43 files changed, 666 insertions, 4773 deletions

diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index e0ff51b89529..14625fd2cecd 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -721,31 +721,6 @@ config USB_FUNCTIONFS_GENERIC
           Include a configuration with the Function Filesystem alone with
           no Ethernet interface.
 
-config USB_FILE_STORAGE
-        tristate "File-backed Storage Gadget (DEPRECATED)"
-        depends on BLOCK
-        help
-          The File-backed Storage Gadget acts as a USB Mass Storage
-          disk drive.  As its storage repository it can use a regular
-          file or a block device (in much the same way as the "loop"
-          device driver), specified as a module parameter.
-
-          Say "y" to link the driver statically, or "m" to build a
-          dynamically linked module called "g_file_storage".
-
-          NOTE: This driver is deprecated.  Its replacement is the
-          Mass Storage Gadget.
-
-config USB_FILE_STORAGE_TEST
-        bool "File-backed Storage Gadget testing version"
-        depends on USB_FILE_STORAGE
-        default n
-        help
-          Say "y" to generate the larger testing version of the
-          File-backed Storage Gadget, useful for probing the
-          behavior of USB Mass Storage hosts.  Not needed for
-          normal operation.
-
 config USB_MASS_STORAGE
         tristate "Mass Storage Gadget"
         depends on BLOCK
@@ -756,8 +731,8 @@ config USB_MASS_STORAGE
           device (in much the same way as the "loop" device driver),
           specified as a module parameter or sysfs option.
 
-          This driver is an updated replacement for the deprecated
-          File-backed Storage Gadget (g_file_storage).
+          This driver is a replacement for now removed File-backed
+          Storage Gadget (g_file_storage).
 
           Say "y" to link the driver statically, or "m" to build
           a dynamically linked module called "g_mass_storage".
diff --git a/drivers/usb/gadget/Makefile b/drivers/usb/gadget/Makefile
index 307be5fa824c..8b4acfd92aa3 100644
--- a/drivers/usb/gadget/Makefile
+++ b/drivers/usb/gadget/Makefile
@@ -44,7 +44,6 @@ g_ether-y			:= ether.o
 g_serial-y                      := serial.o
 g_midi-y                        := gmidi.o
 gadgetfs-y                      := inode.o
-g_file_storage-y                := file_storage.o
 g_mass_storage-y                := mass_storage.o
 g_printer-y                     := printer.o
 g_cdc-y                         := cdc2.o
@@ -62,7 +61,6 @@ obj-$(CONFIG_USB_AUDIO)		+= g_audio.o
 obj-$(CONFIG_USB_ETH)           += g_ether.o
 obj-$(CONFIG_USB_GADGETFS)      += gadgetfs.o
 obj-$(CONFIG_USB_FUNCTIONFS)    += g_ffs.o
-obj-$(CONFIG_USB_FILE_STORAGE)  += g_file_storage.o
 obj-$(CONFIG_USB_MASS_STORAGE)  += g_mass_storage.o
 obj-$(CONFIG_USB_G_SERIAL)      += g_serial.o
 obj-$(CONFIG_USB_G_PRINTER)     += g_printer.o
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index 89d90b5fb787..e6135faabc3a 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -1673,7 +1673,7 @@ static void at91udc_shutdown(struct platform_device *dev)
         spin_unlock_irqrestore(&udc->lock, flags);
 }
 
-static void __devinit at91udc_of_init(struct at91_udc *udc,
+static void at91udc_of_init(struct at91_udc *udc,
                                      struct device_node *np)
 {
         struct at91_udc_data *board = &udc->board;
@@ -1693,7 +1693,7 @@ static void __devinit at91udc_of_init(struct at91_udc *udc,
         board->pullup_active_low = (flags & OF_GPIO_ACTIVE_LOW) ? 1 : 0;
 }
 
-static int __devinit at91udc_probe(struct platform_device *pdev)
+static int at91udc_probe(struct platform_device *pdev)
 {
         struct device   *dev = &pdev->dev;
         struct at91_udc *udc;
diff --git a/drivers/usb/gadget/bcm63xx_udc.c b/drivers/usb/gadget/bcm63xx_udc.c
index 9ca792224cd4..47a49931361e 100644
--- a/drivers/usb/gadget/bcm63xx_udc.c
+++ b/drivers/usb/gadget/bcm63xx_udc.c
@@ -2323,7 +2323,7 @@ static void bcm63xx_udc_gadget_release(struct device *dev)
  * Note that platform data is required, because pd.port_no varies from chip
  * to chip and is used to switch the correct USB port to device mode.
  */
-static int __devinit bcm63xx_udc_probe(struct platform_device *pdev)
+static int bcm63xx_udc_probe(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
         struct bcm63xx_usbd_platform_data *pd = dev->platform_data;
@@ -2433,7 +2433,7 @@ out_uninit:
  * bcm63xx_udc_remove - Remove the device from the system.
  * @pdev: Platform device struct from the bcm63xx BSP code.
  */
-static int __devexit bcm63xx_udc_remove(struct platform_device *pdev)
+static int bcm63xx_udc_remove(struct platform_device *pdev)
 {
         struct bcm63xx_udc *udc = platform_get_drvdata(pdev);
 
@@ -2450,7 +2450,7 @@ static int __devexit bcm63xx_udc_remove(struct platform_device *pdev)
 
 static struct platform_driver bcm63xx_udc_driver = {
         .probe          = bcm63xx_udc_probe,
-        .remove         = __devexit_p(bcm63xx_udc_remove),
+        .remove         = bcm63xx_udc_remove,
         .driver         = {
                 .name   = DRV_MODULE_NAME,
                 .owner  = THIS_MODULE,
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 957f973dd96a..2a6bfe759c29 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -107,7 +107,7 @@ int config_ep_by_speed(struct usb_gadget *g,
                 }
                 /* else: fall through */
         default:
-                speed_desc = f->descriptors;
+                speed_desc = f->fs_descriptors;
         }
         /* find descriptors */
         for_each_ep_desc(speed_desc, d_spd) {
@@ -200,7 +200,7 @@ int usb_add_function(struct usb_configuration *config,
          * as full speed ... it's the function drivers that will need
          * to avoid bulk and ISO transfers.
          */
-        if (!config->fullspeed && function->descriptors)
+        if (!config->fullspeed && function->fs_descriptors)
                 config->fullspeed = true;
         if (!config->highspeed && function->hs_descriptors)
                 config->highspeed = true;
@@ -363,7 +363,7 @@ static int config_buf(struct usb_configuration *config,
                         descriptors = f->hs_descriptors;
                         break;
                 default:
-                        descriptors = f->descriptors;
+                        descriptors = f->fs_descriptors;
                 }
 
                 if (!descriptors)
@@ -620,7 +620,7 @@ static int set_config(struct usb_composite_dev *cdev,
                         descriptors = f->hs_descriptors;
                         break;
                 default:
-                        descriptors = f->descriptors;
+                        descriptors = f->fs_descriptors;
                 }
 
                 for (; *descriptors; ++descriptors) {
diff --git a/drivers/usb/gadget/config.c b/drivers/usb/gadget/config.c
index e3a98929d346..34e12fc52c23 100644
--- a/drivers/usb/gadget/config.c
+++ b/drivers/usb/gadget/config.c
@@ -19,7 +19,7 @@
 
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
-
+#include <linux/usb/composite.h>
 
 /**
  * usb_descriptor_fillbuf - fill buffer with descriptors
@@ -158,3 +158,40 @@ usb_copy_descriptors(struct usb_descriptor_header **src)
         return ret;
 }
 EXPORT_SYMBOL_GPL(usb_copy_descriptors);
+
+int usb_assign_descriptors(struct usb_function *f,
+                struct usb_descriptor_header **fs,
+                struct usb_descriptor_header **hs,
+                struct usb_descriptor_header **ss)
+{
+        struct usb_gadget *g = f->config->cdev->gadget;
+
+        if (fs) {
+                f->fs_descriptors = usb_copy_descriptors(fs);
+                if (!f->fs_descriptors)
+                        goto err;
+        }
+        if (hs && gadget_is_dualspeed(g)) {
+                f->hs_descriptors = usb_copy_descriptors(hs);
+                if (!f->hs_descriptors)
+                        goto err;
+        }
+        if (ss && gadget_is_superspeed(g)) {
+                f->ss_descriptors = usb_copy_descriptors(ss);
+                if (!f->ss_descriptors)
+                        goto err;
+        }
+        return 0;
+err:
+        usb_free_all_descriptors(f);
+        return -ENOMEM;
+}
+EXPORT_SYMBOL_GPL(usb_assign_descriptors);
+
+void usb_free_all_descriptors(struct usb_function *f)
+{
+        usb_free_descriptors(f->fs_descriptors);
+        usb_free_descriptors(f->hs_descriptors);
+        usb_free_descriptors(f->ss_descriptors);
+}
+EXPORT_SYMBOL_GPL(usb_free_all_descriptors);
diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
index 0f7541be28f3..95d584dbed13 100644
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -63,16 +63,20 @@ MODULE_LICENSE("GPL");
 struct dummy_hcd_module_parameters {
         bool is_super_speed;
         bool is_high_speed;
+        unsigned int num;
 };
 
 static struct dummy_hcd_module_parameters mod_data = {
         .is_super_speed = false,
         .is_high_speed = true,
+        .num = 1,
 };
 module_param_named(is_super_speed, mod_data.is_super_speed, bool, S_IRUGO);
 MODULE_PARM_DESC(is_super_speed, "true to simulate SuperSpeed connection");
 module_param_named(is_high_speed, mod_data.is_high_speed, bool, S_IRUGO);
 MODULE_PARM_DESC(is_high_speed, "true to simulate HighSpeed connection");
+module_param_named(num, mod_data.num, uint, S_IRUGO);
+MODULE_PARM_DESC(num, "number of emulated controllers");
 /*-------------------------------------------------------------------------*/
 
 /* gadget side driver data structres */
@@ -238,8 +242,6 @@ static inline struct dummy *gadget_dev_to_dummy(struct device *dev)
         return container_of(dev, struct dummy, gadget.dev);
 }
 
-static struct dummy                     the_controller;
-
 /*-------------------------------------------------------------------------*/
 
 /* SLAVE/GADGET SIDE UTILITY ROUTINES */
@@ -973,9 +975,10 @@ static void init_dummy_udc_hw(struct dummy *dum)
 
 static int dummy_udc_probe(struct platform_device *pdev)
 {
-        struct dummy    *dum = &the_controller;
+        struct dummy    *dum;
         int             rc;
 
+        dum = *((void **)dev_get_platdata(&pdev->dev));
         dum->gadget.name = gadget_name;
         dum->gadget.ops = &dummy_ops;
         dum->gadget.max_speed = USB_SPEED_SUPER;
@@ -2398,10 +2401,13 @@ static int dummy_h_get_frame(struct usb_hcd *hcd)
 
 static int dummy_setup(struct usb_hcd *hcd)
 {
+        struct dummy *dum;
+
+        dum = *((void **)dev_get_platdata(hcd->self.controller));
         hcd->self.sg_tablesize = ~0;
         if (usb_hcd_is_primary_hcd(hcd)) {
-                the_controller.hs_hcd = hcd_to_dummy_hcd(hcd);
-                the_controller.hs_hcd->dum = &the_controller;
+                dum->hs_hcd = hcd_to_dummy_hcd(hcd);
+                dum->hs_hcd->dum = dum;
                 /*
                  * Mark the first roothub as being USB 2.0.
                  * The USB 3.0 roothub will be registered later by
@@ -2410,8 +2416,8 @@ static int dummy_setup(struct usb_hcd *hcd)
                 hcd->speed = HCD_USB2;
                 hcd->self.root_hub->speed = USB_SPEED_HIGH;
         } else {
-                the_controller.ss_hcd = hcd_to_dummy_hcd(hcd);
-                the_controller.ss_hcd->dum = &the_controller;
+                dum->ss_hcd = hcd_to_dummy_hcd(hcd);
+                dum->ss_hcd->dum = dum;
                 hcd->speed = HCD_USB3;
                 hcd->self.root_hub->speed = USB_SPEED_SUPER;
         }
@@ -2524,11 +2530,13 @@ static struct hc_driver dummy_hcd = {
 
 static int dummy_hcd_probe(struct platform_device *pdev)
 {
+        struct dummy            *dum;
         struct usb_hcd          *hs_hcd;
         struct usb_hcd          *ss_hcd;
         int                     retval;
 
         dev_info(&pdev->dev, "%s, driver " DRIVER_VERSION "\n", driver_desc);
+        dum = *((void **)dev_get_platdata(&pdev->dev));
 
         if (!mod_data.is_super_speed)
                 dummy_hcd.flags = HCD_USB2;
@@ -2561,7 +2569,7 @@ dealloc_usb2_hcd:
         usb_remove_hcd(hs_hcd);
 put_usb2_hcd:
         usb_put_hcd(hs_hcd);
-        the_controller.hs_hcd = the_controller.ss_hcd = NULL;
+        dum->hs_hcd = dum->ss_hcd = NULL;
         return retval;
 }
 
@@ -2579,8 +2587,8 @@ static int dummy_hcd_remove(struct platform_device *pdev)
         usb_remove_hcd(dummy_hcd_to_hcd(dum->hs_hcd));
         usb_put_hcd(dummy_hcd_to_hcd(dum->hs_hcd));
 
-        the_controller.hs_hcd = NULL;
-        the_controller.ss_hcd = NULL;
+        dum->hs_hcd = NULL;
+        dum->ss_hcd = NULL;
 
         return 0;
 }
@@ -2627,13 +2635,15 @@ static struct platform_driver dummy_hcd_driver = {
 };
 
