xref: /netbsd/sys/dev/pcmcia/pcmcia_cis.c (revision c4a72b64)
1 /*	$NetBSD: pcmcia_cis.c,v 1.31 2002/08/15 10:37:02 christos Exp $	*/
2 
3 /*
4  * Copyright (c) 1997 Marc Horowitz.  All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. All advertising materials mentioning features or use of this software
15  *    must display the following acknowledgement:
16  *	This product includes software developed by Marc Horowitz.
17  * 4. The name of the author may not be used to endorse or promote products
18  *    derived from this software without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
21  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
22  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
23  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
25  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
27  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 #include <sys/cdefs.h>
33 __KERNEL_RCSID(0, "$NetBSD: pcmcia_cis.c,v 1.31 2002/08/15 10:37:02 christos Exp $");
34 
35 #include <sys/param.h>
36 #include <sys/systm.h>
37 #include <sys/device.h>
38 #include <sys/malloc.h>
39 
40 #include <dev/pcmcia/pcmciareg.h>
41 #include <dev/pcmcia/pcmciachip.h>
42 #include <dev/pcmcia/pcmciavar.h>
43 
44 #ifdef PCMCIACISDEBUG
45 int	pcmciacis_debug = 0;
46 #define	DPRINTF(arg) if (pcmciacis_debug) printf arg
47 #else
48 #define	DPRINTF(arg)
49 #endif
50 
51 #define	PCMCIA_CIS_SIZE		1024
52 
53 struct cis_state {
54 	int	count;
55 	int	gotmfc;
56 	struct pcmcia_config_entry temp_cfe;
57 	struct pcmcia_config_entry *default_cfe;
58 	struct pcmcia_card *card;
59 	struct pcmcia_function *pf;
60 };
61 
62 int	pcmcia_parse_cis_tuple __P((struct pcmcia_tuple *, void *));
63 static int decode_funce __P((struct pcmcia_tuple *, struct pcmcia_function *));
64 static void create_pf __P((struct cis_state *));
65 
66 
67 static void
68 create_pf(struct cis_state *state)
69 {
70 	state->pf = malloc(sizeof(*state->pf), M_DEVBUF, M_NOWAIT|M_ZERO);
71 	state->pf->number = state->count++;
72 	state->pf->last_config_index = -1;
73 	SIMPLEQ_INIT(&state->pf->cfe_head);
74 	SIMPLEQ_INSERT_TAIL(&state->card->pf_head, state->pf, pf_list);
75 }
76 
77 void
78 pcmcia_free_pf(struct pcmcia_function_head *pfhead)
79 {
80 	struct pcmcia_function *pf, *opf = NULL;
81 	struct pcmcia_config_entry *cfe, *ocfe = NULL;
82 
83 	SIMPLEQ_FOREACH(pf, pfhead, pf_list) {
84 		SIMPLEQ_FOREACH(cfe, &pf->cfe_head, cfe_list) {
85 			if (ocfe)
86 				free(ocfe, M_DEVBUF);
87 			ocfe = cfe;
88 		}
89 		if (ocfe) {
90 			free(ocfe, M_DEVBUF);
91 			ocfe = NULL;
92 		}
93 		if (opf)
94 			free(opf, M_DEVBUF);
95 		opf = pf;
96 	}
97 	if (opf)
98 		free(opf, M_DEVBUF);
99 
100 	SIMPLEQ_INIT(pfhead);
101 }
102 
103 void
104 pcmcia_read_cis(sc)
105 	struct pcmcia_softc *sc;
106 {
107 	struct cis_state state;
108 
109 	memset(&state, 0, sizeof state);
110 
111 	state.card = &sc->card;
112 
113 	state.card->error = 0;
114 	state.card->cis1_major = -1;
115 	state.card->cis1_minor = -1;
116 	state.card->cis1_info[0] = NULL;
117 	state.card->cis1_info[1] = NULL;
118 	state.card->cis1_info[2] = NULL;
119 	state.card->cis1_info[3] = NULL;
120 	state.card->manufacturer = PCMCIA_VENDOR_INVALID;
121 	state.card->product = PCMCIA_PRODUCT_INVALID;
122 	SIMPLEQ_INIT(&state.card->pf_head);
123 
124 	state.pf = NULL;
125 
126 	if (pcmcia_scan_cis((struct device *)sc, pcmcia_parse_cis_tuple,
127 	    &state) == -1)
128 		state.card->error++;
129 }
130 
131 int
132 pcmcia_scan_cis(dev, fct, arg)
133 	struct device *dev;
134 	int (*fct) __P((struct pcmcia_tuple *, void *));
135 	void *arg;
136 {
137 	struct pcmcia_softc *sc = (struct pcmcia_softc *) dev;
138 	pcmcia_chipset_tag_t pct;
139 	pcmcia_chipset_handle_t pch;
140 	int window;
141 	struct pcmcia_mem_handle pcmh;
142 	struct pcmcia_tuple tuple;
143 	int longlink_present;
144 	int longlink_common;
145 	u_long longlink_addr;
146 	int mfc_count;
147 	int mfc_index;
148 	struct {
149 		int	common;
150 		u_long	addr;
151 	} mfc[256 / 5];
152 	int ret;
153 
154 	ret = 0;
155 
156 	pct = sc->pct;
157 	pch = sc->pch;
158 
159 	/* allocate some memory */
160 
161 	if (pcmcia_chip_mem_alloc(pct, pch, PCMCIA_CIS_SIZE, &pcmh)) {
162 #ifdef DIAGNOSTIC
163 		printf("%s: can't alloc memory to read attributes\n",
164 		    sc->dev.dv_xname);
165 #endif
166 		return -1;
167 	}
168 	/* initialize state for the primary tuple chain */
169 	if (pcmcia_chip_mem_map(pct, pch, PCMCIA_MEM_ATTR, 0,
170 	    PCMCIA_CIS_SIZE, &pcmh, &tuple.ptr, &window)) {
171 		pcmcia_chip_mem_free(pct, pch, &pcmh);
172 #ifdef DIAGNOSTIC
173 		printf("%s: can't map memory to read attributes\n",
174 		    sc->dev.dv_xname);
175 #endif
176 		return -1;
177 	}
178 	tuple.memt = pcmh.memt;
179 	tuple.memh = pcmh.memh;
180 
181 	DPRINTF(("cis mem map %x\n", (unsigned int) tuple.memh));
182 
183 	tuple.mult = 2;
184 
185 	longlink_present = 1;
186 	longlink_common = 1;
187 	longlink_addr = 0;
188 
189 	mfc_count = 0;
190 	mfc_index = 0;
191 
192 	DPRINTF(("%s: CIS tuple chain:\n", sc->dev.dv_xname));
193 
194 	while (1) {
195 		while (1) {
196 			/*
197 			 * Perform boundary check for insane cards.
