1	// SPDX-License-Identifier: GPL-2.0-only
2	/*
3	* Remote VUB300 SDIO/SDmem Host Controller Driver
4	*
5	* Copyright (C) 2010 Elan Digital Systems Limited
6	*
7	* based on USB Skeleton driver - 2.2
8	*
9	* Copyright (C) 2001-2004 Greg Kroah-Hartman (greg@kroah.com)
10	*
11	* VUB300: is a USB 2.0 client device with a single SDIO/SDmem/MMC slot
12	* Any SDIO/SDmem/MMC device plugged into the VUB300 will appear,
13	* by virtue of this driver, to have been plugged into a local
14	* SDIO host controller, similar to, say, a PCI Ricoh controller
15	* This is because this kernel device driver is both a USB 2.0
16	* client device driver AND an MMC host controller driver. Thus
17	* if there is an existing driver for the inserted SDIO/SDmem/MMC
18	* device then that driver will be used by the kernel to manage
19	* the device in exactly the same fashion as if it had been
20	* directly plugged into, say, a local pci bus Ricoh controller
21	*
22	* RANT: this driver was written using a display 128x48 - converting it
23	* to a line width of 80 makes it very difficult to support. In
24	* particular functions have been broken down into sub functions
25	* and the original meaningful names have been shortened into
26	* cryptic ones.
27	* The problem is that executing a fragment of code subject to
28	* two conditions means an indentation of 24, thus leaving only
29	* 56 characters for a C statement. And that is quite ridiculous!
30	*
31	* Data types: data passed to/from the VUB300 is fixed to a number of
32	* bits and driver data fields reflect that limit by using
33	* u8, u16, u32
34	*/
35	#include <linux/kernel.h>
36	#include <linux/errno.h>
37	#include <linux/init.h>
38	#include <linux/slab.h>
39	#include <linux/module.h>
40	#include <linux/kref.h>
41	#include <linux/uaccess.h>
42	#include <linux/usb.h>
43	#include <linux/mutex.h>
44	#include <linux/mmc/host.h>
45	#include <linux/mmc/card.h>
46	#include <linux/mmc/sdio_func.h>
47	#include <linux/mmc/sdio_ids.h>
48	#include <linux/workqueue.h>
49	#include <linux/ctype.h>
50	#include <linux/firmware.h>
51	#include <linux/scatterlist.h>
52
53	struct host_controller_info {
54	u8 info_size;
55	u16 firmware_version;
56	u8 number_of_ports;
57	} __packed;
58
59	#define FIRMWARE_BLOCK_BOUNDARY 1024
60	struct sd_command_header {
61	u8 header_size;
62	u8 header_type;
63	u8 port_number;
64	u8 command_type; /* Bit7 - Rd/Wr */
65	u8 command_index;
66	u8 transfer_size[4]; /* ReadSize + ReadSize */
67	u8 response_type;
68	u8 arguments[4];
69	u8 block_count[2];
70	u8 block_size[2];
71	u8 block_boundary[2];
72	u8 reserved[44]; /* to pad out to 64 bytes */
73	} __packed;
74
75	struct sd_irqpoll_header {
76	u8 header_size;
77	u8 header_type;
78	u8 port_number;
79	u8 command_type; /* Bit7 - Rd/Wr */
80	u8 padding[16]; /* don't ask why !! */
81	u8 poll_timeout_msb;
82	u8 poll_timeout_lsb;
83	u8 reserved[42]; /* to pad out to 64 bytes */
84	} __packed;
85
86	struct sd_common_header {
87	u8 header_size;
88	u8 header_type;
89	u8 port_number;
90	} __packed;
91
92	struct sd_response_header {
93	u8 header_size;
94	u8 header_type;
95	u8 port_number;
96	u8 command_type;
97	u8 command_index;
98	u8 command_response[];
99	} __packed;
100
101	struct sd_status_header {
102	u8 header_size;
103	u8 header_type;
104	u8 port_number;
105	u16 port_flags;
106	u32 sdio_clock;
107	u16 host_header_size;
108	u16 func_header_size;
109	u16 ctrl_header_size;
110	} __packed;
111
112	struct sd_error_header {
113	u8 header_size;
114	u8 header_type;
115	u8 port_number;
116	u8 error_code;
117	} __packed;
118
119	struct sd_interrupt_header {
120	u8 header_size;
121	u8 header_type;
122	u8 port_number;
123	} __packed;
124
125	struct offload_registers_access {
126	u8 command_byte[4];
127	u8 Respond_Byte[4];
128	} __packed;
129
130	#define INTERRUPT_REGISTER_ACCESSES 15
131	struct sd_offloaded_interrupt {
132	u8 header_size;
133	u8 header_type;
134	u8 port_number;
135	struct offload_registers_access reg[INTERRUPT_REGISTER_ACCESSES];
136	} __packed;
137
138	struct sd_register_header {
139	u8 header_size;
140	u8 header_type;
141	u8 port_number;
142	u8 command_type;
143	u8 command_index;
144	u8 command_response[6];
145	} __packed;
146
147	#define PIGGYBACK_REGISTER_ACCESSES 14
148	struct sd_offloaded_piggyback {
149	struct sd_register_header sdio;
150	struct offload_registers_access reg[PIGGYBACK_REGISTER_ACCESSES];
151	} __packed;
152
153	union sd_response {
154	struct sd_common_header common;
155	struct sd_status_header status;
156	struct sd_error_header error;
157	struct sd_interrupt_header interrupt;
158	struct sd_response_header response;
159	struct sd_offloaded_interrupt irq;
160	struct sd_offloaded_piggyback pig;
161	} __packed;
162
163	union sd_command {
164	struct sd_command_header head;
165	struct sd_irqpoll_header poll;
166	} __packed;
167
168	enum SD_RESPONSE_TYPE {
169	SDRT_UNSPECIFIED = 0,
170	SDRT_NONE,
171	SDRT_1,
172	SDRT_1B,
173	SDRT_2,
174	SDRT_3,
175	SDRT_4,
176	SDRT_5,
177	SDRT_5B,
178	SDRT_6,
179	SDRT_7,
180	};
181
182	#define RESPONSE_INTERRUPT 0x01
183	#define RESPONSE_ERROR 0x02
184	#define RESPONSE_STATUS 0x03
185	#define RESPONSE_IRQ_DISABLED 0x05
186	#define RESPONSE_IRQ_ENABLED 0x06
187	#define RESPONSE_PIGGYBACKED 0x07
188	#define RESPONSE_NO_INTERRUPT 0x08
189	#define RESPONSE_PIG_DISABLED 0x09
190	#define RESPONSE_PIG_ENABLED 0x0A
191	#define SD_ERROR_1BIT_TIMEOUT 0x01
192	#define SD_ERROR_4BIT_TIMEOUT 0x02
193	#define SD_ERROR_1BIT_CRC_WRONG 0x03
194	#define SD_ERROR_4BIT_CRC_WRONG 0x04
195	#define SD_ERROR_1BIT_CRC_ERROR 0x05
196	#define SD_ERROR_4BIT_CRC_ERROR 0x06
197	#define SD_ERROR_NO_CMD_ENDBIT 0x07
198	#define SD_ERROR_NO_1BIT_DATEND 0x08
199	#define SD_ERROR_NO_4BIT_DATEND 0x09
200	#define SD_ERROR_1BIT_UNEXPECTED_TIMEOUT 0x0A
201	#define SD_ERROR_4BIT_UNEXPECTED_TIMEOUT 0x0B
202	#define SD_ERROR_ILLEGAL_COMMAND 0x0C
203	#define SD_ERROR_NO_DEVICE 0x0D
204	#define SD_ERROR_TRANSFER_LENGTH 0x0E
205	#define SD_ERROR_1BIT_DATA_TIMEOUT 0x0F
206	#define SD_ERROR_4BIT_DATA_TIMEOUT 0x10
207	#define SD_ERROR_ILLEGAL_STATE 0x11
208	#define SD_ERROR_UNKNOWN_ERROR 0x12
209	#define SD_ERROR_RESERVED_ERROR 0x13
210	#define SD_ERROR_INVALID_FUNCTION 0x14
211	#define SD_ERROR_OUT_OF_RANGE 0x15
212	#define SD_ERROR_STAT_CMD 0x16
213	#define SD_ERROR_STAT_DATA 0x17
214	#define SD_ERROR_STAT_CMD_TIMEOUT 0x18
215	#define SD_ERROR_SDCRDY_STUCK 0x19
216	#define SD_ERROR_UNHANDLED 0x1A
217	#define SD_ERROR_OVERRUN 0x1B
218	#define SD_ERROR_PIO_TIMEOUT 0x1C
219
220	#define FUN(c) (0x000007 & (c->arg>>28))
221	#define REG(c) (0x01FFFF & (c->arg>>9))
222
223	static bool limit_speed_to_24_MHz;
224	module_param(limit_speed_to_24_MHz, bool, 0644);
225	MODULE_PARM_DESC(limit_speed_to_24_MHz, "Limit Max SDIO Clock Speed to 24 MHz");
226
227	static bool pad_input_to_usb_pkt;
228	module_param(pad_input_to_usb_pkt, bool, 0644);
229	MODULE_PARM_DESC(pad_input_to_usb_pkt,
230	"Pad USB data input transfers to whole USB Packet");
231
232	static bool disable_offload_processing;
233	module_param(disable_offload_processing, bool, 0644);
234	MODULE_PARM_DESC(disable_offload_processing, "Disable Offload Processing");
235
236	static bool force_1_bit_data_xfers;
237	module_param(force_1_bit_data_xfers, bool, 0644);
238	MODULE_PARM_DESC(force_1_bit_data_xfers,
239	"Force SDIO Data Transfers to 1-bit Mode");
240
241	static bool force_polling_for_irqs;
242	module_param(force_polling_for_irqs, bool, 0644);
243	MODULE_PARM_DESC(force_polling_for_irqs, "Force Polling for SDIO interrupts");
244
245	static int firmware_irqpoll_timeout = 1024;
246	module_param(firmware_irqpoll_timeout, int, 0644);
247	MODULE_PARM_DESC(firmware_irqpoll_timeout, "VUB300 firmware irqpoll timeout");
248
249	static int force_max_req_size = 128;
250	module_param(force_max_req_size, int, 0644);
251	MODULE_PARM_DESC(force_max_req_size, "set max request size in kBytes");
252
253	#ifdef SMSC_DEVELOPMENT_BOARD
254	static int firmware_rom_wait_states = 0x04;
255	#else
256	static int firmware_rom_wait_states = 0x1C;
257	#endif
258
259	module_param(firmware_rom_wait_states, int, 0644);
260	MODULE_PARM_DESC(firmware_rom_wait_states,
261	"ROM wait states byte=RRRIIEEE (Reserved Internal External)");
262
263	#define ELAN_VENDOR_ID 0x2201
264	#define VUB300_VENDOR_ID 0x0424
265	#define VUB300_PRODUCT_ID 0x012C
266	static const struct usb_device_id vub300_table[] = {
267	{USB_DEVICE(ELAN_VENDOR_ID, VUB300_PRODUCT_ID)},
268	{USB_DEVICE(VUB300_VENDOR_ID, VUB300_PRODUCT_ID)},
269	{} /* Terminating entry */
270	};
271	MODULE_DEVICE_TABLE(usb, vub300_table);
272
273	static struct workqueue_struct *cmndworkqueue;
274	static struct workqueue_struct *pollworkqueue;
275	static struct workqueue_struct *deadworkqueue;
276
277	static inline int interface_to_InterfaceNumber(struct usb_interface *interface)
278	{
279	if (!interface)
280	return -1;
281	if (!interface->cur_altsetting)
282	return -1;
283	return interface->cur_altsetting->desc.bInterfaceNumber;
284	}
285
286	struct sdio_register {
287	unsigned func_num:3;
288	unsigned sdio_reg:17;
289	unsigned activate:1;
290	unsigned prepared:1;
291	unsigned regvalue:8;
292	unsigned response:8;
293	unsigned sparebit:26;
294	};
295
296	struct vub300_mmc_host {
297	struct usb_device *udev;
298	struct usb_interface *interface;
299	struct kref kref;
300	struct mutex cmd_mutex;
301	struct mutex irq_mutex;
302	char vub_name[3 + (9 * 8) + 4 + 1]; /* max of 7 sdio fn's */
303	u8 cmnd_out_ep; /* EndPoint for commands */
304	u8 cmnd_res_ep; /* EndPoint for responses */
305	u8 data_out_ep; /* EndPoint for out data */
306	u8 data_inp_ep; /* EndPoint for inp data */
307	bool card_powered;
308	bool card_present;
309	bool read_only;
310	bool large_usb_packets;
311	bool app_spec; /* ApplicationSpecific */
312	bool irq_enabled; /* by the MMC CORE */
313	bool irq_disabled; /* in the firmware */
314	unsigned bus_width:4;
315	u8 total_offload_count;
316	u8 dynamic_register_count;
317	u8 resp_len;
318	u32 datasize;
319	int errors;
320	int usb_transport_fail;
321	int usb_timed_out;
322	int irqs_queued;
323	struct sdio_register sdio_register[16];
324	struct offload_interrupt_function_register {
325	#define MAXREGBITS 4
326	#define MAXREGS (1<<MAXREGBITS)
327	#define MAXREGMASK (MAXREGS-1)
328	u8 offload_count;
329	u32 offload_point;
330	struct offload_registers_access reg[MAXREGS];
331	} fn[8];
332	u16 fbs[8]; /* Function Block Size */
333	struct mmc_command *cmd;
334	struct mmc_request *req;
335	struct mmc_data *data;
336	struct mmc_host *mmc;
337	struct urb *urb;
338	struct urb *command_out_urb;
339	struct urb *command_res_urb;
340	struct completion command_complete;
341	struct completion irqpoll_complete;
342	union sd_command cmnd;