 /*-------------------------------------------------------------------------*/
-
-static struct platform_device *the_udc_pdev;
-static struct platform_device *the_hcd_pdev;
+#define MAX_NUM_UDC     2
+static struct platform_device *the_udc_pdev[MAX_NUM_UDC];
+static struct platform_device *the_hcd_pdev[MAX_NUM_UDC];
 
 static int __init init(void)
 {
         int     retval = -ENOMEM;
+        int     i;
+        struct  dummy *dum[MAX_NUM_UDC];
 
         if (usb_disabled())
                 return -ENODEV;
@@ -2641,65 +2651,129 @@ static int __init init(void)
         if (!mod_data.is_high_speed && mod_data.is_super_speed)
                 return -EINVAL;
 
-        the_hcd_pdev = platform_device_alloc(driver_name, -1);
-        if (!the_hcd_pdev)
-                return retval;
-        the_udc_pdev = platform_device_alloc(gadget_name, -1);
-        if (!the_udc_pdev)
-                goto err_alloc_udc;
+        if (mod_data.num < 1 || mod_data.num > MAX_NUM_UDC) {
+                pr_err("Number of emulated UDC must be in range of 1…%d\n",
+                                MAX_NUM_UDC);
+                return -EINVAL;
+        }
+
+        for (i = 0; i < mod_data.num; i++) {
+                the_hcd_pdev[i] = platform_device_alloc(driver_name, i);
+                if (!the_hcd_pdev[i]) {
+                        i--;
+                        while (i >= 0)
+                                platform_device_put(the_hcd_pdev[i--]);
+                        return retval;
+                }
+        }
+        for (i = 0; i < mod_data.num; i++) {
+                the_udc_pdev[i] = platform_device_alloc(gadget_name, i);
+                if (!the_udc_pdev[i]) {
+                        i--;
+                        while (i >= 0)
+                                platform_device_put(the_udc_pdev[i--]);
+                        goto err_alloc_udc;
+                }
+        }
+        for (i = 0; i < mod_data.num; i++) {
+                dum[i] = kzalloc(sizeof(struct dummy), GFP_KERNEL);
+                if (!dum[i])
+                        goto err_add_pdata;
+                retval = platform_device_add_data(the_hcd_pdev[i], &dum[i],
+                                sizeof(void *));
+                if (retval)
+                        goto err_add_pdata;
+                retval = platform_device_add_data(the_udc_pdev[i], &dum[i],
+                                sizeof(void *));
+                if (retval)
+                        goto err_add_pdata;
+        }
 
         retval = platform_driver_register(&dummy_hcd_driver);
         if (retval < 0)
-                goto err_register_hcd_driver;
+                goto err_add_pdata;
         retval = platform_driver_register(&dummy_udc_driver);
         if (retval < 0)
                 goto err_register_udc_driver;
 
-        retval = platform_device_add(the_hcd_pdev);
-        if (retval < 0)
-                goto err_add_hcd;
-        if (!the_controller.hs_hcd ||
-            (!the_controller.ss_hcd && mod_data.is_super_speed)) {
-                /*
-                 * The hcd was added successfully but its probe function failed
-                 * for some reason.
-                 */
-                retval = -EINVAL;
-                goto err_add_udc;
+        for (i = 0; i < mod_data.num; i++) {
+                retval = platform_device_add(the_hcd_pdev[i]);
+                if (retval < 0) {
+                        i--;
+                        while (i >= 0)
+                                platform_device_del(the_hcd_pdev[i--]);
+                        goto err_add_hcd;
+                }
         }
-        retval = platform_device_add(the_udc_pdev);
-        if (retval < 0)
-                goto err_add_udc;
-        if (!platform_get_drvdata(the_udc_pdev)) {
-                /*
-                 * The udc was added successfully but its probe function failed
-                 * for some reason.
-                 */
-                retval = -EINVAL;
-                goto err_probe_udc;
+        for (i = 0; i < mod_data.num; i++) {
+                if (!dum[i]->hs_hcd ||
+                                (!dum[i]->ss_hcd && mod_data.is_super_speed)) {
+                        /*
+                         * The hcd was added successfully but its probe
+                         * function failed for some reason.
+                         */
+                        retval = -EINVAL;
+                        goto err_add_udc;
+                }
+        }
+
+        for (i = 0; i < mod_data.num; i++) {
+                retval = platform_device_add(the_udc_pdev[i]);
+                if (retval < 0) {
+                        i--;
+                        while (i >= 0)
+                                platform_device_del(the_udc_pdev[i]);
+                        goto err_add_udc;
+                }
+        }
+
+        for (i = 0; i < mod_data.num; i++) {
+                if (!platform_get_drvdata(the_udc_pdev[i])) {
+                        /*
+                         * The udc was added successfully but its probe
+                         * function failed for some reason.
+                         */
+                        retval = -EINVAL;
+                        goto err_probe_udc;
+                }
         }
         return retval;
 
 err_probe_udc:
-        platform_device_del(the_udc_pdev);
+        for (i = 0; i < mod_data.num; i++)
+                platform_device_del(the_udc_pdev[i]);
 err_add_udc:
-        platform_device_del(the_hcd_pdev);
+        for (i = 0; i < mod_data.num; i++)
+                platform_device_del(the_hcd_pdev[i]);
 err_add_hcd:
         platform_driver_unregister(&dummy_udc_driver);
 err_register_udc_driver:
         platform_driver_unregister(&dummy_hcd_driver);
-err_register_hcd_driver:
-        platform_device_put(the_udc_pdev);
+err_add_pdata:
+        for (i = 0; i < mod_data.num; i++)
+                kfree(dum[i]);
+        for (i = 0; i < mod_data.num; i++)
+                platform_device_put(the_udc_pdev[i]);
 err_alloc_udc:
-        platform_device_put(the_hcd_pdev);
+        for (i = 0; i < mod_data.num; i++)
+                platform_device_put(the_hcd_pdev[i]);
         return retval;
 }
 module_init(init);
 
 static void __exit cleanup(void)
 {
-        platform_device_unregister(the_udc_pdev);
-        platform_device_unregister(the_hcd_pdev);
+        int i;
+
+        for (i = 0; i < mod_data.num; i++) {
+                struct dummy *dum;
+
+                dum = *((void **)dev_get_platdata(&the_udc_pdev[i]->dev));
+
+                platform_device_unregister(the_udc_pdev[i]);
+                platform_device_unregister(the_hcd_pdev[i]);
+                kfree(dum);
+        }
         platform_driver_unregister(&dummy_udc_driver);
         platform_driver_unregister(&dummy_hcd_driver);
 }
diff --git a/drivers/usb/gadget/f_acm.c b/drivers/usb/gadget/f_acm.c
index d672250a61fa..549174466c21 100644
--- a/drivers/usb/gadget/f_acm.c
+++ b/drivers/usb/gadget/f_acm.c
@@ -87,7 +87,7 @@ static inline struct f_acm *port_to_acm(struct gserial *p)
 
 /* notification endpoint uses smallish and infrequent fixed-size messages */
 
-#define GS_LOG2_NOTIFY_INTERVAL         5       /* 1 << 5 == 32 msec */
+#define GS_NOTIFY_INTERVAL_MS           32
 #define GS_NOTIFY_MAXPACKET             10      /* notification + 2 bytes */
 
 /* interface and class descriptors: */
@@ -167,7 +167,7 @@ static struct usb_endpoint_descriptor acm_fs_notify_desc = {
         .bEndpointAddress =     USB_DIR_IN,
         .bmAttributes =         USB_ENDPOINT_XFER_INT,
         .wMaxPacketSize =       cpu_to_le16(GS_NOTIFY_MAXPACKET),
-        .bInterval =            1 << GS_LOG2_NOTIFY_INTERVAL,
+        .bInterval =            GS_NOTIFY_INTERVAL_MS,
 };
 
 static struct usb_endpoint_descriptor acm_fs_in_desc = {
@@ -199,14 +199,13 @@ static struct usb_descriptor_header *acm_fs_function[] = {
 };
 
 /* high speed support: */
-
 static struct usb_endpoint_descriptor acm_hs_notify_desc = {
         .bLength =              USB_DT_ENDPOINT_SIZE,
         .bDescriptorType =      USB_DT_ENDPOINT,
         .bEndpointAddress =     USB_DIR_IN,
         .bmAttributes =         USB_ENDPOINT_XFER_INT,
         .wMaxPacketSize =       cpu_to_le16(GS_NOTIFY_MAXPACKET),
-        .bInterval =            GS_LOG2_NOTIFY_INTERVAL+4,
+        .bInterval =            USB_MS_TO_HS_INTERVAL(GS_NOTIFY_INTERVAL_MS),
 };
 
 static struct usb_endpoint_descriptor acm_hs_in_desc = {
@@ -659,37 +658,22 @@ acm_bind(struct usb_configuration *c, struct usb_function *f)
         acm->notify_req->complete = acm_cdc_notify_complete;
         acm->notify_req->context = acm;
 
-        /* copy descriptors */
-        f->descriptors = usb_copy_descriptors(acm_fs_function);
-        if (!f->descriptors)
-                goto fail;
-
         /* support all relevant hardware speeds... we expect that when
          * hardware is dual speed, all bulk-capable endpoints work at
          * both speeds
          */
-        if (gadget_is_dualspeed(c->cdev->gadget)) {
-                acm_hs_in_desc.bEndpointAddress =
-                                acm_fs_in_desc.bEndpointAddress;
-                acm_hs_out_desc.bEndpointAddress =
-                                acm_fs_out_desc.bEndpointAddress;
-                acm_hs_notify_desc.bEndpointAddress =
-                                acm_fs_notify_desc.bEndpointAddress;
-
-                /* copy descriptors */
-                f->hs_descriptors = usb_copy_descriptors(acm_hs_function);
-        }
-        if (gadget_is_superspeed(c->cdev->gadget)) {
-                acm_ss_in_desc.bEndpointAddress =
-                        acm_fs_in_desc.bEndpointAddress;
-                acm_ss_out_desc.bEndpointAddress =
-                        acm_fs_out_desc.bEndpointAddress;
-
-                /* copy descriptors, and track endpoint copies */
-                f->ss_descriptors = usb_copy_descriptors(acm_ss_function);
-                if (!f->ss_descriptors)
-                        goto fail;
-        }
+        acm_hs_in_desc.bEndpointAddress = acm_fs_in_desc.bEndpointAddress;
+        acm_hs_out_desc.bEndpointAddress = acm_fs_out_desc.bEndpointAddress;
+        acm_hs_notify_desc.bEndpointAddress =
+                acm_fs_notify_desc.bEndpointAddress;
+
+        acm_ss_in_desc.bEndpointAddress = acm_fs_in_desc.bEndpointAddress;
+        acm_ss_out_desc.bEndpointAddress = acm_fs_out_desc.bEndpointAddress;
+
+        status = usb_assign_descriptors(f, acm_fs_function, acm_hs_function,
+                        acm_ss_function);
+        if (status)
+                goto fail;
 
         DBG(cdev, "acm ttyGS%d: %s speed IN/%s OUT/%s NOTIFY/%s\n",
                         acm->port_num,
@@ -721,11 +705,8 @@ acm_unbind(struct usb_configuration *c, struct usb_function *f)
 {
         struct f_acm            *acm = func_to_acm(f);
 
-        if (gadget_is_dualspeed(c->cdev->gadget))
-                usb_free_descriptors(f->hs_descriptors);
-        if (gadget_is_superspeed(c->cdev->gadget))
-                usb_free_descriptors(f->ss_descriptors);
-        usb_free_descriptors(f->descriptors);
+        acm_string_defs[0].id = 0;
+        usb_free_all_descriptors(f);
         gs_free_req(acm->notify, acm->notify_req);
         kfree(acm);
 }
@@ -762,27 +743,15 @@ int acm_bind_config(struct usb_configuration *c, u8 port_num)
          */
 
         /* maybe allocate device-global string IDs, and patch descriptors */
-        if (acm_string_defs[ACM_CTRL_IDX].id == 0) {
-                status = usb_string_id(c->cdev);
+        if (acm_string_defs[0].id == 0) {
+                status = usb_string_ids_tab(c->cdev, acm_string_defs);
                 if (status < 0)
                         return status;
-                acm_string_defs[ACM_CTRL_IDX].id = status;
-
-                acm_control_interface_desc.iInterface = status;
-
-                status = usb_string_id(c->cdev);
-                if (status < 0)
-                        return status;
-                acm_string_defs[ACM_DATA_IDX].id = status;
-
-                acm_data_interface_desc.iInterface = status;
-
-                status = usb_string_id(c->cdev);
-                if (status < 0)
-                        return status;
-                acm_string_defs[ACM_IAD_IDX].id = status;
-
-                acm_iad_descriptor.iFunction = status;
+                acm_control_interface_desc.iInterface =
+                        acm_string_defs[ACM_CTRL_IDX].id;
+                acm_data_interface_desc.iInterface =
+                        acm_string_defs[ACM_DATA_IDX].id;
+                acm_iad_descriptor.iFunction = acm_string_defs[ACM_IAD_IDX].id;
         }
 
         /* allocate and initialize one new instance */
diff --git a/drivers/usb/gadget/f_ecm.c b/drivers/usb/gadget/f_ecm.c
index 95bc94f8e570..83420a310fb7 100644
--- a/drivers/usb/gadget/f_ecm.c
+++ b/drivers/usb/gadget/f_ecm.c
@@ -91,7 +91,7 @@ static inline unsigned ecm_bitrate(struct usb_gadget *g)
  * encapsulated commands (vendor-specific, using control-OUT).
  */
 
-#define LOG2_STATUS_INTERVAL_MSEC       5       /* 1 << 5 == 32 msec */
+#define ECM_STATUS_INTERVAL_MS          32
 #define ECM_STATUS_BYTECOUNT            16      /* 8 byte header + data */
 
