drivers/mmc/host/vub300.c

   1 /*
   2  * Remote VUB300 SDIO/SDmem Host Controller Driver
   3  *
   4  * Copyright (C) 2010 Elan Digital Systems Limited
   5  *
   6  * based on USB Skeleton driver - 2.2
   7  *
   8  * Copyright (C) 2001-2004 Greg Kroah-Hartman (greg@kroah.com)
   9  *
  10  * This program is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU General Public License as
  12  * published by the Free Software Foundation, version 2
  13  *
  14  * VUB300: is a USB 2.0 client device with a single SDIO/SDmem/MMC slot
  15  *         Any SDIO/SDmem/MMC device plugged into the VUB300 will appear,
  16  *         by virtue of this driver, to have been plugged into a local
  17  *         SDIO host controller, similar to, say, a PCI Ricoh controller
  18  *         This is because this kernel device driver is both a USB 2.0
  19  *         client device driver AND an MMC host controller driver. Thus
  20  *         if there is an existing driver for the inserted SDIO/SDmem/MMC
  21  *         device then that driver will be used by the kernel to manage
  22  *         the device in exactly the same fashion as if it had been
  23  *         directly plugged into, say, a local pci bus Ricoh controller
  24  *
  25  * RANT: this driver was written using a display 128x48 - converting it
  26  *       to a line width of 80 makes it very difficult to support. In
  27  *       particular functions have been broken down into sub functions
  28  *       and the original meaningful names have been shortened into
  29  *       cryptic ones.
  30  *       The problem is that executing a fragment of code subject to
  31  *       two conditions means an indentation of 24, thus leaving only
  32  *       56 characters for a C statement. And that is quite ridiculous!
  33  *
  34  * Data types: data passed to/from the VUB300 is fixed to a number of
  35  *             bits and driver data fields reflect that limit by using
  36  *             u8, u16, u32
  37  */
  38 #include <linux/kernel.h>
  39 #include <linux/errno.h>
  40 #include <linux/init.h>
  41 #include <linux/slab.h>
  42 #include <linux/module.h>
  43 #include <linux/kref.h>
  44 #include <linux/uaccess.h>
  45 #include <linux/usb.h>
  46 #include <linux/mutex.h>
  47 #include <linux/mmc/host.h>
  48 #include <linux/mmc/card.h>
  49 #include <linux/mmc/sdio_func.h>
  50 #include <linux/mmc/sdio_ids.h>
  51 #include <linux/workqueue.h>
  52 #include <linux/ctype.h>
  53 #include <linux/firmware.h>
  54 #include <linux/scatterlist.h>
  55
  56 struct host_controller_info {
  57         u8 info_size;
  58         u16 firmware_version;
  59         u8 number_of_ports;
  60 } __packed;
  61
  62 #define FIRMWARE_BLOCK_BOUNDARY 1024
  63 struct sd_command_header {
  64         u8 header_size;
  65         u8 header_type;
  66         u8 port_number;
  67         u8 command_type; /* Bit7 - Rd/Wr */
  68         u8 command_index;
  69         u8 transfer_size[4]; /* ReadSize + ReadSize */
  70         u8 response_type;
  71         u8 arguments[4];
  72         u8 block_count[2];
  73         u8 block_size[2];
  74         u8 block_boundary[2];
  75         u8 reserved[44]; /* to pad out to 64 bytes */
  76 } __packed;
  77
  78 struct sd_irqpoll_header {
  79         u8 header_size;
  80         u8 header_type;
  81         u8 port_number;
  82         u8 command_type; /* Bit7 - Rd/Wr */
  83         u8 padding[16]; /* don't ask why !! */
  84         u8 poll_timeout_msb;
  85         u8 poll_timeout_lsb;
  86         u8 reserved[42]; /* to pad out to 64 bytes */
  87 } __packed;
  88
  89 struct sd_common_header {
  90         u8 header_size;
  91         u8 header_type;
  92         u8 port_number;
  93 } __packed;
  94
  95 struct sd_response_header {
  96         u8 header_size;
  97         u8 header_type;
  98         u8 port_number;
  99         u8 command_type;
 100         u8 command_index;
 101         u8 command_response[0];
 102 } __packed;
 103
 104 struct sd_status_header {
 105         u8 header_size;
 106         u8 header_type;
 107         u8 port_number;
 108         u16 port_flags;
 109         u32 sdio_clock;
 110         u16 host_header_size;
 111         u16 func_header_size;
 112         u16 ctrl_header_size;
 113 } __packed;
 114
 115 struct sd_error_header {
 116         u8 header_size;
 117         u8 header_type;
 118         u8 port_number;
 119         u8 error_code;
 120 } __packed;
 121
 122 struct sd_interrupt_header {
 123         u8 header_size;
 124         u8 header_type;
 125         u8 port_number;
 126 } __packed;
 127
 128 struct offload_registers_access {
 129         u8 command_byte[4];
 130         u8 Respond_Byte[4];
 131 } __packed;
 132
 133 #define INTERRUPT_REGISTER_ACCESSES 15
 134 struct sd_offloaded_interrupt {
 135         u8 header_size;
 136         u8 header_type;
 137         u8 port_number;
 138         struct offload_registers_access reg[INTERRUPT_REGISTER_ACCESSES];
 139 } __packed;
 140
 141 struct sd_register_header {
 142         u8 header_size;
 143         u8 header_type;
 144         u8 port_number;
 145         u8 command_type;
 146         u8 command_index;
 147         u8 command_response[6];
 148 } __packed;
 149
 150 #define PIGGYBACK_REGISTER_ACCESSES 14
 151 struct sd_offloaded_piggyback {
 152         struct sd_register_header sdio;
 153         struct offload_registers_access reg[PIGGYBACK_REGISTER_ACCESSES];
 154 } __packed;
 155
 156 union sd_response {
 157         struct sd_common_header common;
 158         struct sd_status_header status;
 159         struct sd_error_header error;
 160         struct sd_interrupt_header interrupt;
 161         struct sd_response_header response;
 162         struct sd_offloaded_interrupt irq;
 163         struct sd_offloaded_piggyback pig;
 164 } __packed;
 165
 166 union sd_command {
 167         struct sd_command_header head;
 168         struct sd_irqpoll_header poll;
 169 } __packed;
 170
 171 enum SD_RESPONSE_TYPE {
 172         SDRT_UNSPECIFIED = 0,
 173         SDRT_NONE,
 174         SDRT_1,
 175         SDRT_1B,
 176         SDRT_2,
 177         SDRT_3,
 178         SDRT_4,
 179         SDRT_5,
 180         SDRT_5B,
 181         SDRT_6,
 182         SDRT_7,
 183 };
 184
 185 #define RESPONSE_INTERRUPT                      0x01
 186 #define RESPONSE_ERROR                          0x02
 187 #define RESPONSE_STATUS                         0x03
 188 #define RESPONSE_IRQ_DISABLED                   0x05
 189 #define RESPONSE_IRQ_ENABLED                    0x06
 190 #define RESPONSE_PIGGYBACKED                    0x07
 191 #define RESPONSE_NO_INTERRUPT                   0x08
 192 #define RESPONSE_PIG_DISABLED                   0x09
 193 #define RESPONSE_PIG_ENABLED                    0x0A
 194 #define SD_ERROR_1BIT_TIMEOUT                   0x01
 195 #define SD_ERROR_4BIT_TIMEOUT                   0x02
 196 #define SD_ERROR_1BIT_CRC_WRONG                 0x03
 197 #define SD_ERROR_4BIT_CRC_WRONG                 0x04
 198 #define SD_ERROR_1BIT_CRC_ERROR                 0x05
 199 #define SD_ERROR_4BIT_CRC_ERROR                 0x06
 200 #define SD_ERROR_NO_CMD_ENDBIT                  0x07
 201 #define SD_ERROR_NO_1BIT_DATEND                 0x08
 202 #define SD_ERROR_NO_4BIT_DATEND                 0x09
 203 #define SD_ERROR_1BIT_UNEXPECTED_TIMEOUT        0x0A
 204 #define SD_ERROR_4BIT_UNEXPECTED_TIMEOUT        0x0B
 205 #define SD_ERROR_ILLEGAL_COMMAND                0x0C
 206 #define SD_ERROR_NO_DEVICE                      0x0D
 207 #define SD_ERROR_TRANSFER_LENGTH                0x0E
 208 #define SD_ERROR_1BIT_DATA_TIMEOUT              0x0F
 209 #define SD_ERROR_4BIT_DATA_TIMEOUT              0x10
 210 #define SD_ERROR_ILLEGAL_STATE                  0x11
 211 #define SD_ERROR_UNKNOWN_ERROR                  0x12
 212 #define SD_ERROR_RESERVED_ERROR                 0x13
 213 #define SD_ERROR_INVALID_FUNCTION               0x14
 214 #define SD_ERROR_OUT_OF_RANGE                   0x15
 215 #define SD_ERROR_STAT_CMD                       0x16
 216 #define SD_ERROR_STAT_DATA                      0x17
 217 #define SD_ERROR_STAT_CMD_TIMEOUT               0x18
 218 #define SD_ERROR_SDCRDY_STUCK                   0x19
 219 #define SD_ERROR_UNHANDLED                      0x1A
 220 #define SD_ERROR_OVERRUN                        0x1B
 221 #define SD_ERROR_PIO_TIMEOUT                    0x1C
 222
 223 #define FUN(c) (0x000007 & (c->arg>>28))
 224 #define REG(c) (0x01FFFF & (c->arg>>9))
 225
 226 static bool limit_speed_to_24_MHz;
 227 module_param(limit_speed_to_24_MHz, bool, 0644);
 228 MODULE_PARM_DESC(limit_speed_to_24_MHz, "Limit Max SDIO Clock Speed to 24 MHz");
 229
 230 static bool pad_input_to_usb_pkt;
 231 module_param(pad_input_to_usb_pkt, bool, 0644);
 232 MODULE_PARM_DESC(pad_input_to_usb_pkt,
 233                  "Pad USB data input transfers to whole USB Packet");
 234
 235 static bool disable_offload_processing;
 236 module_param(disable_offload_processing, bool, 0644);
 237 MODULE_PARM_DESC(disable_offload_processing, "Disable Offload Processing");
 238
 239 static bool force_1_bit_data_xfers;
 240 module_param(force_1_bit_data_xfers, bool, 0644);
 241 MODULE_PARM_DESC(force_1_bit_data_xfers,
 242                  "Force SDIO Data Transfers to 1-bit Mode");
 243
 244 static bool force_polling_for_irqs;
 245 module_param(force_polling_for_irqs, bool, 0644);
 246 MODULE_PARM_DESC(force_polling_for_irqs, "Force Polling for SDIO interrupts");
 247
 248 static int firmware_irqpoll_timeout = 1024;
 249 module_param(firmware_irqpoll_timeout, int, 0644);
 250 MODULE_PARM_DESC(firmware_irqpoll_timeout, "VUB300 firmware irqpoll timeout");
 251
 252 static int force_max_req_size = 128;
 253 module_param(force_max_req_size, int, 0644);
 254 MODULE_PARM_DESC(force_max_req_size, "set max request size in kBytes");
 255
 256 #ifdef SMSC_DEVELOPMENT_BOARD
 257 static int firmware_rom_wait_states = 0x04;
 258 #else
 259 static int firmware_rom_wait_states = 0x1C;
 260 #endif
 261
 262 module_param(firmware_rom_wait_states, int, 0644);
 263 MODULE_PARM_DESC(firmware_rom_wait_states,
 264                  "ROM wait states byte=RRRIIEEE (Reserved Internal External)");
 265
 266 #define ELAN_VENDOR_ID          0x2201
 267 #define VUB300_VENDOR_ID        0x0424
 268 #define VUB300_PRODUCT_ID       0x012C
 269 static const struct usb_device_id vub300_table[] = {
 270         {USB_DEVICE(ELAN_VENDOR_ID, VUB300_PRODUCT_ID)},
 271         {USB_DEVICE(VUB300_VENDOR_ID, VUB300_PRODUCT_ID)},
 272         {} /* Terminating entry */
 273 };
 274 MODULE_DEVICE_TABLE(usb, vub300_table);
 275
 276 static struct workqueue_struct *cmndworkqueue;
 277 static struct workqueue_struct *pollworkqueue;
 278 static struct workqueue_struct *deadworkqueue;
 279
 280 static inline int interface_to_InterfaceNumber(struct usb_interface *interface)
 281 {
 282         if (!interface)
 283                 return -1;
 284         if (!interface->cur_altsetting)
 285                 return -1;
 286         return interface->cur_altsetting->desc.bInterfaceNumber;
 287 }
 288
 289 struct sdio_register {
 290         unsigned func_num:3;
 291         unsigned sdio_reg:17;
 292         unsigned activate:1;
 293         unsigned prepared:1;
 294         unsigned regvalue:8;
 295         unsigned response:8;
 296         unsigned sparebit:26;
 297 };
 298
 299 struct vub300_mmc_host {
 300         struct usb_device *udev;
 301         struct usb_interface *interface;
 302         struct kref kref;
 303         struct mutex cmd_mutex;
 304         struct mutex irq_mutex;
 305         char vub_name[3 + (9 * 8) + 4 + 1]; /* max of 7 sdio fn's */
 306         u8 cmnd_out_ep; /* EndPoint for commands */
 307         u8 cmnd_res_ep; /* EndPoint for responses */
 308         u8 data_out_ep; /* EndPoint for out data */
 309         u8 data_inp_ep; /* EndPoint for inp data */
 310         bool card_powered;
 311         bool card_present;
 312         bool read_only;
 313         bool large_usb_packets;
 314         bool app_spec; /* ApplicationSpecific */
 315         bool irq_enabled; /* by the MMC CORE */
 316         bool irq_disabled; /* in the firmware */
 317         unsigned bus_width:4;
 318         u8 total_offload_count;
 319         u8 dynamic_register_count;
 320         u8 resp_len;
 321         u32 datasize;
 322         int errors;
 323         int usb_transport_fail;
 324         int usb_timed_out;
 325         int irqs_queued;
 326         struct sdio_register sdio_register[16];
 327         struct offload_interrupt_function_register {
 328 #define MAXREGBITS 4
 329 #define MAXREGS (1<<MAXREGBITS)
 330 #define MAXREGMASK (MAXREGS-1)
 331                 u8 offload_count;
 332                 u32 offload_point;
 333                 struct offload_registers_access reg[MAXREGS];
 334         } fn[8];
 335         u16 fbs[8]; /* Function Block Size */
 336         struct mmc_command *cmd;
 337         struct mmc_request *req;
 338         struct mmc_data *data;
 339         struct mmc_host *mmc;
 340         struct urb *urb;
 341         struct urb *command_out_urb;
 342         struct urb *command_res_urb;
 343         struct completion command_complete;
 344         struct completion irqpoll_complete;
 345         union sd_command cmnd;
 346         union sd_response resp;
 347         struct timer_list sg_transfer_timer;
 348         struct usb_sg_request sg_request;
 349         struct timer_list inactivity_timer;
 350         struct work_struct deadwork;
 351         struct work_struct cmndwork;
 352         struct delayed_work pollwork;
 353         struct host_controller_info hc_info;
 354         struct sd_status_header system_port_status;
 355         u8 padded_buffer[64];
 356 };
 357
 358 #define kref_to_vub300_mmc_host(d) container_of(d, struct vub300_mmc_host, kref)
 359 #define SET_TRANSFER_PSEUDOCODE         21
 360 #define SET_INTERRUPT_PSEUDOCODE        20
 361 #define SET_FAILURE_MODE                18
 362 #define SET_ROM_WAIT_STATES             16
 363 #define SET_IRQ_ENABLE                  13
 364 #define SET_CLOCK_SPEED                 11
 365 #define SET_FUNCTION_BLOCK_SIZE         9
 366 #define SET_SD_DATA_MODE                6
 367 #define SET_SD_POWER                    4
 368 #define ENTER_DFU_MODE                  3
 369 #define GET_HC_INF0                     1
 370 #define GET_SYSTEM_PORT_STATUS          0
 371
 372 static void vub300_delete(struct kref *kref)
 373 {                               /* kref callback - softirq */
 374         struct vub300_mmc_host *vub300 = kref_to_vub300_mmc_host(kref);
 375         struct mmc_host *mmc = vub300->mmc;
 376         usb_free_urb(vub300->command_out_urb);
 377         vub300->command_out_urb = NULL;
 378         usb_free_urb(vub300->command_res_urb);
 379         vub300->command_res_urb = NULL;
 380         usb_put_dev(vub300->udev);
 381         mmc_free_host(mmc);
 382         /*
 383          * and hence also frees vub300
 384          * which is contained at the end of struct mmc
 385          */
 386 }
 387
 388 static void vub300_queue_cmnd_work(struct vub300_mmc_host *vub300)
