linux/drivers/mmc/host/vub300.c
<<
>>
Prefs
   1/*
   2 * Remote VUB300 SDIO/SDmem Host Controller Driver
   3 *
   4 * Copyright (C) 2010 Elan Digital Systems Limited
   5 *
   6 * based on USB Skeleton driver - 2.2
   7 *
   8 * Copyright (C) 2001-2004 Greg Kroah-Hartman (greg@kroah.com)
   9 *
  10 * This program is free software; you can redistribute it and/or
  11 * modify it under the terms of the GNU General Public License as
  12 * published by the Free Software Foundation, version 2
  13 *
  14 * VUB300: is a USB 2.0 client device with a single SDIO/SDmem/MMC slot
  15 *         Any SDIO/SDmem/MMC device plugged into the VUB300 will appear,
  16 *         by virtue of this driver, to have been plugged into a local
  17 *         SDIO host controller, similar to, say, a PCI Ricoh controller
  18 *         This is because this kernel device driver is both a USB 2.0
  19 *         client device driver AND an MMC host controller driver. Thus
  20 *         if there is an existing driver for the inserted SDIO/SDmem/MMC
  21 *         device then that driver will be used by the kernel to manage
  22 *         the device in exactly the same fashion as if it had been
  23 *         directly plugged into, say, a local pci bus Ricoh controller
  24 *
  25 * RANT: this driver was written using a display 128x48 - converting it
  26 *       to a line width of 80 makes it very difficult to support. In
  27 *       particular functions have been broken down into sub functions
  28 *       and the original meaningful names have been shortened into
  29 *       cryptic ones.
  30 *       The problem is that executing a fragment of code subject to
  31 *       two conditions means an indentation of 24, thus leaving only
  32 *       56 characters for a C statement. And that is quite ridiculous!
  33 *
  34 * Data types: data passed to/from the VUB300 is fixed to a number of
  35 *             bits and driver data fields reflect that limit by using
  36 *             u8, u16, u32
  37 */
  38#include <linux/kernel.h>
  39#include <linux/errno.h>
  40#include <linux/init.h>
  41#include <linux/slab.h>
  42#include <linux/module.h>
  43#include <linux/kref.h>
  44#include <linux/uaccess.h>
  45#include <linux/usb.h>
  46#include <linux/mutex.h>
  47#include <linux/mmc/host.h>
  48#include <linux/mmc/card.h>
  49#include <linux/mmc/sdio_func.h>
  50#include <linux/mmc/sdio_ids.h>
  51#include <linux/workqueue.h>
  52#include <linux/ctype.h>
  53#include <linux/firmware.h>
  54#include <linux/scatterlist.h>
  55
  56struct host_controller_info {
  57        u8 info_size;
  58        u16 firmware_version;
  59        u8 number_of_ports;
  60} __packed;
  61
  62#define FIRMWARE_BLOCK_BOUNDARY 1024
  63struct sd_command_header {
  64        u8 header_size;
  65        u8 header_type;
  66        u8 port_number;
  67        u8 command_type; /* Bit7 - Rd/Wr */
  68        u8 command_index;
  69        u8 transfer_size[4]; /* ReadSize + ReadSize */
  70        u8 response_type;
  71        u8 arguments[4];
  72        u8 block_count[2];
  73        u8 block_size[2];
  74        u8 block_boundary[2];
  75        u8 reserved[44]; /* to pad out to 64 bytes */
  76} __packed;
  77
  78struct sd_irqpoll_header {
  79        u8 header_size;
  80        u8 header_type;
  81        u8 port_number;
  82        u8 command_type; /* Bit7 - Rd/Wr */
  83        u8 padding[16]; /* don't ask why !! */
  84        u8 poll_timeout_msb;
  85        u8 poll_timeout_lsb;
  86        u8 reserved[42]; /* to pad out to 64 bytes */
  87} __packed;
  88
  89struct sd_common_header {
  90        u8 header_size;
  91        u8 header_type;
  92        u8 port_number;
  93} __packed;
  94
  95struct sd_response_header {
  96        u8 header_size;
  97        u8 header_type;
  98        u8 port_number;
  99        u8 command_type;
 100        u8 command_index;
 101        u8 command_response[0];
 102} __packed;
 103
 104struct sd_status_header {
 105        u8 header_size;
 106        u8 header_type;
 107        u8 port_number;
 108        u16 port_flags;
 109        u32 sdio_clock;
 110        u16 host_header_size;
 111        u16 func_header_size;
 112        u16 ctrl_header_size;
 113} __packed;
 114
 115struct sd_error_header {
 116        u8 header_size;
 117        u8 header_type;
 118        u8 port_number;
 119        u8 error_code;
 120} __packed;
 121
 122struct sd_interrupt_header {
 123        u8 header_size;
 124        u8 header_type;
 125        u8 port_number;
 126} __packed;
 127
 128struct offload_registers_access {
 129        u8 command_byte[4];
 130        u8 Respond_Byte[4];
 131} __packed;
 132
 133#define INTERRUPT_REGISTER_ACCESSES 15
 134struct sd_offloaded_interrupt {
 135        u8 header_size;
 136        u8 header_type;
 137        u8 port_number;
 138        struct offload_registers_access reg[INTERRUPT_REGISTER_ACCESSES];
 139} __packed;
 140
 141struct sd_register_header {
 142        u8 header_size;
 143        u8 header_type;
 144        u8 port_number;
 145        u8 command_type;
 146        u8 command_index;
 147        u8 command_response[6];
 148} __packed;
 149
 150#define PIGGYBACK_REGISTER_ACCESSES 14
 151struct sd_offloaded_piggyback {
 152        struct sd_register_header sdio;
 153        struct offload_registers_access reg[PIGGYBACK_REGISTER_ACCESSES];
 154} __packed;
 155
 156union sd_response {
 157        struct sd_common_header common;
 158        struct sd_status_header status;
 159        struct sd_error_header error;
 160        struct sd_interrupt_header interrupt;
 161        struct sd_response_header response;
 162        struct sd_offloaded_interrupt irq;
 163        struct sd_offloaded_piggyback pig;
 164} __packed;
 165
 166union sd_command {
 167        struct sd_command_header head;
 168        struct sd_irqpoll_header poll;
 169} __packed;
 170
 171enum SD_RESPONSE_TYPE {
 172        SDRT_UNSPECIFIED = 0,
 173        SDRT_NONE,
 174        SDRT_1,
 175        SDRT_1B,
 176        SDRT_2,
 177        SDRT_3,
 178        SDRT_4,
 179        SDRT_5,
 180        SDRT_5B,
 181        SDRT_6,
 182        SDRT_7,
 183};
 184
 185#define RESPONSE_INTERRUPT                      0x01
 186#define RESPONSE_ERROR                          0x02
 187#define RESPONSE_STATUS                         0x03
 188#define RESPONSE_IRQ_DISABLED                   0x05
 189#define RESPONSE_IRQ_ENABLED                    0x06
 190#define RESPONSE_PIGGYBACKED                    0x07
 191#define RESPONSE_NO_INTERRUPT                   0x08
 192#define RESPONSE_PIG_DISABLED                   0x09
 193#define RESPONSE_PIG_ENABLED                    0x0A
 194#define SD_ERROR_1BIT_TIMEOUT                   0x01
 195#define SD_ERROR_4BIT_TIMEOUT                   0x02
 196#define SD_ERROR_1BIT_CRC_WRONG                 0x03
 197#define SD_ERROR_4BIT_CRC_WRONG                 0x04
 198#define SD_ERROR_1BIT_CRC_ERROR                 0x05
 199#define SD_ERROR_4BIT_CRC_ERROR                 0x06
 200#define SD_ERROR_NO_CMD_ENDBIT                  0x07
 201#define SD_ERROR_NO_1BIT_DATEND                 0x08
 202#define SD_ERROR_NO_4BIT_DATEND                 0x09
 203#define SD_ERROR_1BIT_UNEXPECTED_TIMEOUT        0x0A
 204#define SD_ERROR_4BIT_UNEXPECTED_TIMEOUT        0x0B
 205#define SD_ERROR_ILLEGAL_COMMAND                0x0C
 206#define SD_ERROR_NO_DEVICE                      0x0D
 207#define SD_ERROR_TRANSFER_LENGTH                0x0E
 208#define SD_ERROR_1BIT_DATA_TIMEOUT              0x0F
 209#define SD_ERROR_4BIT_DATA_TIMEOUT              0x10
 210#define SD_ERROR_ILLEGAL_STATE                  0x11
 211#define SD_ERROR_UNKNOWN_ERROR                  0x12
 212#define SD_ERROR_RESERVED_ERROR                 0x13
 213#define SD_ERROR_INVALID_FUNCTION               0x14
 214#define SD_ERROR_OUT_OF_RANGE                   0x15
 215#define SD_ERROR_STAT_CMD                       0x16
 216#define SD_ERROR_STAT_DATA                      0x17
 217#define SD_ERROR_STAT_CMD_TIMEOUT               0x18
 218#define SD_ERROR_SDCRDY_STUCK                   0x19
 219#define SD_ERROR_UNHANDLED                      0x1A
 220#define SD_ERROR_OVERRUN                        0x1B
 221#define SD_ERROR_PIO_TIMEOUT                    0x1C
 222
 223#define FUN(c) (0x000007 & (c->arg>>28))
 224#define REG(c) (0x01FFFF & (c->arg>>9))
 225
 226static bool limit_speed_to_24_MHz;
 227module_param(limit_speed_to_24_MHz, bool, 0644);
 228MODULE_PARM_DESC(limit_speed_to_24_MHz, "Limit Max SDIO Clock Speed to 24 MHz");
 229
 230static bool pad_input_to_usb_pkt;
 231module_param(pad_input_to_usb_pkt, bool, 0644);
 232MODULE_PARM_DESC(pad_input_to_usb_pkt,
 233                 "Pad USB data input transfers to whole USB Packet");
 234
 235static bool disable_offload_processing;
 236module_param(disable_offload_processing, bool, 0644);
 237MODULE_PARM_DESC(disable_offload_processing, "Disable Offload Processing");
 238
 239static bool force_1_bit_data_xfers;
 240module_param(force_1_bit_data_xfers, bool, 0644);
 241MODULE_PARM_DESC(force_1_bit_data_xfers,
 242                 "Force SDIO Data Transfers to 1-bit Mode");
 243
 244static bool force_polling_for_irqs;
 245module_param(force_polling_for_irqs, bool, 0644);
 246MODULE_PARM_DESC(force_polling_for_irqs, "Force Polling for SDIO interrupts");
 247
 248static int firmware_irqpoll_timeout = 1024;
 249module_param(firmware_irqpoll_timeout, int, 0644);
 250MODULE_PARM_DESC(firmware_irqpoll_timeout, "VUB300 firmware irqpoll timeout");
 251
 252static int force_max_req_size = 128;
 253module_param(force_max_req_size, int, 0644);
 254MODULE_PARM_DESC(force_max_req_size, "set max request size in kBytes");
 255
 256#ifdef SMSC_DEVELOPMENT_BOARD
 257static int firmware_rom_wait_states = 0x04;
 258#else
 259static int firmware_rom_wait_states = 0x1C;
 260#endif
 261
 262module_param(firmware_rom_wait_states, int, 0644);
 263MODULE_PARM_DESC(firmware_rom_wait_states,
 264                 "ROM wait states byte=RRRIIEEE (Reserved Internal External)");
 265
 266#define ELAN_VENDOR_ID          0x2201
 267#define VUB300_VENDOR_ID        0x0424
 268#define VUB300_PRODUCT_ID       0x012C
 269static struct usb_device_id vub300_table[] = {
 270        {USB_DEVICE(ELAN_VENDOR_ID, VUB300_PRODUCT_ID)},
 271        {USB_DEVICE(VUB300_VENDOR_ID, VUB300_PRODUCT_ID)},
 272        {} /* Terminating entry */
 273};
 274MODULE_DEVICE_TABLE(usb, vub300_table);
 275
 276static struct workqueue_struct *cmndworkqueue;
 277static struct workqueue_struct *pollworkqueue;
 278static struct workqueue_struct *deadworkqueue;
 279
 280static inline int interface_to_InterfaceNumber(struct usb_interface *interface)
 281{
 282        if (!interface)
 283                return -1;
 284        if (!interface->cur_altsetting)
 285                return -1;
 286        return interface->cur_altsetting->desc.bInterfaceNumber;
 287}
 288
 289struct sdio_register {
 290        unsigned func_num:3;
 291        unsigned sdio_reg:17;
 292        unsigned activate:1;
 293        unsigned prepared:1;
 294        unsigned regvalue:8;
 295        unsigned response:8;
 296        unsigned sparebit:26;
 297};
 298
 299struct vub300_mmc_host {
 300        struct usb_device *udev;
 301        struct usb_interface *interface;
 302        struct kref kref;
 303        struct mutex cmd_mutex;
 304        struct mutex irq_mutex;
 305        char vub_name[3 + (9 * 8) + 4 + 1]; /* max of 7 sdio fn's */
 306        u8 cmnd_out_ep; /* EndPoint for commands */
 307        u8 cmnd_res_ep; /* EndPoint for responses */
 308        u8 data_out_ep; /* EndPoint for out data */
 309        u8 data_inp_ep; /* EndPoint for inp data */
 310        bool card_powered;
 311        bool card_present;
 312        bool read_only;
 313        bool large_usb_packets;
 314        bool app_spec; /* ApplicationSpecific */
 315        bool irq_enabled; /* by the MMC CORE */
 316        bool irq_disabled; /* in the firmware */
 317        unsigned bus_width:4;
 318        u8 total_offload_count;
 319        u8 dynamic_register_count;
 320        u8 resp_len;
 321        u32 datasize;
 322        int errors;
 323        int usb_transport_fail;
 324        int usb_timed_out;
 325        int irqs_queued;
 326        struct sdio_register sdio_register[16];
 327        struct offload_interrupt_function_register {
 328#define MAXREGBITS 4
 329#define MAXREGS (1<<MAXREGBITS)
 330#define MAXREGMASK (MAXREGS-1)
 331                u8 offload_count;
 332                u32 offload_point;
 333                struct offload_registers_access reg[MAXREGS];
 334        } fn[8];
 335        u16 fbs[8]; /* Function Block Size */
 336        struct mmc_command *cmd;
 337        struct mmc_request *req;
 338        struct mmc_data *data;
 339        struct mmc_host *mmc;
 340        struct urb *urb;
 341        struct urb *command_out_urb;
 342        struct urb *command_res_urb;
 343        struct completion command_complete;
 344        struct completion irqpoll_complete;
 345        union sd_command cmnd;
 346        union sd_response resp;
 347        struct timer_list sg_transfer_timer;
 348        struct usb_sg_request sg_request;
 349        struct timer_list inactivity_timer;
 350        struct work_struct deadwork;
 351        struct work_struct cmndwork;
 352        struct delayed_work pollwork;
 353        struct host_controller_info hc_info;
 354        struct sd_status_header system_port_status;
 355        u8 padded_buffer[64];
 356};
 357
 358#define kref_to_vub300_mmc_host(d) container_of(d, struct vub300_mmc_host, kref)
 359#define SET_TRANSFER_PSEUDOCODE         21
 360#define SET_INTERRUPT_PSEUDOCODE        20
 361#define SET_FAILURE_MODE                18
 362#define SET_ROM_WAIT_STATES             16
 363#define SET_IRQ_ENABLE                  13
 364#define SET_CLOCK_SPEED                 11
 365#define SET_FUNCTION_BLOCK_SIZE         9
 366#define SET_SD_DATA_MODE                6
 367#define SET_SD_POWER                    4
 368#define ENTER_DFU_MODE                  3
 369#define GET_HC_INF0                     1
 370#define GET_SYSTEM_PORT_STATUS          0
 371
 372static void vub300_delete(struct kref *kref)
 373{                               /* kref callback - softirq */
 374        struct vub300_mmc_host *vub300 = kref_to_vub300_mmc_host(kref);
 375        struct mmc_host *mmc = vub300->mmc;
 376        usb_free_urb(vub300->command_out_urb);
 377        vub300->command_out_urb = NULL;
 378        usb_free_urb(vub300->command_res_urb);
 379        vub300->command_res_urb = NULL;
 380        usb_put_dev(vub300->udev);
 381        mmc_free_host(mmc);
 382        /*
 383         * and hence also frees vub300
 384         * which is contained at the end of struct mmc
 385         */
 386}
 387
 388static void vub300_queue_cmnd_work(struct vub300_mmc_host *vub300)
 389{
 390        kref_get(&vub300->kref);
 391        if (queue_work(cmndworkqueue, &vub300->cmndwork)) {