 
@@ -192,7 +192,7 @@ static struct usb_endpoint_descriptor fs_ecm_notify_desc = {
         .bEndpointAddress =     USB_DIR_IN,
         .bmAttributes =         USB_ENDPOINT_XFER_INT,
         .wMaxPacketSize =       cpu_to_le16(ECM_STATUS_BYTECOUNT),
-        .bInterval =            1 << LOG2_STATUS_INTERVAL_MSEC,
+        .bInterval =            ECM_STATUS_INTERVAL_MS,
 };
 
 static struct usb_endpoint_descriptor fs_ecm_in_desc = {
@@ -239,7 +239,7 @@ static struct usb_endpoint_descriptor hs_ecm_notify_desc = {
         .bEndpointAddress =     USB_DIR_IN,
         .bmAttributes =         USB_ENDPOINT_XFER_INT,
         .wMaxPacketSize =       cpu_to_le16(ECM_STATUS_BYTECOUNT),
-        .bInterval =            LOG2_STATUS_INTERVAL_MSEC + 4,
+        .bInterval =            USB_MS_TO_HS_INTERVAL(ECM_STATUS_INTERVAL_MS),
 };
 
 static struct usb_endpoint_descriptor hs_ecm_in_desc = {
@@ -288,7 +288,7 @@ static struct usb_endpoint_descriptor ss_ecm_notify_desc = {
         .bEndpointAddress =     USB_DIR_IN,
         .bmAttributes =         USB_ENDPOINT_XFER_INT,
         .wMaxPacketSize =       cpu_to_le16(ECM_STATUS_BYTECOUNT),
-        .bInterval =            LOG2_STATUS_INTERVAL_MSEC + 4,
+        .bInterval =            USB_MS_TO_HS_INTERVAL(ECM_STATUS_INTERVAL_MS),
 };
 
 static struct usb_ss_ep_comp_descriptor ss_ecm_intr_comp_desc = {
@@ -330,6 +330,7 @@ static struct usb_ss_ep_comp_descriptor ss_ecm_bulk_comp_desc = {
 
 static struct usb_descriptor_header *ecm_ss_function[] = {
         /* CDC ECM control descriptors */
+        (struct usb_descriptor_header *) &ecm_iad_descriptor,
         (struct usb_descriptor_header *) &ecm_control_intf,
         (struct usb_descriptor_header *) &ecm_header_desc,
         (struct usb_descriptor_header *) &ecm_union_desc,
@@ -353,7 +354,7 @@ static struct usb_descriptor_header *ecm_ss_function[] = {
 
 static struct usb_string ecm_string_defs[] = {
         [0].s = "CDC Ethernet Control Model (ECM)",
-        [1].s = NULL /* DYNAMIC */,
+        [1].s = "",
         [2].s = "CDC Ethernet Data",
         [3].s = "CDC ECM",
         {  } /* end of list */
@@ -742,42 +743,24 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f)
         ecm->notify_req->context = ecm;
         ecm->notify_req->complete = ecm_notify_complete;
 
-        /* copy descriptors, and track endpoint copies */
-        f->descriptors = usb_copy_descriptors(ecm_fs_function);
-        if (!f->descriptors)
-                goto fail;
-
         /* support all relevant hardware speeds... we expect that when
          * hardware is dual speed, all bulk-capable endpoints work at
          * both speeds
          */
-        if (gadget_is_dualspeed(c->cdev->gadget)) {
-                hs_ecm_in_desc.bEndpointAddress =
-                                fs_ecm_in_desc.bEndpointAddress;
-                hs_ecm_out_desc.bEndpointAddress =
-                                fs_ecm_out_desc.bEndpointAddress;
-                hs_ecm_notify_desc.bEndpointAddress =
-                                fs_ecm_notify_desc.bEndpointAddress;
-
-                /* copy descriptors, and track endpoint copies */
-                f->hs_descriptors = usb_copy_descriptors(ecm_hs_function);
-                if (!f->hs_descriptors)
-                        goto fail;
-        }
-
-        if (gadget_is_superspeed(c->cdev->gadget)) {
-                ss_ecm_in_desc.bEndpointAddress =
-                                fs_ecm_in_desc.bEndpointAddress;
-                ss_ecm_out_desc.bEndpointAddress =
-                                fs_ecm_out_desc.bEndpointAddress;
-                ss_ecm_notify_desc.bEndpointAddress =
-                                fs_ecm_notify_desc.bEndpointAddress;
-
-                /* copy descriptors, and track endpoint copies */
-                f->ss_descriptors = usb_copy_descriptors(ecm_ss_function);
-                if (!f->ss_descriptors)
-                        goto fail;
-        }
+        hs_ecm_in_desc.bEndpointAddress = fs_ecm_in_desc.bEndpointAddress;
+        hs_ecm_out_desc.bEndpointAddress = fs_ecm_out_desc.bEndpointAddress;
+        hs_ecm_notify_desc.bEndpointAddress =
+                fs_ecm_notify_desc.bEndpointAddress;
+
+        ss_ecm_in_desc.bEndpointAddress = fs_ecm_in_desc.bEndpointAddress;
+        ss_ecm_out_desc.bEndpointAddress = fs_ecm_out_desc.bEndpointAddress;
+        ss_ecm_notify_desc.bEndpointAddress =
+                fs_ecm_notify_desc.bEndpointAddress;
+
+        status = usb_assign_descriptors(f, ecm_fs_function, ecm_hs_function,
+                        ecm_ss_function);
+        if (status)
+                goto fail;
 
         /* NOTE:  all that is done without knowing or caring about
          * the network link ... which is unavailable to this code
@@ -795,11 +778,6 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f)
         return 0;
 
 fail:
-        if (f->descriptors)
-                usb_free_descriptors(f->descriptors);
-        if (f->hs_descriptors)
-                usb_free_descriptors(f->hs_descriptors);
-
         if (ecm->notify_req) {
                 kfree(ecm->notify_req->buf);
                 usb_ep_free_request(ecm->notify, ecm->notify_req);
@@ -808,9 +786,9 @@ fail:
         /* we might as well release our claims on endpoints */
         if (ecm->notify)
                 ecm->notify->driver_data = NULL;
-        if (ecm->port.out_ep->desc)
+        if (ecm->port.out_ep)
                 ecm->port.out_ep->driver_data = NULL;
-        if (ecm->port.in_ep->desc)
+        if (ecm->port.in_ep)
                 ecm->port.in_ep->driver_data = NULL;
 
         ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
@@ -825,16 +803,11 @@ ecm_unbind(struct usb_configuration *c, struct usb_function *f)
 
         DBG(c->cdev, "ecm unbind\n");
 
-        if (gadget_is_superspeed(c->cdev->gadget))
-                usb_free_descriptors(f->ss_descriptors);
-        if (gadget_is_dualspeed(c->cdev->gadget))
-                usb_free_descriptors(f->hs_descriptors);
-        usb_free_descriptors(f->descriptors);
+        ecm_string_defs[0].id = 0;
+        usb_free_all_descriptors(f);
 
         kfree(ecm->notify_req->buf);
         usb_ep_free_request(ecm->notify, ecm->notify_req);
-
-        ecm_string_defs[1].s = NULL;
         kfree(ecm);
 }
 
@@ -859,36 +832,15 @@ ecm_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN])
         if (!can_support_ecm(c->cdev->gadget) || !ethaddr)
                 return -EINVAL;
 
-        /* maybe allocate device-global string IDs */
         if (ecm_string_defs[0].id == 0) {
-
-                /* control interface label */
-                status = usb_string_id(c->cdev);
-                if (status < 0)
-                        return status;
-                ecm_string_defs[0].id = status;
-                ecm_control_intf.iInterface = status;
-
-                /* data interface label */
-                status = usb_string_id(c->cdev);
-                if (status < 0)
+                status = usb_string_ids_tab(c->cdev, ecm_string_defs);
+                if (status)
                         return status;
-                ecm_string_defs[2].id = status;
-                ecm_data_intf.iInterface = status;
 
-                /* MAC address */
-                status = usb_string_id(c->cdev);
-                if (status < 0)
-                        return status;
-                ecm_string_defs[1].id = status;
-                ecm_desc.iMACAddress = status;
-
-                /* IAD label */
-                status = usb_string_id(c->cdev);
-                if (status < 0)
-                        return status;
-                ecm_string_defs[3].id = status;
-                ecm_iad_descriptor.iFunction = status;
+                ecm_control_intf.iInterface = ecm_string_defs[0].id;
+                ecm_data_intf.iInterface = ecm_string_defs[2].id;
+                ecm_desc.iMACAddress = ecm_string_defs[1].id;
+                ecm_iad_descriptor.iFunction = ecm_string_defs[3].id;
         }
 
         /* allocate and initialize one new instance */
@@ -913,9 +865,7 @@ ecm_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN])
         ecm->port.func.disable = ecm_disable;
 
         status = usb_add_function(c, &ecm->port.func);
-        if (status) {
-                ecm_string_defs[1].s = NULL;
+        if (status)
                 kfree(ecm);
-        }
         return status;
 }
diff --git a/drivers/usb/gadget/f_eem.c b/drivers/usb/gadget/f_eem.c
index 1a7b2dd7d408..cf0ebee85563 100644
--- a/drivers/usb/gadget/f_eem.c
+++ b/drivers/usb/gadget/f_eem.c
@@ -274,38 +274,20 @@ eem_bind(struct usb_configuration *c, struct usb_function *f)
 
         status = -ENOMEM;
 
-        /* copy descriptors, and track endpoint copies */
-        f->descriptors = usb_copy_descriptors(eem_fs_function);
-        if (!f->descriptors)
-                goto fail;
-
         /* support all relevant hardware speeds... we expect that when
          * hardware is dual speed, all bulk-capable endpoints work at
          * both speeds
          */
-        if (gadget_is_dualspeed(c->cdev->gadget)) {
-                eem_hs_in_desc.bEndpointAddress =
-                                eem_fs_in_desc.bEndpointAddress;
-                eem_hs_out_desc.bEndpointAddress =
-                                eem_fs_out_desc.bEndpointAddress;
-
-                /* copy descriptors, and track endpoint copies */
-                f->hs_descriptors = usb_copy_descriptors(eem_hs_function);
-                if (!f->hs_descriptors)
-                        goto fail;
-        }
+        eem_hs_in_desc.bEndpointAddress = eem_fs_in_desc.bEndpointAddress;
+        eem_hs_out_desc.bEndpointAddress = eem_fs_out_desc.bEndpointAddress;
 
-        if (gadget_is_superspeed(c->cdev->gadget)) {
-                eem_ss_in_desc.bEndpointAddress =
-                                eem_fs_in_desc.bEndpointAddress;
-                eem_ss_out_desc.bEndpointAddress =
-                                eem_fs_out_desc.bEndpointAddress;
+        eem_ss_in_desc.bEndpointAddress = eem_fs_in_desc.bEndpointAddress;
+        eem_ss_out_desc.bEndpointAddress = eem_fs_out_desc.bEndpointAddress;
 
-                /* copy descriptors, and track endpoint copies */
-                f->ss_descriptors = usb_copy_descriptors(eem_ss_function);
-                if (!f->ss_descriptors)
-                        goto fail;
-        }
+        status = usb_assign_descriptors(f, eem_fs_function, eem_hs_function,
+                        eem_ss_function);
+        if (status)
+                goto fail;
 
         DBG(cdev, "CDC Ethernet (EEM): %s speed IN/%s OUT/%s\n",
                         gadget_is_superspeed(c->cdev->gadget) ? "super" :
@@ -314,15 +296,10 @@ eem_bind(struct usb_configuration *c, struct usb_function *f)
         return 0;
 
 fail:
-        if (f->descriptors)
-                usb_free_descriptors(f->descriptors);
-        if (f->hs_descriptors)
-                usb_free_descriptors(f->hs_descriptors);
-
-        /* we might as well release our claims on endpoints */
-        if (eem->port.out_ep->desc)
+        usb_free_all_descriptors(f);
+        if (eem->port.out_ep)
                 eem->port.out_ep->driver_data = NULL;
-        if (eem->port.in_ep->desc)
+        if (eem->port.in_ep)
                 eem->port.in_ep->driver_data = NULL;
 
         ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
@@ -337,11 +314,7 @@ eem_unbind(struct usb_configuration *c, struct usb_function *f)
 
         DBG(c->cdev, "eem unbind\n");
 
-        if (gadget_is_superspeed(c->cdev->gadget))
-                usb_free_descriptors(f->ss_descriptors);
-        if (gadget_is_dualspeed(c->cdev->gadget))
-                usb_free_descriptors(f->hs_descriptors);
-        usb_free_descriptors(f->descriptors);
+        usb_free_all_descriptors(f);
         kfree(eem);
 }
 
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 64c4ec10d1fc..4a6961c517f2 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -2097,7 +2097,7 @@ static int __ffs_func_bind_do_descs(enum ffs_entity_type type, u8 *valuep,
         if (isHS)
                 func->function.hs_descriptors[(long)valuep] = desc;
         else
-                func->function.descriptors[(long)valuep]    = desc;
+                func->function.fs_descriptors[(long)valuep]    = desc;
 
         if (!desc || desc->bDescriptorType != USB_DT_ENDPOINT)
                 return 0;
@@ -2249,7 +2249,7 @@ static int ffs_func_bind(struct usb_configuration *c,
          * numbers without worrying that it may be described later on.
          */
         if (likely(full)) {
-                func->function.descriptors = data->fs_descs;
+                func->function.fs_descriptors = data->fs_descs;
                 ret = ffs_do_descs(ffs->fs_descs_count,
                                    data->raw_descs,
                                    sizeof data->raw_descs,
diff --git a/drivers/usb/gadget/f_hid.c b/drivers/usb/gadget/f_hid.c
index 511e527178e2..6e69a8e8d22a 100644
--- a/drivers/usb/gadget/f_hid.c
+++ b/drivers/usb/gadget/f_hid.c
@@ -573,7 +573,6 @@ static int __init hidg_bind(struct usb_configuration *c, struct usb_function *f)
                 goto fail;
         hidg_interface_desc.bInterfaceNumber = status;
 