 389 {
 390         kref_get(&vub300->kref);
 391         if (queue_work(cmndworkqueue, &vub300->cmndwork)) {
 392                 /*
 393                  * then the cmndworkqueue was not previously
 394                  * running and the above get ref is obvious
 395                  * required and will be put when the thread
 396                  * terminates by a specific call
 397                  */
 398         } else {
 399                 /*
 400                  * the cmndworkqueue was already running from
 401                  * a previous invocation and thus to keep the
 402                  * kref counts correct we must undo the get
 403                  */
 404                 kref_put(&vub300->kref, vub300_delete);
 405         }
 406 }
 407
 408 static void vub300_queue_poll_work(struct vub300_mmc_host *vub300, int delay)
 409 {
 410         kref_get(&vub300->kref);
 411         if (queue_delayed_work(pollworkqueue, &vub300->pollwork, delay)) {
 412                 /*
 413                  * then the pollworkqueue was not previously
 414                  * running and the above get ref is obvious
 415                  * required and will be put when the thread
 416                  * terminates by a specific call
 417                  */
 418         } else {
 419                 /*
 420                  * the pollworkqueue was already running from
 421                  * a previous invocation and thus to keep the
 422                  * kref counts correct we must undo the get
 423                  */
 424                 kref_put(&vub300->kref, vub300_delete);
 425         }
 426 }
 427
 428 static void vub300_queue_dead_work(struct vub300_mmc_host *vub300)
 429 {
 430         kref_get(&vub300->kref);
 431         if (queue_work(deadworkqueue, &vub300->deadwork)) {
 432                 /*
 433                  * then the deadworkqueue was not previously
 434                  * running and the above get ref is obvious
 435                  * required and will be put when the thread
 436                  * terminates by a specific call
 437                  */
 438         } else {
 439                 /*
 440                  * the deadworkqueue was already running from
 441                  * a previous invocation and thus to keep the
 442                  * kref counts correct we must undo the get
 443                  */
 444                 kref_put(&vub300->kref, vub300_delete);
 445         }
 446 }
 447
 448 static void irqpoll_res_completed(struct urb *urb)
 449 {                               /* urb completion handler - hardirq */
 450         struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
 451         if (urb->status)
 452                 vub300->usb_transport_fail = urb->status;
 453         complete(&vub300->irqpoll_complete);
 454 }
 455
 456 static void irqpoll_out_completed(struct urb *urb)
 457 {                               /* urb completion handler - hardirq */
 458         struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
 459         if (urb->status) {
 460                 vub300->usb_transport_fail = urb->status;
 461                 complete(&vub300->irqpoll_complete);
 462                 return;
 463         } else {
 464                 int ret;
 465                 unsigned int pipe =
 466                         usb_rcvbulkpipe(vub300->udev, vub300->cmnd_res_ep);
 467                 usb_fill_bulk_urb(vub300->command_res_urb, vub300->udev, pipe,
 468                                   &vub300->resp, sizeof(vub300->resp),
 469                                   irqpoll_res_completed, vub300);
 470                 vub300->command_res_urb->actual_length = 0;
 471                 ret = usb_submit_urb(vub300->command_res_urb, GFP_ATOMIC);
 472                 if (ret) {
 473                         vub300->usb_transport_fail = ret;
 474                         complete(&vub300->irqpoll_complete);
 475                 }
 476                 return;
 477         }
 478 }
 479
 480 static void send_irqpoll(struct vub300_mmc_host *vub300)
 481 {
 482         /* cmd_mutex is held by vub300_pollwork_thread */
 483         int retval;
 484         int timeout = 0xFFFF & (0x0001FFFF - firmware_irqpoll_timeout);
 485         vub300->cmnd.poll.header_size = 22;
 486         vub300->cmnd.poll.header_type = 1;
 487         vub300->cmnd.poll.port_number = 0;
 488         vub300->cmnd.poll.command_type = 2;
 489         vub300->cmnd.poll.poll_timeout_lsb = 0xFF & (unsigned)timeout;
 490         vub300->cmnd.poll.poll_timeout_msb = 0xFF & (unsigned)(timeout >> 8);
 491         usb_fill_bulk_urb(vub300->command_out_urb, vub300->udev,
 492                           usb_sndbulkpipe(vub300->udev, vub300->cmnd_out_ep)
 493                           , &vub300->cmnd, sizeof(vub300->cmnd)
 494                           , irqpoll_out_completed, vub300);
 495         retval = usb_submit_urb(vub300->command_out_urb, GFP_KERNEL);
 496         if (0 > retval) {
 497                 vub300->usb_transport_fail = retval;
 498                 vub300_queue_poll_work(vub300, 1);
 499                 complete(&vub300->irqpoll_complete);
 500                 return;
 501         } else {
 502                 return;
 503         }
 504 }
 505
 506 static void new_system_port_status(struct vub300_mmc_host *vub300)
 507 {
 508         int old_card_present = vub300->card_present;
 509         int new_card_present =
 510                 (0x0001 & vub300->system_port_status.port_flags) ? 1 : 0;
 511         vub300->read_only =
 512                 (0x0010 & vub300->system_port_status.port_flags) ? 1 : 0;
 513         if (new_card_present && !old_card_present) {
 514                 dev_info(&vub300->udev->dev, "card just inserted\n");
 515                 vub300->card_present = 1;
 516                 vub300->bus_width = 0;
 517                 if (disable_offload_processing)
 518                         strncpy(vub300->vub_name, "EMPTY Processing Disabled",
 519                                 sizeof(vub300->vub_name));
 520                 else
 521                         vub300->vub_name[0] = 0;
 522                 mmc_detect_change(vub300->mmc, 1);
 523         } else if (!new_card_present && old_card_present) {
 524                 dev_info(&vub300->udev->dev, "card just ejected\n");
 525                 vub300->card_present = 0;
 526                 mmc_detect_change(vub300->mmc, 0);
 527         } else {
 528                 /* no change */
 529         }
 530 }
 531
 532 static void __add_offloaded_reg_to_fifo(struct vub300_mmc_host *vub300,
 533                                         struct offload_registers_access
 534                                         *register_access, u8 func)
 535 {
 536         u8 r = vub300->fn[func].offload_point + vub300->fn[func].offload_count;
 537         memcpy(&vub300->fn[func].reg[MAXREGMASK & r], register_access,
 538                sizeof(struct offload_registers_access));
 539         vub300->fn[func].offload_count += 1;
 540         vub300->total_offload_count += 1;
 541 }
 542
 543 static void add_offloaded_reg(struct vub300_mmc_host *vub300,
 544                               struct offload_registers_access *register_access)
 545 {
 546         u32 Register = ((0x03 & register_access->command_byte[0]) << 15)
 547                         | ((0xFF & register_access->command_byte[1]) << 7)
 548                         | ((0xFE & register_access->command_byte[2]) >> 1);
 549         u8 func = ((0x70 & register_access->command_byte[0]) >> 4);
 550         u8 regs = vub300->dynamic_register_count;
 551         u8 i = 0;
 552         while (0 < regs-- && 1 == vub300->sdio_register[i].activate) {
 553                 if (vub300->sdio_register[i].func_num == func &&
 554                     vub300->sdio_register[i].sdio_reg == Register) {
 555                         if (vub300->sdio_register[i].prepared == 0)
 556                                 vub300->sdio_register[i].prepared = 1;
 557                         vub300->sdio_register[i].response =
 558                                 register_access->Respond_Byte[2];
 559                         vub300->sdio_register[i].regvalue =
 560                                 register_access->Respond_Byte[3];
 561                         return;
 562                 } else {
 563                         i += 1;
 564                         continue;
 565                 }
 566         }
 567         __add_offloaded_reg_to_fifo(vub300, register_access, func);
 568 }
 569
 570 static void check_vub300_port_status(struct vub300_mmc_host *vub300)
 571 {
 572         /*
 573          * cmd_mutex is held by vub300_pollwork_thread,
 574          * vub300_deadwork_thread or vub300_cmndwork_thread
 575          */
 576         int retval;
 577         retval =
 578                 usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
 579                                 GET_SYSTEM_PORT_STATUS,
 580                                 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 581                                 0x0000, 0x0000, &vub300->system_port_status,
 582                                 sizeof(vub300->system_port_status), 1000);
 583         if (sizeof(vub300->system_port_status) == retval)
 584                 new_system_port_status(vub300);
 585 }
 586
 587 static void __vub300_irqpoll_response(struct vub300_mmc_host *vub300)
 588 {
 589         /* cmd_mutex is held by vub300_pollwork_thread */
 590         if (vub300->command_res_urb->actual_length == 0)
 591                 return;
 592
 593         switch (vub300->resp.common.header_type) {
 594         case RESPONSE_INTERRUPT:
 595                 mutex_lock(&vub300->irq_mutex);
 596                 if (vub300->irq_enabled)
 597                         mmc_signal_sdio_irq(vub300->mmc);
 598                 else
 599                         vub300->irqs_queued += 1;
 600                 vub300->irq_disabled = 1;
 601                 mutex_unlock(&vub300->irq_mutex);
 602                 break;
 603         case RESPONSE_ERROR:
 604                 if (vub300->resp.error.error_code == SD_ERROR_NO_DEVICE)
 605                         check_vub300_port_status(vub300);
 606                 break;
 607         case RESPONSE_STATUS:
 608                 vub300->system_port_status = vub300->resp.status;
 609                 new_system_port_status(vub300);
 610                 if (!vub300->card_present)
 611                         vub300_queue_poll_work(vub300, HZ / 5);
 612                 break;
 613         case RESPONSE_IRQ_DISABLED:
 614         {
 615                 int offloaded_data_length = vub300->resp.common.header_size - 3;
 616                 int register_count = offloaded_data_length >> 3;
 617                 int ri = 0;
 618                 while (register_count--) {
 619                         add_offloaded_reg(vub300, &vub300->resp.irq.reg[ri]);
 620                         ri += 1;
 621                 }
 622                 mutex_lock(&vub300->irq_mutex);
 623                 if (vub300->irq_enabled)
 624                         mmc_signal_sdio_irq(vub300->mmc);
 625                 else
 626                         vub300->irqs_queued += 1;
 627                 vub300->irq_disabled = 1;
 628                 mutex_unlock(&vub300->irq_mutex);
 629                 break;
 630         }
 631         case RESPONSE_IRQ_ENABLED:
 632         {
 633                 int offloaded_data_length = vub300->resp.common.header_size - 3;
 634                 int register_count = offloaded_data_length >> 3;
 635                 int ri = 0;
 636                 while (register_count--) {
 637                         add_offloaded_reg(vub300, &vub300->resp.irq.reg[ri]);
 638                         ri += 1;
 639                 }
 640                 mutex_lock(&vub300->irq_mutex);
 641                 if (vub300->irq_enabled)
 642                         mmc_signal_sdio_irq(vub300->mmc);
 643                 else
 644                         vub300->irqs_queued += 1;
 645                 vub300->irq_disabled = 0;
 646                 mutex_unlock(&vub300->irq_mutex);
 647                 break;
 648         }
 649         case RESPONSE_NO_INTERRUPT:
 650                 vub300_queue_poll_work(vub300, 1);
 651                 break;
 652         default:
 653                 break;
 654         }
 655 }
 656
 657 static void __do_poll(struct vub300_mmc_host *vub300)
 658 {
 659         /* cmd_mutex is held by vub300_pollwork_thread */
 660         unsigned long commretval;
 661         mod_timer(&vub300->inactivity_timer, jiffies + HZ);
 662         init_completion(&vub300->irqpoll_complete);
 663         send_irqpoll(vub300);
 664         commretval = wait_for_completion_timeout(&vub300->irqpoll_complete,
 665                                                  msecs_to_jiffies(500));
 666         if (vub300->usb_transport_fail) {
 667                 /* no need to do anything */
 668         } else if (commretval == 0) {
 669                 vub300->usb_timed_out = 1;
 670                 usb_kill_urb(vub300->command_out_urb);
 671                 usb_kill_urb(vub300->command_res_urb);
 672         } else { /* commretval > 0 */
 673                 __vub300_irqpoll_response(vub300);
 674         }
 675 }
 676
 677 /* this thread runs only when the driver
 678  * is trying to poll the device for an IRQ
 679  */
 680 static void vub300_pollwork_thread(struct work_struct *work)
 681 {                               /* NOT irq */
 682         struct vub300_mmc_host *vub300 = container_of(work,
 683                               struct vub300_mmc_host, pollwork.work);
 684         if (!vub300->interface) {
 685                 kref_put(&vub300->kref, vub300_delete);
 686                 return;
 687         }
 688         mutex_lock(&vub300->cmd_mutex);
 689         if (vub300->cmd) {
 690                 vub300_queue_poll_work(vub300, 1);
 691         } else if (!vub300->card_present) {
 692                 /* no need to do anything */
 693         } else { /* vub300->card_present */
 694                 mutex_lock(&vub300->irq_mutex);
 695                 if (!vub300->irq_enabled) {
 696                         mutex_unlock(&vub300->irq_mutex);
 697                 } else if (vub300->irqs_queued) {
 698                         vub300->irqs_queued -= 1;
 699                         mmc_signal_sdio_irq(vub300->mmc);
 700                         mod_timer(&vub300->inactivity_timer, jiffies + HZ);
 701                         mutex_unlock(&vub300->irq_mutex);
 702                 } else { /* NOT vub300->irqs_queued */
 703                         mutex_unlock(&vub300->irq_mutex);
 704                         __do_poll(vub300);
 705                 }
 706         }
 707         mutex_unlock(&vub300->cmd_mutex);
 708         kref_put(&vub300->kref, vub300_delete);
 709 }
 710
 711 static void vub300_deadwork_thread(struct work_struct *work)
 712 {                               /* NOT irq */
 713         struct vub300_mmc_host *vub300 =
 714                 container_of(work, struct vub300_mmc_host, deadwork);
