vub300.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * Remote VUB300 SDIO/SDmem Host Controller Driver
   4 *
   5 * Copyright (C) 2010 Elan Digital Systems Limited
   6 *
   7 * based on USB Skeleton driver - 2.2
   8 *
   9 * Copyright (C) 2001-2004 Greg Kroah-Hartman (greg@kroah.com)
  10 *
  11 * VUB300: is a USB 2.0 client device with a single SDIO/SDmem/MMC slot
  12 *         Any SDIO/SDmem/MMC device plugged into the VUB300 will appear,
  13 *         by virtue of this driver, to have been plugged into a local
  14 *         SDIO host controller, similar to, say, a PCI Ricoh controller
  15 *         This is because this kernel device driver is both a USB 2.0
  16 *         client device driver AND an MMC host controller driver. Thus
  17 *         if there is an existing driver for the inserted SDIO/SDmem/MMC
  18 *         device then that driver will be used by the kernel to manage
  19 *         the device in exactly the same fashion as if it had been
  20 *         directly plugged into, say, a local pci bus Ricoh controller
  21 *
  22 * RANT: this driver was written using a display 128x48 - converting it
  23 *       to a line width of 80 makes it very difficult to support. In
  24 *       particular functions have been broken down into sub functions
  25 *       and the original meaningful names have been shortened into
  26 *       cryptic ones.
  27 *       The problem is that executing a fragment of code subject to
  28 *       two conditions means an indentation of 24, thus leaving only
  29 *       56 characters for a C statement. And that is quite ridiculous!
  30 *
  31 * Data types: data passed to/from the VUB300 is fixed to a number of
  32 *             bits and driver data fields reflect that limit by using
  33 *             u8, u16, u32
  34 */
  35#include <linux/kernel.h>
  36#include <linux/errno.h>
  37#include <linux/init.h>
  38#include <linux/slab.h>
  39#include <linux/module.h>
  40#include <linux/kref.h>
  41#include <linux/uaccess.h>
  42#include <linux/usb.h>
  43#include <linux/mutex.h>
  44#include <linux/mmc/host.h>
  45#include <linux/mmc/card.h>
  46#include <linux/mmc/sdio_func.h>
  47#include <linux/mmc/sdio_ids.h>
  48#include <linux/workqueue.h>
  49#include <linux/ctype.h>
  50#include <linux/firmware.h>
  51#include <linux/scatterlist.h>
  52
  53struct host_controller_info {
  54	u8 info_size;
  55	u16 firmware_version;
  56	u8 number_of_ports;
  57} __packed;
  58
  59#define FIRMWARE_BLOCK_BOUNDARY 1024
  60struct sd_command_header {
  61	u8 header_size;
  62	u8 header_type;
  63	u8 port_number;
  64	u8 command_type; /* Bit7 - Rd/Wr */
  65	u8 command_index;
  66	u8 transfer_size[4]; /* ReadSize + ReadSize */
  67	u8 response_type;
  68	u8 arguments[4];
  69	u8 block_count[2];
  70	u8 block_size[2];
  71	u8 block_boundary[2];
  72	u8 reserved[44]; /* to pad out to 64 bytes */
  73} __packed;
  74
  75struct sd_irqpoll_header {
  76	u8 header_size;
  77	u8 header_type;
  78	u8 port_number;
  79	u8 command_type; /* Bit7 - Rd/Wr */
  80	u8 padding[16]; /* don't ask why !! */
  81	u8 poll_timeout_msb;
  82	u8 poll_timeout_lsb;
  83	u8 reserved[42]; /* to pad out to 64 bytes */
  84} __packed;
  85
  86struct sd_common_header {
  87	u8 header_size;
  88	u8 header_type;
  89	u8 port_number;
  90} __packed;
  91
  92struct sd_response_header {
  93	u8 header_size;
  94	u8 header_type;
  95	u8 port_number;
  96	u8 command_type;
  97	u8 command_index;
  98	u8 command_response[];
  99} __packed;
 100
 101struct sd_status_header {
 102	u8 header_size;
 103	u8 header_type;
 104	u8 port_number;
 105	u16 port_flags;
 106	u32 sdio_clock;
 107	u16 host_header_size;
 108	u16 func_header_size;
 109	u16 ctrl_header_size;
 110} __packed;
 111
 112struct sd_error_header {
 113	u8 header_size;
 114	u8 header_type;
 115	u8 port_number;
 116	u8 error_code;
 117} __packed;
 118
 119struct sd_interrupt_header {
 120	u8 header_size;
 121	u8 header_type;
 122	u8 port_number;
 123} __packed;
 124
 125struct offload_registers_access {
 126	u8 command_byte[4];
 127	u8 Respond_Byte[4];
 128} __packed;
 129
 130#define INTERRUPT_REGISTER_ACCESSES 15
 131struct sd_offloaded_interrupt {
 132	u8 header_size;
 133	u8 header_type;
 134	u8 port_number;
 135	struct offload_registers_access reg[INTERRUPT_REGISTER_ACCESSES];
 136} __packed;
 137
 138struct sd_register_header {
 139	u8 header_size;
 140	u8 header_type;
 141	u8 port_number;
 142	u8 command_type;
 143	u8 command_index;
 144	u8 command_response[6];
 145} __packed;
 146
 147#define PIGGYBACK_REGISTER_ACCESSES 14
 148struct sd_offloaded_piggyback {
 149	struct sd_register_header sdio;
 150	struct offload_registers_access reg[PIGGYBACK_REGISTER_ACCESSES];
 151} __packed;
 152
 153union sd_response {
 154	struct sd_common_header common;
 155	struct sd_status_header status;
 156	struct sd_error_header error;
 157	struct sd_interrupt_header interrupt;
 158	struct sd_response_header response;
 159	struct sd_offloaded_interrupt irq;
 160	struct sd_offloaded_piggyback pig;
 161} __packed;
 162
 163union sd_command {
 164	struct sd_command_header head;
 165	struct sd_irqpoll_header poll;
 166} __packed;
 167
 168enum SD_RESPONSE_TYPE {
 169	SDRT_UNSPECIFIED = 0,
 170	SDRT_NONE,
 171	SDRT_1,
 172	SDRT_1B,
 173	SDRT_2,
 174	SDRT_3,
 175	SDRT_4,
 176	SDRT_5,
 177	SDRT_5B,
 178	SDRT_6,
 179	SDRT_7,
 180};
 181
 182#define RESPONSE_INTERRUPT			0x01
 183#define RESPONSE_ERROR				0x02
 184#define RESPONSE_STATUS				0x03
 185#define RESPONSE_IRQ_DISABLED			0x05
 186#define RESPONSE_IRQ_ENABLED			0x06
 187#define RESPONSE_PIGGYBACKED			0x07
 188#define RESPONSE_NO_INTERRUPT			0x08
 189#define RESPONSE_PIG_DISABLED			0x09
 190#define RESPONSE_PIG_ENABLED			0x0A
 191#define SD_ERROR_1BIT_TIMEOUT			0x01
 192#define SD_ERROR_4BIT_TIMEOUT			0x02
 193#define SD_ERROR_1BIT_CRC_WRONG			0x03
 194#define SD_ERROR_4BIT_CRC_WRONG			0x04
 195#define SD_ERROR_1BIT_CRC_ERROR			0x05
 196#define SD_ERROR_4BIT_CRC_ERROR			0x06
 197#define SD_ERROR_NO_CMD_ENDBIT			0x07
 198#define SD_ERROR_NO_1BIT_DATEND			0x08
 199#define SD_ERROR_NO_4BIT_DATEND			0x09
 200#define SD_ERROR_1BIT_UNEXPECTED_TIMEOUT	0x0A
 201#define SD_ERROR_4BIT_UNEXPECTED_TIMEOUT	0x0B
 202#define SD_ERROR_ILLEGAL_COMMAND		0x0C
 203#define SD_ERROR_NO_DEVICE			0x0D
 204#define SD_ERROR_TRANSFER_LENGTH		0x0E
 205#define SD_ERROR_1BIT_DATA_TIMEOUT		0x0F
 206#define SD_ERROR_4BIT_DATA_TIMEOUT		0x10
 207#define SD_ERROR_ILLEGAL_STATE			0x11
 208#define SD_ERROR_UNKNOWN_ERROR			0x12
 209#define SD_ERROR_RESERVED_ERROR			0x13
 210#define SD_ERROR_INVALID_FUNCTION		0x14
 211#define SD_ERROR_OUT_OF_RANGE			0x15
 212#define SD_ERROR_STAT_CMD			0x16
 213#define SD_ERROR_STAT_DATA			0x17
 214#define SD_ERROR_STAT_CMD_TIMEOUT		0x18
 215#define SD_ERROR_SDCRDY_STUCK			0x19
 216#define SD_ERROR_UNHANDLED			0x1A
 217#define SD_ERROR_OVERRUN			0x1B
 218#define SD_ERROR_PIO_TIMEOUT			0x1C
 219
 220#define FUN(c) (0x000007 & (c->arg>>28))
 221#define REG(c) (0x01FFFF & (c->arg>>9))
 222
 223static bool limit_speed_to_24_MHz;
 224module_param(limit_speed_to_24_MHz, bool, 0644);
 225MODULE_PARM_DESC(limit_speed_to_24_MHz, "Limit Max SDIO Clock Speed to 24 MHz");
 226
 227static bool pad_input_to_usb_pkt;
 228module_param(pad_input_to_usb_pkt, bool, 0644);
 229MODULE_PARM_DESC(pad_input_to_usb_pkt,
 230		 "Pad USB data input transfers to whole USB Packet");
 231
 232static bool disable_offload_processing;
 233module_param(disable_offload_processing, bool, 0644);
 234MODULE_PARM_DESC(disable_offload_processing, "Disable Offload Processing");
 235
 236static bool force_1_bit_data_xfers;
 237module_param(force_1_bit_data_xfers, bool, 0644);
 238MODULE_PARM_DESC(force_1_bit_data_xfers,
 239		 "Force SDIO Data Transfers to 1-bit Mode");
 240
 241static bool force_polling_for_irqs;
 242module_param(force_polling_for_irqs, bool, 0644);
 243MODULE_PARM_DESC(force_polling_for_irqs, "Force Polling for SDIO interrupts");
 244
 245static int firmware_irqpoll_timeout = 1024;
 246module_param(firmware_irqpoll_timeout, int, 0644);
 247MODULE_PARM_DESC(firmware_irqpoll_timeout, "VUB300 firmware irqpoll timeout");
 248
 249static int force_max_req_size = 128;
 250module_param(force_max_req_size, int, 0644);
 251MODULE_PARM_DESC(force_max_req_size, "set max request size in kBytes");
 252
 253#ifdef SMSC_DEVELOPMENT_BOARD
 254static int firmware_rom_wait_states = 0x04;
 255#else
 256static int firmware_rom_wait_states = 0x1C;
 257#endif
 258
 259module_param(firmware_rom_wait_states, int, 0644);
 260MODULE_PARM_DESC(firmware_rom_wait_states,
 261		 "ROM wait states byte=RRRIIEEE (Reserved Internal External)");
 262
 263#define ELAN_VENDOR_ID		0x2201
 264#define VUB300_VENDOR_ID	0x0424
 265#define VUB300_PRODUCT_ID	0x012C
 266static const struct usb_device_id vub300_table[] = {
 267	{USB_DEVICE(ELAN_VENDOR_ID, VUB300_PRODUCT_ID)},
 268	{USB_DEVICE(VUB300_VENDOR_ID, VUB300_PRODUCT_ID)},
 269	{} /* Terminating entry */
 270};
 271MODULE_DEVICE_TABLE(usb, vub300_table);
 272
 273static struct workqueue_struct *cmndworkqueue;
 274static struct workqueue_struct *pollworkqueue;
 275static struct workqueue_struct *deadworkqueue;
 276
 277static inline int interface_to_InterfaceNumber(struct usb_interface *interface)
 278{
 279	if (!interface)
 280		return -1;
 281	if (!interface->cur_altsetting)
 282		return -1;
 283	return interface->cur_altsetting->desc.bInterfaceNumber;
 284}
 285
 286struct sdio_register {
 287	unsigned func_num:3;
 288	unsigned sdio_reg:17;
 289	unsigned activate:1;
 290	unsigned prepared:1;
 291	unsigned regvalue:8;
 292	unsigned response:8;
 293	unsigned sparebit:26;
 294};
 295
 296struct vub300_mmc_host {
 297	struct usb_device *udev;
 298	struct usb_interface *interface;
 299	struct kref kref;
 300	struct mutex cmd_mutex;
 301	struct mutex irq_mutex;
 302	char vub_name[3 + (9 * 8) + 4 + 1]; /* max of 7 sdio fn's */
 303	u8 cmnd_out_ep; /* EndPoint for commands */
 304	u8 cmnd_res_ep; /* EndPoint for responses */
 305	u8 data_out_ep; /* EndPoint for out data */
 306	u8 data_inp_ep; /* EndPoint for inp data */
 307	bool card_powered;
 308	bool card_present;
 309	bool read_only;
 310	bool large_usb_packets;
 311	bool app_spec; /* ApplicationSpecific */
 312	bool irq_enabled; /* by the MMC CORE */
 313	bool irq_disabled; /* in the firmware */
 314	unsigned bus_width:4;
 315	u8 total_offload_count;
 316	u8 dynamic_register_count;
 317	u8 resp_len;
 318	u32 datasize;
 319	int errors;
 320	int usb_transport_fail;
 321	int usb_timed_out;
 322	int irqs_queued;
 323	struct sdio_register sdio_register[16];
 324	struct offload_interrupt_function_register {
 325#define MAXREGBITS 4
 326#define MAXREGS (1<<MAXREGBITS)
 327#define MAXREGMASK (MAXREGS-1)
 328		u8 offload_count;
 329		u32 offload_point;
 330		struct offload_registers_access reg[MAXREGS];
 331	} fn[8];
 332	u16 fbs[8]; /* Function Block Size */
