drivers/mmc/host/vub300.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Remote VUB300 SDIO/SDmem Host Controller Driver
   4  *
   5  * Copyright (C) 2010 Elan Digital Systems Limited
   6  *
   7  * based on USB Skeleton driver - 2.2
   8  *
   9  * Copyright (C) 2001-2004 Greg Kroah-Hartman (greg@kroah.com)
  10  *
  11  * VUB300: is a USB 2.0 client device with a single SDIO/SDmem/MMC slot
  12  *         Any SDIO/SDmem/MMC device plugged into the VUB300 will appear,
  13  *         by virtue of this driver, to have been plugged into a local
  14  *         SDIO host controller, similar to, say, a PCI Ricoh controller
  15  *         This is because this kernel device driver is both a USB 2.0
  16  *         client device driver AND an MMC host controller driver. Thus
  17  *         if there is an existing driver for the inserted SDIO/SDmem/MMC
  18  *         device then that driver will be used by the kernel to manage
  19  *         the device in exactly the same fashion as if it had been
  20  *         directly plugged into, say, a local pci bus Ricoh controller
  21  *
  22  * RANT: this driver was written using a display 128x48 - converting it
  23  *       to a line width of 80 makes it very difficult to support. In
  24  *       particular functions have been broken down into sub functions
  25  *       and the original meaningful names have been shortened into
  26  *       cryptic ones.
  27  *       The problem is that executing a fragment of code subject to
  28  *       two conditions means an indentation of 24, thus leaving only
  29  *       56 characters for a C statement. And that is quite ridiculous!
  30  *
  31  * Data types: data passed to/from the VUB300 is fixed to a number of
  32  *             bits and driver data fields reflect that limit by using
  33  *             u8, u16, u32
  34  */
  35 #include <linux/kernel.h>
  36 #include <linux/errno.h>
  37 #include <linux/init.h>
  38 #include <linux/slab.h>
  39 #include <linux/module.h>
  40 #include <linux/kref.h>
  41 #include <linux/uaccess.h>
  42 #include <linux/usb.h>
  43 #include <linux/mutex.h>
  44 #include <linux/mmc/host.h>
  45 #include <linux/mmc/card.h>
  46 #include <linux/mmc/sdio_func.h>
  47 #include <linux/mmc/sdio_ids.h>
  48 #include <linux/workqueue.h>
  49 #include <linux/ctype.h>
  50 #include <linux/firmware.h>
  51 #include <linux/scatterlist.h>
  52
  53 struct host_controller_info {
  54         u8 info_size;
  55         u16 firmware_version;
  56         u8 number_of_ports;
  57 } __packed;
  58
  59 #define FIRMWARE_BLOCK_BOUNDARY 1024
  60 struct sd_command_header {
  61         u8 header_size;
  62         u8 header_type;
  63         u8 port_number;
  64         u8 command_type; /* Bit7 - Rd/Wr */
  65         u8 command_index;
  66         u8 transfer_size[4]; /* ReadSize + ReadSize */
  67         u8 response_type;
  68         u8 arguments[4];
  69         u8 block_count[2];
  70         u8 block_size[2];
  71         u8 block_boundary[2];
  72         u8 reserved[44]; /* to pad out to 64 bytes */
  73 } __packed;
  74
  75 struct sd_irqpoll_header {
  76         u8 header_size;
  77         u8 header_type;
  78         u8 port_number;
  79         u8 command_type; /* Bit7 - Rd/Wr */
  80         u8 padding[16]; /* don't ask why !! */
  81         u8 poll_timeout_msb;
  82         u8 poll_timeout_lsb;
  83         u8 reserved[42]; /* to pad out to 64 bytes */
  84 } __packed;
  85
  86 struct sd_common_header {
  87         u8 header_size;
  88         u8 header_type;
  89         u8 port_number;
  90 } __packed;
  91
  92 struct sd_response_header {
  93         u8 header_size;
  94         u8 header_type;
  95         u8 port_number;
  96         u8 command_type;
  97         u8 command_index;
  98         u8 command_response[];
  99 } __packed;
 100
 101 struct sd_status_header {
 102         u8 header_size;
 103         u8 header_type;
 104         u8 port_number;
 105         u16 port_flags;
 106         u32 sdio_clock;
 107         u16 host_header_size;
 108         u16 func_header_size;
 109         u16 ctrl_header_size;
 110 } __packed;
 111
 112 struct sd_error_header {
 113         u8 header_size;
 114         u8 header_type;
 115         u8 port_number;
 116         u8 error_code;
 117 } __packed;
 118
 119 struct sd_interrupt_header {
 120         u8 header_size;
 121         u8 header_type;
 122         u8 port_number;
 123 } __packed;
 124
 125 struct offload_registers_access {
 126         u8 command_byte[4];
 127         u8 Respond_Byte[4];
 128 } __packed;
 129
 130 #define INTERRUPT_REGISTER_ACCESSES 15
 131 struct sd_offloaded_interrupt {
 132         u8 header_size;
 133         u8 header_type;
 134         u8 port_number;
 135         struct offload_registers_access reg[INTERRUPT_REGISTER_ACCESSES];
 136 } __packed;
 137
 138 struct sd_register_header {
 139         u8 header_size;
 140         u8 header_type;
 141         u8 port_number;
 142         u8 command_type;
 143         u8 command_index;
 144         u8 command_response[6];
 145 } __packed;
 146
 147 #define PIGGYBACK_REGISTER_ACCESSES 14
 148 struct sd_offloaded_piggyback {
 149         struct sd_register_header sdio;
 150         struct offload_registers_access reg[PIGGYBACK_REGISTER_ACCESSES];
 151 } __packed;
 152
 153 union sd_response {
 154         struct sd_common_header common;
 155         struct sd_status_header status;
 156         struct sd_error_header error;
 157         struct sd_interrupt_header interrupt;
 158         struct sd_response_header response;
 159         struct sd_offloaded_interrupt irq;
 160         struct sd_offloaded_piggyback pig;
 161 } __packed;
 162
 163 union sd_command {
 164         struct sd_command_header head;
 165         struct sd_irqpoll_header poll;
 166 } __packed;
 167
 168 enum SD_RESPONSE_TYPE {
 169         SDRT_UNSPECIFIED = 0,
 170         SDRT_NONE,
 171         SDRT_1,
 172         SDRT_1B,
 173         SDRT_2,
 174         SDRT_3,
 175         SDRT_4,
 176         SDRT_5,
 177         SDRT_5B,
 178         SDRT_6,
 179         SDRT_7,
 180 };
 181
 182 #define RESPONSE_INTERRUPT                      0x01
 183 #define RESPONSE_ERROR                          0x02
 184 #define RESPONSE_STATUS                         0x03
 185 #define RESPONSE_IRQ_DISABLED                   0x05
 186 #define RESPONSE_IRQ_ENABLED                    0x06
 187 #define RESPONSE_PIGGYBACKED                    0x07
 188 #define RESPONSE_NO_INTERRUPT                   0x08
 189 #define RESPONSE_PIG_DISABLED                   0x09
 190 #define RESPONSE_PIG_ENABLED                    0x0A
 191 #define SD_ERROR_1BIT_TIMEOUT                   0x01
 192 #define SD_ERROR_4BIT_TIMEOUT                   0x02
 193 #define SD_ERROR_1BIT_CRC_WRONG                 0x03
 194 #define SD_ERROR_4BIT_CRC_WRONG                 0x04
 195 #define SD_ERROR_1BIT_CRC_ERROR                 0x05
 196 #define SD_ERROR_4BIT_CRC_ERROR                 0x06
 197 #define SD_ERROR_NO_CMD_ENDBIT                  0x07
 198 #define SD_ERROR_NO_1BIT_DATEND                 0x08
 199 #define SD_ERROR_NO_4BIT_DATEND                 0x09
 200 #define SD_ERROR_1BIT_UNEXPECTED_TIMEOUT        0x0A
 201 #define SD_ERROR_4BIT_UNEXPECTED_TIMEOUT        0x0B
 202 #define SD_ERROR_ILLEGAL_COMMAND                0x0C
 203 #define SD_ERROR_NO_DEVICE                      0x0D
 204 #define SD_ERROR_TRANSFER_LENGTH                0x0E
 205 #define SD_ERROR_1BIT_DATA_TIMEOUT              0x0F
 206 #define SD_ERROR_4BIT_DATA_TIMEOUT              0x10
 207 #define SD_ERROR_ILLEGAL_STATE                  0x11
 208 #define SD_ERROR_UNKNOWN_ERROR                  0x12
 209 #define SD_ERROR_RESERVED_ERROR                 0x13
 210 #define SD_ERROR_INVALID_FUNCTION               0x14
 211 #define SD_ERROR_OUT_OF_RANGE                   0x15
 212 #define SD_ERROR_STAT_CMD                       0x16
 213 #define SD_ERROR_STAT_DATA                      0x17
 214 #define SD_ERROR_STAT_CMD_TIMEOUT               0x18
 215 #define SD_ERROR_SDCRDY_STUCK                   0x19
 216 #define SD_ERROR_UNHANDLED                      0x1A
 217 #define SD_ERROR_OVERRUN                        0x1B
 218 #define SD_ERROR_PIO_TIMEOUT                    0x1C
 219
 220 #define FUN(c) (0x000007 & (c->arg>>28))
 221 #define REG(c) (0x01FFFF & (c->arg>>9))
 222
 223 static bool limit_speed_to_24_MHz;
 224 module_param(limit_speed_to_24_MHz, bool, 0644);
 225 MODULE_PARM_DESC(limit_speed_to_24_MHz, "Limit Max SDIO Clock Speed to 24 MHz");
 226
 227 static bool pad_input_to_usb_pkt;
 228 module_param(pad_input_to_usb_pkt, bool, 0644);
 229 MODULE_PARM_DESC(pad_input_to_usb_pkt,
 230                  "Pad USB data input transfers to whole USB Packet");
 231
 232 static bool disable_offload_processing;
 233 module_param(disable_offload_processing, bool, 0644);
 234 MODULE_PARM_DESC(disable_offload_processing, "Disable Offload Processing");
 235
 236 static bool force_1_bit_data_xfers;
 237 module_param(force_1_bit_data_xfers, bool, 0644);
 238 MODULE_PARM_DESC(force_1_bit_data_xfers,
 239                  "Force SDIO Data Transfers to 1-bit Mode");
 240
 241 static bool force_polling_for_irqs;
 242 module_param(force_polling_for_irqs, bool, 0644);
 243 MODULE_PARM_DESC(force_polling_for_irqs, "Force Polling for SDIO interrupts");
 244
 245 static int firmware_irqpoll_timeout = 1024;
 246 module_param(firmware_irqpoll_timeout, int, 0644);
 247 MODULE_PARM_DESC(firmware_irqpoll_timeout, "VUB300 firmware irqpoll timeout");
 248
 249 static int force_max_req_size = 128;
 250 module_param(force_max_req_size, int, 0644);
 251 MODULE_PARM_DESC(force_max_req_size, "set max request size in kBytes");
 252
 253 #ifdef SMSC_DEVELOPMENT_BOARD
 254 static int firmware_rom_wait_states = 0x04;
 255 #else
 256 static int firmware_rom_wait_states = 0x1C;
 257 #endif
 258
 259 module_param(firmware_rom_wait_states, int, 0644);
 260 MODULE_PARM_DESC(firmware_rom_wait_states,
 261                  "ROM wait states byte=RRRIIEEE (Reserved Internal External)");
 262
 263 #define ELAN_VENDOR_ID          0x2201
 264 #define VUB300_VENDOR_ID        0x0424
 265 #define VUB300_PRODUCT_ID       0x012C
 266 static const struct usb_device_id vub300_table[] = {
 267         {USB_DEVICE(ELAN_VENDOR_ID, VUB300_PRODUCT_ID)},
 268         {USB_DEVICE(VUB300_VENDOR_ID, VUB300_PRODUCT_ID)},
 269         {} /* Terminating entry */
 270 };
 271 MODULE_DEVICE_TABLE(usb, vub300_table);
 272
 273 static struct workqueue_struct *cmndworkqueue;
 274 static struct workqueue_struct *pollworkqueue;
 275 static struct workqueue_struct *deadworkqueue;
 276
 277 static inline int interface_to_InterfaceNumber(struct usb_interface *interface)
 278 {
 279         if (!interface)
 280                 return -1;
 281         if (!interface->cur_altsetting)
 282                 return -1;
 283         return interface->cur_altsetting->desc.bInterfaceNumber;
 284 }
 285
 286 struct sdio_register {
 287         unsigned func_num:3;
 288         unsigned sdio_reg:17;
 289         unsigned activate:1;
 290         unsigned prepared:1;
 291         unsigned regvalue:8;
 292         unsigned response:8;
 293         unsigned sparebit:26;
 294 };
 295
 296 struct vub300_mmc_host {
 297         struct usb_device *udev;
 298         struct usb_interface *interface;
 299         struct kref kref;
 300         struct mutex cmd_mutex;
 301         struct mutex irq_mutex;
 302         char vub_name[3 + (9 * 8) + 4 + 1]; /* max of 7 sdio fn's */
 303         u8 cmnd_out_ep; /* EndPoint for commands */
 304         u8 cmnd_res_ep; /* EndPoint for responses */
 305         u8 data_out_ep; /* EndPoint for out data */
 306         u8 data_inp_ep; /* EndPoint for inp data */
 307         bool card_powered;
 308         bool card_present;
 309         bool read_only;
 310         bool large_usb_packets;
 311         bool app_spec; /* ApplicationSpecific */
 312         bool irq_enabled; /* by the MMC CORE */
 313         bool irq_disabled; /* in the firmware */
 314         unsigned bus_width:4;
 315         u8 total_offload_count;
 316         u8 dynamic_register_count;
 317         u8 resp_len;
 318         u32 datasize;
 319         int errors;
 320         int usb_transport_fail;
 321         int usb_timed_out;
 322         int irqs_queued;
 323         struct sdio_register sdio_register[16];
 324         struct offload_interrupt_function_register {
 325 #define MAXREGBITS 4
 326 #define MAXREGS (1<<MAXREGBITS)
 327 #define MAXREGMASK (MAXREGS-1)
 328                 u8 offload_count;
 329                 u32 offload_point;
 330                 struct offload_registers_access reg[MAXREGS];
 331         } fn[8];
 332         u16 fbs[8]; /* Function Block Size */
 333         struct mmc_command *cmd;
 334         struct mmc_request *req;
 335         struct mmc_data *data;
 336         struct mmc_host *mmc;
 337         struct urb *urb;
 338         struct urb *command_out_urb;
 339         struct urb *command_res_urb;
 340         struct completion command_complete;
 341         struct completion irqpoll_complete;
 342         union sd_command cmnd;
 343         union sd_response resp;
 344         struct timer_list sg_transfer_timer;
 345         struct usb_sg_request sg_request;
 346         struct timer_list inactivity_timer;
 347         struct work_struct deadwork;
 348         struct work_struct cmndwork;
 349         struct delayed_work pollwork;
 350         struct host_controller_info hc_info;
 351         struct sd_status_header system_port_status;
 352         u8 padded_buffer[64];
 353 };
 354
 355 #define kref_to_vub300_mmc_host(d) container_of(d, struct vub300_mmc_host, kref)
 356 #define SET_TRANSFER_PSEUDOCODE         21
 357 #define SET_INTERRUPT_PSEUDOCODE        20
 358 #define SET_FAILURE_MODE                18
 359 #define SET_ROM_WAIT_STATES             16
 360 #define SET_IRQ_ENABLE                  13
 361 #define SET_CLOCK_SPEED                 11
 362 #define SET_FUNCTION_BLOCK_SIZE         9
 363 #define SET_SD_DATA_MODE                6
 364 #define SET_SD_POWER                    4
 365 #define ENTER_DFU_MODE                  3
 366 #define GET_HC_INF0                     1
 367 #define GET_SYSTEM_PORT_STATUS          0
 368
 369 static void vub300_delete(struct kref *kref)
 370 {                               /* kref callback - softirq */
 371         struct vub300_mmc_host *vub300 = kref_to_vub300_mmc_host(kref);
 372         struct mmc_host *mmc = vub300->mmc;
 373         usb_free_urb(vub300->command_out_urb);
 374         vub300->command_out_urb = NULL;
 375         usb_free_urb(vub300->command_res_urb);
 376         vub300->command_res_urb = NULL;
 377         usb_put_dev(vub300->udev);
 378         mmc_free_host(mmc);
 379         /*
 380          * and hence also frees vub300
 381          * which is contained at the end of struct mmc
 382          */
 383 }
 384
 385 static void vub300_queue_cmnd_work(struct vub300_mmc_host *vub300)
 386 {
 387         kref_get(&vub300->kref);
 388         if (queue_work(cmndworkqueue, &vub300->cmndwork)) {