198 			 * If CIS is too long, simulate CIS end.
199 			 * (This check may not be sufficient for
200 			 * malicious cards.)
201 			 */
202 			if (tuple.mult * tuple.ptr >= PCMCIA_CIS_SIZE - 1
203 			    - 32 /* ad hoc value */ ) {
204 				DPRINTF(("CISTPL_END (too long CIS)\n"));
205 				tuple.code = PCMCIA_CISTPL_END;
206 				goto cis_end;
207 			}
208 
209 			/* get the tuple code */
210 
211 			DELAY(1000);
212 			tuple.code = pcmcia_cis_read_1(&tuple, tuple.ptr);
213 
214 			/* two special-case tuples */
215 
216 			if (tuple.code == PCMCIA_CISTPL_NULL) {
217 				DPRINTF(("CISTPL_NONE\n 00\n"));
218 				tuple.ptr++;
219 				continue;
220 			} else if (tuple.code == PCMCIA_CISTPL_END) {
221 				DPRINTF(("CISTPL_END\n ff\n"));
222 			cis_end:
223 				/* Call the function for the END tuple, since
224 				   the CIS semantics depend on it */
225 				if ((*fct) (&tuple, arg)) {
226 					pcmcia_chip_mem_unmap(pct, pch,
227 							      window);
228 					ret = 1;
229 					goto done;
230 				}
231 				tuple.ptr++;
232 				break;
233 			}
234 			/* now all the normal tuples */
235 
236 			DELAY(1250);
237 			tuple.length = pcmcia_cis_read_1(&tuple, tuple.ptr + 1);
238 			switch (tuple.code) {
239 			case PCMCIA_CISTPL_LONGLINK_A:
240 			case PCMCIA_CISTPL_LONGLINK_C:
241 				if (tuple.length < 4) {
242 					DPRINTF(("CISTPL_LONGLINK_%s too "
243 					    "short %d\n",
244 					    longlink_common ? "C" : "A",
245 					    tuple.length));
246 					break;
247 				}
248 				longlink_present = 1;
249 				longlink_common = (tuple.code ==
250 				    PCMCIA_CISTPL_LONGLINK_C) ? 1 : 0;
251 				longlink_addr = pcmcia_tuple_read_4(&tuple, 0);
252 				DPRINTF(("CISTPL_LONGLINK_%s %lx\n",
253 				    longlink_common ? "C" : "A",
254 				    longlink_addr));
255 				break;
256 			case PCMCIA_CISTPL_NO_LINK:
257 				longlink_present = 0;
258 				DPRINTF(("CISTPL_NO_LINK\n"));
259 				break;
260 			case PCMCIA_CISTPL_CHECKSUM:
261 				if (tuple.length < 5) {
262 					DPRINTF(("CISTPL_CHECKSUM too "
263 					    "short %d\n", tuple.length));
264 					break;
265 				} {
266 					int16_t offset;
267 					u_long addr, length;
268 					u_int cksum, sum;
269 					int i;
270 
271 					*((u_int16_t *) & offset) =
272 					    pcmcia_tuple_read_2(&tuple, 0);
273 					DELAY(500);
274 					length = pcmcia_tuple_read_2(&tuple, 2);
275 					DELAY(500);
276 					cksum = pcmcia_tuple_read_1(&tuple, 4);
277 
278 					addr = tuple.ptr + offset;
279 
280 					DPRINTF(("CISTPL_CHECKSUM addr=%lx "
281 					    "len=%lx cksum=%x",
282 					    addr, length, cksum));
283 
284 					/*
285 					 * XXX do more work to deal with
286 					 * distant regions
287 					 */
288 					if ((addr >= PCMCIA_CIS_SIZE) ||
289 					    ((addr + length) < 0) ||
290 					    ((addr + length) >=
291 					      PCMCIA_CIS_SIZE)) {
292 						DPRINTF((" skipped, "
293 						    "too distant\n"));
294 						break;
295 					}
296 					sum = 0;
297 					for (i = 0; i < length; i++)
298 						sum +=
299 						    bus_space_read_1(tuple.memt,
300 						    tuple.memh,
301 						    addr + tuple.mult * i);
302 					if (cksum != (sum & 0xff)) {
303 						DPRINTF((" failed sum=%x\n",
304 						    sum));
305 						printf("%s: CIS checksum "
306 						    "failed\n",
307 						    sc->dev.dv_xname);
308 #if 0
309 						/*
310 						 * XXX Some working cards have
311 						 * XXX bad checksums!!
312 						 */
313 						ret = -1;
314 #endif
315 					} else {
316 						DPRINTF((" ok\n"));
317 					}
318 				}
319 				break;
320 			case PCMCIA_CISTPL_LONGLINK_MFC:
321 				if (tuple.length < 1) {
322 					DPRINTF(("CISTPL_LONGLINK_MFC too "
323 					    "short %d\n", tuple.length));
324 					break;
325 				}
326 				if (((tuple.length - 1) % 5) != 0) {
327 					DPRINTF(("CISTPL_LONGLINK_MFC bogus "
328 					    "length %d\n", tuple.length));
329 					break;
330 				}
331 				/*
332 				 * this is kind of ad hoc, as I don't have
333 				 * any real documentation
334 				 */
335 				{
336 					int i, tmp_count;
337 
338 					/*
339 					 * put count into tmp var so that
340 					 * if we have to bail (because it's
341 					 * a bogus count) it won't be
342 					 * remembered for later use.
343 					 */
344 					tmp_count =
345 					    pcmcia_tuple_read_1(&tuple, 0);
346 					DPRINTF(("CISTPL_LONGLINK_MFC %d",
347 					    tmp_count));
348 
349 					/*
350 					 * make _sure_ it's the right size;
351 					 * if too short, it may be a weird
352 					 * (unknown/undefined) format
353 					 */
354 					if (tuple.length != (tmp_count*5 + 1)) {
355 						DPRINTF((" bogus length %d\n",
356 						    tuple.length));
357 						break;
358 					}
359 
360 #ifdef PCMCIACISDEBUG	/* maybe enable all the time? */
361 					/*
362 					 * sanity check for a programming
363 					 * error which is difficult to find
364 					 * when debugging.
365 					 */
366 					if (tmp_count >
367 					    howmany(sizeof mfc, sizeof mfc[0]))
368 						panic("CISTPL_LONGLINK_MFC mfc "
369 						    "count would blow stack");
370 #endif
371 
372 					mfc_count = tmp_count;
373 					for (i = 0; i < mfc_count; i++) {
374 						mfc[i].common =
375 						    (pcmcia_tuple_read_1(&tuple,
376 						    1 + 5 * i) ==
377 						    PCMCIA_MFC_MEM_COMMON) ?
378 						    1 : 0;
379 						mfc[i].addr =
380 						    pcmcia_tuple_read_4(&tuple,
381 						    1 + 5 * i + 1);
382 						DPRINTF((" %s:%lx",
383 						    mfc[i].common ? "common" :
384 						    "attr", mfc[i].addr));
385 					}
386 					DPRINTF(("\n"));
387 				}
388 				/*
389 				 * for LONGLINK_MFC, fall through to the
390 				 * function.  This tuple has structural and
391 				 * semantic content.