 333	struct mmc_command *cmd;
 334	struct mmc_request *req;
 335	struct mmc_data *data;
 336	struct mmc_host *mmc;
 337	struct urb *urb;
 338	struct urb *command_out_urb;
 339	struct urb *command_res_urb;
 340	struct completion command_complete;
 341	struct completion irqpoll_complete;
 342	union sd_command cmnd;
 343	union sd_response resp;
 344	struct timer_list sg_transfer_timer;
 345	struct usb_sg_request sg_request;
 346	struct timer_list inactivity_timer;
 347	struct work_struct deadwork;
 348	struct work_struct cmndwork;
 349	struct delayed_work pollwork;
 350	struct host_controller_info hc_info;
 351	struct sd_status_header system_port_status;
 352	u8 padded_buffer[64];
 353};
 354
 355#define kref_to_vub300_mmc_host(d) container_of(d, struct vub300_mmc_host, kref)
 356#define SET_TRANSFER_PSEUDOCODE		21
 357#define SET_INTERRUPT_PSEUDOCODE	20
 358#define SET_FAILURE_MODE		18
 359#define SET_ROM_WAIT_STATES		16
 360#define SET_IRQ_ENABLE			13
 361#define SET_CLOCK_SPEED			11
 362#define SET_FUNCTION_BLOCK_SIZE		9
 363#define SET_SD_DATA_MODE		6
 364#define SET_SD_POWER			4
 365#define ENTER_DFU_MODE			3
 366#define GET_HC_INF0			1
 367#define GET_SYSTEM_PORT_STATUS		0
 368
 369static void vub300_delete(struct kref *kref)
 370{				/* kref callback - softirq */
 371	struct vub300_mmc_host *vub300 = kref_to_vub300_mmc_host(kref);
 372	struct mmc_host *mmc = vub300->mmc;
 373
 374	usb_free_urb(vub300->command_out_urb);
 375	vub300->command_out_urb = NULL;
 376	usb_free_urb(vub300->command_res_urb);
 377	vub300->command_res_urb = NULL;
 378	usb_put_dev(vub300->udev);
 379	mmc_free_host(mmc);
 380	/*
 381	 * and hence also frees vub300
 382	 * which is contained at the end of struct mmc
 383	 */
 384}
 385
 386static void vub300_queue_cmnd_work(struct vub300_mmc_host *vub300)
 387{
 388	kref_get(&vub300->kref);
 389	if (queue_work(cmndworkqueue, &vub300->cmndwork)) {
 390		/*
 391		 * then the cmndworkqueue was not previously
 392		 * running and the above get ref is obvious
 393		 * required and will be put when the thread
 394		 * terminates by a specific call
 395		 */
 396	} else {
 397		/*
 398		 * the cmndworkqueue was already running from
 399		 * a previous invocation and thus to keep the
 400		 * kref counts correct we must undo the get
 401		 */
 402		kref_put(&vub300->kref, vub300_delete);
 403	}
 404}
 405
 406static void vub300_queue_poll_work(struct vub300_mmc_host *vub300, int delay)
 407{
 408	kref_get(&vub300->kref);
 409	if (queue_delayed_work(pollworkqueue, &vub300->pollwork, delay)) {
 410		/*
 411		 * then the pollworkqueue was not previously
 412		 * running and the above get ref is obvious
 413		 * required and will be put when the thread
 414		 * terminates by a specific call
 415		 */
 416	} else {
 417		/*
 418		 * the pollworkqueue was already running from
 419		 * a previous invocation and thus to keep the
 420		 * kref counts correct we must undo the get
 421		 */
 422		kref_put(&vub300->kref, vub300_delete);
 423	}
 424}
 425
 426static void vub300_queue_dead_work(struct vub300_mmc_host *vub300)
 427{
 428	kref_get(&vub300->kref);
 429	if (queue_work(deadworkqueue, &vub300->deadwork)) {
 430		/*
 431		 * then the deadworkqueue was not previously
 432		 * running and the above get ref is obvious
 433		 * required and will be put when the thread
 434		 * terminates by a specific call
 435		 */
 436	} else {
 437		/*
 438		 * the deadworkqueue was already running from
 439		 * a previous invocation and thus to keep the
 440		 * kref counts correct we must undo the get
 441		 */
 442		kref_put(&vub300->kref, vub300_delete);
 443	}
 444}
 445
 446static void irqpoll_res_completed(struct urb *urb)
 447{				/* urb completion handler - hardirq */
 448	struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
 449	if (urb->status)
 450		vub300->usb_transport_fail = urb->status;
 451	complete(&vub300->irqpoll_complete);
 452}
 453
 454static void irqpoll_out_completed(struct urb *urb)
 455{				/* urb completion handler - hardirq */
 456	struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
 457	if (urb->status) {
 458		vub300->usb_transport_fail = urb->status;
 459		complete(&vub300->irqpoll_complete);
 460		return;
 461	} else {
 462		int ret;
 463		unsigned int pipe =
 464			usb_rcvbulkpipe(vub300->udev, vub300->cmnd_res_ep);
 465		usb_fill_bulk_urb(vub300->command_res_urb, vub300->udev, pipe,
 466				  &vub300->resp, sizeof(vub300->resp),
 467				  irqpoll_res_completed, vub300);
 468		vub300->command_res_urb->actual_length = 0;
 469		ret = usb_submit_urb(vub300->command_res_urb, GFP_ATOMIC);
 470		if (ret) {
 471			vub300->usb_transport_fail = ret;
 472			complete(&vub300->irqpoll_complete);
 473		}
 474		return;
 475	}
 476}
 477
 478static void send_irqpoll(struct vub300_mmc_host *vub300)
 479{
 480	/* cmd_mutex is held by vub300_pollwork_thread */
 481	int retval;
 482	int timeout = 0xFFFF & (0x0001FFFF - firmware_irqpoll_timeout);
 483	vub300->cmnd.poll.header_size = 22;
 484	vub300->cmnd.poll.header_type = 1;
 485	vub300->cmnd.poll.port_number = 0;
 486	vub300->cmnd.poll.command_type = 2;
 487	vub300->cmnd.poll.poll_timeout_lsb = 0xFF & (unsigned)timeout;
 488	vub300->cmnd.poll.poll_timeout_msb = 0xFF & (unsigned)(timeout >> 8);
 489	usb_fill_bulk_urb(vub300->command_out_urb, vub300->udev,
 490			  usb_sndbulkpipe(vub300->udev, vub300->cmnd_out_ep)
 491			  , &vub300->cmnd, sizeof(vub300->cmnd)
 492			  , irqpoll_out_completed, vub300);
 493	retval = usb_submit_urb(vub300->command_out_urb, GFP_KERNEL);
 494	if (0 > retval) {
 495		vub300->usb_transport_fail = retval;
 496		vub300_queue_poll_work(vub300, 1);
 497		complete(&vub300->irqpoll_complete);
 498		return;
 499	} else {
 500		return;
 501	}
 502}
 503
 504static void new_system_port_status(struct vub300_mmc_host *vub300)
 505{
 506	int old_card_present = vub300->card_present;
 507	int new_card_present =
 508		(0x0001 & vub300->system_port_status.port_flags) ? 1 : 0;
 509	vub300->read_only =
 510		(0x0010 & vub300->system_port_status.port_flags) ? 1 : 0;
 511	if (new_card_present && !old_card_present) {
 512		dev_info(&vub300->udev->dev, "card just inserted\n");
 513		vub300->card_present = 1;
 514		vub300->bus_width = 0;
 515		if (disable_offload_processing)
 516			strscpy(vub300->vub_name, "EMPTY Processing Disabled",
 517				sizeof(vub300->vub_name));
 518		else
 519			vub300->vub_name[0] = 0;
 520		mmc_detect_change(vub300->mmc, 1);
 521	} else if (!new_card_present && old_card_present) {
 522		dev_info(&vub300->udev->dev, "card just ejected\n");
 523		vub300->card_present = 0;
 524		mmc_detect_change(vub300->mmc, 0);
 525	} else {
 526		/* no change */
 527	}
 528}
 529
 530static void __add_offloaded_reg_to_fifo(struct vub300_mmc_host *vub300,
 531					struct offload_registers_access
 532					*register_access, u8 func)
 533{
 534	u8 r = vub300->fn[func].offload_point + vub300->fn[func].offload_count;
 535	memcpy(&vub300->fn[func].reg[MAXREGMASK & r], register_access,
 536	       sizeof(struct offload_registers_access));
 537	vub300->fn[func].offload_count += 1;
 538	vub300->total_offload_count += 1;
 539}
 540
 541static void add_offloaded_reg(struct vub300_mmc_host *vub300,
 542			      struct offload_registers_access *register_access)
 543{
 544	u32 Register = ((0x03 & register_access->command_byte[0]) << 15)
 545			| ((0xFF & register_access->command_byte[1]) << 7)
 546			| ((0xFE & register_access->command_byte[2]) >> 1);
 547	u8 func = ((0x70 & register_access->command_byte[0]) >> 4);
 548	u8 regs = vub300->dynamic_register_count;
 549	u8 i = 0;
 550	while (0 < regs-- && 1 == vub300->sdio_register[i].activate) {
 551		if (vub300->sdio_register[i].func_num == func &&
 552		    vub300->sdio_register[i].sdio_reg == Register) {
 553			if (vub300->sdio_register[i].prepared == 0)
 554				vub300->sdio_register[i].prepared = 1;
 555			vub300->sdio_register[i].response =
 556				register_access->Respond_Byte[2];
 557			vub300->sdio_register[i].regvalue =
 558				register_access->Respond_Byte[3];
 559			return;
 560		} else {
 561			i += 1;
 562			continue;
 563		}
 564	}
 565	__add_offloaded_reg_to_fifo(vub300, register_access, func);
 566}
 567
 568static void check_vub300_port_status(struct vub300_mmc_host *vub300)
 569{
 570	/*
 571	 * cmd_mutex is held by vub300_pollwork_thread,
 572	 * vub300_deadwork_thread or vub300_cmndwork_thread
 573	 */
 574	int retval;
 575	retval =
 576		usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
 577				GET_SYSTEM_PORT_STATUS,
 578				USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 579				0x0000, 0x0000, &vub300->system_port_status,
 580				sizeof(vub300->system_port_status), 1000);
 581	if (sizeof(vub300->system_port_status) == retval)
 582		new_system_port_status(vub300);
 583}
 584
 585static void __vub300_irqpoll_response(struct vub300_mmc_host *vub300)
 586{
 587	/* cmd_mutex is held by vub300_pollwork_thread */
 588	if (vub300->command_res_urb->actual_length == 0)
 589		return;
 590
 591	switch (vub300->resp.common.header_type) {
 592	case RESPONSE_INTERRUPT:
 593		mutex_lock(&vub300->irq_mutex);
 594		if (vub300->irq_enabled)
 595			mmc_signal_sdio_irq(vub300->mmc);
 596		else
 597			vub300->irqs_queued += 1;
 598		vub300->irq_disabled = 1;
 599		mutex_unlock(&vub300->irq_mutex);
 600		break;
 601	case RESPONSE_ERROR:
 602		if (vub300->resp.error.error_code == SD_ERROR_NO_DEVICE)
 603			check_vub300_port_status(vub300);
 604		break;
 605	case RESPONSE_STATUS:
 606		vub300->system_port_status = vub300->resp.status;
 607		new_system_port_status(vub300);
 608		if (!vub300->card_present)
 609			vub300_queue_poll_work(vub300, HZ / 5);
 610		break;
 611	case RESPONSE_IRQ_DISABLED:
 612	{
 613		int offloaded_data_length = vub300->resp.common.header_size - 3;
 614		int register_count = offloaded_data_length >> 3;
 615		int ri = 0;
 616		while (register_count--) {
 617			add_offloaded_reg(vub300, &vub300->resp.irq.reg[ri]);
 618			ri += 1;
 619		}
 620		mutex_lock(&vub300->irq_mutex);
 621		if (vub300->irq_enabled)
 622			mmc_signal_sdio_irq(vub300->mmc);
 623		else
 624			vub300->irqs_queued += 1;
 625		vub300->irq_disabled = 1;
 626		mutex_unlock(&vub300->irq_mutex);
 627		break;
 628	}
 629	case RESPONSE_IRQ_ENABLED:
 630	{
 631		int offloaded_data_length = vub300->resp.common.header_size - 3;
 632		int register_count = offloaded_data_length >> 3;
 633		int ri = 0;
 634		while (register_count--) {
 635			add_offloaded_reg(vub300, &vub300->resp.irq.reg[ri]);
 636			ri += 1;
 637		}
 638		mutex_lock(&vub300->irq_mutex);
 639		if (vub300->irq_enabled)
 640			mmc_signal_sdio_irq(vub300->mmc);
 641		else
 642			vub300->irqs_queued += 1;
 643		vub300->irq_disabled = 0;
 644		mutex_unlock(&vub300->irq_mutex);
 645		break;
 646	}
 647	case RESPONSE_NO_INTERRUPT:
 648		vub300_queue_poll_work(vub300, 1);
 649		break;
 650	default:
 651		break;
 652	}
 653}
 654