 389                 /*
 390                  * then the cmndworkqueue was not previously
 391                  * running and the above get ref is obvious
 392                  * required and will be put when the thread
 393                  * terminates by a specific call
 394                  */
 395         } else {
 396                 /*
 397                  * the cmndworkqueue was already running from
 398                  * a previous invocation and thus to keep the
 399                  * kref counts correct we must undo the get
 400                  */
 401                 kref_put(&vub300->kref, vub300_delete);
 402         }
 403 }
 404
 405 static void vub300_queue_poll_work(struct vub300_mmc_host *vub300, int delay)
 406 {
 407         kref_get(&vub300->kref);
 408         if (queue_delayed_work(pollworkqueue, &vub300->pollwork, delay)) {
 409                 /*
 410                  * then the pollworkqueue was not previously
 411                  * running and the above get ref is obvious
 412                  * required and will be put when the thread
 413                  * terminates by a specific call
 414                  */
 415         } else {
 416                 /*
 417                  * the pollworkqueue was already running from
 418                  * a previous invocation and thus to keep the
 419                  * kref counts correct we must undo the get
 420                  */
 421                 kref_put(&vub300->kref, vub300_delete);
 422         }
 423 }
 424
 425 static void vub300_queue_dead_work(struct vub300_mmc_host *vub300)
 426 {
 427         kref_get(&vub300->kref);
 428         if (queue_work(deadworkqueue, &vub300->deadwork)) {
 429                 /*
 430                  * then the deadworkqueue was not previously
 431                  * running and the above get ref is obvious
 432                  * required and will be put when the thread
 433                  * terminates by a specific call
 434                  */
 435         } else {
 436                 /*
 437                  * the deadworkqueue was already running from
 438                  * a previous invocation and thus to keep the
 439                  * kref counts correct we must undo the get
 440                  */
 441                 kref_put(&vub300->kref, vub300_delete);
 442         }
 443 }
 444
 445 static void irqpoll_res_completed(struct urb *urb)
 446 {                               /* urb completion handler - hardirq */
 447         struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
 448         if (urb->status)
 449                 vub300->usb_transport_fail = urb->status;
 450         complete(&vub300->irqpoll_complete);
 451 }
 452
 453 static void irqpoll_out_completed(struct urb *urb)
 454 {                               /* urb completion handler - hardirq */
 455         struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
 456         if (urb->status) {
 457                 vub300->usb_transport_fail = urb->status;
 458                 complete(&vub300->irqpoll_complete);
 459                 return;
 460         } else {
 461                 int ret;
 462                 unsigned int pipe =
 463                         usb_rcvbulkpipe(vub300->udev, vub300->cmnd_res_ep);
 464                 usb_fill_bulk_urb(vub300->command_res_urb, vub300->udev, pipe,
 465                                   &vub300->resp, sizeof(vub300->resp),
 466                                   irqpoll_res_completed, vub300);
 467                 vub300->command_res_urb->actual_length = 0;
 468                 ret = usb_submit_urb(vub300->command_res_urb, GFP_ATOMIC);
 469                 if (ret) {
 470                         vub300->usb_transport_fail = ret;
 471                         complete(&vub300->irqpoll_complete);
 472                 }
 473                 return;
 474         }
 475 }
 476
 477 static void send_irqpoll(struct vub300_mmc_host *vub300)
 478 {
 479         /* cmd_mutex is held by vub300_pollwork_thread */
 480         int retval;
 481         int timeout = 0xFFFF & (0x0001FFFF - firmware_irqpoll_timeout);
 482         vub300->cmnd.poll.header_size = 22;
 483         vub300->cmnd.poll.header_type = 1;
 484         vub300->cmnd.poll.port_number = 0;
 485         vub300->cmnd.poll.command_type = 2;
 486         vub300->cmnd.poll.poll_timeout_lsb = 0xFF & (unsigned)timeout;
 487         vub300->cmnd.poll.poll_timeout_msb = 0xFF & (unsigned)(timeout >> 8);
 488         usb_fill_bulk_urb(vub300->command_out_urb, vub300->udev,
 489                           usb_sndbulkpipe(vub300->udev, vub300->cmnd_out_ep)
 490                           , &vub300->cmnd, sizeof(vub300->cmnd)
 491                           , irqpoll_out_completed, vub300);
 492         retval = usb_submit_urb(vub300->command_out_urb, GFP_KERNEL);
 493         if (0 > retval) {
 494                 vub300->usb_transport_fail = retval;
 495                 vub300_queue_poll_work(vub300, 1);
 496                 complete(&vub300->irqpoll_complete);
 497                 return;
 498         } else {
 499                 return;
 500         }
 501 }
 502
 503 static void new_system_port_status(struct vub300_mmc_host *vub300)
 504 {
 505         int old_card_present = vub300->card_present;
 506         int new_card_present =
 507                 (0x0001 & vub300->system_port_status.port_flags) ? 1 : 0;
 508         vub300->read_only =
 509                 (0x0010 & vub300->system_port_status.port_flags) ? 1 : 0;
 510         if (new_card_present && !old_card_present) {
 511                 dev_info(&vub300->udev->dev, "card just inserted\n");
 512                 vub300->card_present = 1;
 513                 vub300->bus_width = 0;
 514                 if (disable_offload_processing)
 515                         strncpy(vub300->vub_name, "EMPTY Processing Disabled",
 516                                 sizeof(vub300->vub_name));
 517                 else
 518                         vub300->vub_name[0] = 0;
 519                 mmc_detect_change(vub300->mmc, 1);
 520         } else if (!new_card_present && old_card_present) {
 521                 dev_info(&vub300->udev->dev, "card just ejected\n");
 522                 vub300->card_present = 0;
 523                 mmc_detect_change(vub300->mmc, 0);
 524         } else {
 525                 /* no change */
 526         }
 527 }
 528
 529 static void __add_offloaded_reg_to_fifo(struct vub300_mmc_host *vub300,
 530                                         struct offload_registers_access
 531                                         *register_access, u8 func)
 532 {
 533         u8 r = vub300->fn[func].offload_point + vub300->fn[func].offload_count;
 534         memcpy(&vub300->fn[func].reg[MAXREGMASK & r], register_access,
 535                sizeof(struct offload_registers_access));
 536         vub300->fn[func].offload_count += 1;
 537         vub300->total_offload_count += 1;
 538 }
 539
 540 static void add_offloaded_reg(struct vub300_mmc_host *vub300,
 541                               struct offload_registers_access *register_access)
 542 {
 543         u32 Register = ((0x03 & register_access->command_byte[0]) << 15)
 544                         | ((0xFF & register_access->command_byte[1]) << 7)
 545                         | ((0xFE & register_access->command_byte[2]) >> 1);
 546         u8 func = ((0x70 & register_access->command_byte[0]) >> 4);
 547         u8 regs = vub300->dynamic_register_count;
 548         u8 i = 0;
 549         while (0 < regs-- && 1 == vub300->sdio_register[i].activate) {
 550                 if (vub300->sdio_register[i].func_num == func &&
 551                     vub300->sdio_register[i].sdio_reg == Register) {
 552                         if (vub300->sdio_register[i].prepared == 0)
 553                                 vub300->sdio_register[i].prepared = 1;
 554                         vub300->sdio_register[i].response =
 555                                 register_access->Respond_Byte[2];
 556                         vub300->sdio_register[i].regvalue =
 557                                 register_access->Respond_Byte[3];
 558                         return;
 559                 } else {
 560                         i += 1;
 561                         continue;
 562                 }
 563         }
 564         __add_offloaded_reg_to_fifo(vub300, register_access, func);
 565 }
 566
 567 static void check_vub300_port_status(struct vub300_mmc_host *vub300)
 568 {
 569         /*
 570          * cmd_mutex is held by vub300_pollwork_thread,
 571          * vub300_deadwork_thread or vub300_cmndwork_thread
 572          */
 573         int retval;
 574         retval =
 575                 usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
 576                                 GET_SYSTEM_PORT_STATUS,
 577                                 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 578                                 0x0000, 0x0000, &vub300->system_port_status,
 579                                 sizeof(vub300->system_port_status), 1000);
 580         if (sizeof(vub300->system_port_status) == retval)
 581                 new_system_port_status(vub300);
 582 }
 583
 584 static void __vub300_irqpoll_response(struct vub300_mmc_host *vub300)
 585 {
 586         /* cmd_mutex is held by vub300_pollwork_thread */
 587         if (vub300->command_res_urb->actual_length == 0)
 588                 return;
 589
 590         switch (vub300->resp.common.header_type) {
 591         case RESPONSE_INTERRUPT:
 592                 mutex_lock(&vub300->irq_mutex);
 593                 if (vub300->irq_enabled)
 594                         mmc_signal_sdio_irq(vub300->mmc);
 595                 else
 596                         vub300->irqs_queued += 1;
 597                 vub300->irq_disabled = 1;
 598                 mutex_unlock(&vub300->irq_mutex);
 599                 break;
 600         case RESPONSE_ERROR:
 601                 if (vub300->resp.error.error_code == SD_ERROR_NO_DEVICE)
 602                         check_vub300_port_status(vub300);
 603                 break;
 604         case RESPONSE_STATUS:
 605                 vub300->system_port_status = vub300->resp.status;
 606                 new_system_port_status(vub300);
 607                 if (!vub300->card_present)
 608                         vub300_queue_poll_work(vub300, HZ / 5);
 609                 break;
 610         case RESPONSE_IRQ_DISABLED:
 611         {
 612                 int offloaded_data_length = vub300->resp.common.header_size - 3;
 613                 int register_count = offloaded_data_length >> 3;
 614                 int ri = 0;
 615                 while (register_count--) {
 616                         add_offloaded_reg(vub300, &vub300->resp.irq.reg[ri]);
 617                         ri += 1;
 618                 }
 619                 mutex_lock(&vub300->irq_mutex);
 620                 if (vub300->irq_enabled)
 621                         mmc_signal_sdio_irq(vub300->mmc);
 622                 else
 623                         vub300->irqs_queued += 1;
 624                 vub300->irq_disabled = 1;
 625                 mutex_unlock(&vub300->irq_mutex);
 626                 break;
 627         }
 628         case RESPONSE_IRQ_ENABLED:
 629         {
 630                 int offloaded_data_length = vub300->resp.common.header_size - 3;
 631                 int register_count = offloaded_data_length >> 3;
 632                 int ri = 0;
 633                 while (register_count--) {
 634                         add_offloaded_reg(vub300, &vub300->resp.irq.reg[ri]);
 635                         ri += 1;
 636                 }
 637                 mutex_lock(&vub300->irq_mutex);
 638                 if (vub300->irq_enabled)
 639                         mmc_signal_sdio_irq(vub300->mmc);
 640                 else
 641                         vub300->irqs_queued += 1;
 642                 vub300->irq_disabled = 0;
 643                 mutex_unlock(&vub300->irq_mutex);
 644                 break;
 645         }
 646         case RESPONSE_NO_INTERRUPT:
 647                 vub300_queue_poll_work(vub300, 1);
 648                 break;
 649         default:
 650                 break;
 651         }
 652 }
 653
 654 static void __do_poll(struct vub300_mmc_host *vub300)
 655 {
 656         /* cmd_mutex is held by vub300_pollwork_thread */
 657         unsigned long commretval;
 658         mod_timer(&vub300->inactivity_timer, jiffies + HZ);
 659         init_completion(&vub300->irqpoll_complete);
 660         send_irqpoll(vub300);
 661         commretval = wait_for_completion_timeout(&vub300->irqpoll_complete,
 662                                                  msecs_to_jiffies(500));
 663         if (vub300->usb_transport_fail) {
 664                 /* no need to do anything */
 665         } else if (commretval == 0) {
 666                 vub300->usb_timed_out = 1;
 667                 usb_kill_urb(vub300->command_out_urb);
 668                 usb_kill_urb(vub300->command_res_urb);
 669         } else { /* commretval > 0 */
 670                 __vub300_irqpoll_response(vub300);
 671         }
 672 }
 673
 674 /* this thread runs only when the driver
 675  * is trying to poll the device for an IRQ
 676  */
 677 static void vub300_pollwork_thread(struct work_struct *work)
 678 {                               /* NOT irq */
 679         struct vub300_mmc_host *vub300 = container_of(work,
 680                               struct vub300_mmc_host, pollwork.work);
 681         if (!vub300->interface) {
 682                 kref_put(&vub300->kref, vub300_delete);
 683                 return;
 684         }
 685         mutex_lock(&vub300->cmd_mutex);
 686         if (vub300->cmd) {
 687                 vub300_queue_poll_work(vub300, 1);
 688         } else if (!vub300->card_present) {
 689                 /* no need to do anything */
 690         } else { /* vub300->card_present */
 691                 mutex_lock(&vub300->irq_mutex);
 692                 if (!vub300->irq_enabled) {
 693                         mutex_unlock(&vub300->irq_mutex);
 694                 } else if (vub300->irqs_queued) {
 695                         vub300->irqs_queued -= 1;
 696                         mmc_signal_sdio_irq(vub300->mmc);
 697                         mod_timer(&vub300->inactivity_timer, jiffies + HZ);
 698                         mutex_unlock(&vub300->irq_mutex);
 699                 } else { /* NOT vub300->irqs_queued */
 700                         mutex_unlock(&vub300->irq_mutex);
 701                         __do_poll(vub300);
 702                 }
 703         }
 704         mutex_unlock(&vub300->cmd_mutex);
 705         kref_put(&vub300->kref, vub300_delete);
 706 }
 707
 708 static void vub300_deadwork_thread(struct work_struct *work)
 709 {                               /* NOT irq */
 710         struct vub300_mmc_host *vub300 =
 711                 container_of(work, struct vub300_mmc_host, deadwork);
 712         if (!vub300->interface) {
 713                 kref_put(&vub300->kref, vub300_delete);