392 				 */
393 			default:
394 				{
395 					if ((*fct) (&tuple, arg)) {
396 						pcmcia_chip_mem_unmap(pct,
397 						    pch, window);
398 						ret = 1;
399 						goto done;
400 					}
401 				}
402 				break;
403 			}	/* switch */
404 #ifdef PCMCIACISDEBUG
405 			/* print the tuple */
406 			{
407 				int i;
408 
409 				DPRINTF((" %02x %02x", tuple.code,
410 				    tuple.length));
411 
412 				for (i = 0; i < tuple.length; i++) {
413 					DPRINTF((" %02x",
414 					    pcmcia_tuple_read_1(&tuple, i)));
415 					if ((i % 16) == 13)
416 						DPRINTF(("\n"));
417 				}
418 				if ((i % 16) != 14)
419 					DPRINTF(("\n"));
420 			}
421 #endif
422 			/* skip to the next tuple */
423 			tuple.ptr += 2 + tuple.length;
424 		}
425 
426 		/*
427 		 * the chain is done.  Clean up and move onto the next one,
428 		 * if any.  The loop is here in the case that there is an MFC
429 		 * card with no longlink (which defaults to existing, == 0).
430 		 * In general, this means that if one pointer fails, it will
431 		 * try the next one, instead of just bailing.
432 		 */
433 
434 		while (1) {
435 			pcmcia_chip_mem_unmap(pct, pch, window);
436 
437 			if (longlink_present) {
438 				/*
439 				 * if the longlink is to attribute memory,
440 				 * then it is unindexed.  That is, if the
441 				 * link value is 0x100, then the actual
442 				 * memory address is 0x200.  This means that
443 				 * we need to multiply by 2 before calling
444 				 * mem_map, and then divide the resulting ptr
445 				 * by 2 after.
446 				 */
447 
448 				if (!longlink_common)
449 					longlink_addr *= 2;
450 
451 				pcmcia_chip_mem_map(pct, pch, longlink_common ?
452 				    (PCMCIA_WIDTH_MEM8 | PCMCIA_MEM_COMMON) :
453 				    PCMCIA_MEM_ATTR,
454 				    longlink_addr, PCMCIA_CIS_SIZE,
455 				    &pcmh, &tuple.ptr, &window);
456 
457 				if (!longlink_common)
458 					tuple.ptr /= 2;
459 
460 				DPRINTF(("cis mem map %x\n",
461 				    (unsigned int) tuple.memh));
462 
463 				tuple.mult = longlink_common ? 1 : 2;
464 				longlink_present = 0;
465 				longlink_common = 1;
466 				longlink_addr = 0;
467 			} else if (mfc_count && (mfc_index < mfc_count)) {
468 				if (!mfc[mfc_index].common)
469 					mfc[mfc_index].addr *= 2;
470 
471 				pcmcia_chip_mem_map(pct, pch,
472 				    mfc[mfc_index].common ?
473 				    (PCMCIA_WIDTH_MEM8 | PCMCIA_MEM_COMMON) :
474 				    PCMCIA_MEM_ATTR,
475 				    mfc[mfc_index].addr, PCMCIA_CIS_SIZE,
476 				    &pcmh, &tuple.ptr, &window);
477 
478 				if (!mfc[mfc_index].common)
479 					tuple.ptr /= 2;
480 
481 				DPRINTF(("cis mem map %x\n",
482 				    (unsigned int) tuple.memh));
483 
484 				/* set parse state, and point at the next one */
485 
486 				tuple.mult = mfc[mfc_index].common ? 1 : 2;
487 
488 				mfc_index++;
489 			} else {
490 				goto done;
491 			}
492 
493 			/* make sure that the link is valid */
494 			tuple.code = pcmcia_cis_read_1(&tuple, tuple.ptr);
495 			if (tuple.code != PCMCIA_CISTPL_LINKTARGET) {
496 				DPRINTF(("CISTPL_LINKTARGET expected, "
497 				    "code %02x observed\n", tuple.code));
498 				continue;
499 			}
500 			tuple.length = pcmcia_cis_read_1(&tuple, tuple.ptr + 1);
501 			if (tuple.length < 3) {
502 				DPRINTF(("CISTPL_LINKTARGET too short %d\n",
503 				    tuple.length));
504 				continue;
505 			}
506 			if ((pcmcia_tuple_read_1(&tuple, 0) != 'C') ||
507 			    (pcmcia_tuple_read_1(&tuple, 1) != 'I') ||
508 			    (pcmcia_tuple_read_1(&tuple, 2) != 'S')) {
509 				DPRINTF(("CISTPL_LINKTARGET magic "
510 				    "%02x%02x%02x incorrect\n",
511 				    pcmcia_tuple_read_1(&tuple, 0),
512 				    pcmcia_tuple_read_1(&tuple, 1),
513 				    pcmcia_tuple_read_1(&tuple, 2)));
514 				continue;
515 			}
516 			tuple.ptr += 2 + tuple.length;
517 
518 			break;
519 		}
520 	}
521 
522 	pcmcia_chip_mem_unmap(pct, pch, window);
523 
524 done:
525 	/* Last, free the allocated memory block */
526 	pcmcia_chip_mem_free(pct, pch, &pcmh);
527 
528 	return (ret);
529 }
530 
531 /* XXX this is incredibly verbose.  Not sure what trt is */
532 
533 void
534 pcmcia_print_cis(sc)
535 	struct pcmcia_softc *sc;
536 {
537 	struct pcmcia_card *card = &sc->card;
538 	struct pcmcia_function *pf;
539 	struct pcmcia_config_entry *cfe;
540 	int i;
541 
542 	printf("%s: CIS version ", sc->dev.dv_xname);
543 	if (card->cis1_major == 4) {
544 		if (card->cis1_minor == 0)
545 			printf("PCMCIA 1.0\n");
546 		else if (card->cis1_minor == 1)
547 			printf("PCMCIA 2.0 or 2.1\n");
548 	} else if (card->cis1_major >= 5)
549 		printf("PC Card Standard %d.%d\n", card->cis1_major, card->cis1_minor);
550 	else
551 		printf("unknown (major=%d, minor=%d)\n",
552 		    card->cis1_major, card->cis1_minor);
553 
554 	printf("%s: CIS info: ", sc->dev.dv_xname);
555 	for (i = 0; i < 4; i++) {
556 		if (card->cis1_info[i] == NULL)
557 			break;
558 		if (i)
559 			printf(", ");
560 		printf("%s", card->cis1_info[i]);
561 	}