343	union sd_response resp;
344	struct timer_list sg_transfer_timer;
345	struct usb_sg_request sg_request;
346	struct timer_list inactivity_timer;
347	struct work_struct deadwork;
348	struct work_struct cmndwork;
349	struct delayed_work pollwork;
350	struct host_controller_info hc_info;
351	struct sd_status_header system_port_status;
352	u8 padded_buffer[64];
353	};
354
355	#define kref_to_vub300_mmc_host(d) container_of(d, struct vub300_mmc_host, kref)
356	#define SET_TRANSFER_PSEUDOCODE 21
357	#define SET_INTERRUPT_PSEUDOCODE 20
358	#define SET_FAILURE_MODE 18
359	#define SET_ROM_WAIT_STATES 16
360	#define SET_IRQ_ENABLE 13
361	#define SET_CLOCK_SPEED 11
362	#define SET_FUNCTION_BLOCK_SIZE 9
363	#define SET_SD_DATA_MODE 6
364	#define SET_SD_POWER 4
365	#define ENTER_DFU_MODE 3
366	#define GET_HC_INF0 1
367	#define GET_SYSTEM_PORT_STATUS 0
368
369	static void vub300_delete(struct kref *kref)
370	{ /* kref callback - softirq */
371	struct vub300_mmc_host *vub300 = kref_to_vub300_mmc_host(kref);
372	struct mmc_host *mmc = vub300->mmc;
373	usb_free_urb(urb: vub300->command_out_urb);
374	vub300->command_out_urb = NULL;
375	usb_free_urb(urb: vub300->command_res_urb);
376	vub300->command_res_urb = NULL;
377	usb_put_dev(dev: vub300->udev);
378	mmc_free_host(mmc);
379	/*
380	* and hence also frees vub300
381	* which is contained at the end of struct mmc
382	*/
383	}
384
385	static void vub300_queue_cmnd_work(struct vub300_mmc_host *vub300)
386	{
387	kref_get(kref: &vub300->kref);
388	if (queue_work(wq: cmndworkqueue, work: &vub300->cmndwork)) {
389	/*
390	* then the cmndworkqueue was not previously
391	* running and the above get ref is obvious
392	* required and will be put when the thread
393	* terminates by a specific call
394	*/
395	} else {
396	/*
397	* the cmndworkqueue was already running from
398	* a previous invocation and thus to keep the
399	* kref counts correct we must undo the get
400	*/
401	kref_put(kref: &vub300->kref, release: vub300_delete);
402	}
403	}
404
405	static void vub300_queue_poll_work(struct vub300_mmc_host *vub300, int delay)
406	{
407	kref_get(kref: &vub300->kref);
408	if (queue_delayed_work(wq: pollworkqueue, dwork: &vub300->pollwork, delay)) {
409	/*
410	* then the pollworkqueue was not previously
411	* running and the above get ref is obvious
412	* required and will be put when the thread
413	* terminates by a specific call
414	*/
415	} else {
416	/*
417	* the pollworkqueue was already running from
418	* a previous invocation and thus to keep the
419	* kref counts correct we must undo the get
420	*/
421	kref_put(kref: &vub300->kref, release: vub300_delete);
422	}
423	}
424
425	static void vub300_queue_dead_work(struct vub300_mmc_host *vub300)
426	{
427	kref_get(kref: &vub300->kref);
428	if (queue_work(wq: deadworkqueue, work: &vub300->deadwork)) {
429	/*
430	* then the deadworkqueue was not previously
431	* running and the above get ref is obvious
432	* required and will be put when the thread
433	* terminates by a specific call
434	*/
435	} else {
436	/*
437	* the deadworkqueue was already running from
438	* a previous invocation and thus to keep the
439	* kref counts correct we must undo the get
440	*/
441	kref_put(kref: &vub300->kref, release: vub300_delete);
442	}
443	}
444
445	static void irqpoll_res_completed(struct urb *urb)
446	{ /* urb completion handler - hardirq */
447	struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
448	if (urb->status)
449	vub300->usb_transport_fail = urb->status;
450	complete(&vub300->irqpoll_complete);
451	}
452
453	static void irqpoll_out_completed(struct urb *urb)
454	{ /* urb completion handler - hardirq */
455	struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
456	if (urb->status) {
457	vub300->usb_transport_fail = urb->status;
458	complete(&vub300->irqpoll_complete);
459	return;
460	} else {
461	int ret;
462	unsigned int pipe =
463	usb_rcvbulkpipe(vub300->udev, vub300->cmnd_res_ep);
464	usb_fill_bulk_urb(urb: vub300->command_res_urb, dev: vub300->udev, pipe,
465	transfer_buffer: &vub300->resp, buffer_length: sizeof(vub300->resp),
466	complete_fn: irqpoll_res_completed, context: vub300);
467	vub300->command_res_urb->actual_length = 0;
468	ret = usb_submit_urb(urb: vub300->command_res_urb, GFP_ATOMIC);
469	if (ret) {
470	vub300->usb_transport_fail = ret;
471	complete(&vub300->irqpoll_complete);
472	}
473	return;
474	}
475	}
476
477	static void send_irqpoll(struct vub300_mmc_host *vub300)
478	{
479	/* cmd_mutex is held by vub300_pollwork_thread */
480	int retval;
481	int timeout = 0xFFFF & (0x0001FFFF - firmware_irqpoll_timeout);
482	vub300->cmnd.poll.header_size = 22;
483	vub300->cmnd.poll.header_type = 1;
484	vub300->cmnd.poll.port_number = 0;
485	vub300->cmnd.poll.command_type = 2;
486	vub300->cmnd.poll.poll_timeout_lsb = 0xFF & (unsigned)timeout;
487	vub300->cmnd.poll.poll_timeout_msb = 0xFF & (unsigned)(timeout >> 8);
488	usb_fill_bulk_urb(urb: vub300->command_out_urb, dev: vub300->udev,
489	usb_sndbulkpipe(vub300->udev, vub300->cmnd_out_ep)
490	, transfer_buffer: &vub300->cmnd, buffer_length: sizeof(vub300->cmnd)
491	, complete_fn: irqpoll_out_completed, context: vub300);
492	retval = usb_submit_urb(urb: vub300->command_out_urb, GFP_KERNEL);
493	if (0 > retval) {
494	vub300->usb_transport_fail = retval;
495	vub300_queue_poll_work(vub300, delay: 1);
496	complete(&vub300->irqpoll_complete);
497	return;
498	} else {
499	return;
500	}
501	}
502
503	static void new_system_port_status(struct vub300_mmc_host *vub300)
504	{
505	int old_card_present = vub300->card_present;
506	int new_card_present =
507	(0x0001 & vub300->system_port_status.port_flags) ? 1 : 0;
508	vub300->read_only =
509	(0x0010 & vub300->system_port_status.port_flags) ? 1 : 0;
510	if (new_card_present && !old_card_present) {
511	dev_info(&vub300->udev->dev, "card just inserted\n");
512	vub300->card_present = 1;
513	vub300->bus_width = 0;
514	if (disable_offload_processing)
515	strscpy(p: vub300->vub_name, q: "EMPTY Processing Disabled",
516	size: sizeof(vub300->vub_name));
517	else
518	vub300->vub_name[0] = 0;
519	mmc_detect_change(vub300->mmc, delay: 1);
520	} else if (!new_card_present && old_card_present) {
521	dev_info(&vub300->udev->dev, "card just ejected\n");
522	vub300->card_present = 0;
523	mmc_detect_change(vub300->mmc, delay: 0);
524	} else {
525	/* no change */
526	}
527	}
528
529	static void __add_offloaded_reg_to_fifo(struct vub300_mmc_host *vub300,
530	struct offload_registers_access
531	*register_access, u8 func)
532	{
533	u8 r = vub300->fn[func].offload_point + vub300->fn[func].offload_count;
534	memcpy(&vub300->fn[func].reg[MAXREGMASK & r], register_access,
535	sizeof(struct offload_registers_access));
536	vub300->fn[func].offload_count += 1;
537	vub300->total_offload_count += 1;
538	}
539
540	static void add_offloaded_reg(struct vub300_mmc_host *vub300,
541	struct offload_registers_access *register_access)
542	{
543	u32 Register = ((0x03 & register_access->command_byte[0]) << 15)
544	| ((0xFF & register_access->command_byte[1]) << 7)
545	| ((0xFE & register_access->command_byte[2]) >> 1);
546	u8 func = ((0x70 & register_access->command_byte[0]) >> 4);
547	u8 regs = vub300->dynamic_register_count;
548	u8 i = 0;
549	while (0 < regs-- && 1 == vub300->sdio_register[i].activate) {
550	if (vub300->sdio_register[i].func_num == func &&
551	vub300->sdio_register[i].sdio_reg == Register) {
552	if (vub300->sdio_register[i].prepared == 0)
553	vub300->sdio_register[i].prepared = 1;
554	vub300->sdio_register[i].response =
555	register_access->Respond_Byte[2];
556	vub300->sdio_register[i].regvalue =
557	register_access->Respond_Byte[3];
558	return;
559	} else {
560	i += 1;
561	continue;
562	}
563	}
564	__add_offloaded_reg_to_fifo(vub300, register_access, func);
565	}
566
567	static void check_vub300_port_status(struct vub300_mmc_host *vub300)
568	{
569	/*
570	* cmd_mutex is held by vub300_pollwork_thread,
571	* vub300_deadwork_thread or vub300_cmndwork_thread
572	*/
573	int retval;
574	retval =
575	usb_control_msg(dev: vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
576	GET_SYSTEM_PORT_STATUS,
577	USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
578	value: 0x0000, index: 0x0000, data: &vub300->system_port_status,
579	size: sizeof(vub300->system_port_status), timeout: 1000);
580	if (sizeof(vub300->system_port_status) == retval)
581	new_system_port_status(vub300);
582	}
583
584	static void __vub300_irqpoll_response(struct vub300_mmc_host *vub300)
585	{
586	/* cmd_mutex is held by vub300_pollwork_thread */
587	if (vub300->command_res_urb->actual_length == 0)
588	return;
589
590	switch (vub300->resp.common.header_type) {
591	case RESPONSE_INTERRUPT:
592	mutex_lock(&vub300->irq_mutex);
593	if (vub300->irq_enabled)
594	mmc_signal_sdio_irq(host: vub300->mmc);
595	else
596	vub300->irqs_queued += 1;
597	vub300->irq_disabled = 1;
598	mutex_unlock(lock: &vub300->irq_mutex);
599	break;
600	case RESPONSE_ERROR:
601	if (vub300->resp.error.error_code == SD_ERROR_NO_DEVICE)
602	check_vub300_port_status(vub300);
603	break;
604	case RESPONSE_STATUS:
605	vub300->system_port_status = vub300->resp.status;
606	new_system_port_status(vub300);
607	if (!vub300->card_present)
608	vub300_queue_poll_work(vub300, HZ / 5);
609	break;
610	case RESPONSE_IRQ_DISABLED:
611	{
612	int offloaded_data_length = vub300->resp.common.header_size - 3;
613	int register_count = offloaded_data_length >> 3;
614	int ri = 0;
615	while (register_count--) {
616	add_offloaded_reg(vub300, register_access: &vub300->resp.irq.reg[ri]);
617	ri += 1;
618	}
619	mutex_lock(&vub300->irq_mutex);
620	if (vub300->irq_enabled)
621	mmc_signal_sdio_irq(host: vub300->mmc);
622	else
623	vub300->irqs_queued += 1;
624	vub300->irq_disabled = 1;
625	mutex_unlock(lock: &vub300->irq_mutex);
626	break;
627	}
628	case RESPONSE_IRQ_ENABLED:
629	{
630	int offloaded_data_length = vub300->resp.common.header_size - 3;
631	int register_count = offloaded_data_length >> 3;
632	int ri = 0;
633	while (register_count--) {
634	add_offloaded_reg(vub300, register_access: &vub300->resp.irq.reg[ri]);
635	ri += 1;
636	}
637	mutex_lock(&vub300->irq_mutex);
638	if (vub300->irq_enabled)
639	mmc_signal_sdio_irq(host: vub300->mmc);
640	else
641	vub300->irqs_queued += 1;
642	vub300->irq_disabled = 0;
643	mutex_unlock(lock: &vub300->irq_mutex);
644	break;
645	}
646	case RESPONSE_NO_INTERRUPT:
647	vub300_queue_poll_work(vub300, delay: 1);
648	break;
649	default:
650	break;
651	}
652	}
653
654	static void __do_poll(struct vub300_mmc_host *vub300)
655	{
656	/* cmd_mutex is held by vub300_pollwork_thread */
657	unsigned long commretval;
658	mod_timer(timer: &vub300->inactivity_timer, expires: jiffies + HZ);