 714                 return;
 715         }
 716         mutex_lock(&vub300->cmd_mutex);
 717         if (vub300->cmd) {
 718                 /*
 719                  * a command got in as the inactivity
 720                  * timer expired - so we just let the
 721                  * processing of the command show if
 722                  * the device is dead
 723                  */
 724         } else if (vub300->card_present) {
 725                 check_vub300_port_status(vub300);
 726         } else if (vub300->mmc && vub300->mmc->card) {
 727                 /*
 728                  * the MMC core must not have responded
 729                  * to the previous indication - lets
 730                  * hope that it eventually does so we
 731                  * will just ignore this for now
 732                  */
 733         } else {
 734                 check_vub300_port_status(vub300);
 735         }
 736         mod_timer(&vub300->inactivity_timer, jiffies + HZ);
 737         mutex_unlock(&vub300->cmd_mutex);
 738         kref_put(&vub300->kref, vub300_delete);
 739 }
 740
 741 static void vub300_inactivity_timer_expired(struct timer_list *t)
 742 {                               /* softirq */
 743         struct vub300_mmc_host *vub300 = from_timer(vub300, t,
 744                                                     inactivity_timer);
 745         if (!vub300->interface) {
 746                 kref_put(&vub300->kref, vub300_delete);
 747         } else if (vub300->cmd) {
 748                 mod_timer(&vub300->inactivity_timer, jiffies + HZ);
 749         } else {
 750                 vub300_queue_dead_work(vub300);
 751                 mod_timer(&vub300->inactivity_timer, jiffies + HZ);
 752         }
 753 }
 754
 755 static int vub300_response_error(u8 error_code)
 756 {
 757         switch (error_code) {
 758         case SD_ERROR_PIO_TIMEOUT:
 759         case SD_ERROR_1BIT_TIMEOUT:
 760         case SD_ERROR_4BIT_TIMEOUT:
 761                 return -ETIMEDOUT;
 762         case SD_ERROR_STAT_DATA:
 763         case SD_ERROR_OVERRUN:
 764         case SD_ERROR_STAT_CMD:
 765         case SD_ERROR_STAT_CMD_TIMEOUT:
 766         case SD_ERROR_SDCRDY_STUCK:
 767         case SD_ERROR_UNHANDLED:
 768         case SD_ERROR_1BIT_CRC_WRONG:
 769         case SD_ERROR_4BIT_CRC_WRONG:
 770         case SD_ERROR_1BIT_CRC_ERROR:
 771         case SD_ERROR_4BIT_CRC_ERROR:
 772         case SD_ERROR_NO_CMD_ENDBIT:
 773         case SD_ERROR_NO_1BIT_DATEND:
 774         case SD_ERROR_NO_4BIT_DATEND:
 775         case SD_ERROR_1BIT_DATA_TIMEOUT:
 776         case SD_ERROR_4BIT_DATA_TIMEOUT:
 777         case SD_ERROR_1BIT_UNEXPECTED_TIMEOUT:
 778         case SD_ERROR_4BIT_UNEXPECTED_TIMEOUT:
 779                 return -EILSEQ;
 780         case 33:
 781                 return -EILSEQ;
 782         case SD_ERROR_ILLEGAL_COMMAND:
 783                 return -EINVAL;
 784         case SD_ERROR_NO_DEVICE:
 785                 return -ENOMEDIUM;
 786         default:
 787                 return -ENODEV;
 788         }
 789 }
 790
 791 static void command_res_completed(struct urb *urb)
 792 {                               /* urb completion handler - hardirq */
 793         struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
 794         if (urb->status) {
 795                 /* we have to let the initiator handle the error */
 796         } else if (vub300->command_res_urb->actual_length == 0) {
 797                 /*
 798                  * we have seen this happen once or twice and
 799                  * we suspect a buggy USB host controller
 800                  */
 801         } else if (!vub300->data) {
 802                 /* this means that the command (typically CMD52) succeeded */
 803         } else if (vub300->resp.common.header_type != 0x02) {
 804                 /*
 805                  * this is an error response from the VUB300 chip
 806                  * and we let the initiator handle it
 807                  */
 808         } else if (vub300->urb) {
 809                 vub300->cmd->error =
 810                         vub300_response_error(vub300->resp.error.error_code);
 811                 usb_unlink_urb(vub300->urb);
 812         } else {
 813                 vub300->cmd->error =
 814                         vub300_response_error(vub300->resp.error.error_code);
 815                 usb_sg_cancel(&vub300->sg_request);
 816         }
 817         complete(&vub300->command_complete);    /* got_response_in */
 818 }
 819
 820 static void command_out_completed(struct urb *urb)
 821 {                               /* urb completion handler - hardirq */
 822         struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
 823         if (urb->status) {
 824                 complete(&vub300->command_complete);
 825         } else {
 826                 int ret;
 827                 unsigned int pipe =
 828                         usb_rcvbulkpipe(vub300->udev, vub300->cmnd_res_ep);
 829                 usb_fill_bulk_urb(vub300->command_res_urb, vub300->udev, pipe,
 830                                   &vub300->resp, sizeof(vub300->resp),
 831                                   command_res_completed, vub300);
 832                 vub300->command_res_urb->actual_length = 0;
 833                 ret = usb_submit_urb(vub300->command_res_urb, GFP_ATOMIC);
 834                 if (ret == 0) {
 835                         /*
 836                          * the urb completion handler will call
 837                          * our completion handler
 838                          */
 839                 } else {
 840                         /*
 841                          * and thus we only call it directly
 842                          * when it will not be called
 843                          */
 844                         complete(&vub300->command_complete);
 845                 }
 846         }
 847 }
 848
 849 /*
 850  * the STUFF bits are masked out for the comparisons
 851  */
 852 static void snoop_block_size_and_bus_width(struct vub300_mmc_host *vub300,
 853                                            u32 cmd_arg)
 854 {
 855         if ((0xFBFFFE00 & cmd_arg) == 0x80022200)
 856                 vub300->fbs[1] = (cmd_arg << 8) | (0x00FF & vub300->fbs[1]);
 857         else if ((0xFBFFFE00 & cmd_arg) == 0x80022000)
 858                 vub300->fbs[1] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[1]);
 859         else if ((0xFBFFFE00 & cmd_arg) == 0x80042200)
 860                 vub300->fbs[2] = (cmd_arg << 8) | (0x00FF & vub300->fbs[2]);
 861         else if ((0xFBFFFE00 & cmd_arg) == 0x80042000)
 862                 vub300->fbs[2] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[2]);
 863         else if ((0xFBFFFE00 & cmd_arg) == 0x80062200)
 864                 vub300->fbs[3] = (cmd_arg << 8) | (0x00FF & vub300->fbs[3]);
 865         else if ((0xFBFFFE00 & cmd_arg) == 0x80062000)
 866                 vub300->fbs[3] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[3]);
 867         else if ((0xFBFFFE00 & cmd_arg) == 0x80082200)
 868                 vub300->fbs[4] = (cmd_arg << 8) | (0x00FF & vub300->fbs[4]);
 869         else if ((0xFBFFFE00 & cmd_arg) == 0x80082000)
 870                 vub300->fbs[4] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[4]);
 871         else if ((0xFBFFFE00 & cmd_arg) == 0x800A2200)
 872                 vub300->fbs[5] = (cmd_arg << 8) | (0x00FF & vub300->fbs[5]);
 873         else if ((0xFBFFFE00 & cmd_arg) == 0x800A2000)
 874                 vub300->fbs[5] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[5]);
 875         else if ((0xFBFFFE00 & cmd_arg) == 0x800C2200)
 876                 vub300->fbs[6] = (cmd_arg << 8) | (0x00FF & vub300->fbs[6]);
 877         else if ((0xFBFFFE00 & cmd_arg) == 0x800C2000)
 878                 vub300->fbs[6] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[6]);
 879         else if ((0xFBFFFE00 & cmd_arg) == 0x800E2200)
 880                 vub300->fbs[7] = (cmd_arg << 8) | (0x00FF & vub300->fbs[7]);
 881         else if ((0xFBFFFE00 & cmd_arg) == 0x800E2000)
 882                 vub300->fbs[7] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[7]);
 883         else if ((0xFBFFFE03 & cmd_arg) == 0x80000E00)
 884                 vub300->bus_width = 1;
 885         else if ((0xFBFFFE03 & cmd_arg) == 0x80000E02)
 886                 vub300->bus_width = 4;
 887 }
 888
 889 static void send_command(struct vub300_mmc_host *vub300)
 890 {
 891         /* cmd_mutex is held by vub300_cmndwork_thread */
 892         struct mmc_command *cmd = vub300->cmd;
 893         struct mmc_data *data = vub300->data;
 894         int retval;
 895         int i;
 896         u8 response_type;
 897         if (vub300->app_spec) {
 898                 switch (cmd->opcode) {
 899                 case 6:
 900                         response_type = SDRT_1;
 901                         vub300->resp_len = 6;
 902                         if (0x00000000 == (0x00000003 & cmd->arg))
 903                                 vub300->bus_width = 1;
 904                         else if (0x00000002 == (0x00000003 & cmd->arg))
 905                                 vub300->bus_width = 4;
 906                         else
 907                                 dev_err(&vub300->udev->dev,
 908                                         "unexpected ACMD6 bus_width=%d\n",
 909                                         0x00000003 & cmd->arg);
 910                         break;
 911                 case 13:
 912                         response_type = SDRT_1;
 913                         vub300->resp_len = 6;
 914                         break;
 915                 case 22:
 916                         response_type = SDRT_1;
 917                         vub300->resp_len = 6;
 918                         break;
 919                 case 23:
 920                         response_type = SDRT_1;
 921                         vub300->resp_len = 6;
 922                         break;
 923                 case 41:
 924                         response_type = SDRT_3;
 925                         vub300->resp_len = 6;
 926                         break;
 927                 case 42:
 928                         response_type = SDRT_1;
 929                         vub300->resp_len = 6;
 930                         break;
 931                 case 51:
 932                         response_type = SDRT_1;
 933                         vub300->resp_len = 6;
 934                         break;
 935                 case 55:
 936                         response_type = SDRT_1;
 937                         vub300->resp_len = 6;
 938                         break;
 939                 default:
 940                         vub300->resp_len = 0;
 941                         cmd->error = -EINVAL;
 942                         complete(&vub300->command_complete);
 943                         return;
 944                 }
 945                 vub300->app_spec = 0;
 946         } else {
 947                 switch (cmd->opcode) {
 948                 case 0:
 949                         response_type = SDRT_NONE;
 950                         vub300->resp_len = 0;
 951                         break;
 952                 case 1:
 953                         response_type = SDRT_3;
 954                         vub300->resp_len = 6;
 955                         break;
 956                 case 2:
 957                         response_type = SDRT_2;
 958                         vub300->resp_len = 17;
 959                         break;
 960                 case 3:
 961                         response_type = SDRT_6;
 962                         vub300->resp_len = 6;
 963                         break;
 964                 case 4:
 965                         response_type = SDRT_NONE;
 966                         vub300->resp_len = 0;
 967                         break;
 968                 case 5:
 969                         response_type = SDRT_4;
 970                         vub300->resp_len = 6;
 971                         break;
 972                 case 6:
 973                         response_type = SDRT_1;
 974                         vub300->resp_len = 6;
 975                         break;
 976                 case 7:
 977                         response_type = SDRT_1B;
 978                         vub300->resp_len = 6;
 979                         break;
 980                 case 8:
 981                         response_type = SDRT_7;
 982                         vub300->resp_len = 6;
 983                         break;
 984                 case 9:
 985                         response_type = SDRT_2;
 986                         vub300->resp_len = 17;
 987                         break;
 988                 case 10:
 989                         response_type = SDRT_2;
 990                         vub300->resp_len = 17;
 991                         break;
 992                 case 12:
 993                         response_type = SDRT_1B;
 994                         vub300->resp_len = 6;
 995                         break;
 996                 case 13:
 997                         response_type = SDRT_1;
 998                         vub300->resp_len = 6;
 999                         break;
1000                 case 15:
1001                         response_type = SDRT_NONE;
1002                         vub300->resp_len = 0;
1003                         break;
1004                 case 16:
1005                         for (i = 0; i < ARRAY_SIZE(vub300->fbs); i++)
1006                                 vub300->fbs[i] = 0xFFFF & cmd->arg;
1007                         response_type = SDRT_1;
1008                         vub300->resp_len = 6;
1009                         break;
1010                 case 17:
1011                 case 18:
1012                 case 24:
1013                 case 25:
1014                 case 27:
1015                         response_type = SDRT_1;
1016                         vub300->resp_len = 6;
1017                         break;
1018                 case 28:
1019                 case 29:
1020                         response_type = SDRT_1B;
1021                         vub300->resp_len = 6;
1022                         break;
1023                 case 30:
1024                 case 32:
1025                 case 33:
1026                         response_type = SDRT_1;
1027                         vub300->resp_len = 6;
1028                         break;
1029                 case 38:
1030                         response_type = SDRT_1B;
1031                         vub300->resp_len = 6;
1032                         break;
1033                 case 42:
1034                         response_type = SDRT_1;
1035                         vub300->resp_len = 6;
1036                         break;
1037                 case 52:
1038                         response_type = SDRT_5;
1039                         vub300->resp_len = 6;
1040                         snoop_block_size_and_bus_width(vub300, cmd->arg);
1041                         break;
1042                 case 53:
1043                         response_type = SDRT_5;
1044                         vub300->resp_len = 6;
1045                         break;
1046                 case 55:
1047                         response_type = SDRT_1;
1048                         vub300->resp_len = 6;
1049                         vub300->app_spec = 1;
1050                         break;
1051                 case 56:
1052                         response_type = SDRT_1;
1053                         vub300->resp_len = 6;
1054                         break;
1055                 default:
1056                         vub300->resp_len = 0;
1057                         cmd->error = -EINVAL;
1058                         complete(&vub300->command_complete);
1059                         return;
1060                 }
1061         }
1062         /*
1063          * it is a shame that we can not use "sizeof(struct sd_command_header)"
1064          * this is because the packet _must_ be padded to 64 bytes
1065          */
1066         vub300->cmnd.head.header_size = 20;
1067         vub300->cmnd.head.header_type = 0x00;
1068         vub300->cmnd.head.port_number = 0; /* "0" means port 1 */
1069         vub300->cmnd.head.command_type = 0x00; /* standard read command */
1070         vub300->cmnd.head.response_type = response_type;
1071         vub300->cmnd.head.command_index = cmd->opcode;
1072         vub300->cmnd.head.arguments[0] = cmd->arg >> 24;
1073         vub300->cmnd.head.arguments[1] = cmd->arg >> 16;
1074         vub300->cmnd.head.arguments[2] = cmd->arg >> 8;
1075         vub300->cmnd.head.arguments[3] = cmd->arg >> 0;
1076         if (cmd->opcode == 52) {
1077                 int fn = 0x7 & (cmd->arg >> 28);
1078                 vub300->cmnd.head.block_count[0] = 0;
1079                 vub300->cmnd.head.block_count[1] = 0;
1080                 vub300->cmnd.head.block_size[0] = (vub300->fbs[fn] >> 8) & 0xFF;
1081                 vub300->cmnd.head.block_size[1] = (vub300->fbs[fn] >> 0) & 0xFF;
1082                 vub300->cmnd.head.command_type = 0x00;
1083                 vub300->cmnd.head.transfer_size[0] = 0;
1084                 vub300->cmnd.head.transfer_size[1] = 0;
1085                 vub300->cmnd.head.transfer_size[2] = 0;
1086                 vub300->cmnd.head.transfer_size[3] = 0;
1087         } else if (!data) {
1088                 vub300->cmnd.head.block_count[0] = 0;
1089                 vub300->cmnd.head.block_count[1] = 0;
1090                 vub300->cmnd.head.block_size[0] = (vub300->fbs[0] >> 8) & 0xFF;
1091                 vub300->cmnd.head.block_size[1] = (vub300->fbs[0] >> 0) & 0xFF;
1092                 vub300->cmnd.head.command_type = 0x00;
1093                 vub300->cmnd.head.transfer_size[0] = 0;
1094                 vub300->cmnd.head.transfer_size[1] = 0;
1095                 vub300->cmnd.head.transfer_size[2] = 0;
1096                 vub300->cmnd.head.transfer_size[3] = 0;
1097         } else if (cmd->opcode == 53) {
1098                 int fn = 0x7 & (cmd->arg >> 28);
1099                 if (0x08 & vub300->cmnd.head.arguments[0]) { /* BLOCK MODE */
1100                         vub300->cmnd.head.block_count[0] =
1101                                 (data->blocks >> 8) & 0xFF;
1102                         vub300->cmnd.head.block_count[1] =
1103                                 (data->blocks >> 0) & 0xFF;
1104                         vub300->cmnd.head.block_size[0] =
1105                                 (data->blksz >> 8) & 0xFF;
1106                         vub300->cmnd.head.block_size[1] =
1107                                 (data->blksz >> 0) & 0xFF;
1108                 } else {        /* BYTE MODE */
1109                         vub300->cmnd.head.block_count[0] = 0;
1110                         vub300->cmnd.head.block_count[1] = 0;
1111                         vub300->cmnd.head.block_size[0] =
1112                                 (vub300->datasize >> 8) & 0xFF;
1113                         vub300->cmnd.head.block_size[1] =
1114                                 (vub300->datasize >> 0) & 0xFF;
1115                 }
1116                 vub300->cmnd.head.command_type =
1117                         (MMC_DATA_READ & data->flags) ? 0x00 : 0x80;
1118                 vub300->cmnd.head.transfer_size[0] =
1119                         (vub300->datasize >> 24) & 0xFF;
1120                 vub300->cmnd.head.transfer_size[1] =
1121                         (vub300->datasize >> 16) & 0xFF;
1122                 vub300->cmnd.head.transfer_size[2] =
1123                         (vub300->datasize >> 8) & 0xFF;
1124                 vub300->cmnd.head.transfer_size[3] =
1125                         (vub300->datasize >> 0) & 0xFF;
1126                 if (vub300->datasize < vub300->fbs[fn]) {
1127                         vub300->cmnd.head.block_count[0] = 0;
1128                         vub300->cmnd.head.block_count[1] = 0;
1129                 }
1130         } else {
1131                 vub300->cmnd.head.block_count[0] = (data->blocks >> 8) & 0xFF;
1132                 vub300->cmnd.head.block_count[1] = (data->blocks >> 0) & 0xFF;
1133                 vub300->cmnd.head.block_size[0] = (data->blksz >> 8) & 0xFF;
1134                 vub300->cmnd.head.block_size[1] = (data->blksz >> 0) & 0xFF;
1135                 vub300->cmnd.head.command_type =
1136                         (MMC_DATA_READ & data->flags) ? 0x00 : 0x80;
1137                 vub300->cmnd.head.transfer_size[0] =
1138                         (vub300->datasize >> 24) & 0xFF;
1139                 vub300->cmnd.head.transfer_size[1] =
1140                         (vub300->datasize >> 16) & 0xFF;
1141                 vub300->cmnd.head.transfer_size[2] =
1142                         (vub300->datasize >> 8) & 0xFF;
1143                 vub300->cmnd.head.transfer_size[3] =
1144                         (vub300->datasize >> 0) & 0xFF;
1145                 if (vub300->datasize < vub300->fbs[0]) {
1146                         vub300->cmnd.head.block_count[0] = 0;
1147                         vub300->cmnd.head.block_count[1] = 0;
1148                 }
1149         }
1150         if (vub300->cmnd.head.block_size[0] || vub300->cmnd.head.block_size[1]) {
1151                 u16 block_size = vub300->cmnd.head.block_size[1] |
1152                         (vub300->cmnd.head.block_size[0] << 8);
1153                 u16 block_boundary = FIRMWARE_BLOCK_BOUNDARY -
1154                         (FIRMWARE_BLOCK_BOUNDARY % block_size);
1155                 vub300->cmnd.head.block_boundary[0] =
1156                         (block_boundary >> 8) & 0xFF;
1157                 vub300->cmnd.head.block_boundary[1] =
1158                         (block_boundary >> 0) & 0xFF;
1159         } else {
1160                 vub300->cmnd.head.block_boundary[0] = 0;
1161                 vub300->cmnd.head.block_boundary[1] = 0;
1162         }
1163         usb_fill_bulk_urb(vub300->command_out_urb, vub300->udev,
1164                           usb_sndbulkpipe(vub300->udev, vub300->cmnd_out_ep),
1165                           &vub300->cmnd, sizeof(vub300->cmnd),
1166                           command_out_completed, vub300);
1167         retval = usb_submit_urb(vub300->command_out_urb, GFP_KERNEL);
1168         if (retval < 0) {
1169                 cmd->error = retval;
1170                 complete(&vub300->command_complete);
1171                 return;
1172         } else {
1173                 return;
1174         }
1175 }
1176
1177 /*
1178  * timer callback runs in atomic mode
1179  *       so it cannot call usb_kill_urb()
1180  */
1181 static void vub300_sg_timed_out(struct timer_list *t)
1182 {
1183         struct vub300_mmc_host *vub300 = from_timer(vub300, t,
1184                                                     sg_transfer_timer);
1185         vub300->usb_timed_out = 1;
1186         usb_sg_cancel(&vub300->sg_request);
1187         usb_unlink_urb(vub300->command_out_urb);
1188         usb_unlink_urb(vub300->command_res_urb);
1189 }
1190
1191 static u16 roundup_to_multiple_of_64(u16 number)
1192 {
1193         return 0xFFC0 & (0x3F + number);
1194 }
1195
1196 /*
1197  * this is a separate function to solve the 80 column width restriction
1198  */
1199 static void __download_offload_pseudocode(struct vub300_mmc_host *vub300,
1200                                           const struct firmware *fw)
1201 {
1202         u8 register_count = 0;
1203         u16 ts = 0;
1204         u16 interrupt_size = 0;
1205         const u8 *data = fw->data;
1206         int size = fw->size;
1207         u8 c;
1208         dev_info(&vub300->udev->dev, "using %s for SDIO offload processing\n",
1209                  vub300->vub_name);
1210         do {
1211                 c = *data++;
1212         } while (size-- && c); /* skip comment */
1213         dev_info(&vub300->udev->dev, "using offload firmware %s %s\n", fw->data,
1214                  vub300->vub_name);
1215         if (size < 4) {
1216                 dev_err(&vub300->udev->dev,
1217                         "corrupt offload pseudocode in firmware %s\n",
1218                         vub300->vub_name);
1219                 strncpy(vub300->vub_name, "corrupt offload pseudocode",
1220                         sizeof(vub300->vub_name));
1221                 return;
1222         }
1223         interrupt_size += *data++;
1224         size -= 1;
1225         interrupt_size <<= 8;
1226         interrupt_size += *data++;
1227         size -= 1;
1228         if (interrupt_size < size) {
1229                 u16 xfer_length = roundup_to_multiple_of_64(interrupt_size);
1230                 u8 *xfer_buffer = kmalloc(xfer_length, GFP_KERNEL);
1231                 if (xfer_buffer) {
1232                         int retval;
1233                         memcpy(xfer_buffer, data, interrupt_size);
1234                         memset(xfer_buffer + interrupt_size, 0,
1235                                xfer_length - interrupt_size);
1236                         size -= interrupt_size;
1237                         data += interrupt_size;
1238                         retval =
1239                                 usb_control_msg(vub300->udev,
1240                                                 usb_sndctrlpipe(vub300->udev, 0),
1241                                                 SET_INTERRUPT_PSEUDOCODE,
1242                                                 USB_DIR_OUT | USB_TYPE_VENDOR |
1243                                                 USB_RECIP_DEVICE, 0x0000, 0x0000,
1244                                                 xfer_buffer, xfer_length, 1000);
1245                         kfree(xfer_buffer);
1246                         if (retval < 0)
1247                                 goto copy_error_message;
1248                 } else {
1249                         dev_err(&vub300->udev->dev,
1250                                 "not enough memory for xfer buffer to send"
1251                                 " INTERRUPT_PSEUDOCODE for %s %s\n", fw->data,
1252                                 vub300->vub_name);
1253                         strncpy(vub300->vub_name,
1254                                 "SDIO interrupt pseudocode download failed",
1255                                 sizeof(vub300->vub_name));
1256                         return;
1257                 }
1258         } else {
1259                 dev_err(&vub300->udev->dev,
1260                         "corrupt interrupt pseudocode in firmware %s %s\n",
1261                         fw->data, vub300->vub_name);
1262                 strncpy(vub300->vub_name, "corrupt interrupt pseudocode",
1263                         sizeof(vub300->vub_name));
1264                 return;
1265         }
1266         ts += *data++;
1267         size -= 1;
1268         ts <<= 8;
1269         ts += *data++;
1270         size -= 1;
1271         if (ts < size) {
1272                 u16 xfer_length = roundup_to_multiple_of_64(ts);
1273                 u8 *xfer_buffer = kmalloc(xfer_length, GFP_KERNEL);
1274                 if (xfer_buffer) {
1275                         int retval;
1276                         memcpy(xfer_buffer, data, ts);
1277                         memset(xfer_buffer + ts, 0,
1278                                xfer_length - ts);
1279                         size -= ts;
1280                         data += ts;
1281                         retval =
1282                                 usb_control_msg(vub300->udev,
1283                                                 usb_sndctrlpipe(vub300->udev, 0),
1284                                                 SET_TRANSFER_PSEUDOCODE,
1285                                                 USB_DIR_OUT | USB_TYPE_VENDOR |
1286                                                 USB_RECIP_DEVICE, 0x0000, 0x0000,
1287                                                 xfer_buffer, xfer_length, 1000);
1288                         kfree(xfer_buffer);
1289                         if (retval < 0)
1290                                 goto copy_error_message;
1291                 } else {
1292                         dev_err(&vub300->udev->dev,
1293                                 "not enough memory for xfer buffer to send"
1294                                 " TRANSFER_PSEUDOCODE for %s %s\n", fw->data,
1295                                 vub300->vub_name);
1296                         strncpy(vub300->vub_name,
1297                                 "SDIO transfer pseudocode download failed",
1298                                 sizeof(vub300->vub_name));
1299                         return;
1300                 }
1301         } else {
1302                 dev_err(&vub300->udev->dev,
1303                         "corrupt transfer pseudocode in firmware %s %s\n",
1304                         fw->data, vub300->vub_name);
1305                 strncpy(vub300->vub_name, "corrupt transfer pseudocode",
1306                         sizeof(vub300->vub_name));
1307                 return;
1308         }
1309         register_count += *data++;
1310         size -= 1;
1311         if (register_count * 4 == size) {
1312                 int I = vub300->dynamic_register_count = register_count;
1313                 int i = 0;
1314                 while (I--) {
1315                         unsigned int func_num = 0;
1316                         vub300->sdio_register[i].func_num = *data++;
1317                         size -= 1;
1318                         func_num += *data++;
1319                         size -= 1;
1320                         func_num <<= 8;
1321                         func_num += *data++;
1322                         size -= 1;
1323                         func_num <<= 8;
1324                         func_num += *data++;
1325                         size -= 1;
1326                         vub300->sdio_register[i].sdio_reg = func_num;
1327                         vub300->sdio_register[i].activate = 1;
1328                         vub300->sdio_register[i].prepared = 0;
1329                         i += 1;
1330                 }
1331                 dev_info(&vub300->udev->dev,
1332                          "initialized %d dynamic pseudocode registers\n",