 655static void __do_poll(struct vub300_mmc_host *vub300)
 656{
 657	/* cmd_mutex is held by vub300_pollwork_thread */
 658	unsigned long commretval;
 659	mod_timer(&vub300->inactivity_timer, jiffies + HZ);
 660	init_completion(&vub300->irqpoll_complete);
 661	send_irqpoll(vub300);
 662	commretval = wait_for_completion_timeout(&vub300->irqpoll_complete,
 663						 msecs_to_jiffies(500));
 664	if (vub300->usb_transport_fail) {
 665		/* no need to do anything */
 666	} else if (commretval == 0) {
 667		vub300->usb_timed_out = 1;
 668		usb_kill_urb(vub300->command_out_urb);
 669		usb_kill_urb(vub300->command_res_urb);
 670	} else { /* commretval > 0 */
 671		__vub300_irqpoll_response(vub300);
 672	}
 673}
 674
 675/* this thread runs only when the driver
 676 * is trying to poll the device for an IRQ
 677 */
 678static void vub300_pollwork_thread(struct work_struct *work)
 679{				/* NOT irq */
 680	struct vub300_mmc_host *vub300 = container_of(work,
 681			      struct vub300_mmc_host, pollwork.work);
 682	if (!vub300->interface) {
 683		kref_put(&vub300->kref, vub300_delete);
 684		return;
 685	}
 686	mutex_lock(&vub300->cmd_mutex);
 687	if (vub300->cmd) {
 688		vub300_queue_poll_work(vub300, 1);
 689	} else if (!vub300->card_present) {
 690		/* no need to do anything */
 691	} else { /* vub300->card_present */
 692		mutex_lock(&vub300->irq_mutex);
 693		if (!vub300->irq_enabled) {
 694			mutex_unlock(&vub300->irq_mutex);
 695		} else if (vub300->irqs_queued) {
 696			vub300->irqs_queued -= 1;
 697			mmc_signal_sdio_irq(vub300->mmc);
 698			mod_timer(&vub300->inactivity_timer, jiffies + HZ);
 699			mutex_unlock(&vub300->irq_mutex);
 700		} else { /* NOT vub300->irqs_queued */
 701			mutex_unlock(&vub300->irq_mutex);
 702			__do_poll(vub300);
 703		}
 704	}
 705	mutex_unlock(&vub300->cmd_mutex);
 706	kref_put(&vub300->kref, vub300_delete);
 707}
 708
 709static void vub300_deadwork_thread(struct work_struct *work)
 710{				/* NOT irq */
 711	struct vub300_mmc_host *vub300 =
 712		container_of(work, struct vub300_mmc_host, deadwork);
 713	if (!vub300->interface) {
 714		kref_put(&vub300->kref, vub300_delete);
 715		return;
 716	}
 717	mutex_lock(&vub300->cmd_mutex);
 718	if (vub300->cmd) {
 719		/*
 720		 * a command got in as the inactivity
 721		 * timer expired - so we just let the
 722		 * processing of the command show if
 723		 * the device is dead
 724		 */
 725	} else if (vub300->card_present) {
 726		check_vub300_port_status(vub300);
 727	} else if (vub300->mmc && vub300->mmc->card) {
 728		/*
 729		 * the MMC core must not have responded
 730		 * to the previous indication - lets
 731		 * hope that it eventually does so we
 732		 * will just ignore this for now
 733		 */
 734	} else {
 735		check_vub300_port_status(vub300);
 736	}
 737	mod_timer(&vub300->inactivity_timer, jiffies + HZ);
 738	mutex_unlock(&vub300->cmd_mutex);
 739	kref_put(&vub300->kref, vub300_delete);
 740}
 741
 742static void vub300_inactivity_timer_expired(struct timer_list *t)
 743{				/* softirq */
 744	struct vub300_mmc_host *vub300 = timer_container_of(vub300, t,
 745							    inactivity_timer);
 746	if (!vub300->interface) {
 747		kref_put(&vub300->kref, vub300_delete);
 748	} else if (vub300->cmd) {
 749		mod_timer(&vub300->inactivity_timer, jiffies + HZ);
 750	} else {
 751		vub300_queue_dead_work(vub300);
 752		mod_timer(&vub300->inactivity_timer, jiffies + HZ);
 753	}
 754}
 755
 756static int vub300_response_error(u8 error_code)
 757{
 758	switch (error_code) {
 759	case SD_ERROR_PIO_TIMEOUT:
 760	case SD_ERROR_1BIT_TIMEOUT:
 761	case SD_ERROR_4BIT_TIMEOUT:
 762		return -ETIMEDOUT;
 763	case SD_ERROR_STAT_DATA:
 764	case SD_ERROR_OVERRUN:
 765	case SD_ERROR_STAT_CMD:
 766	case SD_ERROR_STAT_CMD_TIMEOUT:
 767	case SD_ERROR_SDCRDY_STUCK:
 768	case SD_ERROR_UNHANDLED:
 769	case SD_ERROR_1BIT_CRC_WRONG:
 770	case SD_ERROR_4BIT_CRC_WRONG:
 771	case SD_ERROR_1BIT_CRC_ERROR:
 772	case SD_ERROR_4BIT_CRC_ERROR:
 773	case SD_ERROR_NO_CMD_ENDBIT:
 774	case SD_ERROR_NO_1BIT_DATEND:
 775	case SD_ERROR_NO_4BIT_DATEND:
 776	case SD_ERROR_1BIT_DATA_TIMEOUT:
 777	case SD_ERROR_4BIT_DATA_TIMEOUT:
 778	case SD_ERROR_1BIT_UNEXPECTED_TIMEOUT:
 779	case SD_ERROR_4BIT_UNEXPECTED_TIMEOUT:
 780		return -EILSEQ;
 781	case 33:
 782		return -EILSEQ;
 783	case SD_ERROR_ILLEGAL_COMMAND:
 784		return -EINVAL;
 785	case SD_ERROR_NO_DEVICE:
 786		return -ENOMEDIUM;
 787	default:
 788		return -ENODEV;
 789	}
 790}
 791
 792static void command_res_completed(struct urb *urb)
 793{				/* urb completion handler - hardirq */
 794	struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
 795	if (urb->status) {
 796		/* we have to let the initiator handle the error */
 797	} else if (vub300->command_res_urb->actual_length == 0) {
 798		/*
 799		 * we have seen this happen once or twice and
 800		 * we suspect a buggy USB host controller
 801		 */
 802	} else if (!vub300->data) {
 803		/* this means that the command (typically CMD52) succeeded */
 804	} else if (vub300->resp.common.header_type != 0x02) {
 805		/*
 806		 * this is an error response from the VUB300 chip
 807		 * and we let the initiator handle it
 808		 */
 809	} else if (vub300->urb) {
 810		vub300->cmd->error =
 811			vub300_response_error(vub300->resp.error.error_code);
 812		usb_unlink_urb(vub300->urb);
 813	} else {
 814		vub300->cmd->error =
 815			vub300_response_error(vub300->resp.error.error_code);
 816		usb_sg_cancel(&vub300->sg_request);
 817	}
 818	complete(&vub300->command_complete);	/* got_response_in */
 819}
 820
 821static void command_out_completed(struct urb *urb)
 822{				/* urb completion handler - hardirq */
 823	struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
 824	if (urb->status) {
 825		complete(&vub300->command_complete);
 826	} else {
 827		int ret;
 828		unsigned int pipe =
 829			usb_rcvbulkpipe(vub300->udev, vub300->cmnd_res_ep);
 830		usb_fill_bulk_urb(vub300->command_res_urb, vub300->udev, pipe,
 831				  &vub300->resp, sizeof(vub300->resp),
 832				  command_res_completed, vub300);
 833		vub300->command_res_urb->actual_length = 0;
 834		ret = usb_submit_urb(vub300->command_res_urb, GFP_ATOMIC);
 835		if (ret == 0) {
 836			/*
 837			 * the urb completion handler will call
 838			 * our completion handler
 839			 */
 840		} else {
 841			/*
 842			 * and thus we only call it directly
 843			 * when it will not be called
 844			 */
 845			complete(&vub300->command_complete);
 846		}
 847	}
 848}
 849
 850/*
 851 * the STUFF bits are masked out for the comparisons
 852 */
 853static void snoop_block_size_and_bus_width(struct vub300_mmc_host *vub300,
 854					   u32 cmd_arg)
 855{
 856	if ((0xFBFFFE00 & cmd_arg) == 0x80022200)
 857		vub300->fbs[1] = (cmd_arg << 8) | (0x00FF & vub300->fbs[1]);
 858	else if ((0xFBFFFE00 & cmd_arg) == 0x80022000)
 859		vub300->fbs[1] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[1]);
 860	else if ((0xFBFFFE00 & cmd_arg) == 0x80042200)
 861		vub300->fbs[2] = (cmd_arg << 8) | (0x00FF & vub300->fbs[2]);
 862	else if ((0xFBFFFE00 & cmd_arg) == 0x80042000)
 863		vub300->fbs[2] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[2]);
 864	else if ((0xFBFFFE00 & cmd_arg) == 0x80062200)
 865		vub300->fbs[3] = (cmd_arg << 8) | (0x00FF & vub300->fbs[3]);
 866	else if ((0xFBFFFE00 & cmd_arg) == 0x80062000)
 867		vub300->fbs[3] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[3]);
 868	else if ((0xFBFFFE00 & cmd_arg) == 0x80082200)
 869		vub300->fbs[4] = (cmd_arg << 8) | (0x00FF & vub300->fbs[4]);
 870	else if ((0xFBFFFE00 & cmd_arg) == 0x80082000)
 871		vub300->fbs[4] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[4]);
 872	else if ((0xFBFFFE00 & cmd_arg) == 0x800A2200)
 873		vub300->fbs[5] = (cmd_arg << 8) | (0x00FF & vub300->fbs[5]);
 874	else if ((0xFBFFFE00 & cmd_arg) == 0x800A2000)
 875		vub300->fbs[5] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[5]);
 876	else if ((0xFBFFFE00 & cmd_arg) == 0x800C2200)
 877		vub300->fbs[6] = (cmd_arg << 8) | (0x00FF & vub300->fbs[6]);
 878	else if ((0xFBFFFE00 & cmd_arg) == 0x800C2000)
 879		vub300->fbs[6] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[6]);
 880	else if ((0xFBFFFE00 & cmd_arg) == 0x800E2200)
 881		vub300->fbs[7] = (cmd_arg << 8) | (0x00FF & vub300->fbs[7]);
 882	else if ((0xFBFFFE00 & cmd_arg) == 0x800E2000)
 883		vub300->fbs[7] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[7]);
 884	else if ((0xFBFFFE03 & cmd_arg) == 0x80000E00)
 885		vub300->bus_width = 1;
 886	else if ((0xFBFFFE03 & cmd_arg) == 0x80000E02)
 887		vub300->bus_width = 4;
 888}
 889
 890static void send_command(struct vub300_mmc_host *vub300)
 891{
 892	/* cmd_mutex is held by vub300_cmndwork_thread */
 893	struct mmc_command *cmd = vub300->cmd;
 894	struct mmc_data *data = vub300->data;
 895	int retval;
 896	int i;
 897	u8 response_type;
 898	if (vub300->app_spec) {
 899		switch (cmd->opcode) {
 900		case 6:
 901			response_type = SDRT_1;
 902			vub300->resp_len = 6;
 903			if (0x00000000 == (0x00000003 & cmd->arg))
 904				vub300->bus_width = 1;
 905			else if (0x00000002 == (0x00000003 & cmd->arg))
 906				vub300->bus_width = 4;
 907			else
 908				dev_err(&vub300->udev->dev,
 909					"unexpected ACMD6 bus_width=%d\n",
 910					0x00000003 & cmd->arg);
 911			break;
 912		case 13:
 913			response_type = SDRT_1;
 914			vub300->resp_len = 6;
 915			break;
 916		case 22:
 917			response_type = SDRT_1;
 918			vub300->resp_len = 6;
 919			break;
 920		case 23:
 921			response_type = SDRT_1;
 922			vub300->resp_len = 6;
 923			break;
 924		case 41:
 925			response_type = SDRT_3;
 926			vub300->resp_len = 6;
 927			break;
 928		case 42:
 929			response_type = SDRT_1;
 930			vub300->resp_len = 6;
 931			break;
 932		case 51:
 933			response_type = SDRT_1;
 934			vub300->resp_len = 6;
 935			break;
 936		case 55:
 937			response_type = SDRT_1;
 938			vub300->resp_len = 6;
 939			break;
 940		default:
 941			vub300->resp_len = 0;
 942			cmd->error = -EINVAL;
 943			complete(&vub300->command_complete);
 944			return;
 945		}
 946		vub300->app_spec = 0;
 947	} else {
 948		switch (cmd->opcode) {
 949		case 0:
 950			response_type = SDRT_NONE;
 951			vub300->resp_len = 0;
 952			break;
 953		case 1:
 954			response_type = SDRT_3;
 955			vub300->resp_len = 6;
 956			break;
 957		case 2:
 958			response_type = SDRT_2;
 959			vub300->resp_len = 17;
 960			break;
 961		case 3:
 962			response_type = SDRT_6;
 963			vub300->resp_len = 6;
 964			break;
 965		case 4:
 966			response_type = SDRT_NONE;
 967			vub300->resp_len = 0;
 968			break;
 969		case 5:
 970			response_type = SDRT_4;
 971			vub300->resp_len = 6;
 972			break;
 973		case 6:
 974			response_type = SDRT_1;
 975			vub300->resp_len = 6;
 976			break;
 977		case 7:
 978			response_type = SDRT_1B;
 979			vub300->resp_len = 6;
 980			break;
 981		case 8:
 982			response_type = SDRT_7;
 983			vub300->resp_len = 6;
 984			break;