659	init_completion(x: &vub300->irqpoll_complete);
660	send_irqpoll(vub300);
661	commretval = wait_for_completion_timeout(x: &vub300->irqpoll_complete,
662	timeout: msecs_to_jiffies(m: 500));
663	if (vub300->usb_transport_fail) {
664	/* no need to do anything */
665	} else if (commretval == 0) {
666	vub300->usb_timed_out = 1;
667	usb_kill_urb(urb: vub300->command_out_urb);
668	usb_kill_urb(urb: vub300->command_res_urb);
669	} else { /* commretval > 0 */
670	__vub300_irqpoll_response(vub300);
671	}
672	}
673
674	/* this thread runs only when the driver
675	* is trying to poll the device for an IRQ
676	*/
677	static void vub300_pollwork_thread(struct work_struct *work)
678	{ /* NOT irq */
679	struct vub300_mmc_host *vub300 = container_of(work,
680	struct vub300_mmc_host, pollwork.work);
681	if (!vub300->interface) {
682	kref_put(kref: &vub300->kref, release: vub300_delete);
683	return;
684	}
685	mutex_lock(&vub300->cmd_mutex);
686	if (vub300->cmd) {
687	vub300_queue_poll_work(vub300, delay: 1);
688	} else if (!vub300->card_present) {
689	/* no need to do anything */
690	} else { /* vub300->card_present */
691	mutex_lock(&vub300->irq_mutex);
692	if (!vub300->irq_enabled) {
693	mutex_unlock(lock: &vub300->irq_mutex);
694	} else if (vub300->irqs_queued) {
695	vub300->irqs_queued -= 1;
696	mmc_signal_sdio_irq(host: vub300->mmc);
697	mod_timer(timer: &vub300->inactivity_timer, expires: jiffies + HZ);
698	mutex_unlock(lock: &vub300->irq_mutex);
699	} else { /* NOT vub300->irqs_queued */
700	mutex_unlock(lock: &vub300->irq_mutex);
701	__do_poll(vub300);
702	}
703	}
704	mutex_unlock(lock: &vub300->cmd_mutex);
705	kref_put(kref: &vub300->kref, release: vub300_delete);
706	}
707
708	static void vub300_deadwork_thread(struct work_struct *work)
709	{ /* NOT irq */
710	struct vub300_mmc_host *vub300 =
711	container_of(work, struct vub300_mmc_host, deadwork);
712	if (!vub300->interface) {
713	kref_put(kref: &vub300->kref, release: vub300_delete);
714	return;
715	}
716	mutex_lock(&vub300->cmd_mutex);
717	if (vub300->cmd) {
718	/*
719	* a command got in as the inactivity
720	* timer expired - so we just let the
721	* processing of the command show if
722	* the device is dead
723	*/
724	} else if (vub300->card_present) {
725	check_vub300_port_status(vub300);
726	} else if (vub300->mmc && vub300->mmc->card) {
727	/*
728	* the MMC core must not have responded
729	* to the previous indication - lets
730	* hope that it eventually does so we
731	* will just ignore this for now
732	*/
733	} else {
734	check_vub300_port_status(vub300);
735	}
736	mod_timer(timer: &vub300->inactivity_timer, expires: jiffies + HZ);
737	mutex_unlock(lock: &vub300->cmd_mutex);
738	kref_put(kref: &vub300->kref, release: vub300_delete);
739	}
740
741	static void vub300_inactivity_timer_expired(struct timer_list *t)
742	{ /* softirq */
743	struct vub300_mmc_host *vub300 = from_timer(vub300, t,
744	inactivity_timer);
745	if (!vub300->interface) {
746	kref_put(kref: &vub300->kref, release: vub300_delete);
747	} else if (vub300->cmd) {
748	mod_timer(timer: &vub300->inactivity_timer, expires: jiffies + HZ);
749	} else {
750	vub300_queue_dead_work(vub300);
751	mod_timer(timer: &vub300->inactivity_timer, expires: jiffies + HZ);
752	}
753	}
754
755	static int vub300_response_error(u8 error_code)
756	{
757	switch (error_code) {
758	case SD_ERROR_PIO_TIMEOUT:
759	case SD_ERROR_1BIT_TIMEOUT:
760	case SD_ERROR_4BIT_TIMEOUT:
761	return -ETIMEDOUT;
762	case SD_ERROR_STAT_DATA:
763	case SD_ERROR_OVERRUN:
764	case SD_ERROR_STAT_CMD:
765	case SD_ERROR_STAT_CMD_TIMEOUT:
766	case SD_ERROR_SDCRDY_STUCK:
767	case SD_ERROR_UNHANDLED:
768	case SD_ERROR_1BIT_CRC_WRONG:
769	case SD_ERROR_4BIT_CRC_WRONG:
770	case SD_ERROR_1BIT_CRC_ERROR:
771	case SD_ERROR_4BIT_CRC_ERROR:
772	case SD_ERROR_NO_CMD_ENDBIT:
773	case SD_ERROR_NO_1BIT_DATEND:
774	case SD_ERROR_NO_4BIT_DATEND:
775	case SD_ERROR_1BIT_DATA_TIMEOUT:
776	case SD_ERROR_4BIT_DATA_TIMEOUT:
777	case SD_ERROR_1BIT_UNEXPECTED_TIMEOUT:
778	case SD_ERROR_4BIT_UNEXPECTED_TIMEOUT:
779	return -EILSEQ;
780	case 33:
781	return -EILSEQ;
782	case SD_ERROR_ILLEGAL_COMMAND:
783	return -EINVAL;
784	case SD_ERROR_NO_DEVICE:
785	return -ENOMEDIUM;
786	default:
787	return -ENODEV;
788	}
789	}
790
791	static void command_res_completed(struct urb *urb)
792	{ /* urb completion handler - hardirq */
793	struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
794	if (urb->status) {
795	/* we have to let the initiator handle the error */
796	} else if (vub300->command_res_urb->actual_length == 0) {
797	/*
798	* we have seen this happen once or twice and
799	* we suspect a buggy USB host controller
800	*/
801	} else if (!vub300->data) {
802	/* this means that the command (typically CMD52) succeeded */
803	} else if (vub300->resp.common.header_type != 0x02) {
804	/*
805	* this is an error response from the VUB300 chip
806	* and we let the initiator handle it
807	*/
808	} else if (vub300->urb) {
809	vub300->cmd->error =
810	vub300_response_error(error_code: vub300->resp.error.error_code);
811	usb_unlink_urb(urb: vub300->urb);
812	} else {
813	vub300->cmd->error =
814	vub300_response_error(error_code: vub300->resp.error.error_code);
815	usb_sg_cancel(io: &vub300->sg_request);
816	}
817	complete(&vub300->command_complete); /* got_response_in */
818	}
819
820	static void command_out_completed(struct urb *urb)
821	{ /* urb completion handler - hardirq */
822	struct vub300_mmc_host *vub300 = (struct vub300_mmc_host *)urb->context;
823	if (urb->status) {
824	complete(&vub300->command_complete);
825	} else {
826	int ret;
827	unsigned int pipe =
828	usb_rcvbulkpipe(vub300->udev, vub300->cmnd_res_ep);
829	usb_fill_bulk_urb(urb: vub300->command_res_urb, dev: vub300->udev, pipe,
830	transfer_buffer: &vub300->resp, buffer_length: sizeof(vub300->resp),
831	complete_fn: command_res_completed, context: vub300);
832	vub300->command_res_urb->actual_length = 0;
833	ret = usb_submit_urb(urb: vub300->command_res_urb, GFP_ATOMIC);
834	if (ret == 0) {
835	/*
836	* the urb completion handler will call
837	* our completion handler
838	*/
839	} else {
840	/*
841	* and thus we only call it directly
842	* when it will not be called
843	*/
844	complete(&vub300->command_complete);
845	}
846	}
847	}
848
849	/*
850	* the STUFF bits are masked out for the comparisons
851	*/
852	static void snoop_block_size_and_bus_width(struct vub300_mmc_host *vub300,
853	u32 cmd_arg)
854	{
855	if ((0xFBFFFE00 & cmd_arg) == 0x80022200)
856	vub300->fbs[1] = (cmd_arg << 8) | (0x00FF & vub300->fbs[1]);
857	else if ((0xFBFFFE00 & cmd_arg) == 0x80022000)
858	vub300->fbs[1] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[1]);
859	else if ((0xFBFFFE00 & cmd_arg) == 0x80042200)
860	vub300->fbs[2] = (cmd_arg << 8) | (0x00FF & vub300->fbs[2]);
861	else if ((0xFBFFFE00 & cmd_arg) == 0x80042000)
862	vub300->fbs[2] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[2]);
863	else if ((0xFBFFFE00 & cmd_arg) == 0x80062200)
864	vub300->fbs[3] = (cmd_arg << 8) | (0x00FF & vub300->fbs[3]);
865	else if ((0xFBFFFE00 & cmd_arg) == 0x80062000)
866	vub300->fbs[3] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[3]);
867	else if ((0xFBFFFE00 & cmd_arg) == 0x80082200)
868	vub300->fbs[4] = (cmd_arg << 8) | (0x00FF & vub300->fbs[4]);
869	else if ((0xFBFFFE00 & cmd_arg) == 0x80082000)
870	vub300->fbs[4] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[4]);
871	else if ((0xFBFFFE00 & cmd_arg) == 0x800A2200)
872	vub300->fbs[5] = (cmd_arg << 8) | (0x00FF & vub300->fbs[5]);
873	else if ((0xFBFFFE00 & cmd_arg) == 0x800A2000)
874	vub300->fbs[5] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[5]);
875	else if ((0xFBFFFE00 & cmd_arg) == 0x800C2200)
876	vub300->fbs[6] = (cmd_arg << 8) | (0x00FF & vub300->fbs[6]);
877	else if ((0xFBFFFE00 & cmd_arg) == 0x800C2000)
878	vub300->fbs[6] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[6]);
879	else if ((0xFBFFFE00 & cmd_arg) == 0x800E2200)
880	vub300->fbs[7] = (cmd_arg << 8) | (0x00FF & vub300->fbs[7]);
881	else if ((0xFBFFFE00 & cmd_arg) == 0x800E2000)
882	vub300->fbs[7] = (0xFF & cmd_arg) | (0xFF00 & vub300->fbs[7]);
883	else if ((0xFBFFFE03 & cmd_arg) == 0x80000E00)
884	vub300->bus_width = 1;
885	else if ((0xFBFFFE03 & cmd_arg) == 0x80000E02)
886	vub300->bus_width = 4;
887	}
888
889	static void send_command(struct vub300_mmc_host *vub300)
890	{
891	/* cmd_mutex is held by vub300_cmndwork_thread */
892	struct mmc_command *cmd = vub300->cmd;
893	struct mmc_data *data = vub300->data;
894	int retval;
895	int i;
896	u8 response_type;
897	if (vub300->app_spec) {
898	switch (cmd->opcode) {
899	case 6:
900	response_type = SDRT_1;
901	vub300->resp_len = 6;
902	if (0x00000000 == (0x00000003 & cmd->arg))
903	vub300->bus_width = 1;
904	else if (0x00000002 == (0x00000003 & cmd->arg))
905	vub300->bus_width = 4;
906	else
907	dev_err(&vub300->udev->dev,
908	"unexpected ACMD6 bus_width=%d\n",
909	0x00000003 & cmd->arg);
910	break;
911	case 13:
912	response_type = SDRT_1;
913	vub300->resp_len = 6;
914	break;
915	case 22:
916	response_type = SDRT_1;
917	vub300->resp_len = 6;
918	break;
919	case 23:
920	response_type = SDRT_1;
921	vub300->resp_len = 6;
922	break;
923	case 41:
924	response_type = SDRT_3;
925	vub300->resp_len = 6;
926	break;
927	case 42:
928	response_type = SDRT_1;
929	vub300->resp_len = 6;
930	break;
931	case 51:
932	response_type = SDRT_1;
933	vub300->resp_len = 6;
934	break;
935	case 55:
936	response_type = SDRT_1;
937	vub300->resp_len = 6;
938	break;
939	default:
940	vub300->resp_len = 0;
941	cmd->error = -EINVAL;
942	complete(&vub300->command_complete);
943	return;
944	}
945	vub300->app_spec = 0;
946	} else {
947	switch (cmd->opcode) {
948	case 0:
949	response_type = SDRT_NONE;
950	vub300->resp_len = 0;
951	break;
952	case 1:
953	response_type = SDRT_3;
954	vub300->resp_len = 6;
955	break;
956	case 2:
957	response_type = SDRT_2;
958	vub300->resp_len = 17;
959	break;
960	case 3:
961	response_type = SDRT_6;
962	vub300->resp_len = 6;
963	break;
964	case 4:
965	response_type = SDRT_NONE;
966	vub300->resp_len = 0;
967	break;
968	case 5:
969	response_type = SDRT_4;
970	vub300->resp_len = 6;
971	break;
972	case 6:
973	response_type = SDRT_1;
974	vub300->resp_len = 6;
975	break;
976	case 7:
977	response_type = SDRT_1B;
978	vub300->resp_len = 6;
979	break;
980	case 8:
981	response_type = SDRT_7;
982	vub300->resp_len = 6;
983	break;
984	case 9:
985	response_type = SDRT_2;
986	vub300->resp_len = 17;
987	break;
988	case 10:
989	response_type = SDRT_2;
990	vub300->resp_len = 17;
991	break;
992	case 12:
993	response_type = SDRT_1B;
994	vub300->resp_len = 6;
995	break;
996	case 13:
997	response_type = SDRT_1;
998	vub300->resp_len = 6;
999	break;