-
         /* allocate instance-specific endpoints */
         status = -ENODEV;
         ep = usb_ep_autoconfig(c->cdev->gadget, &hidg_fs_in_ep_desc);
@@ -609,20 +608,15 @@ static int __init hidg_bind(struct usb_configuration *c, struct usb_function *f)
         hidg_desc.desc[0].wDescriptorLength =
                 cpu_to_le16(hidg->report_desc_length);
 
-        /* copy descriptors */
-        f->descriptors = usb_copy_descriptors(hidg_fs_descriptors);
-        if (!f->descriptors)
-                goto fail;
+        hidg_hs_in_ep_desc.bEndpointAddress =
+                hidg_fs_in_ep_desc.bEndpointAddress;
+        hidg_hs_out_ep_desc.bEndpointAddress =
+                hidg_fs_out_ep_desc.bEndpointAddress;
 
-        if (gadget_is_dualspeed(c->cdev->gadget)) {
-                hidg_hs_in_ep_desc.bEndpointAddress =
-                        hidg_fs_in_ep_desc.bEndpointAddress;
-                hidg_hs_out_ep_desc.bEndpointAddress =
-                        hidg_fs_out_ep_desc.bEndpointAddress;
-                f->hs_descriptors = usb_copy_descriptors(hidg_hs_descriptors);
-                if (!f->hs_descriptors)
-                        goto fail;
-        }
+        status = usb_assign_descriptors(f, hidg_fs_descriptors,
+                        hidg_hs_descriptors, NULL);
+        if (status)
+                goto fail;
 
         mutex_init(&hidg->lock);
         spin_lock_init(&hidg->spinlock);
@@ -649,9 +643,7 @@ fail:
                         usb_ep_free_request(hidg->in_ep, hidg->req);
         }
 
-        usb_free_descriptors(f->hs_descriptors);
-        usb_free_descriptors(f->descriptors);
-
+        usb_free_all_descriptors(f);
         return status;
 }
 
@@ -668,9 +660,7 @@ static void hidg_unbind(struct usb_configuration *c, struct usb_function *f)
         kfree(hidg->req->buf);
         usb_ep_free_request(hidg->in_ep, hidg->req);
 
-        /* free descriptors copies */
-        usb_free_descriptors(f->hs_descriptors);
-        usb_free_descriptors(f->descriptors);
+        usb_free_all_descriptors(f);
 
         kfree(hidg->report_desc);
         kfree(hidg);
diff --git a/drivers/usb/gadget/f_loopback.c b/drivers/usb/gadget/f_loopback.c
index 7275706caeb0..bb39cb2bb3a3 100644
--- a/drivers/usb/gadget/f_loopback.c
+++ b/drivers/usb/gadget/f_loopback.c
@@ -177,6 +177,7 @@ loopback_bind(struct usb_configuration *c, struct usb_function *f)
         struct usb_composite_dev *cdev = c->cdev;
         struct f_loopback       *loop = func_to_loop(f);
         int                     id;
+        int ret;
 
         /* allocate interface ID(s) */
         id = usb_interface_id(c, f);
@@ -201,22 +202,19 @@ autoconf_fail:
         loop->out_ep->driver_data = cdev;       /* claim */
 
         /* support high speed hardware */
-        if (gadget_is_dualspeed(c->cdev->gadget)) {
-                hs_loop_source_desc.bEndpointAddress =
-                                fs_loop_source_desc.bEndpointAddress;
-                hs_loop_sink_desc.bEndpointAddress =
-                                fs_loop_sink_desc.bEndpointAddress;
-                f->hs_descriptors = hs_loopback_descs;
-        }
+        hs_loop_source_desc.bEndpointAddress =
+                fs_loop_source_desc.bEndpointAddress;
+        hs_loop_sink_desc.bEndpointAddress = fs_loop_sink_desc.bEndpointAddress;
 
         /* support super speed hardware */
-        if (gadget_is_superspeed(c->cdev->gadget)) {
-                ss_loop_source_desc.bEndpointAddress =
-                                fs_loop_source_desc.bEndpointAddress;
-                ss_loop_sink_desc.bEndpointAddress =
-                                fs_loop_sink_desc.bEndpointAddress;
-                f->ss_descriptors = ss_loopback_descs;
-        }
+        ss_loop_source_desc.bEndpointAddress =
+                fs_loop_source_desc.bEndpointAddress;
+        ss_loop_sink_desc.bEndpointAddress = fs_loop_sink_desc.bEndpointAddress;
+
+        ret = usb_assign_descriptors(f, fs_loopback_descs, hs_loopback_descs,
+                        ss_loopback_descs);
+        if (ret)
+                return ret;
 
         DBG(cdev, "%s speed %s: IN/%s, OUT/%s\n",
             (gadget_is_superspeed(c->cdev->gadget) ? "super" :
@@ -228,6 +226,7 @@ autoconf_fail:
 static void
 loopback_unbind(struct usb_configuration *c, struct usb_function *f)
 {
+        usb_free_all_descriptors(f);
         kfree(func_to_loop(f));
 }
 
@@ -379,7 +378,6 @@ static int __init loopback_bind_config(struct usb_configuration *c)
                 return -ENOMEM;
 
         loop->function.name = "loopback";
-        loop->function.descriptors = fs_loopback_descs;
         loop->function.bind = loopback_bind;
         loop->function.unbind = loopback_unbind;
         loop->function.set_alt = loopback_set_alt;
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
index 3a7668bde3ef..5d027b3e1ef0 100644
--- a/drivers/usb/gadget/f_mass_storage.c
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -228,10 +228,6 @@
 
 static const char fsg_string_interface[] = "Mass Storage";
 
-#define FSG_NO_DEVICE_STRINGS    1
-#define FSG_NO_OTG               1
-#define FSG_NO_INTR_EP           1
-
 #include "storage_common.c"
 
 
@@ -2904,9 +2900,7 @@ static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
         }
 
         fsg_common_put(common);
-        usb_free_descriptors(fsg->function.descriptors);
-        usb_free_descriptors(fsg->function.hs_descriptors);
-        usb_free_descriptors(fsg->function.ss_descriptors);
+        usb_free_all_descriptors(&fsg->function);
         kfree(fsg);
 }
 
@@ -2916,6 +2910,8 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
         struct usb_gadget       *gadget = c->cdev->gadget;
         int                     i;
         struct usb_ep           *ep;
+        unsigned                max_burst;
+        int                     ret;
 
         fsg->gadget = gadget;
 
@@ -2939,45 +2935,27 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
         ep->driver_data = fsg->common;  /* claim the endpoint */
         fsg->bulk_out = ep;
 
-        /* Copy descriptors */
-        f->descriptors = usb_copy_descriptors(fsg_fs_function);
-        if (unlikely(!f->descriptors))
-                return -ENOMEM;
-
-        if (gadget_is_dualspeed(gadget)) {
-                /* Assume endpoint addresses are the same for both speeds */
-                fsg_hs_bulk_in_desc.bEndpointAddress =
-                        fsg_fs_bulk_in_desc.bEndpointAddress;
-                fsg_hs_bulk_out_desc.bEndpointAddress =
-                        fsg_fs_bulk_out_desc.bEndpointAddress;
-                f->hs_descriptors = usb_copy_descriptors(fsg_hs_function);
-                if (unlikely(!f->hs_descriptors)) {
-                        usb_free_descriptors(f->descriptors);
-                        return -ENOMEM;
-                }
-        }
-
-        if (gadget_is_superspeed(gadget)) {
-                unsigned        max_burst;
+        /* Assume endpoint addresses are the same for both speeds */
+        fsg_hs_bulk_in_desc.bEndpointAddress =
+                fsg_fs_bulk_in_desc.bEndpointAddress;
+        fsg_hs_bulk_out_desc.bEndpointAddress =
+                fsg_fs_bulk_out_desc.bEndpointAddress;
 
-                /* Calculate bMaxBurst, we know packet size is 1024 */
-                max_burst = min_t(unsigned, FSG_BUFLEN / 1024, 15);
+        /* Calculate bMaxBurst, we know packet size is 1024 */
+        max_burst = min_t(unsigned, FSG_BUFLEN / 1024, 15);
 
-                fsg_ss_bulk_in_desc.bEndpointAddress =
-                        fsg_fs_bulk_in_desc.bEndpointAddress;
-                fsg_ss_bulk_in_comp_desc.bMaxBurst = max_burst;
+        fsg_ss_bulk_in_desc.bEndpointAddress =
+                fsg_fs_bulk_in_desc.bEndpointAddress;
+        fsg_ss_bulk_in_comp_desc.bMaxBurst = max_burst;
 
-                fsg_ss_bulk_out_desc.bEndpointAddress =
-                        fsg_fs_bulk_out_desc.bEndpointAddress;
-                fsg_ss_bulk_out_comp_desc.bMaxBurst = max_burst;
+        fsg_ss_bulk_out_desc.bEndpointAddress =
+                fsg_fs_bulk_out_desc.bEndpointAddress;
+        fsg_ss_bulk_out_comp_desc.bMaxBurst = max_burst;
 
-                f->ss_descriptors = usb_copy_descriptors(fsg_ss_function);
-                if (unlikely(!f->ss_descriptors)) {
-                        usb_free_descriptors(f->hs_descriptors);
-                        usb_free_descriptors(f->descriptors);
-                        return -ENOMEM;
-                }
-        }
+        ret = usb_assign_descriptors(f, fsg_fs_function, fsg_hs_function,
+                        fsg_ss_function);
+        if (ret)
+                goto autoconf_fail;
 
         return 0;
 
@@ -2986,7 +2964,6 @@ autoconf_fail:
         return -ENOTSUPP;
 }
 
-
 /****************************** ADD FUNCTION ******************************/
 
 static struct usb_gadget_strings *fsg_strings_array[] = {
diff --git a/drivers/usb/gadget/f_midi.c b/drivers/usb/gadget/f_midi.c
index 8ed1259fe80d..263e721c2694 100644
--- a/drivers/usb/gadget/f_midi.c
+++ b/drivers/usb/gadget/f_midi.c
@@ -414,7 +414,7 @@ static void f_midi_unbind(struct usb_configuration *c, struct usb_function *f)
         kfree(midi->id);
         midi->id = NULL;
 
-        usb_free_descriptors(f->descriptors);
+        usb_free_all_descriptors(f);
         kfree(midi);
 }
 
@@ -881,19 +881,25 @@ f_midi_bind(struct usb_configuration *c, struct usb_function *f)
          * both speeds
          */
         /* copy descriptors, and track endpoint copies */
+        f->fs_descriptors = usb_copy_descriptors(midi_function);
+        if (!f->fs_descriptors)
+                goto fail_f_midi;
+
         if (gadget_is_dualspeed(c->cdev->gadget)) {
-                c->highspeed = true;
                 bulk_in_desc.wMaxPacketSize = cpu_to_le16(512);
                 bulk_out_desc.wMaxPacketSize = cpu_to_le16(512);
                 f->hs_descriptors = usb_copy_descriptors(midi_function);
-        } else {
-                f->descriptors = usb_copy_descriptors(midi_function);
+                if (!f->hs_descriptors)
+                        goto fail_f_midi;
         }
 
         kfree(midi_function);
 
         return 0;
 
+fail_f_midi:
+        kfree(midi_function);
+        usb_free_descriptors(f->hs_descriptors);
 fail:
         /* we might as well release our claims on endpoints */
         if (midi->out_ep)
diff --git a/drivers/usb/gadget/f_ncm.c b/drivers/usb/gadget/f_ncm.c
index b651b529c67f..6c8362f937be 100644
--- a/drivers/usb/gadget/f_ncm.c
+++ b/drivers/usb/gadget/f_ncm.c
@@ -102,7 +102,7 @@ static inline unsigned ncm_bitrate(struct usb_gadget *g)
                                  USB_CDC_NCM_NTB32_SUPPORTED)
 
 static struct usb_cdc_ncm_ntb_parameters ntb_parameters = {
-        .wLength = sizeof ntb_parameters,
+        .wLength = cpu_to_le16(sizeof(ntb_parameters)),
         .bmNtbFormatsSupported = cpu_to_le16(FORMATS_SUPPORTED),
         .dwNtbInMaxSize = cpu_to_le32(NTB_DEFAULT_IN_SIZE),
         .wNdpInDivisor = cpu_to_le16(4),
@@ -121,7 +121,7 @@ static struct usb_cdc_ncm_ntb_parameters ntb_parameters = {
  * waste less bandwidth.
  */
 