 715         if (!vub300->interface) {
 716                 kref_put(&vub300->kref, vub300_delete);
 717                 return;
 718         }
 719         mutex_lock(&vub300->cmd_mutex);
 720         if (vub300->cmd) {
 721                 /*
 722                  * a command got in as the inactivity
 723                  * timer expired - so we just let the
 724                  * processing of the command show if
 725                  * the device is dead
 726                  */
 727         } else if (vub300->card_present) {
 728                 check_vub300_port_status(vub300);
 729         } else if (vub300->mmc && vub300->mmc->card) {
 730                 /*
 731                  * the MMC core must not have responded
 732                  * to the previous indication - lets
 733                  * hope that it eventually does so we
 734                  * will just ignore this for now
 735                  */
 736         } else {
 737                 check_vub300_port_status(vub300);
 738         }
 739         mod_timer(&vub300->inactivity_timer, jiffies + HZ);
 740         mutex_unlock(&vub300->cmd_mutex);
 741         kref_put(&vub300->kref, vub300_delete);
 742 }
 743
 744 static void vub300_inactivity_timer_expired(struct timer_list *t)
 745 {                               /* softirq */
 746         struct vub300_mmc_host *vub300 = from_timer(vub300, t,
 747                                                     inactivity_timer);
 748         if (!vub300->interface) {
 749                 kref_put(&vub300->kref, vub300_delete);
 750         } else if (vub300->cmd) {
 751                 mod_timer(&vub300->inactivity_timer, jiffies + HZ);
 752         } else {
 753                 vub300_queue_dead_work(vub300);
 754                 mod_timer(&vub300->inactivity_timer, jiffies + HZ);
 755         }
 756 }
 757
 758 static int vub300_response_error(u8 error_code)
 759 {
 760         switch (error_code) {
 761         case SD_ERROR_PIO_TIMEOUT:
 762         case SD_ERROR_1BIT_TIMEOUT:
 763         case SD_ERROR_4BIT_TIMEOUT:
 764                 return -ETIMEDOUT;
 765         case SD_ERROR_STAT_DATA:
 766         case SD_ERROR_OVERRUN:
 767         case SD_ERROR_STAT_CMD:
 768         case SD_ERROR_STAT_CMD_TIMEOUT:
 769         case SD_ERROR_SDCRDY_STUCK:
 770         case SD_ERROR_UNHANDLED:
 771         case SD_ERROR_1BIT_CRC_WRONG:
 772         case SD_ERROR_4BIT_CRC_WRONG:
 773         case SD_ERROR_1BIT_CRC_ERROR:
 774         case SD_ERROR_4BIT_CRC_ERROR:
 775         case SD_ERROR_NO_CMD_ENDBIT:
 776         case SD_ERROR_NO_1BIT_DATEND:
 777         case SD_ERROR_NO_4BIT_DATEND:
 778         case SD_ERROR_1BIT_DATA_TIMEOUT:
 779         case SD_ERROR_4BIT_DATA_TIMEOUT:
 780         case SD_ERROR_1BIT_UNEXPECTED_TIMEOUT:
 781         case SD_ERROR_4BIT_UNEXPECTED_TIMEOUT:
 782                 return -EILSEQ;
 783         case 33:
 784                 return -EILSEQ;
 785         case SD_ERROR_ILLEGAL_COMMAND:
 786                 return -EINVAL;
 787         case SD_ERROR_NO_DEVICE:
 788                 return -ENOMEDIUM;
 789         default:
 790                 return -ENODEV;
 791         }
 792 }
 793
 794 static void command_res_completed(struct urb *urb)
 795 {                               /* urb completion handler - hardirq */
 796         struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
 797         if (urb->status) {
 798                 /* we have to let the initiator handle the error */
 799         } else if (vub300->command_res_urb->actual_length == 0) {
 800                 /*
 801                  * we have seen this happen once or twice and
 802                  * we suspect a buggy USB host controller
 803                  */
 804         } else if (!vub300->data) {
 805                 /* this means that the command (typically CMD52) succeeded */
 806         } else if (vub300->resp.common.header_type != 0x02) {
 807                 /*
 808                  * this is an error response from the VUB300 chip
 809                  * and we let the initiator handle it
 810                  */
 811         } else if (vub300->urb) {
 812                 vub300->cmd->error =
 813                         vub300_response_error(vub300->resp.error.error_code);
 814                 usb_unlink_urb(vub300->urb);
 815         } else {
 816                 vub300->cmd->error =
 817                         vub300_response_error(vub300->resp.error.error_code);
 818                 usb_sg_cancel(&vub300->sg_request);
 819         }
 820         complete(&vub300->command_complete);    /* got_response_in */
 821 }
 822
 823 static void command_out_completed(struct urb *urb)
 824 {                               /* urb completion handler - hardirq */
 825         struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
 826         if (urb->status) {
 827                 complete(&vub300->command_complete);
 828         } else {
 829                 int ret;
 830                 unsigned int pipe =
 831                         usb_rcvbulkpipe(vub300->udev, vub300->cmnd_res_ep);
 832                 usb_fill_bulk_urb(vub300->command_res_urb, vub300->udev, pipe,
 833                                   &vub300->resp, sizeof(vub300->resp),
 834                                   command_res_completed, vub300);
 835                 vub300->command_res_urb->actual_length = 0;
 836                 ret = usb_submit_urb(vub300->command_res_urb, GFP_ATOMIC);
 837                 if (ret == 0) {
 838                         /*
 839                          * the urb completion handler will call
 840                          * our completion handler
 841                          */
 842                 } else {
 843                         /*
 844                          * and thus we only call it directly
 845                          * when it will not be called
 846                          */
 847                         complete(&vub300->command_complete);
 848                 }
 849         }
 850 }
 851
 852 /*
 853  * the STUFF bits are masked out for the comparisons
 854  */
 855 static void snoop_block_size_and_bus_width(struct vub300_mmc_host *vub300,
 856                                            u32 cmd_arg)
 857 {
 858         if ((0xFBFFFE00 & cmd_arg) == 0x80022200)
 859                 vub300->fbs[1] = (cmd_arg << 8) | (0x00FF & vub300->fbs[1]);
 860         else if ((0xFBFFFE00 & cmd_arg) == 0x80022000)
 861                 vub300->fbs[1] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[1]);
 862         else if ((0xFBFFFE00 & cmd_arg) == 0x80042200)
 863                 vub300->fbs[2] = (cmd_arg << 8) | (0x00FF & vub300->fbs[2]);
 864         else if ((0xFBFFFE00 & cmd_arg) == 0x80042000)
 865                 vub300->fbs[2] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[2]);
 866         else if ((0xFBFFFE00 & cmd_arg) == 0x80062200)
 867                 vub300->fbs[3] = (cmd_arg << 8) | (0x00FF & vub300->fbs[3]);
 868         else if ((0xFBFFFE00 & cmd_arg) == 0x80062000)
 869                 vub300->fbs[3] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[3]);
 870         else if ((0xFBFFFE00 & cmd_arg) == 0x80082200)
 871                 vub300->fbs[4] = (cmd_arg << 8) | (0x00FF & vub300->fbs[4]);
 872         else if ((0xFBFFFE00 & cmd_arg) == 0x80082000)
 873                 vub300->fbs[4] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[4]);
 874         else if ((0xFBFFFE00 & cmd_arg) == 0x800A2200)
 875                 vub300->fbs[5] = (cmd_arg << 8) | (0x00FF & vub300->fbs[5]);
 876         else if ((0xFBFFFE00 & cmd_arg) == 0x800A2000)
 877                 vub300->fbs[5] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[5]);
 878         else if ((0xFBFFFE00 & cmd_arg) == 0x800C2200)
 879                 vub300->fbs[6] = (cmd_arg << 8) | (0x00FF & vub300->fbs[6]);
 880         else if ((0xFBFFFE00 & cmd_arg) == 0x800C2000)
 881                 vub300->fbs[6] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[6]);
 882         else if ((0xFBFFFE00 & cmd_arg) == 0x800E2200)
 883                 vub300->fbs[7] = (cmd_arg << 8) | (0x00FF & vub300->fbs[7]);
 884         else if ((0xFBFFFE00 & cmd_arg) == 0x800E2000)
 885                 vub300->fbs[7] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[7]);
 886         else if ((0xFBFFFE03 & cmd_arg) == 0x80000E00)
 887                 vub300->bus_width = 1;
 888         else if ((0xFBFFFE03 & cmd_arg) == 0x80000E02)
 889                 vub300->bus_width = 4;
 890 }
 891
 892 static void send_command(struct vub300_mmc_host *vub300)
 893 {
 894         /* cmd_mutex is held by vub300_cmndwork_thread */
 895         struct mmc_command *cmd = vub300->cmd;
 896         struct mmc_data *data = vub300->data;
 897         int retval;
 898         int i;
 899         u8 response_type;
 900         if (vub300->app_spec) {
 901                 switch (cmd->opcode) {
 902                 case 6:
 903                         response_type = SDRT_1;
 904                         vub300->resp_len = 6;
 905                         if (0x00000000 == (0x00000003 & cmd->arg))
 906                                 vub300->bus_width = 1;
 907                         else if (0x00000002 == (0x00000003 & cmd->arg))
 908                                 vub300->bus_width = 4;
 909                         else
 910                                 dev_err(&vub300->udev->dev,
 911                                         "unexpected ACMD6 bus_width=%d\n",
 912                                         0x00000003 & cmd->arg);
 913                         break;
 914                 case 13:
 915                         response_type = SDRT_1;
 916                         vub300->resp_len = 6;
 917                         break;
 918                 case 22:
 919                         response_type = SDRT_1;
 920                         vub300->resp_len = 6;
 921                         break;
 922                 case 23:
 923                         response_type = SDRT_1;
 924                         vub300->resp_len = 6;
 925                         break;
 926                 case 41:
 927                         response_type = SDRT_3;
 928                         vub300->resp_len = 6;
 929                         break;
 930                 case 42:
 931                         response_type = SDRT_1;
 932                         vub300->resp_len = 6;
 933                         break;
 934                 case 51:
 935                         response_type = SDRT_1;
 936                         vub300->resp_len = 6;
 937                         break;
 938                 case 55:
 939                         response_type = SDRT_1;
 940                         vub300->resp_len = 6;
 941                         break;
 942                 default:
 943                         vub300->resp_len = 0;
 944                         cmd->error = -EINVAL;
 945                         complete(&vub300->command_complete);
 946                         return;
 947                 }
 948                 vub300->app_spec = 0;
 949         } else {
 950                 switch (cmd->opcode) {
 951                 case 0:
 952                         response_type = SDRT_NONE;
 953                         vub300->resp_len = 0;
 954                         break;
 955                 case 1:
 956                         response_type = SDRT_3;
 957                         vub300->resp_len = 6;
 958                         break;
 959                 case 2:
 960                         response_type = SDRT_2;
 961                         vub300->resp_len = 17;
 962                         break;
 963                 case 3:
 964                         response_type = SDRT_6;
 965                         vub300->resp_len = 6;
 966                         break;
 967                 case 4:
 968                         response_type = SDRT_NONE;
 969                         vub300->resp_len = 0;
 970                         break;
 971                 case 5:
 972                         response_type = SDRT_4;
 973                         vub300->resp_len = 6;
 974                         break;
 975                 case 6:
 976                         response_type = SDRT_1;
 977                         vub300->resp_len = 6;
 978                         break;
 979                 case 7:
 980                         response_type = SDRT_1B;
 981                         vub300->resp_len = 6;
 982                         break;
 983                 case 8:
 984                         response_type = SDRT_7;
 985                         vub300->resp_len = 6;
 986                         break;
 987                 case 9:
 988                         response_type = SDRT_2;
 989                         vub300->resp_len = 17;
 990                         break;
 991                 case 10:
 992                         response_type = SDRT_2;
 993                         vub300->resp_len = 17;
 994                         break;
 995                 case 12:
 996                         response_type = SDRT_1B;
 997                         vub300->resp_len = 6;
 998                         break;
 999                 case 13:
1000                         response_type = SDRT_1;
1001                         vub300->resp_len = 6;
1002                         break;
1003                 case 15:
1004                         response_type = SDRT_NONE;
1005                         vub300->resp_len = 0;
1006                         break;
1007                 case 16:
1008                         for (i = 0; i < ARRAY_SIZE(vub300->fbs); i++)
1009                                 vub300->fbs[i] = 0xFFFF & cmd->arg;
1010                         response_type = SDRT_1;
1011                         vub300->resp_len = 6;
1012                         break;
1013                 case 17:
1014                 case 18:
1015                 case 24:
1016                 case 25:
1017                 case 27:
1018                         response_type = SDRT_1;
1019                         vub300->resp_len = 6;
1020                         break;
1021                 case 28:
1022                 case 29:
1023                         response_type = SDRT_1B;
1024                         vub300->resp_len = 6;
1025                         break;
1026                 case 30:
1027                 case 32:
1028                 case 33:
1029                         response_type = SDRT_1;
1030                         vub300->resp_len = 6;
1031                         break;
1032                 case 38:
1033                         response_type = SDRT_1B;
1034                         vub300->resp_len = 6;
1035                         break;
1036                 case 42:
1037                         response_type = SDRT_1;
1038                         vub300->resp_len = 6;
1039                         break;
1040                 case 52:
1041                         response_type = SDRT_5;
1042                         vub300->resp_len = 6;
1043                         snoop_block_size_and_bus_width(vub300, cmd->arg);