1000	case 15:
1001	response_type = SDRT_NONE;
1002	vub300->resp_len = 0;
1003	break;
1004	case 16:
1005	for (i = 0; i < ARRAY_SIZE(vub300->fbs); i++)
1006	vub300->fbs[i] = 0xFFFF & cmd->arg;
1007	response_type = SDRT_1;
1008	vub300->resp_len = 6;
1009	break;
1010	case 17:
1011	case 18:
1012	case 24:
1013	case 25:
1014	case 27:
1015	response_type = SDRT_1;
1016	vub300->resp_len = 6;
1017	break;
1018	case 28:
1019	case 29:
1020	response_type = SDRT_1B;
1021	vub300->resp_len = 6;
1022	break;
1023	case 30:
1024	case 32:
1025	case 33:
1026	response_type = SDRT_1;
1027	vub300->resp_len = 6;
1028	break;
1029	case 38:
1030	response_type = SDRT_1B;
1031	vub300->resp_len = 6;
1032	break;
1033	case 42:
1034	response_type = SDRT_1;
1035	vub300->resp_len = 6;
1036	break;
1037	case 52:
1038	response_type = SDRT_5;
1039	vub300->resp_len = 6;
1040	snoop_block_size_and_bus_width(vub300, cmd_arg: cmd->arg);
1041	break;
1042	case 53:
1043	response_type = SDRT_5;
1044	vub300->resp_len = 6;
1045	break;
1046	case 55:
1047	response_type = SDRT_1;
1048	vub300->resp_len = 6;
1049	vub300->app_spec = 1;
1050	break;
1051	case 56:
1052	response_type = SDRT_1;
1053	vub300->resp_len = 6;
1054	break;
1055	default:
1056	vub300->resp_len = 0;
1057	cmd->error = -EINVAL;
1058	complete(&vub300->command_complete);
1059	return;
1060	}
1061	}
1062	/*
1063	* it is a shame that we can not use "sizeof(struct sd_command_header)"
1064	* this is because the packet _must_ be padded to 64 bytes
1065	*/
1066	vub300->cmnd.head.header_size = 20;
1067	vub300->cmnd.head.header_type = 0x00;
1068	vub300->cmnd.head.port_number = 0; /* "0" means port 1 */
1069	vub300->cmnd.head.command_type = 0x00; /* standard read command */
1070	vub300->cmnd.head.response_type = response_type;
1071	vub300->cmnd.head.command_index = cmd->opcode;
1072	vub300->cmnd.head.arguments[0] = cmd->arg >> 24;
1073	vub300->cmnd.head.arguments[1] = cmd->arg >> 16;
1074	vub300->cmnd.head.arguments[2] = cmd->arg >> 8;
1075	vub300->cmnd.head.arguments[3] = cmd->arg >> 0;
1076	if (cmd->opcode == 52) {
1077	int fn = 0x7 & (cmd->arg >> 28);
1078	vub300->cmnd.head.block_count[0] = 0;
1079	vub300->cmnd.head.block_count[1] = 0;
1080	vub300->cmnd.head.block_size[0] = (vub300->fbs[fn] >> 8) & 0xFF;
1081	vub300->cmnd.head.block_size[1] = (vub300->fbs[fn] >> 0) & 0xFF;
1082	vub300->cmnd.head.command_type = 0x00;
1083	vub300->cmnd.head.transfer_size[0] = 0;
1084	vub300->cmnd.head.transfer_size[1] = 0;
1085	vub300->cmnd.head.transfer_size[2] = 0;
1086	vub300->cmnd.head.transfer_size[3] = 0;
1087	} else if (!data) {
1088	vub300->cmnd.head.block_count[0] = 0;
1089	vub300->cmnd.head.block_count[1] = 0;
1090	vub300->cmnd.head.block_size[0] = (vub300->fbs[0] >> 8) & 0xFF;
1091	vub300->cmnd.head.block_size[1] = (vub300->fbs[0] >> 0) & 0xFF;
1092	vub300->cmnd.head.command_type = 0x00;
1093	vub300->cmnd.head.transfer_size[0] = 0;
1094	vub300->cmnd.head.transfer_size[1] = 0;
1095	vub300->cmnd.head.transfer_size[2] = 0;
1096	vub300->cmnd.head.transfer_size[3] = 0;
1097	} else if (cmd->opcode == 53) {
1098	int fn = 0x7 & (cmd->arg >> 28);
1099	if (0x08 & vub300->cmnd.head.arguments[0]) { /* BLOCK MODE */
1100	vub300->cmnd.head.block_count[0] =
1101	(data->blocks >> 8) & 0xFF;
1102	vub300->cmnd.head.block_count[1] =
1103	(data->blocks >> 0) & 0xFF;
1104	vub300->cmnd.head.block_size[0] =
1105	(data->blksz >> 8) & 0xFF;
1106	vub300->cmnd.head.block_size[1] =
1107	(data->blksz >> 0) & 0xFF;
1108	} else { /* BYTE MODE */
1109	vub300->cmnd.head.block_count[0] = 0;
1110	vub300->cmnd.head.block_count[1] = 0;
1111	vub300->cmnd.head.block_size[0] =
1112	(vub300->datasize >> 8) & 0xFF;
1113	vub300->cmnd.head.block_size[1] =
1114	(vub300->datasize >> 0) & 0xFF;
1115	}
1116	vub300->cmnd.head.command_type =
1117	(MMC_DATA_READ & data->flags) ? 0x00 : 0x80;
1118	vub300->cmnd.head.transfer_size[0] =
1119	(vub300->datasize >> 24) & 0xFF;
1120	vub300->cmnd.head.transfer_size[1] =
1121	(vub300->datasize >> 16) & 0xFF;
1122	vub300->cmnd.head.transfer_size[2] =
1123	(vub300->datasize >> 8) & 0xFF;
1124	vub300->cmnd.head.transfer_size[3] =
1125	(vub300->datasize >> 0) & 0xFF;
1126	if (vub300->datasize < vub300->fbs[fn]) {
1127	vub300->cmnd.head.block_count[0] = 0;
1128	vub300->cmnd.head.block_count[1] = 0;
1129	}
1130	} else {
1131	vub300->cmnd.head.block_count[0] = (data->blocks >> 8) & 0xFF;
1132	vub300->cmnd.head.block_count[1] = (data->blocks >> 0) & 0xFF;
1133	vub300->cmnd.head.block_size[0] = (data->blksz >> 8) & 0xFF;
1134	vub300->cmnd.head.block_size[1] = (data->blksz >> 0) & 0xFF;
1135	vub300->cmnd.head.command_type =
1136	(MMC_DATA_READ & data->flags) ? 0x00 : 0x80;
1137	vub300->cmnd.head.transfer_size[0] =
1138	(vub300->datasize >> 24) & 0xFF;
1139	vub300->cmnd.head.transfer_size[1] =
1140	(vub300->datasize >> 16) & 0xFF;
1141	vub300->cmnd.head.transfer_size[2] =
1142	(vub300->datasize >> 8) & 0xFF;
1143	vub300->cmnd.head.transfer_size[3] =
1144	(vub300->datasize >> 0) & 0xFF;
1145	if (vub300->datasize < vub300->fbs[0]) {
1146	vub300->cmnd.head.block_count[0] = 0;
1147	vub300->cmnd.head.block_count[1] = 0;
1148	}
1149	}
1150	if (vub300->cmnd.head.block_size[0] || vub300->cmnd.head.block_size[1]) {
1151	u16 block_size = vub300->cmnd.head.block_size[1] |
1152	(vub300->cmnd.head.block_size[0] << 8);
1153	u16 block_boundary = FIRMWARE_BLOCK_BOUNDARY -
1154	(FIRMWARE_BLOCK_BOUNDARY % block_size);
1155	vub300->cmnd.head.block_boundary[0] =
1156	(block_boundary >> 8) & 0xFF;
1157	vub300->cmnd.head.block_boundary[1] =
1158	(block_boundary >> 0) & 0xFF;
1159	} else {
1160	vub300->cmnd.head.block_boundary[0] = 0;
1161	vub300->cmnd.head.block_boundary[1] = 0;
1162	}
1163	usb_fill_bulk_urb(urb: vub300->command_out_urb, dev: vub300->udev,
1164	usb_sndbulkpipe(vub300->udev, vub300->cmnd_out_ep),
1165	transfer_buffer: &vub300->cmnd, buffer_length: sizeof(vub300->cmnd),
1166	complete_fn: command_out_completed, context: vub300);
1167	retval = usb_submit_urb(urb: vub300->command_out_urb, GFP_KERNEL);
1168	if (retval < 0) {
1169	cmd->error = retval;
1170	complete(&vub300->command_complete);
1171	return;
1172	} else {
1173	return;
1174	}
1175	}
1176
1177	/*
1178	* timer callback runs in atomic mode
1179	* so it cannot call usb_kill_urb()
1180	*/
1181	static void vub300_sg_timed_out(struct timer_list *t)
1182	{
1183	struct vub300_mmc_host *vub300 = from_timer(vub300, t,
1184	sg_transfer_timer);
1185	vub300->usb_timed_out = 1;
1186	usb_sg_cancel(io: &vub300->sg_request);
1187	usb_unlink_urb(urb: vub300->command_out_urb);
1188	usb_unlink_urb(urb: vub300->command_res_urb);
1189	}
1190
1191	static u16 roundup_to_multiple_of_64(u16 number)
1192	{
1193	return 0xFFC0 & (0x3F + number);
1194	}
1195
1196	/*
1197	* this is a separate function to solve the 80 column width restriction
1198	*/
1199	static void __download_offload_pseudocode(struct vub300_mmc_host *vub300,
1200	const struct firmware *fw)
1201	{
1202	u8 register_count = 0;
1203	u16 ts = 0;
1204	u16 interrupt_size = 0;
1205	const u8 *data = fw->data;
1206	int size = fw->size;
1207	u8 c;
1208	dev_info(&vub300->udev->dev, "using %s for SDIO offload processing\n",
1209	vub300->vub_name);
1210	do {
1211	c = *data++;
1212	} while (size-- && c); /* skip comment */
1213	dev_info(&vub300->udev->dev, "using offload firmware %s %s\n", fw->data,
1214	vub300->vub_name);
1215	if (size < 4) {
1216	dev_err(&vub300->udev->dev,
1217	"corrupt offload pseudocode in firmware %s\n",
1218	vub300->vub_name);
1219	strscpy(p: vub300->vub_name, q: "corrupt offload pseudocode",
1220	size: sizeof(vub300->vub_name));
1221	return;
1222	}
1223	interrupt_size += *data++;
1224	size -= 1;
1225	interrupt_size <<= 8;
1226	interrupt_size += *data++;
1227	size -= 1;
1228	if (interrupt_size < size) {
1229	u16 xfer_length = roundup_to_multiple_of_64(number: interrupt_size);
1230	u8 *xfer_buffer = kmalloc(size: xfer_length, GFP_KERNEL);
1231	if (xfer_buffer) {
1232	int retval;
1233	memcpy(xfer_buffer, data, interrupt_size);
1234	memset(xfer_buffer + interrupt_size, 0,
1235	xfer_length - interrupt_size);
1236	size -= interrupt_size;
1237	data += interrupt_size;
1238	retval =
1239	usb_control_msg(dev: vub300->udev,
1240	usb_sndctrlpipe(vub300->udev, 0),
1241	SET_INTERRUPT_PSEUDOCODE,
1242	USB_DIR_OUT | USB_TYPE_VENDOR |
1243	USB_RECIP_DEVICE, value: 0x0000, index: 0x0000,
1244	data: xfer_buffer, size: xfer_length, timeout: 1000);
1245	kfree(objp: xfer_buffer);
1246	if (retval < 0)
1247	goto copy_error_message;
1248	} else {
1249	dev_err(&vub300->udev->dev,
1250	"not enough memory for xfer buffer to send"
1251	" INTERRUPT_PSEUDOCODE for %s %s\n", fw->data,
1252	vub300->vub_name);
1253	strscpy(p: vub300->vub_name,
1254	q: "SDIO interrupt pseudocode download failed",
1255	size: sizeof(vub300->vub_name));
1256	return;
1257	}
1258	} else {
1259	dev_err(&vub300->udev->dev,
1260	"corrupt interrupt pseudocode in firmware %s %s\n",
1261	fw->data, vub300->vub_name);
1262	strscpy(p: vub300->vub_name, q: "corrupt interrupt pseudocode",
1263	size: sizeof(vub300->vub_name));
1264	return;
1265	}
1266	ts += *data++;
1267	size -= 1;
1268	ts <<= 8;
1269	ts += *data++;
1270	size -= 1;
1271	if (ts < size) {
1272	u16 xfer_length = roundup_to_multiple_of_64(number: ts);
1273	u8 *xfer_buffer = kmalloc(size: xfer_length, GFP_KERNEL);
1274	if (xfer_buffer) {
1275	int retval;
1276	memcpy(xfer_buffer, data, ts);
1277	memset(xfer_buffer + ts, 0,
1278	xfer_length - ts);
1279	size -= ts;
1280	data += ts;
1281	retval =
1282	usb_control_msg(dev: vub300->udev,
1283	usb_sndctrlpipe(vub300->udev, 0),
1284	SET_TRANSFER_PSEUDOCODE,
1285	USB_DIR_OUT | USB_TYPE_VENDOR |
1286	USB_RECIP_DEVICE, value: 0x0000, index: 0x0000,
1287	data: xfer_buffer, size: xfer_length, timeout: 1000);
1288	kfree(objp: xfer_buffer);
1289	if (retval < 0)
1290	goto copy_error_message;
1291	} else {
1292	dev_err(&vub300->udev->dev,
1293	"not enough memory for xfer buffer to send"
1294	" TRANSFER_PSEUDOCODE for %s %s\n", fw->data,
1295	vub300->vub_name);
1296	strscpy(p: vub300->vub_name,
1297	q: "SDIO transfer pseudocode download failed",
1298	size: sizeof(vub300->vub_name));
1299	return;
1300	}
1301	} else {
1302	dev_err(&vub300->udev->dev,
1303	"corrupt transfer pseudocode in firmware %s %s\n",
1304	fw->data, vub300->vub_name);
1305	strscpy(p: vub300->vub_name, q: "corrupt transfer pseudocode",
1306	size: sizeof(vub300->vub_name));
1307	return;
1308	}
1309	register_count += *data++;
1310	size -= 1;
1311	if (register_count * 4 == size) {
1312	int I = vub300->dynamic_register_count = register_count;
1313	int i = 0;
1314	while (I--) {
1315	unsigned int func_num = 0;
1316	vub300->sdio_register[i].func_num = *data++;
1317	size -= 1;
1318	func_num += *data++;
