mmc/host/vub300.c

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  * Remote VUB300 SDIO/SDmem Host Controller Driver
0004  *
0005  * Copyright (C) 2010 Elan Digital Systems Limited
0006  *
0007  * based on USB Skeleton driver - 2.2
0008  *
0009  * Copyright (C) 2001-2004 Greg Kroah-Hartman (greg@kroah.com)
0010  *
0011  * VUB300: is a USB 2.0 client device with a single SDIO/SDmem/MMC slot
0012  *         Any SDIO/SDmem/MMC device plugged into the VUB300 will appear,
0013  *         by virtue of this driver, to have been plugged into a local
0014  *         SDIO host controller, similar to, say, a PCI Ricoh controller
0015  *         This is because this kernel device driver is both a USB 2.0
0016  *         client device driver AND an MMC host controller driver. Thus
0017  *         if there is an existing driver for the inserted SDIO/SDmem/MMC
0018  *         device then that driver will be used by the kernel to manage
0019  *         the device in exactly the same fashion as if it had been
0020  *         directly plugged into, say, a local pci bus Ricoh controller
0021  *
0022  * RANT: this driver was written using a display 128x48 - converting it
0023  *       to a line width of 80 makes it very difficult to support. In
0024  *       particular functions have been broken down into sub functions
0025  *       and the original meaningful names have been shortened into
0026  *       cryptic ones.
0027  *       The problem is that executing a fragment of code subject to
0028  *       two conditions means an indentation of 24, thus leaving only
0029  *       56 characters for a C statement. And that is quite ridiculous!
0030  *
0031  * Data types: data passed to/from the VUB300 is fixed to a number of
0032  *             bits and driver data fields reflect that limit by using
0033  *             u8, u16, u32
0034  */
0035 #include <linux/kernel.h>
0036 #include <linux/errno.h>
0037 #include <linux/init.h>
0038 #include <linux/slab.h>
0039 #include <linux/module.h>
0040 #include <linux/kref.h>
0041 #include <linux/uaccess.h>
0042 #include <linux/usb.h>
0043 #include <linux/mutex.h>
0044 #include <linux/mmc/host.h>
0045 #include <linux/mmc/card.h>
0046 #include <linux/mmc/sdio_func.h>
0047 #include <linux/mmc/sdio_ids.h>
0048 #include <linux/workqueue.h>
0049 #include <linux/ctype.h>
0050 #include <linux/firmware.h>
0051 #include <linux/scatterlist.h>
0052
0053 struct host_controller_info {
0054     u8 info_size;
0055     u16 firmware_version;
0056     u8 number_of_ports;
0057 } __packed;
0058
0059 #define FIRMWARE_BLOCK_BOUNDARY 1024
0060 struct sd_command_header {
0061     u8 header_size;
0062     u8 header_type;
0063     u8 port_number;
0064     u8 command_type; /* Bit7 - Rd/Wr */
0065     u8 command_index;
0066     u8 transfer_size[4]; /* ReadSize + ReadSize */
0067     u8 response_type;
0068     u8 arguments[4];
0069     u8 block_count[2];
0070     u8 block_size[2];
0071     u8 block_boundary[2];
0072     u8 reserved[44]; /* to pad out to 64 bytes */
0073 } __packed;
0074
0075 struct sd_irqpoll_header {
0076     u8 header_size;
0077     u8 header_type;
0078     u8 port_number;
0079     u8 command_type; /* Bit7 - Rd/Wr */
0080     u8 padding[16]; /* don't ask why !! */
0081     u8 poll_timeout_msb;
0082     u8 poll_timeout_lsb;
0083     u8 reserved[42]; /* to pad out to 64 bytes */
0084 } __packed;
0085
0086 struct sd_common_header {
0087     u8 header_size;
0088     u8 header_type;
0089     u8 port_number;
0090 } __packed;
0091
0092 struct sd_response_header {
0093     u8 header_size;
0094     u8 header_type;
0095     u8 port_number;
0096     u8 command_type;
0097     u8 command_index;
0098     u8 command_response[];
0099 } __packed;
0100
0101 struct sd_status_header {
0102     u8 header_size;
0103     u8 header_type;
0104     u8 port_number;
0105     u16 port_flags;
0106     u32 sdio_clock;
0107     u16 host_header_size;
0108     u16 func_header_size;
0109     u16 ctrl_header_size;
0110 } __packed;
0111
0112 struct sd_error_header {
0113     u8 header_size;
0114     u8 header_type;
0115     u8 port_number;
0116     u8 error_code;
0117 } __packed;
0118
0119 struct sd_interrupt_header {
0120     u8 header_size;
0121     u8 header_type;
0122     u8 port_number;
0123 } __packed;
0124
0125 struct offload_registers_access {
0126     u8 command_byte[4];
0127     u8 Respond_Byte[4];
0128 } __packed;
0129
0130 #define INTERRUPT_REGISTER_ACCESSES 15
0131 struct sd_offloaded_interrupt {
0132     u8 header_size;
0133     u8 header_type;
0134     u8 port_number;
0135     struct offload_registers_access reg[INTERRUPT_REGISTER_ACCESSES];
0136 } __packed;
0137
0138 struct sd_register_header {
0139     u8 header_size;
0140     u8 header_type;
0141     u8 port_number;
0142     u8 command_type;
0143     u8 command_index;
0144     u8 command_response[6];
0145 } __packed;
0146
0147 #define PIGGYBACK_REGISTER_ACCESSES 14
0148 struct sd_offloaded_piggyback {
0149     struct sd_register_header sdio;
0150     struct offload_registers_access reg[PIGGYBACK_REGISTER_ACCESSES];
0151 } __packed;
0152
0153 union sd_response {
0154     struct sd_common_header common;
0155     struct sd_status_header status;
0156     struct sd_error_header error;
0157     struct sd_interrupt_header interrupt;
0158     struct sd_response_header response;
0159     struct sd_offloaded_interrupt irq;
0160     struct sd_offloaded_piggyback pig;
0161 } __packed;
0162
0163 union sd_command {
0164     struct sd_command_header head;
0165     struct sd_irqpoll_header poll;
0166 } __packed;
0167
0168 enum SD_RESPONSE_TYPE {
0169     SDRT_UNSPECIFIED = 0,
0170     SDRT_NONE,
0171     SDRT_1,
0172     SDRT_1B,
0173     SDRT_2,
0174     SDRT_3,
0175     SDRT_4,
0176     SDRT_5,
0177     SDRT_5B,
0178     SDRT_6,
0179     SDRT_7,
0180 };
0181
0182 #define RESPONSE_INTERRUPT          0x01
0183 #define RESPONSE_ERROR              0x02
0184 #define RESPONSE_STATUS             0x03
0185 #define RESPONSE_IRQ_DISABLED           0x05
0186 #define RESPONSE_IRQ_ENABLED            0x06
0187 #define RESPONSE_PIGGYBACKED            0x07
0188 #define RESPONSE_NO_INTERRUPT           0x08
0189 #define RESPONSE_PIG_DISABLED           0x09
0190 #define RESPONSE_PIG_ENABLED            0x0A
0191 #define SD_ERROR_1BIT_TIMEOUT           0x01
0192 #define SD_ERROR_4BIT_TIMEOUT           0x02
0193 #define SD_ERROR_1BIT_CRC_WRONG         0x03
0194 #define SD_ERROR_4BIT_CRC_WRONG         0x04
0195 #define SD_ERROR_1BIT_CRC_ERROR         0x05
0196 #define SD_ERROR_4BIT_CRC_ERROR         0x06
0197 #define SD_ERROR_NO_CMD_ENDBIT          0x07
0198 #define SD_ERROR_NO_1BIT_DATEND         0x08
0199 #define SD_ERROR_NO_4BIT_DATEND         0x09
0200 #define SD_ERROR_1BIT_UNEXPECTED_TIMEOUT    0x0A
0201 #define SD_ERROR_4BIT_UNEXPECTED_TIMEOUT    0x0B
0202 #define SD_ERROR_ILLEGAL_COMMAND        0x0C
0203 #define SD_ERROR_NO_DEVICE          0x0D
0204 #define SD_ERROR_TRANSFER_LENGTH        0x0E
0205 #define SD_ERROR_1BIT_DATA_TIMEOUT      0x0F
0206 #define SD_ERROR_4BIT_DATA_TIMEOUT      0x10
0207 #define SD_ERROR_ILLEGAL_STATE          0x11
0208 #define SD_ERROR_UNKNOWN_ERROR          0x12
0209 #define SD_ERROR_RESERVED_ERROR         0x13
0210 #define SD_ERROR_INVALID_FUNCTION       0x14
0211 #define SD_ERROR_OUT_OF_RANGE           0x15
0212 #define SD_ERROR_STAT_CMD           0x16
0213 #define SD_ERROR_STAT_DATA          0x17
0214 #define SD_ERROR_STAT_CMD_TIMEOUT       0x18
0215 #define SD_ERROR_SDCRDY_STUCK           0x19
0216 #define SD_ERROR_UNHANDLED          0x1A
0217 #define SD_ERROR_OVERRUN            0x1B
0218 #define SD_ERROR_PIO_TIMEOUT            0x1C
0219
0220 #define FUN(c) (0x000007 & (c->arg>>28))
0221 #define REG(c) (0x01FFFF & (c->arg>>9))
0222
0223 static bool limit_speed_to_24_MHz;
0224 module_param(limit_speed_to_24_MHz, bool, 0644);
0225 MODULE_PARM_DESC(limit_speed_to_24_MHz, "Limit Max SDIO Clock Speed to 24 MHz");
0226
0227 static bool pad_input_to_usb_pkt;
0228 module_param(pad_input_to_usb_pkt, bool, 0644);
0229 MODULE_PARM_DESC(pad_input_to_usb_pkt,
0230          "Pad USB data input transfers to whole USB Packet");
0231
0232 static bool disable_offload_processing;
0233 module_param(disable_offload_processing, bool, 0644);
0234 MODULE_PARM_DESC(disable_offload_processing, "Disable Offload Processing");
0235
0236 static bool force_1_bit_data_xfers;
0237 module_param(force_1_bit_data_xfers, bool, 0644);
0238 MODULE_PARM_DESC(force_1_bit_data_xfers,
0239          "Force SDIO Data Transfers to 1-bit Mode");
0240
0241 static bool force_polling_for_irqs;
0242 module_param(force_polling_for_irqs, bool, 0644);
0243 MODULE_PARM_DESC(force_polling_for_irqs, "Force Polling for SDIO interrupts");
0244
0245 static int firmware_irqpoll_timeout = 1024;
0246 module_param(firmware_irqpoll_timeout, int, 0644);
0247 MODULE_PARM_DESC(firmware_irqpoll_timeout, "VUB300 firmware irqpoll timeout");
0248
0249 static int force_max_req_size = 128;
0250 module_param(force_max_req_size, int, 0644);
0251 MODULE_PARM_DESC(force_max_req_size, "set max request size in kBytes");
0252
0253 #ifdef SMSC_DEVELOPMENT_BOARD
0254 static int firmware_rom_wait_states = 0x04;
0255 #else
0256 static int firmware_rom_wait_states = 0x1C;
0257 #endif
0258
0259 module_param(firmware_rom_wait_states, int, 0644);
0260 MODULE_PARM_DESC(firmware_rom_wait_states,
0261          "ROM wait states byte=RRRIIEEE (Reserved Internal External)");
0262
0263 #define ELAN_VENDOR_ID      0x2201
0264 #define VUB300_VENDOR_ID    0x0424
0265 #define VUB300_PRODUCT_ID   0x012C
0266 static const struct usb_device_id vub300_table[] = {
0267     {USB_DEVICE(ELAN_VENDOR_ID, VUB300_PRODUCT_ID)},
0268     {USB_DEVICE(VUB300_VENDOR_ID, VUB300_PRODUCT_ID)},
0269     {} /* Terminating entry */
0270 };
0271 MODULE_DEVICE_TABLE(usb, vub300_table);
0272
0273 static struct workqueue_struct *cmndworkqueue;
0274 static struct workqueue_struct *pollworkqueue;
0275 static struct workqueue_struct *deadworkqueue;
0276
0277 static inline int interface_to_InterfaceNumber(struct usb_interface *interface)
0278 {
0279     if (!interface)
0280         return -1;
0281     if (!interface->cur_altsetting)
0282         return -1;
0283     return interface->cur_altsetting->desc.bInterfaceNumber;
0284 }
0285
0286 struct sdio_register {
0287     unsigned func_num:3;
0288     unsigned sdio_reg:17;
0289     unsigned activate:1;
0290     unsigned prepared:1;
0291     unsigned regvalue:8;
0292     unsigned response:8;
0293     unsigned sparebit:26;
0294 };
0295
0296 struct vub300_mmc_host {
0297     struct usb_device *udev;
0298     struct usb_interface *interface;
0299     struct kref kref;
0300     struct mutex cmd_mutex;
0301     struct mutex irq_mutex;
0302     char vub_name[3 + (9 * 8) + 4 + 1]; /* max of 7 sdio fn's */
0303     u8 cmnd_out_ep; /* EndPoint for commands */
0304     u8 cmnd_res_ep; /* EndPoint for responses */
0305     u8 data_out_ep; /* EndPoint for out data */
0306     u8 data_inp_ep; /* EndPoint for inp data */
0307     bool card_powered;
0308     bool card_present;
0309     bool read_only;
0310     bool large_usb_packets;
0311     bool app_spec; /* ApplicationSpecific */
0312     bool irq_enabled; /* by the MMC CORE */
0313     bool irq_disabled; /* in the firmware */
0314     unsigned bus_width:4;
0315     u8 total_offload_count;
0316     u8 dynamic_register_count;
0317     u8 resp_len;
0318     u32 datasize;
0319     int errors;
0320     int usb_transport_fail;
0321     int usb_timed_out;
0322     int irqs_queued;
0323     struct sdio_register sdio_register[16];
0324     struct offload_interrupt_function_register {
0325 #define MAXREGBITS 4
0326 #define MAXREGS (1<<MAXREGBITS)
0327 #define MAXREGMASK (MAXREGS-1)
0328         u8 offload_count;
0329         u32 offload_point;
0330         struct offload_registers_access reg[MAXREGS];
0331     } fn[8];
0332     u16 fbs[8]; /* Function Block Size */
0333     struct mmc_command *cmd;
0334     struct mmc_request *req;
0335     struct mmc_data *data;
0336     struct mmc_host *mmc;
0337     struct urb *urb;
0338     struct urb *command_out_urb;
0339     struct urb *command_res_urb;
0340     struct completion command_complete;
0341     struct completion irqpoll_complete;
0342     union sd_command cmnd;
0343     union sd_response resp;
0344     struct timer_list sg_transfer_timer;
0345     struct usb_sg_request sg_request;
0346     struct timer_list inactivity_timer;
0347     struct work_struct deadwork;
0348     struct work_struct cmndwork;
0349     struct delayed_work pollwork;
0350     struct host_controller_info hc_info;
0351     struct sd_status_header system_port_status;
0352     u8 padded_buffer[64];
0353 };
0354
0355 #define kref_to_vub300_mmc_host(d) container_of(d, struct vub300_mmc_host, kref)
0356 #define SET_TRANSFER_PSEUDOCODE     21
0357 #define SET_INTERRUPT_PSEUDOCODE    20
0358 #define SET_FAILURE_MODE        18