 392                /*
 393                 * then the cmndworkqueue was not previously
 394                 * running and the above get ref is obvious
 395                 * required and will be put when the thread
 396                 * terminates by a specific call
 397                 */
 398        } else {
 399                /*
 400                 * the cmndworkqueue was already running from
 401                 * a previous invocation and thus to keep the
 402                 * kref counts correct we must undo the get
 403                 */
 404                kref_put(&vub300->kref, vub300_delete);
 405        }
 406}
 407
 408static void vub300_queue_poll_work(struct vub300_mmc_host *vub300, int delay)
 409{
 410        kref_get(&vub300->kref);
 411        if (queue_delayed_work(pollworkqueue, &vub300->pollwork, delay)) {
 412                /*
 413                 * then the pollworkqueue was not previously
 414                 * running and the above get ref is obvious
 415                 * required and will be put when the thread
 416                 * terminates by a specific call
 417                 */
 418        } else {
 419                /*
 420                 * the pollworkqueue was already running from
 421                 * a previous invocation and thus to keep the
 422                 * kref counts correct we must undo the get
 423                 */
 424                kref_put(&vub300->kref, vub300_delete);
 425        }
 426}
 427
 428static void vub300_queue_dead_work(struct vub300_mmc_host *vub300)
 429{
 430        kref_get(&vub300->kref);
 431        if (queue_work(deadworkqueue, &vub300->deadwork)) {
 432                /*
 433                 * then the deadworkqueue was not previously
 434                 * running and the above get ref is obvious
 435                 * required and will be put when the thread
 436                 * terminates by a specific call
 437                 */
 438        } else {
 439                /*
 440                 * the deadworkqueue was already running from
 441                 * a previous invocation and thus to keep the
 442                 * kref counts correct we must undo the get
 443                 */
 444                kref_put(&vub300->kref, vub300_delete);
 445        }
 446}
 447
 448static void irqpoll_res_completed(struct urb *urb)
 449{                               /* urb completion handler - hardirq */
 450        struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
 451        if (urb->status)
 452                vub300->usb_transport_fail = urb->status;
 453        complete(&vub300->irqpoll_complete);
 454}
 455
 456static void irqpoll_out_completed(struct urb *urb)
 457{                               /* urb completion handler - hardirq */
 458        struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
 459        if (urb->status) {
 460                vub300->usb_transport_fail = urb->status;
 461                complete(&vub300->irqpoll_complete);
 462                return;
 463        } else {
 464                int ret;
 465                unsigned int pipe =
 466                        usb_rcvbulkpipe(vub300->udev, vub300->cmnd_res_ep);
 467                usb_fill_bulk_urb(vub300->command_res_urb, vub300->udev, pipe,
 468                                  &vub300->resp, sizeof(vub300->resp),
 469                                  irqpoll_res_completed, vub300);
 470                vub300->command_res_urb->actual_length = 0;
 471                ret = usb_submit_urb(vub300->command_res_urb, GFP_ATOMIC);
 472                if (ret) {
 473                        vub300->usb_transport_fail = ret;
 474                        complete(&vub300->irqpoll_complete);
 475                }
 476                return;
 477        }
 478}
 479
 480static void send_irqpoll(struct vub300_mmc_host *vub300)
 481{
 482        /* cmd_mutex is held by vub300_pollwork_thread */
 483        int retval;
 484        int timeout = 0xFFFF & (0x0001FFFF - firmware_irqpoll_timeout);
 485        vub300->cmnd.poll.header_size = 22;
 486        vub300->cmnd.poll.header_type = 1;
 487        vub300->cmnd.poll.port_number = 0;
 488        vub300->cmnd.poll.command_type = 2;
 489        vub300->cmnd.poll.poll_timeout_lsb = 0xFF & (unsigned)timeout;
 490        vub300->cmnd.poll.poll_timeout_msb = 0xFF & (unsigned)(timeout >> 8);
 491        usb_fill_bulk_urb(vub300->command_out_urb, vub300->udev,
 492                          usb_sndbulkpipe(vub300->udev, vub300->cmnd_out_ep)
 493                          , &vub300->cmnd, sizeof(vub300->cmnd)
 494                          , irqpoll_out_completed, vub300);
 495        retval = usb_submit_urb(vub300->command_out_urb, GFP_KERNEL);
 496        if (0 > retval) {
 497                vub300->usb_transport_fail = retval;
 498                vub300_queue_poll_work(vub300, 1);
 499                complete(&vub300->irqpoll_complete);
 500                return;
 501        } else {
 502                return;
 503        }
 504}
 505
 506static void new_system_port_status(struct vub300_mmc_host *vub300)
 507{
 508        int old_card_present = vub300->card_present;
 509        int new_card_present =
 510                (0x0001 & vub300->system_port_status.port_flags) ? 1 : 0;
 511        vub300->read_only =
 512                (0x0010 & vub300->system_port_status.port_flags) ? 1 : 0;
 513        if (new_card_present && !old_card_present) {
 514                dev_info(&vub300->udev->dev, "card just inserted\n");
 515                vub300->card_present = 1;
 516                vub300->bus_width = 0;
 517                if (disable_offload_processing)
 518                        strncpy(vub300->vub_name, "EMPTY Processing Disabled",
 519                                sizeof(vub300->vub_name));
 520                else
 521                        vub300->vub_name[0] = 0;
 522                mmc_detect_change(vub300->mmc, 1);
 523        } else if (!new_card_present && old_card_present) {
 524                dev_info(&vub300->udev->dev, "card just ejected\n");
 525                vub300->card_present = 0;
 526                mmc_detect_change(vub300->mmc, 0);
 527        } else {
 528                /* no change */
 529        }
 530}
 531
 532static void __add_offloaded_reg_to_fifo(struct vub300_mmc_host *vub300,
 533                                        struct offload_registers_access
 534                                        *register_access, u8 func)
 535{
 536        u8 r = vub300->fn[func].offload_point + vub300->fn[func].offload_count;
 537        memcpy(&vub300->fn[func].reg[MAXREGMASK & r], register_access,
 538               sizeof(struct offload_registers_access));
 539        vub300->fn[func].offload_count += 1;
 540        vub300->total_offload_count += 1;
 541}
 542
 543static void add_offloaded_reg(struct vub300_mmc_host *vub300,
 544                              struct offload_registers_access *register_access)
 545{
 546        u32 Register = ((0x03 & register_access->command_byte[0]) << 15)
 547                        | ((0xFF & register_access->command_byte[1]) << 7)
 548                        | ((0xFE & register_access->command_byte[2]) >> 1);
 549        u8 func = ((0x70 & register_access->command_byte[0]) >> 4);
 550        u8 regs = vub300->dynamic_register_count;
 551        u8 i = 0;
 552        while (0 < regs-- && 1 == vub300->sdio_register[i].activate) {
 553                if (vub300->sdio_register[i].func_num == func &&
 554                    vub300->sdio_register[i].sdio_reg == Register) {
 555                        if (vub300->sdio_register[i].prepared == 0)
 556                                vub300->sdio_register[i].prepared = 1;
 557                        vub300->sdio_register[i].response =
 558                                register_access->Respond_Byte[2];
 559                        vub300->sdio_register[i].regvalue =
 560                                register_access->Respond_Byte[3];
 561                        return;
 562                } else {
 563                        i += 1;
 564                        continue;
 565                }
 566        };
 567        __add_offloaded_reg_to_fifo(vub300, register_access, func);
 568}
 569
 570static void check_vub300_port_status(struct vub300_mmc_host *vub300)
 571{
 572        /*
 573         * cmd_mutex is held by vub300_pollwork_thread,
 574         * vub300_deadwork_thread or vub300_cmndwork_thread
 575         */
 576        int retval;
 577        retval =
 578                usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
 579                                GET_SYSTEM_PORT_STATUS,
 580                                USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 581                                0x0000, 0x0000, &vub300->system_port_status,
 582                                sizeof(vub300->system_port_status), HZ);
 583        if (sizeof(vub300->system_port_status) == retval)
 584                new_system_port_status(vub300);
 585}
 586
 587static void __vub300_irqpoll_response(struct vub300_mmc_host *vub300)
 588{
 589        /* cmd_mutex is held by vub300_pollwork_thread */
 590        if (vub300->command_res_urb->actual_length == 0)
 591                return;
 592
 593        switch (vub300->resp.common.header_type) {
 594        case RESPONSE_INTERRUPT:
 595                mutex_lock(&vub300->irq_mutex);
 596                if (vub300->irq_enabled)
 597                        mmc_signal_sdio_irq(vub300->mmc);
 598                else
 599                        vub300->irqs_queued += 1;
 600                vub300->irq_disabled = 1;
 601                mutex_unlock(&vub300->irq_mutex);
 602                break;
 603        case RESPONSE_ERROR:
 604                if (vub300->resp.error.error_code == SD_ERROR_NO_DEVICE)
 605                        check_vub300_port_status(vub300);
 606                break;
 607        case RESPONSE_STATUS:
 608                vub300->system_port_status = vub300->resp.status;
 609                new_system_port_status(vub300);
 610                if (!vub300->card_present)
 611                        vub300_queue_poll_work(vub300, HZ / 5);
 612                break;
 613        case RESPONSE_IRQ_DISABLED:
 614        {
 615                int offloaded_data_length = vub300->resp.common.header_size - 3;
 616                int register_count = offloaded_data_length >> 3;
 617                int ri = 0;
 618                while (register_count--) {
 619                        add_offloaded_reg(vub300, &vub300->resp.irq.reg[ri]);
 620                        ri += 1;
 621                }
 622                mutex_lock(&vub300->irq_mutex);
 623                if (vub300->irq_enabled)
 624                        mmc_signal_sdio_irq(vub300->mmc);
 625                else
 626                        vub300->irqs_queued += 1;
 627                vub300->irq_disabled = 1;
 628                mutex_unlock(&vub300->irq_mutex);
 629                break;
 630        }
 631        case RESPONSE_IRQ_ENABLED:
 632        {
 633                int offloaded_data_length = vub300->resp.common.header_size - 3;
 634                int register_count = offloaded_data_length >> 3;
 635                int ri = 0;
 636                while (register_count--) {
 637                        add_offloaded_reg(vub300, &vub300->resp.irq.reg[ri]);
 638                        ri += 1;
 639                }
 640                mutex_lock(&vub300->irq_mutex);
 641                if (vub300->irq_enabled)
 642                        mmc_signal_sdio_irq(vub300->mmc);
 643                else if (vub300->irqs_queued)
 644                        vub300->irqs_queued += 1;
 645                else
 646                        vub300->irqs_queued += 1;
 647                vub300->irq_disabled = 0;
 648                mutex_unlock(&vub300->irq_mutex);
 649                break;
 650        }
 651        case RESPONSE_NO_INTERRUPT:
 652                vub300_queue_poll_work(vub300, 1);
 653                break;
 654        default:
 655                break;
 656        }
 657}
 658
 659static void __do_poll(struct vub300_mmc_host *vub300)
 660{
 661        /* cmd_mutex is held by vub300_pollwork_thread */
 662        long commretval;
 663        mod_timer(&vub300->inactivity_timer, jiffies + HZ);
 664        init_completion(&vub300->irqpoll_complete);
 665        send_irqpoll(vub300);
 666        commretval = wait_for_completion_timeout(&vub300->irqpoll_complete,
 667                                                 msecs_to_jiffies(500));
 668        if (vub300->usb_transport_fail) {
 669                /* no need to do anything */
 670        } else if (commretval == 0) {
 671                vub300->usb_timed_out = 1;
 672                usb_kill_urb(vub300->command_out_urb);
 673                usb_kill_urb(vub300->command_res_urb);
 674        } else if (commretval < 0) {
 675                vub300_queue_poll_work(vub300, 1);
 676        } else { /* commretval > 0 */
 677                __vub300_irqpoll_response(vub300);
 678        }
 679}
 680
 681/* this thread runs only when the driver
 682 * is trying to poll the device for an IRQ
 683 */
 684static void vub300_pollwork_thread(struct work_struct *work)
 685{                               /* NOT irq */
 686        struct vub300_mmc_host *vub300 = container_of(work,
 687                              struct vub300_mmc_host, pollwork.work);
 688        if (!vub300->interface) {
 689                kref_put(&vub300->kref, vub300_delete);
 690                return;
 691        }
 692        mutex_lock(&vub300->cmd_mutex);
 693        if (vub300->cmd) {
 694                vub300_queue_poll_work(vub300, 1);
 695        } else if (!vub300->card_present) {
 696                /* no need to do anything */
 697        } else { /* vub300->card_present */
 698                mutex_lock(&vub300->irq_mutex);
 699                if (!vub300->irq_enabled) {
 700                        mutex_unlock(&vub300->irq_mutex);
 701                } else if (vub300->irqs_queued) {
 702                        vub300->irqs_queued -= 1;
 703                        mmc_signal_sdio_irq(vub300->mmc);
 704                        mod_timer(&vub300->inactivity_timer, jiffies + HZ);
 705                        mutex_unlock(&vub300->irq_mutex);
 706                } else { /* NOT vub300->irqs_queued */
 707                        mutex_unlock(&vub300->irq_mutex);
 708                        __do_poll(vub300);
 709                }
 710        }
 711        mutex_unlock(&vub300->cmd_mutex);
 712        kref_put(&vub300->kref, vub300_delete);
 713}
 714
 715static void vub300_deadwork_thread(struct work_struct *work)
 716{                               /* NOT irq */
 717        struct vub300_mmc_host *vub300 =
 718                container_of(work, struct vub300_mmc_host, deadwork);