1319	size -= 1;
1320	func_num <<= 8;
1321	func_num += *data++;
1322	size -= 1;
1323	func_num <<= 8;
1324	func_num += *data++;
1325	size -= 1;
1326	vub300->sdio_register[i].sdio_reg = func_num;
1327	vub300->sdio_register[i].activate = 1;
1328	vub300->sdio_register[i].prepared = 0;
1329	i += 1;
1330	}
1331	dev_info(&vub300->udev->dev,
1332	"initialized %d dynamic pseudocode registers\n",
1333	vub300->dynamic_register_count);
1334	return;
1335	} else {
1336	dev_err(&vub300->udev->dev,
1337	"corrupt dynamic registers in firmware %s\n",
1338	vub300->vub_name);
1339	strscpy(p: vub300->vub_name, q: "corrupt dynamic registers",
1340	size: sizeof(vub300->vub_name));
1341	return;
1342	}
1343
1344	copy_error_message:
1345	strscpy(p: vub300->vub_name, q: "SDIO pseudocode download failed",
1346	size: sizeof(vub300->vub_name));
1347	}
1348
1349	/*
1350	* if the binary containing the EMPTY PseudoCode can not be found
1351	* vub300->vub_name is set anyway in order to prevent an automatic retry
1352	*/
1353	static void download_offload_pseudocode(struct vub300_mmc_host *vub300)
1354	{
1355	struct mmc_card *card = vub300->mmc->card;
1356	int sdio_funcs = card->sdio_funcs;
1357	const struct firmware *fw = NULL;
1358	int l = snprintf(buf: vub300->vub_name, size: sizeof(vub300->vub_name),
1359	fmt: "vub_%04X%04X", card->cis.vendor, card->cis.device);
1360	int n = 0;
1361	int retval;
1362	for (n = 0; n < sdio_funcs; n++) {
1363	struct sdio_func *sf = card->sdio_func[n];
1364	l += scnprintf(buf: vub300->vub_name + l,
1365	size: sizeof(vub300->vub_name) - l, fmt: "_%04X%04X",
1366	sf->vendor, sf->device);
1367	}
1368	snprintf(buf: vub300->vub_name + l, size: sizeof(vub300->vub_name) - l, fmt: ".bin");
1369	dev_info(&vub300->udev->dev, "requesting offload firmware %s\n",
1370	vub300->vub_name);
1371	retval = request_firmware(fw: &fw, name: vub300->vub_name, device: &card->dev);
1372	if (retval < 0) {
1373	strscpy(p: vub300->vub_name, q: "vub_default.bin",
1374	size: sizeof(vub300->vub_name));
1375	retval = request_firmware(fw: &fw, name: vub300->vub_name, device: &card->dev);
1376	if (retval < 0) {
1377	strscpy(p: vub300->vub_name,
1378	q: "no SDIO offload firmware found",
1379	size: sizeof(vub300->vub_name));
1380	} else {
1381	__download_offload_pseudocode(vub300, fw);
1382	release_firmware(fw);
1383	}
1384	} else {
1385	__download_offload_pseudocode(vub300, fw);
1386	release_firmware(fw);
1387	}
1388	}
1389
1390	static void vub300_usb_bulk_msg_completion(struct urb *urb)
1391	{ /* urb completion handler - hardirq */
1392	complete((struct completion *)urb->context);
1393	}
1394
1395	static int vub300_usb_bulk_msg(struct vub300_mmc_host *vub300,
1396	unsigned int pipe, void *data, int len,
1397	int *actual_length, int timeout_msecs)
1398	{
1399	/* cmd_mutex is held by vub300_cmndwork_thread */
1400	struct usb_device *usb_dev = vub300->udev;
1401	struct completion done;
1402	int retval;
1403	vub300->urb = usb_alloc_urb(iso_packets: 0, GFP_KERNEL);
1404	if (!vub300->urb)
1405	return -ENOMEM;
1406	usb_fill_bulk_urb(urb: vub300->urb, dev: usb_dev, pipe, transfer_buffer: data, buffer_length: len,
1407	complete_fn: vub300_usb_bulk_msg_completion, NULL);
1408	init_completion(x: &done);
1409	vub300->urb->context = &done;
1410	vub300->urb->actual_length = 0;
1411	retval = usb_submit_urb(urb: vub300->urb, GFP_KERNEL);
1412	if (unlikely(retval))
1413	goto out;
1414	if (!wait_for_completion_timeout
1415	(x: &done, timeout: msecs_to_jiffies(m: timeout_msecs))) {
1416	retval = -ETIMEDOUT;
1417	usb_kill_urb(urb: vub300->urb);
1418	} else {
1419	retval = vub300->urb->status;
1420	}
1421	out:
1422	*actual_length = vub300->urb->actual_length;
1423	usb_free_urb(urb: vub300->urb);
1424	vub300->urb = NULL;
1425	return retval;
1426	}
1427
1428	static int __command_read_data(struct vub300_mmc_host *vub300,
1429	struct mmc_command *cmd, struct mmc_data *data)
1430	{
1431	/* cmd_mutex is held by vub300_cmndwork_thread */
1432	int linear_length = vub300->datasize;
1433	int padded_length = vub300->large_usb_packets ?
1434	((511 + linear_length) >> 9) << 9 :
1435	((63 + linear_length) >> 6) << 6;
1436	if ((padded_length == linear_length) || !pad_input_to_usb_pkt) {
1437	int result;
1438	unsigned pipe;
1439	pipe = usb_rcvbulkpipe(vub300->udev, vub300->data_inp_ep);
1440	result = usb_sg_init(io: &vub300->sg_request, dev: vub300->udev,
1441	pipe, period: 0, sg: data->sg,
1442	nents: data->sg_len, length: 0, GFP_KERNEL);
1443	if (result < 0) {
1444	usb_unlink_urb(urb: vub300->command_out_urb);
1445	usb_unlink_urb(urb: vub300->command_res_urb);
1446	cmd->error = result;
1447	data->bytes_xfered = 0;
1448	return 0;
1449	} else {
1450	vub300->sg_transfer_timer.expires =
1451	jiffies + msecs_to_jiffies(m: 2000 +
1452	(linear_length / 16384));
1453	add_timer(timer: &vub300->sg_transfer_timer);
1454	usb_sg_wait(io: &vub300->sg_request);
1455	del_timer(timer: &vub300->sg_transfer_timer);
1456	if (vub300->sg_request.status < 0) {
1457	cmd->error = vub300->sg_request.status;
1458	data->bytes_xfered = 0;
1459	return 0;
1460	} else {
1461	data->bytes_xfered = vub300->datasize;
1462	return linear_length;
1463	}
1464	}
1465	} else {
1466	u8 *buf = kmalloc(size: padded_length, GFP_KERNEL);
1467	if (buf) {
1468	int result;
1469	unsigned pipe = usb_rcvbulkpipe(vub300->udev,
1470	vub300->data_inp_ep);
1471	int actual_length = 0;
1472	result = vub300_usb_bulk_msg(vub300, pipe, data: buf,
1473	len: padded_length, actual_length: &actual_length,
1474	timeout_msecs: 2000 + (padded_length / 16384));
1475	if (result < 0) {
1476	cmd->error = result;
1477	data->bytes_xfered = 0;
1478	kfree(objp: buf);
1479	return 0;
1480	} else if (actual_length < linear_length) {
1481	cmd->error = -EREMOTEIO;
1482	data->bytes_xfered = 0;
1483	kfree(objp: buf);
1484	return 0;
1485	} else {
1486	sg_copy_from_buffer(sgl: data->sg, nents: data->sg_len, buf,
1487	buflen: linear_length);
1488	kfree(objp: buf);
1489	data->bytes_xfered = vub300->datasize;
1490	return linear_length;
1491	}
1492	} else {
1493	cmd->error = -ENOMEM;
1494	data->bytes_xfered = 0;
1495	return 0;
1496	}
1497	}
1498	}
1499
1500	static int __command_write_data(struct vub300_mmc_host *vub300,
1501	struct mmc_command *cmd, struct mmc_data *data)
1502	{
1503	/* cmd_mutex is held by vub300_cmndwork_thread */
1504	unsigned pipe = usb_sndbulkpipe(vub300->udev, vub300->data_out_ep);
1505	int linear_length = vub300->datasize;
1506	int modulo_64_length = linear_length & 0x003F;
1507	int modulo_512_length = linear_length & 0x01FF;
1508	if (linear_length < 64) {
1509	int result;
1510	int actual_length;
1511	sg_copy_to_buffer(sgl: data->sg, nents: data->sg_len,
1512	buf: vub300->padded_buffer,
1513	buflen: sizeof(vub300->padded_buffer));
1514	memset(vub300->padded_buffer + linear_length, 0,
1515	sizeof(vub300->padded_buffer) - linear_length);
1516	result = vub300_usb_bulk_msg(vub300, pipe, data: vub300->padded_buffer,
1517	len: sizeof(vub300->padded_buffer),
1518	actual_length: &actual_length, timeout_msecs: 2000 +
1519	(sizeof(vub300->padded_buffer) /
1520	16384));
1521	if (result < 0) {
1522	cmd->error = result;
1523	data->bytes_xfered = 0;
1524	} else {
1525	data->bytes_xfered = vub300->datasize;
1526	}
1527	} else if ((!vub300->large_usb_packets && (0 < modulo_64_length)) ||
1528	(vub300->large_usb_packets && (64 > modulo_512_length))
1529	) { /* don't you just love these work-rounds */
1530	int padded_length = ((63 + linear_length) >> 6) << 6;
1531	u8 *buf = kmalloc(size: padded_length, GFP_KERNEL);
1532	if (buf) {
1533	int result;
1534	int actual_length;
1535	sg_copy_to_buffer(sgl: data->sg, nents: data->sg_len, buf,
1536	buflen: padded_length);
1537	memset(buf + linear_length, 0,
1538	padded_length - linear_length);
1539	result =
1540	vub300_usb_bulk_msg(vub300, pipe, data: buf,
1541	len: padded_length, actual_length: &actual_length,
1542	timeout_msecs: 2000 + padded_length / 16384);
1543	kfree(objp: buf);
1544	if (result < 0) {
1545	cmd->error = result;
1546	data->bytes_xfered = 0;
1547	} else {
1548	data->bytes_xfered = vub300->datasize;
1549	}
1550	} else {
1551	cmd->error = -ENOMEM;
1552	data->bytes_xfered = 0;
1553	}
1554	} else { /* no data padding required */
1555	int result;
1556	unsigned char buf[64 * 4];
1557	sg_copy_to_buffer(sgl: data->sg, nents: data->sg_len, buf, buflen: sizeof(buf));
1558	result = usb_sg_init(io: &vub300->sg_request, dev: vub300->udev,
1559	pipe, period: 0, sg: data->sg,
1560	nents: data->sg_len, length: 0, GFP_KERNEL);
1561	if (result < 0) {
1562	usb_unlink_urb(urb: vub300->command_out_urb);
1563	usb_unlink_urb(urb: vub300->command_res_urb);
1564	cmd->error = result;
1565	data->bytes_xfered = 0;
1566	} else {
1567	vub300->sg_transfer_timer.expires =
1568	jiffies + msecs_to_jiffies(m: 2000 +
1569	linear_length / 16384);
1570	add_timer(timer: &vub300->sg_transfer_timer);
1571	usb_sg_wait(io: &vub300->sg_request);
1572	if (cmd->error) {
1573	data->bytes_xfered = 0;
1574	} else {
1575	del_timer(timer: &vub300->sg_transfer_timer);
1576	if (vub300->sg_request.status < 0) {
1577	cmd->error = vub300->sg_request.status;
1578	data->bytes_xfered = 0;
1579	} else {
1580	data->bytes_xfered = vub300->datasize;
1581	}
1582	}
1583	}
1584	}
1585	return linear_length;
1586	}
1587
1588	static void __vub300_command_response(struct vub300_mmc_host *vub300,
1589	struct mmc_command *cmd,
1590	struct mmc_data *data, int data_length)
1591	{
1592	/* cmd_mutex is held by vub300_cmndwork_thread */
1593	long respretval;
1594	int msec_timeout = 1000 + data_length / 4;
1595	respretval =
1596	wait_for_completion_timeout(x: &vub300->command_complete,
1597	timeout: msecs_to_jiffies(m: msec_timeout));
1598	if (respretval == 0) { /* TIMED OUT */
1599	/* we don't know which of "out" and "res" if any failed */
1600	int result;
1601	vub300->usb_timed_out = 1;
1602	usb_kill_urb(urb: vub300->command_out_urb);
1603	usb_kill_urb(urb: vub300->command_res_urb);
1604	cmd->error = -ETIMEDOUT;
1605	result = usb_lock_device_for_reset(udev: vub300->udev,
1606	iface: vub300->interface);
1607	if (result == 0) {
1608	result = usb_reset_device(dev: vub300->udev);
1609	usb_unlock_device(vub300->udev);
1610	}
1611	} else if (respretval < 0) {
1612	/* we don't know which of "out" and "res" if any failed */
1613	usb_kill_urb(urb: vub300->command_out_urb);
1614	usb_kill_urb(urb: vub300->command_res_urb);
1615	cmd->error = respretval;
1616	} else if (cmd->error) {
1617	/*
1618	* the error occurred sending the command
1619	* or receiving the response
1620	*/
1621	} else if (vub300->command_out_urb->status) {
1622	vub300->usb_transport_fail = vub300->command_out_urb->status;
1623	cmd->error = -EPROTO == vub300->command_out_urb->status ?