1044                         break;
1045                 case 53:
1046                         response_type = SDRT_5;
1047                         vub300->resp_len = 6;
1048                         break;
1049                 case 55:
1050                         response_type = SDRT_1;
1051                         vub300->resp_len = 6;
1052                         vub300->app_spec = 1;
1053                         break;
1054                 case 56:
1055                         response_type = SDRT_1;
1056                         vub300->resp_len = 6;
1057                         break;
1058                 default:
1059                         vub300->resp_len = 0;
1060                         cmd->error = -EINVAL;
1061                         complete(&vub300->command_complete);
1062                         return;
1063                 }
1064         }
1065         /*
1066          * it is a shame that we can not use "sizeof(struct sd_command_header)"
1067          * this is because the packet _must_ be padded to 64 bytes
1068          */
1069         vub300->cmnd.head.header_size = 20;
1070         vub300->cmnd.head.header_type = 0x00;
1071         vub300->cmnd.head.port_number = 0; /* "0" means port 1 */
1072         vub300->cmnd.head.command_type = 0x00; /* standard read command */
1073         vub300->cmnd.head.response_type = response_type;
1074         vub300->cmnd.head.command_index = cmd->opcode;
1075         vub300->cmnd.head.arguments[0] = cmd->arg >> 24;
1076         vub300->cmnd.head.arguments[1] = cmd->arg >> 16;
1077         vub300->cmnd.head.arguments[2] = cmd->arg >> 8;
1078         vub300->cmnd.head.arguments[3] = cmd->arg >> 0;
1079         if (cmd->opcode == 52) {
1080                 int fn = 0x7 & (cmd->arg >> 28);
1081                 vub300->cmnd.head.block_count[0] = 0;
1082                 vub300->cmnd.head.block_count[1] = 0;
1083                 vub300->cmnd.head.block_size[0] = (vub300->fbs[fn] >> 8) & 0xFF;
1084                 vub300->cmnd.head.block_size[1] = (vub300->fbs[fn] >> 0) & 0xFF;
1085                 vub300->cmnd.head.command_type = 0x00;
1086                 vub300->cmnd.head.transfer_size[0] = 0;
1087                 vub300->cmnd.head.transfer_size[1] = 0;
1088                 vub300->cmnd.head.transfer_size[2] = 0;
1089                 vub300->cmnd.head.transfer_size[3] = 0;
1090         } else if (!data) {
1091                 vub300->cmnd.head.block_count[0] = 0;
1092                 vub300->cmnd.head.block_count[1] = 0;
1093                 vub300->cmnd.head.block_size[0] = (vub300->fbs[0] >> 8) & 0xFF;
1094                 vub300->cmnd.head.block_size[1] = (vub300->fbs[0] >> 0) & 0xFF;
1095                 vub300->cmnd.head.command_type = 0x00;
1096                 vub300->cmnd.head.transfer_size[0] = 0;
1097                 vub300->cmnd.head.transfer_size[1] = 0;
1098                 vub300->cmnd.head.transfer_size[2] = 0;
1099                 vub300->cmnd.head.transfer_size[3] = 0;
1100         } else if (cmd->opcode == 53) {
1101                 int fn = 0x7 & (cmd->arg >> 28);
1102                 if (0x08 & vub300->cmnd.head.arguments[0]) { /* BLOCK MODE */
1103                         vub300->cmnd.head.block_count[0] =
1104                                 (data->blocks >> 8) & 0xFF;
1105                         vub300->cmnd.head.block_count[1] =
1106                                 (data->blocks >> 0) & 0xFF;
1107                         vub300->cmnd.head.block_size[0] =
1108                                 (data->blksz >> 8) & 0xFF;
1109                         vub300->cmnd.head.block_size[1] =
1110                                 (data->blksz >> 0) & 0xFF;
1111                 } else {        /* BYTE MODE */
1112                         vub300->cmnd.head.block_count[0] = 0;
1113                         vub300->cmnd.head.block_count[1] = 0;
1114                         vub300->cmnd.head.block_size[0] =
1115                                 (vub300->datasize >> 8) & 0xFF;
1116                         vub300->cmnd.head.block_size[1] =
1117                                 (vub300->datasize >> 0) & 0xFF;
1118                 }
1119                 vub300->cmnd.head.command_type =
1120                         (MMC_DATA_READ & data->flags) ? 0x00 : 0x80;
1121                 vub300->cmnd.head.transfer_size[0] =
1122                         (vub300->datasize >> 24) & 0xFF;
1123                 vub300->cmnd.head.transfer_size[1] =
1124                         (vub300->datasize >> 16) & 0xFF;
1125                 vub300->cmnd.head.transfer_size[2] =
1126                         (vub300->datasize >> 8) & 0xFF;
1127                 vub300->cmnd.head.transfer_size[3] =
1128                         (vub300->datasize >> 0) & 0xFF;
1129                 if (vub300->datasize < vub300->fbs[fn]) {
1130                         vub300->cmnd.head.block_count[0] = 0;
1131                         vub300->cmnd.head.block_count[1] = 0;
1132                 }
1133         } else {
1134                 vub300->cmnd.head.block_count[0] = (data->blocks >> 8) & 0xFF;
1135                 vub300->cmnd.head.block_count[1] = (data->blocks >> 0) & 0xFF;
1136                 vub300->cmnd.head.block_size[0] = (data->blksz >> 8) & 0xFF;
1137                 vub300->cmnd.head.block_size[1] = (data->blksz >> 0) & 0xFF;
1138                 vub300->cmnd.head.command_type =
1139                         (MMC_DATA_READ & data->flags) ? 0x00 : 0x80;
1140                 vub300->cmnd.head.transfer_size[0] =
1141                         (vub300->datasize >> 24) & 0xFF;
1142                 vub300->cmnd.head.transfer_size[1] =
1143                         (vub300->datasize >> 16) & 0xFF;
1144                 vub300->cmnd.head.transfer_size[2] =
1145                         (vub300->datasize >> 8) & 0xFF;
1146                 vub300->cmnd.head.transfer_size[3] =
1147                         (vub300->datasize >> 0) & 0xFF;
1148                 if (vub300->datasize < vub300->fbs[0]) {
1149                         vub300->cmnd.head.block_count[0] = 0;
1150                         vub300->cmnd.head.block_count[1] = 0;
1151                 }
1152         }
1153         if (vub300->cmnd.head.block_size[0] || vub300->cmnd.head.block_size[1]) {
1154                 u16 block_size = vub300->cmnd.head.block_size[1] |
1155                         (vub300->cmnd.head.block_size[0] << 8);
1156                 u16 block_boundary = FIRMWARE_BLOCK_BOUNDARY -
1157                         (FIRMWARE_BLOCK_BOUNDARY % block_size);
1158                 vub300->cmnd.head.block_boundary[0] =
1159                         (block_boundary >> 8) & 0xFF;
1160                 vub300->cmnd.head.block_boundary[1] =
1161                         (block_boundary >> 0) & 0xFF;
1162         } else {
1163                 vub300->cmnd.head.block_boundary[0] = 0;
1164                 vub300->cmnd.head.block_boundary[1] = 0;
1165         }
1166         usb_fill_bulk_urb(vub300->command_out_urb, vub300->udev,
1167                           usb_sndbulkpipe(vub300->udev, vub300->cmnd_out_ep),
1168                           &vub300->cmnd, sizeof(vub300->cmnd),
1169                           command_out_completed, vub300);
1170         retval = usb_submit_urb(vub300->command_out_urb, GFP_KERNEL);
1171         if (retval < 0) {
1172                 cmd->error = retval;
1173                 complete(&vub300->command_complete);
1174                 return;
1175         } else {
1176                 return;
1177         }
1178 }
1179
1180 /*
1181  * timer callback runs in atomic mode
1182  *       so it cannot call usb_kill_urb()
1183  */
1184 static void vub300_sg_timed_out(struct timer_list *t)
1185 {
1186         struct vub300_mmc_host *vub300 = from_timer(vub300, t,
1187                                                     sg_transfer_timer);
1188         vub300->usb_timed_out = 1;
1189         usb_sg_cancel(&vub300->sg_request);
1190         usb_unlink_urb(vub300->command_out_urb);
1191         usb_unlink_urb(vub300->command_res_urb);
1192 }
1193
1194 static u16 roundup_to_multiple_of_64(u16 number)
1195 {
1196         return 0xFFC0 & (0x3F + number);
1197 }
1198
1199 /*
1200  * this is a separate function to solve the 80 column width restriction
1201  */
1202 static void __download_offload_pseudocode(struct vub300_mmc_host *vub300,
1203                                           const struct firmware *fw)
1204 {
1205         u8 register_count = 0;
1206         u16 ts = 0;
1207         u16 interrupt_size = 0;
1208         const u8 *data = fw->data;
1209         int size = fw->size;
1210         u8 c;
1211         dev_info(&vub300->udev->dev, "using %s for SDIO offload processing\n",
1212                  vub300->vub_name);
1213         do {
1214                 c = *data++;
1215         } while (size-- && c); /* skip comment */
1216         dev_info(&vub300->udev->dev, "using offload firmware %s %s\n", fw->data,
1217                  vub300->vub_name);
1218         if (size < 4) {
1219                 dev_err(&vub300->udev->dev,
1220                         "corrupt offload pseudocode in firmware %s\n",
1221                         vub300->vub_name);
1222                 strncpy(vub300->vub_name, "corrupt offload pseudocode",
1223                         sizeof(vub300->vub_name));
1224                 return;
1225         }
1226         interrupt_size += *data++;
1227         size -= 1;
1228         interrupt_size <<= 8;
1229         interrupt_size += *data++;
1230         size -= 1;
1231         if (interrupt_size < size) {
1232                 u16 xfer_length = roundup_to_multiple_of_64(interrupt_size);
1233                 u8 *xfer_buffer = kmalloc(xfer_length, GFP_KERNEL);
1234                 if (xfer_buffer) {
1235                         int retval;
1236                         memcpy(xfer_buffer, data, interrupt_size);
1237                         memset(xfer_buffer + interrupt_size, 0,
1238                                xfer_length - interrupt_size);
1239                         size -= interrupt_size;
1240                         data += interrupt_size;
1241                         retval =
1242                                 usb_control_msg(vub300->udev,
1243                                                 usb_sndctrlpipe(vub300->udev, 0),
1244                                                 SET_INTERRUPT_PSEUDOCODE,
1245                                                 USB_DIR_OUT | USB_TYPE_VENDOR |
1246                                                 USB_RECIP_DEVICE, 0x0000, 0x0000,
1247                                                 xfer_buffer, xfer_length, 1000);
1248                         kfree(xfer_buffer);
1249                         if (retval < 0)
1250                                 goto copy_error_message;
1251                 } else {
1252                         dev_err(&vub300->udev->dev,
1253                                 "not enough memory for xfer buffer to send"
1254                                 " INTERRUPT_PSEUDOCODE for %s %s\n", fw->data,
1255                                 vub300->vub_name);
1256                         strncpy(vub300->vub_name,
1257                                 "SDIO interrupt pseudocode download failed",
1258                                 sizeof(vub300->vub_name));
1259                         return;
1260                 }
1261         } else {
1262                 dev_err(&vub300->udev->dev,
1263                         "corrupt interrupt pseudocode in firmware %s %s\n",
1264                         fw->data, vub300->vub_name);
1265                 strncpy(vub300->vub_name, "corrupt interrupt pseudocode",
1266                         sizeof(vub300->vub_name));
1267                 return;
1268         }
1269         ts += *data++;
1270         size -= 1;
1271         ts <<= 8;
1272         ts += *data++;
1273         size -= 1;
1274         if (ts < size) {
1275                 u16 xfer_length = roundup_to_multiple_of_64(ts);
1276                 u8 *xfer_buffer = kmalloc(xfer_length, GFP_KERNEL);
1277                 if (xfer_buffer) {
1278                         int retval;
1279                         memcpy(xfer_buffer, data, ts);
1280                         memset(xfer_buffer + ts, 0,
1281                                xfer_length - ts);
1282                         size -= ts;
1283                         data += ts;
1284                         retval =
1285                                 usb_control_msg(vub300->udev,
1286                                                 usb_sndctrlpipe(vub300->udev, 0),
1287                                                 SET_TRANSFER_PSEUDOCODE,
1288                                                 USB_DIR_OUT | USB_TYPE_VENDOR |
1289                                                 USB_RECIP_DEVICE, 0x0000, 0x0000,
1290                                                 xfer_buffer, xfer_length, 1000);
1291                         kfree(xfer_buffer);
1292                         if (retval < 0)
1293                                 goto copy_error_message;
1294                 } else {
1295                         dev_err(&vub300->udev->dev,
1296                                 "not enough memory for xfer buffer to send"
1297                                 " TRANSFER_PSEUDOCODE for %s %s\n", fw->data,
1298                                 vub300->vub_name);
1299                         strncpy(vub300->vub_name,
1300                                 "SDIO transfer pseudocode download failed",
1301                                 sizeof(vub300->vub_name));
1302                         return;
1303                 }
1304         } else {
1305                 dev_err(&vub300->udev->dev,
1306                         "corrupt transfer pseudocode in firmware %s %s\n",
1307                         fw->data, vub300->vub_name);
1308                 strncpy(vub300->vub_name, "corrupt transfer pseudocode",
1309                         sizeof(vub300->vub_name));
1310                 return;
1311         }
1312         register_count += *data++;
1313         size -= 1;
1314         if (register_count * 4 == size) {
1315                 int I = vub300->dynamic_register_count = register_count;
1316                 int i = 0;
1317                 while (I--) {
1318                         unsigned int func_num = 0;
1319                         vub300->sdio_register[i].func_num = *data++;
1320                         size -= 1;
1321                         func_num += *data++;
1322                         size -= 1;
1323                         func_num <<= 8;
1324                         func_num += *data++;
1325                         size -= 1;
1326                         func_num <<= 8;
1327                         func_num += *data++;
1328                         size -= 1;
1329                         vub300->sdio_register[i].sdio_reg = func_num;
1330                         vub300->sdio_register[i].activate = 1;
1331                         vub300->sdio_register[i].prepared = 0;
1332                         i += 1;
1333                 }
1334                 dev_info(&vub300->udev->dev,