 985		case 9:
 986			response_type = SDRT_2;
 987			vub300->resp_len = 17;
 988			break;
 989		case 10:
 990			response_type = SDRT_2;
 991			vub300->resp_len = 17;
 992			break;
 993		case 12:
 994			response_type = SDRT_1B;
 995			vub300->resp_len = 6;
 996			break;
 997		case 13:
 998			response_type = SDRT_1;
 999			vub300->resp_len = 6;
1000			break;
1001		case 15:
1002			response_type = SDRT_NONE;
1003			vub300->resp_len = 0;
1004			break;
1005		case 16:
1006			for (i = 0; i < ARRAY_SIZE(vub300->fbs); i++)
1007				vub300->fbs[i] = 0xFFFF & cmd->arg;
1008			response_type = SDRT_1;
1009			vub300->resp_len = 6;
1010			break;
1011		case 17:
1012		case 18:
1013		case 24:
1014		case 25:
1015		case 27:
1016			response_type = SDRT_1;
1017			vub300->resp_len = 6;
1018			break;
1019		case 28:
1020		case 29:
1021			response_type = SDRT_1B;
1022			vub300->resp_len = 6;
1023			break;
1024		case 30:
1025		case 32:
1026		case 33:
1027			response_type = SDRT_1;
1028			vub300->resp_len = 6;
1029			break;
1030		case 38:
1031			response_type = SDRT_1B;
1032			vub300->resp_len = 6;
1033			break;
1034		case 42:
1035			response_type = SDRT_1;
1036			vub300->resp_len = 6;
1037			break;
1038		case 52:
1039			response_type = SDRT_5;
1040			vub300->resp_len = 6;
1041			snoop_block_size_and_bus_width(vub300, cmd->arg);
1042			break;
1043		case 53:
1044			response_type = SDRT_5;
1045			vub300->resp_len = 6;
1046			break;
1047		case 55:
1048			response_type = SDRT_1;
1049			vub300->resp_len = 6;
1050			vub300->app_spec = 1;
1051			break;
1052		case 56:
1053			response_type = SDRT_1;
1054			vub300->resp_len = 6;
1055			break;
1056		default:
1057			vub300->resp_len = 0;
1058			cmd->error = -EINVAL;
1059			complete(&vub300->command_complete);
1060			return;
1061		}
1062	}
1063	/*
1064	 * it is a shame that we can not use "sizeof(struct sd_command_header)"
1065	 * this is because the packet _must_ be padded to 64 bytes
1066	 */
1067	vub300->cmnd.head.header_size = 20;
1068	vub300->cmnd.head.header_type = 0x00;
1069	vub300->cmnd.head.port_number = 0; /* "0" means port 1 */
1070	vub300->cmnd.head.command_type = 0x00; /* standard read command */
1071	vub300->cmnd.head.response_type = response_type;
1072	vub300->cmnd.head.command_index = cmd->opcode;
1073	vub300->cmnd.head.arguments[0] = cmd->arg >> 24;
1074	vub300->cmnd.head.arguments[1] = cmd->arg >> 16;
1075	vub300->cmnd.head.arguments[2] = cmd->arg >> 8;
1076	vub300->cmnd.head.arguments[3] = cmd->arg >> 0;
1077	if (cmd->opcode == 52) {
1078		int fn = 0x7 & (cmd->arg >> 28);
1079		vub300->cmnd.head.block_count[0] = 0;
1080		vub300->cmnd.head.block_count[1] = 0;
1081		vub300->cmnd.head.block_size[0] = (vub300->fbs[fn] >> 8) & 0xFF;
1082		vub300->cmnd.head.block_size[1] = (vub300->fbs[fn] >> 0) & 0xFF;
1083		vub300->cmnd.head.command_type = 0x00;
1084		vub300->cmnd.head.transfer_size[0] = 0;
1085		vub300->cmnd.head.transfer_size[1] = 0;
1086		vub300->cmnd.head.transfer_size[2] = 0;
1087		vub300->cmnd.head.transfer_size[3] = 0;
1088	} else if (!data) {
1089		vub300->cmnd.head.block_count[0] = 0;
1090		vub300->cmnd.head.block_count[1] = 0;
1091		vub300->cmnd.head.block_size[0] = (vub300->fbs[0] >> 8) & 0xFF;
1092		vub300->cmnd.head.block_size[1] = (vub300->fbs[0] >> 0) & 0xFF;
1093		vub300->cmnd.head.command_type = 0x00;
1094		vub300->cmnd.head.transfer_size[0] = 0;
1095		vub300->cmnd.head.transfer_size[1] = 0;
1096		vub300->cmnd.head.transfer_size[2] = 0;
1097		vub300->cmnd.head.transfer_size[3] = 0;
1098	} else if (cmd->opcode == 53) {
1099		int fn = 0x7 & (cmd->arg >> 28);
1100		if (0x08 & vub300->cmnd.head.arguments[0]) { /* BLOCK MODE */
1101			vub300->cmnd.head.block_count[0] =
1102				(data->blocks >> 8) & 0xFF;
1103			vub300->cmnd.head.block_count[1] =
1104				(data->blocks >> 0) & 0xFF;
1105			vub300->cmnd.head.block_size[0] =
1106				(data->blksz >> 8) & 0xFF;
1107			vub300->cmnd.head.block_size[1] =
1108				(data->blksz >> 0) & 0xFF;
1109		} else {	/* BYTE MODE */
1110			vub300->cmnd.head.block_count[0] = 0;
1111			vub300->cmnd.head.block_count[1] = 0;
1112			vub300->cmnd.head.block_size[0] =
1113				(vub300->datasize >> 8) & 0xFF;
1114			vub300->cmnd.head.block_size[1] =
1115				(vub300->datasize >> 0) & 0xFF;
1116		}
1117		vub300->cmnd.head.command_type =
1118			(MMC_DATA_READ & data->flags) ? 0x00 : 0x80;
1119		vub300->cmnd.head.transfer_size[0] =
1120			(vub300->datasize >> 24) & 0xFF;
1121		vub300->cmnd.head.transfer_size[1] =
1122			(vub300->datasize >> 16) & 0xFF;
1123		vub300->cmnd.head.transfer_size[2] =
1124			(vub300->datasize >> 8) & 0xFF;
1125		vub300->cmnd.head.transfer_size[3] =
1126			(vub300->datasize >> 0) & 0xFF;
1127		if (vub300->datasize < vub300->fbs[fn]) {
1128			vub300->cmnd.head.block_count[0] = 0;
1129			vub300->cmnd.head.block_count[1] = 0;
1130		}
1131	} else {
1132		vub300->cmnd.head.block_count[0] = (data->blocks >> 8) & 0xFF;
1133		vub300->cmnd.head.block_count[1] = (data->blocks >> 0) & 0xFF;
1134		vub300->cmnd.head.block_size[0] = (data->blksz >> 8) & 0xFF;
1135		vub300->cmnd.head.block_size[1] = (data->blksz >> 0) & 0xFF;
1136		vub300->cmnd.head.command_type =
1137			(MMC_DATA_READ & data->flags) ? 0x00 : 0x80;
1138		vub300->cmnd.head.transfer_size[0] =
1139			(vub300->datasize >> 24) & 0xFF;
1140		vub300->cmnd.head.transfer_size[1] =
1141			(vub300->datasize >> 16) & 0xFF;
1142		vub300->cmnd.head.transfer_size[2] =
1143			(vub300->datasize >> 8) & 0xFF;
1144		vub300->cmnd.head.transfer_size[3] =
1145			(vub300->datasize >> 0) & 0xFF;
1146		if (vub300->datasize < vub300->fbs[0]) {
1147			vub300->cmnd.head.block_count[0] = 0;
1148			vub300->cmnd.head.block_count[1] = 0;
1149		}
1150	}
1151	if (vub300->cmnd.head.block_size[0] || vub300->cmnd.head.block_size[1]) {
1152		u16 block_size = vub300->cmnd.head.block_size[1] |
1153			(vub300->cmnd.head.block_size[0] << 8);
1154		u16 block_boundary = FIRMWARE_BLOCK_BOUNDARY -
1155			(FIRMWARE_BLOCK_BOUNDARY % block_size);
1156		vub300->cmnd.head.block_boundary[0] =
1157			(block_boundary >> 8) & 0xFF;
1158		vub300->cmnd.head.block_boundary[1] =
1159			(block_boundary >> 0) & 0xFF;
1160	} else {
1161		vub300->cmnd.head.block_boundary[0] = 0;
1162		vub300->cmnd.head.block_boundary[1] = 0;
1163	}
1164	usb_fill_bulk_urb(vub300->command_out_urb, vub300->udev,
1165			  usb_sndbulkpipe(vub300->udev, vub300->cmnd_out_ep),
1166			  &vub300->cmnd, sizeof(vub300->cmnd),
1167			  command_out_completed, vub300);
1168	retval = usb_submit_urb(vub300->command_out_urb, GFP_KERNEL);
1169	if (retval < 0) {
1170		cmd->error = retval;
1171		complete(&vub300->command_complete);
1172		return;
1173	} else {
1174		return;
1175	}
1176}
1177
1178/*
1179 * timer callback runs in atomic mode
1180 *       so it cannot call usb_kill_urb()
1181 */
1182static void vub300_sg_timed_out(struct timer_list *t)
1183{
1184	struct vub300_mmc_host *vub300 = timer_container_of(vub300, t,
1185							    sg_transfer_timer);
1186	vub300->usb_timed_out = 1;
1187	usb_sg_cancel(&vub300->sg_request);
1188	usb_unlink_urb(vub300->command_out_urb);
1189	usb_unlink_urb(vub300->command_res_urb);
1190}
1191
1192static u16 roundup_to_multiple_of_64(u16 number)
1193{
1194	return 0xFFC0 & (0x3F + number);
1195}
1196
1197/*
1198 * this is a separate function to solve the 80 column width restriction
1199 */
1200static void __download_offload_pseudocode(struct vub300_mmc_host *vub300,
1201					  const struct firmware *fw)
1202{
1203	u8 register_count = 0;
1204	u16 ts = 0;
1205	u16 interrupt_size = 0;
1206	const u8 *data = fw->data;
1207	int size = fw->size;
1208	u8 c;
1209	dev_info(&vub300->udev->dev, "using %s for SDIO offload processing\n",
1210		 vub300->vub_name);
1211	do {
1212		c = *data++;
1213	} while (size-- && c); /* skip comment */
1214	dev_info(&vub300->udev->dev, "using offload firmware %s %s\n", fw->data,
1215		 vub300->vub_name);
1216	if (size < 4) {
1217		dev_err(&vub300->udev->dev,
1218			"corrupt offload pseudocode in firmware %s\n",
1219			vub300->vub_name);
1220		strscpy(vub300->vub_name, "corrupt offload pseudocode",
1221			sizeof(vub300->vub_name));
1222		return;
1223	}
1224	interrupt_size += *data++;
1225	size -= 1;
1226	interrupt_size <<= 8;
1227	interrupt_size += *data++;
1228	size -= 1;
1229	if (interrupt_size < size) {
1230		u16 xfer_length = roundup_to_multiple_of_64(interrupt_size);
1231		u8 *xfer_buffer = kmalloc(xfer_length, GFP_KERNEL);
1232		if (xfer_buffer) {
1233			int retval;
1234			memcpy(xfer_buffer, data, interrupt_size);
1235			memset(xfer_buffer + interrupt_size, 0,
1236			       xfer_length - interrupt_size);
1237			size -= interrupt_size;
1238			data += interrupt_size;
1239			retval =
1240				usb_control_msg(vub300->udev,
1241						usb_sndctrlpipe(vub300->udev, 0),
1242						SET_INTERRUPT_PSEUDOCODE,
1243						USB_DIR_OUT | USB_TYPE_VENDOR |
1244						USB_RECIP_DEVICE, 0x0000, 0x0000,
1245						xfer_buffer, xfer_length, 1000);
1246			kfree(xfer_buffer);
1247			if (retval < 0)
1248				goto copy_error_message;
1249		} else {
1250			dev_err(&vub300->udev->dev,
1251				"not enough memory for xfer buffer to send"
1252				" INTERRUPT_PSEUDOCODE for %s %s\n", fw->data,
1253				vub300->vub_name);
1254			strscpy(vub300->vub_name,
1255				"SDIO interrupt pseudocode download failed",
1256				sizeof(vub300->vub_name));
1257			return;
1258		}
1259	} else {
1260		dev_err(&vub300->udev->dev,
1261			"corrupt interrupt pseudocode in firmware %s %s\n",
1262			fw->data, vub300->vub_name);
1263		strscpy(vub300->vub_name, "corrupt interrupt pseudocode",
1264			sizeof(vub300->vub_name));
1265		return;
1266	}
1267	ts += *data++;
1268	size -= 1;
1269	ts <<= 8;
1270	ts += *data++;
1271	size -= 1;
1272	if (ts < size) {
1273		u16 xfer_length = roundup_to_multiple_of_64(ts);
1274		u8 *xfer_buffer = kmalloc(xfer_length, GFP_KERNEL);
1275		if (xfer_buffer) {
1276			int retval;
1277			memcpy(xfer_buffer, data, ts);
1278			memset(xfer_buffer + ts, 0,
1279			       xfer_length - ts);
1280			size -= ts;
1281			data += ts;
1282			retval =
1283				usb_control_msg(vub300->udev,
1284						usb_sndctrlpipe(vub300->udev, 0),
1285						SET_TRANSFER_PSEUDOCODE,
1286						USB_DIR_OUT | USB_TYPE_VENDOR |
1287						USB_RECIP_DEVICE, 0x0000, 0x0000,
1288						xfer_buffer, xfer_length, 1000);
1289			kfree(xfer_buffer);
1290			if (retval < 0)
1291				goto copy_error_message;
1292		} else {
1293			dev_err(&vub300->udev->dev,
1294				"not enough memory for xfer buffer to send"
1295				" TRANSFER_PSEUDOCODE for %s %s\n", fw->data,
1296				vub300->vub_name);
1297			strscpy(vub300->vub_name,
1298				"SDIO transfer pseudocode download failed",
1299				sizeof(vub300->vub_name));
1300			return;
1301		}
1302	} else {
1303		dev_err(&vub300->udev->dev,
1304			"corrupt transfer pseudocode in firmware %s %s\n",
1305			fw->data, vub300->vub_name);
1306		strscpy(vub300->vub_name, "corrupt transfer pseudocode",
1307			sizeof(vub300->vub_name));
1308		return;
1309	}