1624	-ESHUTDOWN : vub300->command_out_urb->status;
1625	} else if (vub300->command_res_urb->status) {
1626	vub300->usb_transport_fail = vub300->command_res_urb->status;
1627	cmd->error = -EPROTO == vub300->command_res_urb->status ?
1628	-ESHUTDOWN : vub300->command_res_urb->status;
1629	} else if (vub300->resp.common.header_type == 0x00) {
1630	/*
1631	* the command completed successfully
1632	* and there was no piggybacked data
1633	*/
1634	} else if (vub300->resp.common.header_type == RESPONSE_ERROR) {
1635	cmd->error =
1636	vub300_response_error(error_code: vub300->resp.error.error_code);
1637	if (vub300->data)
1638	usb_sg_cancel(io: &vub300->sg_request);
1639	} else if (vub300->resp.common.header_type == RESPONSE_PIGGYBACKED) {
1640	int offloaded_data_length =
1641	vub300->resp.common.header_size -
1642	sizeof(struct sd_register_header);
1643	int register_count = offloaded_data_length >> 3;
1644	int ri = 0;
1645	while (register_count--) {
1646	add_offloaded_reg(vub300, register_access: &vub300->resp.pig.reg[ri]);
1647	ri += 1;
1648	}
1649	vub300->resp.common.header_size =
1650	sizeof(struct sd_register_header);
1651	vub300->resp.common.header_type = 0x00;
1652	cmd->error = 0;
1653	} else if (vub300->resp.common.header_type == RESPONSE_PIG_DISABLED) {
1654	int offloaded_data_length =
1655	vub300->resp.common.header_size -
1656	sizeof(struct sd_register_header);
1657	int register_count = offloaded_data_length >> 3;
1658	int ri = 0;
1659	while (register_count--) {
1660	add_offloaded_reg(vub300, register_access: &vub300->resp.pig.reg[ri]);
1661	ri += 1;
1662	}
1663	mutex_lock(&vub300->irq_mutex);
1664	if (vub300->irqs_queued) {
1665	vub300->irqs_queued += 1;
1666	} else if (vub300->irq_enabled) {
1667	vub300->irqs_queued += 1;
1668	vub300_queue_poll_work(vub300, delay: 0);
1669	} else {
1670	vub300->irqs_queued += 1;
1671	}
1672	vub300->irq_disabled = 1;
1673	mutex_unlock(lock: &vub300->irq_mutex);
1674	vub300->resp.common.header_size =
1675	sizeof(struct sd_register_header);
1676	vub300->resp.common.header_type = 0x00;
1677	cmd->error = 0;
1678	} else if (vub300->resp.common.header_type == RESPONSE_PIG_ENABLED) {
1679	int offloaded_data_length =
1680	vub300->resp.common.header_size -
1681	sizeof(struct sd_register_header);
1682	int register_count = offloaded_data_length >> 3;
1683	int ri = 0;
1684	while (register_count--) {
1685	add_offloaded_reg(vub300, register_access: &vub300->resp.pig.reg[ri]);
1686	ri += 1;
1687	}
1688	mutex_lock(&vub300->irq_mutex);
1689	if (vub300->irqs_queued) {
1690	vub300->irqs_queued += 1;
1691	} else if (vub300->irq_enabled) {
1692	vub300->irqs_queued += 1;
1693	vub300_queue_poll_work(vub300, delay: 0);
1694	} else {
1695	vub300->irqs_queued += 1;
1696	}
1697	vub300->irq_disabled = 0;
1698	mutex_unlock(lock: &vub300->irq_mutex);
1699	vub300->resp.common.header_size =
1700	sizeof(struct sd_register_header);
1701	vub300->resp.common.header_type = 0x00;
1702	cmd->error = 0;
1703	} else {
1704	cmd->error = -EINVAL;
1705	}
1706	}
1707
1708	static void construct_request_response(struct vub300_mmc_host *vub300,
1709	struct mmc_command *cmd)
1710	{
1711	int resp_len = vub300->resp_len;
1712	int less_cmd = (17 == resp_len) ? resp_len : resp_len - 1;
1713	int bytes = 3 & less_cmd;
1714	int words = less_cmd >> 2;
1715	u8 *r = vub300->resp.response.command_response;
1716
1717	if (!resp_len)
1718	return;
1719	if (bytes == 3) {
1720	cmd->resp[words] = (r[1 + (words << 2)] << 24)
1721	| (r[2 + (words << 2)] << 16)
1722	| (r[3 + (words << 2)] << 8);
1723	} else if (bytes == 2) {
1724	cmd->resp[words] = (r[1 + (words << 2)] << 24)
1725	| (r[2 + (words << 2)] << 16);
1726	} else if (bytes == 1) {
1727	cmd->resp[words] = (r[1 + (words << 2)] << 24);
1728	}
1729	while (words-- > 0) {
1730	cmd->resp[words] = (r[1 + (words << 2)] << 24)
1731	| (r[2 + (words << 2)] << 16)
1732	| (r[3 + (words << 2)] << 8)
1733	| (r[4 + (words << 2)] << 0);
1734	}
1735	if ((cmd->opcode == 53) && (0x000000FF & cmd->resp[0]))
1736	cmd->resp[0] &= 0xFFFFFF00;
1737	}
1738
1739	/* this thread runs only when there is an upper level command req outstanding */
1740	static void vub300_cmndwork_thread(struct work_struct *work)
1741	{
1742	struct vub300_mmc_host *vub300 =
1743	container_of(work, struct vub300_mmc_host, cmndwork);
1744	if (!vub300->interface) {
1745	kref_put(kref: &vub300->kref, release: vub300_delete);
1746	return;
1747	} else {
1748	struct mmc_request *req = vub300->req;
1749	struct mmc_command *cmd = vub300->cmd;
1750	struct mmc_data *data = vub300->data;
1751	int data_length;
1752	mutex_lock(&vub300->cmd_mutex);
1753	init_completion(x: &vub300->command_complete);
1754	if (likely(vub300->vub_name[0]) || !vub300->mmc->card) {
1755	/*
1756	* the name of the EMPTY Pseudo firmware file
1757	* is used as a flag to indicate that the file
1758	* has been already downloaded to the VUB300 chip
1759	*/
1760	} else if (0 == vub300->mmc->card->sdio_funcs) {
1761	strscpy(p: vub300->vub_name, q: "SD memory device",
1762	size: sizeof(vub300->vub_name));
1763	} else {
1764	download_offload_pseudocode(vub300);
1765	}
1766	send_command(vub300);
1767	if (!data)
1768	data_length = 0;
1769	else if (MMC_DATA_READ & data->flags)
1770	data_length = __command_read_data(vub300, cmd, data);
1771	else
1772	data_length = __command_write_data(vub300, cmd, data);
1773	__vub300_command_response(vub300, cmd, data, data_length);
1774	vub300->req = NULL;
1775	vub300->cmd = NULL;
1776	vub300->data = NULL;
1777	if (cmd->error) {
1778	if (cmd->error == -ENOMEDIUM)
1779	check_vub300_port_status(vub300);
1780	mutex_unlock(lock: &vub300->cmd_mutex);
1781	mmc_request_done(vub300->mmc, req);
1782	kref_put(kref: &vub300->kref, release: vub300_delete);
1783	return;
1784	} else {
1785	construct_request_response(vub300, cmd);
1786	vub300->resp_len = 0;
1787	mutex_unlock(lock: &vub300->cmd_mutex);
1788	kref_put(kref: &vub300->kref, release: vub300_delete);
1789	mmc_request_done(vub300->mmc, req);
1790	return;
1791	}
1792	}
1793	}
1794
1795	static int examine_cyclic_buffer(struct vub300_mmc_host *vub300,
1796	struct mmc_command *cmd, u8 Function)
1797	{
1798	/* cmd_mutex is held by vub300_mmc_request */
1799	u8 cmd0 = 0xFF & (cmd->arg >> 24);
1800	u8 cmd1 = 0xFF & (cmd->arg >> 16);
1801	u8 cmd2 = 0xFF & (cmd->arg >> 8);
1802	u8 cmd3 = 0xFF & (cmd->arg >> 0);
1803	int first = MAXREGMASK & vub300->fn[Function].offload_point;
1804	struct offload_registers_access *rf = &vub300->fn[Function].reg[first];
1805	if (cmd0 == rf->command_byte[0] &&
1806	cmd1 == rf->command_byte[1] &&
1807	cmd2 == rf->command_byte[2] &&
1808	cmd3 == rf->command_byte[3]) {
1809	u8 checksum = 0x00;
1810	cmd->resp[1] = checksum << 24;
1811	cmd->resp[0] = (rf->Respond_Byte[0] << 24)
1812	| (rf->Respond_Byte[1] << 16)
1813	| (rf->Respond_Byte[2] << 8)
1814	| (rf->Respond_Byte[3] << 0);
1815	vub300->fn[Function].offload_point += 1;
1816	vub300->fn[Function].offload_count -= 1;
1817	vub300->total_offload_count -= 1;
1818	return 1;
1819	} else {
1820	int delta = 1; /* because it does not match the first one */
1821	u8 register_count = vub300->fn[Function].offload_count - 1;
1822	u32 register_point = vub300->fn[Function].offload_point + 1;
1823	while (0 < register_count) {
1824	int point = MAXREGMASK & register_point;
1825	struct offload_registers_access *r =
1826	&vub300->fn[Function].reg[point];
1827	if (cmd0 == r->command_byte[0] &&
1828	cmd1 == r->command_byte[1] &&
1829	cmd2 == r->command_byte[2] &&
1830	cmd3 == r->command_byte[3]) {
1831	u8 checksum = 0x00;
1832	cmd->resp[1] = checksum << 24;
1833	cmd->resp[0] = (r->Respond_Byte[0] << 24)
1834	| (r->Respond_Byte[1] << 16)
1835	| (r->Respond_Byte[2] << 8)
1836	| (r->Respond_Byte[3] << 0);
1837	vub300->fn[Function].offload_point += delta;
1838	vub300->fn[Function].offload_count -= delta;
1839	vub300->total_offload_count -= delta;
1840	return 1;
1841	} else {
1842	register_point += 1;
1843	register_count -= 1;
1844	delta += 1;
1845	continue;
1846	}
1847	}
1848	return 0;
1849	}
1850	}
1851
1852	static int satisfy_request_from_offloaded_data(struct vub300_mmc_host *vub300,
1853	struct mmc_command *cmd)
1854	{
1855	/* cmd_mutex is held by vub300_mmc_request */
1856	u8 regs = vub300->dynamic_register_count;
1857	u8 i = 0;
1858	u8 func = FUN(cmd);
1859	u32 reg = REG(cmd);
1860	while (0 < regs--) {
1861	if ((vub300->sdio_register[i].func_num == func) &&
1862	(vub300->sdio_register[i].sdio_reg == reg)) {
1863	if (!vub300->sdio_register[i].prepared) {
1864	return 0;
1865	} else if ((0x80000000 & cmd->arg) == 0x80000000) {
1866	/*
1867	* a write to a dynamic register
1868	* nullifies our offloaded value
1869	*/
1870	vub300->sdio_register[i].prepared = 0;
1871	return 0;
1872	} else {
1873	u8 checksum = 0x00;
1874	u8 rsp0 = 0x00;
1875	u8 rsp1 = 0x00;
1876	u8 rsp2 = vub300->sdio_register[i].response;
1877	u8 rsp3 = vub300->sdio_register[i].regvalue;
1878	vub300->sdio_register[i].prepared = 0;
1879	cmd->resp[1] = checksum << 24;
1880	cmd->resp[0] = (rsp0 << 24)
1881	| (rsp1 << 16)
1882	| (rsp2 << 8)
1883	| (rsp3 << 0);
1884	return 1;
1885	}
1886	} else {
1887	i += 1;
1888	continue;
1889	}
1890	}
1891	if (vub300->total_offload_count == 0)
1892	return 0;
1893	else if (vub300->fn[func].offload_count == 0)
1894	return 0;
1895	else
1896	return examine_cyclic_buffer(vub300, cmd, Function: func);
1897	}
1898
1899	static void vub300_mmc_request(struct mmc_host *mmc, struct mmc_request *req)
1900	{ /* NOT irq */
1901	struct mmc_command *cmd = req->cmd;
1902	struct vub300_mmc_host *vub300 = mmc_priv(host: mmc);
1903	if (!vub300->interface) {