1335                          "initialized %d dynamic pseudocode registers\n",
1336                          vub300->dynamic_register_count);
1337                 return;
1338         } else {
1339                 dev_err(&vub300->udev->dev,
1340                         "corrupt dynamic registers in firmware %s\n",
1341                         vub300->vub_name);
1342                 strncpy(vub300->vub_name, "corrupt dynamic registers",
1343                         sizeof(vub300->vub_name));
1344                 return;
1345         }
1346
1347         return;
1348
1349 copy_error_message:
1350         strncpy(vub300->vub_name, "SDIO pseudocode download failed",
1351                 sizeof(vub300->vub_name));
1352 }
1353
1354 /*
1355  * if the binary containing the EMPTY PseudoCode can not be found
1356  * vub300->vub_name is set anyway in order to prevent an automatic retry
1357  */
1358 static void download_offload_pseudocode(struct vub300_mmc_host *vub300)
1359 {
1360         struct mmc_card *card = vub300->mmc->card;
1361         int sdio_funcs = card->sdio_funcs;
1362         const struct firmware *fw = NULL;
1363         int l = snprintf(vub300->vub_name, sizeof(vub300->vub_name),
1364                          "/*(DEBLOBBED)*/", card->cis.vendor, card->cis.device);
1365         int n = 0;
1366         int retval;
1367         for (n = 0; n < sdio_funcs; n++) {
1368                 struct sdio_func *sf = card->sdio_func[n];
1369                 l += snprintf(vub300->vub_name + l,
1370                               sizeof(vub300->vub_name) - l, "_%04X%04X",
1371                               sf->vendor, sf->device);
1372         }
1373         /*(DEBLOBBED)*/
1374         dev_info(&vub300->udev->dev, "requesting offload firmware %s\n",
1375                  vub300->vub_name);
1376         retval = reject_firmware(&fw, vub300->vub_name, &card->dev);
1377         if (retval < 0) {
1378                 strncpy(vub300->vub_name, "/*(DEBLOBBED)*/",
1379                         sizeof(vub300->vub_name));
1380                 retval = reject_firmware(&fw, vub300->vub_name, &card->dev);
1381                 if (retval < 0) {
1382                         strncpy(vub300->vub_name,
1383                                 "no SDIO offload firmware found",
1384                                 sizeof(vub300->vub_name));
1385                 } else {
1386                         __download_offload_pseudocode(vub300, fw);
1387                         release_firmware(fw);
1388                 }
1389         } else {
1390                 __download_offload_pseudocode(vub300, fw);
1391                 release_firmware(fw);
1392         }
1393 }
1394
1395 static void vub300_usb_bulk_msg_completion(struct urb *urb)
1396 {                               /* urb completion handler - hardirq */
1397         complete((struct completion *)urb->context);
1398 }
1399
1400 static int vub300_usb_bulk_msg(struct vub300_mmc_host *vub300,
1401                                unsigned int pipe, void *data, int len,
1402                                int *actual_length, int timeout_msecs)
1403 {
1404         /* cmd_mutex is held by vub300_cmndwork_thread */
1405         struct usb_device *usb_dev = vub300->udev;
1406         struct completion done;
1407         int retval;
1408         vub300->urb = usb_alloc_urb(0, GFP_KERNEL);
1409         if (!vub300->urb)
1410                 return -ENOMEM;
1411         usb_fill_bulk_urb(vub300->urb, usb_dev, pipe, data, len,
1412                           vub300_usb_bulk_msg_completion, NULL);
1413         init_completion(&done);
1414         vub300->urb->context = &done;
1415         vub300->urb->actual_length = 0;
1416         retval = usb_submit_urb(vub300->urb, GFP_KERNEL);
1417         if (unlikely(retval))
1418                 goto out;
1419         if (!wait_for_completion_timeout
1420             (&done, msecs_to_jiffies(timeout_msecs))) {
1421                 retval = -ETIMEDOUT;
1422                 usb_kill_urb(vub300->urb);
1423         } else {
1424                 retval = vub300->urb->status;
1425         }
1426 out:
1427         *actual_length = vub300->urb->actual_length;
1428         usb_free_urb(vub300->urb);
1429         vub300->urb = NULL;
1430         return retval;
1431 }
1432
1433 static int __command_read_data(struct vub300_mmc_host *vub300,
1434                                struct mmc_command *cmd, struct mmc_data *data)
1435 {
1436         /* cmd_mutex is held by vub300_cmndwork_thread */
1437         int linear_length = vub300->datasize;
1438         int padded_length = vub300->large_usb_packets ?
1439                 ((511 + linear_length) >> 9) << 9 :
1440                 ((63 + linear_length) >> 6) << 6;
1441         if ((padded_length == linear_length) || !pad_input_to_usb_pkt) {
1442                 int result;
1443                 unsigned pipe;
1444                 pipe = usb_rcvbulkpipe(vub300->udev, vub300->data_inp_ep);
1445                 result = usb_sg_init(&vub300->sg_request, vub300->udev,
1446                                      pipe, 0, data->sg,
1447                                      data->sg_len, 0, GFP_KERNEL);
1448                 if (result < 0) {
1449                         usb_unlink_urb(vub300->command_out_urb);
1450                         usb_unlink_urb(vub300->command_res_urb);
1451                         cmd->error = result;
1452                         data->bytes_xfered = 0;
1453                         return 0;
1454                 } else {
1455                         vub300->sg_transfer_timer.expires =
1456                                 jiffies + msecs_to_jiffies(2000 +
1457                                                   (linear_length / 16384));
1458                         add_timer(&vub300->sg_transfer_timer);
1459                         usb_sg_wait(&vub300->sg_request);
1460                         del_timer(&vub300->sg_transfer_timer);
1461                         if (vub300->sg_request.status < 0) {
1462                                 cmd->error = vub300->sg_request.status;
1463                                 data->bytes_xfered = 0;
1464                                 return 0;
1465                         } else {
1466                                 data->bytes_xfered = vub300->datasize;
1467                                 return linear_length;
1468                         }
1469                 }
1470         } else {
1471                 u8 *buf = kmalloc(padded_length, GFP_KERNEL);
1472                 if (buf) {
1473                         int result;
1474                         unsigned pipe = usb_rcvbulkpipe(vub300->udev,
1475                                                         vub300->data_inp_ep);
1476                         int actual_length = 0;
1477                         result = vub300_usb_bulk_msg(vub300, pipe, buf,
1478                                              padded_length, &actual_length,
1479                                              2000 + (padded_length / 16384));
1480                         if (result < 0) {
1481                                 cmd->error = result;
1482                                 data->bytes_xfered = 0;
1483                                 kfree(buf);
1484                                 return 0;
1485                         } else if (actual_length < linear_length) {
1486                                 cmd->error = -EREMOTEIO;
1487                                 data->bytes_xfered = 0;
1488                                 kfree(buf);
1489                                 return 0;
1490                         } else {
1491                                 sg_copy_from_buffer(data->sg, data->sg_len, buf,
1492                                                     linear_length);
1493                                 kfree(buf);
1494                                 data->bytes_xfered = vub300->datasize;
1495                                 return linear_length;
1496                         }
1497                 } else {
1498                         cmd->error = -ENOMEM;
1499                         data->bytes_xfered = 0;
1500                         return 0;
1501                 }
1502         }
1503 }
1504
1505 static int __command_write_data(struct vub300_mmc_host *vub300,
1506                                 struct mmc_command *cmd, struct mmc_data *data)
1507 {
1508         /* cmd_mutex is held by vub300_cmndwork_thread */
1509         unsigned pipe = usb_sndbulkpipe(vub300->udev, vub300->data_out_ep);
1510         int linear_length = vub300->datasize;
1511         int modulo_64_length = linear_length & 0x003F;
1512         int modulo_512_length = linear_length & 0x01FF;
1513         if (linear_length < 64) {
1514                 int result;
1515                 int actual_length;
1516                 sg_copy_to_buffer(data->sg, data->sg_len,
1517                                   vub300->padded_buffer,
1518                                   sizeof(vub300->padded_buffer));
1519                 memset(vub300->padded_buffer + linear_length, 0,
1520                        sizeof(vub300->padded_buffer) - linear_length);
1521                 result = vub300_usb_bulk_msg(vub300, pipe, vub300->padded_buffer,
1522                                              sizeof(vub300->padded_buffer),
1523                                              &actual_length, 2000 +
1524                                              (sizeof(vub300->padded_buffer) /
1525                                               16384));
1526                 if (result < 0) {
1527                         cmd->error = result;
1528                         data->bytes_xfered = 0;
1529                 } else {
1530                         data->bytes_xfered = vub300->datasize;
1531                 }
1532         } else if ((!vub300->large_usb_packets && (0 < modulo_64_length)) ||
1533                     (vub300->large_usb_packets && (64 > modulo_512_length))
1534                 ) {             /* don't you just love these work-rounds */
1535                 int padded_length = ((63 + linear_length) >> 6) << 6;
1536                 u8 *buf = kmalloc(padded_length, GFP_KERNEL);
1537                 if (buf) {
1538                         int result;
1539                         int actual_length;
1540                         sg_copy_to_buffer(data->sg, data->sg_len, buf,
1541                                           padded_length);
1542                         memset(buf + linear_length, 0,
1543                                padded_length - linear_length);
1544                         result =
1545                                 vub300_usb_bulk_msg(vub300, pipe, buf,
1546                                                     padded_length, &actual_length,
1547                                                     2000 + padded_length / 16384);
1548                         kfree(buf);
1549                         if (result < 0) {
1550                                 cmd->error = result;
1551                                 data->bytes_xfered = 0;
1552                         } else {
1553                                 data->bytes_xfered = vub300->datasize;
1554                         }
1555                 } else {
1556                         cmd->error = -ENOMEM;
1557                         data->bytes_xfered = 0;
1558                 }
1559         } else {                /* no data padding required */
1560                 int result;
1561                 unsigned char buf[64 * 4];
1562                 sg_copy_to_buffer(data->sg, data->sg_len, buf, sizeof(buf));
1563                 result = usb_sg_init(&vub300->sg_request, vub300->udev,
1564                                      pipe, 0, data->sg,
1565                                      data->sg_len, 0, GFP_KERNEL);
1566                 if (result < 0) {
1567                         usb_unlink_urb(vub300->command_out_urb);
1568                         usb_unlink_urb(vub300->command_res_urb);
1569                         cmd->error = result;
1570                         data->bytes_xfered = 0;
1571                 } else {
1572                         vub300->sg_transfer_timer.expires =
1573                                 jiffies + msecs_to_jiffies(2000 +
1574                                                            linear_length / 16384);
1575                         add_timer(&vub300->sg_transfer_timer);
1576                         usb_sg_wait(&vub300->sg_request);
1577                         if (cmd->error) {
1578                                 data->bytes_xfered = 0;
1579                         } else {
1580                                 del_timer(&vub300->sg_transfer_timer);
1581                                 if (vub300->sg_request.status < 0) {
1582                                         cmd->error = vub300->sg_request.status;
1583                                         data->bytes_xfered = 0;
1584                                 } else {
1585                                         data->bytes_xfered = vub300->datasize;
1586                                 }
1587                         }
1588                 }
1589         }
1590         return linear_length;
1591 }
1592
1593 static void __vub300_command_response(struct vub300_mmc_host *vub300,
1594                                       struct mmc_command *cmd,
1595                                       struct mmc_data *data, int data_length)
1596 {
1597         /* cmd_mutex is held by vub300_cmndwork_thread */
1598         long respretval;
1599         int msec_timeout = 1000 + data_length / 4;
1600         respretval =
1601                 wait_for_completion_timeout(&vub300->command_complete,
1602                                             msecs_to_jiffies(msec_timeout));
1603         if (respretval == 0) { /* TIMED OUT */
1604                 /* we don't know which of "out" and "res" if any failed */
1605                 int result;
1606                 vub300->usb_timed_out = 1;
1607                 usb_kill_urb(vub300->command_out_urb);
1608                 usb_kill_urb(vub300->command_res_urb);
1609                 cmd->error = -ETIMEDOUT;
1610                 result = usb_lock_device_for_reset(vub300->udev,
1611                                                    vub300->interface);
1612                 if (result == 0) {
1613                         result = usb_reset_device(vub300->udev);
1614                         usb_unlock_device(vub300->udev);
1615                 }
1616         } else if (respretval < 0) {
1617                 /* we don't know which of "out" and "res" if any failed */
1618                 usb_kill_urb(vub300->command_out_urb);
1619                 usb_kill_urb(vub300->command_res_urb);
1620                 cmd->error = respretval;
1621         } else if (cmd->error) {
1622                 /*
1623                  * the error occurred sending the command
1624                  * or receiving the response
1625                  */
1626         } else if (vub300->command_out_urb->status) {
1627                 vub300->usb_transport_fail = vub300->command_out_urb->status;
1628                 cmd->error = -EPROTO == vub300->command_out_urb->status ?