-#define LOG2_STATUS_INTERVAL_MSEC       5       /* 1 << 5 == 32 msec */
+#define NCM_STATUS_INTERVAL_MS          32
 #define NCM_STATUS_BYTECOUNT            16      /* 8 byte header + data */
 
 static struct usb_interface_assoc_descriptor ncm_iad_desc __initdata = {
@@ -230,7 +230,7 @@ static struct usb_endpoint_descriptor fs_ncm_notify_desc __initdata = {
         .bEndpointAddress =     USB_DIR_IN,
         .bmAttributes =         USB_ENDPOINT_XFER_INT,
         .wMaxPacketSize =       cpu_to_le16(NCM_STATUS_BYTECOUNT),
-        .bInterval =            1 << LOG2_STATUS_INTERVAL_MSEC,
+        .bInterval =            NCM_STATUS_INTERVAL_MS,
 };
 
 static struct usb_endpoint_descriptor fs_ncm_in_desc __initdata = {
@@ -275,7 +275,7 @@ static struct usb_endpoint_descriptor hs_ncm_notify_desc __initdata = {
         .bEndpointAddress =     USB_DIR_IN,
         .bmAttributes =         USB_ENDPOINT_XFER_INT,
         .wMaxPacketSize =       cpu_to_le16(NCM_STATUS_BYTECOUNT),
-        .bInterval =            LOG2_STATUS_INTERVAL_MSEC + 4,
+        .bInterval =            USB_MS_TO_HS_INTERVAL(NCM_STATUS_INTERVAL_MS),
 };
 static struct usb_endpoint_descriptor hs_ncm_in_desc __initdata = {
         .bLength =              USB_DT_ENDPOINT_SIZE,
@@ -321,7 +321,7 @@ static struct usb_descriptor_header *ncm_hs_function[] __initdata = {
 
 static struct usb_string ncm_string_defs[] = {
         [STRING_CTRL_IDX].s = "CDC Network Control Model (NCM)",
-        [STRING_MAC_IDX].s = NULL /* DYNAMIC */,
+        [STRING_MAC_IDX].s = "",
         [STRING_DATA_IDX].s = "CDC Network Data",
         [STRING_IAD_IDX].s = "CDC NCM",
         {  } /* end of list */
@@ -869,15 +869,19 @@ static struct sk_buff *ncm_wrap_ntb(struct gether *port,
         struct sk_buff  *skb2;
         int             ncb_len = 0;
         __le16          *tmp;
-        int             div = ntb_parameters.wNdpInDivisor;
-        int             rem = ntb_parameters.wNdpInPayloadRemainder;
+        int             div;
+        int             rem;
         int             pad;
-        int             ndp_align = ntb_parameters.wNdpInAlignment;
+        int             ndp_align;
         int             ndp_pad;
         unsigned        max_size = ncm->port.fixed_in_len;
         struct ndp_parser_opts *opts = ncm->parser_opts;
         unsigned        crc_len = ncm->is_crc ? sizeof(uint32_t) : 0;
 
+        div = le16_to_cpu(ntb_parameters.wNdpInDivisor);
+        rem = le16_to_cpu(ntb_parameters.wNdpInPayloadRemainder);
+        ndp_align = le16_to_cpu(ntb_parameters.wNdpInAlignment);
+
         ncb_len += opts->nth_size;
         ndp_pad = ALIGN(ncb_len, ndp_align) - ncb_len;
         ncb_len += ndp_pad;
@@ -1208,30 +1212,18 @@ ncm_bind(struct usb_configuration *c, struct usb_function *f)
         ncm->notify_req->context = ncm;
         ncm->notify_req->complete = ncm_notify_complete;
 
-        /* copy descriptors, and track endpoint copies */
-        f->descriptors = usb_copy_descriptors(ncm_fs_function);
-        if (!f->descriptors)
-                goto fail;
-
         /*
          * support all relevant hardware speeds... we expect that when
          * hardware is dual speed, all bulk-capable endpoints work at
          * both speeds
          */
-        if (gadget_is_dualspeed(c->cdev->gadget)) {
-                hs_ncm_in_desc.bEndpointAddress =
-                                fs_ncm_in_desc.bEndpointAddress;
-                hs_ncm_out_desc.bEndpointAddress =
-                                fs_ncm_out_desc.bEndpointAddress;
-                hs_ncm_notify_desc.bEndpointAddress =
-                                fs_ncm_notify_desc.bEndpointAddress;
-
-                /* copy descriptors, and track endpoint copies */
-                f->hs_descriptors = usb_copy_descriptors(ncm_hs_function);
-                if (!f->hs_descriptors)
-                        goto fail;
-        }
+        hs_ncm_in_desc.bEndpointAddress = fs_ncm_in_desc.bEndpointAddress;
+        hs_ncm_out_desc.bEndpointAddress = fs_ncm_out_desc.bEndpointAddress;
+        hs_ncm_notify_desc.bEndpointAddress =
+                fs_ncm_notify_desc.bEndpointAddress;
 
+        status = usb_assign_descriptors(f, ncm_fs_function, ncm_hs_function,
+                        NULL);
         /*
          * NOTE:  all that is done without knowing or caring about
          * the network link ... which is unavailable to this code
@@ -1248,9 +1240,7 @@ ncm_bind(struct usb_configuration *c, struct usb_function *f)
         return 0;
 
 fail:
-        if (f->descriptors)
-                usb_free_descriptors(f->descriptors);
-
+        usb_free_all_descriptors(f);
         if (ncm->notify_req) {
                 kfree(ncm->notify_req->buf);
                 usb_ep_free_request(ncm->notify, ncm->notify_req);
@@ -1259,9 +1249,9 @@ fail:
         /* we might as well release our claims on endpoints */
         if (ncm->notify)
                 ncm->notify->driver_data = NULL;
-        if (ncm->port.out_ep->desc)
+        if (ncm->port.out_ep)
                 ncm->port.out_ep->driver_data = NULL;
-        if (ncm->port.in_ep->desc)
+        if (ncm->port.in_ep)
                 ncm->port.in_ep->driver_data = NULL;
 
         ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
@@ -1276,14 +1266,12 @@ ncm_unbind(struct usb_configuration *c, struct usb_function *f)
 
         DBG(c->cdev, "ncm unbind\n");
 
-        if (gadget_is_dualspeed(c->cdev->gadget))
-                usb_free_descriptors(f->hs_descriptors);
-        usb_free_descriptors(f->descriptors);
+        ncm_string_defs[0].id = 0;
+        usb_free_all_descriptors(f);
 
         kfree(ncm->notify_req->buf);
         usb_ep_free_request(ncm->notify, ncm->notify_req);
 
-        ncm_string_defs[1].s = NULL;
         kfree(ncm);
 }
 
@@ -1307,37 +1295,19 @@ int __init ncm_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN])
         if (!can_support_ecm(c->cdev->gadget) || !ethaddr)
                 return -EINVAL;
 
-        /* maybe allocate device-global string IDs */
         if (ncm_string_defs[0].id == 0) {
-
-                /* control interface label */
-                status = usb_string_id(c->cdev);
+                status = usb_string_ids_tab(c->cdev, ncm_string_defs);
                 if (status < 0)
                         return status;
-                ncm_string_defs[STRING_CTRL_IDX].id = status;
-                ncm_control_intf.iInterface = status;
+                ncm_control_intf.iInterface =
+                        ncm_string_defs[STRING_CTRL_IDX].id;
 
-                /* data interface label */
-                status = usb_string_id(c->cdev);
-                if (status < 0)
-                        return status;
-                ncm_string_defs[STRING_DATA_IDX].id = status;
+                status = ncm_string_defs[STRING_DATA_IDX].id;
                 ncm_data_nop_intf.iInterface = status;
                 ncm_data_intf.iInterface = status;
 
-                /* MAC address */
-                status = usb_string_id(c->cdev);
-                if (status < 0)
-                        return status;
-                ncm_string_defs[STRING_MAC_IDX].id = status;
-                ecm_desc.iMACAddress = status;
-
-                /* IAD */
-                status = usb_string_id(c->cdev);
-                if (status < 0)
-                        return status;
-                ncm_string_defs[STRING_IAD_IDX].id = status;
-                ncm_iad_desc.iFunction = status;
+                ecm_desc.iMACAddress = ncm_string_defs[STRING_MAC_IDX].id;
+                ncm_iad_desc.iFunction = ncm_string_defs[STRING_IAD_IDX].id;
         }
 
         /* allocate and initialize one new instance */
@@ -1347,7 +1317,7 @@ int __init ncm_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN])
 
         /* export host's Ethernet address in CDC format */
         snprintf(ncm->ethaddr, sizeof ncm->ethaddr, "%pm", ethaddr);
-        ncm_string_defs[1].s = ncm->ethaddr;
+        ncm_string_defs[STRING_MAC_IDX].s = ncm->ethaddr;
 
         spin_lock_init(&ncm->lock);
         ncm_reset_values(ncm);
@@ -1367,9 +1337,7 @@ int __init ncm_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN])
         ncm->port.unwrap = ncm_unwrap_ntb;
 
         status = usb_add_function(c, &ncm->port.func);
-        if (status) {
-                ncm_string_defs[1].s = NULL;
+        if (status)
                 kfree(ncm);
-        }
         return status;
 }
diff --git a/drivers/usb/gadget/f_obex.c b/drivers/usb/gadget/f_obex.c
index 5f400f66aa9b..d8dd8782768c 100644
--- a/drivers/usb/gadget/f_obex.c
+++ b/drivers/usb/gadget/f_obex.c
@@ -331,23 +331,19 @@ obex_bind(struct usb_configuration *c, struct usb_function *f)
         obex->port.out = ep;
         ep->driver_data = cdev; /* claim */
 
-        /* copy descriptors, and track endpoint copies */
-        f->descriptors = usb_copy_descriptors(fs_function);
-
         /* support all relevant hardware speeds... we expect that when
          * hardware is dual speed, all bulk-capable endpoints work at
          * both speeds
          */
-        if (gadget_is_dualspeed(c->cdev->gadget)) {
 
-                obex_hs_ep_in_desc.bEndpointAddress =
-                                obex_fs_ep_in_desc.bEndpointAddress;
-                obex_hs_ep_out_desc.bEndpointAddress =
-                                obex_fs_ep_out_desc.bEndpointAddress;
+        obex_hs_ep_in_desc.bEndpointAddress =
+                obex_fs_ep_in_desc.bEndpointAddress;
+        obex_hs_ep_out_desc.bEndpointAddress =
+                obex_fs_ep_out_desc.bEndpointAddress;
 
-                /* copy descriptors, and track endpoint copies */
-                f->hs_descriptors = usb_copy_descriptors(hs_function);
-        }
+        status = usb_assign_descriptors(f, fs_function, hs_function, NULL);
+        if (status)
+                goto fail;
 
         /* Avoid letting this gadget enumerate until the userspace
          * OBEX server is active.
@@ -368,6 +364,7 @@ obex_bind(struct usb_configuration *c, struct usb_function *f)
         return 0;
 
 fail:
+        usb_free_all_descriptors(f);
         /* we might as well release our claims on endpoints */
         if (obex->port.out)
                 obex->port.out->driver_data = NULL;
@@ -382,9 +379,8 @@ fail:
 static void
 obex_unbind(struct usb_configuration *c, struct usb_function *f)
 {
-        if (gadget_is_dualspeed(c->cdev->gadget))
-                usb_free_descriptors(f->hs_descriptors);
-        usb_free_descriptors(f->descriptors);
+        obex_string_defs[OBEX_CTRL_IDX].id = 0;
+        usb_free_all_descriptors(f);
         kfree(func_to_obex(f));
 }
 
@@ -423,22 +419,16 @@ int __init obex_bind_config(struct usb_configuration *c, u8 port_num)
         if (!can_support_obex(c))
                 return -EINVAL;
 
-        /* maybe allocate device-global string IDs, and patch descriptors */
         if (obex_string_defs[OBEX_CTRL_IDX].id == 0) {
-                status = usb_string_id(c->cdev);
-                if (status < 0)
-                        return status;
-                obex_string_defs[OBEX_CTRL_IDX].id = status;
-
-                obex_control_intf.iInterface = status;
-
-                status = usb_string_id(c->cdev);
+                status = usb_string_ids_tab(c->cdev, obex_string_defs);
                 if (status < 0)
                         return status;
-                obex_string_defs[OBEX_DATA_IDX].id = status;
+                obex_control_intf.iInterface =
+                        obex_string_defs[OBEX_CTRL_IDX].id;
 
-                obex_data_nop_intf.iInterface =
-                        obex_data_intf.iInterface = status;
+                status = obex_string_defs[OBEX_DATA_IDX].id;
+                obex_data_nop_intf.iInterface = status;
+                obex_data_intf.iInterface = status;
         }
 
         /* allocate and initialize one new instance */
diff --git a/drivers/usb/gadget/f_phonet.c b/drivers/usb/gadget/f_phonet.c
index 8ee9268fe253..b21ab558b6c0 100644
--- a/drivers/usb/gadget/f_phonet.c
+++ b/drivers/usb/gadget/f_phonet.c
@@ -515,14 +515,14 @@ int pn_bind(struct usb_configuration *c, struct usb_function *f)
         fp->in_ep = ep;
         ep->driver_data = fp; /* Claim */
 
-        pn_hs_sink_desc.bEndpointAddress =
-                pn_fs_sink_desc.bEndpointAddress;
-        pn_hs_source_desc.bEndpointAddress =
-                pn_fs_source_desc.bEndpointAddress;
+        pn_hs_sink_desc.bEndpointAddress = pn_fs_sink_desc.bEndpointAddress;
+        pn_hs_source_desc.bEndpointAddress = pn_fs_source_desc.bEndpointAddress;
 
         /* Do not try to bind Phonet twice... */
-        fp->function.descriptors = fs_pn_function;
-        fp->function.hs_descriptors = hs_pn_function;
+        status = usb_assign_descriptors(f, fs_pn_function, hs_pn_function,
+                        NULL);
+        if (status)
+                goto err;
 
         /* Incoming USB requests */
         status = -ENOMEM;
@@ -531,7 +531,7 @@ int pn_bind(struct usb_configuration *c, struct usb_function *f)
 
                 req = usb_ep_alloc_request(fp->out_ep, GFP_KERNEL);
                 if (!req)
-                        goto err;
+                        goto err_req;
 
                 req->complete = pn_rx_complete;
                 fp->out_reqv[i] = req;
@@ -540,14 +540,18 @@ int pn_bind(struct usb_configuration *c, struct usb_function *f)
         /* Outgoing USB requests */
         fp->in_req = usb_ep_alloc_request(fp->in_ep, GFP_KERNEL);
         if (!fp->in_req)
-                goto err;
+                goto err_req;
 
         INFO(cdev, "USB CDC Phonet function\n");
         INFO(cdev, "using %s, OUT %s, IN %s\n", cdev->gadget->name,
                 fp->out_ep->name, fp->in_ep->name);
         return 0;
 