1333                          vub300->dynamic_register_count);
1334                 return;
1335         } else {
1336                 dev_err(&vub300->udev->dev,
1337                         "corrupt dynamic registers in firmware %s\n",
1338                         vub300->vub_name);
1339                 strncpy(vub300->vub_name, "corrupt dynamic registers",
1340                         sizeof(vub300->vub_name));
1341                 return;
1342         }
1343
1344 copy_error_message:
1345         strncpy(vub300->vub_name, "SDIO pseudocode download failed",
1346                 sizeof(vub300->vub_name));
1347 }
1348
1349 /*
1350  * if the binary containing the EMPTY PseudoCode can not be found
1351  * vub300->vub_name is set anyway in order to prevent an automatic retry
1352  */
1353 static void download_offload_pseudocode(struct vub300_mmc_host *vub300)
1354 {
1355         struct mmc_card *card = vub300->mmc->card;
1356         int sdio_funcs = card->sdio_funcs;
1357         const struct firmware *fw = NULL;
1358         int l = snprintf(vub300->vub_name, sizeof(vub300->vub_name),
1359                          "vub_%04X%04X", card->cis.vendor, card->cis.device);
1360         int n = 0;
1361         int retval;
1362         for (n = 0; n < sdio_funcs; n++) {
1363                 struct sdio_func *sf = card->sdio_func[n];
1364                 l += scnprintf(vub300->vub_name + l,
1365                               sizeof(vub300->vub_name) - l, "_%04X%04X",
1366                               sf->vendor, sf->device);
1367         }
1368         snprintf(vub300->vub_name + l, sizeof(vub300->vub_name) - l, ".bin");
1369         dev_info(&vub300->udev->dev, "requesting offload firmware %s\n",
1370                  vub300->vub_name);
1371         retval = request_firmware(&fw, vub300->vub_name, &card->dev);
1372         if (retval < 0) {
1373                 strncpy(vub300->vub_name, "vub_default.bin",
1374                         sizeof(vub300->vub_name));
1375                 retval = request_firmware(&fw, vub300->vub_name, &card->dev);
1376                 if (retval < 0) {
1377                         strncpy(vub300->vub_name,
1378                                 "no SDIO offload firmware found",
1379                                 sizeof(vub300->vub_name));
1380                 } else {
1381                         __download_offload_pseudocode(vub300, fw);
1382                         release_firmware(fw);
1383                 }
1384         } else {
1385                 __download_offload_pseudocode(vub300, fw);
1386                 release_firmware(fw);
1387         }
1388 }
1389
1390 static void vub300_usb_bulk_msg_completion(struct urb *urb)
1391 {                               /* urb completion handler - hardirq */
1392         complete((struct completion *)urb->context);
1393 }
1394
1395 static int vub300_usb_bulk_msg(struct vub300_mmc_host *vub300,
1396                                unsigned int pipe, void *data, int len,
1397                                int *actual_length, int timeout_msecs)
1398 {
1399         /* cmd_mutex is held by vub300_cmndwork_thread */
1400         struct usb_device *usb_dev = vub300->udev;
1401         struct completion done;
1402         int retval;
1403         vub300->urb = usb_alloc_urb(0, GFP_KERNEL);
1404         if (!vub300->urb)
1405                 return -ENOMEM;
1406         usb_fill_bulk_urb(vub300->urb, usb_dev, pipe, data, len,
1407                           vub300_usb_bulk_msg_completion, NULL);
1408         init_completion(&done);
1409         vub300->urb->context = &done;
1410         vub300->urb->actual_length = 0;
1411         retval = usb_submit_urb(vub300->urb, GFP_KERNEL);
1412         if (unlikely(retval))
1413                 goto out;
1414         if (!wait_for_completion_timeout
1415             (&done, msecs_to_jiffies(timeout_msecs))) {
1416                 retval = -ETIMEDOUT;
1417                 usb_kill_urb(vub300->urb);
1418         } else {
1419                 retval = vub300->urb->status;
1420         }
1421 out:
1422         *actual_length = vub300->urb->actual_length;
1423         usb_free_urb(vub300->urb);
1424         vub300->urb = NULL;
1425         return retval;
1426 }
1427
1428 static int __command_read_data(struct vub300_mmc_host *vub300,
1429                                struct mmc_command *cmd, struct mmc_data *data)
1430 {
1431         /* cmd_mutex is held by vub300_cmndwork_thread */
1432         int linear_length = vub300->datasize;
1433         int padded_length = vub300->large_usb_packets ?
1434                 ((511 + linear_length) >> 9) << 9 :
1435                 ((63 + linear_length) >> 6) << 6;
1436         if ((padded_length == linear_length) || !pad_input_to_usb_pkt) {
1437                 int result;
1438                 unsigned pipe;
1439                 pipe = usb_rcvbulkpipe(vub300->udev, vub300->data_inp_ep);
1440                 result = usb_sg_init(&vub300->sg_request, vub300->udev,
1441                                      pipe, 0, data->sg,
1442                                      data->sg_len, 0, GFP_KERNEL);
1443                 if (result < 0) {
1444                         usb_unlink_urb(vub300->command_out_urb);
1445                         usb_unlink_urb(vub300->command_res_urb);
1446                         cmd->error = result;
1447                         data->bytes_xfered = 0;
1448                         return 0;
1449                 } else {
1450                         vub300->sg_transfer_timer.expires =
1451                                 jiffies + msecs_to_jiffies(2000 +
1452                                                   (linear_length / 16384));
1453                         add_timer(&vub300->sg_transfer_timer);
1454                         usb_sg_wait(&vub300->sg_request);
1455                         del_timer(&vub300->sg_transfer_timer);
1456                         if (vub300->sg_request.status < 0) {
1457                                 cmd->error = vub300->sg_request.status;
1458                                 data->bytes_xfered = 0;
1459                                 return 0;
1460                         } else {
1461                                 data->bytes_xfered = vub300->datasize;
1462                                 return linear_length;
1463                         }
1464                 }
1465         } else {
1466                 u8 *buf = kmalloc(padded_length, GFP_KERNEL);
1467                 if (buf) {
1468                         int result;
1469                         unsigned pipe = usb_rcvbulkpipe(vub300->udev,
1470                                                         vub300->data_inp_ep);
1471                         int actual_length = 0;
1472                         result = vub300_usb_bulk_msg(vub300, pipe, buf,
1473                                              padded_length, &actual_length,
1474                                              2000 + (padded_length / 16384));
1475                         if (result < 0) {
1476                                 cmd->error = result;
1477                                 data->bytes_xfered = 0;
1478                                 kfree(buf);
1479                                 return 0;
1480                         } else if (actual_length < linear_length) {
1481                                 cmd->error = -EREMOTEIO;
1482                                 data->bytes_xfered = 0;
1483                                 kfree(buf);
1484                                 return 0;
1485                         } else {
1486                                 sg_copy_from_buffer(data->sg, data->sg_len, buf,
1487                                                     linear_length);
1488                                 kfree(buf);
1489                                 data->bytes_xfered = vub300->datasize;
1490                                 return linear_length;
1491                         }
1492                 } else {
1493                         cmd->error = -ENOMEM;
1494                         data->bytes_xfered = 0;
1495                         return 0;
1496                 }
1497         }
1498 }
1499
1500 static int __command_write_data(struct vub300_mmc_host *vub300,
1501                                 struct mmc_command *cmd, struct mmc_data *data)
1502 {
1503         /* cmd_mutex is held by vub300_cmndwork_thread */
1504         unsigned pipe = usb_sndbulkpipe(vub300->udev, vub300->data_out_ep);
1505         int linear_length = vub300->datasize;
1506         int modulo_64_length = linear_length & 0x003F;
1507         int modulo_512_length = linear_length & 0x01FF;
1508         if (linear_length < 64) {
1509                 int result;
1510                 int actual_length;
1511                 sg_copy_to_buffer(data->sg, data->sg_len,
1512                                   vub300->padded_buffer,
1513                                   sizeof(vub300->padded_buffer));
1514                 memset(vub300->padded_buffer + linear_length, 0,
1515                        sizeof(vub300->padded_buffer) - linear_length);
1516                 result = vub300_usb_bulk_msg(vub300, pipe, vub300->padded_buffer,
1517                                              sizeof(vub300->padded_buffer),
1518                                              &actual_length, 2000 +
1519                                              (sizeof(vub300->padded_buffer) /
1520                                               16384));
1521                 if (result < 0) {
1522                         cmd->error = result;
1523                         data->bytes_xfered = 0;
1524                 } else {
1525                         data->bytes_xfered = vub300->datasize;
1526                 }
1527         } else if ((!vub300->large_usb_packets && (0 < modulo_64_length)) ||
1528                     (vub300->large_usb_packets && (64 > modulo_512_length))
1529                 ) {             /* don't you just love these work-rounds */
1530                 int padded_length = ((63 + linear_length) >> 6) << 6;
1531                 u8 *buf = kmalloc(padded_length, GFP_KERNEL);
1532                 if (buf) {
1533                         int result;
1534                         int actual_length;
1535                         sg_copy_to_buffer(data->sg, data->sg_len, buf,
1536                                           padded_length);
1537                         memset(buf + linear_length, 0,
1538                                padded_length - linear_length);
1539                         result =
1540                                 vub300_usb_bulk_msg(vub300, pipe, buf,
1541                                                     padded_length, &actual_length,
1542                                                     2000 + padded_length / 16384);
1543                         kfree(buf);
1544                         if (result < 0) {
1545                                 cmd->error = result;
1546                                 data->bytes_xfered = 0;
1547                         } else {
1548                                 data->bytes_xfered = vub300->datasize;
1549                         }
1550                 } else {
1551                         cmd->error = -ENOMEM;
1552                         data->bytes_xfered = 0;
1553                 }
1554         } else {                /* no data padding required */
1555                 int result;
1556                 unsigned char buf[64 * 4];
1557                 sg_copy_to_buffer(data->sg, data->sg_len, buf, sizeof(buf));
1558                 result = usb_sg_init(&vub300->sg_request, vub300->udev,
1559                                      pipe, 0, data->sg,
1560                                      data->sg_len, 0, GFP_KERNEL);
1561                 if (result < 0) {
1562                         usb_unlink_urb(vub300->command_out_urb);
1563                         usb_unlink_urb(vub300->command_res_urb);
1564                         cmd->error = result;
1565                         data->bytes_xfered = 0;
1566                 } else {
1567                         vub300->sg_transfer_timer.expires =
1568                                 jiffies + msecs_to_jiffies(2000 +
1569                                                            linear_length / 16384);
1570                         add_timer(&vub300->sg_transfer_timer);
1571                         usb_sg_wait(&vub300->sg_request);
1572                         if (cmd->error) {
1573                                 data->bytes_xfered = 0;
1574                         } else {
1575                                 del_timer(&vub300->sg_transfer_timer);
1576                                 if (vub300->sg_request.status < 0) {
1577                                         cmd->error = vub300->sg_request.status;
1578                                         data->bytes_xfered = 0;
1579                                 } else {
1580                                         data->bytes_xfered = vub300->datasize;
1581                                 }
1582                         }
1583                 }
1584         }
1585         return linear_length;
1586 }
1587
1588 static void __vub300_command_response(struct vub300_mmc_host *vub300,
1589                                       struct mmc_command *cmd,
1590                                       struct mmc_data *data, int data_length)
1591 {
1592         /* cmd_mutex is held by vub300_cmndwork_thread */
1593         long respretval;
1594         int msec_timeout = 1000 + data_length / 4;
1595         respretval =
1596                 wait_for_completion_timeout(&vub300->command_complete,
1597                                             msecs_to_jiffies(msec_timeout));
1598         if (respretval == 0) { /* TIMED OUT */
1599                 /* we don't know which of "out" and "res" if any failed */
1600                 int result;
1601                 vub300->usb_timed_out = 1;
1602                 usb_kill_urb(vub300->command_out_urb);
1603                 usb_kill_urb(vub300->command_res_urb);
1604                 cmd->error = -ETIMEDOUT;
1605                 result = usb_lock_device_for_reset(vub300->udev,
1606                                                    vub300->interface);
1607                 if (result == 0) {
1608                         result = usb_reset_device(vub300->udev);
1609                         usb_unlock_device(vub300->udev);
1610                 }
1611         } else if (respretval < 0) {
1612                 /* we don't know which of "out" and "res" if any failed */
1613                 usb_kill_urb(vub300->command_out_urb);
1614                 usb_kill_urb(vub300->command_res_urb);
1615                 cmd->error = respretval;
1616         } else if (cmd->error) {
1617                 /*
1618                  * the error occurred sending the command
1619                  * or receiving the response
1620                  */
1621         } else if (vub300->command_out_urb->status) {
1622                 vub300->usb_transport_fail = vub300->command_out_urb->status;
1623                 cmd->error = -EPROTO == vub300->command_out_urb->status ?
