--- /dev/null
+From 66b512eda74d59b17eac04c4da1b38d82059e6c9 Mon Sep 17 00:00:00 2001
+From: Ludovic Desroches <ludovic.desroches@atmel.com>
+Date: Wed, 20 Nov 2013 16:01:11 +0100
+Subject: mmc: atmel-mci: fix timeout errors in SDIO mode when using DMA
+
+From: Ludovic Desroches <ludovic.desroches@atmel.com>
+
+commit 66b512eda74d59b17eac04c4da1b38d82059e6c9 upstream.
+
+With some SDIO devices, timeout errors can happen when reading data.
+To solve this issue, the DMA transfer has to be activated before sending
+the command to the device. This order is incorrect in PDC mode. So we
+have to take care if we are using DMA or PDC to know when to send the
+MMC command.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/atmel-mci.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/atmel-mci.c
++++ b/drivers/mmc/host/atmel-mci.c
+@@ -1188,11 +1188,22 @@ static void atmci_start_request(struct a
+ iflags |= ATMCI_CMDRDY;
+ cmd = mrq->cmd;
+ cmdflags = atmci_prepare_command(slot->mmc, cmd);
+- atmci_send_command(host, cmd, cmdflags);
++
++ /*
++ * DMA transfer should be started before sending the command to avoid
++ * unexpected errors especially for read operations in SDIO mode.
++ * Unfortunately, in PDC mode, command has to be sent before starting
++ * the transfer.
++ */
++ if (host->submit_data != &atmci_submit_data_dma)
++ atmci_send_command(host, cmd, cmdflags);
+
+ if (data)
+ host->submit_data(host, data);
+
++ if (host->submit_data == &atmci_submit_data_dma)
++ atmci_send_command(host, cmd, cmdflags);
++
+ if (mrq->stop) {
+ host->stop_cmdr = atmci_prepare_command(slot->mmc, mrq->stop);
+ host->stop_cmdr |= ATMCI_CMDR_STOP_XFER;
--- /dev/null
+From f662ae48ae67dfd42739e65750274fe8de46240a Mon Sep 17 00:00:00 2001
+From: Ray Jui <rjui@broadcom.com>
+Date: Sat, 26 Oct 2013 11:03:44 -0700
+Subject: mmc: fix host release issue after discard operation
+
+From: Ray Jui <rjui@broadcom.com>
+
+commit f662ae48ae67dfd42739e65750274fe8de46240a upstream.
+
+Under function mmc_blk_issue_rq, after an MMC discard operation,
+the MMC request data structure may be freed in memory. Later in
+the same function, the check of req->cmd_flags & MMC_REQ_SPECIAL_MASK
+is dangerous and invalid. It causes the MMC host not to be released
+when it should.
+
+This patch fixes the issue by marking the special request down before
+the discard/flush operation.
+
+Reported by: Harold (SoonYeal) Yang <haroldsy@broadcom.com>
+Signed-off-by: Ray Jui <rjui@broadcom.com>
+Reviewed-by: Seungwon Jeon <tgih.jun@samsung.com>
+Acked-by: Seungwon Jeon <tgih.jun@samsung.com>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/card/block.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -1931,6 +1931,7 @@ static int mmc_blk_issue_rq(struct mmc_q
+ struct mmc_card *card = md->queue.card;
+ struct mmc_host *host = card->host;
+ unsigned long flags;
++ unsigned int cmd_flags = req ? req->cmd_flags : 0;
+
+ if (req && !mq->mqrq_prev->req)
+ /* claim host only for the first request */
+@@ -1946,7 +1947,7 @@ static int mmc_blk_issue_rq(struct mmc_q
+ }
+
+ mq->flags &= ~MMC_QUEUE_NEW_REQUEST;
+- if (req && req->cmd_flags & REQ_DISCARD) {
++ if (cmd_flags & REQ_DISCARD) {
+ /* complete ongoing async transfer before issuing discard */
+ if (card->host->areq)
+ mmc_blk_issue_rw_rq(mq, NULL);
+@@ -1955,7 +1956,7 @@ static int mmc_blk_issue_rq(struct mmc_q
+ ret = mmc_blk_issue_secdiscard_rq(mq, req);
+ else
+ ret = mmc_blk_issue_discard_rq(mq, req);
+- } else if (req && req->cmd_flags & REQ_FLUSH) {
++ } else if (cmd_flags & REQ_FLUSH) {
+ /* complete ongoing async transfer before issuing flush */
+ if (card->host->areq)
+ mmc_blk_issue_rw_rq(mq, NULL);
+@@ -1971,7 +1972,7 @@ static int mmc_blk_issue_rq(struct mmc_q
+
+ out:
+ if ((!req && !(mq->flags & MMC_QUEUE_NEW_REQUEST)) ||
+- (req && (req->cmd_flags & MMC_REQ_SPECIAL_MASK)))
++ (cmd_flags & MMC_REQ_SPECIAL_MASK))
+ /*
+ * Release host when there are no more requests
+ * and after special request(discard, flush) is done.