 719        if (!vub300->interface) {
 720                kref_put(&vub300->kref, vub300_delete);
 721                return;
 722        }
 723        mutex_lock(&vub300->cmd_mutex);
 724        if (vub300->cmd) {
 725                /*
 726                 * a command got in as the inactivity
 727                 * timer expired - so we just let the
 728                 * processing of the command show if
 729                 * the device is dead
 730                 */
 731        } else if (vub300->card_present) {
 732                check_vub300_port_status(vub300);
 733        } else if (vub300->mmc && vub300->mmc->card &&
 734                   mmc_card_present(vub300->mmc->card)) {
 735                /*
 736                 * the MMC core must not have responded
 737                 * to the previous indication - lets
 738                 * hope that it eventually does so we
 739                 * will just ignore this for now
 740                 */
 741        } else {
 742                check_vub300_port_status(vub300);
 743        }
 744        mod_timer(&vub300->inactivity_timer, jiffies + HZ);
 745        mutex_unlock(&vub300->cmd_mutex);
 746        kref_put(&vub300->kref, vub300_delete);
 747}
 748
 749static void vub300_inactivity_timer_expired(unsigned long data)
 750{                               /* softirq */
 751        struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)data;
 752        if (!vub300->interface) {
 753                kref_put(&vub300->kref, vub300_delete);
 754        } else if (vub300->cmd) {
 755                mod_timer(&vub300->inactivity_timer, jiffies + HZ);
 756        } else {
 757                vub300_queue_dead_work(vub300);
 758                mod_timer(&vub300->inactivity_timer, jiffies + HZ);
 759        }
 760}
 761
 762static int vub300_response_error(u8 error_code)
 763{
 764        switch (error_code) {
 765        case SD_ERROR_PIO_TIMEOUT:
 766        case SD_ERROR_1BIT_TIMEOUT:
 767        case SD_ERROR_4BIT_TIMEOUT:
 768                return -ETIMEDOUT;
 769        case SD_ERROR_STAT_DATA:
 770        case SD_ERROR_OVERRUN:
 771        case SD_ERROR_STAT_CMD:
 772        case SD_ERROR_STAT_CMD_TIMEOUT:
 773        case SD_ERROR_SDCRDY_STUCK:
 774        case SD_ERROR_UNHANDLED:
 775        case SD_ERROR_1BIT_CRC_WRONG:
 776        case SD_ERROR_4BIT_CRC_WRONG:
 777        case SD_ERROR_1BIT_CRC_ERROR:
 778        case SD_ERROR_4BIT_CRC_ERROR:
 779        case SD_ERROR_NO_CMD_ENDBIT:
 780        case SD_ERROR_NO_1BIT_DATEND:
 781        case SD_ERROR_NO_4BIT_DATEND:
 782        case SD_ERROR_1BIT_DATA_TIMEOUT:
 783        case SD_ERROR_4BIT_DATA_TIMEOUT:
 784        case SD_ERROR_1BIT_UNEXPECTED_TIMEOUT:
 785        case SD_ERROR_4BIT_UNEXPECTED_TIMEOUT:
 786                return -EILSEQ;
 787        case 33:
 788                return -EILSEQ;
 789        case SD_ERROR_ILLEGAL_COMMAND:
 790                return -EINVAL;
 791        case SD_ERROR_NO_DEVICE:
 792                return -ENOMEDIUM;
 793        default:
 794                return -ENODEV;
 795        }
 796}
 797
 798static void command_res_completed(struct urb *urb)
 799{                               /* urb completion handler - hardirq */
 800        struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
 801        if (urb->status) {
 802                /* we have to let the initiator handle the error */
 803        } else if (vub300->command_res_urb->actual_length == 0) {
 804                /*
 805                 * we have seen this happen once or twice and
 806                 * we suspect a buggy USB host controller
 807                 */
 808        } else if (!vub300->data) {
 809                /* this means that the command (typically CMD52) suceeded */
 810        } else if (vub300->resp.common.header_type != 0x02) {
 811                /*
 812                 * this is an error response from the VUB300 chip
 813                 * and we let the initiator handle it
 814                 */
 815        } else if (vub300->urb) {
 816                vub300->cmd->error =
 817                        vub300_response_error(vub300->resp.error.error_code);
 818                usb_unlink_urb(vub300->urb);
 819        } else {
 820                vub300->cmd->error =
 821                        vub300_response_error(vub300->resp.error.error_code);
 822                usb_sg_cancel(&vub300->sg_request);
 823        }
 824        complete(&vub300->command_complete);    /* got_response_in */
 825}
 826
 827static void command_out_completed(struct urb *urb)
 828{                               /* urb completion handler - hardirq */
 829        struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
 830        if (urb->status) {
 831                complete(&vub300->command_complete);
 832        } else {
 833                int ret;
 834                unsigned int pipe =
 835                        usb_rcvbulkpipe(vub300->udev, vub300->cmnd_res_ep);
 836                usb_fill_bulk_urb(vub300->command_res_urb, vub300->udev, pipe,
 837                                  &vub300->resp, sizeof(vub300->resp),
 838                                  command_res_completed, vub300);
 839                vub300->command_res_urb->actual_length = 0;
 840                ret = usb_submit_urb(vub300->command_res_urb, GFP_ATOMIC);
 841                if (ret == 0) {
 842                        /*
 843                         * the urb completion handler will call
 844                         * our completion handler
 845                         */
 846                } else {
 847                        /*
 848                         * and thus we only call it directly
 849                         * when it will not be called
 850                         */
 851                        complete(&vub300->command_complete);
 852                }
 853        }
 854}
 855
 856/*
 857 * the STUFF bits are masked out for the comparisons
 858 */
 859static void snoop_block_size_and_bus_width(struct vub300_mmc_host *vub300,
 860                                           u32 cmd_arg)
 861{
 862        if ((0xFBFFFE00 & cmd_arg) == 0x80022200)
 863                vub300->fbs[1] = (cmd_arg << 8) | (0x00FF & vub300->fbs[1]);
 864        else if ((0xFBFFFE00 & cmd_arg) == 0x80022000)
 865                vub300->fbs[1] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[1]);
 866        else if ((0xFBFFFE00 & cmd_arg) == 0x80042200)
 867                vub300->fbs[2] = (cmd_arg << 8) | (0x00FF & vub300->fbs[2]);
 868        else if ((0xFBFFFE00 & cmd_arg) == 0x80042000)
 869                vub300->fbs[2] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[2]);
 870        else if ((0xFBFFFE00 & cmd_arg) == 0x80062200)
 871                vub300->fbs[3] = (cmd_arg << 8) | (0x00FF & vub300->fbs[3]);
 872        else if ((0xFBFFFE00 & cmd_arg) == 0x80062000)
 873                vub300->fbs[3] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[3]);
 874        else if ((0xFBFFFE00 & cmd_arg) == 0x80082200)
 875                vub300->fbs[4] = (cmd_arg << 8) | (0x00FF & vub300->fbs[4]);
 876        else if ((0xFBFFFE00 & cmd_arg) == 0x80082000)
 877                vub300->fbs[4] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[4]);
 878        else if ((0xFBFFFE00 & cmd_arg) == 0x800A2200)
 879                vub300->fbs[5] = (cmd_arg << 8) | (0x00FF & vub300->fbs[5]);
 880        else if ((0xFBFFFE00 & cmd_arg) == 0x800A2000)
 881                vub300->fbs[5] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[5]);
 882        else if ((0xFBFFFE00 & cmd_arg) == 0x800C2200)
 883                vub300->fbs[6] = (cmd_arg << 8) | (0x00FF & vub300->fbs[6]);
 884        else if ((0xFBFFFE00 & cmd_arg) == 0x800C2000)
 885                vub300->fbs[6] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[6]);
 886        else if ((0xFBFFFE00 & cmd_arg) == 0x800E2200)
 887                vub300->fbs[7] = (cmd_arg << 8) | (0x00FF & vub300->fbs[7]);
 888        else if ((0xFBFFFE00 & cmd_arg) == 0x800E2000)
 889                vub300->fbs[7] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[7]);
 890        else if ((0xFBFFFE03 & cmd_arg) == 0x80000E00)
 891                vub300->bus_width = 1;
 892        else if ((0xFBFFFE03 & cmd_arg) == 0x80000E02)
 893                vub300->bus_width = 4;
 894}
 895
 896static void send_command(struct vub300_mmc_host *vub300)
 897{
 898        /* cmd_mutex is held by vub300_cmndwork_thread */
 899        struct mmc_command *cmd = vub300->cmd;
 900        struct mmc_data *data = vub300->data;
 901        int retval;
 902        int i;
 903        u8 response_type;
 904        if (vub300->app_spec) {
 905                switch (cmd->opcode) {
 906                case 6:
 907                        response_type = SDRT_1;
 908                        vub300->resp_len = 6;
 909                        if (0x00000000 == (0x00000003 & cmd->arg))
 910                                vub300->bus_width = 1;
 911                        else if (0x00000002 == (0x00000003 & cmd->arg))
 912                                vub300->bus_width = 4;
 913                        else
 914                                dev_err(&vub300->udev->dev,
 915                                        "unexpected ACMD6 bus_width=%d\n",
 916                                        0x00000003 & cmd->arg);
 917                        break;
 918                case 13:
 919                        response_type = SDRT_1;
 920                        vub300->resp_len = 6;
 921                        break;
 922                case 22:
 923                        response_type = SDRT_1;
 924                        vub300->resp_len = 6;
 925                        break;
 926                case 23:
 927                        response_type = SDRT_1;
 928                        vub300->resp_len = 6;
 929                        break;
 930                case 41:
 931                        response_type = SDRT_3;
 932                        vub300->resp_len = 6;
 933                        break;
 934                case 42:
 935                        response_type = SDRT_1;
 936                        vub300->resp_len = 6;
 937                        break;
 938                case 51:
 939                        response_type = SDRT_1;
 940                        vub300->resp_len = 6;
 941                        break;
 942                case 55:
 943                        response_type = SDRT_1;
 944                        vub300->resp_len = 6;
 945                        break;
 946                default:
 947                        vub300->resp_len = 0;
 948                        cmd->error = -EINVAL;
 949                        complete(&vub300->command_complete);
 950                        return;
 951                }
 952                vub300->app_spec = 0;
 953        } else {
 954                switch (cmd->opcode) {
 955                case 0:
 956                        response_type = SDRT_NONE;
 957                        vub300->resp_len = 0;
 958                        break;
 959                case 1:
 960                        response_type = SDRT_3;
 961                        vub300->resp_len = 6;
 962                        break;
 963                case 2:
 964                        response_type = SDRT_2;
 965                        vub300->resp_len = 17;
 966                        break;
 967                case 3:
 968                        response_type = SDRT_6;
 969                        vub300->resp_len = 6;
 970                        break;
 971                case 4:
 972                        response_type = SDRT_NONE;
 973                        vub300->resp_len = 0;
 974                        break;
 975                case 5:
 976                        response_type = SDRT_4;
 977                        vub300->resp_len = 6;
 978                        break;
 979                case 6:
 980                        response_type = SDRT_1;
 981                        vub300->resp_len = 6;
 982                        break;
 983                case 7:
 984                        response_type = SDRT_1B;
 985                        vub300->resp_len = 6;
 986                        break;
 987                case 8:
 988                        response_type = SDRT_7;
 989                        vub300->resp_len = 6;
 990                        break;
 991                case 9:
 992                        response_type = SDRT_2;
 993                        vub300->resp_len = 17;
 994                        break;
 995                case 10:
 996                        response_type = SDRT_2;
 997                        vub300->resp_len = 17;
 998                        break;
 999                case 12:
1000                        response_type = SDRT_1B;
1001                        vub300->resp_len = 6;
1002                        break;
1003                case 13:
1004                        response_type = SDRT_1;
1005                        vub300->resp_len = 6;
1006                        break;
1007                case 15:
1008                        response_type = SDRT_NONE;
1009                        vub300->resp_len = 0;
1010                        break;
1011                case 16:
1012                        for (i = 0; i < ARRAY_SIZE(vub300->fbs); i++)
1013                                vub300->fbs[i] = 0xFFFF & cmd->arg;
1014                        response_type = SDRT_1;
1015                        vub300->resp_len = 6;
1016                        break;
1017                case 17:
1018                case 18:
1019                case 24:
1020                case 25:
1021                case 27:
1022                        response_type = SDRT_1;
1023                        vub300->resp_len = 6;
1024                        break;
1025                case 28:
1026                case 29:
1027                        response_type = SDRT_1B;
1028                        vub300->resp_len = 6;
1029                        break;
1030                case 30:
1031                case 32:
1032                case 33:
1033                        response_type = SDRT_1;
1034                        vub300->resp_len = 6;
1035                        break;
1036                case 38:
1037                        response_type = SDRT_1B;
1038                        vub300->resp_len = 6;
1039                        break;
1040                case 42:
1041                        response_type = SDRT_1;
1042                        vub300->resp_len = 6;
1043                        break;
1044                case 52:
1045                        response_type = SDRT_5;
1046                        vub300->resp_len = 6;
1047                        snoop_block_size_and_bus_width(vub300, cmd->arg);
1048                        break;
1049                case 53:
1050                        response_type = SDRT_5;