1624                         -ESHUTDOWN : vub300->command_out_urb->status;
1625         } else if (vub300->command_res_urb->status) {
1626                 vub300->usb_transport_fail = vub300->command_res_urb->status;
1627                 cmd->error = -EPROTO == vub300->command_res_urb->status ?
1628                         -ESHUTDOWN : vub300->command_res_urb->status;
1629         } else if (vub300->resp.common.header_type == 0x00) {
1630                 /*
1631                  * the command completed successfully
1632                  * and there was no piggybacked data
1633                  */
1634         } else if (vub300->resp.common.header_type == RESPONSE_ERROR) {
1635                 cmd->error =
1636                         vub300_response_error(vub300->resp.error.error_code);
1637                 if (vub300->data)
1638                         usb_sg_cancel(&vub300->sg_request);
1639         } else if (vub300->resp.common.header_type == RESPONSE_PIGGYBACKED) {
1640                 int offloaded_data_length =
1641                         vub300->resp.common.header_size -
1642                         sizeof(struct sd_register_header);
1643                 int register_count = offloaded_data_length >> 3;
1644                 int ri = 0;
1645                 while (register_count--) {
1646                         add_offloaded_reg(vub300, &vub300->resp.pig.reg[ri]);
1647                         ri += 1;
1648                 }
1649                 vub300->resp.common.header_size =
1650                         sizeof(struct sd_register_header);
1651                 vub300->resp.common.header_type = 0x00;
1652                 cmd->error = 0;
1653         } else if (vub300->resp.common.header_type == RESPONSE_PIG_DISABLED) {
1654                 int offloaded_data_length =
1655                         vub300->resp.common.header_size -
1656                         sizeof(struct sd_register_header);
1657                 int register_count = offloaded_data_length >> 3;
1658                 int ri = 0;
1659                 while (register_count--) {
1660                         add_offloaded_reg(vub300, &vub300->resp.pig.reg[ri]);
1661                         ri += 1;
1662                 }
1663                 mutex_lock(&vub300->irq_mutex);
1664                 if (vub300->irqs_queued) {
1665                         vub300->irqs_queued += 1;
1666                 } else if (vub300->irq_enabled) {
1667                         vub300->irqs_queued += 1;
1668                         vub300_queue_poll_work(vub300, 0);
1669                 } else {
1670                         vub300->irqs_queued += 1;
1671                 }
1672                 vub300->irq_disabled = 1;
1673                 mutex_unlock(&vub300->irq_mutex);
1674                 vub300->resp.common.header_size =
1675                         sizeof(struct sd_register_header);
1676                 vub300->resp.common.header_type = 0x00;
1677                 cmd->error = 0;
1678         } else if (vub300->resp.common.header_type == RESPONSE_PIG_ENABLED) {
1679                 int offloaded_data_length =
1680                         vub300->resp.common.header_size -
1681                         sizeof(struct sd_register_header);
1682                 int register_count = offloaded_data_length >> 3;
1683                 int ri = 0;
1684                 while (register_count--) {
1685                         add_offloaded_reg(vub300, &vub300->resp.pig.reg[ri]);
1686                         ri += 1;
1687                 }
1688                 mutex_lock(&vub300->irq_mutex);
1689                 if (vub300->irqs_queued) {
1690                         vub300->irqs_queued += 1;
1691                 } else if (vub300->irq_enabled) {
1692                         vub300->irqs_queued += 1;
1693                         vub300_queue_poll_work(vub300, 0);
1694                 } else {
1695                         vub300->irqs_queued += 1;
1696                 }
1697                 vub300->irq_disabled = 0;
1698                 mutex_unlock(&vub300->irq_mutex);
1699                 vub300->resp.common.header_size =
1700                         sizeof(struct sd_register_header);
1701                 vub300->resp.common.header_type = 0x00;
1702                 cmd->error = 0;
1703         } else {
1704                 cmd->error = -EINVAL;
1705         }
1706 }
1707
1708 static void construct_request_response(struct vub300_mmc_host *vub300,
1709                                        struct mmc_command *cmd)
1710 {
1711         int resp_len = vub300->resp_len;
1712         int less_cmd = (17 == resp_len) ? resp_len : resp_len - 1;
1713         int bytes = 3 & less_cmd;
1714         int words = less_cmd >> 2;
1715         u8 *r = vub300->resp.response.command_response;
1716
1717         if (!resp_len)
1718                 return;
1719         if (bytes == 3) {
1720                 cmd->resp[words] = (r[1 + (words << 2)] << 24)
1721                         | (r[2 + (words << 2)] << 16)
1722                         | (r[3 + (words << 2)] << 8);
1723         } else if (bytes == 2) {
1724                 cmd->resp[words] = (r[1 + (words << 2)] << 24)
1725                         | (r[2 + (words << 2)] << 16);
1726         } else if (bytes == 1) {
1727                 cmd->resp[words] = (r[1 + (words << 2)] << 24);
1728         }
1729         while (words-- > 0) {
1730                 cmd->resp[words] = (r[1 + (words << 2)] << 24)
1731                         | (r[2 + (words << 2)] << 16)
1732                         | (r[3 + (words << 2)] << 8)
1733                         | (r[4 + (words << 2)] << 0);
1734         }
1735         if ((cmd->opcode == 53) && (0x000000FF & cmd->resp[0]))
1736                 cmd->resp[0] &= 0xFFFFFF00;
1737 }
1738
1739 /* this thread runs only when there is an upper level command req outstanding */
1740 static void vub300_cmndwork_thread(struct work_struct *work)
1741 {
1742         struct vub300_mmc_host *vub300 =
1743                 container_of(work, struct vub300_mmc_host, cmndwork);
1744         if (!vub300->interface) {
1745                 kref_put(&vub300->kref, vub300_delete);
1746                 return;
1747         } else {
1748                 struct mmc_request *req = vub300->req;
1749                 struct mmc_command *cmd = vub300->cmd;
1750                 struct mmc_data *data = vub300->data;
1751                 int data_length;
1752                 mutex_lock(&vub300->cmd_mutex);
1753                 init_completion(&vub300->command_complete);
1754                 if (likely(vub300->vub_name[0]) || !vub300->mmc->card) {
1755                         /*
1756                          * the name of the EMPTY Pseudo firmware file
1757                          * is used as a flag to indicate that the file
1758                          * has been already downloaded to the VUB300 chip
1759                          */
1760                 } else if (0 == vub300->mmc->card->sdio_funcs) {
1761                         strncpy(vub300->vub_name, "SD memory device",
1762                                 sizeof(vub300->vub_name));
1763                 } else {
1764                         download_offload_pseudocode(vub300);
1765                 }
1766                 send_command(vub300);
1767                 if (!data)
1768                         data_length = 0;
1769                 else if (MMC_DATA_READ & data->flags)
1770                         data_length = __command_read_data(vub300, cmd, data);
1771                 else
1772                         data_length = __command_write_data(vub300, cmd, data);
1773                 __vub300_command_response(vub300, cmd, data, data_length);
1774                 vub300->req = NULL;
1775                 vub300->cmd = NULL;
1776                 vub300->data = NULL;
1777                 if (cmd->error) {
1778                         if (cmd->error == -ENOMEDIUM)
1779                                 check_vub300_port_status(vub300);
1780                         mutex_unlock(&vub300->cmd_mutex);
1781                         mmc_request_done(vub300->mmc, req);
1782                         kref_put(&vub300->kref, vub300_delete);
1783                         return;
1784                 } else {
1785                         construct_request_response(vub300, cmd);
1786                         vub300->resp_len = 0;
1787                         mutex_unlock(&vub300->cmd_mutex);
1788                         kref_put(&vub300->kref, vub300_delete);
1789                         mmc_request_done(vub300->mmc, req);
1790                         return;
1791                 }
1792         }
1793 }
1794
1795 static int examine_cyclic_buffer(struct vub300_mmc_host *vub300,
1796                                  struct mmc_command *cmd, u8 Function)
1797 {
1798         /* cmd_mutex is held by vub300_mmc_request */
1799         u8 cmd0 = 0xFF & (cmd->arg >> 24);
1800         u8 cmd1 = 0xFF & (cmd->arg >> 16);
1801         u8 cmd2 = 0xFF & (cmd->arg >> 8);
1802         u8 cmd3 = 0xFF & (cmd->arg >> 0);
1803         int first = MAXREGMASK & vub300->fn[Function].offload_point;
1804         struct offload_registers_access *rf = &vub300->fn[Function].reg[first];
1805         if (cmd0 == rf->command_byte[0] &&
1806             cmd1 == rf->command_byte[1] &&
1807             cmd2 == rf->command_byte[2] &&
1808             cmd3 == rf->command_byte[3]) {
1809                 u8 checksum = 0x00;
1810                 cmd->resp[1] = checksum << 24;
1811                 cmd->resp[0] = (rf->Respond_Byte[0] << 24)
1812                         | (rf->Respond_Byte[1] << 16)
1813                         | (rf->Respond_Byte[2] << 8)
1814                         | (rf->Respond_Byte[3] << 0);
1815                 vub300->fn[Function].offload_point += 1;
1816                 vub300->fn[Function].offload_count -= 1;
1817                 vub300->total_offload_count -= 1;
1818                 return 1;
1819         } else {
1820                 int delta = 1;  /* because it does not match the first one */
1821                 u8 register_count = vub300->fn[Function].offload_count - 1;
1822                 u32 register_point = vub300->fn[Function].offload_point + 1;
1823                 while (0 < register_count) {
1824                         int point = MAXREGMASK & register_point;
1825                         struct offload_registers_access *r =
1826                                 &vub300->fn[Function].reg[point];
1827                         if (cmd0 == r->command_byte[0] &&
1828                             cmd1 == r->command_byte[1] &&
1829                             cmd2 == r->command_byte[2] &&
1830                             cmd3 == r->command_byte[3]) {
1831                                 u8 checksum = 0x00;
1832                                 cmd->resp[1] = checksum << 24;
1833                                 cmd->resp[0] = (r->Respond_Byte[0] << 24)
1834                                         | (r->Respond_Byte[1] << 16)
1835                                         | (r->Respond_Byte[2] << 8)
1836                                         | (r->Respond_Byte[3] << 0);
1837                                 vub300->fn[Function].offload_point += delta;
1838                                 vub300->fn[Function].offload_count -= delta;
1839                                 vub300->total_offload_count -= delta;
1840                                 return 1;
1841                         } else {
1842                                 register_point += 1;
1843                                 register_count -= 1;
1844                                 delta += 1;
1845                                 continue;
1846                         }
1847                 }
1848                 return 0;
1849         }
1850 }
1851
1852 static int satisfy_request_from_offloaded_data(struct vub300_mmc_host *vub300,
1853                                                struct mmc_command *cmd)
1854 {
1855         /* cmd_mutex is held by vub300_mmc_request */
1856         u8 regs = vub300->dynamic_register_count;
1857         u8 i = 0;
1858         u8 func = FUN(cmd);
1859         u32 reg = REG(cmd);
1860         while (0 < regs--) {
1861                 if ((vub300->sdio_register[i].func_num == func) &&
1862                     (vub300->sdio_register[i].sdio_reg == reg)) {
1863                         if (!vub300->sdio_register[i].prepared) {
1864                                 return 0;
1865                         } else if ((0x80000000 & cmd->arg) == 0x80000000) {
1866                                 /*
1867                                  * a write to a dynamic register
1868                                  * nullifies our offloaded value
1869                                  */
1870                                 vub300->sdio_register[i].prepared = 0;
1871                                 return 0;
1872                         } else {
1873                                 u8 checksum = 0x00;
1874                                 u8 rsp0 = 0x00;
1875                                 u8 rsp1 = 0x00;
1876                                 u8 rsp2 = vub300->sdio_register[i].response;
1877                                 u8 rsp3 = vub300->sdio_register[i].regvalue;
1878                                 vub300->sdio_register[i].prepared = 0;
1879                                 cmd->resp[1] = checksum << 24;
1880                                 cmd->resp[0] = (rsp0 << 24)