+err_req:
+        for (i = 0; i < phonet_rxq_size && fp->out_reqv[i]; i++)
+                usb_ep_free_request(fp->out_ep, fp->out_reqv[i]);
 err:
+        usb_free_all_descriptors(f);
         if (fp->out_ep)
                 fp->out_ep->driver_data = NULL;
         if (fp->in_ep)
@@ -569,6 +573,7 @@ pn_unbind(struct usb_configuration *c, struct usb_function *f)
                 if (fp->out_reqv[i])
                         usb_ep_free_request(fp->out_ep, fp->out_reqv[i]);
 
+        usb_free_all_descriptors(f);
         kfree(fp);
 }
 
diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
index b1681e45aca7..71beeb833558 100644
--- a/drivers/usb/gadget/f_rndis.c
+++ b/drivers/usb/gadget/f_rndis.c
@@ -101,7 +101,7 @@ static unsigned int bitrate(struct usb_gadget *g)
 /*
  */
 
-#define LOG2_STATUS_INTERVAL_MSEC       5       /* 1 << 5 == 32 msec */
+#define RNDIS_STATUS_INTERVAL_MS        32
 #define STATUS_BYTECOUNT                8       /* 8 bytes data */
 
 
@@ -190,7 +190,7 @@ static struct usb_endpoint_descriptor fs_notify_desc = {
         .bEndpointAddress =     USB_DIR_IN,
         .bmAttributes =         USB_ENDPOINT_XFER_INT,
         .wMaxPacketSize =       cpu_to_le16(STATUS_BYTECOUNT),
-        .bInterval =            1 << LOG2_STATUS_INTERVAL_MSEC,
+        .bInterval =            RNDIS_STATUS_INTERVAL_MS,
 };
 
 static struct usb_endpoint_descriptor fs_in_desc = {
@@ -236,7 +236,7 @@ static struct usb_endpoint_descriptor hs_notify_desc = {
         .bEndpointAddress =     USB_DIR_IN,
         .bmAttributes =         USB_ENDPOINT_XFER_INT,
         .wMaxPacketSize =       cpu_to_le16(STATUS_BYTECOUNT),
-        .bInterval =            LOG2_STATUS_INTERVAL_MSEC + 4,
+        .bInterval =            USB_MS_TO_HS_INTERVAL(RNDIS_STATUS_INTERVAL_MS)
 };
 
 static struct usb_endpoint_descriptor hs_in_desc = {
@@ -284,7 +284,7 @@ static struct usb_endpoint_descriptor ss_notify_desc = {
         .bEndpointAddress =     USB_DIR_IN,
         .bmAttributes =         USB_ENDPOINT_XFER_INT,
         .wMaxPacketSize =       cpu_to_le16(STATUS_BYTECOUNT),
-        .bInterval =            LOG2_STATUS_INTERVAL_MSEC + 4,
+        .bInterval =            USB_MS_TO_HS_INTERVAL(RNDIS_STATUS_INTERVAL_MS)
 };
 
 static struct usb_ss_ep_comp_descriptor ss_intr_comp_desc = {
@@ -722,42 +722,22 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f)
         rndis->notify_req->context = rndis;
         rndis->notify_req->complete = rndis_response_complete;
 
-        /* copy descriptors, and track endpoint copies */
-        f->descriptors = usb_copy_descriptors(eth_fs_function);
-        if (!f->descriptors)
-                goto fail;
-
         /* support all relevant hardware speeds... we expect that when
          * hardware is dual speed, all bulk-capable endpoints work at
          * both speeds
          */
-        if (gadget_is_dualspeed(c->cdev->gadget)) {
-                hs_in_desc.bEndpointAddress =
-                                fs_in_desc.bEndpointAddress;
-                hs_out_desc.bEndpointAddress =
-                                fs_out_desc.bEndpointAddress;
-                hs_notify_desc.bEndpointAddress =
-                                fs_notify_desc.bEndpointAddress;
-
-                /* copy descriptors, and track endpoint copies */
-                f->hs_descriptors = usb_copy_descriptors(eth_hs_function);
-                if (!f->hs_descriptors)
-                        goto fail;
-        }
+        hs_in_desc.bEndpointAddress = fs_in_desc.bEndpointAddress;
+        hs_out_desc.bEndpointAddress = fs_out_desc.bEndpointAddress;
+        hs_notify_desc.bEndpointAddress = fs_notify_desc.bEndpointAddress;
 
-        if (gadget_is_superspeed(c->cdev->gadget)) {
-                ss_in_desc.bEndpointAddress =
-                                fs_in_desc.bEndpointAddress;
-                ss_out_desc.bEndpointAddress =
-                                fs_out_desc.bEndpointAddress;
-                ss_notify_desc.bEndpointAddress =
-                                fs_notify_desc.bEndpointAddress;
-
-                /* copy descriptors, and track endpoint copies */
-                f->ss_descriptors = usb_copy_descriptors(eth_ss_function);
-                if (!f->ss_descriptors)
-                        goto fail;
-        }
+        ss_in_desc.bEndpointAddress = fs_in_desc.bEndpointAddress;
+        ss_out_desc.bEndpointAddress = fs_out_desc.bEndpointAddress;
+        ss_notify_desc.bEndpointAddress = fs_notify_desc.bEndpointAddress;
+
+        status = usb_assign_descriptors(f, eth_fs_function, eth_hs_function,
+                        eth_ss_function);
+        if (status)
+                goto fail;
 
         rndis->port.open = rndis_open;
         rndis->port.close = rndis_close;
@@ -788,12 +768,7 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f)
         return 0;
 
 fail:
-        if (gadget_is_superspeed(c->cdev->gadget) && f->ss_descriptors)
-                usb_free_descriptors(f->ss_descriptors);
-        if (gadget_is_dualspeed(c->cdev->gadget) && f->hs_descriptors)
-                usb_free_descriptors(f->hs_descriptors);
-        if (f->descriptors)
-                usb_free_descriptors(f->descriptors);
+        usb_free_all_descriptors(f);
 
         if (rndis->notify_req) {
                 kfree(rndis->notify_req->buf);
@@ -803,9 +778,9 @@ fail:
         /* we might as well release our claims on endpoints */
         if (rndis->notify)
                 rndis->notify->driver_data = NULL;
-        if (rndis->port.out_ep->desc)
+        if (rndis->port.out_ep)
                 rndis->port.out_ep->driver_data = NULL;
-        if (rndis->port.in_ep->desc)
+        if (rndis->port.in_ep)
                 rndis->port.in_ep->driver_data = NULL;
 
         ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
@@ -820,13 +795,9 @@ rndis_unbind(struct usb_configuration *c, struct usb_function *f)
 
         rndis_deregister(rndis->config);
         rndis_exit();
-        rndis_string_defs[0].id = 0;
 
-        if (gadget_is_superspeed(c->cdev->gadget))
-                usb_free_descriptors(f->ss_descriptors);
-        if (gadget_is_dualspeed(c->cdev->gadget))
-                usb_free_descriptors(f->hs_descriptors);
-        usb_free_descriptors(f->descriptors);
+        rndis_string_defs[0].id = 0;
+        usb_free_all_descriptors(f);
 
         kfree(rndis->notify_req->buf);
         usb_ep_free_request(rndis->notify, rndis->notify_req);
@@ -851,34 +822,19 @@ rndis_bind_config_vendor(struct usb_configuration *c, u8 ethaddr[ETH_ALEN],
         if (!can_support_rndis(c) || !ethaddr)
                 return -EINVAL;
 
-        /* maybe allocate device-global string IDs */
         if (rndis_string_defs[0].id == 0) {
-
                 /* ... and setup RNDIS itself */
                 status = rndis_init();
                 if (status < 0)
                         return status;
 
-                /* control interface label */
-                status = usb_string_id(c->cdev);
-                if (status < 0)
+                status = usb_string_ids_tab(c->cdev, rndis_string_defs);
+                if (status)
                         return status;
-                rndis_string_defs[0].id = status;
-                rndis_control_intf.iInterface = status;
 
-                /* data interface label */
-                status = usb_string_id(c->cdev);
-                if (status < 0)
-                        return status;
-                rndis_string_defs[1].id = status;
-                rndis_data_intf.iInterface = status;
-
-                /* IAD iFunction label */
-                status = usb_string_id(c->cdev);
-                if (status < 0)
-                        return status;
-                rndis_string_defs[2].id = status;
-                rndis_iad_descriptor.iFunction = status;
+                rndis_control_intf.iInterface = rndis_string_defs[0].id;
+                rndis_data_intf.iInterface = rndis_string_defs[1].id;
+                rndis_iad_descriptor.iFunction = rndis_string_defs[2].id;
         }
 
         /* allocate and initialize one new instance */
diff --git a/drivers/usb/gadget/f_serial.c b/drivers/usb/gadget/f_serial.c
index 07197d63d9b1..98fa7795df5f 100644
--- a/drivers/usb/gadget/f_serial.c
+++ b/drivers/usb/gadget/f_serial.c
@@ -213,34 +213,20 @@ gser_bind(struct usb_configuration *c, struct usb_function *f)
         gser->port.out = ep;
         ep->driver_data = cdev; /* claim */
 
-        /* copy descriptors, and track endpoint copies */
-        f->descriptors = usb_copy_descriptors(gser_fs_function);
-
         /* support all relevant hardware speeds... we expect that when
          * hardware is dual speed, all bulk-capable endpoints work at
          * both speeds
          */
-        if (gadget_is_dualspeed(c->cdev->gadget)) {
-                gser_hs_in_desc.bEndpointAddress =
-                                gser_fs_in_desc.bEndpointAddress;
-                gser_hs_out_desc.bEndpointAddress =
-                                gser_fs_out_desc.bEndpointAddress;
-
-                /* copy descriptors, and track endpoint copies */
-                f->hs_descriptors = usb_copy_descriptors(gser_hs_function);
-        }
-        if (gadget_is_superspeed(c->cdev->gadget)) {
-                gser_ss_in_desc.bEndpointAddress =
-                        gser_fs_in_desc.bEndpointAddress;
-                gser_ss_out_desc.bEndpointAddress =
-                        gser_fs_out_desc.bEndpointAddress;
-
-                /* copy descriptors, and track endpoint copies */
-                f->ss_descriptors = usb_copy_descriptors(gser_ss_function);
-                if (!f->ss_descriptors)
-                        goto fail;
-        }
+        gser_hs_in_desc.bEndpointAddress = gser_fs_in_desc.bEndpointAddress;
+        gser_hs_out_desc.bEndpointAddress = gser_fs_out_desc.bEndpointAddress;
 
+        gser_ss_in_desc.bEndpointAddress = gser_fs_in_desc.bEndpointAddress;
+        gser_ss_out_desc.bEndpointAddress = gser_fs_out_desc.bEndpointAddress;
+
+        status = usb_assign_descriptors(f, gser_fs_function, gser_hs_function,
+                        gser_ss_function);
+        if (status)
+                goto fail;
         DBG(cdev, "generic ttyGS%d: %s speed IN/%s OUT/%s\n",
                         gser->port_num,
                         gadget_is_superspeed(c->cdev->gadget) ? "super" :
@@ -263,11 +249,7 @@ fail:
 static void
 gser_unbind(struct usb_configuration *c, struct usb_function *f)
 {
-        if (gadget_is_dualspeed(c->cdev->gadget))
-                usb_free_descriptors(f->hs_descriptors);
-        if (gadget_is_superspeed(c->cdev->gadget))
-                usb_free_descriptors(f->ss_descriptors);
-        usb_free_descriptors(f->descriptors);
+        usb_free_all_descriptors(f);
         kfree(func_to_gser(f));
 }
 
diff --git a/drivers/usb/gadget/f_sourcesink.c b/drivers/usb/gadget/f_sourcesink.c
index 3c126fde6e7e..102d49beb9df 100644
--- a/drivers/usb/gadget/f_sourcesink.c
+++ b/drivers/usb/gadget/f_sourcesink.c
@@ -319,6 +319,7 @@ sourcesink_bind(struct usb_configuration *c, struct usb_function *f)
         struct usb_composite_dev *cdev = c->cdev;
         struct f_sourcesink     *ss = func_to_ss(f);
         int     id;
+        int ret;
 
         /* allocate interface ID(s) */
         id = usb_interface_id(c, f);
@@ -387,64 +388,57 @@ no_iso:
                 isoc_maxpacket = 1024;
 
         /* support high speed hardware */
-        if (gadget_is_dualspeed(c->cdev->gadget)) {
-                hs_source_desc.bEndpointAddress =
-                                fs_source_desc.bEndpointAddress;
-                hs_sink_desc.bEndpointAddress =
-                                fs_sink_desc.bEndpointAddress;
+        hs_source_desc.bEndpointAddress = fs_source_desc.bEndpointAddress;
+        hs_sink_desc.bEndpointAddress = fs_sink_desc.bEndpointAddress;
 
-                /*
-                 * Fill in the HS isoc descriptors from the module parameters.
-                 * We assume that the user knows what they are doing and won't
-                 * give parameters that their UDC doesn't support.
-                 */
-                hs_iso_source_desc.wMaxPacketSize = isoc_maxpacket;
-                hs_iso_source_desc.wMaxPacketSize |= isoc_mult << 11;
-                hs_iso_source_desc.bInterval = isoc_interval;
-                hs_iso_source_desc.bEndpointAddress =
-                                fs_iso_source_desc.bEndpointAddress;
-
-                hs_iso_sink_desc.wMaxPacketSize = isoc_maxpacket;
-                hs_iso_sink_desc.wMaxPacketSize |= isoc_mult << 11;
-                hs_iso_sink_desc.bInterval = isoc_interval;
-                hs_iso_sink_desc.bEndpointAddress =
-                                fs_iso_sink_desc.bEndpointAddress;
-
-                f->hs_descriptors = hs_source_sink_descs;
-        }
+        /*
+         * Fill in the HS isoc descriptors from the module parameters.
+         * We assume that the user knows what they are doing and won't
+         * give parameters that their UDC doesn't support.
+         */
+        hs_iso_source_desc.wMaxPacketSize = isoc_maxpacket;
+        hs_iso_source_desc.wMaxPacketSize |= isoc_mult << 11;
+        hs_iso_source_desc.bInterval = isoc_interval;
+        hs_iso_source_desc.bEndpointAddress =
+                fs_iso_source_desc.bEndpointAddress;
+
+        hs_iso_sink_desc.wMaxPacketSize = isoc_maxpacket;
+        hs_iso_sink_desc.wMaxPacketSize |= isoc_mult << 11;
+        hs_iso_sink_desc.bInterval = isoc_interval;
+        hs_iso_sink_desc.bEndpointAddress = fs_iso_sink_desc.bEndpointAddress;
 