0359 #define SET_ROM_WAIT_STATES     16
0360 #define SET_IRQ_ENABLE          13
0361 #define SET_CLOCK_SPEED         11
0362 #define SET_FUNCTION_BLOCK_SIZE     9
0363 #define SET_SD_DATA_MODE        6
0364 #define SET_SD_POWER            4
0365 #define ENTER_DFU_MODE          3
0366 #define GET_HC_INF0         1
0367 #define GET_SYSTEM_PORT_STATUS      0
0368
0369 static void vub300_delete(struct kref *kref)
0370 {               /* kref callback - softirq */
0371     struct vub300_mmc_host *vub300 = kref_to_vub300_mmc_host(kref);
0372     struct mmc_host *mmc = vub300->mmc;
0373     usb_free_urb(vub300->command_out_urb);
0374     vub300->command_out_urb = NULL;
0375     usb_free_urb(vub300->command_res_urb);
0376     vub300->command_res_urb = NULL;
0377     usb_put_dev(vub300->udev);
0378     mmc_free_host(mmc);
0379     /*
0380      * and hence also frees vub300
0381      * which is contained at the end of struct mmc
0382      */
0383 }
0384
0385 static void vub300_queue_cmnd_work(struct vub300_mmc_host *vub300)
0386 {
0387     kref_get(&vub300->kref);
0388     if (queue_work(cmndworkqueue, &vub300->cmndwork)) {
0389         /*
0390          * then the cmndworkqueue was not previously
0391          * running and the above get ref is obvious
0392          * required and will be put when the thread
0393          * terminates by a specific call
0394          */
0395     } else {
0396         /*
0397          * the cmndworkqueue was already running from
0398          * a previous invocation and thus to keep the
0399          * kref counts correct we must undo the get
0400          */
0401         kref_put(&vub300->kref, vub300_delete);
0402     }
0403 }
0404
0405 static void vub300_queue_poll_work(struct vub300_mmc_host *vub300, int delay)
0406 {
0407     kref_get(&vub300->kref);
0408     if (queue_delayed_work(pollworkqueue, &vub300->pollwork, delay)) {
0409         /*
0410          * then the pollworkqueue was not previously
0411          * running and the above get ref is obvious
0412          * required and will be put when the thread
0413          * terminates by a specific call
0414          */
0415     } else {
0416         /*
0417          * the pollworkqueue was already running from
0418          * a previous invocation and thus to keep the
0419          * kref counts correct we must undo the get
0420          */
0421         kref_put(&vub300->kref, vub300_delete);
0422     }
0423 }
0424
0425 static void vub300_queue_dead_work(struct vub300_mmc_host *vub300)
0426 {
0427     kref_get(&vub300->kref);
0428     if (queue_work(deadworkqueue, &vub300->deadwork)) {
0429         /*
0430          * then the deadworkqueue was not previously
0431          * running and the above get ref is obvious
0432          * required and will be put when the thread
0433          * terminates by a specific call
0434          */
0435     } else {
0436         /*
0437          * the deadworkqueue was already running from
0438          * a previous invocation and thus to keep the
0439          * kref counts correct we must undo the get
0440          */
0441         kref_put(&vub300->kref, vub300_delete);
0442     }
0443 }
0444
0445 static void irqpoll_res_completed(struct urb *urb)
0446 {               /* urb completion handler - hardirq */
0447     struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
0448     if (urb->status)
0449         vub300->usb_transport_fail = urb->status;
0450     complete(&vub300->irqpoll_complete);
0451 }
0452
0453 static void irqpoll_out_completed(struct urb *urb)
0454 {               /* urb completion handler - hardirq */
0455     struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
0456     if (urb->status) {
0457         vub300->usb_transport_fail = urb->status;
0458         complete(&vub300->irqpoll_complete);
0459         return;
0460     } else {
0461         int ret;
0462         unsigned int pipe =
0463             usb_rcvbulkpipe(vub300->udev, vub300->cmnd_res_ep);
0464         usb_fill_bulk_urb(vub300->command_res_urb, vub300->udev, pipe,
0465                   &vub300->resp, sizeof(vub300->resp),
0466                   irqpoll_res_completed, vub300);
0467         vub300->command_res_urb->actual_length = 0;
0468         ret = usb_submit_urb(vub300->command_res_urb, GFP_ATOMIC);
0469         if (ret) {
0470             vub300->usb_transport_fail = ret;
0471             complete(&vub300->irqpoll_complete);
0472         }
0473         return;
0474     }
0475 }
0476
0477 static void send_irqpoll(struct vub300_mmc_host *vub300)
0478 {
0479     /* cmd_mutex is held by vub300_pollwork_thread */
0480     int retval;
0481     int timeout = 0xFFFF & (0x0001FFFF - firmware_irqpoll_timeout);
0482     vub300->cmnd.poll.header_size = 22;
0483     vub300->cmnd.poll.header_type = 1;
0484     vub300->cmnd.poll.port_number = 0;
0485     vub300->cmnd.poll.command_type = 2;
0486     vub300->cmnd.poll.poll_timeout_lsb = 0xFF & (unsigned)timeout;
0487     vub300->cmnd.poll.poll_timeout_msb = 0xFF & (unsigned)(timeout >> 8);
0488     usb_fill_bulk_urb(vub300->command_out_urb, vub300->udev,
0489               usb_sndbulkpipe(vub300->udev, vub300->cmnd_out_ep)
0490               , &vub300->cmnd, sizeof(vub300->cmnd)
0491               , irqpoll_out_completed, vub300);
0492     retval = usb_submit_urb(vub300->command_out_urb, GFP_KERNEL);
0493     if (0 > retval) {
0494         vub300->usb_transport_fail = retval;
0495         vub300_queue_poll_work(vub300, 1);
0496         complete(&vub300->irqpoll_complete);
0497         return;
0498     } else {
0499         return;
0500     }
0501 }
0502
0503 static void new_system_port_status(struct vub300_mmc_host *vub300)
0504 {
0505     int old_card_present = vub300->card_present;
0506     int new_card_present =
0507         (0x0001 & vub300->system_port_status.port_flags) ? 1 : 0;
0508     vub300->read_only =
0509         (0x0010 & vub300->system_port_status.port_flags) ? 1 : 0;
0510     if (new_card_present && !old_card_present) {
0511         dev_info(&vub300->udev->dev, "card just inserted\n");
0512         vub300->card_present = 1;
0513         vub300->bus_width = 0;
0514         if (disable_offload_processing)
0515             strncpy(vub300->vub_name, "EMPTY Processing Disabled",
0516                 sizeof(vub300->vub_name));
0517         else
0518             vub300->vub_name[0] = 0;
0519         mmc_detect_change(vub300->mmc, 1);
0520     } else if (!new_card_present && old_card_present) {
0521         dev_info(&vub300->udev->dev, "card just ejected\n");
0522         vub300->card_present = 0;
0523         mmc_detect_change(vub300->mmc, 0);
0524     } else {
0525         /* no change */
0526     }
0527 }
0528
0529 static void __add_offloaded_reg_to_fifo(struct vub300_mmc_host *vub300,
0530                     struct offload_registers_access
0531                     *register_access, u8 func)
0532 {
0533     u8 r = vub300->fn[func].offload_point + vub300->fn[func].offload_count;
0534     memcpy(&vub300->fn[func].reg[MAXREGMASK & r], register_access,
0535            sizeof(struct offload_registers_access));
0536     vub300->fn[func].offload_count += 1;
0537     vub300->total_offload_count += 1;
0538 }
0539
0540 static void add_offloaded_reg(struct vub300_mmc_host *vub300,
0541                   struct offload_registers_access *register_access)
0542 {
0543     u32 Register = ((0x03 & register_access->command_byte[0]) << 15)
0544             | ((0xFF & register_access->command_byte[1]) << 7)
0545             | ((0xFE & register_access->command_byte[2]) >> 1);
0546     u8 func = ((0x70 & register_access->command_byte[0]) >> 4);
0547     u8 regs = vub300->dynamic_register_count;
0548     u8 i = 0;
0549     while (0 < regs-- && 1 == vub300->sdio_register[i].activate) {
0550         if (vub300->sdio_register[i].func_num == func &&
0551             vub300->sdio_register[i].sdio_reg == Register) {
0552             if (vub300->sdio_register[i].prepared == 0)
0553                 vub300->sdio_register[i].prepared = 1;
0554             vub300->sdio_register[i].response =
0555                 register_access->Respond_Byte[2];
0556             vub300->sdio_register[i].regvalue =
0557                 register_access->Respond_Byte[3];
0558             return;
0559         } else {
0560             i += 1;
0561             continue;
0562         }
0563     }
0564     __add_offloaded_reg_to_fifo(vub300, register_access, func);
0565 }
0566
0567 static void check_vub300_port_status(struct vub300_mmc_host *vub300)
0568 {
0569     /*
0570      * cmd_mutex is held by vub300_pollwork_thread,
0571      * vub300_deadwork_thread or vub300_cmndwork_thread
0572      */
0573     int retval;
0574     retval =
0575         usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
0576                 GET_SYSTEM_PORT_STATUS,
0577                 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
0578                 0x0000, 0x0000, &vub300->system_port_status,
0579                 sizeof(vub300->system_port_status), 1000);
0580     if (sizeof(vub300->system_port_status) == retval)
0581         new_system_port_status(vub300);
0582 }
0583
0584 static void __vub300_irqpoll_response(struct vub300_mmc_host *vub300)
0585 {
0586     /* cmd_mutex is held by vub300_pollwork_thread */
0587     if (vub300->command_res_urb->actual_length == 0)
0588         return;
0589
0590     switch (vub300->resp.common.header_type) {
0591     case RESPONSE_INTERRUPT:
0592         mutex_lock(&vub300->irq_mutex);
0593         if (vub300->irq_enabled)
0594             mmc_signal_sdio_irq(vub300->mmc);
0595         else
0596             vub300->irqs_queued += 1;
0597         vub300->irq_disabled = 1;
0598         mutex_unlock(&vub300->irq_mutex);
0599         break;
0600     case RESPONSE_ERROR:
0601         if (vub300->resp.error.error_code == SD_ERROR_NO_DEVICE)
0602             check_vub300_port_status(vub300);
0603         break;
0604     case RESPONSE_STATUS:
0605         vub300->system_port_status = vub300->resp.status;
0606         new_system_port_status(vub300);
0607         if (!vub300->card_present)
0608             vub300_queue_poll_work(vub300, HZ / 5);
0609         break;
0610     case RESPONSE_IRQ_DISABLED:
0611     {
0612         int offloaded_data_length = vub300->resp.common.header_size - 3;
0613         int register_count = offloaded_data_length >> 3;
0614         int ri = 0;
0615         while (register_count--) {
0616             add_offloaded_reg(vub300, &vub300->resp.irq.reg[ri]);
0617             ri += 1;
0618         }
0619         mutex_lock(&vub300->irq_mutex);
0620         if (vub300->irq_enabled)
0621             mmc_signal_sdio_irq(vub300->mmc);
0622         else
0623             vub300->irqs_queued += 1;
0624         vub300->irq_disabled = 1;
0625         mutex_unlock(&vub300->irq_mutex);
0626         break;
0627     }
0628     case RESPONSE_IRQ_ENABLED:
0629     {
0630         int offloaded_data_length = vub300->resp.common.header_size - 3;
0631         int register_count = offloaded_data_length >> 3;
0632         int ri = 0;
0633         while (register_count--) {
0634             add_offloaded_reg(vub300, &vub300->resp.irq.reg[ri]);
0635             ri += 1;
0636         }
0637         mutex_lock(&vub300->irq_mutex);
0638         if (vub300->irq_enabled)
0639             mmc_signal_sdio_irq(vub300->mmc);
0640         else
0641             vub300->irqs_queued += 1;
0642         vub300->irq_disabled = 0;
0643         mutex_unlock(&vub300->irq_mutex);
0644         break;
0645     }
0646     case RESPONSE_NO_INTERRUPT:
0647         vub300_queue_poll_work(vub300, 1);
0648         break;
0649     default:
0650         break;
0651     }
0652 }
0653
0654 static void __do_poll(struct vub300_mmc_host *vub300)
0655 {
0656     /* cmd_mutex is held by vub300_pollwork_thread */
0657     unsigned long commretval;
0658     mod_timer(&vub300->inactivity_timer, jiffies + HZ);
0659     init_completion(&vub300->irqpoll_complete);
0660     send_irqpoll(vub300);
0661     commretval = wait_for_completion_timeout(&vub300->irqpoll_complete,
0662                          msecs_to_jiffies(500));
0663     if (vub300->usb_transport_fail) {
0664         /* no need to do anything */
0665     } else if (commretval == 0) {
0666         vub300->usb_timed_out = 1;
0667         usb_kill_urb(vub300->command_out_urb);
0668         usb_kill_urb(vub300->command_res_urb);
0669     } else { /* commretval > 0 */
0670         __vub300_irqpoll_response(vub300);
0671     }
0672 }
0673
0674 /* this thread runs only when the driver
0675  * is trying to poll the device for an IRQ
0676  */
0677 static void vub300_pollwork_thread(struct work_struct *work)
0678 {               /* NOT irq */
0679     struct vub300_mmc_host *vub300 = container_of(work,
0680                   struct vub300_mmc_host, pollwork.work);
0681     if (!vub300->interface) {
0682         kref_put(&vub300->kref, vub300_delete);