1051                        vub300->resp_len = 6;
1052                        break;
1053                case 55:
1054                        response_type = SDRT_1;
1055                        vub300->resp_len = 6;
1056                        vub300->app_spec = 1;
1057                        break;
1058                case 56:
1059                        response_type = SDRT_1;
1060                        vub300->resp_len = 6;
1061                        break;
1062                default:
1063                        vub300->resp_len = 0;
1064                        cmd->error = -EINVAL;
1065                        complete(&vub300->command_complete);
1066                        return;
1067                }
1068        }
1069        /*
1070         * it is a shame that we can not use "sizeof(struct sd_command_header)"
1071         * this is because the packet _must_ be padded to 64 bytes
1072         */
1073        vub300->cmnd.head.header_size = 20;
1074        vub300->cmnd.head.header_type = 0x00;
1075        vub300->cmnd.head.port_number = 0; /* "0" means port 1 */
1076        vub300->cmnd.head.command_type = 0x00; /* standard read command */
1077        vub300->cmnd.head.response_type = response_type;
1078        vub300->cmnd.head.command_index = cmd->opcode;
1079        vub300->cmnd.head.arguments[0] = cmd->arg >> 24;
1080        vub300->cmnd.head.arguments[1] = cmd->arg >> 16;
1081        vub300->cmnd.head.arguments[2] = cmd->arg >> 8;
1082        vub300->cmnd.head.arguments[3] = cmd->arg >> 0;
1083        if (cmd->opcode == 52) {
1084                int fn = 0x7 & (cmd->arg >> 28);
1085                vub300->cmnd.head.block_count[0] = 0;
1086                vub300->cmnd.head.block_count[1] = 0;
1087                vub300->cmnd.head.block_size[0] = (vub300->fbs[fn] >> 8) & 0xFF;
1088                vub300->cmnd.head.block_size[1] = (vub300->fbs[fn] >> 0) & 0xFF;
1089                vub300->cmnd.head.command_type = 0x00;
1090                vub300->cmnd.head.transfer_size[0] = 0;
1091                vub300->cmnd.head.transfer_size[1] = 0;
1092                vub300->cmnd.head.transfer_size[2] = 0;
1093                vub300->cmnd.head.transfer_size[3] = 0;
1094        } else if (!data) {
1095                vub300->cmnd.head.block_count[0] = 0;
1096                vub300->cmnd.head.block_count[1] = 0;
1097                vub300->cmnd.head.block_size[0] = (vub300->fbs[0] >> 8) & 0xFF;
1098                vub300->cmnd.head.block_size[1] = (vub300->fbs[0] >> 0) & 0xFF;
1099                vub300->cmnd.head.command_type = 0x00;
1100                vub300->cmnd.head.transfer_size[0] = 0;
1101                vub300->cmnd.head.transfer_size[1] = 0;
1102                vub300->cmnd.head.transfer_size[2] = 0;
1103                vub300->cmnd.head.transfer_size[3] = 0;
1104        } else if (cmd->opcode == 53) {
1105                int fn = 0x7 & (cmd->arg >> 28);
1106                if (0x08 & vub300->cmnd.head.arguments[0]) { /* BLOCK MODE */
1107                        vub300->cmnd.head.block_count[0] =
1108                                (data->blocks >> 8) & 0xFF;
1109                        vub300->cmnd.head.block_count[1] =
1110                                (data->blocks >> 0) & 0xFF;
1111                        vub300->cmnd.head.block_size[0] =
1112                                (data->blksz >> 8) & 0xFF;
1113                        vub300->cmnd.head.block_size[1] =
1114                                (data->blksz >> 0) & 0xFF;
1115                } else {        /* BYTE MODE */
1116                        vub300->cmnd.head.block_count[0] = 0;
1117                        vub300->cmnd.head.block_count[1] = 0;
1118                        vub300->cmnd.head.block_size[0] =
1119                                (vub300->datasize >> 8) & 0xFF;
1120                        vub300->cmnd.head.block_size[1] =
1121                                (vub300->datasize >> 0) & 0xFF;
1122                }
1123                vub300->cmnd.head.command_type =
1124                        (MMC_DATA_READ & data->flags) ? 0x00 : 0x80;
1125                vub300->cmnd.head.transfer_size[0] =
1126                        (vub300->datasize >> 24) & 0xFF;
1127                vub300->cmnd.head.transfer_size[1] =
1128                        (vub300->datasize >> 16) & 0xFF;
1129                vub300->cmnd.head.transfer_size[2] =
1130                        (vub300->datasize >> 8) & 0xFF;
1131                vub300->cmnd.head.transfer_size[3] =
1132                        (vub300->datasize >> 0) & 0xFF;
1133                if (vub300->datasize < vub300->fbs[fn]) {
1134                        vub300->cmnd.head.block_count[0] = 0;
1135                        vub300->cmnd.head.block_count[1] = 0;
1136                }
1137        } else {
1138                vub300->cmnd.head.block_count[0] = (data->blocks >> 8) & 0xFF;
1139                vub300->cmnd.head.block_count[1] = (data->blocks >> 0) & 0xFF;
1140                vub300->cmnd.head.block_size[0] = (data->blksz >> 8) & 0xFF;
1141                vub300->cmnd.head.block_size[1] = (data->blksz >> 0) & 0xFF;
1142                vub300->cmnd.head.command_type =
1143                        (MMC_DATA_READ & data->flags) ? 0x00 : 0x80;
1144                vub300->cmnd.head.transfer_size[0] =
1145                        (vub300->datasize >> 24) & 0xFF;
1146                vub300->cmnd.head.transfer_size[1] =
1147                        (vub300->datasize >> 16) & 0xFF;
1148                vub300->cmnd.head.transfer_size[2] =
1149                        (vub300->datasize >> 8) & 0xFF;
1150                vub300->cmnd.head.transfer_size[3] =
1151                        (vub300->datasize >> 0) & 0xFF;
1152                if (vub300->datasize < vub300->fbs[0]) {
1153                        vub300->cmnd.head.block_count[0] = 0;
1154                        vub300->cmnd.head.block_count[1] = 0;
1155                }
1156        }
1157        if (vub300->cmnd.head.block_size[0] || vub300->cmnd.head.block_size[1]) {
1158                u16 block_size = vub300->cmnd.head.block_size[1] |
1159                        (vub300->cmnd.head.block_size[0] << 8);
1160                u16 block_boundary = FIRMWARE_BLOCK_BOUNDARY -
1161                        (FIRMWARE_BLOCK_BOUNDARY % block_size);
1162                vub300->cmnd.head.block_boundary[0] =
1163                        (block_boundary >> 8) & 0xFF;
1164                vub300->cmnd.head.block_boundary[1] =
1165                        (block_boundary >> 0) & 0xFF;
1166        } else {
1167                vub300->cmnd.head.block_boundary[0] = 0;
1168                vub300->cmnd.head.block_boundary[1] = 0;
1169        }
1170        usb_fill_bulk_urb(vub300->command_out_urb, vub300->udev,
1171                          usb_sndbulkpipe(vub300->udev, vub300->cmnd_out_ep),
1172                          &vub300->cmnd, sizeof(vub300->cmnd),
1173                          command_out_completed, vub300);
1174        retval = usb_submit_urb(vub300->command_out_urb, GFP_KERNEL);
1175        if (retval < 0) {
1176                cmd->error = retval;
1177                complete(&vub300->command_complete);
1178                return;
1179        } else {
1180                return;
1181        }
1182}
1183
1184/*
1185 * timer callback runs in atomic mode
1186 *       so it cannot call usb_kill_urb()
1187 */
1188static void vub300_sg_timed_out(unsigned long data)
1189{
1190        struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)data;
1191        vub300->usb_timed_out = 1;
1192        usb_sg_cancel(&vub300->sg_request);
1193        usb_unlink_urb(vub300->command_out_urb);
1194        usb_unlink_urb(vub300->command_res_urb);
1195}
1196
1197static u16 roundup_to_multiple_of_64(u16 number)
1198{
1199        return 0xFFC0 & (0x3F + number);
1200}
1201
1202/*
1203 * this is a separate function to solve the 80 column width restriction
1204 */
1205static void __download_offload_pseudocode(struct vub300_mmc_host *vub300,
1206                                          const struct firmware *fw)
1207{
1208        u8 register_count = 0;
1209        u16 ts = 0;
1210        u16 interrupt_size = 0;
1211        const u8 *data = fw->data;
1212        int size = fw->size;
1213        u8 c;
1214        dev_info(&vub300->udev->dev, "using %s for SDIO offload processing\n",
1215                 vub300->vub_name);
1216        do {
1217                c = *data++;
1218        } while (size-- && c); /* skip comment */
1219        dev_info(&vub300->udev->dev, "using offload firmware %s %s\n", fw->data,
1220                 vub300->vub_name);
1221        if (size < 4) {
1222                dev_err(&vub300->udev->dev,
1223                        "corrupt offload pseudocode in firmware %s\n",
1224                        vub300->vub_name);
1225                strncpy(vub300->vub_name, "corrupt offload pseudocode",
1226                        sizeof(vub300->vub_name));
1227                return;
1228        }
1229        interrupt_size += *data++;
1230        size -= 1;
1231        interrupt_size <<= 8;
1232        interrupt_size += *data++;
1233        size -= 1;
1234        if (interrupt_size < size) {
1235                u16 xfer_length = roundup_to_multiple_of_64(interrupt_size);
1236                u8 *xfer_buffer = kmalloc(xfer_length, GFP_KERNEL);
1237                if (xfer_buffer) {
1238                        int retval;
1239                        memcpy(xfer_buffer, data, interrupt_size);
1240                        memset(xfer_buffer + interrupt_size, 0,
1241                               xfer_length - interrupt_size);
1242                        size -= interrupt_size;
1243                        data += interrupt_size;
1244                        retval =
1245                                usb_control_msg(vub300->udev,
1246                                                usb_sndctrlpipe(vub300->udev, 0),
1247                                                SET_INTERRUPT_PSEUDOCODE,
1248                                                USB_DIR_OUT | USB_TYPE_VENDOR |
1249                                                USB_RECIP_DEVICE, 0x0000, 0x0000,
1250                                                xfer_buffer, xfer_length, HZ);
1251                        kfree(xfer_buffer);
1252                        if (retval < 0) {
1253                                strncpy(vub300->vub_name,
1254                                        "SDIO pseudocode download failed",
1255                                        sizeof(vub300->vub_name));
1256                                return;
1257                        }
1258                } else {
1259                        dev_err(&vub300->udev->dev,
1260                                "not enough memory for xfer buffer to send"
1261                                " INTERRUPT_PSEUDOCODE for %s %s\n", fw->data,
1262                                vub300->vub_name);
1263                        strncpy(vub300->vub_name,
1264                                "SDIO interrupt pseudocode download failed",
1265                                sizeof(vub300->vub_name));
1266                        return;
1267                }
1268        } else {
1269                dev_err(&vub300->udev->dev,
1270                        "corrupt interrupt pseudocode in firmware %s %s\n",
1271                        fw->data, vub300->vub_name);
1272                strncpy(vub300->vub_name, "corrupt interrupt pseudocode",
1273                        sizeof(vub300->vub_name));
1274                return;
1275        }
1276        ts += *data++;
1277        size -= 1;
1278        ts <<= 8;
1279        ts += *data++;
1280        size -= 1;
1281        if (ts < size) {
1282                u16 xfer_length = roundup_to_multiple_of_64(ts);
1283                u8 *xfer_buffer = kmalloc(xfer_length, GFP_KERNEL);
1284                if (xfer_buffer) {
1285                        int retval;
1286                        memcpy(xfer_buffer, data, ts);
1287                        memset(xfer_buffer + ts, 0,
1288                               xfer_length - ts);
1289                        size -= ts;
1290                        data += ts;
1291                        retval =
1292                                usb_control_msg(vub300->udev,
1293                                                usb_sndctrlpipe(vub300->udev, 0),
1294                                                SET_TRANSFER_PSEUDOCODE,
1295                                                USB_DIR_OUT | USB_TYPE_VENDOR |
1296                                                USB_RECIP_DEVICE, 0x0000, 0x0000,
1297                                                xfer_buffer, xfer_length, HZ);
1298                        kfree(xfer_buffer);
1299                        if (retval < 0) {
1300                                strncpy(vub300->vub_name,
1301                                        "SDIO pseudocode download failed",
1302                                        sizeof(vub300->vub_name));
1303                                return;
1304                        }
1305                } else {
1306                        dev_err(&vub300->udev->dev,
1307                                "not enough memory for xfer buffer to send"
1308                                " TRANSFER_PSEUDOCODE for %s %s\n", fw->data,
1309                                vub300->vub_name);
1310                        strncpy(vub300->vub_name,
1311                                "SDIO transfer pseudocode download failed",
1312                                sizeof(vub300->vub_name));
1313                        return;
1314                }
1315        } else {
1316                dev_err(&vub300->udev->dev,
1317                        "corrupt transfer pseudocode in firmware %s %s\n",
1318                        fw->data, vub300->vub_name);
1319                strncpy(vub300->vub_name, "corrupt transfer pseudocode",
1320                        sizeof(vub300->vub_name));
1321                return;
1322        }
1323        register_count += *data++;
1324        size -= 1;
1325        if (register_count * 4 == size) {
1326                int I = vub300->dynamic_register_count = register_count;
1327                int i = 0;
1328                while (I--) {
1329                        unsigned int func_num = 0;
1330                        vub300->sdio_register[i].func_num = *data++;
1331                        size -= 1;
1332                        func_num += *data++;
1333                        size -= 1;
1334                        func_num <<= 8;
1335                        func_num += *data++;
1336                        size -= 1;
1337                        func_num <<= 8;
1338                        func_num += *data++;
1339                        size -= 1;
1340                        vub300->sdio_register[i].sdio_reg = func_num;
1341                        vub300->sdio_register[i].activate = 1;