1629                         -ESHUTDOWN : vub300->command_out_urb->status;
1630         } else if (vub300->command_res_urb->status) {
1631                 vub300->usb_transport_fail = vub300->command_res_urb->status;
1632                 cmd->error = -EPROTO == vub300->command_res_urb->status ?
1633                         -ESHUTDOWN : vub300->command_res_urb->status;
1634         } else if (vub300->resp.common.header_type == 0x00) {
1635                 /*
1636                  * the command completed successfully
1637                  * and there was no piggybacked data
1638                  */
1639         } else if (vub300->resp.common.header_type == RESPONSE_ERROR) {
1640                 cmd->error =
1641                         vub300_response_error(vub300->resp.error.error_code);
1642                 if (vub300->data)
1643                         usb_sg_cancel(&vub300->sg_request);
1644         } else if (vub300->resp.common.header_type == RESPONSE_PIGGYBACKED) {
1645                 int offloaded_data_length =
1646                         vub300->resp.common.header_size -
1647                         sizeof(struct sd_register_header);
1648                 int register_count = offloaded_data_length >> 3;
1649                 int ri = 0;
1650                 while (register_count--) {
1651                         add_offloaded_reg(vub300, &vub300->resp.pig.reg[ri]);
1652                         ri += 1;
1653                 }
1654                 vub300->resp.common.header_size =
1655                         sizeof(struct sd_register_header);
1656                 vub300->resp.common.header_type = 0x00;
1657                 cmd->error = 0;
1658         } else if (vub300->resp.common.header_type == RESPONSE_PIG_DISABLED) {
1659                 int offloaded_data_length =
1660                         vub300->resp.common.header_size -
1661                         sizeof(struct sd_register_header);
1662                 int register_count = offloaded_data_length >> 3;
1663                 int ri = 0;
1664                 while (register_count--) {
1665                         add_offloaded_reg(vub300, &vub300->resp.pig.reg[ri]);
1666                         ri += 1;
1667                 }
1668                 mutex_lock(&vub300->irq_mutex);
1669                 if (vub300->irqs_queued) {
1670                         vub300->irqs_queued += 1;
1671                 } else if (vub300->irq_enabled) {
1672                         vub300->irqs_queued += 1;
1673                         vub300_queue_poll_work(vub300, 0);
1674                 } else {
1675                         vub300->irqs_queued += 1;
1676                 }
1677                 vub300->irq_disabled = 1;
1678                 mutex_unlock(&vub300->irq_mutex);
1679                 vub300->resp.common.header_size =
1680                         sizeof(struct sd_register_header);
1681                 vub300->resp.common.header_type = 0x00;
1682                 cmd->error = 0;
1683         } else if (vub300->resp.common.header_type == RESPONSE_PIG_ENABLED) {
1684                 int offloaded_data_length =
1685                         vub300->resp.common.header_size -
1686                         sizeof(struct sd_register_header);
1687                 int register_count = offloaded_data_length >> 3;
1688                 int ri = 0;
1689                 while (register_count--) {
1690                         add_offloaded_reg(vub300, &vub300->resp.pig.reg[ri]);
1691                         ri += 1;
1692                 }
1693                 mutex_lock(&vub300->irq_mutex);
1694                 if (vub300->irqs_queued) {
1695                         vub300->irqs_queued += 1;
1696                 } else if (vub300->irq_enabled) {
1697                         vub300->irqs_queued += 1;
1698                         vub300_queue_poll_work(vub300, 0);
1699                 } else {
1700                         vub300->irqs_queued += 1;
1701                 }
1702                 vub300->irq_disabled = 0;
1703                 mutex_unlock(&vub300->irq_mutex);
1704                 vub300->resp.common.header_size =
1705                         sizeof(struct sd_register_header);
1706                 vub300->resp.common.header_type = 0x00;
1707                 cmd->error = 0;
1708         } else {
1709                 cmd->error = -EINVAL;
1710         }
1711 }
1712
1713 static void construct_request_response(struct vub300_mmc_host *vub300,
1714                                        struct mmc_command *cmd)
1715 {
1716         int resp_len = vub300->resp_len;
1717         int less_cmd = (17 == resp_len) ? resp_len : resp_len - 1;
1718         int bytes = 3 & less_cmd;
1719         int words = less_cmd >> 2;
1720         u8 *r = vub300->resp.response.command_response;
1721         if (bytes == 3) {
1722                 cmd->resp[words] = (r[1 + (words << 2)] << 24)
1723                         | (r[2 + (words << 2)] << 16)
1724                         | (r[3 + (words << 2)] << 8);
1725         } else if (bytes == 2) {
1726                 cmd->resp[words] = (r[1 + (words << 2)] << 24)
1727                         | (r[2 + (words << 2)] << 16);
1728         } else if (bytes == 1) {
1729                 cmd->resp[words] = (r[1 + (words << 2)] << 24);
1730         }
1731         while (words-- > 0) {
1732                 cmd->resp[words] = (r[1 + (words << 2)] << 24)
1733                         | (r[2 + (words << 2)] << 16)
1734                         | (r[3 + (words << 2)] << 8)
1735                         | (r[4 + (words << 2)] << 0);
1736         }
1737         if ((cmd->opcode == 53) && (0x000000FF & cmd->resp[0]))
1738                 cmd->resp[0] &= 0xFFFFFF00;
1739 }
1740
1741 /* this thread runs only when there is an upper level command req outstanding */
1742 static void vub300_cmndwork_thread(struct work_struct *work)
1743 {
1744         struct vub300_mmc_host *vub300 =
1745                 container_of(work, struct vub300_mmc_host, cmndwork);
1746         if (!vub300->interface) {
1747                 kref_put(&vub300->kref, vub300_delete);
1748                 return;
1749         } else {
1750                 struct mmc_request *req = vub300->req;
1751                 struct mmc_command *cmd = vub300->cmd;
1752                 struct mmc_data *data = vub300->data;
1753                 int data_length;
1754                 mutex_lock(&vub300->cmd_mutex);
1755                 init_completion(&vub300->command_complete);
1756                 if (likely(vub300->vub_name[0]) || !vub300->mmc->card) {
1757                         /*
1758                          * the name of the EMPTY Pseudo firmware file
1759                          * is used as a flag to indicate that the file
1760                          * has been already downloaded to the VUB300 chip
1761                          */
1762                 } else if (0 == vub300->mmc->card->sdio_funcs) {
1763                         strncpy(vub300->vub_name, "SD memory device",
1764                                 sizeof(vub300->vub_name));
1765                 } else {
1766                         download_offload_pseudocode(vub300);
1767                 }
1768                 send_command(vub300);
1769                 if (!data)
1770                         data_length = 0;
1771                 else if (MMC_DATA_READ & data->flags)
1772                         data_length = __command_read_data(vub300, cmd, data);
1773                 else
1774                         data_length = __command_write_data(vub300, cmd, data);
1775                 __vub300_command_response(vub300, cmd, data, data_length);
1776                 vub300->req = NULL;
1777                 vub300->cmd = NULL;
1778                 vub300->data = NULL;
1779                 if (cmd->error) {
1780                         if (cmd->error == -ENOMEDIUM)
1781                                 check_vub300_port_status(vub300);
1782                         mutex_unlock(&vub300->cmd_mutex);
1783                         mmc_request_done(vub300->mmc, req);
1784                         kref_put(&vub300->kref, vub300_delete);
1785                         return;
1786                 } else {
1787                         construct_request_response(vub300, cmd);
1788                         vub300->resp_len = 0;
1789                         mutex_unlock(&vub300->cmd_mutex);
1790                         kref_put(&vub300->kref, vub300_delete);
1791                         mmc_request_done(vub300->mmc, req);
1792                         return;
1793                 }
1794         }
1795 }
1796
1797 static int examine_cyclic_buffer(struct vub300_mmc_host *vub300,
1798                                  struct mmc_command *cmd, u8 Function)
1799 {
1800         /* cmd_mutex is held by vub300_mmc_request */
1801         u8 cmd0 = 0xFF & (cmd->arg >> 24);
1802         u8 cmd1 = 0xFF & (cmd->arg >> 16);
1803         u8 cmd2 = 0xFF & (cmd->arg >> 8);
1804         u8 cmd3 = 0xFF & (cmd->arg >> 0);
1805         int first = MAXREGMASK & vub300->fn[Function].offload_point;
1806         struct offload_registers_access *rf = &vub300->fn[Function].reg[first];
1807         if (cmd0 == rf->command_byte[0] &&
1808             cmd1 == rf->command_byte[1] &&
1809             cmd2 == rf->command_byte[2] &&
1810             cmd3 == rf->command_byte[3]) {
1811                 u8 checksum = 0x00;
1812                 cmd->resp[1] = checksum << 24;
1813                 cmd->resp[0] = (rf->Respond_Byte[0] << 24)
1814                         | (rf->Respond_Byte[1] << 16)
1815                         | (rf->Respond_Byte[2] << 8)
1816                         | (rf->Respond_Byte[3] << 0);
1817                 vub300->fn[Function].offload_point += 1;
1818                 vub300->fn[Function].offload_count -= 1;
1819                 vub300->total_offload_count -= 1;
1820                 return 1;
1821         } else {
1822                 int delta = 1;  /* because it does not match the first one */
1823                 u8 register_count = vub300->fn[Function].offload_count - 1;
1824                 u32 register_point = vub300->fn[Function].offload_point + 1;
1825                 while (0 < register_count) {
1826                         int point = MAXREGMASK & register_point;
1827                         struct offload_registers_access *r =
1828                                 &vub300->fn[Function].reg[point];
1829                         if (cmd0 == r->command_byte[0] &&
1830                             cmd1 == r->command_byte[1] &&
1831                             cmd2 == r->command_byte[2] &&
1832                             cmd3 == r->command_byte[3]) {
1833                                 u8 checksum = 0x00;
1834                                 cmd->resp[1] = checksum << 24;
1835                                 cmd->resp[0] = (r->Respond_Byte[0] << 24)
1836                                         | (r->Respond_Byte[1] << 16)
1837                                         | (r->Respond_Byte[2] << 8)
1838                                         | (r->Respond_Byte[3] << 0);
1839                                 vub300->fn[Function].offload_point += delta;
1840                                 vub300->fn[Function].offload_count -= delta;
1841                                 vub300->total_offload_count -= delta;
1842                                 return 1;
1843                         } else {
1844                                 register_point += 1;
1845                                 register_count -= 1;
1846                                 delta += 1;
1847                                 continue;
1848                         }
1849                 }
1850                 return 0;
1851         }
1852 }
1853
1854 static int satisfy_request_from_offloaded_data(struct vub300_mmc_host *vub300,
1855                                                struct mmc_command *cmd)
1856 {
1857         /* cmd_mutex is held by vub300_mmc_request */
1858         u8 regs = vub300->dynamic_register_count;
1859         u8 i = 0;
1860         u8 func = FUN(cmd);
1861         u32 reg = REG(cmd);
1862         while (0 < regs--) {
1863                 if ((vub300->sdio_register[i].func_num == func) &&
1864                     (vub300->sdio_register[i].sdio_reg == reg)) {
1865                         if (!vub300->sdio_register[i].prepared) {
1866                                 return 0;
1867                         } else if ((0x80000000 & cmd->arg) == 0x80000000) {
1868                                 /*
1869                                  * a write to a dynamic register
1870                                  * nullifies our offloaded value
1871                                  */
1872                                 vub300->sdio_register[i].prepared = 0;
1873                                 return 0;
1874                         } else {
1875                                 u8 checksum = 0x00;
1876                                 u8 rsp0 = 0x00;
1877                                 u8 rsp1 = 0x00;
1878                                 u8 rsp2 = vub300->sdio_register[i].response;
1879                                 u8 rsp3 = vub300->sdio_register[i].regvalue;
1880                                 vub300->sdio_register[i].prepared = 0;
1881                                 cmd->resp[1] = checksum << 24;
1882                                 cmd->resp[0] = (rsp0 << 24)
1883                                         | (rsp1 << 16)