0683         return;
0684     }
0685     mutex_lock(&vub300->cmd_mutex);
0686     if (vub300->cmd) {
0687         vub300_queue_poll_work(vub300, 1);
0688     } else if (!vub300->card_present) {
0689         /* no need to do anything */
0690     } else { /* vub300->card_present */
0691         mutex_lock(&vub300->irq_mutex);
0692         if (!vub300->irq_enabled) {
0693             mutex_unlock(&vub300->irq_mutex);
0694         } else if (vub300->irqs_queued) {
0695             vub300->irqs_queued -= 1;
0696             mmc_signal_sdio_irq(vub300->mmc);
0697             mod_timer(&vub300->inactivity_timer, jiffies + HZ);
0698             mutex_unlock(&vub300->irq_mutex);
0699         } else { /* NOT vub300->irqs_queued */
0700             mutex_unlock(&vub300->irq_mutex);
0701             __do_poll(vub300);
0702         }
0703     }
0704     mutex_unlock(&vub300->cmd_mutex);
0705     kref_put(&vub300->kref, vub300_delete);
0706 }
0707
0708 static void vub300_deadwork_thread(struct work_struct *work)
0709 {               /* NOT irq */
0710     struct vub300_mmc_host *vub300 =
0711         container_of(work, struct vub300_mmc_host, deadwork);
0712     if (!vub300->interface) {
0713         kref_put(&vub300->kref, vub300_delete);
0714         return;
0715     }
0716     mutex_lock(&vub300->cmd_mutex);
0717     if (vub300->cmd) {
0718         /*
0719          * a command got in as the inactivity
0720          * timer expired - so we just let the
0721          * processing of the command show if
0722          * the device is dead
0723          */
0724     } else if (vub300->card_present) {
0725         check_vub300_port_status(vub300);
0726     } else if (vub300->mmc && vub300->mmc->card) {
0727         /*
0728          * the MMC core must not have responded
0729          * to the previous indication - lets
0730          * hope that it eventually does so we
0731          * will just ignore this for now
0732          */
0733     } else {
0734         check_vub300_port_status(vub300);
0735     }
0736     mod_timer(&vub300->inactivity_timer, jiffies + HZ);
0737     mutex_unlock(&vub300->cmd_mutex);
0738     kref_put(&vub300->kref, vub300_delete);
0739 }
0740
0741 static void vub300_inactivity_timer_expired(struct timer_list *t)
0742 {               /* softirq */
0743     struct vub300_mmc_host *vub300 = from_timer(vub300, t,
0744                             inactivity_timer);
0745     if (!vub300->interface) {
0746         kref_put(&vub300->kref, vub300_delete);
0747     } else if (vub300->cmd) {
0748         mod_timer(&vub300->inactivity_timer, jiffies + HZ);
0749     } else {
0750         vub300_queue_dead_work(vub300);
0751         mod_timer(&vub300->inactivity_timer, jiffies + HZ);
0752     }
0753 }
0754
0755 static int vub300_response_error(u8 error_code)
0756 {
0757     switch (error_code) {
0758     case SD_ERROR_PIO_TIMEOUT:
0759     case SD_ERROR_1BIT_TIMEOUT:
0760     case SD_ERROR_4BIT_TIMEOUT:
0761         return -ETIMEDOUT;
0762     case SD_ERROR_STAT_DATA:
0763     case SD_ERROR_OVERRUN:
0764     case SD_ERROR_STAT_CMD:
0765     case SD_ERROR_STAT_CMD_TIMEOUT:
0766     case SD_ERROR_SDCRDY_STUCK:
0767     case SD_ERROR_UNHANDLED:
0768     case SD_ERROR_1BIT_CRC_WRONG:
0769     case SD_ERROR_4BIT_CRC_WRONG:
0770     case SD_ERROR_1BIT_CRC_ERROR:
0771     case SD_ERROR_4BIT_CRC_ERROR:
0772     case SD_ERROR_NO_CMD_ENDBIT:
0773     case SD_ERROR_NO_1BIT_DATEND:
0774     case SD_ERROR_NO_4BIT_DATEND:
0775     case SD_ERROR_1BIT_DATA_TIMEOUT:
0776     case SD_ERROR_4BIT_DATA_TIMEOUT:
0777     case SD_ERROR_1BIT_UNEXPECTED_TIMEOUT:
0778     case SD_ERROR_4BIT_UNEXPECTED_TIMEOUT:
0779         return -EILSEQ;
0780     case 33:
0781         return -EILSEQ;
0782     case SD_ERROR_ILLEGAL_COMMAND:
0783         return -EINVAL;
0784     case SD_ERROR_NO_DEVICE:
0785         return -ENOMEDIUM;
0786     default:
0787         return -ENODEV;
0788     }
0789 }
0790
0791 static void command_res_completed(struct urb *urb)
0792 {               /* urb completion handler - hardirq */
0793     struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
0794     if (urb->status) {
0795         /* we have to let the initiator handle the error */
0796     } else if (vub300->command_res_urb->actual_length == 0) {
0797         /*
0798          * we have seen this happen once or twice and
0799          * we suspect a buggy USB host controller
0800          */
0801     } else if (!vub300->data) {
0802         /* this means that the command (typically CMD52) succeeded */
0803     } else if (vub300->resp.common.header_type != 0x02) {
0804         /*
0805          * this is an error response from the VUB300 chip
0806          * and we let the initiator handle it
0807          */
0808     } else if (vub300->urb) {
0809         vub300->cmd->error =
0810             vub300_response_error(vub300->resp.error.error_code);
0811         usb_unlink_urb(vub300->urb);
0812     } else {
0813         vub300->cmd->error =
0814             vub300_response_error(vub300->resp.error.error_code);
0815         usb_sg_cancel(&vub300->sg_request);
0816     }
0817     complete(&vub300->command_complete);    /* got_response_in */
0818 }
0819
0820 static void command_out_completed(struct urb *urb)
0821 {               /* urb completion handler - hardirq */
0822     struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
0823     if (urb->status) {
0824         complete(&vub300->command_complete);
0825     } else {
0826         int ret;
0827         unsigned int pipe =
0828             usb_rcvbulkpipe(vub300->udev, vub300->cmnd_res_ep);
0829         usb_fill_bulk_urb(vub300->command_res_urb, vub300->udev, pipe,
0830                   &vub300->resp, sizeof(vub300->resp),
0831                   command_res_completed, vub300);
0832         vub300->command_res_urb->actual_length = 0;
0833         ret = usb_submit_urb(vub300->command_res_urb, GFP_ATOMIC);
0834         if (ret == 0) {
0835             /*
0836              * the urb completion handler will call
0837              * our completion handler
0838              */
0839         } else {
0840             /*
0841              * and thus we only call it directly
0842              * when it will not be called
0843              */
0844             complete(&vub300->command_complete);
0845         }
0846     }
0847 }
0848
0849 /*
0850  * the STUFF bits are masked out for the comparisons
0851  */
0852 static void snoop_block_size_and_bus_width(struct vub300_mmc_host *vub300,
0853                        u32 cmd_arg)
0854 {
0855     if ((0xFBFFFE00 & cmd_arg) == 0x80022200)
0856         vub300->fbs[1] = (cmd_arg << 8) | (0x00FF & vub300->fbs[1]);
0857     else if ((0xFBFFFE00 & cmd_arg) == 0x80022000)
0858         vub300->fbs[1] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[1]);
0859     else if ((0xFBFFFE00 & cmd_arg) == 0x80042200)
0860         vub300->fbs[2] = (cmd_arg << 8) | (0x00FF & vub300->fbs[2]);
0861     else if ((0xFBFFFE00 & cmd_arg) == 0x80042000)
0862         vub300->fbs[2] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[2]);
0863     else if ((0xFBFFFE00 & cmd_arg) == 0x80062200)
0864         vub300->fbs[3] = (cmd_arg << 8) | (0x00FF & vub300->fbs[3]);
0865     else if ((0xFBFFFE00 & cmd_arg) == 0x80062000)
0866         vub300->fbs[3] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[3]);
0867     else if ((0xFBFFFE00 & cmd_arg) == 0x80082200)
0868         vub300->fbs[4] = (cmd_arg << 8) | (0x00FF & vub300->fbs[4]);
0869     else if ((0xFBFFFE00 & cmd_arg) == 0x80082000)
0870         vub300->fbs[4] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[4]);
0871     else if ((0xFBFFFE00 & cmd_arg) == 0x800A2200)
0872         vub300->fbs[5] = (cmd_arg << 8) | (0x00FF & vub300->fbs[5]);
0873     else if ((0xFBFFFE00 & cmd_arg) == 0x800A2000)
0874         vub300->fbs[5] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[5]);
0875     else if ((0xFBFFFE00 & cmd_arg) == 0x800C2200)
0876         vub300->fbs[6] = (cmd_arg << 8) | (0x00FF & vub300->fbs[6]);
0877     else if ((0xFBFFFE00 & cmd_arg) == 0x800C2000)
0878         vub300->fbs[6] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[6]);
0879     else if ((0xFBFFFE00 & cmd_arg) == 0x800E2200)
0880         vub300->fbs[7] = (cmd_arg << 8) | (0x00FF & vub300->fbs[7]);
0881     else if ((0xFBFFFE00 & cmd_arg) == 0x800E2000)
0882         vub300->fbs[7] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[7]);
0883     else if ((0xFBFFFE03 & cmd_arg) == 0x80000E00)
0884         vub300->bus_width = 1;
0885     else if ((0xFBFFFE03 & cmd_arg) == 0x80000E02)
0886         vub300->bus_width = 4;
0887 }
0888
0889 static void send_command(struct vub300_mmc_host *vub300)
0890 {
0891     /* cmd_mutex is held by vub300_cmndwork_thread */
0892     struct mmc_command *cmd = vub300->cmd;
0893     struct mmc_data *data = vub300->data;
0894     int retval;
0895     int i;
0896     u8 response_type;
0897     if (vub300->app_spec) {
0898         switch (cmd->opcode) {
0899         case 6:
0900             response_type = SDRT_1;
0901             vub300->resp_len = 6;
0902             if (0x00000000 == (0x00000003 & cmd->arg))
0903                 vub300->bus_width = 1;
0904             else if (0x00000002 == (0x00000003 & cmd->arg))
0905                 vub300->bus_width = 4;
0906             else
0907                 dev_err(&vub300->udev->dev,
0908                     "unexpected ACMD6 bus_width=%d\n",
0909                     0x00000003 & cmd->arg);
0910             break;
0911         case 13:
0912             response_type = SDRT_1;
0913             vub300->resp_len = 6;
0914             break;
0915         case 22:
0916             response_type = SDRT_1;
0917             vub300->resp_len = 6;
0918             break;
0919         case 23:
0920             response_type = SDRT_1;
0921             vub300->resp_len = 6;
0922             break;
0923         case 41:
0924             response_type = SDRT_3;
0925             vub300->resp_len = 6;
0926             break;
0927         case 42:
0928             response_type = SDRT_1;
0929             vub300->resp_len = 6;
0930             break;
0931         case 51:
0932             response_type = SDRT_1;
0933             vub300->resp_len = 6;
0934             break;
0935         case 55:
0936             response_type = SDRT_1;
0937             vub300->resp_len = 6;
0938             break;
0939         default:
0940             vub300->resp_len = 0;
0941             cmd->error = -EINVAL;
0942             complete(&vub300->command_complete);
0943             return;
0944         }
0945         vub300->app_spec = 0;
0946     } else {
0947         switch (cmd->opcode) {
0948         case 0:
0949             response_type = SDRT_NONE;
0950             vub300->resp_len = 0;
0951             break;
0952         case 1:
0953             response_type = SDRT_3;
0954             vub300->resp_len = 6;
0955             break;
0956         case 2:
0957             response_type = SDRT_2;
0958             vub300->resp_len = 17;
0959             break;
0960         case 3:
0961             response_type = SDRT_6;
0962             vub300->resp_len = 6;
0963             break;
0964         case 4:
0965             response_type = SDRT_NONE;
0966             vub300->resp_len = 0;
0967             break;
0968         case 5:
0969             response_type = SDRT_4;
0970             vub300->resp_len = 6;
0971             break;
0972         case 6:
0973             response_type = SDRT_1;
0974             vub300->resp_len = 6;
0975             break;
0976         case 7:
0977             response_type = SDRT_1B;
0978             vub300->resp_len = 6;
0979             break;
0980         case 8:
0981             response_type = SDRT_7;
0982             vub300->resp_len = 6;
0983             break;
0984         case 9:
0985             response_type = SDRT_2;
0986             vub300->resp_len = 17;
0987             break;
0988         case 10:
0989             response_type = SDRT_2;
0990             vub300->resp_len = 17;
0991             break;
0992         case 12:
0993             response_type = SDRT_1B;
0994             vub300->resp_len = 6;
0995             break;
0996         case 13:
0997             response_type = SDRT_1;
0998             vub300->resp_len = 6;
0999             break;
1000         case 15:
1001             response_type = SDRT_NONE;
1002             vub300->resp_len = 0;
1003             break;
1004         case 16:
1005             for (i = 0; i < ARRAY_SIZE(vub300->fbs); i++)
1006                 vub300->fbs[i] = 0xFFFF & cmd->arg;
1007             response_type = SDRT_1;
1008             vub300->resp_len = 6;
1009             break;
1010         case 17:
1011         case 18:
1012         case 24:
1013         case 25:
1014         case 27:
1015             response_type = SDRT_1;
1016             vub300->resp_len = 6;
1017             break;