562 	printf("\n");
563 
564 	printf("%s: Manufacturer code 0x%x, product 0x%x\n",
565 	       sc->dev.dv_xname, card->manufacturer, card->product);
566 
567 	SIMPLEQ_FOREACH(pf, &card->pf_head, pf_list) {
568 		printf("%s: function %d: ", sc->dev.dv_xname, pf->number);
569 
570 		switch (pf->function) {
571 		case PCMCIA_FUNCTION_UNSPEC:
572 			printf("unspecified");
573 			break;
574 		case PCMCIA_FUNCTION_MULTIFUNCTION:
575 			printf("multi-function");
576 			break;
577 		case PCMCIA_FUNCTION_MEMORY:
578 			printf("memory");
579 			break;
580 		case PCMCIA_FUNCTION_SERIAL:
581 			printf("serial port");
582 			break;
583 		case PCMCIA_FUNCTION_PARALLEL:
584 			printf("parallel port");
585 			break;
586 		case PCMCIA_FUNCTION_DISK:
587 			printf("fixed disk");
588 			switch (pf->pf_funce_disk_interface) {
589 			case PCMCIA_TPLFE_DDI_PCCARD_ATA:
590 				printf("(ata)");
591 				break;
592 			default:
593 				break;
594 			}
595 			break;
596 		case PCMCIA_FUNCTION_VIDEO:
597 			printf("video adapter");
598 			break;
599 		case PCMCIA_FUNCTION_NETWORK:
600 			printf("network adapter");
601 			break;
602 		case PCMCIA_FUNCTION_AIMS:
603 			printf("auto incrementing mass storage");
604 			break;
605 		case PCMCIA_FUNCTION_SCSI:
606 			printf("SCSI bridge");
607 			break;
608 		case PCMCIA_FUNCTION_SECURITY:
609 			printf("Security services");
610 			break;
611 		case PCMCIA_FUNCTION_INSTRUMENT:
612 			printf("Instrument");
613 			break;
614 		default:
615 			printf("unknown (%d)", pf->function);
616 			break;
617 		}
618 
619 		printf(", ccr addr %lx mask %lx\n", pf->ccr_base, pf->ccr_mask);
620 
621 		SIMPLEQ_FOREACH(cfe, &pf->cfe_head, cfe_list) {
622 			printf("%s: function %d, config table entry %d: ",
623 			    sc->dev.dv_xname, pf->number, cfe->number);
624 
625 			switch (cfe->iftype) {
626 			case PCMCIA_IFTYPE_MEMORY:
627 				printf("memory card");
628 				break;
629 			case PCMCIA_IFTYPE_IO:
630 				printf("I/O card");
631 				break;
632 			default:
633 				printf("card type unknown");
634 				break;
635 			}
636 
637 			printf("; irq mask %x", cfe->irqmask);
638 
639 			if (cfe->num_iospace) {
640 				printf("; iomask %lx, iospace", cfe->iomask);
641 
642 				for (i = 0; i < cfe->num_iospace; i++) {
643 					printf(" %lx", cfe->iospace[i].start);
644 					if (cfe->iospace[i].length)
645 						printf("-%lx",
646 						    cfe->iospace[i].start +
647 						    cfe->iospace[i].length - 1);
648 				}
649 			}
650 			if (cfe->num_memspace) {
651 				printf("; memspace");
652 
653 				for (i = 0; i < cfe->num_memspace; i++) {
654 					printf(" %lx",
655 					    cfe->memspace[i].cardaddr);
656 					if (cfe->memspace[i].length)
657 						printf("-%lx",
658 						    cfe->memspace[i].cardaddr +
659 						    cfe->memspace[i].length - 1);
660 					if (cfe->memspace[i].hostaddr)
661 						printf("@%lx",
662 						    cfe->memspace[i].hostaddr);
663 				}
664 			}
665 			if (cfe->maxtwins)
666 				printf("; maxtwins %d", cfe->maxtwins);
667 
668 			printf(";");
669 
670 			if (cfe->flags & PCMCIA_CFE_MWAIT_REQUIRED)
671 				printf(" mwait_required");
672 			if (cfe->flags & PCMCIA_CFE_RDYBSY_ACTIVE)
673 				printf(" rdybsy_active");
674 			if (cfe->flags & PCMCIA_CFE_WP_ACTIVE)
675 				printf(" wp_active");
676 			if (cfe->flags & PCMCIA_CFE_BVD_ACTIVE)
677 				printf(" bvd_active");
678 			if (cfe->flags & PCMCIA_CFE_IO8)
679 				printf(" io8");
680 			if (cfe->flags & PCMCIA_CFE_IO16)
681 				printf(" io16");
682 			if (cfe->flags & PCMCIA_CFE_IRQSHARE)
683 				printf(" irqshare");
684 			if (cfe->flags & PCMCIA_CFE_IRQPULSE)
685 				printf(" irqpulse");
686 			if (cfe->flags & PCMCIA_CFE_IRQLEVEL)
687 				printf(" irqlevel");
688 			if (cfe->flags & PCMCIA_CFE_POWERDOWN)
689 				printf(" powerdown");
690 			if (cfe->flags & PCMCIA_CFE_READONLY)
691 				printf(" readonly");
692 			if (cfe->flags & PCMCIA_CFE_AUDIO)
693 				printf(" audio");
694 
695 			printf("\n");
696 		}
697 	}
698 
699 	if (card->error)
700 		printf("%s: %d errors found while parsing CIS\n",
701 		    sc->dev.dv_xname, card->error);
702 }
703 
704 int
705 pcmcia_parse_cis_tuple(tuple, arg)
706 	struct pcmcia_tuple *tuple;
707 	void *arg;
708 {
709 	/* most of these are educated guesses */
710 	static struct pcmcia_config_entry init_cfe = {
711 		-1, PCMCIA_CFE_RDYBSY_ACTIVE | PCMCIA_CFE_WP_ACTIVE |
712 		PCMCIA_CFE_BVD_ACTIVE, PCMCIA_IFTYPE_MEMORY,
713 	};
714 
715 	struct cis_state *state = arg;
716 
717 	switch (tuple->code) {
718 	case PCMCIA_CISTPL_END:
719 		/* if we've seen a LONGLINK_MFC, and this is the first
720 		 * END after it, reset the function list.
721 		 *
722 		 * XXX This might also be the right place to start a
723 		 * new function, but that assumes that a function
724 		 * definition never crosses any longlink, and I'm not
725 		 * sure about that.  This is probably safe for MFC
726 		 * cards, but what we have now isn't broken, so I'd
727 		 * rather not change it.