1342                        vub300->sdio_register[i].prepared = 0;
1343                        i += 1;
1344                }
1345                dev_info(&vub300->udev->dev,
1346                         "initialized %d dynamic pseudocode registers\n",
1347                         vub300->dynamic_register_count);
1348                return;
1349        } else {
1350                dev_err(&vub300->udev->dev,
1351                        "corrupt dynamic registers in firmware %s\n",
1352                        vub300->vub_name);
1353                strncpy(vub300->vub_name, "corrupt dynamic registers",
1354                        sizeof(vub300->vub_name));
1355                return;
1356        }
1357}
1358
1359/*
1360 * if the binary containing the EMPTY PseudoCode can not be found
1361 * vub300->vub_name is set anyway in order to prevent an automatic retry
1362 */
1363static void download_offload_pseudocode(struct vub300_mmc_host *vub300)
1364{
1365        struct mmc_card *card = vub300->mmc->card;
1366        int sdio_funcs = card->sdio_funcs;
1367        const struct firmware *fw = NULL;
1368        int l = snprintf(vub300->vub_name, sizeof(vub300->vub_name),
1369                         "vub_%04X%04X", card->cis.vendor, card->cis.device);
1370        int n = 0;
1371        int retval;
1372        for (n = 0; n < sdio_funcs; n++) {
1373                struct sdio_func *sf = card->sdio_func[n];
1374                l += snprintf(vub300->vub_name + l,
1375                              sizeof(vub300->vub_name) - l, "_%04X%04X",
1376                              sf->vendor, sf->device);
1377        };
1378        snprintf(vub300->vub_name + l, sizeof(vub300->vub_name) - l, ".bin");
1379        dev_info(&vub300->udev->dev, "requesting offload firmware %s\n",
1380                 vub300->vub_name);
1381        retval = request_firmware(&fw, vub300->vub_name, &card->dev);
1382        if (retval < 0) {
1383                strncpy(vub300->vub_name, "vub_default.bin",
1384                        sizeof(vub300->vub_name));
1385                retval = request_firmware(&fw, vub300->vub_name, &card->dev);
1386                if (retval < 0) {
1387                        strncpy(vub300->vub_name,
1388                                "no SDIO offload firmware found",
1389                                sizeof(vub300->vub_name));
1390                } else {
1391                        __download_offload_pseudocode(vub300, fw);
1392                        release_firmware(fw);
1393                }
1394        } else {
1395                __download_offload_pseudocode(vub300, fw);
1396                release_firmware(fw);
1397        }
1398}
1399
1400static void vub300_usb_bulk_msg_completion(struct urb *urb)
1401{                               /* urb completion handler - hardirq */
1402        complete((struct completion *)urb->context);
1403}
1404
1405static int vub300_usb_bulk_msg(struct vub300_mmc_host *vub300,
1406                               unsigned int pipe, void *data, int len,
1407                               int *actual_length, int timeout_msecs)
1408{
1409        /* cmd_mutex is held by vub300_cmndwork_thread */
1410        struct usb_device *usb_dev = vub300->udev;
1411        struct completion done;
1412        int retval;
1413        vub300->urb = usb_alloc_urb(0, GFP_KERNEL);
1414        if (!vub300->urb)
1415                return -ENOMEM;
1416        usb_fill_bulk_urb(vub300->urb, usb_dev, pipe, data, len,
1417                          vub300_usb_bulk_msg_completion, NULL);
1418        init_completion(&done);
1419        vub300->urb->context = &done;
1420        vub300->urb->actual_length = 0;
1421        retval = usb_submit_urb(vub300->urb, GFP_KERNEL);
1422        if (unlikely(retval))
1423                goto out;
1424        if (!wait_for_completion_timeout
1425            (&done, msecs_to_jiffies(timeout_msecs))) {
1426                retval = -ETIMEDOUT;
1427                usb_kill_urb(vub300->urb);
1428        } else {
1429                retval = vub300->urb->status;
1430        }
1431out:
1432        *actual_length = vub300->urb->actual_length;
1433        usb_free_urb(vub300->urb);
1434        vub300->urb = NULL;
1435        return retval;
1436}
1437
1438static int __command_read_data(struct vub300_mmc_host *vub300,
1439                               struct mmc_command *cmd, struct mmc_data *data)
1440{
1441        /* cmd_mutex is held by vub300_cmndwork_thread */
1442        int linear_length = vub300->datasize;
1443        int padded_length = vub300->large_usb_packets ?
1444                ((511 + linear_length) >> 9) << 9 :
1445                ((63 + linear_length) >> 6) << 6;
1446        if ((padded_length == linear_length) || !pad_input_to_usb_pkt) {
1447                int result;
1448                unsigned pipe;
1449                pipe = usb_rcvbulkpipe(vub300->udev, vub300->data_inp_ep);
1450                result = usb_sg_init(&vub300->sg_request, vub300->udev,
1451                                     pipe, 0, data->sg,
1452                                     data->sg_len, 0, GFP_KERNEL);
1453                if (result < 0) {
1454                        usb_unlink_urb(vub300->command_out_urb);
1455                        usb_unlink_urb(vub300->command_res_urb);
1456                        cmd->error = result;
1457                        data->bytes_xfered = 0;
1458                        return 0;
1459                } else {
1460                        vub300->sg_transfer_timer.expires =
1461                                jiffies + msecs_to_jiffies(2000 +
1462                                                  (linear_length / 16384));
1463                        add_timer(&vub300->sg_transfer_timer);
1464                        usb_sg_wait(&vub300->sg_request);
1465                        del_timer(&vub300->sg_transfer_timer);
1466                        if (vub300->sg_request.status < 0) {
1467                                cmd->error = vub300->sg_request.status;
1468                                data->bytes_xfered = 0;
1469                                return 0;
1470                        } else {
1471                                data->bytes_xfered = vub300->datasize;
1472                                return linear_length;
1473                        }
1474                }
1475        } else {
1476                u8 *buf = kmalloc(padded_length, GFP_KERNEL);
1477                if (buf) {
1478                        int result;
1479                        unsigned pipe = usb_rcvbulkpipe(vub300->udev,
1480                                                        vub300->data_inp_ep);
1481                        int actual_length = 0;
1482                        result = vub300_usb_bulk_msg(vub300, pipe, buf,
1483                                             padded_length, &actual_length,
1484                                             2000 + (padded_length / 16384));
1485                        if (result < 0) {
1486                                cmd->error = result;
1487                                data->bytes_xfered = 0;
1488                                kfree(buf);
1489                                return 0;
1490                        } else if (actual_length < linear_length) {
1491                                cmd->error = -EREMOTEIO;
1492                                data->bytes_xfered = 0;
1493                                kfree(buf);
1494                                return 0;
1495                        } else {
1496                                sg_copy_from_buffer(data->sg, data->sg_len, buf,
1497                                                    linear_length);
1498                                kfree(buf);
1499                                data->bytes_xfered = vub300->datasize;
1500                                return linear_length;
1501                        }
1502                } else {
1503                        cmd->error = -ENOMEM;
1504                        data->bytes_xfered = 0;
1505                        return 0;
1506                }
1507        }
1508}
1509
1510static int __command_write_data(struct vub300_mmc_host *vub300,
1511                                struct mmc_command *cmd, struct mmc_data *data)
1512{
1513        /* cmd_mutex is held by vub300_cmndwork_thread */
1514        unsigned pipe = usb_sndbulkpipe(vub300->udev, vub300->data_out_ep);
1515        int linear_length = vub300->datasize;
1516        int modulo_64_length = linear_length & 0x003F;
1517        int modulo_512_length = linear_length & 0x01FF;
1518        if (linear_length < 64) {
1519                int result;
1520                int actual_length;
1521                sg_copy_to_buffer(data->sg, data->sg_len,
1522                                  vub300->padded_buffer,
1523                                  sizeof(vub300->padded_buffer));
1524                memset(vub300->padded_buffer + linear_length, 0,
1525                       sizeof(vub300->padded_buffer) - linear_length);
1526                result = vub300_usb_bulk_msg(vub300, pipe, vub300->padded_buffer,
1527                                             sizeof(vub300->padded_buffer),
1528                                             &actual_length, 2000 +
1529                                             (sizeof(vub300->padded_buffer) /
1530                                              16384));
1531                if (result < 0) {
1532                        cmd->error = result;
1533                        data->bytes_xfered = 0;
1534                } else {
1535                        data->bytes_xfered = vub300->datasize;
1536                }
1537        } else if ((!vub300->large_usb_packets && (0 < modulo_64_length)) ||
1538                    (vub300->large_usb_packets && (64 > modulo_512_length))
1539                ) {             /* don't you just love these work-rounds */
1540                int padded_length = ((63 + linear_length) >> 6) << 6;
1541                u8 *buf = kmalloc(padded_length, GFP_KERNEL);
1542                if (buf) {
1543                        int result;
1544                        int actual_length;
1545                        sg_copy_to_buffer(data->sg, data->sg_len, buf,
1546                                          padded_length);
1547                        memset(buf + linear_length, 0,
1548                               padded_length - linear_length);
1549                        result =
1550                                vub300_usb_bulk_msg(vub300, pipe, buf,
1551                                                    padded_length, &actual_length,
1552                                                    2000 + padded_length / 16384);
1553                        kfree(buf);
1554                        if (result < 0) {
1555                                cmd->error = result;
1556                                data->bytes_xfered = 0;
1557                        } else {
1558                                data->bytes_xfered = vub300->datasize;
1559                        }
1560                } else {
1561                        cmd->error = -ENOMEM;
1562                        data->bytes_xfered = 0;
1563                }
1564        } else {                /* no data padding required */
1565                int result;
1566                unsigned char buf[64 * 4];
1567                sg_copy_to_buffer(data->sg, data->sg_len, buf, sizeof(buf));
1568                result = usb_sg_init(&vub300->sg_request, vub300->udev,
1569                                     pipe, 0, data->sg,
1570                                     data->sg_len, 0, GFP_KERNEL);
1571                if (result < 0) {
1572                        usb_unlink_urb(vub300->command_out_urb);
1573                        usb_unlink_urb(vub300->command_res_urb);
1574                        cmd->error = result;
1575                        data->bytes_xfered = 0;
1576                } else {
1577                        vub300->sg_transfer_timer.expires =
1578                                jiffies + msecs_to_jiffies(2000 +
1579                                                           linear_length / 16384);
1580                        add_timer(&vub300->sg_transfer_timer);
1581                        usb_sg_wait(&vub300->sg_request);
1582                        if (cmd->error) {
1583                                data->bytes_xfered = 0;
1584                        } else {
1585                                del_timer(&vub300->sg_transfer_timer);
1586                                if (vub300->sg_request.status < 0) {
1587                                        cmd->error = vub300->sg_request.status;
1588                                        data->bytes_xfered = 0;
1589                                } else {
1590                                        data->bytes_xfered = vub300->datasize;
1591                                }
1592                        }
1593                }
1594        }
1595        return linear_length;
1596}
1597
1598static void __vub300_command_response(struct vub300_mmc_host *vub300,
1599                                      struct mmc_command *cmd,
1600                                      struct mmc_data *data, int data_length)
1601{
1602        /* cmd_mutex is held by vub300_cmndwork_thread */
1603        long respretval;
1604        int msec_timeout = 1000 + data_length / 4;
1605        respretval =
1606                wait_for_completion_timeout(&vub300->command_complete,
1607                                            msecs_to_jiffies(msec_timeout));
1608        if (respretval == 0) { /* TIMED OUT */
1609                /* we don't know which of "out" and "res" if any failed */
1610                int result;
1611                vub300->usb_timed_out = 1;
1612                usb_kill_urb(vub300->command_out_urb);
1613                usb_kill_urb(vub300->command_res_urb);
1614                cmd->error = -ETIMEDOUT;
1615                result = usb_lock_device_for_reset(vub300->udev,
1616                                                   vub300->interface);
1617                if (result == 0) {
1618                        result = usb_reset_device(vub300->udev);
1619                        usb_unlock_device(vub300->udev);
1620                }
1621        } else if (respretval < 0) {
1622                /* we don't know which of "out" and "res" if any failed */
1623                usb_kill_urb(vub300->command_out_urb);
1624                usb_kill_urb(vub300->command_res_urb);
1625                cmd->error = respretval;
1626        } else if (cmd->error) {
1627                /*
1628                 * the error occurred sending the command
1629                 * or receiving the response
1630                 */
1631        } else if (vub300->command_out_urb->status) {
1632                vub300->usb_transport_fail = vub300->command_out_urb->status;
1633                cmd->error = -EPROTO == vub300->command_out_urb->status ?