1018         case 28:
1019         case 29:
1020             response_type = SDRT_1B;
1021             vub300->resp_len = 6;
1022             break;
1023         case 30:
1024         case 32:
1025         case 33:
1026             response_type = SDRT_1;
1027             vub300->resp_len = 6;
1028             break;
1029         case 38:
1030             response_type = SDRT_1B;
1031             vub300->resp_len = 6;
1032             break;
1033         case 42:
1034             response_type = SDRT_1;
1035             vub300->resp_len = 6;
1036             break;
1037         case 52:
1038             response_type = SDRT_5;
1039             vub300->resp_len = 6;
1040             snoop_block_size_and_bus_width(vub300, cmd->arg);
1041             break;
1042         case 53:
1043             response_type = SDRT_5;
1044             vub300->resp_len = 6;
1045             break;
1046         case 55:
1047             response_type = SDRT_1;
1048             vub300->resp_len = 6;
1049             vub300->app_spec = 1;
1050             break;
1051         case 56:
1052             response_type = SDRT_1;
1053             vub300->resp_len = 6;
1054             break;
1055         default:
1056             vub300->resp_len = 0;
1057             cmd->error = -EINVAL;
1058             complete(&vub300->command_complete);
1059             return;
1060         }
1061     }
1062     /*
1063      * it is a shame that we can not use "sizeof(struct sd_command_header)"
1064      * this is because the packet _must_ be padded to 64 bytes
1065      */
1066     vub300->cmnd.head.header_size = 20;
1067     vub300->cmnd.head.header_type = 0x00;
1068     vub300->cmnd.head.port_number = 0; /* "0" means port 1 */
1069     vub300->cmnd.head.command_type = 0x00; /* standard read command */
1070     vub300->cmnd.head.response_type = response_type;
1071     vub300->cmnd.head.command_index = cmd->opcode;
1072     vub300->cmnd.head.arguments[0] = cmd->arg >> 24;
1073     vub300->cmnd.head.arguments[1] = cmd->arg >> 16;
1074     vub300->cmnd.head.arguments[2] = cmd->arg >> 8;
1075     vub300->cmnd.head.arguments[3] = cmd->arg >> 0;
1076     if (cmd->opcode == 52) {
1077         int fn = 0x7 & (cmd->arg >> 28);
1078         vub300->cmnd.head.block_count[0] = 0;
1079         vub300->cmnd.head.block_count[1] = 0;
1080         vub300->cmnd.head.block_size[0] = (vub300->fbs[fn] >> 8) & 0xFF;
1081         vub300->cmnd.head.block_size[1] = (vub300->fbs[fn] >> 0) & 0xFF;
1082         vub300->cmnd.head.command_type = 0x00;
1083         vub300->cmnd.head.transfer_size[0] = 0;
1084         vub300->cmnd.head.transfer_size[1] = 0;
1085         vub300->cmnd.head.transfer_size[2] = 0;
1086         vub300->cmnd.head.transfer_size[3] = 0;
1087     } else if (!data) {
1088         vub300->cmnd.head.block_count[0] = 0;
1089         vub300->cmnd.head.block_count[1] = 0;
1090         vub300->cmnd.head.block_size[0] = (vub300->fbs[0] >> 8) & 0xFF;
1091         vub300->cmnd.head.block_size[1] = (vub300->fbs[0] >> 0) & 0xFF;
1092         vub300->cmnd.head.command_type = 0x00;
1093         vub300->cmnd.head.transfer_size[0] = 0;
1094         vub300->cmnd.head.transfer_size[1] = 0;
1095         vub300->cmnd.head.transfer_size[2] = 0;
1096         vub300->cmnd.head.transfer_size[3] = 0;
1097     } else if (cmd->opcode == 53) {
1098         int fn = 0x7 & (cmd->arg >> 28);
1099         if (0x08 & vub300->cmnd.head.arguments[0]) { /* BLOCK MODE */
1100             vub300->cmnd.head.block_count[0] =
1101                 (data->blocks >> 8) & 0xFF;
1102             vub300->cmnd.head.block_count[1] =
1103                 (data->blocks >> 0) & 0xFF;
1104             vub300->cmnd.head.block_size[0] =
1105                 (data->blksz >> 8) & 0xFF;
1106             vub300->cmnd.head.block_size[1] =
1107                 (data->blksz >> 0) & 0xFF;
1108         } else {    /* BYTE MODE */
1109             vub300->cmnd.head.block_count[0] = 0;
1110             vub300->cmnd.head.block_count[1] = 0;
1111             vub300->cmnd.head.block_size[0] =
1112                 (vub300->datasize >> 8) & 0xFF;
1113             vub300->cmnd.head.block_size[1] =
1114                 (vub300->datasize >> 0) & 0xFF;
1115         }
1116         vub300->cmnd.head.command_type =
1117             (MMC_DATA_READ & data->flags) ? 0x00 : 0x80;
1118         vub300->cmnd.head.transfer_size[0] =
1119             (vub300->datasize >> 24) & 0xFF;
1120         vub300->cmnd.head.transfer_size[1] =
1121             (vub300->datasize >> 16) & 0xFF;
1122         vub300->cmnd.head.transfer_size[2] =
1123             (vub300->datasize >> 8) & 0xFF;
1124         vub300->cmnd.head.transfer_size[3] =
1125             (vub300->datasize >> 0) & 0xFF;
1126         if (vub300->datasize < vub300->fbs[fn]) {
1127             vub300->cmnd.head.block_count[0] = 0;
1128             vub300->cmnd.head.block_count[1] = 0;
1129         }
1130     } else {
1131         vub300->cmnd.head.block_count[0] = (data->blocks >> 8) & 0xFF;
1132         vub300->cmnd.head.block_count[1] = (data->blocks >> 0) & 0xFF;
1133         vub300->cmnd.head.block_size[0] = (data->blksz >> 8) & 0xFF;
1134         vub300->cmnd.head.block_size[1] = (data->blksz >> 0) & 0xFF;
1135         vub300->cmnd.head.command_type =
1136             (MMC_DATA_READ & data->flags) ? 0x00 : 0x80;
1137         vub300->cmnd.head.transfer_size[0] =
1138             (vub300->datasize >> 24) & 0xFF;
1139         vub300->cmnd.head.transfer_size[1] =
1140             (vub300->datasize >> 16) & 0xFF;
1141         vub300->cmnd.head.transfer_size[2] =
1142             (vub300->datasize >> 8) & 0xFF;
1143         vub300->cmnd.head.transfer_size[3] =
1144             (vub300->datasize >> 0) & 0xFF;
1145         if (vub300->datasize < vub300->fbs[0]) {
1146             vub300->cmnd.head.block_count[0] = 0;
1147             vub300->cmnd.head.block_count[1] = 0;
1148         }
1149     }
1150     if (vub300->cmnd.head.block_size[0] || vub300->cmnd.head.block_size[1]) {
1151         u16 block_size = vub300->cmnd.head.block_size[1] |
1152             (vub300->cmnd.head.block_size[0] << 8);
1153         u16 block_boundary = FIRMWARE_BLOCK_BOUNDARY -
1154             (FIRMWARE_BLOCK_BOUNDARY % block_size);
1155         vub300->cmnd.head.block_boundary[0] =
1156             (block_boundary >> 8) & 0xFF;
1157         vub300->cmnd.head.block_boundary[1] =
1158             (block_boundary >> 0) & 0xFF;
1159     } else {
1160         vub300->cmnd.head.block_boundary[0] = 0;
1161         vub300->cmnd.head.block_boundary[1] = 0;
1162     }
1163     usb_fill_bulk_urb(vub300->command_out_urb, vub300->udev,
1164               usb_sndbulkpipe(vub300->udev, vub300->cmnd_out_ep),
1165               &vub300->cmnd, sizeof(vub300->cmnd),
1166               command_out_completed, vub300);
1167     retval = usb_submit_urb(vub300->command_out_urb, GFP_KERNEL);
1168     if (retval < 0) {
1169         cmd->error = retval;
1170         complete(&vub300->command_complete);
1171         return;
1172     } else {
1173         return;
1174     }
1175 }
1176
1177 /*
1178  * timer callback runs in atomic mode
1179  *       so it cannot call usb_kill_urb()
1180  */
1181 static void vub300_sg_timed_out(struct timer_list *t)
1182 {
1183     struct vub300_mmc_host *vub300 = from_timer(vub300, t,
1184                             sg_transfer_timer);
1185     vub300->usb_timed_out = 1;
1186     usb_sg_cancel(&vub300->sg_request);
1187     usb_unlink_urb(vub300->command_out_urb);
1188     usb_unlink_urb(vub300->command_res_urb);
1189 }
1190
1191 static u16 roundup_to_multiple_of_64(u16 number)
1192 {
1193     return 0xFFC0 & (0x3F + number);
1194 }
1195
1196 /*
1197  * this is a separate function to solve the 80 column width restriction
1198  */
1199 static void __download_offload_pseudocode(struct vub300_mmc_host *vub300,
1200                       const struct firmware *fw)
1201 {
1202     u8 register_count = 0;
1203     u16 ts = 0;
1204     u16 interrupt_size = 0;
1205     const u8 *data = fw->data;
1206     int size = fw->size;
1207     u8 c;
1208     dev_info(&vub300->udev->dev, "using %s for SDIO offload processing\n",
1209          vub300->vub_name);
1210     do {
1211         c = *data++;
1212     } while (size-- && c); /* skip comment */
1213     dev_info(&vub300->udev->dev, "using offload firmware %s %s\n", fw->data,
1214          vub300->vub_name);
1215     if (size < 4) {
1216         dev_err(&vub300->udev->dev,
1217             "corrupt offload pseudocode in firmware %s\n",
1218             vub300->vub_name);
1219         strncpy(vub300->vub_name, "corrupt offload pseudocode",
1220             sizeof(vub300->vub_name));
1221         return;
1222     }
1223     interrupt_size += *data++;
1224     size -= 1;
1225     interrupt_size <<= 8;
1226     interrupt_size += *data++;
1227     size -= 1;
1228     if (interrupt_size < size) {
1229         u16 xfer_length = roundup_to_multiple_of_64(interrupt_size);
1230         u8 *xfer_buffer = kmalloc(xfer_length, GFP_KERNEL);
1231         if (xfer_buffer) {
1232             int retval;
1233             memcpy(xfer_buffer, data, interrupt_size);
1234             memset(xfer_buffer + interrupt_size, 0,
1235                    xfer_length - interrupt_size);
1236             size -= interrupt_size;
1237             data += interrupt_size;
1238             retval =
1239                 usb_control_msg(vub300->udev,
1240                         usb_sndctrlpipe(vub300->udev, 0),
1241                         SET_INTERRUPT_PSEUDOCODE,
1242                         USB_DIR_OUT | USB_TYPE_VENDOR |
1243                         USB_RECIP_DEVICE, 0x0000, 0x0000,
1244                         xfer_buffer, xfer_length, 1000);
1245             kfree(xfer_buffer);
1246             if (retval < 0)
1247                 goto copy_error_message;
1248         } else {
1249             dev_err(&vub300->udev->dev,
1250                 "not enough memory for xfer buffer to send"
1251                 " INTERRUPT_PSEUDOCODE for %s %s\n", fw->data,
1252                 vub300->vub_name);
1253             strncpy(vub300->vub_name,
1254                 "SDIO interrupt pseudocode download failed",
1255                 sizeof(vub300->vub_name));
1256             return;
1257         }
1258     } else {
1259         dev_err(&vub300->udev->dev,
1260             "corrupt interrupt pseudocode in firmware %s %s\n",
1261             fw->data, vub300->vub_name);
1262         strncpy(vub300->vub_name, "corrupt interrupt pseudocode",
1263             sizeof(vub300->vub_name));
1264         return;
1265     }
1266     ts += *data++;
1267     size -= 1;
1268     ts <<= 8;
1269     ts += *data++;
1270     size -= 1;
1271     if (ts < size) {
1272         u16 xfer_length = roundup_to_multiple_of_64(ts);
1273         u8 *xfer_buffer = kmalloc(xfer_length, GFP_KERNEL);
1274         if (xfer_buffer) {
1275             int retval;
1276             memcpy(xfer_buffer, data, ts);
1277             memset(xfer_buffer + ts, 0,
1278                    xfer_length - ts);
1279             size -= ts;
1280             data += ts;
1281             retval =
1282                 usb_control_msg(vub300->udev,
1283                         usb_sndctrlpipe(vub300->udev, 0),
1284                         SET_TRANSFER_PSEUDOCODE,
1285                         USB_DIR_OUT | USB_TYPE_VENDOR |
1286                         USB_RECIP_DEVICE, 0x0000, 0x0000,
1287                         xfer_buffer, xfer_length, 1000);
1288             kfree(xfer_buffer);
1289             if (retval < 0)
1290                 goto copy_error_message;
1291         } else {
1292             dev_err(&vub300->udev->dev,
1293                 "not enough memory for xfer buffer to send"
1294                 " TRANSFER_PSEUDOCODE for %s %s\n", fw->data,
1295                 vub300->vub_name);
1296             strncpy(vub300->vub_name,
1297                 "SDIO transfer pseudocode download failed",
1298                 sizeof(vub300->vub_name));
1299             return;
1300         }
1301     } else {
1302         dev_err(&vub300->udev->dev,
1303             "corrupt transfer pseudocode in firmware %s %s\n",
1304             fw->data, vub300->vub_name);
1305         strncpy(vub300->vub_name, "corrupt transfer pseudocode",
1306             sizeof(vub300->vub_name));
1307         return;
1308     }
1309     register_count += *data++;
1310     size -= 1;
1311     if (register_count * 4 == size) {
1312         int I = vub300->dynamic_register_count = register_count;
1313         int i = 0;
1314         while (I--) {
1315             unsigned int func_num = 0;
1316             vub300->sdio_register[i].func_num = *data++;
1317             size -= 1;
1318             func_num += *data++;
1319             size -= 1;
1320             func_num <<= 8;
1321             func_num += *data++;
1322             size -= 1;