728 		 */
729 		if (state->gotmfc == 1) {
730 			state->gotmfc = 2;
731 			state->count = 0;
732 			state->pf = NULL;
733 
734 			pcmcia_free_pf(&state->card->pf_head);
735 		}
736 		break;
737 	case PCMCIA_CISTPL_LONGLINK_MFC:
738 		/*
739 		 * this tuple's structure was dealt with in scan_cis.  here,
740 		 * record the fact that the MFC tuple was seen, so that
741 		 * functions declared before the MFC link can be cleaned
742 		 * up.
743 		 */
744 		if (state->gotmfc == 0) {
745 			state->gotmfc = 1;
746 		} else {
747 			DPRINTF(("got LONGLINK_MFC again!"));
748 		}
749 		break;
750 #ifdef PCMCIACISDEBUG
751 	case PCMCIA_CISTPL_DEVICE:
752 	case PCMCIA_CISTPL_DEVICE_A:
753 		{
754 			u_int reg, dtype, dspeed;
755 
756 			reg = pcmcia_tuple_read_1(tuple, 0);
757 			dtype = reg & PCMCIA_DTYPE_MASK;
758 			dspeed = reg & PCMCIA_DSPEED_MASK;
759 
760 			DPRINTF(("CISTPL_DEVICE%s type=",
761 			(tuple->code == PCMCIA_CISTPL_DEVICE) ? "" : "_A"));
762 			switch (dtype) {
763 			case PCMCIA_DTYPE_NULL:
764 				DPRINTF(("null"));
765 				break;
766 			case PCMCIA_DTYPE_ROM:
767 				DPRINTF(("rom"));
768 				break;
769 			case PCMCIA_DTYPE_OTPROM:
770 				DPRINTF(("otprom"));
771 				break;
772 			case PCMCIA_DTYPE_EPROM:
773 				DPRINTF(("eprom"));
774 				break;
775 			case PCMCIA_DTYPE_EEPROM:
776 				DPRINTF(("eeprom"));
777 				break;
778 			case PCMCIA_DTYPE_FLASH:
779 				DPRINTF(("flash"));
780 				break;
781 			case PCMCIA_DTYPE_SRAM:
782 				DPRINTF(("sram"));
783 				break;
784 			case PCMCIA_DTYPE_DRAM:
785 				DPRINTF(("dram"));
786 				break;
787 			case PCMCIA_DTYPE_FUNCSPEC:
788 				DPRINTF(("funcspec"));
789 				break;
790 			case PCMCIA_DTYPE_EXTEND:
791 				DPRINTF(("extend"));
792 				break;
793 			default:
794 				DPRINTF(("reserved"));
795 				break;
796 			}
797 			DPRINTF((" speed="));
798 			switch (dspeed) {
799 			case PCMCIA_DSPEED_NULL:
800 				DPRINTF(("null"));
801 				break;
802 			case PCMCIA_DSPEED_250NS:
803 				DPRINTF(("250ns"));
804 				break;
805 			case PCMCIA_DSPEED_200NS:
806 				DPRINTF(("200ns"));
807 				break;
808 			case PCMCIA_DSPEED_150NS:
809 				DPRINTF(("150ns"));
810 				break;
811 			case PCMCIA_DSPEED_100NS:
812 				DPRINTF(("100ns"));
813 				break;
814 			case PCMCIA_DSPEED_EXT:
815 				DPRINTF(("ext"));
816 				break;
817 			default:
818 				DPRINTF(("reserved"));
819 				break;
820 			}
821 		}
822 		DPRINTF(("\n"));
823 		break;
824 #endif
825 	case PCMCIA_CISTPL_VERS_1:
826 		if (tuple->length < 6) {
827 			DPRINTF(("CISTPL_VERS_1 too short %d\n",
828 			    tuple->length));
829 			break;
830 		} {
831 			int start, i, ch, count;
832 
833 			state->card->cis1_major = pcmcia_tuple_read_1(tuple, 0);
834 			state->card->cis1_minor = pcmcia_tuple_read_1(tuple, 1);
835 
836 			for (count = 0, start = 0, i = 0;
837 			    (count < 4) && ((i + 4) < 256); i++) {
838 				ch = pcmcia_tuple_read_1(tuple, 2 + i);
839 				if (ch == 0xff) {
840 					if (i > start) {
841 						state->card->cis1_info_buf[i] = 0;
842 						state->card->cis1_info[count] =
843 						    state->card->cis1_info_buf + start;
844 					}
845 					break;
846 				}
847 				state->card->cis1_info_buf[i] = ch;
848 				if (ch == 0) {
849 					state->card->cis1_info[count] =
850 					    state->card->cis1_info_buf + start;
851 					start = i + 1;
852 					count++;
853 				}
854 			}
855 			DPRINTF(("CISTPL_VERS_1\n"));
856 		}
857 		break;
858 	case PCMCIA_CISTPL_MANFID:
859 		if (tuple->length < 4) {
860 			DPRINTF(("CISTPL_MANFID too short %d\n",
861 			    tuple->length));
862 			break;
863 		}
864 		state->card->manufacturer = pcmcia_tuple_read_2(tuple, 0);
865 		state->card->product = pcmcia_tuple_read_2(tuple, 2);
866 		DPRINTF(("CISTPL_MANFID\n"));
867 		break;
868 	case PCMCIA_CISTPL_FUNCID:
869 		if (tuple->length < 1) {
870 			DPRINTF(("CISTPL_FUNCID too short %d\n",
871 			    tuple->length));
872 			break;
873 		}
874 		if (state->pf) {
875 			if (state->pf->function == PCMCIA_FUNCTION_UNSPEC) {
876 				/*
877 				 * This looks like a opportunistic function
878 				 * created by a CONFIG tuple.  Just keep it.
879 				 */
880 			} else {
881 				/*
882 				 * A function is being defined, end it.