1634                        -ESHUTDOWN : vub300->command_out_urb->status;
1635        } else if (vub300->command_res_urb->status) {
1636                vub300->usb_transport_fail = vub300->command_res_urb->status;
1637                cmd->error = -EPROTO == vub300->command_res_urb->status ?
1638                        -ESHUTDOWN : vub300->command_res_urb->status;
1639        } else if (vub300->resp.common.header_type == 0x00) {
1640                /*
1641                 * the command completed successfully
1642                 * and there was no piggybacked data
1643                 */
1644        } else if (vub300->resp.common.header_type == RESPONSE_ERROR) {
1645                cmd->error =
1646                        vub300_response_error(vub300->resp.error.error_code);
1647                if (vub300->data)
1648                        usb_sg_cancel(&vub300->sg_request);
1649        } else if (vub300->resp.common.header_type == RESPONSE_PIGGYBACKED) {
1650                int offloaded_data_length =
1651                        vub300->resp.common.header_size -
1652                        sizeof(struct sd_register_header);
1653                int register_count = offloaded_data_length >> 3;
1654                int ri = 0;
1655                while (register_count--) {
1656                        add_offloaded_reg(vub300, &vub300->resp.pig.reg[ri]);
1657                        ri += 1;
1658                }
1659                vub300->resp.common.header_size =
1660                        sizeof(struct sd_register_header);
1661                vub300->resp.common.header_type = 0x00;
1662                cmd->error = 0;
1663        } else if (vub300->resp.common.header_type == RESPONSE_PIG_DISABLED) {
1664                int offloaded_data_length =
1665                        vub300->resp.common.header_size -
1666                        sizeof(struct sd_register_header);
1667                int register_count = offloaded_data_length >> 3;
1668                int ri = 0;
1669                while (register_count--) {
1670                        add_offloaded_reg(vub300, &vub300->resp.pig.reg[ri]);
1671                        ri += 1;
1672                }
1673                mutex_lock(&vub300->irq_mutex);
1674                if (vub300->irqs_queued) {
1675                        vub300->irqs_queued += 1;
1676                } else if (vub300->irq_enabled) {
1677                        vub300->irqs_queued += 1;
1678                        vub300_queue_poll_work(vub300, 0);
1679                } else {
1680                        vub300->irqs_queued += 1;
1681                }
1682                vub300->irq_disabled = 1;
1683                mutex_unlock(&vub300->irq_mutex);
1684                vub300->resp.common.header_size =
1685                        sizeof(struct sd_register_header);
1686                vub300->resp.common.header_type = 0x00;
1687                cmd->error = 0;
1688        } else if (vub300->resp.common.header_type == RESPONSE_PIG_ENABLED) {
1689                int offloaded_data_length =
1690                        vub300->resp.common.header_size -
1691                        sizeof(struct sd_register_header);
1692                int register_count = offloaded_data_length >> 3;
1693                int ri = 0;
1694                while (register_count--) {
1695                        add_offloaded_reg(vub300, &vub300->resp.pig.reg[ri]);
1696                        ri += 1;
1697                }
1698                mutex_lock(&vub300->irq_mutex);
1699                if (vub300->irqs_queued) {
1700                        vub300->irqs_queued += 1;
1701                } else if (vub300->irq_enabled) {
1702                        vub300->irqs_queued += 1;
1703                        vub300_queue_poll_work(vub300, 0);
1704                } else {
1705                        vub300->irqs_queued += 1;
1706                }
1707                vub300->irq_disabled = 0;
1708                mutex_unlock(&vub300->irq_mutex);
1709                vub300->resp.common.header_size =
1710                        sizeof(struct sd_register_header);
1711                vub300->resp.common.header_type = 0x00;
1712                cmd->error = 0;
1713        } else {
1714                cmd->error = -EINVAL;
1715        }
1716}
1717
1718static void construct_request_response(struct vub300_mmc_host *vub300,
1719                                       struct mmc_command *cmd)
1720{
1721        int resp_len = vub300->resp_len;
1722        int less_cmd = (17 == resp_len) ? resp_len : resp_len - 1;
1723        int bytes = 3 & less_cmd;
1724        int words = less_cmd >> 2;
1725        u8 *r = vub300->resp.response.command_response;
1726        if (bytes == 3) {
1727                cmd->resp[words] = (r[1 + (words << 2)] << 24)
1728                        | (r[2 + (words << 2)] << 16)
1729                        | (r[3 + (words << 2)] << 8);
1730        } else if (bytes == 2) {
1731                cmd->resp[words] = (r[1 + (words << 2)] << 24)
1732                        | (r[2 + (words << 2)] << 16);
1733        } else if (bytes == 1) {
1734                cmd->resp[words] = (r[1 + (words << 2)] << 24);
1735        }
1736        while (words-- > 0) {
1737                cmd->resp[words] = (r[1 + (words << 2)] << 24)
1738                        | (r[2 + (words << 2)] << 16)
1739                        | (r[3 + (words << 2)] << 8)
1740                        | (r[4 + (words << 2)] << 0);
1741        }
1742        if ((cmd->opcode == 53) && (0x000000FF & cmd->resp[0]))
1743                cmd->resp[0] &= 0xFFFFFF00;
1744}
1745
1746/* this thread runs only when there is an upper level command req outstanding */
1747static void vub300_cmndwork_thread(struct work_struct *work)
1748{
1749        struct vub300_mmc_host *vub300 =
1750                container_of(work, struct vub300_mmc_host, cmndwork);
1751        if (!vub300->interface) {
1752                kref_put(&vub300->kref, vub300_delete);
1753                return;
1754        } else {
1755                struct mmc_request *req = vub300->req;
1756                struct mmc_command *cmd = vub300->cmd;
1757                struct mmc_data *data = vub300->data;
1758                int data_length;
1759                mutex_lock(&vub300->cmd_mutex);
1760                init_completion(&vub300->command_complete);
1761                if (likely(vub300->vub_name[0]) || !vub300->mmc->card ||
1762                    !mmc_card_present(vub300->mmc->card)) {
1763                        /*
1764                         * the name of the EMPTY Pseudo firmware file
1765                         * is used as a flag to indicate that the file
1766                         * has been already downloaded to the VUB300 chip
1767                         */
1768                } else if (0 == vub300->mmc->card->sdio_funcs) {
1769                        strncpy(vub300->vub_name, "SD memory device",
1770                                sizeof(vub300->vub_name));
1771                } else {
1772                        download_offload_pseudocode(vub300);
1773                }
1774                send_command(vub300);
1775                if (!data)
1776                        data_length = 0;
1777                else if (MMC_DATA_READ & data->flags)
1778                        data_length = __command_read_data(vub300, cmd, data);
1779                else
1780                        data_length = __command_write_data(vub300, cmd, data);
1781                __vub300_command_response(vub300, cmd, data, data_length);
1782                vub300->req = NULL;
1783                vub300->cmd = NULL;
1784                vub300->data = NULL;
1785                if (cmd->error) {
1786                        if (cmd->error == -ENOMEDIUM)
1787                                check_vub300_port_status(vub300);
1788                        mutex_unlock(&vub300->cmd_mutex);
1789                        mmc_request_done(vub300->mmc, req);
1790                        kref_put(&vub300->kref, vub300_delete);
1791                        return;
1792                } else {
1793                        construct_request_response(vub300, cmd);
1794                        vub300->resp_len = 0;
1795                        mutex_unlock(&vub300->cmd_mutex);
1796                        kref_put(&vub300->kref, vub300_delete);
1797                        mmc_request_done(vub300->mmc, req);
1798                        return;
1799                }
1800        }
1801}
1802
1803static int examine_cyclic_buffer(struct vub300_mmc_host *vub300,
1804                                 struct mmc_command *cmd, u8 Function)
1805{
1806        /* cmd_mutex is held by vub300_mmc_request */
1807        u8 cmd0 = 0xFF & (cmd->arg >> 24);
1808        u8 cmd1 = 0xFF & (cmd->arg >> 16);
1809        u8 cmd2 = 0xFF & (cmd->arg >> 8);
1810        u8 cmd3 = 0xFF & (cmd->arg >> 0);
1811        int first = MAXREGMASK & vub300->fn[Function].offload_point;
1812        struct offload_registers_access *rf = &vub300->fn[Function].reg[first];
1813        if (cmd0 == rf->command_byte[0] &&
1814            cmd1 == rf->command_byte[1] &&
1815            cmd2 == rf->command_byte[2] &&
1816            cmd3 == rf->command_byte[3]) {
1817                u8 checksum = 0x00;
1818                cmd->resp[1] = checksum << 24;
1819                cmd->resp[0] = (rf->Respond_Byte[0] << 24)
1820                        | (rf->Respond_Byte[1] << 16)
1821                        | (rf->Respond_Byte[2] << 8)
1822                        | (rf->Respond_Byte[3] << 0);
1823                vub300->fn[Function].offload_point += 1;
1824                vub300->fn[Function].offload_count -= 1;
1825                vub300->total_offload_count -= 1;
1826                return 1;
1827        } else {
1828                int delta = 1;  /* because it does not match the first one */
1829                u8 register_count = vub300->fn[Function].offload_count - 1;
1830                u32 register_point = vub300->fn[Function].offload_point + 1;
1831                while (0 < register_count) {
1832                        int point = MAXREGMASK & register_point;
1833                        struct offload_registers_access *r =
1834                                &vub300->fn[Function].reg[point];
1835                        if (cmd0 == r->command_byte[0] &&
1836                            cmd1 == r->command_byte[1] &&
1837                            cmd2 == r->command_byte[2] &&
1838                            cmd3 == r->command_byte[3]) {
1839                                u8 checksum = 0x00;
1840                                cmd->resp[1] = checksum << 24;
1841                                cmd->resp[0] = (r->Respond_Byte[0] << 24)
1842                                        | (r->Respond_Byte[1] << 16)
1843                                        | (r->Respond_Byte[2] << 8)
1844                                        | (r->Respond_Byte[3] << 0);
1845                                vub300->fn[Function].offload_point += delta;
1846                                vub300->fn[Function].offload_count -= delta;
1847                                vub300->total_offload_count -= delta;
1848                                return 1;
1849                        } else {
1850                                register_point += 1;
1851                                register_count -= 1;
1852                                delta += 1;
1853                                continue;
1854                        }
1855                }
1856                return 0;
1857        }
1858}
1859
1860static int satisfy_request_from_offloaded_data(struct vub300_mmc_host *vub300,
1861                                               struct mmc_command *cmd)
1862{
1863        /* cmd_mutex is held by vub300_mmc_request */
1864        u8 regs = vub300->dynamic_register_count;
1865        u8 i = 0;
1866        u8 func = FUN(cmd);
1867        u32 reg = REG(cmd);
1868        while (0 < regs--) {
1869                if ((vub300->sdio_register[i].func_num == func) &&
1870                    (vub300->sdio_register[i].sdio_reg == reg)) {
1871                        if (!vub300->sdio_register[i].prepared) {
1872                                return 0;
1873                        } else if ((0x80000000 & cmd->arg) == 0x80000000) {
1874                                /*
1875                                 * a write to a dynamic register
1876                                 * nullifies our offloaded value
1877                                 */
1878                                vub300->sdio_register[i].prepared = 0;
1879                                return 0;
1880                        } else {
1881                                u8 checksum = 0x00;
1882                                u8 rsp0 = 0x00;
1883                                u8 rsp1 = 0x00;
1884                                u8 rsp2 = vub300->sdio_register[i].response;
1885                                u8 rsp3 = vub300->sdio_register[i].regvalue;
1886                                vub300->sdio_register[i].prepared = 0;
1887                                cmd->resp[1] = checksum << 24;
1888                                cmd->resp[0] = (rsp0 << 24)
1889                                        | (rsp1 << 16)
1890                                        | (rsp2 << 8)
1891                                        | (rsp3 << 0);
1892                                return 1;
1893                        }
1894                } else {