1323             func_num <<= 8;
1324             func_num += *data++;
1325             size -= 1;
1326             vub300->sdio_register[i].sdio_reg = func_num;
1327             vub300->sdio_register[i].activate = 1;
1328             vub300->sdio_register[i].prepared = 0;
1329             i += 1;
1330         }
1331         dev_info(&vub300->udev->dev,
1332              "initialized %d dynamic pseudocode registers\n",
1333              vub300->dynamic_register_count);
1334         return;
1335     } else {
1336         dev_err(&vub300->udev->dev,
1337             "corrupt dynamic registers in firmware %s\n",
1338             vub300->vub_name);
1339         strncpy(vub300->vub_name, "corrupt dynamic registers",
1340             sizeof(vub300->vub_name));
1341         return;
1342     }
1343
1344     return;
1345
1346 copy_error_message:
1347     strncpy(vub300->vub_name, "SDIO pseudocode download failed",
1348         sizeof(vub300->vub_name));
1349 }
1350
1351 /*
1352  * if the binary containing the EMPTY PseudoCode can not be found
1353  * vub300->vub_name is set anyway in order to prevent an automatic retry
1354  */
1355 static void download_offload_pseudocode(struct vub300_mmc_host *vub300)
1356 {
1357     struct mmc_card *card = vub300->mmc->card;
1358     int sdio_funcs = card->sdio_funcs;
1359     const struct firmware *fw = NULL;
1360     int l = snprintf(vub300->vub_name, sizeof(vub300->vub_name),
1361              "vub_%04X%04X", card->cis.vendor, card->cis.device);
1362     int n = 0;
1363     int retval;
1364     for (n = 0; n < sdio_funcs; n++) {
1365         struct sdio_func *sf = card->sdio_func[n];
1366         l += scnprintf(vub300->vub_name + l,
1367                   sizeof(vub300->vub_name) - l, "_%04X%04X",
1368                   sf->vendor, sf->device);
1369     }
1370     snprintf(vub300->vub_name + l, sizeof(vub300->vub_name) - l, ".bin");
1371     dev_info(&vub300->udev->dev, "requesting offload firmware %s\n",
1372          vub300->vub_name);
1373     retval = request_firmware(&fw, vub300->vub_name, &card->dev);
1374     if (retval < 0) {
1375         strncpy(vub300->vub_name, "vub_default.bin",
1376             sizeof(vub300->vub_name));
1377         retval = request_firmware(&fw, vub300->vub_name, &card->dev);
1378         if (retval < 0) {
1379             strncpy(vub300->vub_name,
1380                 "no SDIO offload firmware found",
1381                 sizeof(vub300->vub_name));
1382         } else {
1383             __download_offload_pseudocode(vub300, fw);
1384             release_firmware(fw);
1385         }
1386     } else {
1387         __download_offload_pseudocode(vub300, fw);
1388         release_firmware(fw);
1389     }
1390 }
1391
1392 static void vub300_usb_bulk_msg_completion(struct urb *urb)
1393 {               /* urb completion handler - hardirq */
1394     complete((struct completion *)urb->context);
1395 }
1396
1397 static int vub300_usb_bulk_msg(struct vub300_mmc_host *vub300,
1398                    unsigned int pipe, void *data, int len,
1399                    int *actual_length, int timeout_msecs)
1400 {
1401     /* cmd_mutex is held by vub300_cmndwork_thread */
1402     struct usb_device *usb_dev = vub300->udev;
1403     struct completion done;
1404     int retval;
1405     vub300->urb = usb_alloc_urb(0, GFP_KERNEL);
1406     if (!vub300->urb)
1407         return -ENOMEM;
1408     usb_fill_bulk_urb(vub300->urb, usb_dev, pipe, data, len,
1409               vub300_usb_bulk_msg_completion, NULL);
1410     init_completion(&done);
1411     vub300->urb->context = &done;
1412     vub300->urb->actual_length = 0;
1413     retval = usb_submit_urb(vub300->urb, GFP_KERNEL);
1414     if (unlikely(retval))
1415         goto out;
1416     if (!wait_for_completion_timeout
1417         (&done, msecs_to_jiffies(timeout_msecs))) {
1418         retval = -ETIMEDOUT;
1419         usb_kill_urb(vub300->urb);
1420     } else {
1421         retval = vub300->urb->status;
1422     }
1423 out:
1424     *actual_length = vub300->urb->actual_length;
1425     usb_free_urb(vub300->urb);
1426     vub300->urb = NULL;
1427     return retval;
1428 }
1429
1430 static int __command_read_data(struct vub300_mmc_host *vub300,
1431                    struct mmc_command *cmd, struct mmc_data *data)
1432 {
1433     /* cmd_mutex is held by vub300_cmndwork_thread */
1434     int linear_length = vub300->datasize;
1435     int padded_length = vub300->large_usb_packets ?
1436         ((511 + linear_length) >> 9) << 9 :
1437         ((63 + linear_length) >> 6) << 6;
1438     if ((padded_length == linear_length) || !pad_input_to_usb_pkt) {
1439         int result;
1440         unsigned pipe;
1441         pipe = usb_rcvbulkpipe(vub300->udev, vub300->data_inp_ep);
1442         result = usb_sg_init(&vub300->sg_request, vub300->udev,
1443                      pipe, 0, data->sg,
1444                      data->sg_len, 0, GFP_KERNEL);
1445         if (result < 0) {
1446             usb_unlink_urb(vub300->command_out_urb);
1447             usb_unlink_urb(vub300->command_res_urb);
1448             cmd->error = result;
1449             data->bytes_xfered = 0;
1450             return 0;
1451         } else {
1452             vub300->sg_transfer_timer.expires =
1453                 jiffies + msecs_to_jiffies(2000 +
1454                           (linear_length / 16384));
1455             add_timer(&vub300->sg_transfer_timer);
1456             usb_sg_wait(&vub300->sg_request);
1457             del_timer(&vub300->sg_transfer_timer);
1458             if (vub300->sg_request.status < 0) {
1459                 cmd->error = vub300->sg_request.status;
1460                 data->bytes_xfered = 0;
1461                 return 0;
1462             } else {
1463                 data->bytes_xfered = vub300->datasize;
1464                 return linear_length;
1465             }
1466         }
1467     } else {
1468         u8 *buf = kmalloc(padded_length, GFP_KERNEL);
1469         if (buf) {
1470             int result;
1471             unsigned pipe = usb_rcvbulkpipe(vub300->udev,
1472                             vub300->data_inp_ep);
1473             int actual_length = 0;
1474             result = vub300_usb_bulk_msg(vub300, pipe, buf,
1475                          padded_length, &actual_length,
1476                          2000 + (padded_length / 16384));
1477             if (result < 0) {
1478                 cmd->error = result;
1479                 data->bytes_xfered = 0;
1480                 kfree(buf);
1481                 return 0;
1482             } else if (actual_length < linear_length) {
1483                 cmd->error = -EREMOTEIO;
1484                 data->bytes_xfered = 0;
1485                 kfree(buf);
1486                 return 0;
1487             } else {
1488                 sg_copy_from_buffer(data->sg, data->sg_len, buf,
1489                             linear_length);
1490                 kfree(buf);
1491                 data->bytes_xfered = vub300->datasize;
1492                 return linear_length;
1493             }
1494         } else {
1495             cmd->error = -ENOMEM;
1496             data->bytes_xfered = 0;
1497             return 0;
1498         }
1499     }
1500 }
1501
1502 static int __command_write_data(struct vub300_mmc_host *vub300,
1503                 struct mmc_command *cmd, struct mmc_data *data)
1504 {
1505     /* cmd_mutex is held by vub300_cmndwork_thread */
1506     unsigned pipe = usb_sndbulkpipe(vub300->udev, vub300->data_out_ep);
1507     int linear_length = vub300->datasize;
1508     int modulo_64_length = linear_length & 0x003F;
1509     int modulo_512_length = linear_length & 0x01FF;
1510     if (linear_length < 64) {
1511         int result;
1512         int actual_length;
1513         sg_copy_to_buffer(data->sg, data->sg_len,
1514                   vub300->padded_buffer,
1515                   sizeof(vub300->padded_buffer));
1516         memset(vub300->padded_buffer + linear_length, 0,
1517                sizeof(vub300->padded_buffer) - linear_length);
1518         result = vub300_usb_bulk_msg(vub300, pipe, vub300->padded_buffer,
1519                          sizeof(vub300->padded_buffer),
1520                          &actual_length, 2000 +
1521                          (sizeof(vub300->padded_buffer) /
1522                           16384));
1523         if (result < 0) {
1524             cmd->error = result;
1525             data->bytes_xfered = 0;
1526         } else {
1527             data->bytes_xfered = vub300->datasize;
1528         }
1529     } else if ((!vub300->large_usb_packets && (0 < modulo_64_length)) ||
1530             (vub300->large_usb_packets && (64 > modulo_512_length))
1531         ) {     /* don't you just love these work-rounds */
1532         int padded_length = ((63 + linear_length) >> 6) << 6;
1533         u8 *buf = kmalloc(padded_length, GFP_KERNEL);
1534         if (buf) {
1535             int result;
1536             int actual_length;
1537             sg_copy_to_buffer(data->sg, data->sg_len, buf,
1538                       padded_length);
1539             memset(buf + linear_length, 0,
1540                    padded_length - linear_length);
1541             result =
1542                 vub300_usb_bulk_msg(vub300, pipe, buf,
1543                             padded_length, &actual_length,
1544                             2000 + padded_length / 16384);
1545             kfree(buf);
1546             if (result < 0) {
1547                 cmd->error = result;
1548                 data->bytes_xfered = 0;
1549             } else {
1550                 data->bytes_xfered = vub300->datasize;
1551             }
1552         } else {
1553             cmd->error = -ENOMEM;
1554             data->bytes_xfered = 0;
1555         }
1556     } else {        /* no data padding required */
1557         int result;
1558         unsigned char buf[64 * 4];
1559         sg_copy_to_buffer(data->sg, data->sg_len, buf, sizeof(buf));
1560         result = usb_sg_init(&vub300->sg_request, vub300->udev,
1561                      pipe, 0, data->sg,
1562                      data->sg_len, 0, GFP_KERNEL);
1563         if (result < 0) {
1564             usb_unlink_urb(vub300->command_out_urb);
1565             usb_unlink_urb(vub300->command_res_urb);
1566             cmd->error = result;
1567             data->bytes_xfered = 0;
1568         } else {
1569             vub300->sg_transfer_timer.expires =
1570                 jiffies + msecs_to_jiffies(2000 +
1571                                linear_length / 16384);
1572             add_timer(&vub300->sg_transfer_timer);
1573             usb_sg_wait(&vub300->sg_request);
1574             if (cmd->error) {
1575                 data->bytes_xfered = 0;
1576             } else {
1577                 del_timer(&vub300->sg_transfer_timer);
1578                 if (vub300->sg_request.status < 0) {
1579                     cmd->error = vub300->sg_request.status;
1580                     data->bytes_xfered = 0;
1581                 } else {
1582                     data->bytes_xfered = vub300->datasize;
1583                 }
1584             }
1585         }
1586     }
1587     return linear_length;
1588 }
1589
1590 static void __vub300_command_response(struct vub300_mmc_host *vub300,
1591                       struct mmc_command *cmd,
1592                       struct mmc_data *data, int data_length)
1593 {
1594     /* cmd_mutex is held by vub300_cmndwork_thread */
1595     long respretval;
1596     int msec_timeout = 1000 + data_length / 4;
1597     respretval =
1598         wait_for_completion_timeout(&vub300->command_complete,
1599                         msecs_to_jiffies(msec_timeout));
1600     if (respretval == 0) { /* TIMED OUT */
1601         /* we don't know which of "out" and "res" if any failed */
1602         int result;
1603         vub300->usb_timed_out = 1;
1604         usb_kill_urb(vub300->command_out_urb);
1605         usb_kill_urb(vub300->command_res_urb);
1606         cmd->error = -ETIMEDOUT;
1607         result = usb_lock_device_for_reset(vub300->udev,
1608                            vub300->interface);
1609         if (result == 0) {
1610             result = usb_reset_device(vub300->udev);
1611             usb_unlock_device(vub300->udev);
1612         }
1613     } else if (respretval < 0) {
1614         /* we don't know which of "out" and "res" if any failed */
1615         usb_kill_urb(vub300->command_out_urb);
1616         usb_kill_urb(vub300->command_res_urb);
1617         cmd->error = respretval;
1618     } else if (cmd->error) {
1619         /*
1620          * the error occurred sending the command
1621          * or receiving the response
1622          */
1623     } else if (vub300->command_out_urb->status) {
1624         vub300->usb_transport_fail = vub300->command_out_urb->status;
1625         cmd->error = -EPROTO == vub300->command_out_urb->status ?