883 				 */
884 				state->pf = NULL;
885 			}
886 		}
887 		if (state->pf == NULL)
888 			create_pf(state);
889 		state->pf->function = pcmcia_tuple_read_1(tuple, 0);
890 
891 		DPRINTF(("CISTPL_FUNCID\n"));
892 		break;
893 	case PCMCIA_CISTPL_FUNCE:
894 		if (state->pf == NULL || state->pf->function <= 0) {
895 			DPRINTF(("CISTPL_FUNCE is not followed by "
896 			    "valid CISTPL_FUNCID\n"));
897 			break;
898 		}
899 		if (tuple->length >= 2) {
900 			decode_funce(tuple, state->pf);
901 		}
902 		break;
903 	case PCMCIA_CISTPL_CONFIG:
904 		if (tuple->length < 3) {
905 			DPRINTF(("CISTPL_CONFIG too short %d\n",
906 			    tuple->length));
907 			break;
908 		} {
909 			u_int reg, rasz, rmsz, rfsz;
910 			int i;
911 
912 			reg = pcmcia_tuple_read_1(tuple, 0);
913 			rasz = 1 + ((reg & PCMCIA_TPCC_RASZ_MASK) >>
914 			    PCMCIA_TPCC_RASZ_SHIFT);
915 			rmsz = 1 + ((reg & PCMCIA_TPCC_RMSZ_MASK) >>
916 			    PCMCIA_TPCC_RMSZ_SHIFT);
917 			rfsz = ((reg & PCMCIA_TPCC_RFSZ_MASK) >>
918 			    PCMCIA_TPCC_RFSZ_SHIFT);
919 
920 			if (tuple->length < (rasz + rmsz + rfsz)) {
921 				DPRINTF(("CISTPL_CONFIG (%d,%d,%d) too "
922 				    "short %d\n", rasz, rmsz, rfsz,
923 				    tuple->length));
924 				break;
925 			}
926 			if (state->pf == NULL) {
927 				create_pf(state);
928 				state->pf->function = PCMCIA_FUNCTION_UNSPEC;
929 			}
930 			state->pf->last_config_index =
931 			    pcmcia_tuple_read_1(tuple, 1);
932 
933 			state->pf->ccr_base = 0;
934 			for (i = 0; i < rasz; i++)
935 				state->pf->ccr_base |=
936 				    ((pcmcia_tuple_read_1(tuple, 2 + i)) <<
937 				    (i * 8));
938 
939 			state->pf->ccr_mask = 0;
940 			for (i = 0; i < rmsz; i++)
941 				state->pf->ccr_mask |=
942 				    ((pcmcia_tuple_read_1(tuple,
943 				    2 + rasz + i)) << (i * 8));
944 
945 			/* skip the reserved area and subtuples */
946 
947 			/* reset the default cfe for each cfe list */
948 			state->temp_cfe = init_cfe;
949 			state->default_cfe = &state->temp_cfe;
950 		}
951 		DPRINTF(("CISTPL_CONFIG\n"));
952 		break;
953 	case PCMCIA_CISTPL_CFTABLE_ENTRY:
954 		{
955 			int idx, i, j;
956 			u_int reg, reg2;
957 			u_int intface, def, num;
958 			u_int power, timing, iospace, irq, memspace, misc;
959 			struct pcmcia_config_entry *cfe;
960 
961 			idx = 0;
962 
963 			reg = pcmcia_tuple_read_1(tuple, idx);
964 			idx++;
965 			intface = reg & PCMCIA_TPCE_INDX_INTFACE;
966 			def = reg & PCMCIA_TPCE_INDX_DEFAULT;
967 			num = reg & PCMCIA_TPCE_INDX_NUM_MASK;
968 
969 			/*
970 			 * this is a little messy.  Some cards have only a
971 			 * cfentry with the default bit set.  So, as we go
972 			 * through the list, we add new indexes to the queue,
973 			 * and keep a pointer to the last one with the
974 			 * default bit set.  if we see a record with the same
975 			 * index, as the default, we stash the default and
976 			 * replace the queue entry. otherwise, we just add
977 			 * new entries to the queue, pointing the default ptr
978 			 * at them if the default bit is set.  if we get to
979 			 * the end with the default pointer pointing at a
980 			 * record which hasn't had a matching index, that's
981 			 * ok; it just becomes a cfentry like any other.
982 			 */
983 
984 			/*
985 			 * if the index in the cis differs from the default
986 			 * cis, create new entry in the queue and start it
987 			 * with the current default
988 			 */
989 			if (state->default_cfe == NULL) {
990 				DPRINTF(("CISTPL_CFTABLE_ENTRY with no "
991 				    "default\n"));
992 				break;
993 			}
994 			if (num != state->default_cfe->number) {
995 				cfe = (struct pcmcia_config_entry *)
996 				    malloc(sizeof(*cfe), M_DEVBUF, M_NOWAIT);
997 
998 				*cfe = *state->default_cfe;
999 
1000 				SIMPLEQ_INSERT_TAIL(&state->pf->cfe_head,
1001 				    cfe, cfe_list);
1002 
1003 				cfe->number = num;
1004 
1005 				/*
1006 				 * if the default bit is set in the cis, then
1007 				 * point the new default at whatever is being
1008 				 * filled in
1009 				 */
1010 				if (def)
1011 					state->default_cfe = cfe;
1012 			} else {
1013 				/*
1014 				 * the cis index matches the default index,
1015 				 * fill in the default cfentry.  It is
1016 				 * assumed that the cfdefault index is in the
1017 				 * queue.  For it to be otherwise, the cis
1018 				 * index would have to be -1 (initial
1019 				 * condition) which is not possible, or there
1020 				 * would have to be a preceding cis entry
1021 				 * which had the same cis index and had the
1022 				 * default bit unset. Neither condition
1023 				 * should happen.  If it does, this cfentry
1024 				 * is lost (written into temp space), which
1025 				 * is an acceptable failure mode.
1026 				 */
1027 
1028 				cfe = state->default_cfe;
1029 
1030 				/*
1031 				 * if the cis entry does not have the default
1032 				 * bit set, copy the default out of the way
1033 				 * first.