         /* support super speed hardware */
-        if (gadget_is_superspeed(c->cdev->gadget)) {
-                ss_source_desc.bEndpointAddress =
-                                fs_source_desc.bEndpointAddress;
-                ss_sink_desc.bEndpointAddress =
-                                fs_sink_desc.bEndpointAddress;
+        ss_source_desc.bEndpointAddress =
+                fs_source_desc.bEndpointAddress;
+        ss_sink_desc.bEndpointAddress =
+                fs_sink_desc.bEndpointAddress;
 
-                /*
-                 * Fill in the SS isoc descriptors from the module parameters.
-                 * We assume that the user knows what they are doing and won't
-                 * give parameters that their UDC doesn't support.
-                 */
-                ss_iso_source_desc.wMaxPacketSize = isoc_maxpacket;
-                ss_iso_source_desc.bInterval = isoc_interval;
-                ss_iso_source_comp_desc.bmAttributes = isoc_mult;
-                ss_iso_source_comp_desc.bMaxBurst = isoc_maxburst;
-                ss_iso_source_comp_desc.wBytesPerInterval =
-                        isoc_maxpacket * (isoc_mult + 1) * (isoc_maxburst + 1);
-                ss_iso_source_desc.bEndpointAddress =
-                                fs_iso_source_desc.bEndpointAddress;
-
-                ss_iso_sink_desc.wMaxPacketSize = isoc_maxpacket;
-                ss_iso_sink_desc.bInterval = isoc_interval;
-                ss_iso_sink_comp_desc.bmAttributes = isoc_mult;
-                ss_iso_sink_comp_desc.bMaxBurst = isoc_maxburst;
-                ss_iso_sink_comp_desc.wBytesPerInterval =
-                        isoc_maxpacket * (isoc_mult + 1) * (isoc_maxburst + 1);
-                ss_iso_sink_desc.bEndpointAddress =
-                                fs_iso_sink_desc.bEndpointAddress;
-
-                f->ss_descriptors = ss_source_sink_descs;
-        }
+        /*
+         * Fill in the SS isoc descriptors from the module parameters.
+         * We assume that the user knows what they are doing and won't
+         * give parameters that their UDC doesn't support.
+         */
+        ss_iso_source_desc.wMaxPacketSize = isoc_maxpacket;
+        ss_iso_source_desc.bInterval = isoc_interval;
+        ss_iso_source_comp_desc.bmAttributes = isoc_mult;
+        ss_iso_source_comp_desc.bMaxBurst = isoc_maxburst;
+        ss_iso_source_comp_desc.wBytesPerInterval =
+                isoc_maxpacket * (isoc_mult + 1) * (isoc_maxburst + 1);
+        ss_iso_source_desc.bEndpointAddress =
+                fs_iso_source_desc.bEndpointAddress;
+
+        ss_iso_sink_desc.wMaxPacketSize = isoc_maxpacket;
+        ss_iso_sink_desc.bInterval = isoc_interval;
+        ss_iso_sink_comp_desc.bmAttributes = isoc_mult;
+        ss_iso_sink_comp_desc.bMaxBurst = isoc_maxburst;
+        ss_iso_sink_comp_desc.wBytesPerInterval =
+                isoc_maxpacket * (isoc_mult + 1) * (isoc_maxburst + 1);
+        ss_iso_sink_desc.bEndpointAddress = fs_iso_sink_desc.bEndpointAddress;
+
+        ret = usb_assign_descriptors(f, fs_source_sink_descs,
+                        hs_source_sink_descs, ss_source_sink_descs);
+        if (ret)
+                return ret;
 
         DBG(cdev, "%s speed %s: IN/%s, OUT/%s, ISO-IN/%s, ISO-OUT/%s\n",
             (gadget_is_superspeed(c->cdev->gadget) ? "super" :
@@ -458,6 +452,7 @@ no_iso:
 static void
 sourcesink_unbind(struct usb_configuration *c, struct usb_function *f)
 {
+        usb_free_all_descriptors(f);
         kfree(func_to_ss(f));
 }
 
@@ -773,7 +768,6 @@ static int __init sourcesink_bind_config(struct usb_configuration *c)
                 return -ENOMEM;
 
         ss->function.name = "source/sink";
-        ss->function.descriptors = fs_source_sink_descs;
         ss->function.bind = sourcesink_bind;
         ss->function.unbind = sourcesink_unbind;
         ss->function.set_alt = sourcesink_set_alt;
diff --git a/drivers/usb/gadget/f_subset.c b/drivers/usb/gadget/f_subset.c
index 4060c0bd9785..f172bd152fbb 100644
--- a/drivers/usb/gadget/f_subset.c
+++ b/drivers/usb/gadget/f_subset.c
@@ -236,7 +236,7 @@ static struct usb_descriptor_header *ss_eth_function[] = {
 
 static struct usb_string geth_string_defs[] = {
         [0].s = "CDC Ethernet Subset/SAFE",
-        [1].s = NULL /* DYNAMIC */,
+        [1].s = "",
         {  } /* end of list */
 };
 
@@ -319,38 +319,22 @@ geth_bind(struct usb_configuration *c, struct usb_function *f)
         geth->port.out_ep = ep;
         ep->driver_data = cdev; /* claim */
 
-        /* copy descriptors, and track endpoint copies */
-        f->descriptors = usb_copy_descriptors(fs_eth_function);
-        if (!f->descriptors)
-                goto fail;
-
         /* support all relevant hardware speeds... we expect that when
          * hardware is dual speed, all bulk-capable endpoints work at
          * both speeds
          */
-        if (gadget_is_dualspeed(c->cdev->gadget)) {
-                hs_subset_in_desc.bEndpointAddress =
-                                fs_subset_in_desc.bEndpointAddress;
-                hs_subset_out_desc.bEndpointAddress =
-                                fs_subset_out_desc.bEndpointAddress;
-
-                /* copy descriptors, and track endpoint copies */
-                f->hs_descriptors = usb_copy_descriptors(hs_eth_function);
-                if (!f->hs_descriptors)
-                        goto fail;
-        }
+        hs_subset_in_desc.bEndpointAddress = fs_subset_in_desc.bEndpointAddress;
+        hs_subset_out_desc.bEndpointAddress =
+                fs_subset_out_desc.bEndpointAddress;
 
-        if (gadget_is_superspeed(c->cdev->gadget)) {
-                ss_subset_in_desc.bEndpointAddress =
-                                fs_subset_in_desc.bEndpointAddress;
-                ss_subset_out_desc.bEndpointAddress =
-                                fs_subset_out_desc.bEndpointAddress;
+        ss_subset_in_desc.bEndpointAddress = fs_subset_in_desc.bEndpointAddress;
+        ss_subset_out_desc.bEndpointAddress =
+                fs_subset_out_desc.bEndpointAddress;
 
-                /* copy descriptors, and track endpoint copies */
-                f->ss_descriptors = usb_copy_descriptors(ss_eth_function);
-                if (!f->ss_descriptors)
-                        goto fail;
-        }
+        status = usb_assign_descriptors(f, fs_eth_function, hs_eth_function,
+                        ss_eth_function);
+        if (status)
+                goto fail;
 
         /* NOTE:  all that is done without knowing or caring about
          * the network link ... which is unavailable to this code
@@ -364,15 +348,11 @@ geth_bind(struct usb_configuration *c, struct usb_function *f)
         return 0;
 
 fail:
-        if (f->descriptors)
-                usb_free_descriptors(f->descriptors);
-        if (f->hs_descriptors)
-                usb_free_descriptors(f->hs_descriptors);
-
+        usb_free_all_descriptors(f);
         /* we might as well release our claims on endpoints */
-        if (geth->port.out_ep->desc)
+        if (geth->port.out_ep)
                 geth->port.out_ep->driver_data = NULL;
-        if (geth->port.in_ep->desc)
+        if (geth->port.in_ep)
                 geth->port.in_ep->driver_data = NULL;
 
         ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
@@ -383,12 +363,8 @@ fail:
 static void
 geth_unbind(struct usb_configuration *c, struct usb_function *f)
 {
-        if (gadget_is_superspeed(c->cdev->gadget))
-                usb_free_descriptors(f->ss_descriptors);
-        if (gadget_is_dualspeed(c->cdev->gadget))
-                usb_free_descriptors(f->hs_descriptors);
-        usb_free_descriptors(f->descriptors);
-        geth_string_defs[1].s = NULL;
+        geth_string_defs[0].id = 0;
+        usb_free_all_descriptors(f);
         kfree(func_to_geth(f));
 }
 
@@ -414,20 +390,11 @@ int geth_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN])
 
         /* maybe allocate device-global string IDs */
         if (geth_string_defs[0].id == 0) {
-
-                /* interface label */
-                status = usb_string_id(c->cdev);
+                status = usb_string_ids_tab(c->cdev, geth_string_defs);
                 if (status < 0)
                         return status;
-                geth_string_defs[0].id = status;
-                subset_data_intf.iInterface = status;
-
-                /* MAC address */
-                status = usb_string_id(c->cdev);
-                if (status < 0)
-                        return status;
-                geth_string_defs[1].id = status;
-                ether_desc.iMACAddress = status;
+                subset_data_intf.iInterface = geth_string_defs[0].id;
+                ether_desc.iMACAddress = geth_string_defs[1].id;
         }
 
         /* allocate and initialize one new instance */
@@ -449,9 +416,7 @@ int geth_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN])
         geth->port.func.disable = geth_disable;
 
         status = usb_add_function(c, &geth->port.func);
-        if (status) {
-                geth_string_defs[1].s = NULL;
+        if (status)
                 kfree(geth);
-        }
         return status;
 }
diff --git a/drivers/usb/gadget/f_uac1.c b/drivers/usb/gadget/f_uac1.c
index 1a5dcd5565e3..f570e667a640 100644
--- a/drivers/usb/gadget/f_uac1.c
+++ b/drivers/usb/gadget/f_uac1.c
@@ -630,7 +630,7 @@ f_audio_bind(struct usb_configuration *c, struct usb_function *f)
         struct usb_composite_dev *cdev = c->cdev;
         struct f_audio          *audio = func_to_audio(f);
         int                     status;
-        struct usb_ep           *ep;
+        struct usb_ep           *ep = NULL;
 
         f_audio_build_desc(audio);
 
@@ -659,22 +659,14 @@ f_audio_bind(struct usb_configuration *c, struct usb_function *f)
         status = -ENOMEM;
 
         /* copy descriptors, and track endpoint copies */
-        f->descriptors = usb_copy_descriptors(f_audio_desc);
-
-        /*
-         * support all relevant hardware speeds... we expect that when
-         * hardware is dual speed, all bulk-capable endpoints work at
-         * both speeds
-         */
-        if (gadget_is_dualspeed(c->cdev->gadget)) {
-                c->highspeed = true;
-                f->hs_descriptors = usb_copy_descriptors(f_audio_desc);
-        }
-
+        status = usb_assign_descriptors(f, f_audio_desc, f_audio_desc, NULL);
+        if (status)
+                goto fail;
         return 0;
 
 fail:
-
+        if (ep)
+                ep->driver_data = NULL;
         return status;
 }
 
@@ -683,8 +675,7 @@ f_audio_unbind(struct usb_configuration *c, struct usb_function *f)
 {
         struct f_audio          *audio = func_to_audio(f);
 
-        usb_free_descriptors(f->descriptors);
-        usb_free_descriptors(f->hs_descriptors);
+        usb_free_all_descriptors(f);
         kfree(audio);
 }
 
diff --git a/drivers/usb/gadget/f_uac2.c b/drivers/usb/gadget/f_uac2.c
index d3c6cffccb72..d7da258fa3f6 100644
--- a/drivers/usb/gadget/f_uac2.c
+++ b/drivers/usb/gadget/f_uac2.c
@@ -50,13 +50,6 @@ static int c_ssize = 2;
 module_param(c_ssize, uint, S_IRUGO);
 MODULE_PARM_DESC(c_ssize, "Capture Sample Size(bytes)");
 
-#define DMA_ADDR_INVALID        (~(dma_addr_t)0)
-
-#define ALT_SET(x, a)   do {(x) &= ~0xff; (x) |= (a); } while (0)
-#define ALT_GET(x)      ((x) & 0xff)
-#define INTF_SET(x, i)  do {(x) &= 0xff; (x) |= ((i) << 8); } while (0)
-#define INTF_GET(x)     ((x >> 8) & 0xff)
-
 /* Keep everyone on toes */
 #define USB_XFERS       2
 
@@ -144,8 +137,9 @@ static struct snd_pcm_hardware uac2_pcm_hardware = {
 };
 
 struct audio_dev {
-        /* Currently active {Interface[15:8] | AltSettings[7:0]} */
-        __u16 ac_alt, as_out_alt, as_in_alt;
+        u8 ac_intf, ac_alt;
+        u8 as_out_intf, as_out_alt;
+        u8 as_in_intf, as_in_alt;
 
         struct usb_ep *in_ep, *out_ep;
         struct usb_function func;
@@ -408,7 +402,7 @@ static struct snd_pcm_ops uac2_pcm_ops = {
         .prepare = uac2_pcm_null,
 };
 