1904	cmd->error = -ESHUTDOWN;
1905	mmc_request_done(mmc, req);
1906	return;
1907	} else {
1908	struct mmc_data *data = req->data;
1909	if (!vub300->card_powered) {
1910	cmd->error = -ENOMEDIUM;
1911	mmc_request_done(mmc, req);
1912	return;
1913	}
1914	if (!vub300->card_present) {
1915	cmd->error = -ENOMEDIUM;
1916	mmc_request_done(mmc, req);
1917	return;
1918	}
1919	if (vub300->usb_transport_fail) {
1920	cmd->error = vub300->usb_transport_fail;
1921	mmc_request_done(mmc, req);
1922	return;
1923	}
1924	if (!vub300->interface) {
1925	cmd->error = -ENODEV;
1926	mmc_request_done(mmc, req);
1927	return;
1928	}
1929	kref_get(kref: &vub300->kref);
1930	mutex_lock(&vub300->cmd_mutex);
1931	mod_timer(timer: &vub300->inactivity_timer, expires: jiffies + HZ);
1932	/*
1933	* for performance we have to return immediately
1934	* if the requested data has been offloaded
1935	*/
1936	if (cmd->opcode == 52 &&
1937	satisfy_request_from_offloaded_data(vub300, cmd)) {
1938	cmd->error = 0;
1939	mutex_unlock(lock: &vub300->cmd_mutex);
1940	kref_put(kref: &vub300->kref, release: vub300_delete);
1941	mmc_request_done(mmc, req);
1942	return;
1943	} else {
1944	vub300->cmd = cmd;
1945	vub300->req = req;
1946	vub300->data = data;
1947	if (data)
1948	vub300->datasize = data->blksz * data->blocks;
1949	else
1950	vub300->datasize = 0;
1951	vub300_queue_cmnd_work(vub300);
1952	mutex_unlock(lock: &vub300->cmd_mutex);
1953	kref_put(kref: &vub300->kref, release: vub300_delete);
1954	/*
1955	* the kernel lock diagnostics complain
1956	* if the cmd_mutex * is "passed on"
1957	* to the cmndwork thread,
1958	* so we must release it now
1959	* and re-acquire it in the cmndwork thread
1960	*/
1961	}
1962	}
1963	}
1964
1965	static void __set_clock_speed(struct vub300_mmc_host *vub300, u8 buf[8],
1966	struct mmc_ios *ios)
1967	{
1968	int buf_array_size = 8; /* ARRAY_SIZE(buf) does not work !!! */
1969	int retval;
1970	u32 kHzClock;
1971	if (ios->clock >= 48000000)
1972	kHzClock = 48000;
1973	else if (ios->clock >= 24000000)
1974	kHzClock = 24000;
1975	else if (ios->clock >= 20000000)
1976	kHzClock = 20000;
1977	else if (ios->clock >= 15000000)
1978	kHzClock = 15000;
1979	else if (ios->clock >= 200000)
1980	kHzClock = 200;
1981	else
1982	kHzClock = 0;
1983	{
1984	int i;
1985	u64 c = kHzClock;
1986	for (i = 0; i < buf_array_size; i++) {
1987	buf[i] = c;
1988	c >>= 8;
1989	}
1990	}
1991	retval =
1992	usb_control_msg(dev: vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
1993	SET_CLOCK_SPEED,
1994	USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
1995	value: 0x00, index: 0x00, data: buf, size: buf_array_size, timeout: 1000);
1996	if (retval != 8) {
1997	dev_err(&vub300->udev->dev, "SET_CLOCK_SPEED"
1998	" %dkHz failed with retval=%d\n", kHzClock, retval);
1999	} else {
2000	dev_dbg(&vub300->udev->dev, "SET_CLOCK_SPEED"
2001	" %dkHz\n", kHzClock);
2002	}
2003	}
2004
2005	static void vub300_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
2006	{ /* NOT irq */
2007	struct vub300_mmc_host *vub300 = mmc_priv(host: mmc);
2008	if (!vub300->interface)
2009	return;
2010	kref_get(kref: &vub300->kref);
2011	mutex_lock(&vub300->cmd_mutex);
2012	if ((ios->power_mode == MMC_POWER_OFF) && vub300->card_powered) {
2013	vub300->card_powered = 0;
2014	usb_control_msg(dev: vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
2015	SET_SD_POWER,
2016	USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2017	value: 0x0000, index: 0x0000, NULL, size: 0, timeout: 1000);
2018	/* must wait for the VUB300 u-proc to boot up */
2019	msleep(msecs: 600);
2020	} else if ((ios->power_mode == MMC_POWER_UP) && !vub300->card_powered) {
2021	usb_control_msg(dev: vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
2022	SET_SD_POWER,
2023	USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2024	value: 0x0001, index: 0x0000, NULL, size: 0, timeout: 1000);
2025	msleep(msecs: 600);
2026	vub300->card_powered = 1;
2027	} else if (ios->power_mode == MMC_POWER_ON) {
2028	u8 *buf = kmalloc(size: 8, GFP_KERNEL);
2029	if (buf) {
2030	__set_clock_speed(vub300, buf, ios);
2031	kfree(objp: buf);
2032	}
2033	} else {
2034	/* this should mean no change of state */
2035	}
2036	mutex_unlock(lock: &vub300->cmd_mutex);
2037	kref_put(kref: &vub300->kref, release: vub300_delete);
2038	}
2039
2040	static int vub300_mmc_get_ro(struct mmc_host *mmc)
2041	{
2042	struct vub300_mmc_host *vub300 = mmc_priv(host: mmc);
2043	return vub300->read_only;
2044	}
2045
2046	static void vub300_enable_sdio_irq(struct mmc_host *mmc, int enable)
2047	{ /* NOT irq */
2048	struct vub300_mmc_host *vub300 = mmc_priv(host: mmc);
2049	if (!vub300->interface)
2050	return;
2051	kref_get(kref: &vub300->kref);
2052	if (enable) {
2053	set_current_state(TASK_RUNNING);
2054	mutex_lock(&vub300->irq_mutex);
2055	if (vub300->irqs_queued) {
2056	vub300->irqs_queued -= 1;
2057	mmc_signal_sdio_irq(host: vub300->mmc);
2058	} else if (vub300->irq_disabled) {
2059	vub300->irq_disabled = 0;
2060	vub300->irq_enabled = 1;
2061	vub300_queue_poll_work(vub300, delay: 0);
2062	} else if (vub300->irq_enabled) {
2063	/* this should not happen, so we will just ignore it */
2064	} else {
2065	vub300->irq_enabled = 1;
2066	vub300_queue_poll_work(vub300, delay: 0);
2067	}
2068	mutex_unlock(lock: &vub300->irq_mutex);
2069	set_current_state(TASK_INTERRUPTIBLE);
2070	} else {
2071	vub300->irq_enabled = 0;
2072	}
2073	kref_put(kref: &vub300->kref, release: vub300_delete);
2074	}
2075
2076	static const struct mmc_host_ops vub300_mmc_ops = {
2077	.request = vub300_mmc_request,
2078	.set_ios = vub300_mmc_set_ios,
2079	.get_ro = vub300_mmc_get_ro,
2080	.enable_sdio_irq = vub300_enable_sdio_irq,
2081	};
2082
2083	static int vub300_probe(struct usb_interface *interface,
2084	const struct usb_device_id *id)
2085	{ /* NOT irq */
2086	struct vub300_mmc_host *vub300;
2087	struct usb_host_interface *iface_desc;
2088	struct usb_device *udev = usb_get_dev(interface_to_usbdev(interface));
2089	int i;
2090	int retval = -ENOMEM;
2091	struct urb *command_out_urb;
2092	struct urb *command_res_urb;
2093	struct mmc_host *mmc;
2094	char manufacturer[48];
2095	char product[32];
2096	char serial_number[32];
2097	usb_string(dev: udev, index: udev->descriptor.iManufacturer, buf: manufacturer,
2098	size: sizeof(manufacturer));
2099	usb_string(dev: udev, index: udev->descriptor.iProduct, buf: product, size: sizeof(product));
2100	usb_string(dev: udev, index: udev->descriptor.iSerialNumber, buf: serial_number,
2101	size: sizeof(serial_number));
2102	dev_info(&udev->dev, "probing VID:PID(%04X:%04X) %s %s %s\n",
2103	le16_to_cpu(udev->descriptor.idVendor),
2104	le16_to_cpu(udev->descriptor.idProduct),
2105	manufacturer, product, serial_number);
2106	command_out_urb = usb_alloc_urb(iso_packets: 0, GFP_KERNEL);
2107	if (!command_out_urb) {
2108	retval = -ENOMEM;
2109	goto error0;
2110	}
2111	command_res_urb = usb_alloc_urb(iso_packets: 0, GFP_KERNEL);
2112	if (!command_res_urb) {
2113	retval = -ENOMEM;
2114	goto error1;
2115	}
2116	/* this also allocates memory for our VUB300 mmc host device */
2117	mmc = mmc_alloc_host(extra: sizeof(struct vub300_mmc_host), &udev->dev);
2118	if (!mmc) {
2119	retval = -ENOMEM;
2120	dev_err(&udev->dev, "not enough memory for the mmc_host\n");
2121	goto error4;
2122	}
2123	/* MMC core transfer sizes tunable parameters */
2124	mmc->caps = 0;
2125	if (!force_1_bit_data_xfers)
2126	mmc->caps |= MMC_CAP_4_BIT_DATA;
2127	if (!force_polling_for_irqs)
2128	mmc->caps |= MMC_CAP_SDIO_IRQ;
2129	mmc->caps &= ~MMC_CAP_NEEDS_POLL;
2130	/*
2131	* MMC_CAP_NEEDS_POLL causes core.c:mmc_rescan() to poll
2132	* for devices which results in spurious CMD7's being
2133	* issued which stops some SDIO cards from working
2134	*/
2135	if (limit_speed_to_24_MHz) {
2136	mmc->caps |= MMC_CAP_MMC_HIGHSPEED;
2137	mmc->caps |= MMC_CAP_SD_HIGHSPEED;
2138	mmc->f_max = 24000000;
2139	dev_info(&udev->dev, "limiting SDIO speed to 24_MHz\n");
2140	} else {
2141	mmc->caps |= MMC_CAP_MMC_HIGHSPEED;
2142	mmc->caps |= MMC_CAP_SD_HIGHSPEED;
2143	mmc->f_max = 48000000;
2144	}
2145	mmc->f_min = 200000;
2146	mmc->max_blk_count = 511;
2147	mmc->max_blk_size = 512;
2148	mmc->max_segs = 128;
2149	if (force_max_req_size)
2150	mmc->max_req_size = force_max_req_size * 1024;
2151	else
2152	mmc->max_req_size = 64 * 1024;
2153	mmc->max_seg_size = mmc->max_req_size;
2154	mmc->ocr_avail = 0;
2155	mmc->ocr_avail |= MMC_VDD_165_195;
2156	mmc->ocr_avail |= MMC_VDD_20_21;
2157	mmc->ocr_avail |= MMC_VDD_21_22;
2158	mmc->ocr_avail |= MMC_VDD_22_23;
2159	mmc->ocr_avail |= MMC_VDD_23_24;
2160	mmc->ocr_avail |= MMC_VDD_24_25;
2161	mmc->ocr_avail |= MMC_VDD_25_26;
2162	mmc->ocr_avail |= MMC_VDD_26_27;
2163	mmc->ocr_avail |= MMC_VDD_27_28;
2164	mmc->ocr_avail |= MMC_VDD_28_29;
2165	mmc->ocr_avail |= MMC_VDD_29_30;
2166	mmc->ocr_avail |= MMC_VDD_30_31;
2167	mmc->ocr_avail |= MMC_VDD_31_32;
2168	mmc->ocr_avail |= MMC_VDD_32_33;
2169	mmc->ocr_avail |= MMC_VDD_33_34;
2170	mmc->ocr_avail |= MMC_VDD_34_35;
2171	mmc->ocr_avail |= MMC_VDD_35_36;
2172	mmc->ops = &vub300_mmc_ops;
2173	vub300 = mmc_priv(host: mmc);
2174	vub300->mmc = mmc;
2175	vub300->card_powered = 0;
2176	vub300->bus_width = 0;
2177	vub300->cmnd.head.block_size[0] = 0x00;
2178	vub300->cmnd.head.block_size[1] = 0x00;
2179	vub300->app_spec = 0;
2180	mutex_init(&vub300->cmd_mutex);
2181	mutex_init(&vub300->irq_mutex);
2182	vub300->command_out_urb = command_out_urb;
2183	vub300->command_res_urb = command_res_urb;
2184	vub300->usb_timed_out = 0;
2185	vub300->dynamic_register_count = 0;
2186