1310	register_count += *data++;
1311	size -= 1;
1312	if (register_count * 4 == size) {
1313		int I = vub300->dynamic_register_count = register_count;
1314		int i = 0;
1315		while (I--) {
1316			unsigned int func_num = 0;
1317			vub300->sdio_register[i].func_num = *data++;
1318			size -= 1;
1319			func_num += *data++;
1320			size -= 1;
1321			func_num <<= 8;
1322			func_num += *data++;
1323			size -= 1;
1324			func_num <<= 8;
1325			func_num += *data++;
1326			size -= 1;
1327			vub300->sdio_register[i].sdio_reg = func_num;
1328			vub300->sdio_register[i].activate = 1;
1329			vub300->sdio_register[i].prepared = 0;
1330			i += 1;
1331		}
1332		dev_info(&vub300->udev->dev,
1333			 "initialized %d dynamic pseudocode registers\n",
1334			 vub300->dynamic_register_count);
1335		return;
1336	} else {
1337		dev_err(&vub300->udev->dev,
1338			"corrupt dynamic registers in firmware %s\n",
1339			vub300->vub_name);
1340		strscpy(vub300->vub_name, "corrupt dynamic registers",
1341			sizeof(vub300->vub_name));
1342		return;
1343	}
1344
1345copy_error_message:
1346	strscpy(vub300->vub_name, "SDIO pseudocode download failed",
1347		sizeof(vub300->vub_name));
1348}
1349
1350/*
1351 * if the binary containing the EMPTY PseudoCode can not be found
1352 * vub300->vub_name is set anyway in order to prevent an automatic retry
1353 */
1354static void download_offload_pseudocode(struct vub300_mmc_host *vub300)
1355{
1356	struct mmc_card *card = vub300->mmc->card;
1357	int sdio_funcs = card->sdio_funcs;
1358	const struct firmware *fw = NULL;
1359	int l = snprintf(vub300->vub_name, sizeof(vub300->vub_name),
1360			 "vub_%04X%04X", card->cis.vendor, card->cis.device);
1361	int n = 0;
1362	int retval;
1363	for (n = 0; n < sdio_funcs; n++) {
1364		struct sdio_func *sf = card->sdio_func[n];
1365		l += scnprintf(vub300->vub_name + l,
1366			      sizeof(vub300->vub_name) - l, "_%04X%04X",
1367			      sf->vendor, sf->device);
1368	}
1369	snprintf(vub300->vub_name + l, sizeof(vub300->vub_name) - l, ".bin");
1370	dev_info(&vub300->udev->dev, "requesting offload firmware %s\n",
1371		 vub300->vub_name);
1372	retval = request_firmware(&fw, vub300->vub_name, &card->dev);
1373	if (retval < 0) {
1374		strscpy(vub300->vub_name, "vub_default.bin",
1375			sizeof(vub300->vub_name));
1376		retval = request_firmware(&fw, vub300->vub_name, &card->dev);
1377		if (retval < 0) {
1378			strscpy(vub300->vub_name,
1379				"no SDIO offload firmware found",
1380				sizeof(vub300->vub_name));
1381		} else {
1382			__download_offload_pseudocode(vub300, fw);
1383			release_firmware(fw);
1384		}
1385	} else {
1386		__download_offload_pseudocode(vub300, fw);
1387		release_firmware(fw);
1388	}
1389}
1390
1391static void vub300_usb_bulk_msg_completion(struct urb *urb)
1392{				/* urb completion handler - hardirq */
1393	complete((struct completion *)urb->context);
1394}
1395
1396static int vub300_usb_bulk_msg(struct vub300_mmc_host *vub300,
1397			       unsigned int pipe, void *data, int len,
1398			       int *actual_length, int timeout_msecs)
1399{
1400	/* cmd_mutex is held by vub300_cmndwork_thread */
1401	struct usb_device *usb_dev = vub300->udev;
1402	struct completion done;
1403	int retval;
1404	vub300->urb = usb_alloc_urb(0, GFP_KERNEL);
1405	if (!vub300->urb)
1406		return -ENOMEM;
1407	usb_fill_bulk_urb(vub300->urb, usb_dev, pipe, data, len,
1408			  vub300_usb_bulk_msg_completion, NULL);
1409	init_completion(&done);
1410	vub300->urb->context = &done;
1411	vub300->urb->actual_length = 0;
1412	retval = usb_submit_urb(vub300->urb, GFP_KERNEL);
1413	if (unlikely(retval))
1414		goto out;
1415	if (!wait_for_completion_timeout
1416	    (&done, msecs_to_jiffies(timeout_msecs))) {
1417		retval = -ETIMEDOUT;
1418		usb_kill_urb(vub300->urb);
1419	} else {
1420		retval = vub300->urb->status;
1421	}
1422out:
1423	*actual_length = vub300->urb->actual_length;
1424	usb_free_urb(vub300->urb);
1425	vub300->urb = NULL;
1426	return retval;
1427}
1428
1429static int __command_read_data(struct vub300_mmc_host *vub300,
1430			       struct mmc_command *cmd, struct mmc_data *data)
1431{
1432	/* cmd_mutex is held by vub300_cmndwork_thread */
1433	int linear_length = vub300->datasize;
1434	int padded_length = vub300->large_usb_packets ?
1435		((511 + linear_length) >> 9) << 9 :
1436		((63 + linear_length) >> 6) << 6;
1437	if ((padded_length == linear_length) || !pad_input_to_usb_pkt) {
1438		int result;
1439		unsigned pipe;
1440		pipe = usb_rcvbulkpipe(vub300->udev, vub300->data_inp_ep);
1441		result = usb_sg_init(&vub300->sg_request, vub300->udev,
1442				     pipe, 0, data->sg,
1443				     data->sg_len, 0, GFP_KERNEL);
1444		if (result < 0) {
1445			usb_unlink_urb(vub300->command_out_urb);
1446			usb_unlink_urb(vub300->command_res_urb);
1447			cmd->error = result;
1448			data->bytes_xfered = 0;
1449			return 0;
1450		} else {
1451			vub300->sg_transfer_timer.expires =
1452				jiffies + msecs_to_jiffies(2000 +
1453						  (linear_length / 16384));
1454			add_timer(&vub300->sg_transfer_timer);
1455			usb_sg_wait(&vub300->sg_request);
1456			timer_delete(&vub300->sg_transfer_timer);
1457			if (vub300->sg_request.status < 0) {
1458				cmd->error = vub300->sg_request.status;
1459				data->bytes_xfered = 0;
1460				return 0;
1461			} else {
1462				data->bytes_xfered = vub300->datasize;
1463				return linear_length;
1464			}
1465		}
1466	} else {
1467		u8 *buf = kmalloc(padded_length, GFP_KERNEL);
1468		if (buf) {
1469			int result;
1470			unsigned pipe = usb_rcvbulkpipe(vub300->udev,
1471							vub300->data_inp_ep);
1472			int actual_length = 0;
1473			result = vub300_usb_bulk_msg(vub300, pipe, buf,
1474					     padded_length, &actual_length,
1475					     2000 + (padded_length / 16384));
1476			if (result < 0) {
1477				cmd->error = result;
1478				data->bytes_xfered = 0;
1479				kfree(buf);
1480				return 0;
1481			} else if (actual_length < linear_length) {
1482				cmd->error = -EREMOTEIO;
1483				data->bytes_xfered = 0;
1484				kfree(buf);
1485				return 0;
1486			} else {
1487				sg_copy_from_buffer(data->sg, data->sg_len, buf,
1488						    linear_length);
1489				kfree(buf);
1490				data->bytes_xfered = vub300->datasize;
1491				return linear_length;
1492			}
1493		} else {
1494			cmd->error = -ENOMEM;
1495			data->bytes_xfered = 0;
1496			return 0;
1497		}
1498	}
1499}
1500
1501static int __command_write_data(struct vub300_mmc_host *vub300,
1502				struct mmc_command *cmd, struct mmc_data *data)
1503{
1504	/* cmd_mutex is held by vub300_cmndwork_thread */
1505	unsigned pipe = usb_sndbulkpipe(vub300->udev, vub300->data_out_ep);
1506	int linear_length = vub300->datasize;
1507	int modulo_64_length = linear_length & 0x003F;
1508	int modulo_512_length = linear_length & 0x01FF;
1509	if (linear_length < 64) {
1510		int result;
1511		int actual_length;
1512		sg_copy_to_buffer(data->sg, data->sg_len,
1513				  vub300->padded_buffer,
1514				  sizeof(vub300->padded_buffer));
1515		memset(vub300->padded_buffer + linear_length, 0,
1516		       sizeof(vub300->padded_buffer) - linear_length);
1517		result = vub300_usb_bulk_msg(vub300, pipe, vub300->padded_buffer,
1518					     sizeof(vub300->padded_buffer),
1519					     &actual_length, 2000 +
1520					     (sizeof(vub300->padded_buffer) /
1521					      16384));
1522		if (result < 0) {
1523			cmd->error = result;
1524			data->bytes_xfered = 0;
1525		} else {
1526			data->bytes_xfered = vub300->datasize;
1527		}
1528	} else if ((!vub300->large_usb_packets && (0 < modulo_64_length)) ||
1529		    (vub300->large_usb_packets && (64 > modulo_512_length))
1530		) {		/* don't you just love these work-rounds */
1531		int padded_length = ((63 + linear_length) >> 6) << 6;
1532		u8 *buf = kmalloc(padded_length, GFP_KERNEL);
1533		if (buf) {
1534			int result;
1535			int actual_length;
1536			sg_copy_to_buffer(data->sg, data->sg_len, buf,
1537					  padded_length);
1538			memset(buf + linear_length, 0,
1539			       padded_length - linear_length);
1540			result =
1541				vub300_usb_bulk_msg(vub300, pipe, buf,
1542						    padded_length, &actual_length,
1543						    2000 + padded_length / 16384);
1544			kfree(buf);
1545			if (result < 0) {
1546				cmd->error = result;
1547				data->bytes_xfered = 0;
1548			} else {
1549				data->bytes_xfered = vub300->datasize;
1550			}
1551		} else {
1552			cmd->error = -ENOMEM;
1553			data->bytes_xfered = 0;
1554		}
1555	} else {		/* no data padding required */
1556		int result;
1557		unsigned char buf[64 * 4];
1558		sg_copy_to_buffer(data->sg, data->sg_len, buf, sizeof(buf));
1559		result = usb_sg_init(&vub300->sg_request, vub300->udev,
1560				     pipe, 0, data->sg,
1561				     data->sg_len, 0, GFP_KERNEL);
1562		if (result < 0) {
1563			usb_unlink_urb(vub300->command_out_urb);
1564			usb_unlink_urb(vub300->command_res_urb);
1565			cmd->error = result;
1566			data->bytes_xfered = 0;
1567		} else {
1568			vub300->sg_transfer_timer.expires =
1569				jiffies + msecs_to_jiffies(2000 +
1570							   linear_length / 16384);
1571			add_timer(&vub300->sg_transfer_timer);
1572			usb_sg_wait(&vub300->sg_request);
1573			if (cmd->error) {
1574				data->bytes_xfered = 0;
1575			} else {
1576				timer_delete(&vub300->sg_transfer_timer);
1577				if (vub300->sg_request.status < 0) {
1578					cmd->error = vub300->sg_request.status;
1579					data->bytes_xfered = 0;
1580				} else {
1581					data->bytes_xfered = vub300->datasize;
1582				}
1583			}
1584		}
1585	}
1586	return linear_length;
1587}
1588
1589static void __vub300_command_response(struct vub300_mmc_host *vub300,
1590				      struct mmc_command *cmd,
1591				      struct mmc_data *data, int data_length)
1592{
1593	/* cmd_mutex is held by vub300_cmndwork_thread */
1594	long respretval;
1595	int msec_timeout = 1000 + data_length / 4;
1596	respretval =
1597		wait_for_completion_timeout(&vub300->command_complete,
1598					    msecs_to_jiffies(msec_timeout));
1599	if (respretval == 0) { /* TIMED OUT */
1600		/* we don't know which of "out" and "res" if any failed */
1601		int result;
1602		vub300->usb_timed_out = 1;
1603		usb_kill_urb(vub300->command_out_urb);
1604		usb_kill_urb(vub300->command_res_urb);
1605		cmd->error = -ETIMEDOUT;
1606		result = usb_lock_device_for_reset(vub300->udev,
1607						   vub300->interface);
1608		if (result == 0) {
1609			result = usb_reset_device(vub300->udev);
1610			usb_unlock_device(vub300->udev);
1611		}
1612	} else if (respretval < 0) {
1613		/* we don't know which of "out" and "res" if any failed */
1614		usb_kill_urb(vub300->command_out_urb);
1615		usb_kill_urb(vub300->command_res_urb);
1616		cmd->error = respretval;
1617	} else if (cmd->error) {
1618		/*
1619		 * the error occurred sending the command
1620		 * or receiving the response
1621		 */
1622	} else if (vub300->command_out_urb->status) {
1623		vub300->usb_transport_fail = vub300->command_out_urb->status;
1624		cmd->error = -EPROTO == vub300->command_out_urb->status ?