1034 				 */
1035 				if (!def) {
1036 					state->temp_cfe = *state->default_cfe;
1037 					state->default_cfe = &state->temp_cfe;
1038 				}
1039 			}
1040 
1041 			if (intface) {
1042 				reg = pcmcia_tuple_read_1(tuple, idx);
1043 				idx++;
1044 				cfe->flags &= ~(PCMCIA_CFE_MWAIT_REQUIRED
1045 				    | PCMCIA_CFE_RDYBSY_ACTIVE
1046 				    | PCMCIA_CFE_WP_ACTIVE
1047 				    | PCMCIA_CFE_BVD_ACTIVE);
1048 				if (reg & PCMCIA_TPCE_IF_MWAIT)
1049 					cfe->flags |= PCMCIA_CFE_MWAIT_REQUIRED;
1050 				if (reg & PCMCIA_TPCE_IF_RDYBSY)
1051 					cfe->flags |= PCMCIA_CFE_RDYBSY_ACTIVE;
1052 				if (reg & PCMCIA_TPCE_IF_WP)
1053 					cfe->flags |= PCMCIA_CFE_WP_ACTIVE;
1054 				if (reg & PCMCIA_TPCE_IF_BVD)
1055 					cfe->flags |= PCMCIA_CFE_BVD_ACTIVE;
1056 				cfe->iftype = reg & PCMCIA_TPCE_IF_IFTYPE;
1057 			}
1058 			reg = pcmcia_tuple_read_1(tuple, idx);
1059 			idx++;
1060 
1061 			power = reg & PCMCIA_TPCE_FS_POWER_MASK;
1062 			timing = reg & PCMCIA_TPCE_FS_TIMING;
1063 			iospace = reg & PCMCIA_TPCE_FS_IOSPACE;
1064 			irq = reg & PCMCIA_TPCE_FS_IRQ;
1065 			memspace = reg & PCMCIA_TPCE_FS_MEMSPACE_MASK;
1066 			misc = reg & PCMCIA_TPCE_FS_MISC;
1067 
1068 			if (power) {
1069 				/* skip over power, don't save */
1070 				/* for each parameter selection byte */
1071 				for (i = 0; i < power; i++) {
1072 					reg = pcmcia_tuple_read_1(tuple, idx);
1073 					idx++;
1074 					/* for each bit */
1075 					for (j = 0; j < 7; j++) {
1076 						/* if the bit is set */
1077 						if ((reg >> j) & 0x01) {
1078 							/* skip over bytes */
1079 							do {
1080 								reg2 = pcmcia_tuple_read_1(tuple, idx);
1081 								idx++;
1082 								/*
1083 								 * until
1084 								 * non-extensi
1085 								 * on byte
1086 								 */
1087 							} while (reg2 & 0x80);
1088 						}
1089 					}
1090 				}
1091 			}
1092 			if (timing) {
1093 				/* skip over timing, don't save */
1094 				reg = pcmcia_tuple_read_1(tuple, idx);
1095 				idx++;
1096 
1097 				if ((reg & PCMCIA_TPCE_TD_RESERVED_MASK) !=
1098 				    PCMCIA_TPCE_TD_RESERVED_MASK)
1099 					idx++;
1100 				if ((reg & PCMCIA_TPCE_TD_RDYBSY_MASK) !=
1101 				    PCMCIA_TPCE_TD_RDYBSY_MASK)
1102 					idx++;
1103 				if ((reg & PCMCIA_TPCE_TD_WAIT_MASK) !=
1104 				    PCMCIA_TPCE_TD_WAIT_MASK)
1105 					idx++;
1106 			}
1107 			if (iospace) {
1108 				if (tuple->length <= idx) {
1109 					DPRINTF(("ran out of space before TCPE_IO\n"));
1110 					goto abort_cfe;
1111 				}
1112 
1113 				reg = pcmcia_tuple_read_1(tuple, idx);
1114 				idx++;
1115 
1116 				cfe->flags &=
1117 				    ~(PCMCIA_CFE_IO8 | PCMCIA_CFE_IO16);
1118 				if (reg & PCMCIA_TPCE_IO_BUSWIDTH_8BIT)
1119 					cfe->flags |= PCMCIA_CFE_IO8;
1120 				if (reg & PCMCIA_TPCE_IO_BUSWIDTH_16BIT)
1121 					cfe->flags |= PCMCIA_CFE_IO16;
1122 				cfe->iomask =
1123 				    reg & PCMCIA_TPCE_IO_IOADDRLINES_MASK;
1124 
1125 				if (reg & PCMCIA_TPCE_IO_HASRANGE) {
1126 					reg = pcmcia_tuple_read_1(tuple, idx);
1127 					idx++;
1128 
1129 					cfe->num_iospace = 1 + (reg &
1130 					    PCMCIA_TPCE_IO_RANGE_COUNT);
1131 
1132 					if (cfe->num_iospace >
1133 					    (sizeof(cfe->iospace) /
1134 					     sizeof(cfe->iospace[0]))) {
1135 						DPRINTF(("too many io "
1136 						    "spaces %d",
1137 						    cfe->num_iospace));
1138 						state->card->error++;
1139 						break;
1140 					}
1141 					for (i = 0; i < cfe->num_iospace; i++) {
1142 						switch (reg & PCMCIA_TPCE_IO_RANGE_ADDRSIZE_MASK) {
1143 						case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_ONE:
1144 							cfe->iospace[i].start =
1145 								pcmcia_tuple_read_1(tuple, idx);
1146 							idx++;
1147 							break;
1148 						case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_TWO:
1149 							cfe->iospace[i].start =
1150 								pcmcia_tuple_read_2(tuple, idx);
1151 							idx += 2;
1152 							break;
1153 						case PCMCIA_TPCE_IO_RANGE_ADDRSIZE_FOUR:
1154 							cfe->iospace[i].start =
1155 								pcmcia_tuple_read_4(tuple, idx);
1156 							idx += 4;
1157 							break;
1158 						}
1159 						switch (reg &
1160 							PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_MASK) {
1161 						case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_ONE:
1162 							cfe->iospace[i].length =
1163 								pcmcia_tuple_read_1(tuple, idx);
1164 							idx++;
1165 							break;
1166 						case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_TWO:
1167 							cfe->iospace[i].length =
1168 								pcmcia_tuple_read_2(tuple, idx);
1169 							idx += 2;
1170 							break;
1171 						case PCMCIA_TPCE_IO_RANGE_LENGTHSIZE_FOUR:
1172 							cfe->iospace[i].length =
1173 								pcmcia_tuple_read_4(tuple, idx);
1174 							idx += 4;
1175 							break;
1176 						}
1177 						cfe->iospace[i].length++;
1178 					}
1179 				} else {
1180 					cfe->num_iospace = 1;
1181 					cfe->iospace[0].start = 0;
1182 					cfe->iospace[0].length =
1183 					    (1 << cfe->iomask);
1184 				}
1185 			}
1186 			if (irq) {
1187 				if (tuple->length <= idx) {
1188 					DPRINTF(("ran out of space before TCPE_IR\n"));
1189 					goto abort_cfe;
1190 				}
1191 
1192 				reg = pcmcia_tuple_read_1(tuple, idx);
1193 				idx++;
1194 
1195 				cfe->flags &= ~(PCMCIA_CFE_IRQSHARE
1196 				    | PCMCIA_CFE_IRQPULSE
1197 				    | PCMCIA_CFE_IRQLEVEL);
1198 				if (reg & PCMCIA_TPCE_IR_SHARE)
1199 					cfe->flags |= PCMCIA_CFE_IRQSHARE;
1200 				if (reg & PCMCIA_TPCE_IR_PULSE)
1201 					cfe->flags |= PCMCIA_CFE_IRQPULSE;