2187	for (i = 0; i < ARRAY_SIZE(vub300->fn); i++) {
2188	vub300->fn[i].offload_point = 0;
2189	vub300->fn[i].offload_count = 0;
2190	}
2191
2192	vub300->total_offload_count = 0;
2193	vub300->irq_enabled = 0;
2194	vub300->irq_disabled = 0;
2195	vub300->irqs_queued = 0;
2196
2197	for (i = 0; i < ARRAY_SIZE(vub300->sdio_register); i++)
2198	vub300->sdio_register[i++].activate = 0;
2199
2200	vub300->udev = udev;
2201	vub300->interface = interface;
2202	vub300->cmnd_res_ep = 0;
2203	vub300->cmnd_out_ep = 0;
2204	vub300->data_inp_ep = 0;
2205	vub300->data_out_ep = 0;
2206
2207	for (i = 0; i < ARRAY_SIZE(vub300->fbs); i++)
2208	vub300->fbs[i] = 512;
2209
2210	/*
2211	* set up the endpoint information
2212	*
2213	* use the first pair of bulk-in and bulk-out
2214	* endpoints for Command/Response+Interrupt
2215	*
2216	* use the second pair of bulk-in and bulk-out
2217	* endpoints for Data In/Out
2218	*/
2219	vub300->large_usb_packets = 0;
2220	iface_desc = interface->cur_altsetting;
2221	for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
2222	struct usb_endpoint_descriptor *endpoint =
2223	&iface_desc->endpoint[i].desc;
2224	dev_info(&vub300->udev->dev,
2225	"vub300 testing %s EndPoint(%d) %02X\n",
2226	usb_endpoint_is_bulk_in(endpoint) ? "BULK IN" :
2227	usb_endpoint_is_bulk_out(endpoint) ? "BULK OUT" :
2228	"UNKNOWN", i, endpoint->bEndpointAddress);
2229	if (endpoint->wMaxPacketSize > 64)
2230	vub300->large_usb_packets = 1;
2231	if (usb_endpoint_is_bulk_in(epd: endpoint)) {
2232	if (!vub300->cmnd_res_ep) {
2233	vub300->cmnd_res_ep =
2234	endpoint->bEndpointAddress;
2235	} else if (!vub300->data_inp_ep) {
2236	vub300->data_inp_ep =
2237	endpoint->bEndpointAddress;
2238	} else {
2239	dev_warn(&vub300->udev->dev,
2240	"ignoring"
2241	" unexpected bulk_in endpoint");
2242	}
2243	} else if (usb_endpoint_is_bulk_out(epd: endpoint)) {
2244	if (!vub300->cmnd_out_ep) {
2245	vub300->cmnd_out_ep =
2246	endpoint->bEndpointAddress;
2247	} else if (!vub300->data_out_ep) {
2248	vub300->data_out_ep =
2249	endpoint->bEndpointAddress;
2250	} else {
2251	dev_warn(&vub300->udev->dev,
2252	"ignoring"
2253	" unexpected bulk_out endpoint");
2254	}
2255	} else {
2256	dev_warn(&vub300->udev->dev,
2257	"vub300 ignoring EndPoint(%d) %02X", i,
2258	endpoint->bEndpointAddress);
2259	}
2260	}
2261	if (vub300->cmnd_res_ep && vub300->cmnd_out_ep &&
2262	vub300->data_inp_ep && vub300->data_out_ep) {
2263	dev_info(&vub300->udev->dev,
2264	"vub300 %s packets"
2265	" using EndPoints %02X %02X %02X %02X\n",
2266	vub300->large_usb_packets ? "LARGE" : "SMALL",
2267	vub300->cmnd_out_ep, vub300->cmnd_res_ep,
2268	vub300->data_out_ep, vub300->data_inp_ep);
2269	/* we have the expected EndPoints */
2270	} else {
2271	dev_err(&vub300->udev->dev,
2272	"Could not find two sets of bulk-in/out endpoint pairs\n");
2273	retval = -EINVAL;
2274	goto error5;
2275	}
2276	retval =
2277	usb_control_msg(dev: vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
2278	GET_HC_INF0,
2279	USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2280	value: 0x0000, index: 0x0000, data: &vub300->hc_info,
2281	size: sizeof(vub300->hc_info), timeout: 1000);
2282	if (retval < 0)
2283	goto error5;
2284	retval =
2285	usb_control_msg(dev: vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
2286	SET_ROM_WAIT_STATES,
2287	USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2288	value: firmware_rom_wait_states, index: 0x0000, NULL, size: 0, timeout: 1000);
2289	if (retval < 0)
2290	goto error5;
2291	dev_info(&vub300->udev->dev,
2292	"operating_mode = %s %s %d MHz %s %d byte USB packets\n",
2293	(mmc->caps & MMC_CAP_SDIO_IRQ) ? "IRQs" : "POLL",
2294	(mmc->caps & MMC_CAP_4_BIT_DATA) ? "4-bit" : "1-bit",
2295	mmc->f_max / 1000000,
2296	pad_input_to_usb_pkt ? "padding input data to" : "with",
2297	vub300->large_usb_packets ? 512 : 64);
2298	retval =
2299	usb_control_msg(dev: vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
2300	GET_SYSTEM_PORT_STATUS,
2301	USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
2302	value: 0x0000, index: 0x0000, data: &vub300->system_port_status,
2303	size: sizeof(vub300->system_port_status), timeout: 1000);
2304	if (retval < 0) {
2305	goto error5;
2306	} else if (sizeof(vub300->system_port_status) == retval) {
2307	vub300->card_present =
2308	(0x0001 & vub300->system_port_status.port_flags) ? 1 : 0;
2309	vub300->read_only =
2310	(0x0010 & vub300->system_port_status.port_flags) ? 1 : 0;
2311	} else {
2312	goto error5;
2313	}
2314	usb_set_intfdata(intf: interface, data: vub300);
2315	INIT_DELAYED_WORK(&vub300->pollwork, vub300_pollwork_thread);
2316	INIT_WORK(&vub300->cmndwork, vub300_cmndwork_thread);
2317	INIT_WORK(&vub300->deadwork, vub300_deadwork_thread);
2318	kref_init(kref: &vub300->kref);
2319	timer_setup(&vub300->sg_transfer_timer, vub300_sg_timed_out, 0);
2320	kref_get(kref: &vub300->kref);
2321	timer_setup(&vub300->inactivity_timer,
2322	vub300_inactivity_timer_expired, 0);
2323	vub300->inactivity_timer.expires = jiffies + HZ;
2324	add_timer(timer: &vub300->inactivity_timer);
2325	if (vub300->card_present)
2326	dev_info(&vub300->udev->dev,
2327	"USB vub300 remote SDIO host controller[%d]"
2328	"connected with SD/SDIO card inserted\n",
2329	interface_to_InterfaceNumber(interface));
2330	else
2331	dev_info(&vub300->udev->dev,
2332	"USB vub300 remote SDIO host controller[%d]"
2333	"connected with no SD/SDIO card inserted\n",
2334	interface_to_InterfaceNumber(interface));
2335	retval = mmc_add_host(mmc);
2336	if (retval)
2337	goto error6;
2338
2339	return 0;
2340	error6:
2341	del_timer_sync(timer: &vub300->inactivity_timer);
2342	error5:
2343	mmc_free_host(mmc);
2344	/*
2345	* and hence also frees vub300
2346	* which is contained at the end of struct mmc
2347	*/
2348	error4:
2349	usb_free_urb(urb: command_res_urb);
2350	error1:
2351	usb_free_urb(urb: command_out_urb);
2352	error0:
2353	usb_put_dev(dev: udev);
2354	return retval;
2355	}
2356
2357	static void vub300_disconnect(struct usb_interface *interface)
2358	{ /* NOT irq */
2359	struct vub300_mmc_host *vub300 = usb_get_intfdata(intf: interface);
2360	if (!vub300 || !vub300->mmc) {
2361	return;
2362	} else {
2363	struct mmc_host *mmc = vub300->mmc;
2364	if (!vub300->mmc) {
2365	return;
2366	} else {
2367	int ifnum = interface_to_InterfaceNumber(interface);
2368	usb_set_intfdata(intf: interface, NULL);
2369	/* prevent more I/O from starting */
2370	vub300->interface = NULL;
2371	kref_put(kref: &vub300->kref, release: vub300_delete);
2372	mmc_remove_host(mmc);
2373	pr_info("USB vub300 remote SDIO host controller[%d]"
2374	" now disconnected", ifnum);
2375	return;
2376	}
2377	}
2378	}
2379
2380	#ifdef CONFIG_PM
2381	static int vub300_suspend(struct usb_interface *intf, pm_message_t message)
2382	{
2383	return 0;
2384	}
2385
2386	static int vub300_resume(struct usb_interface *intf)
2387	{
2388	return 0;
2389	}
2390	#else
2391	#define vub300_suspend NULL
2392	#define vub300_resume NULL
2393	#endif
2394	static int vub300_pre_reset(struct usb_interface *intf)
2395	{ /* NOT irq */
2396	struct vub300_mmc_host *vub300 = usb_get_intfdata(intf);
2397	mutex_lock(&vub300->cmd_mutex);
2398	return 0;
2399	}
2400
2401	static int vub300_post_reset(struct usb_interface *intf)
2402	{ /* NOT irq */
2403	struct vub300_mmc_host *vub300 = usb_get_intfdata(intf);
2404	/* we are sure no URBs are active - no locking needed */
2405	vub300->errors = -EPIPE;
2406	mutex_unlock(lock: &vub300->cmd_mutex);
2407	return 0;
2408	}
2409
2410	static struct usb_driver vub300_driver = {
2411	.name = "vub300",
2412	.probe = vub300_probe,
2413	.disconnect = vub300_disconnect,
2414	.suspend = vub300_suspend,
2415	.resume = vub300_resume,
2416	.pre_reset = vub300_pre_reset,
2417	.post_reset = vub300_post_reset,
2418	.id_table = vub300_table,
2419	.supports_autosuspend = 1,
2420	};
2421
2422	static int __init vub300_init(void)
2423	{ /* NOT irq */
2424	int result;
2425
2426	pr_info("VUB300 Driver rom wait states = %02X irqpoll timeout = %04X",
2427	firmware_rom_wait_states, 0x0FFFF & firmware_irqpoll_timeout);
2428	cmndworkqueue = create_singlethread_workqueue("kvub300c");
2429	if (!cmndworkqueue) {
2430	pr_err("not enough memory for the REQUEST workqueue");
2431	result = -ENOMEM;
2432	goto out1;
2433	}
2434	pollworkqueue = create_singlethread_workqueue("kvub300p");
2435	if (!pollworkqueue) {
2436	pr_err("not enough memory for the IRQPOLL workqueue");
2437	result = -ENOMEM;
2438	goto out2;
2439	}
2440	deadworkqueue = create_singlethread_workqueue("kvub300d");
2441	if (!deadworkqueue) {
2442	pr_err("not enough memory for the EXPIRED workqueue");
2443	result = -ENOMEM;
2444	goto out3;
2445	}
2446	result = usb_register(&vub300_driver);
2447	if (result) {
2448	pr_err("usb_register failed. Error number %d", result);
2449	goto out4;
2450	}
2451	return 0;
2452	out4:
2453	destroy_workqueue(wq: deadworkqueue);
2454	out3:
2455	destroy_workqueue(wq: pollworkqueue);
2456	out2:
2457	destroy_workqueue(wq: cmndworkqueue);
2458	out1:
2459	return result;
2460	}
2461
2462	static void __exit vub300_exit(void)
2463	{
2464	usb_deregister(&vub300_driver);
2465	flush_workqueue(cmndworkqueue);
2466	flush_workqueue(pollworkqueue);
2467	flush_workqueue(deadworkqueue);
2468	destroy_workqueue(wq: cmndworkqueue);
2469	destroy_workqueue(wq: pollworkqueue);
2470	destroy_workqueue(wq: deadworkqueue);
2471	}
2472
2473	module_init(vub300_init);
2474	module_exit(vub300_exit);
2475
2476	MODULE_AUTHOR("Tony Olech <tony.olech@elandigitalsystems.com>");
2477	MODULE_DESCRIPTION("VUB300 USB to SD/MMC/SDIO adapter driver");
2478	MODULE_LICENSE("GPL");
2479