1626             -ESHUTDOWN : vub300->command_out_urb->status;
1627     } else if (vub300->command_res_urb->status) {
1628         vub300->usb_transport_fail = vub300->command_res_urb->status;
1629         cmd->error = -EPROTO == vub300->command_res_urb->status ?
1630             -ESHUTDOWN : vub300->command_res_urb->status;
1631     } else if (vub300->resp.common.header_type == 0x00) {
1632         /*
1633          * the command completed successfully
1634          * and there was no piggybacked data
1635          */
1636     } else if (vub300->resp.common.header_type == RESPONSE_ERROR) {
1637         cmd->error =
1638             vub300_response_error(vub300->resp.error.error_code);
1639         if (vub300->data)
1640             usb_sg_cancel(&vub300->sg_request);
1641     } else if (vub300->resp.common.header_type == RESPONSE_PIGGYBACKED) {
1642         int offloaded_data_length =
1643             vub300->resp.common.header_size -
1644             sizeof(struct sd_register_header);
1645         int register_count = offloaded_data_length >> 3;
1646         int ri = 0;
1647         while (register_count--) {
1648             add_offloaded_reg(vub300, &vub300->resp.pig.reg[ri]);
1649             ri += 1;
1650         }
1651         vub300->resp.common.header_size =
1652             sizeof(struct sd_register_header);
1653         vub300->resp.common.header_type = 0x00;
1654         cmd->error = 0;
1655     } else if (vub300->resp.common.header_type == RESPONSE_PIG_DISABLED) {
1656         int offloaded_data_length =
1657             vub300->resp.common.header_size -
1658             sizeof(struct sd_register_header);
1659         int register_count = offloaded_data_length >> 3;
1660         int ri = 0;
1661         while (register_count--) {
1662             add_offloaded_reg(vub300, &vub300->resp.pig.reg[ri]);
1663             ri += 1;
1664         }
1665         mutex_lock(&vub300->irq_mutex);
1666         if (vub300->irqs_queued) {
1667             vub300->irqs_queued += 1;
1668         } else if (vub300->irq_enabled) {
1669             vub300->irqs_queued += 1;
1670             vub300_queue_poll_work(vub300, 0);
1671         } else {
1672             vub300->irqs_queued += 1;
1673         }
1674         vub300->irq_disabled = 1;
1675         mutex_unlock(&vub300->irq_mutex);
1676         vub300->resp.common.header_size =
1677             sizeof(struct sd_register_header);
1678         vub300->resp.common.header_type = 0x00;
1679         cmd->error = 0;
1680     } else if (vub300->resp.common.header_type == RESPONSE_PIG_ENABLED) {
1681         int offloaded_data_length =
1682             vub300->resp.common.header_size -
1683             sizeof(struct sd_register_header);
1684         int register_count = offloaded_data_length >> 3;
1685         int ri = 0;
1686         while (register_count--) {
1687             add_offloaded_reg(vub300, &vub300->resp.pig.reg[ri]);
1688             ri += 1;
1689         }
1690         mutex_lock(&vub300->irq_mutex);
1691         if (vub300->irqs_queued) {
1692             vub300->irqs_queued += 1;
1693         } else if (vub300->irq_enabled) {
1694             vub300->irqs_queued += 1;
1695             vub300_queue_poll_work(vub300, 0);
1696         } else {
1697             vub300->irqs_queued += 1;
1698         }
1699         vub300->irq_disabled = 0;
1700         mutex_unlock(&vub300->irq_mutex);
1701         vub300->resp.common.header_size =
1702             sizeof(struct sd_register_header);
1703         vub300->resp.common.header_type = 0x00;
1704         cmd->error = 0;
1705     } else {
1706         cmd->error = -EINVAL;
1707     }
1708 }
1709
1710 static void construct_request_response(struct vub300_mmc_host *vub300,
1711                        struct mmc_command *cmd)
1712 {
1713     int resp_len = vub300->resp_len;
1714     int less_cmd = (17 == resp_len) ? resp_len : resp_len - 1;
1715     int bytes = 3 & less_cmd;
1716     int words = less_cmd >> 2;
1717     u8 *r = vub300->resp.response.command_response;
1718     if (bytes == 3) {
1719         cmd->resp[words] = (r[1 + (words << 2)] << 24)
1720             | (r[2 + (words << 2)] << 16)
1721             | (r[3 + (words << 2)] << 8);
1722     } else if (bytes == 2) {
1723         cmd->resp[words] = (r[1 + (words << 2)] << 24)
1724             | (r[2 + (words << 2)] << 16);
1725     } else if (bytes == 1) {
1726         cmd->resp[words] = (r[1 + (words << 2)] << 24);
1727     }
1728     while (words-- > 0) {
1729         cmd->resp[words] = (r[1 + (words << 2)] << 24)
1730             | (r[2 + (words << 2)] << 16)
1731             | (r[3 + (words << 2)] << 8)
1732             | (r[4 + (words << 2)] << 0);
1733     }
1734     if ((cmd->opcode == 53) && (0x000000FF & cmd->resp[0]))
1735         cmd->resp[0] &= 0xFFFFFF00;
1736 }
1737
1738 /* this thread runs only when there is an upper level command req outstanding */
1739 static void vub300_cmndwork_thread(struct work_struct *work)
1740 {
1741     struct vub300_mmc_host *vub300 =
1742         container_of(work, struct vub300_mmc_host, cmndwork);
1743     if (!vub300->interface) {
1744         kref_put(&vub300->kref, vub300_delete);
1745         return;
1746     } else {
1747         struct mmc_request *req = vub300->req;
1748         struct mmc_command *cmd = vub300->cmd;
1749         struct mmc_data *data = vub300->data;
1750         int data_length;
1751         mutex_lock(&vub300->cmd_mutex);
1752         init_completion(&vub300->command_complete);
1753         if (likely(vub300->vub_name[0]) || !vub300->mmc->card) {
1754             /*
1755              * the name of the EMPTY Pseudo firmware file
1756              * is used as a flag to indicate that the file
1757              * has been already downloaded to the VUB300 chip
1758              */
1759         } else if (0 == vub300->mmc->card->sdio_funcs) {
1760             strncpy(vub300->vub_name, "SD memory device",
1761                 sizeof(vub300->vub_name));
1762         } else {
1763             download_offload_pseudocode(vub300);
1764         }
1765         send_command(vub300);
1766         if (!data)
1767             data_length = 0;
1768         else if (MMC_DATA_READ & data->flags)
1769             data_length = __command_read_data(vub300, cmd, data);
1770         else
1771             data_length = __command_write_data(vub300, cmd, data);
1772         __vub300_command_response(vub300, cmd, data, data_length);
1773         vub300->req = NULL;
1774         vub300->cmd = NULL;
1775         vub300->data = NULL;
1776         if (cmd->error) {
1777             if (cmd->error == -ENOMEDIUM)
1778                 check_vub300_port_status(vub300);
1779             mutex_unlock(&vub300->cmd_mutex);
1780             mmc_request_done(vub300->mmc, req);
1781             kref_put(&vub300->kref, vub300_delete);
1782             return;
1783         } else {
1784             construct_request_response(vub300, cmd);
1785             vub300->resp_len = 0;
1786             mutex_unlock(&vub300->cmd_mutex);
1787             kref_put(&vub300->kref, vub300_delete);
1788             mmc_request_done(vub300->mmc, req);
1789             return;
1790         }
1791     }
1792 }
1793
1794 static int examine_cyclic_buffer(struct vub300_mmc_host *vub300,
1795                  struct mmc_command *cmd, u8 Function)
1796 {
1797     /* cmd_mutex is held by vub300_mmc_request */
1798     u8 cmd0 = 0xFF & (cmd->arg >> 24);
1799     u8 cmd1 = 0xFF & (cmd->arg >> 16);
1800     u8 cmd2 = 0xFF & (cmd->arg >> 8);
1801     u8 cmd3 = 0xFF & (cmd->arg >> 0);
1802     int first = MAXREGMASK & vub300->fn[Function].offload_point;
1803     struct offload_registers_access *rf = &vub300->fn[Function].reg[first];
1804     if (cmd0 == rf->command_byte[0] &&
1805         cmd1 == rf->command_byte[1] &&
1806         cmd2 == rf->command_byte[2] &&
1807         cmd3 == rf->command_byte[3]) {
1808         u8 checksum = 0x00;
1809         cmd->resp[1] = checksum << 24;
1810         cmd->resp[0] = (rf->Respond_Byte[0] << 24)
1811             | (rf->Respond_Byte[1] << 16)
1812             | (rf->Respond_Byte[2] << 8)
1813             | (rf->Respond_Byte[3] << 0);
1814         vub300->fn[Function].offload_point += 1;
1815         vub300->fn[Function].offload_count -= 1;
1816         vub300->total_offload_count -= 1;
1817         return 1;
1818     } else {
1819         int delta = 1;  /* because it does not match the first one */
1820         u8 register_count = vub300->fn[Function].offload_count - 1;
1821         u32 register_point = vub300->fn[Function].offload_point + 1;
1822         while (0 < register_count) {
1823             int point = MAXREGMASK & register_point;
1824             struct offload_registers_access *r =
1825                 &vub300->fn[Function].reg[point];
1826             if (cmd0 == r->command_byte[0] &&
1827                 cmd1 == r->command_byte[1] &&
1828                 cmd2 == r->command_byte[2] &&
1829                 cmd3 == r->command_byte[3]) {
1830                 u8 checksum = 0x00;
1831                 cmd->resp[1] = checksum << 24;
1832                 cmd->resp[0] = (r->Respond_Byte[0] << 24)
1833                     | (r->Respond_Byte[1] << 16)
1834                     | (r->Respond_Byte[2] << 8)
1835                     | (r->Respond_Byte[3] << 0);
1836                 vub300->fn[Function].offload_point += delta;
1837                 vub300->fn[Function].offload_count -= delta;
1838                 vub300->total_offload_count -= delta;
1839                 return 1;
1840             } else {
1841                 register_point += 1;
1842                 register_count -= 1;
1843                 delta += 1;
1844                 continue;
1845             }
1846         }
1847         return 0;
1848     }
1849 }
1850
1851 static int satisfy_request_from_offloaded_data(struct vub300_mmc_host *vub300,
1852                            struct mmc_command *cmd)
1853 {
1854     /* cmd_mutex is held by vub300_mmc_request */
1855     u8 regs = vub300->dynamic_register_count;
1856     u8 i = 0;
1857     u8 func = FUN(cmd);
1858     u32 reg = REG(cmd);
1859     while (0 < regs--) {
1860         if ((vub300->sdio_register[i].func_num == func) &&
1861             (vub300->sdio_register[i].sdio_reg == reg)) {
1862             if (!vub300->sdio_register[i].prepared) {
1863                 return 0;
1864             } else if ((0x80000000 & cmd->arg) == 0x80000000) {
1865                 /*
1866                  * a write to a dynamic register
1867                  * nullifies our offloaded value
1868                  */
1869                 vub300->sdio_register[i].prepared = 0;
1870                 return 0;
1871             } else {
1872                 u8 checksum = 0x00;
1873                 u8 rsp0 = 0x00;
1874                 u8 rsp1 = 0x00;
1875                 u8 rsp2 = vub300->sdio_register[i].response;
1876                 u8 rsp3 = vub300->sdio_register[i].regvalue;
1877                 vub300->sdio_register[i].prepared = 0;
1878                 cmd->resp[1] = checksum << 24;
1879                 cmd->resp[0] = (rsp0 << 24)
1880                     | (rsp1 << 16)
1881                     | (rsp2 << 8)
1882                     | (rsp3 << 0);
1883                 return 1;
1884             }