1884                                         | (rsp2 << 8)
1885                                         | (rsp3 << 0);
1886                                 return 1;
1887                         }
1888                 } else {
1889                         i += 1;
1890                         continue;
1891                 }
1892         }
1893         if (vub300->total_offload_count == 0)
1894                 return 0;
1895         else if (vub300->fn[func].offload_count == 0)
1896                 return 0;
1897         else
1898                 return examine_cyclic_buffer(vub300, cmd, func);
1899 }
1900
1901 static void vub300_mmc_request(struct mmc_host *mmc, struct mmc_request *req)
1902 {                               /* NOT irq */
1903         struct mmc_command *cmd = req->cmd;
1904         struct vub300_mmc_host *vub300 = mmc_priv(mmc);
1905         if (!vub300->interface) {
1906                 cmd->error = -ESHUTDOWN;
1907                 mmc_request_done(mmc, req);
1908                 return;
1909         } else {
1910                 struct mmc_data *data = req->data;
1911                 if (!vub300->card_powered) {
1912                         cmd->error = -ENOMEDIUM;
1913                         mmc_request_done(mmc, req);
1914                         return;
1915                 }
1916                 if (!vub300->card_present) {
1917                         cmd->error = -ENOMEDIUM;
1918                         mmc_request_done(mmc, req);
1919                         return;
1920                 }
1921                 if (vub300->usb_transport_fail) {
1922                         cmd->error = vub300->usb_transport_fail;
1923                         mmc_request_done(mmc, req);
1924                         return;
1925                 }
1926                 if (!vub300->interface) {
1927                         cmd->error = -ENODEV;
1928                         mmc_request_done(mmc, req);
1929                         return;
1930                 }
1931                 kref_get(&vub300->kref);
1932                 mutex_lock(&vub300->cmd_mutex);
1933                 mod_timer(&vub300->inactivity_timer, jiffies + HZ);
1934                 /*
1935                  * for performance we have to return immediately
1936                  * if the requested data has been offloaded
1937                  */
1938                 if (cmd->opcode == 52 &&
1939                     satisfy_request_from_offloaded_data(vub300, cmd)) {
1940                         cmd->error = 0;
1941                         mutex_unlock(&vub300->cmd_mutex);
1942                         kref_put(&vub300->kref, vub300_delete);
1943                         mmc_request_done(mmc, req);
1944                         return;
1945                 } else {
1946                         vub300->cmd = cmd;
1947                         vub300->req = req;
1948                         vub300->data = data;
1949                         if (data)
1950                                 vub300->datasize = data->blksz * data->blocks;
1951                         else
1952                                 vub300->datasize = 0;
1953                         vub300_queue_cmnd_work(vub300);
1954                         mutex_unlock(&vub300->cmd_mutex);
1955                         kref_put(&vub300->kref, vub300_delete);
1956                         /*
1957                          * the kernel lock diagnostics complain
1958                          * if the cmd_mutex * is "passed on"
1959                          * to the cmndwork thread,
1960                          * so we must release it now
1961                          * and re-acquire it in the cmndwork thread
1962                          */
1963                 }
1964         }
1965 }
1966
1967 static void __set_clock_speed(struct vub300_mmc_host *vub300, u8 buf[8],
1968                               struct mmc_ios *ios)
1969 {
1970         int buf_array_size = 8; /* ARRAY_SIZE(buf) does not work !!! */
1971         int retval;
1972         u32 kHzClock;
1973         if (ios->clock >= 48000000)
1974                 kHzClock = 48000;
1975         else if (ios->clock >= 24000000)
1976                 kHzClock = 24000;
1977         else if (ios->clock >= 20000000)
1978                 kHzClock = 20000;
1979         else if (ios->clock >= 15000000)
1980                 kHzClock = 15000;
1981         else if (ios->clock >= 200000)
1982                 kHzClock = 200;
1983         else
1984                 kHzClock = 0;
1985         {
1986                 int i;
1987                 u64 c = kHzClock;
1988                 for (i = 0; i < buf_array_size; i++) {
1989                         buf[i] = c;
1990                         c >>= 8;
1991                 }
1992         }
1993         retval =
1994                 usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
1995                                 SET_CLOCK_SPEED,
1996                                 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
1997                                 0x00, 0x00, buf, buf_array_size, 1000);
1998         if (retval != 8) {
1999                 dev_err(&vub300->udev->dev, "SET_CLOCK_SPEED"
2000                         " %dkHz failed with retval=%d\n", kHzClock, retval);
2001         } else {
2002                 dev_dbg(&vub300->udev->dev, "SET_CLOCK_SPEED"
2003                         " %dkHz\n", kHzClock);
2004         }
2005 }
2006
2007 static void vub300_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
2008 {                               /* NOT irq */
2009         struct vub300_mmc_host *vub300 = mmc_priv(mmc);
2010         if (!vub300->interface)
2011                 return;
2012         kref_get(&vub300->kref);
2013         mutex_lock(&vub300->cmd_mutex);
2014         if ((ios->power_mode == MMC_POWER_OFF) && vub300->card_powered) {
2015                 vub300->card_powered = 0;
2016                 usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
2017                                 SET_SD_POWER,
2018                                 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2019                                 0x0000, 0x0000, NULL, 0, 1000);
2020                 /* must wait for the VUB300 u-proc to boot up */
2021                 msleep(600);
2022         } else if ((ios->power_mode == MMC_POWER_UP) && !vub300->card_powered) {
2023                 usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
2024                                 SET_SD_POWER,
2025                                 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2026                                 0x0001, 0x0000, NULL, 0, 1000);
2027                 msleep(600);
2028                 vub300->card_powered = 1;
2029         } else if (ios->power_mode == MMC_POWER_ON) {
2030                 u8 *buf = kmalloc(8, GFP_KERNEL);
2031                 if (buf) {
2032                         __set_clock_speed(vub300, buf, ios);
2033                         kfree(buf);
2034                 }
2035         } else {
2036                 /* this should mean no change of state */
2037         }
2038         mutex_unlock(&vub300->cmd_mutex);
2039         kref_put(&vub300->kref, vub300_delete);
2040 }
2041
2042 static int vub300_mmc_get_ro(struct mmc_host *mmc)
2043 {
2044         struct vub300_mmc_host *vub300 = mmc_priv(mmc);
2045         return vub300->read_only;
2046 }
2047
2048 static void vub300_enable_sdio_irq(struct mmc_host *mmc, int enable)
2049 {                               /* NOT irq */
2050         struct vub300_mmc_host *vub300 = mmc_priv(mmc);
2051         if (!vub300->interface)
2052                 return;
2053         kref_get(&vub300->kref);
2054         if (enable) {
2055                 mutex_lock(&vub300->irq_mutex);
2056                 if (vub300->irqs_queued) {
2057                         vub300->irqs_queued -= 1;
2058                         mmc_signal_sdio_irq(vub300->mmc);
2059                 } else if (vub300->irq_disabled) {
2060                         vub300->irq_disabled = 0;
2061                         vub300->irq_enabled = 1;
2062                         vub300_queue_poll_work(vub300, 0);
2063                 } else if (vub300->irq_enabled) {
2064                         /* this should not happen, so we will just ignore it */
2065                 } else {
2066                         vub300->irq_enabled = 1;
2067                         vub300_queue_poll_work(vub300, 0);
2068                 }
2069                 mutex_unlock(&vub300->irq_mutex);
2070         } else {
2071                 vub300->irq_enabled = 0;
2072         }
2073         kref_put(&vub300->kref, vub300_delete);
2074 }
2075
2076 static void vub300_init_card(struct mmc_host *mmc, struct mmc_card *card)
2077 {                               /* NOT irq */
2078         struct vub300_mmc_host *vub300 = mmc_priv(mmc);
2079         dev_info(&vub300->udev->dev, "NO host QUIRKS for this card\n");
2080 }
2081
2082 static const struct mmc_host_ops vub300_mmc_ops = {
2083         .request = vub300_mmc_request,
2084         .set_ios = vub300_mmc_set_ios,
2085         .get_ro = vub300_mmc_get_ro,
2086         .enable_sdio_irq = vub300_enable_sdio_irq,
2087         .init_card = vub300_init_card,
2088 };
2089
2090 static int vub300_probe(struct usb_interface *interface,
2091                         const struct usb_device_id *id)
2092 {                               /* NOT irq */
2093         struct vub300_mmc_host *vub300;
2094         struct usb_host_interface *iface_desc;
2095         struct usb_device *udev = usb_get_dev(interface_to_usbdev(interface));
2096         int i;
2097         int retval = -ENOMEM;
2098         struct urb *command_out_urb;
2099         struct urb *command_res_urb;
2100         struct mmc_host *mmc;
2101         char manufacturer[48];
2102         char product[32];
2103         char serial_number[32];
2104         usb_string(udev, udev->descriptor.iManufacturer, manufacturer,
2105                    sizeof(manufacturer));
2106         usb_string(udev, udev->descriptor.iProduct, product, sizeof(product));
2107         usb_string(udev, udev->descriptor.iSerialNumber, serial_number,
2108                    sizeof(serial_number));
2109         dev_info(&udev->dev, "probing VID:PID(%04X:%04X) %s %s %s\n",
2110                  le16_to_cpu(udev->descriptor.idVendor),
2111                  le16_to_cpu(udev->descriptor.idProduct),
2112                  manufacturer, product, serial_number);
2113         command_out_urb = usb_alloc_urb(0, GFP_KERNEL);
2114         if (!command_out_urb) {
2115                 retval = -ENOMEM;
2116                 goto error0;
2117         }
2118         command_res_urb = usb_alloc_urb(0, GFP_KERNEL);
2119         if (!command_res_urb) {
2120                 retval = -ENOMEM;
2121                 goto error1;
2122         }
2123         /* this also allocates memory for our VUB300 mmc host device */
2124         mmc = mmc_alloc_host(sizeof(struct vub300_mmc_host), &udev->dev);
2125         if (!mmc) {
2126                 retval = -ENOMEM;
2127                 dev_err(&udev->dev, "not enough memory for the mmc_host\n");
2128                 goto error4;
2129         }
2130         /* MMC core transfer sizes tunable parameters */
2131         mmc->caps = 0;
2132         if (!force_1_bit_data_xfers)
2133                 mmc->caps |= MMC_CAP_4_BIT_DATA;
2134         if (!force_polling_for_irqs)
2135                 mmc->caps |= MMC_CAP_SDIO_IRQ;
2136         mmc->caps &= ~MMC_CAP_NEEDS_POLL;
2137         /*
2138          * MMC_CAP_NEEDS_POLL causes core.c:mmc_rescan() to poll
2139          * for devices which results in spurious CMD7's being
2140          * issued which stops some SDIO cards from working
2141          */
2142         if (limit_speed_to_24_MHz) {
2143                 mmc->caps |= MMC_CAP_MMC_HIGHSPEED;
2144                 mmc->caps |= MMC_CAP_SD_HIGHSPEED;
2145                 mmc->f_max = 24000000;
2146                 dev_info(&udev->dev, "limiting SDIO speed to 24_MHz\n");
2147         } else {
2148                 mmc->caps |= MMC_CAP_MMC_HIGHSPEED;
2149                 mmc->caps |= MMC_CAP_SD_HIGHSPEED;
2150                 mmc->f_max = 48000000;
2151         }
2152         mmc->f_min = 200000;
2153         mmc->max_blk_count = 511;
2154         mmc->max_blk_size = 512;
2155         mmc->max_segs = 128;
2156         if (force_max_req_size)
2157                 mmc->max_req_size = force_max_req_size * 1024;
2158         else
2159                 mmc->max_req_size = 64 * 1024;
2160         mmc->max_seg_size = mmc->max_req_size;
2161         mmc->ocr_avail = 0;
2162         mmc->ocr_avail |= MMC_VDD_165_195;
2163         mmc->ocr_avail |= MMC_VDD_20_21;
2164         mmc->ocr_avail |= MMC_VDD_21_22;
2165         mmc->ocr_avail |= MMC_VDD_22_23;
2166         mmc->ocr_avail |= MMC_VDD_23_24;
2167         mmc->ocr_avail |= MMC_VDD_24_25;
2168         mmc->ocr_avail |= MMC_VDD_25_26;
2169         mmc->ocr_avail |= MMC_VDD_26_27;
2170         mmc->ocr_avail |= MMC_VDD_27_28;
2171         mmc->ocr_avail |= MMC_VDD_28_29;
2172         mmc->ocr_avail |= MMC_VDD_29_30;
2173         mmc->ocr_avail |= MMC_VDD_30_31;
2174         mmc->ocr_avail |= MMC_VDD_31_32;
2175         mmc->ocr_avail |= MMC_VDD_32_33;
2176         mmc->ocr_avail |= MMC_VDD_33_34;
2177         mmc->ocr_avail |= MMC_VDD_34_35;
2178         mmc->ocr_avail |= MMC_VDD_35_36;
2179         mmc->ops = &vub300_mmc_ops;
2180         vub300 = mmc_priv(mmc);