1625			-ESHUTDOWN : vub300->command_out_urb->status;
1626	} else if (vub300->command_res_urb->status) {
1627		vub300->usb_transport_fail = vub300->command_res_urb->status;
1628		cmd->error = -EPROTO == vub300->command_res_urb->status ?
1629			-ESHUTDOWN : vub300->command_res_urb->status;
1630	} else if (vub300->resp.common.header_type == 0x00) {
1631		/*
1632		 * the command completed successfully
1633		 * and there was no piggybacked data
1634		 */
1635	} else if (vub300->resp.common.header_type == RESPONSE_ERROR) {
1636		cmd->error =
1637			vub300_response_error(vub300->resp.error.error_code);
1638		if (vub300->data)
1639			usb_sg_cancel(&vub300->sg_request);
1640	} else if (vub300->resp.common.header_type == RESPONSE_PIGGYBACKED) {
1641		int offloaded_data_length =
1642			vub300->resp.common.header_size -
1643			sizeof(struct sd_register_header);
1644		int register_count = offloaded_data_length >> 3;
1645		int ri = 0;
1646		while (register_count--) {
1647			add_offloaded_reg(vub300, &vub300->resp.pig.reg[ri]);
1648			ri += 1;
1649		}
1650		vub300->resp.common.header_size =
1651			sizeof(struct sd_register_header);
1652		vub300->resp.common.header_type = 0x00;
1653		cmd->error = 0;
1654	} else if (vub300->resp.common.header_type == RESPONSE_PIG_DISABLED) {
1655		int offloaded_data_length =
1656			vub300->resp.common.header_size -
1657			sizeof(struct sd_register_header);
1658		int register_count = offloaded_data_length >> 3;
1659		int ri = 0;
1660		while (register_count--) {
1661			add_offloaded_reg(vub300, &vub300->resp.pig.reg[ri]);
1662			ri += 1;
1663		}
1664		mutex_lock(&vub300->irq_mutex);
1665		if (vub300->irqs_queued) {
1666			vub300->irqs_queued += 1;
1667		} else if (vub300->irq_enabled) {
1668			vub300->irqs_queued += 1;
1669			vub300_queue_poll_work(vub300, 0);
1670		} else {
1671			vub300->irqs_queued += 1;
1672		}
1673		vub300->irq_disabled = 1;
1674		mutex_unlock(&vub300->irq_mutex);
1675		vub300->resp.common.header_size =
1676			sizeof(struct sd_register_header);
1677		vub300->resp.common.header_type = 0x00;
1678		cmd->error = 0;
1679	} else if (vub300->resp.common.header_type == RESPONSE_PIG_ENABLED) {
1680		int offloaded_data_length =
1681			vub300->resp.common.header_size -
1682			sizeof(struct sd_register_header);
1683		int register_count = offloaded_data_length >> 3;
1684		int ri = 0;
1685		while (register_count--) {
1686			add_offloaded_reg(vub300, &vub300->resp.pig.reg[ri]);
1687			ri += 1;
1688		}
1689		mutex_lock(&vub300->irq_mutex);
1690		if (vub300->irqs_queued) {
1691			vub300->irqs_queued += 1;
1692		} else if (vub300->irq_enabled) {
1693			vub300->irqs_queued += 1;
1694			vub300_queue_poll_work(vub300, 0);
1695		} else {
1696			vub300->irqs_queued += 1;
1697		}
1698		vub300->irq_disabled = 0;
1699		mutex_unlock(&vub300->irq_mutex);
1700		vub300->resp.common.header_size =
1701			sizeof(struct sd_register_header);
1702		vub300->resp.common.header_type = 0x00;
1703		cmd->error = 0;
1704	} else {
1705		cmd->error = -EINVAL;
1706	}
1707}
1708
1709static void construct_request_response(struct vub300_mmc_host *vub300,
1710				       struct mmc_command *cmd)
1711{
1712	int resp_len = vub300->resp_len;
1713	int less_cmd = (17 == resp_len) ? resp_len : resp_len - 1;
1714	int bytes = 3 & less_cmd;
1715	int words = less_cmd >> 2;
1716	u8 *r = vub300->resp.response.command_response;
1717
1718	if (!resp_len)
1719		return;
1720	if (bytes == 3) {
1721		cmd->resp[words] = (r[1 + (words << 2)] << 24)
1722			| (r[2 + (words << 2)] << 16)
1723			| (r[3 + (words << 2)] << 8);
1724	} else if (bytes == 2) {
1725		cmd->resp[words] = (r[1 + (words << 2)] << 24)
1726			| (r[2 + (words << 2)] << 16);
1727	} else if (bytes == 1) {
1728		cmd->resp[words] = (r[1 + (words << 2)] << 24);
1729	}
1730	while (words-- > 0) {
1731		cmd->resp[words] = (r[1 + (words << 2)] << 24)
1732			| (r[2 + (words << 2)] << 16)
1733			| (r[3 + (words << 2)] << 8)
1734			| (r[4 + (words << 2)] << 0);
1735	}
1736	if ((cmd->opcode == 53) && (0x000000FF & cmd->resp[0]))
1737		cmd->resp[0] &= 0xFFFFFF00;
1738}
1739
1740/* this thread runs only when there is an upper level command req outstanding */
1741static void vub300_cmndwork_thread(struct work_struct *work)
1742{
1743	struct vub300_mmc_host *vub300 =
1744		container_of(work, struct vub300_mmc_host, cmndwork);
1745	if (!vub300->interface) {
1746		kref_put(&vub300->kref, vub300_delete);
1747		return;
1748	} else {
1749		struct mmc_request *req = vub300->req;
1750		struct mmc_command *cmd = vub300->cmd;
1751		struct mmc_data *data = vub300->data;
1752		int data_length;
1753		mutex_lock(&vub300->cmd_mutex);
1754		init_completion(&vub300->command_complete);
1755		if (likely(vub300->vub_name[0]) || !vub300->mmc->card) {
1756			/*
1757			 * the name of the EMPTY Pseudo firmware file
1758			 * is used as a flag to indicate that the file
1759			 * has been already downloaded to the VUB300 chip
1760			 */
1761		} else if (0 == vub300->mmc->card->sdio_funcs) {
1762			strscpy(vub300->vub_name, "SD memory device",
1763				sizeof(vub300->vub_name));
1764		} else {
1765			download_offload_pseudocode(vub300);
1766		}
1767		send_command(vub300);
1768		if (!data)
1769			data_length = 0;
1770		else if (MMC_DATA_READ & data->flags)
1771			data_length = __command_read_data(vub300, cmd, data);
1772		else
1773			data_length = __command_write_data(vub300, cmd, data);
1774		__vub300_command_response(vub300, cmd, data, data_length);
1775		vub300->req = NULL;
1776		vub300->cmd = NULL;
1777		vub300->data = NULL;
1778		if (cmd->error) {
1779			if (cmd->error == -ENOMEDIUM)
1780				check_vub300_port_status(vub300);
1781			mutex_unlock(&vub300->cmd_mutex);
1782			mmc_request_done(vub300->mmc, req);
1783			kref_put(&vub300->kref, vub300_delete);
1784			return;
1785		} else {
1786			construct_request_response(vub300, cmd);
1787			vub300->resp_len = 0;
1788			mutex_unlock(&vub300->cmd_mutex);
1789			kref_put(&vub300->kref, vub300_delete);
1790			mmc_request_done(vub300->mmc, req);
1791			return;
1792		}
1793	}
1794}
1795
1796static int examine_cyclic_buffer(struct vub300_mmc_host *vub300,
1797				 struct mmc_command *cmd, u8 Function)
1798{
1799	/* cmd_mutex is held by vub300_mmc_request */
1800	u8 cmd0 = 0xFF & (cmd->arg >> 24);
1801	u8 cmd1 = 0xFF & (cmd->arg >> 16);
1802	u8 cmd2 = 0xFF & (cmd->arg >> 8);
1803	u8 cmd3 = 0xFF & (cmd->arg >> 0);
1804	int first = MAXREGMASK & vub300->fn[Function].offload_point;
1805	struct offload_registers_access *rf = &vub300->fn[Function].reg[first];
1806	if (cmd0 == rf->command_byte[0] &&
1807	    cmd1 == rf->command_byte[1] &&
1808	    cmd2 == rf->command_byte[2] &&
1809	    cmd3 == rf->command_byte[3]) {
1810		u8 checksum = 0x00;
1811		cmd->resp[1] = checksum << 24;
1812		cmd->resp[0] = (rf->Respond_Byte[0] << 24)
1813			| (rf->Respond_Byte[1] << 16)
1814			| (rf->Respond_Byte[2] << 8)
1815			| (rf->Respond_Byte[3] << 0);
1816		vub300->fn[Function].offload_point += 1;
1817		vub300->fn[Function].offload_count -= 1;
1818		vub300->total_offload_count -= 1;
1819		return 1;
1820	} else {
1821		int delta = 1;	/* because it does not match the first one */
1822		u8 register_count = vub300->fn[Function].offload_count - 1;
1823		u32 register_point = vub300->fn[Function].offload_point + 1;
1824		while (0 < register_count) {
1825			int point = MAXREGMASK & register_point;
1826			struct offload_registers_access *r =
1827				&vub300->fn[Function].reg[point];
1828			if (cmd0 == r->command_byte[0] &&
1829			    cmd1 == r->command_byte[1] &&
1830			    cmd2 == r->command_byte[2] &&
1831			    cmd3 == r->command_byte[3]) {
1832				u8 checksum = 0x00;
1833				cmd->resp[1] = checksum << 24;
1834				cmd->resp[0] = (r->Respond_Byte[0] << 24)
1835					| (r->Respond_Byte[1] << 16)
1836					| (r->Respond_Byte[2] << 8)
1837					| (r->Respond_Byte[3] << 0);
1838				vub300->fn[Function].offload_point += delta;
1839				vub300->fn[Function].offload_count -= delta;
1840				vub300->total_offload_count -= delta;
1841				return 1;
1842			} else {
1843				register_point += 1;
1844				register_count -= 1;
1845				delta += 1;
1846				continue;
1847			}
1848		}
1849		return 0;
1850	}
1851}
1852
1853static int satisfy_request_from_offloaded_data(struct vub300_mmc_host *vub300,
1854					       struct mmc_command *cmd)
1855{
1856	/* cmd_mutex is held by vub300_mmc_request */
1857	u8 regs = vub300->dynamic_register_count;
1858	u8 i = 0;
1859	u8 func = FUN(cmd);
1860	u32 reg = REG(cmd);
1861	while (0 < regs--) {
1862		if ((vub300->sdio_register[i].func_num == func) &&
1863		    (vub300->sdio_register[i].sdio_reg == reg)) {
1864			if (!vub300->sdio_register[i].prepared) {
1865				return 0;
1866			} else if ((0x80000000 & cmd->arg) == 0x80000000) {
1867				/*
1868				 * a write to a dynamic register
1869				 * nullifies our offloaded value
1870				 */
1871				vub300->sdio_register[i].prepared = 0;
1872				return 0;
1873			} else {
1874				u8 checksum = 0x00;
1875				u8 rsp0 = 0x00;
1876				u8 rsp1 = 0x00;
1877				u8 rsp2 = vub300->sdio_register[i].response;
1878				u8 rsp3 = vub300->sdio_register[i].regvalue;
1879				vub300->sdio_register[i].prepared = 0;
1880				cmd->resp[1] = checksum << 24;
1881				cmd->resp[0] = (rsp0 << 24)
1882					| (rsp1 << 16)
1883					| (rsp2 << 8)
1884					| (rsp3 << 0);
1885				return 1;
1886			}
1887		} else {
1888			i += 1;
1889			continue;
1890		}
1891	}
1892	if (vub300->total_offload_count == 0)
1893		return 0;
1894	else if (vub300->fn[func].offload_count == 0)
1895		return 0;
1896	else
1897		return examine_cyclic_buffer(vub300, cmd, func);
1898}
1899