1895                        i += 1;
1896                        continue;
1897                }
1898        };
1899        if (vub300->total_offload_count == 0)
1900                return 0;
1901        else if (vub300->fn[func].offload_count == 0)
1902                return 0;
1903        else
1904                return examine_cyclic_buffer(vub300, cmd, func);
1905}
1906
1907static void vub300_mmc_request(struct mmc_host *mmc, struct mmc_request *req)
1908{                               /* NOT irq */
1909        struct mmc_command *cmd = req->cmd;
1910        struct vub300_mmc_host *vub300 = mmc_priv(mmc);
1911        if (!vub300->interface) {
1912                cmd->error = -ESHUTDOWN;
1913                mmc_request_done(mmc, req);
1914                return;
1915        } else {
1916                struct mmc_data *data = req->data;
1917                if (!vub300->card_powered) {
1918                        cmd->error = -ENOMEDIUM;
1919                        mmc_request_done(mmc, req);
1920                        return;
1921                }
1922                if (!vub300->card_present) {
1923                        cmd->error = -ENOMEDIUM;
1924                        mmc_request_done(mmc, req);
1925                        return;
1926                }
1927                if (vub300->usb_transport_fail) {
1928                        cmd->error = vub300->usb_transport_fail;
1929                        mmc_request_done(mmc, req);
1930                        return;
1931                }
1932                if (!vub300->interface) {
1933                        cmd->error = -ENODEV;
1934                        mmc_request_done(mmc, req);
1935                        return;
1936                }
1937                kref_get(&vub300->kref);
1938                mutex_lock(&vub300->cmd_mutex);
1939                mod_timer(&vub300->inactivity_timer, jiffies + HZ);
1940                /*
1941                 * for performance we have to return immediately
1942                 * if the requested data has been offloaded
1943                 */
1944                if (cmd->opcode == 52 &&
1945                    satisfy_request_from_offloaded_data(vub300, cmd)) {
1946                        cmd->error = 0;
1947                        mutex_unlock(&vub300->cmd_mutex);
1948                        kref_put(&vub300->kref, vub300_delete);
1949                        mmc_request_done(mmc, req);
1950                        return;
1951                } else {
1952                        vub300->cmd = cmd;
1953                        vub300->req = req;
1954                        vub300->data = data;
1955                        if (data)
1956                                vub300->datasize = data->blksz * data->blocks;
1957                        else
1958                                vub300->datasize = 0;
1959                        vub300_queue_cmnd_work(vub300);
1960                        mutex_unlock(&vub300->cmd_mutex);
1961                        kref_put(&vub300->kref, vub300_delete);
1962                        /*
1963                         * the kernel lock diagnostics complain
1964                         * if the cmd_mutex * is "passed on"
1965                         * to the cmndwork thread,
1966                         * so we must release it now
1967                         * and re-acquire it in the cmndwork thread
1968                         */
1969                }
1970        }
1971}
1972
1973static void __set_clock_speed(struct vub300_mmc_host *vub300, u8 buf[8],
1974                              struct mmc_ios *ios)
1975{
1976        int buf_array_size = 8; /* ARRAY_SIZE(buf) does not work !!! */
1977        int retval;
1978        u32 kHzClock;
1979        if (ios->clock >= 48000000)
1980                kHzClock = 48000;
1981        else if (ios->clock >= 24000000)
1982                kHzClock = 24000;
1983        else if (ios->clock >= 20000000)
1984                kHzClock = 20000;
1985        else if (ios->clock >= 15000000)
1986                kHzClock = 15000;
1987        else if (ios->clock >= 200000)
1988                kHzClock = 200;
1989        else
1990                kHzClock = 0;
1991        {
1992                int i;
1993                u64 c = kHzClock;
1994                for (i = 0; i < buf_array_size; i++) {
1995                        buf[i] = c;
1996                        c >>= 8;
1997                }
1998        }
1999        retval =
2000                usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
2001                                SET_CLOCK_SPEED,
2002                                USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2003                                0x00, 0x00, buf, buf_array_size, HZ);
2004        if (retval != 8) {
2005                dev_err(&vub300->udev->dev, "SET_CLOCK_SPEED"
2006                        " %dkHz failed with retval=%d\n", kHzClock, retval);
2007        } else {
2008                dev_dbg(&vub300->udev->dev, "SET_CLOCK_SPEED"
2009                        " %dkHz\n", kHzClock);
2010        }
2011}
2012
2013static void vub300_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
2014{                               /* NOT irq */
2015        struct vub300_mmc_host *vub300 = mmc_priv(mmc);
2016        if (!vub300->interface)
2017                return;
2018        kref_get(&vub300->kref);
2019        mutex_lock(&vub300->cmd_mutex);
2020        if ((ios->power_mode == MMC_POWER_OFF) && vub300->card_powered) {
2021                vub300->card_powered = 0;
2022                usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
2023                                SET_SD_POWER,
2024                                USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2025                                0x0000, 0x0000, NULL, 0, HZ);
2026                /* must wait for the VUB300 u-proc to boot up */
2027                msleep(600);
2028        } else if ((ios->power_mode == MMC_POWER_UP) && !vub300->card_powered) {
2029                usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
2030                                SET_SD_POWER,
2031                                USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2032                                0x0001, 0x0000, NULL, 0, HZ);
2033                msleep(600);
2034                vub300->card_powered = 1;
2035        } else if (ios->power_mode == MMC_POWER_ON) {
2036                u8 *buf = kmalloc(8, GFP_KERNEL);
2037                if (buf) {
2038                        __set_clock_speed(vub300, buf, ios);
2039                        kfree(buf);
2040                }
2041        } else {
2042                /* this should mean no change of state */
2043        }
2044        mutex_unlock(&vub300->cmd_mutex);
2045        kref_put(&vub300->kref, vub300_delete);
2046}
2047
2048static int vub300_mmc_get_ro(struct mmc_host *mmc)
2049{
2050        struct vub300_mmc_host *vub300 = mmc_priv(mmc);
2051        return vub300->read_only;
2052}
2053
2054static void vub300_enable_sdio_irq(struct mmc_host *mmc, int enable)
2055{                               /* NOT irq */
2056        struct vub300_mmc_host *vub300 = mmc_priv(mmc);
2057        if (!vub300->interface)
2058                return;
2059        kref_get(&vub300->kref);
2060        if (enable) {
2061                mutex_lock(&vub300->irq_mutex);
2062                if (vub300->irqs_queued) {
2063                        vub300->irqs_queued -= 1;
2064                        mmc_signal_sdio_irq(vub300->mmc);
2065                } else if (vub300->irq_disabled) {
2066                        vub300->irq_disabled = 0;
2067                        vub300->irq_enabled = 1;
2068                        vub300_queue_poll_work(vub300, 0);
2069                } else if (vub300->irq_enabled) {
2070                        /* this should not happen, so we will just ignore it */
2071                } else {
2072                        vub300->irq_enabled = 1;
2073                        vub300_queue_poll_work(vub300, 0);
2074                }
2075                mutex_unlock(&vub300->irq_mutex);
2076        } else {
2077                vub300->irq_enabled = 0;
2078        }
2079        kref_put(&vub300->kref, vub300_delete);
2080}
2081
2082void vub300_init_card(struct mmc_host *mmc, struct mmc_card *card)
2083{                               /* NOT irq */
2084        struct vub300_mmc_host *vub300 = mmc_priv(mmc);
2085        dev_info(&vub300->udev->dev, "NO host QUIRKS for this card\n");
2086}
2087
2088static struct mmc_host_ops vub300_mmc_ops = {
2089        .request = vub300_mmc_request,
2090        .set_ios = vub300_mmc_set_ios,
2091        .get_ro = vub300_mmc_get_ro,
2092        .enable_sdio_irq = vub300_enable_sdio_irq,
2093        .init_card = vub300_init_card,
2094};
2095
2096static int vub300_probe(struct usb_interface *interface,
2097                        const struct usb_device_id *id)
2098{                               /* NOT irq */
2099        struct vub300_mmc_host *vub300;
2100        struct usb_host_interface *iface_desc;
2101        struct usb_device *udev = usb_get_dev(interface_to_usbdev(interface));
2102        int i;
2103        int retval = -ENOMEM;
2104        struct urb *command_out_urb;
2105        struct urb *command_res_urb;
2106        struct mmc_host *mmc;
2107        char manufacturer[48];
2108        char product[32];
2109        char serial_number[32];
2110        usb_string(udev, udev->descriptor.iManufacturer, manufacturer,
2111                   sizeof(manufacturer));
2112        usb_string(udev, udev->descriptor.iProduct, product, sizeof(product));
2113        usb_string(udev, udev->descriptor.iSerialNumber, serial_number,
2114                   sizeof(serial_number));
2115        dev_info(&udev->dev, "probing VID:PID(%04X:%04X) %s %s %s\n",
2116                 udev->descriptor.idVendor, udev->descriptor.idProduct,
2117                 manufacturer, product, serial_number);
2118        command_out_urb = usb_alloc_urb(0, GFP_KERNEL);
2119        if (!command_out_urb) {
2120                retval = -ENOMEM;
2121                dev_err(&udev->dev, "not enough memory for command_out_urb\n");
2122                goto error0;
2123        }
2124        command_res_urb = usb_alloc_urb(0, GFP_KERNEL);
2125        if (!command_res_urb) {
2126                retval = -ENOMEM;
2127                dev_err(&udev->dev, "not enough memory for command_res_urb\n");
2128                goto error1;
2129        }
2130        /* this also allocates memory for our VUB300 mmc host device */
2131        mmc = mmc_alloc_host(sizeof(struct vub300_mmc_host), &udev->dev);
2132        if (!mmc) {
2133                retval = -ENOMEM;
2134                dev_err(&udev->dev, "not enough memory for the mmc_host\n");
2135                goto error4;
2136        }
2137        /* MMC core transfer sizes tunable parameters */
2138        mmc->caps = 0;
2139        if (!force_1_bit_data_xfers)
2140                mmc->caps |= MMC_CAP_4_BIT_DATA;
2141        if (!force_polling_for_irqs)
2142                mmc->caps |= MMC_CAP_SDIO_IRQ;
2143        mmc->caps &= ~MMC_CAP_NEEDS_POLL;
2144        /*
2145         * MMC_CAP_NEEDS_POLL causes core.c:mmc_rescan() to poll
2146         * for devices which results in spurious CMD7's being
2147         * issued which stops some SDIO cards from working
2148         */
2149        if (limit_speed_to_24_MHz) {
2150                mmc->caps |= MMC_CAP_MMC_HIGHSPEED;
2151                mmc->caps |= MMC_CAP_SD_HIGHSPEED;
2152                mmc->f_max = 24000000;
2153                dev_info(&udev->dev, "limiting SDIO speed to 24_MHz\n");
2154        } else {
2155                mmc->caps |= MMC_CAP_MMC_HIGHSPEED;
2156                mmc->caps |= MMC_CAP_SD_HIGHSPEED;
2157                mmc->f_max = 48000000;
2158        }
2159        mmc->f_min = 200000;
2160        mmc->max_blk_count = 511;
2161        mmc->max_blk_size = 512;
2162        mmc->max_segs = 128;
2163        if (force_max_req_size)
2164                mmc->max_req_size = force_max_req_size * 1024;
2165        else
2166                mmc->max_req_size = 64 * 1024;
2167        mmc->max_seg_size = mmc->max_req_size;
2168        mmc->ocr_avail = 0;
2169        mmc->ocr_avail |= MMC_VDD_165_195;
2170        mmc->ocr_avail |= MMC_VDD_20_21;
2171        mmc->ocr_avail |= MMC_VDD_21_22;
2172        mmc->ocr_avail |= MMC_VDD_22_23;
2173        mmc->ocr_avail |= MMC_VDD_23_24;
2174        mmc->ocr_avail |= MMC_VDD_24_25;
2175        mmc->ocr_avail |= MMC_VDD_25_26;
2176        mmc->ocr_avail |= MMC_VDD_26_27;
2177        mmc->ocr_avail |= MMC_VDD_27_28;
2178        mmc->ocr_avail |= MMC_VDD_28_29;
2179        mmc->ocr_avail |= MMC_VDD_29_30;
2180        mmc->ocr_avail |= MMC_VDD_30_31;
2181        mmc->ocr_avail |= MMC_VDD_31_32;
2182        mmc->ocr_avail |= MMC_VDD_32_33;
2183        mmc->ocr_avail |= MMC_VDD_33_34;
2184        mmc->ocr_avail |= MMC_VDD_34_35;
2185        mmc->ocr_avail |= MMC_VDD_35_36;
2186        mmc->ops = &vub300_mmc_ops;
2187        vub300 = mmc_priv(mmc);
2188        vub300->mmc = mmc;
2189        vub300->card_powered = 0;
2190        vub300->bus_width = 0;
2191        vub300->cmnd.head.block_size[0] = 0x00;
2192        vub300->cmnd.head.block_size[1] = 0x00;
2193        vub300->app_spec = 0;
2194        mutex_init(&vub300->cmd_mutex);
2195        mutex_init(&vub300->irq_mutex);
2196        vub300->command_out_urb = command_out_urb;
2197        vub300->command_res_urb = command_res_urb;