1885         } else {
1886             i += 1;
1887             continue;
1888         }
1889     }
1890     if (vub300->total_offload_count == 0)
1891         return 0;
1892     else if (vub300->fn[func].offload_count == 0)
1893         return 0;
1894     else
1895         return examine_cyclic_buffer(vub300, cmd, func);
1896 }
1897
1898 static void vub300_mmc_request(struct mmc_host *mmc, struct mmc_request *req)
1899 {               /* NOT irq */
1900     struct mmc_command *cmd = req->cmd;
1901     struct vub300_mmc_host *vub300 = mmc_priv(mmc);
1902     if (!vub300->interface) {
1903         cmd->error = -ESHUTDOWN;
1904         mmc_request_done(mmc, req);
1905         return;
1906     } else {
1907         struct mmc_data *data = req->data;
1908         if (!vub300->card_powered) {
1909             cmd->error = -ENOMEDIUM;
1910             mmc_request_done(mmc, req);
1911             return;
1912         }
1913         if (!vub300->card_present) {
1914             cmd->error = -ENOMEDIUM;
1915             mmc_request_done(mmc, req);
1916             return;
1917         }
1918         if (vub300->usb_transport_fail) {
1919             cmd->error = vub300->usb_transport_fail;
1920             mmc_request_done(mmc, req);
1921             return;
1922         }
1923         if (!vub300->interface) {
1924             cmd->error = -ENODEV;
1925             mmc_request_done(mmc, req);
1926             return;
1927         }
1928         kref_get(&vub300->kref);
1929         mutex_lock(&vub300->cmd_mutex);
1930         mod_timer(&vub300->inactivity_timer, jiffies + HZ);
1931         /*
1932          * for performance we have to return immediately
1933          * if the requested data has been offloaded
1934          */
1935         if (cmd->opcode == 52 &&
1936             satisfy_request_from_offloaded_data(vub300, cmd)) {
1937             cmd->error = 0;
1938             mutex_unlock(&vub300->cmd_mutex);
1939             kref_put(&vub300->kref, vub300_delete);
1940             mmc_request_done(mmc, req);
1941             return;
1942         } else {
1943             vub300->cmd = cmd;
1944             vub300->req = req;
1945             vub300->data = data;
1946             if (data)
1947                 vub300->datasize = data->blksz * data->blocks;
1948             else
1949                 vub300->datasize = 0;
1950             vub300_queue_cmnd_work(vub300);
1951             mutex_unlock(&vub300->cmd_mutex);
1952             kref_put(&vub300->kref, vub300_delete);
1953             /*
1954              * the kernel lock diagnostics complain
1955              * if the cmd_mutex * is "passed on"
1956              * to the cmndwork thread,
1957              * so we must release it now
1958              * and re-acquire it in the cmndwork thread
1959              */
1960         }
1961     }
1962 }
1963
1964 static void __set_clock_speed(struct vub300_mmc_host *vub300, u8 buf[8],
1965                   struct mmc_ios *ios)
1966 {
1967     int buf_array_size = 8; /* ARRAY_SIZE(buf) does not work !!! */
1968     int retval;
1969     u32 kHzClock;
1970     if (ios->clock >= 48000000)
1971         kHzClock = 48000;
1972     else if (ios->clock >= 24000000)
1973         kHzClock = 24000;
1974     else if (ios->clock >= 20000000)
1975         kHzClock = 20000;
1976     else if (ios->clock >= 15000000)
1977         kHzClock = 15000;
1978     else if (ios->clock >= 200000)
1979         kHzClock = 200;
1980     else
1981         kHzClock = 0;
1982     {
1983         int i;
1984         u64 c = kHzClock;
1985         for (i = 0; i < buf_array_size; i++) {
1986             buf[i] = c;
1987             c >>= 8;
1988         }
1989     }
1990     retval =
1991         usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
1992                 SET_CLOCK_SPEED,
1993                 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
1994                 0x00, 0x00, buf, buf_array_size, 1000);
1995     if (retval != 8) {
1996         dev_err(&vub300->udev->dev, "SET_CLOCK_SPEED"
1997             " %dkHz failed with retval=%d\n", kHzClock, retval);
1998     } else {
1999         dev_dbg(&vub300->udev->dev, "SET_CLOCK_SPEED"
2000             " %dkHz\n", kHzClock);
2001     }
2002 }
2003
2004 static void vub300_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
2005 {               /* NOT irq */
2006     struct vub300_mmc_host *vub300 = mmc_priv(mmc);
2007     if (!vub300->interface)
2008         return;
2009     kref_get(&vub300->kref);
2010     mutex_lock(&vub300->cmd_mutex);
2011     if ((ios->power_mode == MMC_POWER_OFF) && vub300->card_powered) {
2012         vub300->card_powered = 0;
2013         usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
2014                 SET_SD_POWER,
2015                 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2016                 0x0000, 0x0000, NULL, 0, 1000);
2017         /* must wait for the VUB300 u-proc to boot up */
2018         msleep(600);
2019     } else if ((ios->power_mode == MMC_POWER_UP) && !vub300->card_powered) {
2020         usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
2021                 SET_SD_POWER,
2022                 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2023                 0x0001, 0x0000, NULL, 0, 1000);
2024         msleep(600);
2025         vub300->card_powered = 1;
2026     } else if (ios->power_mode == MMC_POWER_ON) {
2027         u8 *buf = kmalloc(8, GFP_KERNEL);
2028         if (buf) {
2029             __set_clock_speed(vub300, buf, ios);
2030             kfree(buf);
2031         }
2032     } else {
2033         /* this should mean no change of state */
2034     }
2035     mutex_unlock(&vub300->cmd_mutex);
2036     kref_put(&vub300->kref, vub300_delete);
2037 }
2038
2039 static int vub300_mmc_get_ro(struct mmc_host *mmc)
2040 {
2041     struct vub300_mmc_host *vub300 = mmc_priv(mmc);
2042     return vub300->read_only;
2043 }
2044
2045 static void vub300_enable_sdio_irq(struct mmc_host *mmc, int enable)
2046 {               /* NOT irq */
2047     struct vub300_mmc_host *vub300 = mmc_priv(mmc);
2048     if (!vub300->interface)
2049         return;
2050     kref_get(&vub300->kref);
2051     if (enable) {
2052         mutex_lock(&vub300->irq_mutex);
2053         if (vub300->irqs_queued) {
2054             vub300->irqs_queued -= 1;
2055             mmc_signal_sdio_irq(vub300->mmc);
2056         } else if (vub300->irq_disabled) {
2057             vub300->irq_disabled = 0;
2058             vub300->irq_enabled = 1;
2059             vub300_queue_poll_work(vub300, 0);
2060         } else if (vub300->irq_enabled) {
2061             /* this should not happen, so we will just ignore it */
2062         } else {
2063             vub300->irq_enabled = 1;
2064             vub300_queue_poll_work(vub300, 0);
2065         }
2066         mutex_unlock(&vub300->irq_mutex);
2067     } else {
2068         vub300->irq_enabled = 0;
2069     }
2070     kref_put(&vub300->kref, vub300_delete);
2071 }
2072
2073 static const struct mmc_host_ops vub300_mmc_ops = {
2074     .request = vub300_mmc_request,
2075     .set_ios = vub300_mmc_set_ios,
2076     .get_ro = vub300_mmc_get_ro,
2077     .enable_sdio_irq = vub300_enable_sdio_irq,
2078 };
2079
2080 static int vub300_probe(struct usb_interface *interface,
2081             const struct usb_device_id *id)
2082 {               /* NOT irq */
2083     struct vub300_mmc_host *vub300;
2084     struct usb_host_interface *iface_desc;
2085     struct usb_device *udev = usb_get_dev(interface_to_usbdev(interface));
2086     int i;
2087     int retval = -ENOMEM;
2088     struct urb *command_out_urb;
2089     struct urb *command_res_urb;
2090     struct mmc_host *mmc;
2091     char manufacturer[48];
2092     char product[32];
2093     char serial_number[32];
2094     usb_string(udev, udev->descriptor.iManufacturer, manufacturer,
2095            sizeof(manufacturer));
2096     usb_string(udev, udev->descriptor.iProduct, product, sizeof(product));
2097     usb_string(udev, udev->descriptor.iSerialNumber, serial_number,
2098            sizeof(serial_number));
2099     dev_info(&udev->dev, "probing VID:PID(%04X:%04X) %s %s %s\n",
2100          le16_to_cpu(udev->descriptor.idVendor),
2101          le16_to_cpu(udev->descriptor.idProduct),
2102          manufacturer, product, serial_number);
2103     command_out_urb = usb_alloc_urb(0, GFP_KERNEL);
2104     if (!command_out_urb) {
2105         retval = -ENOMEM;
2106         goto error0;
2107     }
2108     command_res_urb = usb_alloc_urb(0, GFP_KERNEL);
2109     if (!command_res_urb) {
2110         retval = -ENOMEM;
2111         goto error1;
2112     }
2113     /* this also allocates memory for our VUB300 mmc host device */
2114     mmc = mmc_alloc_host(sizeof(struct vub300_mmc_host), &udev->dev);
2115     if (!mmc) {
2116         retval = -ENOMEM;
2117         dev_err(&udev->dev, "not enough memory for the mmc_host\n");
2118         goto error4;
2119     }
2120     /* MMC core transfer sizes tunable parameters */
2121     mmc->caps = 0;
2122     if (!force_1_bit_data_xfers)
2123         mmc->caps |= MMC_CAP_4_BIT_DATA;
2124     if (!force_polling_for_irqs)
2125         mmc->caps |= MMC_CAP_SDIO_IRQ;
2126     mmc->caps &= ~MMC_CAP_NEEDS_POLL;
2127     /*
2128      * MMC_CAP_NEEDS_POLL causes core.c:mmc_rescan() to poll
2129      * for devices which results in spurious CMD7's being
2130      * issued which stops some SDIO cards from working
2131      */
2132     if (limit_speed_to_24_MHz) {
2133         mmc->caps |= MMC_CAP_MMC_HIGHSPEED;
2134         mmc->caps |= MMC_CAP_SD_HIGHSPEED;
2135         mmc->f_max = 24000000;
2136         dev_info(&udev->dev, "limiting SDIO speed to 24_MHz\n");
2137     } else {
2138         mmc->caps |= MMC_CAP_MMC_HIGHSPEED;
2139         mmc->caps |= MMC_CAP_SD_HIGHSPEED;
2140         mmc->f_max = 48000000;
2141     }
2142     mmc->f_min = 200000;
2143     mmc->max_blk_count = 511;
2144     mmc->max_blk_size = 512;
2145     mmc->max_segs = 128;
2146     if (force_max_req_size)
2147         mmc->max_req_size = force_max_req_size * 1024;
2148     else
2149         mmc->max_req_size = 64 * 1024;
2150     mmc->max_seg_size = mmc->max_req_size;
2151     mmc->ocr_avail = 0;
2152     mmc->ocr_avail |= MMC_VDD_165_195;
2153     mmc->ocr_avail |= MMC_VDD_20_21;
2154     mmc->ocr_avail |= MMC_VDD_21_22;
2155     mmc->ocr_avail |= MMC_VDD_22_23;
2156     mmc->ocr_avail |= MMC_VDD_23_24;
2157     mmc->ocr_avail |= MMC_VDD_24_25;
2158     mmc->ocr_avail |= MMC_VDD_25_26;
2159     mmc->ocr_avail |= MMC_VDD_26_27;
2160     mmc->ocr_avail |= MMC_VDD_27_28;
2161     mmc->ocr_avail |= MMC_VDD_28_29;
2162     mmc->ocr_avail |= MMC_VDD_29_30;
2163     mmc->ocr_avail |= MMC_VDD_30_31;
2164     mmc->ocr_avail |= MMC_VDD_31_32;
2165     mmc->ocr_avail |= MMC_VDD_32_33;
2166     mmc->ocr_avail |= MMC_VDD_33_34;
2167     mmc->ocr_avail |= MMC_VDD_34_35;
2168     mmc->ocr_avail |= MMC_VDD_35_36;
2169     mmc->ops = &vub300_mmc_ops;
2170     vub300 = mmc_priv(mmc);
2171     vub300->mmc = mmc;
2172     vub300->card_powered = 0;
2173     vub300->bus_width = 0;
2174     vub300->cmnd.head.block_size[0] = 0x00;
2175     vub300->cmnd.head.block_size[1] = 0x00;
2176     vub300->app_spec = 0;
2177     mutex_init(&vub300->cmd_mutex);