1881                                         | (rsp1 << 16)
1882                                         | (rsp2 << 8)
1883                                         | (rsp3 << 0);
1884                                 return 1;
1885                         }
1886                 } else {
1887                         i += 1;
1888                         continue;
1889                 }
1890         }
1891         if (vub300->total_offload_count == 0)
1892                 return 0;
1893         else if (vub300->fn[func].offload_count == 0)
1894                 return 0;
1895         else
1896                 return examine_cyclic_buffer(vub300, cmd, func);
1897 }
1898
1899 static void vub300_mmc_request(struct mmc_host *mmc, struct mmc_request *req)
1900 {                               /* NOT irq */
1901         struct mmc_command *cmd = req->cmd;
1902         struct vub300_mmc_host *vub300 = mmc_priv(mmc);
1903         if (!vub300->interface) {
1904                 cmd->error = -ESHUTDOWN;
1905                 mmc_request_done(mmc, req);
1906                 return;
1907         } else {
1908                 struct mmc_data *data = req->data;
1909                 if (!vub300->card_powered) {
1910                         cmd->error = -ENOMEDIUM;
1911                         mmc_request_done(mmc, req);
1912                         return;
1913                 }
1914                 if (!vub300->card_present) {
1915                         cmd->error = -ENOMEDIUM;
1916                         mmc_request_done(mmc, req);
1917                         return;
1918                 }
1919                 if (vub300->usb_transport_fail) {
1920                         cmd->error = vub300->usb_transport_fail;
1921                         mmc_request_done(mmc, req);
1922                         return;
1923                 }
1924                 if (!vub300->interface) {
1925                         cmd->error = -ENODEV;
1926                         mmc_request_done(mmc, req);
1927                         return;
1928                 }
1929                 kref_get(&vub300->kref);
1930                 mutex_lock(&vub300->cmd_mutex);
1931                 mod_timer(&vub300->inactivity_timer, jiffies + HZ);
1932                 /*
1933                  * for performance we have to return immediately
1934                  * if the requested data has been offloaded
1935                  */
1936                 if (cmd->opcode == 52 &&
1937                     satisfy_request_from_offloaded_data(vub300, cmd)) {
1938                         cmd->error = 0;
1939                         mutex_unlock(&vub300->cmd_mutex);
1940                         kref_put(&vub300->kref, vub300_delete);
1941                         mmc_request_done(mmc, req);
1942                         return;
1943                 } else {
1944                         vub300->cmd = cmd;
1945                         vub300->req = req;
1946                         vub300->data = data;
1947                         if (data)
1948                                 vub300->datasize = data->blksz * data->blocks;
1949                         else
1950                                 vub300->datasize = 0;
1951                         vub300_queue_cmnd_work(vub300);
1952                         mutex_unlock(&vub300->cmd_mutex);
1953                         kref_put(&vub300->kref, vub300_delete);
1954                         /*
1955                          * the kernel lock diagnostics complain
1956                          * if the cmd_mutex * is "passed on"
1957                          * to the cmndwork thread,
1958                          * so we must release it now
1959                          * and re-acquire it in the cmndwork thread
1960                          */
1961                 }
1962         }
1963 }
1964
1965 static void __set_clock_speed(struct vub300_mmc_host *vub300, u8 buf[8],
1966                               struct mmc_ios *ios)
1967 {
1968         int buf_array_size = 8; /* ARRAY_SIZE(buf) does not work !!! */
1969         int retval;
1970         u32 kHzClock;
1971         if (ios->clock >= 48000000)
1972                 kHzClock = 48000;
1973         else if (ios->clock >= 24000000)
1974                 kHzClock = 24000;
1975         else if (ios->clock >= 20000000)
1976                 kHzClock = 20000;
1977         else if (ios->clock >= 15000000)
1978                 kHzClock = 15000;
1979         else if (ios->clock >= 200000)
1980                 kHzClock = 200;
1981         else
1982                 kHzClock = 0;
1983         {
1984                 int i;
1985                 u64 c = kHzClock;
1986                 for (i = 0; i < buf_array_size; i++) {
1987                         buf[i] = c;
1988                         c >>= 8;
1989                 }
1990         }
1991         retval =
1992                 usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
1993                                 SET_CLOCK_SPEED,
1994                                 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
1995                                 0x00, 0x00, buf, buf_array_size, 1000);
1996         if (retval != 8) {
1997                 dev_err(&vub300->udev->dev, "SET_CLOCK_SPEED"
1998                         " %dkHz failed with retval=%d\n", kHzClock, retval);
1999         } else {
2000                 dev_dbg(&vub300->udev->dev, "SET_CLOCK_SPEED"
2001                         " %dkHz\n", kHzClock);
2002         }
2003 }
2004
2005 static void vub300_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
2006 {                               /* NOT irq */
2007         struct vub300_mmc_host *vub300 = mmc_priv(mmc);
2008         if (!vub300->interface)
2009                 return;
2010         kref_get(&vub300->kref);
2011         mutex_lock(&vub300->cmd_mutex);
2012         if ((ios->power_mode == MMC_POWER_OFF) && vub300->card_powered) {
2013                 vub300->card_powered = 0;
2014                 usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
2015                                 SET_SD_POWER,
2016                                 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2017                                 0x0000, 0x0000, NULL, 0, 1000);
2018                 /* must wait for the VUB300 u-proc to boot up */
2019                 msleep(600);
2020         } else if ((ios->power_mode == MMC_POWER_UP) && !vub300->card_powered) {
2021                 usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
2022                                 SET_SD_POWER,
2023                                 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2024                                 0x0001, 0x0000, NULL, 0, 1000);
2025                 msleep(600);
2026                 vub300->card_powered = 1;
2027         } else if (ios->power_mode == MMC_POWER_ON) {
2028                 u8 *buf = kmalloc(8, GFP_KERNEL);
2029                 if (buf) {
2030                         __set_clock_speed(vub300, buf, ios);
2031                         kfree(buf);
2032                 }
2033         } else {
2034                 /* this should mean no change of state */
2035         }
2036         mutex_unlock(&vub300->cmd_mutex);
2037         kref_put(&vub300->kref, vub300_delete);
2038 }
2039
2040 static int vub300_mmc_get_ro(struct mmc_host *mmc)
2041 {
2042         struct vub300_mmc_host *vub300 = mmc_priv(mmc);
2043         return vub300->read_only;
2044 }
2045
2046 static void vub300_enable_sdio_irq(struct mmc_host *mmc, int enable)
2047 {                               /* NOT irq */
2048         struct vub300_mmc_host *vub300 = mmc_priv(mmc);
2049         if (!vub300->interface)
2050                 return;
2051         kref_get(&vub300->kref);
2052         if (enable) {
2053                 set_current_state(TASK_RUNNING);
2054                 mutex_lock(&vub300->irq_mutex);
2055                 if (vub300->irqs_queued) {
2056                         vub300->irqs_queued -= 1;
2057                         mmc_signal_sdio_irq(vub300->mmc);
2058                 } else if (vub300->irq_disabled) {
2059                         vub300->irq_disabled = 0;
2060                         vub300->irq_enabled = 1;
2061                         vub300_queue_poll_work(vub300, 0);
2062                 } else if (vub300->irq_enabled) {
2063                         /* this should not happen, so we will just ignore it */
2064                 } else {
2065                         vub300->irq_enabled = 1;
2066                         vub300_queue_poll_work(vub300, 0);
2067                 }
2068                 mutex_unlock(&vub300->irq_mutex);
2069                 set_current_state(TASK_INTERRUPTIBLE);
2070         } else {
2071                 vub300->irq_enabled = 0;
2072         }
2073         kref_put(&vub300->kref, vub300_delete);
2074 }
2075
2076 static const struct mmc_host_ops vub300_mmc_ops = {
2077         .request = vub300_mmc_request,
2078         .set_ios = vub300_mmc_set_ios,
2079         .get_ro = vub300_mmc_get_ro,
2080         .enable_sdio_irq = vub300_enable_sdio_irq,
2081 };
2082
2083 static int vub300_probe(struct usb_interface *interface,
2084                         const struct usb_device_id *id)
2085 {                               /* NOT irq */
2086         struct vub300_mmc_host *vub300;
2087         struct usb_host_interface *iface_desc;
2088         struct usb_device *udev = usb_get_dev(interface_to_usbdev(interface));
2089         int i;
2090         int retval = -ENOMEM;
2091         struct urb *command_out_urb;
2092         struct urb *command_res_urb;
2093         struct mmc_host *mmc;
2094         char manufacturer[48];
2095         char product[32];
2096         char serial_number[32];
2097         usb_string(udev, udev->descriptor.iManufacturer, manufacturer,
2098                    sizeof(manufacturer));
2099         usb_string(udev, udev->descriptor.iProduct, product, sizeof(product));
2100         usb_string(udev, udev->descriptor.iSerialNumber, serial_number,
2101                    sizeof(serial_number));
2102         dev_info(&udev->dev, "probing VID:PID(%04X:%04X) %s %s %s\n",
2103                  le16_to_cpu(udev->descriptor.idVendor),
2104                  le16_to_cpu(udev->descriptor.idProduct),
2105                  manufacturer, product, serial_number);
2106         command_out_urb = usb_alloc_urb(0, GFP_KERNEL);
2107         if (!command_out_urb) {
2108                 retval = -ENOMEM;
2109                 goto error0;
2110         }
2111         command_res_urb = usb_alloc_urb(0, GFP_KERNEL);
2112         if (!command_res_urb) {
2113                 retval = -ENOMEM;
2114                 goto error1;
2115         }
2116         /* this also allocates memory for our VUB300 mmc host device */
2117         mmc = mmc_alloc_host(sizeof(struct vub300_mmc_host), &udev->dev);
2118         if (!mmc) {
2119                 retval = -ENOMEM;
2120                 dev_err(&udev->dev, "not enough memory for the mmc_host\n");
2121                 goto error4;
2122         }
2123         /* MMC core transfer sizes tunable parameters */
2124         mmc->caps = 0;
2125         if (!force_1_bit_data_xfers)
2126                 mmc->caps |= MMC_CAP_4_BIT_DATA;
2127         if (!force_polling_for_irqs)
2128                 mmc->caps |= MMC_CAP_SDIO_IRQ;
2129         mmc->caps &= ~MMC_CAP_NEEDS_POLL;
2130         /*
2131          * MMC_CAP_NEEDS_POLL causes core.c:mmc_rescan() to poll
2132          * for devices which results in spurious CMD7's being
2133          * issued which stops some SDIO cards from working
2134          */
2135         if (limit_speed_to_24_MHz) {
2136                 mmc->caps |= MMC_CAP_MMC_HIGHSPEED;
2137                 mmc->caps |= MMC_CAP_SD_HIGHSPEED;
2138                 mmc->f_max = 24000000;
2139                 dev_info(&udev->dev, "limiting SDIO speed to 24_MHz\n");
2140         } else {
2141                 mmc->caps |= MMC_CAP_MMC_HIGHSPEED;
2142                 mmc->caps |= MMC_CAP_SD_HIGHSPEED;
2143                 mmc->f_max = 48000000;
2144         }
2145         mmc->f_min = 200000;
2146         mmc->max_blk_count = 511;
2147         mmc->max_blk_size = 512;
2148         mmc->max_segs = 128;
2149         if (force_max_req_size)
2150                 mmc->max_req_size = force_max_req_size * 1024;
2151         else
2152                 mmc->max_req_size = 64 * 1024;
2153         mmc->max_seg_size = mmc->max_req_size;
2154         mmc->ocr_avail = 0;
2155         mmc->ocr_avail |= MMC_VDD_165_195;
2156         mmc->ocr_avail |= MMC_VDD_20_21;
2157         mmc->ocr_avail |= MMC_VDD_21_22;
2158         mmc->ocr_avail |= MMC_VDD_22_23;
2159         mmc->ocr_avail |= MMC_VDD_23_24;
2160         mmc->ocr_avail |= MMC_VDD_24_25;
2161         mmc->ocr_avail |= MMC_VDD_25_26;
2162         mmc->ocr_avail |= MMC_VDD_26_27;
2163         mmc->ocr_avail |= MMC_VDD_27_28;
2164         mmc->ocr_avail |= MMC_VDD_28_29;
2165         mmc->ocr_avail |= MMC_VDD_29_30;
2166         mmc->ocr_avail |= MMC_VDD_30_31;
2167         mmc->ocr_avail |= MMC_VDD_31_32;
2168         mmc->ocr_avail |= MMC_VDD_32_33;
2169         mmc->ocr_avail |= MMC_VDD_33_34;
2170         mmc->ocr_avail |= MMC_VDD_34_35;
2171         mmc->ocr_avail |= MMC_VDD_35_36;
2172         mmc->ops = &vub300_mmc_ops;
2173         vub300 = mmc_priv(mmc);
2174         vub300->mmc = mmc;
2175         vub300->card_powered = 0;
2176         vub300->bus_width = 0;
2177         vub300->cmnd.head.block_size[0] = 0x00;