2198        vub300->usb_timed_out = 0;
2199        vub300->dynamic_register_count = 0;
2200
2201        for (i = 0; i < ARRAY_SIZE(vub300->fn); i++) {
2202                vub300->fn[i].offload_point = 0;
2203                vub300->fn[i].offload_count = 0;
2204        }
2205
2206        vub300->total_offload_count = 0;
2207        vub300->irq_enabled = 0;
2208        vub300->irq_disabled = 0;
2209        vub300->irqs_queued = 0;
2210
2211        for (i = 0; i < ARRAY_SIZE(vub300->sdio_register); i++)
2212                vub300->sdio_register[i++].activate = 0;
2213
2214        vub300->udev = udev;
2215        vub300->interface = interface;
2216        vub300->cmnd_res_ep = 0;
2217        vub300->cmnd_out_ep = 0;
2218        vub300->data_inp_ep = 0;
2219        vub300->data_out_ep = 0;
2220
2221        for (i = 0; i < ARRAY_SIZE(vub300->fbs); i++)
2222                vub300->fbs[i] = 512;
2223
2224        /*
2225         *      set up the endpoint information
2226         *
2227         * use the first pair of bulk-in and bulk-out
2228         *     endpoints for Command/Response+Interrupt
2229         *
2230         * use the second pair of bulk-in and bulk-out
2231         *     endpoints for Data In/Out
2232         */
2233        vub300->large_usb_packets = 0;
2234        iface_desc = interface->cur_altsetting;
2235        for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
2236                struct usb_endpoint_descriptor *endpoint =
2237                        &iface_desc->endpoint[i].desc;
2238                dev_info(&vub300->udev->dev,
2239                         "vub300 testing %s EndPoint(%d) %02X\n",
2240                         usb_endpoint_is_bulk_in(endpoint) ? "BULK IN" :
2241                         usb_endpoint_is_bulk_out(endpoint) ? "BULK OUT" :
2242                         "UNKNOWN", i, endpoint->bEndpointAddress);
2243                if (endpoint->wMaxPacketSize > 64)
2244                        vub300->large_usb_packets = 1;
2245                if (usb_endpoint_is_bulk_in(endpoint)) {
2246                        if (!vub300->cmnd_res_ep) {
2247                                vub300->cmnd_res_ep =
2248                                        endpoint->bEndpointAddress;
2249                        } else if (!vub300->data_inp_ep) {
2250                                vub300->data_inp_ep =
2251                                        endpoint->bEndpointAddress;
2252                        } else {
2253                                dev_warn(&vub300->udev->dev,
2254                                         "ignoring"
2255                                         " unexpected bulk_in endpoint");
2256                        }
2257                } else if (usb_endpoint_is_bulk_out(endpoint)) {
2258                        if (!vub300->cmnd_out_ep) {
2259                                vub300->cmnd_out_ep =
2260                                        endpoint->bEndpointAddress;
2261                        } else if (!vub300->data_out_ep) {
2262                                vub300->data_out_ep =
2263                                        endpoint->bEndpointAddress;
2264                        } else {
2265                                dev_warn(&vub300->udev->dev,
2266                                         "ignoring"
2267                                         " unexpected bulk_out endpoint");
2268                        }
2269                } else {
2270                        dev_warn(&vub300->udev->dev,
2271                                 "vub300 ignoring EndPoint(%d) %02X", i,
2272                                 endpoint->bEndpointAddress);
2273                }
2274        }
2275        if (vub300->cmnd_res_ep && vub300->cmnd_out_ep &&
2276            vub300->data_inp_ep && vub300->data_out_ep) {
2277                dev_info(&vub300->udev->dev,
2278                         "vub300 %s packets"
2279                         " using EndPoints %02X %02X %02X %02X\n",
2280                         vub300->large_usb_packets ? "LARGE" : "SMALL",
2281                         vub300->cmnd_out_ep, vub300->cmnd_res_ep,
2282                         vub300->data_out_ep, vub300->data_inp_ep);
2283                /* we have the expected EndPoints */
2284        } else {
2285                dev_err(&vub300->udev->dev,
2286                    "Could not find two sets of bulk-in/out endpoint pairs\n");
2287                retval = -EINVAL;
2288                goto error5;
2289        }
2290        retval =
2291                usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
2292                                GET_HC_INF0,
2293                                USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2294                                0x0000, 0x0000, &vub300->hc_info,
2295                                sizeof(vub300->hc_info), HZ);
2296        if (retval < 0)
2297                goto error5;
2298        retval =
2299                usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
2300                                SET_ROM_WAIT_STATES,
2301                                USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2302                                firmware_rom_wait_states, 0x0000, NULL, 0, HZ);
2303        if (retval < 0)
2304                goto error5;
2305        dev_info(&vub300->udev->dev,
2306                 "operating_mode = %s %s %d MHz %s %d byte USB packets\n",
2307                 (mmc->caps & MMC_CAP_SDIO_IRQ) ? "IRQs" : "POLL",
2308                 (mmc->caps & MMC_CAP_4_BIT_DATA) ? "4-bit" : "1-bit",
2309                 mmc->f_max / 1000000,
2310                 pad_input_to_usb_pkt ? "padding input data to" : "with",
2311                 vub300->large_usb_packets ? 512 : 64);
2312        retval =
2313                usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
2314                                GET_SYSTEM_PORT_STATUS,
2315                                USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2316                                0x0000, 0x0000, &vub300->system_port_status,
2317                                sizeof(vub300->system_port_status), HZ);
2318        if (retval < 0) {
2319                goto error4;
2320        } else if (sizeof(vub300->system_port_status) == retval) {
2321                vub300->card_present =
2322                        (0x0001 & vub300->system_port_status.port_flags) ? 1 : 0;
2323                vub300->read_only =
2324                        (0x0010 & vub300->system_port_status.port_flags) ? 1 : 0;
2325        } else {
2326                goto error4;
2327        }
2328        usb_set_intfdata(interface, vub300);
2329        INIT_DELAYED_WORK(&vub300->pollwork, vub300_pollwork_thread);
2330        INIT_WORK(&vub300->cmndwork, vub300_cmndwork_thread);
2331        INIT_WORK(&vub300->deadwork, vub300_deadwork_thread);
2332        kref_init(&vub300->kref);
2333        init_timer(&vub300->sg_transfer_timer);
2334        vub300->sg_transfer_timer.data = (unsigned long)vub300;
2335        vub300->sg_transfer_timer.function = vub300_sg_timed_out;
2336        kref_get(&vub300->kref);
2337        init_timer(&vub300->inactivity_timer);
2338        vub300->inactivity_timer.data = (unsigned long)vub300;
2339        vub300->inactivity_timer.function = vub300_inactivity_timer_expired;
2340        vub300->inactivity_timer.expires = jiffies + HZ;
2341        add_timer(&vub300->inactivity_timer);
2342        if (vub300->card_present)
2343                dev_info(&vub300->udev->dev,
2344                         "USB vub300 remote SDIO host controller[%d]"
2345                         "connected with SD/SDIO card inserted\n",
2346                         interface_to_InterfaceNumber(interface));
2347        else
2348                dev_info(&vub300->udev->dev,
2349                         "USB vub300 remote SDIO host controller[%d]"
2350                         "connected with no SD/SDIO card inserted\n",
2351                         interface_to_InterfaceNumber(interface));
2352        mmc_add_host(mmc);
2353        return 0;
2354error5:
2355        mmc_free_host(mmc);
2356        /*
2357         * and hence also frees vub300
2358         * which is contained at the end of struct mmc
2359         */
2360error4:
2361        usb_free_urb(command_out_urb);
2362error1:
2363        usb_free_urb(command_res_urb);
2364error0:
2365        return retval;
2366}
2367
2368static void vub300_disconnect(struct usb_interface *interface)
2369{                               /* NOT irq */
2370        struct vub300_mmc_host *vub300 = usb_get_intfdata(interface);
2371        if (!vub300 || !vub300->mmc) {
2372                return;
2373        } else {
2374                struct mmc_host *mmc = vub300->mmc;
2375                if (!vub300->mmc) {
2376                        return;
2377                } else {
2378                        int ifnum = interface_to_InterfaceNumber(interface);
2379                        usb_set_intfdata(interface, NULL);
2380                        /* prevent more I/O from starting */
2381                        vub300->interface = NULL;
2382                        kref_put(&vub300->kref, vub300_delete);
2383                        mmc_remove_host(mmc);
2384                        pr_info("USB vub300 remote SDIO host controller[%d]"
2385                                " now disconnected", ifnum);
2386                        return;
2387                }
2388        }
2389}
2390
2391#ifdef CONFIG_PM
2392static int vub300_suspend(struct usb_interface *intf, pm_message_t message)
2393{
2394        struct vub300_mmc_host *vub300 = usb_get_intfdata(intf);
2395        if (!vub300 || !vub300->mmc) {
2396                return 0;
2397        } else {
2398                struct mmc_host *mmc = vub300->mmc;
2399                mmc_suspend_host(mmc);
2400                return 0;
2401        }
2402}
2403
2404static int vub300_resume(struct usb_interface *intf)
2405{
2406        struct vub300_mmc_host *vub300 = usb_get_intfdata(intf);
2407        if (!vub300 || !vub300->mmc) {
2408                return 0;
2409        } else {
2410                struct mmc_host *mmc = vub300->mmc;
2411                mmc_resume_host(mmc);
2412                return 0;
2413        }
2414}
2415#else
2416#define vub300_suspend NULL
2417#define vub300_resume NULL
2418#endif
2419static int vub300_pre_reset(struct usb_interface *intf)
2420{                               /* NOT irq */
2421        struct vub300_mmc_host *vub300 = usb_get_intfdata(intf);
2422        mutex_lock(&vub300->cmd_mutex);
2423        return 0;
2424}
2425
2426static int vub300_post_reset(struct usb_interface *intf)
2427{                               /* NOT irq */
2428        struct vub300_mmc_host *vub300 = usb_get_intfdata(intf);
2429        /* we are sure no URBs are active - no locking needed */
2430        vub300->errors = -EPIPE;
2431        mutex_unlock(&vub300->cmd_mutex);
2432        return 0;
2433}
2434
2435static struct usb_driver vub300_driver = {
2436        .name = "vub300",
2437        .probe = vub300_probe,
2438        .disconnect = vub300_disconnect,
2439        .suspend = vub300_suspend,
2440        .resume = vub300_resume,
2441        .pre_reset = vub300_pre_reset,
2442        .post_reset = vub300_post_reset,
2443        .id_table = vub300_table,
2444        .supports_autosuspend = 1,
2445};
2446
2447static int __init vub300_init(void)
2448{                               /* NOT irq */
2449        int result;
2450
2451        pr_info("VUB300 Driver rom wait states = %02X irqpoll timeout = %04X",
2452                firmware_rom_wait_states, 0x0FFFF & firmware_irqpoll_timeout);
2453        cmndworkqueue = create_singlethread_workqueue("kvub300c");
2454        if (!cmndworkqueue) {
2455                pr_err("not enough memory for the REQUEST workqueue");
2456                result = -ENOMEM;
2457                goto out1;
2458        }
2459        pollworkqueue = create_singlethread_workqueue("kvub300p");
2460        if (!pollworkqueue) {
2461                pr_err("not enough memory for the IRQPOLL workqueue");
2462                result = -ENOMEM;
2463                goto out2;
2464        }
2465        deadworkqueue = create_singlethread_workqueue("kvub300d");
2466        if (!deadworkqueue) {
2467                pr_err("not enough memory for the EXPIRED workqueue");
2468                result = -ENOMEM;
2469                goto out3;
2470        }
2471        result = usb_register(&vub300_driver);
2472        if (result) {
2473                pr_err("usb_register failed. Error number %d", result);
2474                goto out4;
2475        }
2476        return 0;
2477out4:
2478        destroy_workqueue(deadworkqueue);
2479out3:
2480        destroy_workqueue(pollworkqueue);
2481out2:
2482        destroy_workqueue(cmndworkqueue);
2483out1:
2484        return result;
2485}
2486
2487static void __exit vub300_exit(void)
2488{
2489        usb_deregister(&vub300_driver);
2490        flush_workqueue(cmndworkqueue);
2491        flush_workqueue(pollworkqueue);
2492        flush_workqueue(deadworkqueue);
2493        destroy_workqueue(cmndworkqueue);
2494        destroy_workqueue(pollworkqueue);
2495        destroy_workqueue(deadworkqueue);
2496}
2497
2498module_init(vub300_init);
2499module_exit(vub300_exit);
2500
2501MODULE_AUTHOR("Tony Olech <tony.olech@elandigitalsystems.com>");
2502MODULE_DESCRIPTION("VUB300 USB to SD/MMC/SDIO adapter driver");
2503MODULE_LICENSE("GPL");
2504