1900static void vub300_mmc_request(struct mmc_host *mmc, struct mmc_request *req)
1901{				/* NOT irq */
1902	struct mmc_command *cmd = req->cmd;
1903	struct vub300_mmc_host *vub300 = mmc_priv(mmc);
1904	if (!vub300->interface) {
1905		cmd->error = -ESHUTDOWN;
1906		mmc_request_done(mmc, req);
1907		return;
1908	} else {
1909		struct mmc_data *data = req->data;
1910		if (!vub300->card_powered) {
1911			cmd->error = -ENOMEDIUM;
1912			mmc_request_done(mmc, req);
1913			return;
1914		}
1915		if (!vub300->card_present) {
1916			cmd->error = -ENOMEDIUM;
1917			mmc_request_done(mmc, req);
1918			return;
1919		}
1920		if (vub300->usb_transport_fail) {
1921			cmd->error = vub300->usb_transport_fail;
1922			mmc_request_done(mmc, req);
1923			return;
1924		}
1925		if (!vub300->interface) {
1926			cmd->error = -ENODEV;
1927			mmc_request_done(mmc, req);
1928			return;
1929		}
1930		kref_get(&vub300->kref);
1931		mutex_lock(&vub300->cmd_mutex);
1932		mod_timer(&vub300->inactivity_timer, jiffies + HZ);
1933		/*
1934		 * for performance we have to return immediately
1935		 * if the requested data has been offloaded
1936		 */
1937		if (cmd->opcode == 52 &&
1938		    satisfy_request_from_offloaded_data(vub300, cmd)) {
1939			cmd->error = 0;
1940			mutex_unlock(&vub300->cmd_mutex);
1941			kref_put(&vub300->kref, vub300_delete);
1942			mmc_request_done(mmc, req);
1943			return;
1944		} else {
1945			vub300->cmd = cmd;
1946			vub300->req = req;
1947			vub300->data = data;
1948			if (data)
1949				vub300->datasize = data->blksz * data->blocks;
1950			else
1951				vub300->datasize = 0;
1952			vub300_queue_cmnd_work(vub300);
1953			mutex_unlock(&vub300->cmd_mutex);
1954			kref_put(&vub300->kref, vub300_delete);
1955			/*
1956			 * the kernel lock diagnostics complain
1957			 * if the cmd_mutex * is "passed on"
1958			 * to the cmndwork thread,
1959			 * so we must release it now
1960			 * and re-acquire it in the cmndwork thread
1961			 */
1962		}
1963	}
1964}
1965
1966static void __set_clock_speed(struct vub300_mmc_host *vub300, u8 buf[8],
1967			      struct mmc_ios *ios)
1968{
1969	int buf_array_size = 8; /* ARRAY_SIZE(buf) does not work !!! */
1970	int retval;
1971	u32 kHzClock;
1972	if (ios->clock >= 48000000)
1973		kHzClock = 48000;
1974	else if (ios->clock >= 24000000)
1975		kHzClock = 24000;
1976	else if (ios->clock >= 20000000)
1977		kHzClock = 20000;
1978	else if (ios->clock >= 15000000)
1979		kHzClock = 15000;
1980	else if (ios->clock >= 200000)
1981		kHzClock = 200;
1982	else
1983		kHzClock = 0;
1984	{
1985		int i;
1986		u64 c = kHzClock;
1987		for (i = 0; i < buf_array_size; i++) {
1988			buf[i] = c;
1989			c >>= 8;
1990		}
1991	}
1992	retval =
1993		usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
1994				SET_CLOCK_SPEED,
1995				USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
1996				0x00, 0x00, buf, buf_array_size, 1000);
1997	if (retval != 8) {
1998		dev_err(&vub300->udev->dev, "SET_CLOCK_SPEED"
1999			" %dkHz failed with retval=%d\n", kHzClock, retval);
2000	} else {
2001		dev_dbg(&vub300->udev->dev, "SET_CLOCK_SPEED"
2002			" %dkHz\n", kHzClock);
2003	}
2004}
2005
2006static void vub300_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
2007{				/* NOT irq */
2008	struct vub300_mmc_host *vub300 = mmc_priv(mmc);
2009	if (!vub300->interface)
2010		return;
2011	kref_get(&vub300->kref);
2012	mutex_lock(&vub300->cmd_mutex);
2013	if ((ios->power_mode == MMC_POWER_OFF) && vub300->card_powered) {
2014		vub300->card_powered = 0;
2015		usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
2016				SET_SD_POWER,
2017				USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2018				0x0000, 0x0000, NULL, 0, 1000);
2019		/* must wait for the VUB300 u-proc to boot up */
2020		msleep(600);
2021	} else if ((ios->power_mode == MMC_POWER_UP) && !vub300->card_powered) {
2022		usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
2023				SET_SD_POWER,
2024				USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2025				0x0001, 0x0000, NULL, 0, 1000);
2026		msleep(600);
2027		vub300->card_powered = 1;
2028	} else if (ios->power_mode == MMC_POWER_ON) {
2029		u8 *buf = kmalloc(8, GFP_KERNEL);
2030		if (buf) {
2031			__set_clock_speed(vub300, buf, ios);
2032			kfree(buf);
2033		}
2034	} else {
2035		/* this should mean no change of state */
2036	}
2037	mutex_unlock(&vub300->cmd_mutex);
2038	kref_put(&vub300->kref, vub300_delete);
2039}
2040
2041static int vub300_mmc_get_ro(struct mmc_host *mmc)
2042{
2043	struct vub300_mmc_host *vub300 = mmc_priv(mmc);
2044	return vub300->read_only;
2045}
2046
2047static void vub300_enable_sdio_irq(struct mmc_host *mmc, int enable)
2048{				/* NOT irq */
2049	struct vub300_mmc_host *vub300 = mmc_priv(mmc);
2050	if (!vub300->interface)
2051		return;
2052	kref_get(&vub300->kref);
2053	if (enable) {
2054		set_current_state(TASK_RUNNING);
2055		mutex_lock(&vub300->irq_mutex);
2056		if (vub300->irqs_queued) {
2057			vub300->irqs_queued -= 1;
2058			mmc_signal_sdio_irq(vub300->mmc);
2059		} else if (vub300->irq_disabled) {
2060			vub300->irq_disabled = 0;
2061			vub300->irq_enabled = 1;
2062			vub300_queue_poll_work(vub300, 0);
2063		} else if (vub300->irq_enabled) {
2064			/* this should not happen, so we will just ignore it */
2065		} else {
2066			vub300->irq_enabled = 1;
2067			vub300_queue_poll_work(vub300, 0);
2068		}
2069		mutex_unlock(&vub300->irq_mutex);
2070		set_current_state(TASK_INTERRUPTIBLE);
2071	} else {
2072		vub300->irq_enabled = 0;
2073	}
2074	kref_put(&vub300->kref, vub300_delete);
2075}
2076
2077static const struct mmc_host_ops vub300_mmc_ops = {
2078	.request = vub300_mmc_request,
2079	.set_ios = vub300_mmc_set_ios,
2080	.get_ro = vub300_mmc_get_ro,
2081	.enable_sdio_irq = vub300_enable_sdio_irq,
2082};
2083
2084static int vub300_probe(struct usb_interface *interface,
2085			const struct usb_device_id *id)
2086{				/* NOT irq */
2087	struct vub300_mmc_host *vub300;
2088	struct usb_host_interface *iface_desc;
2089	struct usb_device *udev = usb_get_dev(interface_to_usbdev(interface));
2090	int i;
2091	int retval = -ENOMEM;
2092	struct urb *command_out_urb;
2093	struct urb *command_res_urb;
2094	struct mmc_host *mmc;
2095	char manufacturer[48];
2096	char product[32];
2097	char serial_number[32];
2098	usb_string(udev, udev->descriptor.iManufacturer, manufacturer,
2099		   sizeof(manufacturer));
2100	usb_string(udev, udev->descriptor.iProduct, product, sizeof(product));
2101	usb_string(udev, udev->descriptor.iSerialNumber, serial_number,
2102		   sizeof(serial_number));
2103	dev_info(&udev->dev, "probing VID:PID(%04X:%04X) %s %s %s\n",
2104		 le16_to_cpu(udev->descriptor.idVendor),
2105		 le16_to_cpu(udev->descriptor.idProduct),
2106		 manufacturer, product, serial_number);
2107	command_out_urb = usb_alloc_urb(0, GFP_KERNEL);
2108	if (!command_out_urb) {
2109		retval = -ENOMEM;
2110		goto error0;
2111	}
2112	command_res_urb = usb_alloc_urb(0, GFP_KERNEL);
2113	if (!command_res_urb) {
2114		retval = -ENOMEM;
2115		goto error1;
2116	}
2117	/* this also allocates memory for our VUB300 mmc host device */
2118	mmc = mmc_alloc_host(sizeof(*vub300), &udev->dev);
2119	if (!mmc) {
2120		retval = -ENOMEM;
2121		dev_err(&udev->dev, "not enough memory for the mmc_host\n");
2122		goto error4;
2123	}
2124	/* MMC core transfer sizes tunable parameters */
2125	mmc->caps = 0;
2126	if (!force_1_bit_data_xfers)
2127		mmc->caps |= MMC_CAP_4_BIT_DATA;
2128	if (!force_polling_for_irqs)
2129		mmc->caps |= MMC_CAP_SDIO_IRQ;
2130	mmc->caps &= ~MMC_CAP_NEEDS_POLL;
2131	/*
2132	 * MMC_CAP_NEEDS_POLL causes core.c:mmc_rescan() to poll
2133	 * for devices which results in spurious CMD7's being
2134	 * issued which stops some SDIO cards from working
2135	 */
2136	if (limit_speed_to_24_MHz) {
2137		mmc->caps |= MMC_CAP_MMC_HIGHSPEED;
2138		mmc->caps |= MMC_CAP_SD_HIGHSPEED;
2139		mmc->f_max = 24000000;
2140		dev_info(&udev->dev, "limiting SDIO speed to 24_MHz\n");
2141	} else {
2142		mmc->caps |= MMC_CAP_MMC_HIGHSPEED;
2143		mmc->caps |= MMC_CAP_SD_HIGHSPEED;
2144		mmc->f_max = 48000000;
2145	}
2146	mmc->f_min = 200000;
2147	mmc->max_blk_count = 511;
2148	mmc->max_blk_size = 512;
2149	mmc->max_segs = 128;
2150	if (force_max_req_size)
2151		mmc->max_req_size = force_max_req_size * 1024;
2152	else
2153		mmc->max_req_size = 64 * 1024;
2154	mmc->max_seg_size = mmc->max_req_size;
2155	mmc->ocr_avail = 0;
2156	mmc->ocr_avail |= MMC_VDD_165_195;
2157	mmc->ocr_avail |= MMC_VDD_20_21;
2158	mmc->ocr_avail |= MMC_VDD_21_22;
2159	mmc->ocr_avail |= MMC_VDD_22_23;
2160	mmc->ocr_avail |= MMC_VDD_23_24;
2161	mmc->ocr_avail |= MMC_VDD_24_25;
2162	mmc->ocr_avail |= MMC_VDD_25_26;
2163	mmc->ocr_avail |= MMC_VDD_26_27;
2164	mmc->ocr_avail |= MMC_VDD_27_28;
2165	mmc->ocr_avail |= MMC_VDD_28_29;
2166	mmc->ocr_avail |= MMC_VDD_29_30;
2167	mmc->ocr_avail |= MMC_VDD_30_31;
2168	mmc->ocr_avail |= MMC_VDD_31_32;
2169	mmc->ocr_avail |= MMC_VDD_32_33;
2170	mmc->ocr_avail |= MMC_VDD_33_34;
2171	mmc->ocr_avail |= MMC_VDD_34_35;
2172	mmc->ocr_avail |= MMC_VDD_35_36;
2173	mmc->ops = &vub300_mmc_ops;
2174	vub300 = mmc_priv(mmc);
2175	vub300->mmc = mmc;
2176	vub300->card_powered = 0;
2177	vub300->bus_width = 0;
2178	vub300->cmnd.head.block_size[0] = 0x00;
2179	vub300->cmnd.head.block_size[1] = 0x00;
2180	vub300->app_spec = 0;
2181	mutex_init(&vub300->cmd_mutex);
2182	mutex_init(&vub300->irq_mutex);
2183	vub300->command_out_urb = command_out_urb;
2184	vub300->command_res_urb = command_res_urb;
2185	vub300->usb_timed_out = 0;
2186	vub300->dynamic_register_count = 0;
2187
2188	for (i = 0; i < ARRAY_SIZE(vub300->fn); i++) {