2178         vub300->cmnd.head.block_size[1] = 0x00;
2179         vub300->app_spec = 0;
2180         mutex_init(&vub300->cmd_mutex);
2181         mutex_init(&vub300->irq_mutex);
2182         vub300->command_out_urb = command_out_urb;
2183         vub300->command_res_urb = command_res_urb;
2184         vub300->usb_timed_out = 0;
2185         vub300->dynamic_register_count = 0;
2186
2187         for (i = 0; i < ARRAY_SIZE(vub300->fn); i++) {
2188                 vub300->fn[i].offload_point = 0;
2189                 vub300->fn[i].offload_count = 0;
2190         }
2191
2192         vub300->total_offload_count = 0;
2193         vub300->irq_enabled = 0;
2194         vub300->irq_disabled = 0;
2195         vub300->irqs_queued = 0;
2196
2197         for (i = 0; i < ARRAY_SIZE(vub300->sdio_register); i++)
2198                 vub300->sdio_register[i++].activate = 0;
2199
2200         vub300->udev = udev;
2201         vub300->interface = interface;
2202         vub300->cmnd_res_ep = 0;
2203         vub300->cmnd_out_ep = 0;
2204         vub300->data_inp_ep = 0;
2205         vub300->data_out_ep = 0;
2206
2207         for (i = 0; i < ARRAY_SIZE(vub300->fbs); i++)
2208                 vub300->fbs[i] = 512;
2209
2210         /*
2211          *      set up the endpoint information
2212          *
2213          * use the first pair of bulk-in and bulk-out
2214          *     endpoints for Command/Response+Interrupt
2215          *
2216          * use the second pair of bulk-in and bulk-out
2217          *     endpoints for Data In/Out
2218          */
2219         vub300->large_usb_packets = 0;
2220         iface_desc = interface->cur_altsetting;
2221         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
2222                 struct usb_endpoint_descriptor *endpoint =
2223                         &iface_desc->endpoint[i].desc;
2224                 dev_info(&vub300->udev->dev,
2225                          "vub300 testing %s EndPoint(%d) %02X\n",
2226                          usb_endpoint_is_bulk_in(endpoint) ? "BULK IN" :
2227                          usb_endpoint_is_bulk_out(endpoint) ? "BULK OUT" :
2228                          "UNKNOWN", i, endpoint->bEndpointAddress);
2229                 if (endpoint->wMaxPacketSize > 64)
2230                         vub300->large_usb_packets = 1;
2231                 if (usb_endpoint_is_bulk_in(endpoint)) {
2232                         if (!vub300->cmnd_res_ep) {
2233                                 vub300->cmnd_res_ep =
2234                                         endpoint->bEndpointAddress;
2235                         } else if (!vub300->data_inp_ep) {
2236                                 vub300->data_inp_ep =
2237                                         endpoint->bEndpointAddress;
2238                         } else {
2239                                 dev_warn(&vub300->udev->dev,
2240                                          "ignoring"
2241                                          " unexpected bulk_in endpoint");
2242                         }
2243                 } else if (usb_endpoint_is_bulk_out(endpoint)) {
2244                         if (!vub300->cmnd_out_ep) {
2245                                 vub300->cmnd_out_ep =
2246                                         endpoint->bEndpointAddress;
2247                         } else if (!vub300->data_out_ep) {
2248                                 vub300->data_out_ep =
2249                                         endpoint->bEndpointAddress;
2250                         } else {
2251                                 dev_warn(&vub300->udev->dev,
2252                                          "ignoring"
2253                                          " unexpected bulk_out endpoint");
2254                         }
2255                 } else {
2256                         dev_warn(&vub300->udev->dev,
2257                                  "vub300 ignoring EndPoint(%d) %02X", i,
2258                                  endpoint->bEndpointAddress);
2259                 }
2260         }
2261         if (vub300->cmnd_res_ep && vub300->cmnd_out_ep &&
2262             vub300->data_inp_ep && vub300->data_out_ep) {
2263                 dev_info(&vub300->udev->dev,
2264                          "vub300 %s packets"
2265                          " using EndPoints %02X %02X %02X %02X\n",
2266                          vub300->large_usb_packets ? "LARGE" : "SMALL",
2267                          vub300->cmnd_out_ep, vub300->cmnd_res_ep,
2268                          vub300->data_out_ep, vub300->data_inp_ep);
2269                 /* we have the expected EndPoints */
2270         } else {
2271                 dev_err(&vub300->udev->dev,
2272                     "Could not find two sets of bulk-in/out endpoint pairs\n");
2273                 retval = -EINVAL;
2274                 goto error5;
2275         }
2276         retval =
2277                 usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
2278                                 GET_HC_INF0,
2279                                 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2280                                 0x0000, 0x0000, &vub300->hc_info,
2281                                 sizeof(vub300->hc_info), 1000);
2282         if (retval < 0)
2283                 goto error5;
2284         retval =
2285                 usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
2286                                 SET_ROM_WAIT_STATES,
2287                                 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2288                                 firmware_rom_wait_states, 0x0000, NULL, 0, 1000);
2289         if (retval < 0)
2290                 goto error5;
2291         dev_info(&vub300->udev->dev,
2292                  "operating_mode = %s %s %d MHz %s %d byte USB packets\n",
2293                  (mmc->caps & MMC_CAP_SDIO_IRQ) ? "IRQs" : "POLL",
2294                  (mmc->caps & MMC_CAP_4_BIT_DATA) ? "4-bit" : "1-bit",
2295                  mmc->f_max / 1000000,
2296                  pad_input_to_usb_pkt ? "padding input data to" : "with",
2297                  vub300->large_usb_packets ? 512 : 64);
2298         retval =
2299                 usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
2300                                 GET_SYSTEM_PORT_STATUS,
2301                                 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2302                                 0x0000, 0x0000, &vub300->system_port_status,
2303                                 sizeof(vub300->system_port_status), 1000);
2304         if (retval < 0) {
2305                 goto error5;
2306         } else if (sizeof(vub300->system_port_status) == retval) {
2307                 vub300->card_present =
2308                         (0x0001 & vub300->system_port_status.port_flags) ? 1 : 0;
2309                 vub300->read_only =
2310                         (0x0010 & vub300->system_port_status.port_flags) ? 1 : 0;
2311         } else {
2312                 goto error5;
2313         }
2314         usb_set_intfdata(interface, vub300);
2315         INIT_DELAYED_WORK(&vub300->pollwork, vub300_pollwork_thread);
2316         INIT_WORK(&vub300->cmndwork, vub300_cmndwork_thread);
2317         INIT_WORK(&vub300->deadwork, vub300_deadwork_thread);
2318         kref_init(&vub300->kref);
2319         timer_setup(&vub300->sg_transfer_timer, vub300_sg_timed_out, 0);
2320         kref_get(&vub300->kref);
2321         timer_setup(&vub300->inactivity_timer,
2322                     vub300_inactivity_timer_expired, 0);
2323         vub300->inactivity_timer.expires = jiffies + HZ;
2324         add_timer(&vub300->inactivity_timer);
2325         if (vub300->card_present)
2326                 dev_info(&vub300->udev->dev,
2327                          "USB vub300 remote SDIO host controller[%d]"
2328                          "connected with SD/SDIO card inserted\n",
2329                          interface_to_InterfaceNumber(interface));
2330         else
2331                 dev_info(&vub300->udev->dev,
2332                          "USB vub300 remote SDIO host controller[%d]"
2333                          "connected with no SD/SDIO card inserted\n",
2334                          interface_to_InterfaceNumber(interface));
2335         retval = mmc_add_host(mmc);
2336         if (retval)
2337                 goto error6;
2338
2339         return 0;
2340 error6:
2341         del_timer_sync(&vub300->inactivity_timer);
2342 error5:
2343         mmc_free_host(mmc);
2344         /*
2345          * and hence also frees vub300
2346          * which is contained at the end of struct mmc
2347          */
2348 error4:
2349         usb_free_urb(command_res_urb);
2350 error1:
2351         usb_free_urb(command_out_urb);
2352 error0:
2353         usb_put_dev(udev);
2354         return retval;
2355 }
2356
2357 static void vub300_disconnect(struct usb_interface *interface)
2358 {                               /* NOT irq */
2359         struct vub300_mmc_host *vub300 = usb_get_intfdata(interface);
2360         if (!vub300 || !vub300->mmc) {
2361                 return;
2362         } else {
2363                 struct mmc_host *mmc = vub300->mmc;
2364                 if (!vub300->mmc) {
2365                         return;
2366                 } else {
2367                         int ifnum = interface_to_InterfaceNumber(interface);
2368                         usb_set_intfdata(interface, NULL);
2369                         /* prevent more I/O from starting */
2370                         vub300->interface = NULL;
2371                         kref_put(&vub300->kref, vub300_delete);
2372                         mmc_remove_host(mmc);
2373                         pr_info("USB vub300 remote SDIO host controller[%d]"
2374                                 " now disconnected", ifnum);
2375                         return;
2376                 }
2377         }
2378 }
2379
2380 #ifdef CONFIG_PM
2381 static int vub300_suspend(struct usb_interface *intf, pm_message_t message)
2382 {
2383         return 0;
2384 }
2385
2386 static int vub300_resume(struct usb_interface *intf)
2387 {
2388         return 0;
2389 }
2390 #else
2391 #define vub300_suspend NULL
2392 #define vub300_resume NULL
2393 #endif
2394 static int vub300_pre_reset(struct usb_interface *intf)
2395 {                               /* NOT irq */
2396         struct vub300_mmc_host *vub300 = usb_get_intfdata(intf);
2397         mutex_lock(&vub300->cmd_mutex);
2398         return 0;
2399 }
2400
2401 static int vub300_post_reset(struct usb_interface *intf)
2402 {                               /* NOT irq */
2403         struct vub300_mmc_host *vub300 = usb_get_intfdata(intf);
2404         /* we are sure no URBs are active - no locking needed */
2405         vub300->errors = -EPIPE;
2406         mutex_unlock(&vub300->cmd_mutex);
2407         return 0;
2408 }
2409
2410 static struct usb_driver vub300_driver = {
2411         .name = "vub300",
2412         .probe = vub300_probe,
2413         .disconnect = vub300_disconnect,
2414         .suspend = vub300_suspend,
2415         .resume = vub300_resume,
2416         .pre_reset = vub300_pre_reset,
2417         .post_reset = vub300_post_reset,
2418         .id_table = vub300_table,
2419         .supports_autosuspend = 1,
2420 };
2421
2422 static int __init vub300_init(void)
2423 {                               /* NOT irq */
2424         int result;
2425
2426         pr_info("VUB300 Driver rom wait states = %02X irqpoll timeout = %04X",
2427                 firmware_rom_wait_states, 0x0FFFF & firmware_irqpoll_timeout);
2428         cmndworkqueue = create_singlethread_workqueue("kvub300c");
2429         if (!cmndworkqueue) {
2430                 pr_err("not enough memory for the REQUEST workqueue");
2431                 result = -ENOMEM;
2432                 goto out1;
2433         }
2434         pollworkqueue = create_singlethread_workqueue("kvub300p");
2435         if (!pollworkqueue) {
2436                 pr_err("not enough memory for the IRQPOLL workqueue");
2437                 result = -ENOMEM;
2438                 goto out2;
2439         }
2440         deadworkqueue = create_singlethread_workqueue("kvub300d");
2441         if (!deadworkqueue) {
2442                 pr_err("not enough memory for the EXPIRED workqueue");
2443                 result = -ENOMEM;
2444                 goto out3;
2445         }
2446         result = usb_register(&vub300_driver);
2447         if (result) {
2448                 pr_err("usb_register failed. Error number %d", result);
2449                 goto out4;
2450         }
2451         return 0;
2452 out4:
2453         destroy_workqueue(deadworkqueue);
2454 out3:
2455         destroy_workqueue(pollworkqueue);
2456 out2:
2457         destroy_workqueue(cmndworkqueue);
2458 out1:
2459         return result;
2460 }
2461
2462 static void __exit vub300_exit(void)
2463 {
2464         usb_deregister(&vub300_driver);
2465         flush_workqueue(cmndworkqueue);
2466         flush_workqueue(pollworkqueue);
2467         flush_workqueue(deadworkqueue);
2468         destroy_workqueue(cmndworkqueue);
2469         destroy_workqueue(pollworkqueue);
2470         destroy_workqueue(deadworkqueue);
2471 }
2472
2473 module_init(vub300_init);
2474 module_exit(vub300_exit);
2475
2476 MODULE_AUTHOR("Tony Olech <tony.olech@elandigitalsystems.com>");
2477 MODULE_DESCRIPTION("VUB300 USB to SD/MMC/SDIO adapter driver");
2478 MODULE_LICENSE("GPL");