1202 				if (reg & PCMCIA_TPCE_IR_LEVEL)
1203 					cfe->flags |= PCMCIA_CFE_IRQLEVEL;
1204 
1205 				if (reg & PCMCIA_TPCE_IR_HASMASK) {
1206 					/*
1207 					 * it's legal to ignore the
1208 					 * special-interrupt bits, so I will
1209 					 */
1210 
1211 					cfe->irqmask =
1212 					    pcmcia_tuple_read_2(tuple, idx);
1213 					idx += 2;
1214 				} else {
1215 					cfe->irqmask =
1216 					    (1 << (reg & PCMCIA_TPCE_IR_IRQ));
1217 				}
1218 			}
1219 			if (memspace) {
1220 				if (tuple->length <= idx) {
1221 					DPRINTF(("ran out of space before TCPE_MS\n"));
1222 					goto abort_cfe;
1223 				}
1224 
1225 				if (memspace == PCMCIA_TPCE_FS_MEMSPACE_NONE) {
1226 					cfe->num_memspace = 0;
1227 				} else if (memspace == PCMCIA_TPCE_FS_MEMSPACE_LENGTH) {
1228 					cfe->num_memspace = 1;
1229 					cfe->memspace[0].length = 256 *
1230 					    pcmcia_tuple_read_2(tuple, idx);
1231 					idx += 2;
1232 					cfe->memspace[0].cardaddr = 0;
1233 					cfe->memspace[0].hostaddr = 0;
1234 				} else if (memspace ==
1235 				    PCMCIA_TPCE_FS_MEMSPACE_LENGTHADDR) {
1236 					cfe->num_memspace = 1;
1237 					cfe->memspace[0].length = 256 *
1238 					    pcmcia_tuple_read_2(tuple, idx);
1239 					idx += 2;
1240 					cfe->memspace[0].cardaddr = 256 *
1241 					    pcmcia_tuple_read_2(tuple, idx);
1242 					idx += 2;
1243 					cfe->memspace[0].hostaddr = cfe->memspace[0].cardaddr;
1244 				} else {
1245 					int lengthsize;
1246 					int cardaddrsize;
1247 					int hostaddrsize;
1248 
1249 					reg = pcmcia_tuple_read_1(tuple, idx);
1250 					idx++;
1251 
1252 					cfe->num_memspace = (reg &
1253 					    PCMCIA_TPCE_MS_COUNT) + 1;
1254 
1255 					if (cfe->num_memspace >
1256 					    (sizeof(cfe->memspace) /
1257 					     sizeof(cfe->memspace[0]))) {
1258 						DPRINTF(("too many mem "
1259 						    "spaces %d",
1260 						    cfe->num_memspace));
1261 						state->card->error++;
1262 						break;
1263 					}
1264 					lengthsize =
1265 						((reg & PCMCIA_TPCE_MS_LENGTH_SIZE_MASK) >>
1266 						 PCMCIA_TPCE_MS_LENGTH_SIZE_SHIFT);
1267 					cardaddrsize =
1268 						((reg & PCMCIA_TPCE_MS_CARDADDR_SIZE_MASK) >>
1269 						 PCMCIA_TPCE_MS_CARDADDR_SIZE_SHIFT);
1270 					hostaddrsize =
1271 						(reg & PCMCIA_TPCE_MS_HOSTADDR) ? cardaddrsize : 0;
1272 
1273 					if (lengthsize == 0) {
1274 						DPRINTF(("cfe memspace "
1275 						    "lengthsize == 0"));
1276 						state->card->error++;
1277 					}
1278 					for (i = 0; i < cfe->num_memspace; i++) {
1279 						if (lengthsize) {
1280 							cfe->memspace[i].length =
1281 								256 * pcmcia_tuple_read_n(tuple, lengthsize,
1282 								       idx);
1283 							idx += lengthsize;
1284 						} else {
1285 							cfe->memspace[i].length = 0;
1286 						}
1287 						if (cfe->memspace[i].length == 0) {
1288 							DPRINTF(("cfe->memspace[%d].length == 0",
1289 								 i));
1290 							state->card->error++;
1291 						}
1292 						if (cardaddrsize) {
1293 							cfe->memspace[i].cardaddr =
1294 								256 * pcmcia_tuple_read_n(tuple, cardaddrsize,
1295 								       idx);
1296 							idx += cardaddrsize;
1297 						} else {
1298 							cfe->memspace[i].cardaddr = 0;
1299 						}
1300 						if (hostaddrsize) {
1301 							cfe->memspace[i].hostaddr =
1302 								256 * pcmcia_tuple_read_n(tuple, hostaddrsize,
1303 								       idx);
1304 							idx += hostaddrsize;
1305 						} else {
1306 							cfe->memspace[i].hostaddr = 0;
1307 						}
1308 					}
1309 				}
1310 			}
1311 			if (misc) {
1312 				if (tuple->length <= idx) {
1313 					DPRINTF(("ran out of space before TCPE_MI\n"));
1314 					goto abort_cfe;
1315 				}
1316 
1317 				reg = pcmcia_tuple_read_1(tuple, idx);
1318 				idx++;
1319 
1320 				cfe->flags &= ~(PCMCIA_CFE_POWERDOWN
1321 				    | PCMCIA_CFE_READONLY
1322 				    | PCMCIA_CFE_AUDIO);
1323 				if (reg & PCMCIA_TPCE_MI_PWRDOWN)
1324 					cfe->flags |= PCMCIA_CFE_POWERDOWN;
1325 				if (reg & PCMCIA_TPCE_MI_READONLY)
1326 					cfe->flags |= PCMCIA_CFE_READONLY;
1327 				if (reg & PCMCIA_TPCE_MI_AUDIO)
1328 					cfe->flags |= PCMCIA_CFE_AUDIO;
1329 				cfe->maxtwins = reg & PCMCIA_TPCE_MI_MAXTWINS;
1330 
1331 				while (reg & PCMCIA_TPCE_MI_EXT) {
1332 					reg = pcmcia_tuple_read_1(tuple, idx);
1333 					idx++;
1334 				}
1335 			}
1336 			/* skip all the subtuples */
1337 		}
1338 
1339 	abort_cfe:
1340 		DPRINTF(("CISTPL_CFTABLE_ENTRY\n"));
1341 		break;
1342 	default:
1343 		DPRINTF(("unhandled CISTPL %x\n", tuple->code));
1344 		break;
1345 	}
1346 
1347 	return (0);
1348 }
1349 
1350 
1351 
1352 static int
1353 decode_funce(tuple, pf)
1354 	struct pcmcia_tuple *tuple;
1355 	struct pcmcia_function *pf;
1356 {
1357 	int type = pcmcia_tuple_read_1(tuple, 0);
1358 
1359 	switch (pf->function) {
1360 	case PCMCIA_FUNCTION_DISK:
1361 		if (type == PCMCIA_TPLFE_TYPE_DISK_DEVICE_INTERFACE) {
1362 			pf->pf_funce_disk_interface
1363 			    = pcmcia_tuple_read_1(tuple, 1);
1364 		}
1365 		break;
1366 	case PCMCIA_FUNCTION_NETWORK:
1367 		if (type == PCMCIA_TPLFE_TYPE_LAN_NID) {
1368 			int i;
1369 			int len = pcmcia_tuple_read_1(tuple, 1);
1370 			if (tuple->length < 2 + len || len > 8) {
1371 				/* tuple length not enough or nid too long */
1372 				break;
1373 			}
1374 			for (i = 0; i < len; ++i) {
1375 				pf->pf_funce_lan_nid[i]
1376 				    = pcmcia_tuple_read_1(tuple, 2 + i);
1377 			}
1378 			pf->pf_funce_lan_nidlen = len;
1379 		}
1380 		break;
1381 	default:
1382 		break;
1383 	}
1384 
1385 	return 0;
1386 }
1387