2189		vub300->fn[i].offload_point = 0;
2190		vub300->fn[i].offload_count = 0;
2191	}
2192
2193	vub300->total_offload_count = 0;
2194	vub300->irq_enabled = 0;
2195	vub300->irq_disabled = 0;
2196	vub300->irqs_queued = 0;
2197
2198	for (i = 0; i < ARRAY_SIZE(vub300->sdio_register); i++)
2199		vub300->sdio_register[i++].activate = 0;
2200
2201	vub300->udev = udev;
2202	vub300->interface = interface;
2203	vub300->cmnd_res_ep = 0;
2204	vub300->cmnd_out_ep = 0;
2205	vub300->data_inp_ep = 0;
2206	vub300->data_out_ep = 0;
2207
2208	for (i = 0; i < ARRAY_SIZE(vub300->fbs); i++)
2209		vub300->fbs[i] = 512;
2210
2211	/*
2212	 *      set up the endpoint information
2213	 *
2214	 * use the first pair of bulk-in and bulk-out
2215	 *     endpoints for Command/Response+Interrupt
2216	 *
2217	 * use the second pair of bulk-in and bulk-out
2218	 *     endpoints for Data In/Out
2219	 */
2220	vub300->large_usb_packets = 0;
2221	iface_desc = interface->cur_altsetting;
2222	for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
2223		struct usb_endpoint_descriptor *endpoint =
2224			&iface_desc->endpoint[i].desc;
2225		dev_info(&vub300->udev->dev,
2226			 "vub300 testing %s EndPoint(%d) %02X\n",
2227			 usb_endpoint_is_bulk_in(endpoint) ? "BULK IN" :
2228			 usb_endpoint_is_bulk_out(endpoint) ? "BULK OUT" :
2229			 "UNKNOWN", i, endpoint->bEndpointAddress);
2230		if (endpoint->wMaxPacketSize > 64)
2231			vub300->large_usb_packets = 1;
2232		if (usb_endpoint_is_bulk_in(endpoint)) {
2233			if (!vub300->cmnd_res_ep) {
2234				vub300->cmnd_res_ep =
2235					endpoint->bEndpointAddress;
2236			} else if (!vub300->data_inp_ep) {
2237				vub300->data_inp_ep =
2238					endpoint->bEndpointAddress;
2239			} else {
2240				dev_warn(&vub300->udev->dev,
2241					 "ignoring"
2242					 " unexpected bulk_in endpoint");
2243			}
2244		} else if (usb_endpoint_is_bulk_out(endpoint)) {
2245			if (!vub300->cmnd_out_ep) {
2246				vub300->cmnd_out_ep =
2247					endpoint->bEndpointAddress;
2248			} else if (!vub300->data_out_ep) {
2249				vub300->data_out_ep =
2250					endpoint->bEndpointAddress;
2251			} else {
2252				dev_warn(&vub300->udev->dev,
2253					 "ignoring"
2254					 " unexpected bulk_out endpoint");
2255			}
2256		} else {
2257			dev_warn(&vub300->udev->dev,
2258				 "vub300 ignoring EndPoint(%d) %02X", i,
2259				 endpoint->bEndpointAddress);
2260		}
2261	}
2262	if (vub300->cmnd_res_ep && vub300->cmnd_out_ep &&
2263	    vub300->data_inp_ep && vub300->data_out_ep) {
2264		dev_info(&vub300->udev->dev,
2265			 "vub300 %s packets"
2266			 " using EndPoints %02X %02X %02X %02X\n",
2267			 vub300->large_usb_packets ? "LARGE" : "SMALL",
2268			 vub300->cmnd_out_ep, vub300->cmnd_res_ep,
2269			 vub300->data_out_ep, vub300->data_inp_ep);
2270		/* we have the expected EndPoints */
2271	} else {
2272		dev_err(&vub300->udev->dev,
2273		    "Could not find two sets of bulk-in/out endpoint pairs\n");
2274		retval = -EINVAL;
2275		goto err_free_host;
2276	}
2277	retval =
2278		usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
2279				GET_HC_INF0,
2280				USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2281				0x0000, 0x0000, &vub300->hc_info,
2282				sizeof(vub300->hc_info), 1000);
2283	if (retval < 0)
2284		goto err_free_host;
2285	retval =
2286		usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
2287				SET_ROM_WAIT_STATES,
2288				USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2289				firmware_rom_wait_states, 0x0000, NULL, 0, 1000);
2290	if (retval < 0)
2291		goto err_free_host;
2292	dev_info(&vub300->udev->dev,
2293		 "operating_mode = %s %s %d MHz %s %d byte USB packets\n",
2294		 (mmc->caps & MMC_CAP_SDIO_IRQ) ? "IRQs" : "POLL",
2295		 (mmc->caps & MMC_CAP_4_BIT_DATA) ? "4-bit" : "1-bit",
2296		 mmc->f_max / 1000000,
2297		 pad_input_to_usb_pkt ? "padding input data to" : "with",
2298		 vub300->large_usb_packets ? 512 : 64);
2299	retval =
2300		usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
2301				GET_SYSTEM_PORT_STATUS,
2302				USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2303				0x0000, 0x0000, &vub300->system_port_status,
2304				sizeof(vub300->system_port_status), 1000);
2305	if (retval < 0) {
2306		goto err_free_host;
2307	} else if (sizeof(vub300->system_port_status) == retval) {
2308		vub300->card_present =
2309			(0x0001 & vub300->system_port_status.port_flags) ? 1 : 0;
2310		vub300->read_only =
2311			(0x0010 & vub300->system_port_status.port_flags) ? 1 : 0;
2312	} else {
2313		retval = -EINVAL;
2314		goto err_free_host;
2315	}
2316	usb_set_intfdata(interface, vub300);
2317	INIT_DELAYED_WORK(&vub300->pollwork, vub300_pollwork_thread);
2318	INIT_WORK(&vub300->cmndwork, vub300_cmndwork_thread);
2319	INIT_WORK(&vub300->deadwork, vub300_deadwork_thread);
2320	kref_init(&vub300->kref);
2321	timer_setup(&vub300->sg_transfer_timer, vub300_sg_timed_out, 0);
2322	kref_get(&vub300->kref);
2323	timer_setup(&vub300->inactivity_timer,
2324		    vub300_inactivity_timer_expired, 0);
2325	vub300->inactivity_timer.expires = jiffies + HZ;
2326	add_timer(&vub300->inactivity_timer);
2327	if (vub300->card_present)
2328		dev_info(&vub300->udev->dev,
2329			 "USB vub300 remote SDIO host controller[%d]"
2330			 "connected with SD/SDIO card inserted\n",
2331			 interface_to_InterfaceNumber(interface));
2332	else
2333		dev_info(&vub300->udev->dev,
2334			 "USB vub300 remote SDIO host controller[%d]"
2335			 "connected with no SD/SDIO card inserted\n",
2336			 interface_to_InterfaceNumber(interface));
2337	retval = mmc_add_host(mmc);
2338	if (retval)
2339		goto error6;
2340
2341	return 0;
2342error6:
2343	timer_delete_sync(&vub300->inactivity_timer);
2344err_free_host:
2345	mmc_free_host(mmc);
2346	/*
2347	 * and hence also frees vub300
2348	 * which is contained at the end of struct mmc
2349	 */
2350error4:
2351	usb_free_urb(command_res_urb);
2352error1:
2353	usb_free_urb(command_out_urb);
2354error0:
2355	usb_put_dev(udev);
2356	return retval;
2357}
2358
2359static void vub300_disconnect(struct usb_interface *interface)
2360{				/* NOT irq */
2361	struct vub300_mmc_host *vub300 = usb_get_intfdata(interface);
2362	if (!vub300 || !vub300->mmc) {
2363		return;
2364	} else {
2365		struct mmc_host *mmc = vub300->mmc;
2366		if (!vub300->mmc) {
2367			return;
2368		} else {
2369			int ifnum = interface_to_InterfaceNumber(interface);
2370			usb_set_intfdata(interface, NULL);
2371			/* prevent more I/O from starting */
2372			vub300->interface = NULL;
2373			mmc_remove_host(mmc);
2374			kref_put(&vub300->kref, vub300_delete);
2375			pr_info("USB vub300 remote SDIO host controller[%d]"
2376				" now disconnected", ifnum);
2377			return;
2378		}
2379	}
2380}
2381
2382#ifdef CONFIG_PM
2383static int vub300_suspend(struct usb_interface *intf, pm_message_t message)
2384{
2385	return 0;
2386}
2387
2388static int vub300_resume(struct usb_interface *intf)
2389{
2390	return 0;
2391}
2392#else
2393#define vub300_suspend NULL
2394#define vub300_resume NULL
2395#endif
2396static int vub300_pre_reset(struct usb_interface *intf)
2397{				/* NOT irq */
2398	struct vub300_mmc_host *vub300 = usb_get_intfdata(intf);
2399	mutex_lock(&vub300->cmd_mutex);
2400	return 0;
2401}
2402
2403static int vub300_post_reset(struct usb_interface *intf)
2404{				/* NOT irq */
2405	struct vub300_mmc_host *vub300 = usb_get_intfdata(intf);
2406	/* we are sure no URBs are active - no locking needed */
2407	vub300->errors = -EPIPE;
2408	mutex_unlock(&vub300->cmd_mutex);
2409	return 0;
2410}
2411
2412static struct usb_driver vub300_driver = {
2413	.name = "vub300",
2414	.probe = vub300_probe,
2415	.disconnect = vub300_disconnect,
2416	.suspend = vub300_suspend,
2417	.resume = vub300_resume,
2418	.pre_reset = vub300_pre_reset,
2419	.post_reset = vub300_post_reset,
2420	.id_table = vub300_table,
2421	.supports_autosuspend = 1,
2422};
2423
2424static int __init vub300_init(void)
2425{				/* NOT irq */
2426	int result;
2427
2428	pr_info("VUB300 Driver rom wait states = %02X irqpoll timeout = %04X",
2429		firmware_rom_wait_states, 0x0FFFF & firmware_irqpoll_timeout);
2430	cmndworkqueue = create_singlethread_workqueue("kvub300c");
2431	if (!cmndworkqueue) {
2432		pr_err("not enough memory for the REQUEST workqueue");
2433		result = -ENOMEM;
2434		goto out1;
2435	}
2436	pollworkqueue = create_singlethread_workqueue("kvub300p");
2437	if (!pollworkqueue) {
2438		pr_err("not enough memory for the IRQPOLL workqueue");
2439		result = -ENOMEM;
2440		goto out2;
2441	}
2442	deadworkqueue = create_singlethread_workqueue("kvub300d");
2443	if (!deadworkqueue) {
2444		pr_err("not enough memory for the EXPIRED workqueue");
2445		result = -ENOMEM;
2446		goto out3;
2447	}
2448	result = usb_register(&vub300_driver);
2449	if (result) {
2450		pr_err("usb_register failed. Error number %d", result);
2451		goto out4;
2452	}
2453	return 0;
2454out4:
2455	destroy_workqueue(deadworkqueue);
2456out3:
2457	destroy_workqueue(pollworkqueue);
2458out2:
2459	destroy_workqueue(cmndworkqueue);
2460out1:
2461	return result;
2462}
2463
2464static void __exit vub300_exit(void)
2465{
2466	usb_deregister(&vub300_driver);
2467	flush_workqueue(cmndworkqueue);
2468	flush_workqueue(pollworkqueue);
2469	flush_workqueue(deadworkqueue);
2470	destroy_workqueue(cmndworkqueue);
2471	destroy_workqueue(pollworkqueue);
2472	destroy_workqueue(deadworkqueue);
2473}
2474
2475module_init(vub300_init);
2476module_exit(vub300_exit);
2477
2478MODULE_AUTHOR("Tony Olech <tony.olech@elandigitalsystems.com>");
2479MODULE_DESCRIPTION("VUB300 USB to SD/MMC/SDIO adapter driver");
2480MODULE_LICENSE("GPL");