2178     mutex_init(&vub300->irq_mutex);
2179     vub300->command_out_urb = command_out_urb;
2180     vub300->command_res_urb = command_res_urb;
2181     vub300->usb_timed_out = 0;
2182     vub300->dynamic_register_count = 0;
2183
2184     for (i = 0; i < ARRAY_SIZE(vub300->fn); i++) {
2185         vub300->fn[i].offload_point = 0;
2186         vub300->fn[i].offload_count = 0;
2187     }
2188
2189     vub300->total_offload_count = 0;
2190     vub300->irq_enabled = 0;
2191     vub300->irq_disabled = 0;
2192     vub300->irqs_queued = 0;
2193
2194     for (i = 0; i < ARRAY_SIZE(vub300->sdio_register); i++)
2195         vub300->sdio_register[i++].activate = 0;
2196
2197     vub300->udev = udev;
2198     vub300->interface = interface;
2199     vub300->cmnd_res_ep = 0;
2200     vub300->cmnd_out_ep = 0;
2201     vub300->data_inp_ep = 0;
2202     vub300->data_out_ep = 0;
2203
2204     for (i = 0; i < ARRAY_SIZE(vub300->fbs); i++)
2205         vub300->fbs[i] = 512;
2206
2207     /*
2208      *      set up the endpoint information
2209      *
2210      * use the first pair of bulk-in and bulk-out
2211      *     endpoints for Command/Response+Interrupt
2212      *
2213      * use the second pair of bulk-in and bulk-out
2214      *     endpoints for Data In/Out
2215      */
2216     vub300->large_usb_packets = 0;
2217     iface_desc = interface->cur_altsetting;
2218     for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
2219         struct usb_endpoint_descriptor *endpoint =
2220             &iface_desc->endpoint[i].desc;
2221         dev_info(&vub300->udev->dev,
2222              "vub300 testing %s EndPoint(%d) %02X\n",
2223              usb_endpoint_is_bulk_in(endpoint) ? "BULK IN" :
2224              usb_endpoint_is_bulk_out(endpoint) ? "BULK OUT" :
2225              "UNKNOWN", i, endpoint->bEndpointAddress);
2226         if (endpoint->wMaxPacketSize > 64)
2227             vub300->large_usb_packets = 1;
2228         if (usb_endpoint_is_bulk_in(endpoint)) {
2229             if (!vub300->cmnd_res_ep) {
2230                 vub300->cmnd_res_ep =
2231                     endpoint->bEndpointAddress;
2232             } else if (!vub300->data_inp_ep) {
2233                 vub300->data_inp_ep =
2234                     endpoint->bEndpointAddress;
2235             } else {
2236                 dev_warn(&vub300->udev->dev,
2237                      "ignoring"
2238                      " unexpected bulk_in endpoint");
2239             }
2240         } else if (usb_endpoint_is_bulk_out(endpoint)) {
2241             if (!vub300->cmnd_out_ep) {
2242                 vub300->cmnd_out_ep =
2243                     endpoint->bEndpointAddress;
2244             } else if (!vub300->data_out_ep) {
2245                 vub300->data_out_ep =
2246                     endpoint->bEndpointAddress;
2247             } else {
2248                 dev_warn(&vub300->udev->dev,
2249                      "ignoring"
2250                      " unexpected bulk_out endpoint");
2251             }
2252         } else {
2253             dev_warn(&vub300->udev->dev,
2254                  "vub300 ignoring EndPoint(%d) %02X", i,
2255                  endpoint->bEndpointAddress);
2256         }
2257     }
2258     if (vub300->cmnd_res_ep && vub300->cmnd_out_ep &&
2259         vub300->data_inp_ep && vub300->data_out_ep) {
2260         dev_info(&vub300->udev->dev,
2261              "vub300 %s packets"
2262              " using EndPoints %02X %02X %02X %02X\n",
2263              vub300->large_usb_packets ? "LARGE" : "SMALL",
2264              vub300->cmnd_out_ep, vub300->cmnd_res_ep,
2265              vub300->data_out_ep, vub300->data_inp_ep);
2266         /* we have the expected EndPoints */
2267     } else {
2268         dev_err(&vub300->udev->dev,
2269             "Could not find two sets of bulk-in/out endpoint pairs\n");
2270         retval = -EINVAL;
2271         goto error5;
2272     }
2273     retval =
2274         usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
2275                 GET_HC_INF0,
2276                 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2277                 0x0000, 0x0000, &vub300->hc_info,
2278                 sizeof(vub300->hc_info), 1000);
2279     if (retval < 0)
2280         goto error5;
2281     retval =
2282         usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
2283                 SET_ROM_WAIT_STATES,
2284                 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2285                 firmware_rom_wait_states, 0x0000, NULL, 0, 1000);
2286     if (retval < 0)
2287         goto error5;
2288     dev_info(&vub300->udev->dev,
2289          "operating_mode = %s %s %d MHz %s %d byte USB packets\n",
2290          (mmc->caps & MMC_CAP_SDIO_IRQ) ? "IRQs" : "POLL",
2291          (mmc->caps & MMC_CAP_4_BIT_DATA) ? "4-bit" : "1-bit",
2292          mmc->f_max / 1000000,
2293          pad_input_to_usb_pkt ? "padding input data to" : "with",
2294          vub300->large_usb_packets ? 512 : 64);
2295     retval =
2296         usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
2297                 GET_SYSTEM_PORT_STATUS,
2298                 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2299                 0x0000, 0x0000, &vub300->system_port_status,
2300                 sizeof(vub300->system_port_status), 1000);
2301     if (retval < 0) {
2302         goto error4;
2303     } else if (sizeof(vub300->system_port_status) == retval) {
2304         vub300->card_present =
2305             (0x0001 & vub300->system_port_status.port_flags) ? 1 : 0;
2306         vub300->read_only =
2307             (0x0010 & vub300->system_port_status.port_flags) ? 1 : 0;
2308     } else {
2309         goto error4;
2310     }
2311     usb_set_intfdata(interface, vub300);
2312     INIT_DELAYED_WORK(&vub300->pollwork, vub300_pollwork_thread);
2313     INIT_WORK(&vub300->cmndwork, vub300_cmndwork_thread);
2314     INIT_WORK(&vub300->deadwork, vub300_deadwork_thread);
2315     kref_init(&vub300->kref);
2316     timer_setup(&vub300->sg_transfer_timer, vub300_sg_timed_out, 0);
2317     kref_get(&vub300->kref);
2318     timer_setup(&vub300->inactivity_timer,
2319             vub300_inactivity_timer_expired, 0);
2320     vub300->inactivity_timer.expires = jiffies + HZ;
2321     add_timer(&vub300->inactivity_timer);
2322     if (vub300->card_present)
2323         dev_info(&vub300->udev->dev,
2324              "USB vub300 remote SDIO host controller[%d]"
2325              "connected with SD/SDIO card inserted\n",
2326              interface_to_InterfaceNumber(interface));
2327     else
2328         dev_info(&vub300->udev->dev,
2329              "USB vub300 remote SDIO host controller[%d]"
2330              "connected with no SD/SDIO card inserted\n",
2331              interface_to_InterfaceNumber(interface));
2332     mmc_add_host(mmc);
2333     return 0;
2334 error5:
2335     mmc_free_host(mmc);
2336     /*
2337      * and hence also frees vub300
2338      * which is contained at the end of struct mmc
2339      */
2340 error4:
2341     usb_free_urb(command_res_urb);
2342 error1:
2343     usb_free_urb(command_out_urb);
2344 error0:
2345     usb_put_dev(udev);
2346     return retval;
2347 }
2348
2349 static void vub300_disconnect(struct usb_interface *interface)
2350 {               /* NOT irq */
2351     struct vub300_mmc_host *vub300 = usb_get_intfdata(interface);
2352     if (!vub300 || !vub300->mmc) {
2353         return;
2354     } else {
2355         struct mmc_host *mmc = vub300->mmc;
2356         if (!vub300->mmc) {
2357             return;
2358         } else {
2359             int ifnum = interface_to_InterfaceNumber(interface);
2360             usb_set_intfdata(interface, NULL);
2361             /* prevent more I/O from starting */
2362             vub300->interface = NULL;
2363             kref_put(&vub300->kref, vub300_delete);
2364             mmc_remove_host(mmc);
2365             pr_info("USB vub300 remote SDIO host controller[%d]"
2366                 " now disconnected", ifnum);
2367             return;
2368         }
2369     }
2370 }
2371
2372 #ifdef CONFIG_PM
2373 static int vub300_suspend(struct usb_interface *intf, pm_message_t message)
2374 {
2375     return 0;
2376 }
2377
2378 static int vub300_resume(struct usb_interface *intf)
2379 {
2380     return 0;
2381 }
2382 #else
2383 #define vub300_suspend NULL
2384 #define vub300_resume NULL
2385 #endif
2386 static int vub300_pre_reset(struct usb_interface *intf)
2387 {               /* NOT irq */
2388     struct vub300_mmc_host *vub300 = usb_get_intfdata(intf);
2389     mutex_lock(&vub300->cmd_mutex);
2390     return 0;
2391 }
2392
2393 static int vub300_post_reset(struct usb_interface *intf)
2394 {               /* NOT irq */
2395     struct vub300_mmc_host *vub300 = usb_get_intfdata(intf);
2396     /* we are sure no URBs are active - no locking needed */
2397     vub300->errors = -EPIPE;
2398     mutex_unlock(&vub300->cmd_mutex);
2399     return 0;
2400 }
2401
2402 static struct usb_driver vub300_driver = {
2403     .name = "vub300",
2404     .probe = vub300_probe,
2405     .disconnect = vub300_disconnect,
2406     .suspend = vub300_suspend,
2407     .resume = vub300_resume,
2408     .pre_reset = vub300_pre_reset,
2409     .post_reset = vub300_post_reset,
2410     .id_table = vub300_table,
2411     .supports_autosuspend = 1,
2412 };
2413
2414 static int __init vub300_init(void)
2415 {               /* NOT irq */
2416     int result;
2417
2418     pr_info("VUB300 Driver rom wait states = %02X irqpoll timeout = %04X",
2419         firmware_rom_wait_states, 0x0FFFF & firmware_irqpoll_timeout);
2420     cmndworkqueue = create_singlethread_workqueue("kvub300c");
2421     if (!cmndworkqueue) {
2422         pr_err("not enough memory for the REQUEST workqueue");
2423         result = -ENOMEM;
2424         goto out1;
2425     }
2426     pollworkqueue = create_singlethread_workqueue("kvub300p");
2427     if (!pollworkqueue) {
2428         pr_err("not enough memory for the IRQPOLL workqueue");
2429         result = -ENOMEM;
2430         goto out2;
2431     }
2432     deadworkqueue = create_singlethread_workqueue("kvub300d");
2433     if (!deadworkqueue) {
2434         pr_err("not enough memory for the EXPIRED workqueue");
2435         result = -ENOMEM;
2436         goto out3;
2437     }
2438     result = usb_register(&vub300_driver);
2439     if (result) {
2440         pr_err("usb_register failed. Error number %d", result);
2441         goto out4;
2442     }
2443     return 0;
2444 out4:
2445     destroy_workqueue(deadworkqueue);
2446 out3:
2447     destroy_workqueue(pollworkqueue);
2448 out2:
2449     destroy_workqueue(cmndworkqueue);
2450 out1:
2451     return result;
2452 }
2453
2454 static void __exit vub300_exit(void)
2455 {
2456     usb_deregister(&vub300_driver);
2457     flush_workqueue(cmndworkqueue);
2458     flush_workqueue(pollworkqueue);
2459     flush_workqueue(deadworkqueue);
2460     destroy_workqueue(cmndworkqueue);
2461     destroy_workqueue(pollworkqueue);
2462     destroy_workqueue(deadworkqueue);
2463 }
2464
2465 module_init(vub300_init);
2466 module_exit(vub300_exit);
2467
2468 MODULE_AUTHOR("Tony Olech <tony.olech@elandigitalsystems.com>");
2469 MODULE_DESCRIPTION("VUB300 USB to SD/MMC/SDIO adapter driver");
2470 MODULE_LICENSE("GPL");