2181         vub300->mmc = mmc;
2182         vub300->card_powered = 0;
2183         vub300->bus_width = 0;
2184         vub300->cmnd.head.block_size[0] = 0x00;
2185         vub300->cmnd.head.block_size[1] = 0x00;
2186         vub300->app_spec = 0;
2187         mutex_init(&vub300->cmd_mutex);
2188         mutex_init(&vub300->irq_mutex);
2189         vub300->command_out_urb = command_out_urb;
2190         vub300->command_res_urb = command_res_urb;
2191         vub300->usb_timed_out = 0;
2192         vub300->dynamic_register_count = 0;
2193
2194         for (i = 0; i < ARRAY_SIZE(vub300->fn); i++) {
2195                 vub300->fn[i].offload_point = 0;
2196                 vub300->fn[i].offload_count = 0;
2197         }
2198
2199         vub300->total_offload_count = 0;
2200         vub300->irq_enabled = 0;
2201         vub300->irq_disabled = 0;
2202         vub300->irqs_queued = 0;
2203
2204         for (i = 0; i < ARRAY_SIZE(vub300->sdio_register); i++)
2205                 vub300->sdio_register[i++].activate = 0;
2206
2207         vub300->udev = udev;
2208         vub300->interface = interface;
2209         vub300->cmnd_res_ep = 0;
2210         vub300->cmnd_out_ep = 0;
2211         vub300->data_inp_ep = 0;
2212         vub300->data_out_ep = 0;
2213
2214         for (i = 0; i < ARRAY_SIZE(vub300->fbs); i++)
2215                 vub300->fbs[i] = 512;
2216
2217         /*
2218          *      set up the endpoint information
2219          *
2220          * use the first pair of bulk-in and bulk-out
2221          *     endpoints for Command/Response+Interrupt
2222          *
2223          * use the second pair of bulk-in and bulk-out
2224          *     endpoints for Data In/Out
2225          */
2226         vub300->large_usb_packets = 0;
2227         iface_desc = interface->cur_altsetting;
2228         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
2229                 struct usb_endpoint_descriptor *endpoint =
2230                         &iface_desc->endpoint[i].desc;
2231                 dev_info(&vub300->udev->dev,
2232                          "vub300 testing %s EndPoint(%d) %02X\n",
2233                          usb_endpoint_is_bulk_in(endpoint) ? "BULK IN" :
2234                          usb_endpoint_is_bulk_out(endpoint) ? "BULK OUT" :
2235                          "UNKNOWN", i, endpoint->bEndpointAddress);
2236                 if (endpoint->wMaxPacketSize > 64)
2237                         vub300->large_usb_packets = 1;
2238                 if (usb_endpoint_is_bulk_in(endpoint)) {
2239                         if (!vub300->cmnd_res_ep) {
2240                                 vub300->cmnd_res_ep =
2241                                         endpoint->bEndpointAddress;
2242                         } else if (!vub300->data_inp_ep) {
2243                                 vub300->data_inp_ep =
2244                                         endpoint->bEndpointAddress;
2245                         } else {
2246                                 dev_warn(&vub300->udev->dev,
2247                                          "ignoring"
2248                                          " unexpected bulk_in endpoint");
2249                         }
2250                 } else if (usb_endpoint_is_bulk_out(endpoint)) {
2251                         if (!vub300->cmnd_out_ep) {
2252                                 vub300->cmnd_out_ep =
2253                                         endpoint->bEndpointAddress;
2254                         } else if (!vub300->data_out_ep) {
2255                                 vub300->data_out_ep =
2256                                         endpoint->bEndpointAddress;
2257                         } else {
2258                                 dev_warn(&vub300->udev->dev,
2259                                          "ignoring"
2260                                          " unexpected bulk_out endpoint");
2261                         }
2262                 } else {
2263                         dev_warn(&vub300->udev->dev,
2264                                  "vub300 ignoring EndPoint(%d) %02X", i,
2265                                  endpoint->bEndpointAddress);
2266                 }
2267         }
2268         if (vub300->cmnd_res_ep && vub300->cmnd_out_ep &&
2269             vub300->data_inp_ep && vub300->data_out_ep) {
2270                 dev_info(&vub300->udev->dev,
2271                          "vub300 %s packets"
2272                          " using EndPoints %02X %02X %02X %02X\n",
2273                          vub300->large_usb_packets ? "LARGE" : "SMALL",
2274                          vub300->cmnd_out_ep, vub300->cmnd_res_ep,
2275                          vub300->data_out_ep, vub300->data_inp_ep);
2276                 /* we have the expected EndPoints */
2277         } else {
2278                 dev_err(&vub300->udev->dev,
2279                     "Could not find two sets of bulk-in/out endpoint pairs\n");
2280                 retval = -EINVAL;
2281                 goto error5;
2282         }
2283         retval =
2284                 usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
2285                                 GET_HC_INF0,
2286                                 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2287                                 0x0000, 0x0000, &vub300->hc_info,
2288                                 sizeof(vub300->hc_info), 1000);
2289         if (retval < 0)
2290                 goto error5;
2291         retval =
2292                 usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
2293                                 SET_ROM_WAIT_STATES,
2294                                 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2295                                 firmware_rom_wait_states, 0x0000, NULL, 0, 1000);
2296         if (retval < 0)
2297                 goto error5;
2298         dev_info(&vub300->udev->dev,
2299                  "operating_mode = %s %s %d MHz %s %d byte USB packets\n",
2300                  (mmc->caps & MMC_CAP_SDIO_IRQ) ? "IRQs" : "POLL",
2301                  (mmc->caps & MMC_CAP_4_BIT_DATA) ? "4-bit" : "1-bit",
2302                  mmc->f_max / 1000000,
2303                  pad_input_to_usb_pkt ? "padding input data to" : "with",
2304                  vub300->large_usb_packets ? 512 : 64);
2305         retval =
2306                 usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
2307                                 GET_SYSTEM_PORT_STATUS,
2308                                 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2309                                 0x0000, 0x0000, &vub300->system_port_status,
2310                                 sizeof(vub300->system_port_status), 1000);
2311         if (retval < 0) {
2312                 goto error4;
2313         } else if (sizeof(vub300->system_port_status) == retval) {
2314                 vub300->card_present =
2315                         (0x0001 & vub300->system_port_status.port_flags) ? 1 : 0;
2316                 vub300->read_only =
2317                         (0x0010 & vub300->system_port_status.port_flags) ? 1 : 0;
2318         } else {
2319                 goto error4;
2320         }
2321         usb_set_intfdata(interface, vub300);
2322         INIT_DELAYED_WORK(&vub300->pollwork, vub300_pollwork_thread);
2323         INIT_WORK(&vub300->cmndwork, vub300_cmndwork_thread);
2324         INIT_WORK(&vub300->deadwork, vub300_deadwork_thread);
2325         kref_init(&vub300->kref);
2326         timer_setup(&vub300->sg_transfer_timer, vub300_sg_timed_out, 0);
2327         kref_get(&vub300->kref);
2328         timer_setup(&vub300->inactivity_timer,
2329                     vub300_inactivity_timer_expired, 0);
2330         vub300->inactivity_timer.expires = jiffies + HZ;
2331         add_timer(&vub300->inactivity_timer);
2332         if (vub300->card_present)
2333                 dev_info(&vub300->udev->dev,
2334                          "USB vub300 remote SDIO host controller[%d]"
2335                          "connected with SD/SDIO card inserted\n",
2336                          interface_to_InterfaceNumber(interface));
2337         else
2338                 dev_info(&vub300->udev->dev,
2339                          "USB vub300 remote SDIO host controller[%d]"
2340                          "connected with no SD/SDIO card inserted\n",
2341                          interface_to_InterfaceNumber(interface));
2342         mmc_add_host(mmc);
2343         return 0;
2344 error5:
2345         mmc_free_host(mmc);
2346         /*
2347          * and hence also frees vub300
2348          * which is contained at the end of struct mmc
2349          */
2350 error4:
2351         usb_free_urb(command_res_urb);
2352 error1:
2353         usb_free_urb(command_out_urb);
2354 error0:
2355         usb_put_dev(udev);
2356         return retval;
2357 }
2358
2359 static void vub300_disconnect(struct usb_interface *interface)
2360 {                               /* NOT irq */
2361         struct vub300_mmc_host *vub300 = usb_get_intfdata(interface);
2362         if (!vub300 || !vub300->mmc) {
2363                 return;
2364         } else {
2365                 struct mmc_host *mmc = vub300->mmc;
2366                 if (!vub300->mmc) {
2367                         return;
2368                 } else {
2369                         int ifnum = interface_to_InterfaceNumber(interface);
2370                         usb_set_intfdata(interface, NULL);
2371                         /* prevent more I/O from starting */
2372                         vub300->interface = NULL;
2373                         kref_put(&vub300->kref, vub300_delete);
2374                         mmc_remove_host(mmc);
2375                         pr_info("USB vub300 remote SDIO host controller[%d]"
2376                                 " now disconnected", ifnum);
2377                         return;
2378                 }
2379         }
2380 }
2381
2382 #ifdef CONFIG_PM
2383 static int vub300_suspend(struct usb_interface *intf, pm_message_t message)
2384 {
2385         return 0;
2386 }
2387
2388 static int vub300_resume(struct usb_interface *intf)
2389 {
2390         return 0;
2391 }
2392 #else
2393 #define vub300_suspend NULL
2394 #define vub300_resume NULL
2395 #endif
2396 static int vub300_pre_reset(struct usb_interface *intf)
2397 {                               /* NOT irq */
2398         struct vub300_mmc_host *vub300 = usb_get_intfdata(intf);
2399         mutex_lock(&vub300->cmd_mutex);
2400         return 0;
2401 }
2402
2403 static int vub300_post_reset(struct usb_interface *intf)
2404 {                               /* NOT irq */
2405         struct vub300_mmc_host *vub300 = usb_get_intfdata(intf);
2406         /* we are sure no URBs are active - no locking needed */
2407         vub300->errors = -EPIPE;
2408         mutex_unlock(&vub300->cmd_mutex);
2409         return 0;
2410 }
2411
2412 static struct usb_driver vub300_driver = {
2413         .name = "vub300",
2414         .probe = vub300_probe,
2415         .disconnect = vub300_disconnect,
2416         .suspend = vub300_suspend,
2417         .resume = vub300_resume,
2418         .pre_reset = vub300_pre_reset,
2419         .post_reset = vub300_post_reset,
2420         .id_table = vub300_table,
2421         .supports_autosuspend = 1,
2422 };
2423
2424 static int __init vub300_init(void)
2425 {                               /* NOT irq */
2426         int result;
2427
2428         pr_info("VUB300 Driver rom wait states = %02X irqpoll timeout = %04X",
2429                 firmware_rom_wait_states, 0x0FFFF & firmware_irqpoll_timeout);
2430         cmndworkqueue = create_singlethread_workqueue("kvub300c");
2431         if (!cmndworkqueue) {
2432                 pr_err("not enough memory for the REQUEST workqueue");
2433                 result = -ENOMEM;
2434                 goto out1;
2435         }
2436         pollworkqueue = create_singlethread_workqueue("kvub300p");
2437         if (!pollworkqueue) {
2438                 pr_err("not enough memory for the IRQPOLL workqueue");
2439                 result = -ENOMEM;
2440                 goto out2;
2441         }
2442         deadworkqueue = create_singlethread_workqueue("kvub300d");
2443         if (!deadworkqueue) {
2444                 pr_err("not enough memory for the EXPIRED workqueue");
2445                 result = -ENOMEM;
2446                 goto out3;
2447         }
2448         result = usb_register(&vub300_driver);
2449         if (result) {
2450                 pr_err("usb_register failed. Error number %d", result);
2451                 goto out4;
2452         }
2453         return 0;
2454 out4:
2455         destroy_workqueue(deadworkqueue);
2456 out3:
2457         destroy_workqueue(pollworkqueue);
2458 out2:
2459         destroy_workqueue(cmndworkqueue);
2460 out1:
2461         return result;
2462 }
2463
2464 static void __exit vub300_exit(void)
2465 {
2466         usb_deregister(&vub300_driver);
2467         flush_workqueue(cmndworkqueue);
2468         flush_workqueue(pollworkqueue);
2469         flush_workqueue(deadworkqueue);
2470         destroy_workqueue(cmndworkqueue);
2471         destroy_workqueue(pollworkqueue);
2472         destroy_workqueue(deadworkqueue);
2473 }
2474
2475 module_init(vub300_init);
2476 module_exit(vub300_exit);
2477
2478 MODULE_AUTHOR("Tony Olech <tony.olech@elandigitalsystems.com>");
2479 MODULE_DESCRIPTION("VUB300 USB to SD/MMC/SDIO adapter driver");
2480 MODULE_LICENSE("GPL");