-static int __devinit snd_uac2_probe(struct platform_device *pdev)
+static int snd_uac2_probe(struct platform_device *pdev)
 {
         struct snd_uac2_chip *uac2 = pdev_to_uac2(pdev);
         struct snd_card *card;
@@ -526,32 +520,22 @@ enum {
         STR_AS_IN_ALT1,
 };
 
-static const char ifassoc[] = "Source/Sink";
-static const char ifctrl[] = "Topology Control";
 static char clksrc_in[8];
 static char clksrc_out[8];
-static const char usb_it[] = "USBH Out";
-static const char io_it[] = "USBD Out";
-static const char usb_ot[] = "USBH In";
-static const char io_ot[] = "USBD In";
-static const char out_alt0[] = "Playback Inactive";
-static const char out_alt1[] = "Playback Active";
-static const char in_alt0[] = "Capture Inactive";
-static const char in_alt1[] = "Capture Active";
 
 static struct usb_string strings_fn[] = {
-        [STR_ASSOC].s = ifassoc,
-        [STR_IF_CTRL].s = ifctrl,
+        [STR_ASSOC].s = "Source/Sink",
+        [STR_IF_CTRL].s = "Topology Control",
         [STR_CLKSRC_IN].s = clksrc_in,
         [STR_CLKSRC_OUT].s = clksrc_out,
-        [STR_USB_IT].s = usb_it,
-        [STR_IO_IT].s = io_it,
-        [STR_USB_OT].s = usb_ot,
-        [STR_IO_OT].s = io_ot,
-        [STR_AS_OUT_ALT0].s = out_alt0,
-        [STR_AS_OUT_ALT1].s = out_alt1,
-        [STR_AS_IN_ALT0].s = in_alt0,
-        [STR_AS_IN_ALT1].s = in_alt1,
+        [STR_USB_IT].s = "USBH Out",
+        [STR_IO_IT].s = "USBD Out",
+        [STR_USB_OT].s = "USBH In",
+        [STR_IO_OT].s = "USBD In",
+        [STR_AS_OUT_ALT0].s = "Playback Inactive",
+        [STR_AS_OUT_ALT1].s = "Playback Active",
+        [STR_AS_IN_ALT0].s = "Capture Inactive",
+        [STR_AS_IN_ALT1].s = "Capture Active",
         { },
 };
 
@@ -952,8 +936,8 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
                 return ret;
         }
         std_ac_if_desc.bInterfaceNumber = ret;
-        ALT_SET(agdev->ac_alt, 0);
-        INTF_SET(agdev->ac_alt, ret);
+        agdev->ac_intf = ret;
+        agdev->ac_alt = 0;
 
         ret = usb_interface_id(cfg, fn);
         if (ret < 0) {
@@ -963,8 +947,8 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
         }
         std_as_out_if0_desc.bInterfaceNumber = ret;
         std_as_out_if1_desc.bInterfaceNumber = ret;
-        ALT_SET(agdev->as_out_alt, 0);
-        INTF_SET(agdev->as_out_alt, ret);
+        agdev->as_out_intf = ret;
+        agdev->as_out_alt = 0;
 
         ret = usb_interface_id(cfg, fn);
         if (ret < 0) {
@@ -974,19 +958,23 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
         }
         std_as_in_if0_desc.bInterfaceNumber = ret;
         std_as_in_if1_desc.bInterfaceNumber = ret;
-        ALT_SET(agdev->as_in_alt, 0);
-        INTF_SET(agdev->as_in_alt, ret);
+        agdev->as_in_intf = ret;
+        agdev->as_in_alt = 0;
 
         agdev->out_ep = usb_ep_autoconfig(gadget, &fs_epout_desc);
-        if (!agdev->out_ep)
+        if (!agdev->out_ep) {
                 dev_err(&uac2->pdev.dev,
                         "%s:%d Error!\n", __func__, __LINE__);
+                goto err;
+        }
         agdev->out_ep->driver_data = agdev;
 
         agdev->in_ep = usb_ep_autoconfig(gadget, &fs_epin_desc);
-        if (!agdev->in_ep)
+        if (!agdev->in_ep) {
                 dev_err(&uac2->pdev.dev,
                         "%s:%d Error!\n", __func__, __LINE__);
+                goto err;
+        }
         agdev->in_ep->driver_data = agdev;
 
         hs_epout_desc.bEndpointAddress = fs_epout_desc.bEndpointAddress;
@@ -994,9 +982,9 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
         hs_epin_desc.bEndpointAddress = fs_epin_desc.bEndpointAddress;
         hs_epin_desc.wMaxPacketSize = fs_epin_desc.wMaxPacketSize;
 
-        fn->descriptors = usb_copy_descriptors(fs_audio_desc);
-        if (gadget_is_dualspeed(gadget))
-                fn->hs_descriptors = usb_copy_descriptors(hs_audio_desc);
+        ret = usb_assign_descriptors(fn, fs_audio_desc, hs_audio_desc, NULL);
+        if (ret)
+                goto err;
 
         prm = &agdev->uac2.c_prm;
         prm->max_psize = hs_epout_desc.wMaxPacketSize;
@@ -1005,6 +993,7 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
                 prm->max_psize = 0;
                 dev_err(&uac2->pdev.dev,
                         "%s:%d Error!\n", __func__, __LINE__);
+                goto err;
         }
 
         prm = &agdev->uac2.p_prm;
@@ -1014,17 +1003,28 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
                 prm->max_psize = 0;
                 dev_err(&uac2->pdev.dev,
                         "%s:%d Error!\n", __func__, __LINE__);
+                goto err;
         }
 
-        return alsa_uac2_init(agdev);
+        ret = alsa_uac2_init(agdev);
+        if (ret)
+                goto err;
+        return 0;
+err:
+        kfree(agdev->uac2.p_prm.rbuf);
+        kfree(agdev->uac2.c_prm.rbuf);
+        usb_free_all_descriptors(fn);
+        if (agdev->in_ep)
+                agdev->in_ep->driver_data = NULL;
+        if (agdev->out_ep)
+                agdev->out_ep->driver_data = NULL;
+        return -EINVAL;
 }
 
 static void
 afunc_unbind(struct usb_configuration *cfg, struct usb_function *fn)
 {
         struct audio_dev *agdev = func_to_agdev(fn);
-        struct usb_composite_dev *cdev = cfg->cdev;
-        struct usb_gadget *gadget = cdev->gadget;
         struct uac2_rtd_params *prm;
 
         alsa_uac2_exit(agdev);
@@ -1034,10 +1034,7 @@ afunc_unbind(struct usb_configuration *cfg, struct usb_function *fn)
 
         prm = &agdev->uac2.c_prm;
         kfree(prm->rbuf);
-
-        if (gadget_is_dualspeed(gadget))
-                usb_free_descriptors(fn->hs_descriptors);
-        usb_free_descriptors(fn->descriptors);
+        usb_free_all_descriptors(fn);
 
         if (agdev->in_ep)
                 agdev->in_ep->driver_data = NULL;
@@ -1064,7 +1061,7 @@ afunc_set_alt(struct usb_function *fn, unsigned intf, unsigned alt)
                 return -EINVAL;
         }
 
-        if (intf == INTF_GET(agdev->ac_alt)) {
+        if (intf == agdev->ac_intf) {
                 /* Control I/f has only 1 AltSetting - 0 */
                 if (alt) {
                         dev_err(&uac2->pdev.dev,
@@ -1074,16 +1071,16 @@ afunc_set_alt(struct usb_function *fn, unsigned intf, unsigned alt)
                 return 0;
         }
 
-        if (intf == INTF_GET(agdev->as_out_alt)) {
+        if (intf == agdev->as_out_intf) {
                 ep = agdev->out_ep;
                 prm = &uac2->c_prm;
                 config_ep_by_speed(gadget, fn, ep);
-                ALT_SET(agdev->as_out_alt, alt);
-        } else if (intf == INTF_GET(agdev->as_in_alt)) {
+                agdev->as_out_alt = alt;
+        } else if (intf == agdev->as_in_intf) {
                 ep = agdev->in_ep;
                 prm = &uac2->p_prm;
                 config_ep_by_speed(gadget, fn, ep);
-                ALT_SET(agdev->as_in_alt, alt);
+                agdev->as_in_alt = alt;
         } else {
                 dev_err(&uac2->pdev.dev,
                         "%s:%d Error!\n", __func__, __LINE__);
@@ -1117,7 +1114,6 @@ afunc_set_alt(struct usb_function *fn, unsigned intf, unsigned alt)
                 prm->ureq[i].pp = prm;
 
                 req->zero = 0;
-                req->dma = DMA_ADDR_INVALID;
                 req->context = &prm->ureq[i];
                 req->length = prm->max_psize;
                 req->complete = agdev_iso_complete;
@@ -1136,12 +1132,12 @@ afunc_get_alt(struct usb_function *fn, unsigned intf)
         struct audio_dev *agdev = func_to_agdev(fn);
         struct snd_uac2_chip *uac2 = &agdev->uac2;
 
-        if (intf == INTF_GET(agdev->ac_alt))
-                return ALT_GET(agdev->ac_alt);
-        else if (intf == INTF_GET(agdev->as_out_alt))
-                return ALT_GET(agdev->as_out_alt);
-        else if (intf == INTF_GET(agdev->as_in_alt))
-                return ALT_GET(agdev->as_in_alt);
+        if (intf == agdev->ac_intf)
+                return agdev->ac_alt;
+        else if (intf == agdev->as_out_intf)
+                return agdev->as_out_alt;
+        else if (intf == agdev->as_in_intf)
+                return agdev->as_in_alt;
         else
                 dev_err(&uac2->pdev.dev,
                         "%s:%d Invalid Interface %d!\n",
@@ -1157,10 +1153,10 @@ afunc_disable(struct usb_function *fn)
         struct snd_uac2_chip *uac2 = &agdev->uac2;
 
         free_ep(&uac2->p_prm, agdev->in_ep);
-        ALT_SET(agdev->as_in_alt, 0);
+        agdev->as_in_alt = 0;
 
         free_ep(&uac2->c_prm, agdev->out_ep);
-        ALT_SET(agdev->as_out_alt, 0);
+        agdev->as_out_alt = 0;
 }
 
 static int
@@ -1267,7 +1263,7 @@ setup_rq_inf(struct usb_function *fn, const struct usb_ctrlrequest *cr)
         u16 w_index = le16_to_cpu(cr->wIndex);
         u8 intf = w_index & 0xff;
 
-        if (intf != INTF_GET(agdev->ac_alt)) {
+        if (intf != agdev->ac_intf) {
                 dev_err(&uac2->pdev.dev,
                         "%s:%d Error!\n", __func__, __LINE__);
                 return -EOPNOTSUPP;
@@ -1316,7 +1312,7 @@ afunc_setup(struct usb_function *fn, const struct usb_ctrlrequest *cr)
 
 static int audio_bind_config(struct usb_configuration *cfg)
 {
-        int id, res;
+        int res;
 
         agdev_g = kzalloc(sizeof *agdev_g, GFP_KERNEL);
         if (agdev_g == NULL) {
@@ -1324,89 +1320,21 @@ static int audio_bind_config(struct usb_configuration *cfg)
                 return -ENOMEM;
         }
 
-        id = usb_string_id(cfg->cdev);
-        if (id < 0)
-                return id;
-
-        strings_fn[STR_ASSOC].id = id;
-        iad_desc.iFunction = id,
-
-        id = usb_string_id(cfg->cdev);
-        if (id < 0)
-                return id;
-
-        strings_fn[STR_IF_CTRL].id = id;
-        std_ac_if_desc.iInterface = id,
-
-        id = usb_string_id(cfg->cdev);
-        if (id < 0)
-                return id;
-
-        strings_fn[STR_CLKSRC_IN].id = id;
-        in_clk_src_desc.iClockSource = id,
-
-        id = usb_string_id(cfg->cdev);
-        if (id < 0)
-                return id;
-
-        strings_fn[STR_CLKSRC_OUT].id = id;
-        out_clk_src_desc.iClockSource = id,
-
-        id = usb_string_id(cfg->cdev);
-        if (id < 0)
-                return id;
-
-        strings_fn[STR_USB_IT].id = id;
-        usb_out_it_desc.iTerminal = id,
-
-        id = usb_string_id(cfg->cdev);
-        if (id < 0)
-                return id;
-
-        strings_fn[STR_IO_IT].id = id;
-        io_in_it_desc.iTerminal = id;
-
-        id = usb_string_id(cfg->cdev);
-        if (id < 0)
-                return id;
-
-        strings_fn[STR_USB_OT].id = id;
-        usb_in_ot_desc.iTerminal = id;
-
-        id = usb_string_id(cfg->cdev);
-        if (id < 0)
-                return id;
-
-        strings_fn[STR_IO_OT].id = id;
-        io_out_ot_desc.iTerminal = id;
-
-        id = usb_string_id(cfg->cdev);
-        if (id < 0)
-                return id;
-
-        strings_fn[STR_AS_OUT_ALT0].id = id;
-        std_as_out_if0_desc.iInterface = id;
-
-        id = usb_string_id(cfg->cdev);
-        if (id < 0)
-                return id;
-
-        strings_fn[STR_AS_OUT_ALT1].id = id;
-        std_as_out_if1_desc.iInterface = id;
-
-        id = usb_string_id(cfg->cdev);
-        if (id < 0)
-                return id;
-
-        strings_fn[STR_AS_IN_ALT0].id = id;
-        std_as_in_if0_desc.iInterface = id;
-
-        id = usb_string_id(cfg->cdev);
-        if (id < 0)
-                return id;
-
-        strings_fn[STR_AS_IN_ALT1].id = id;
-        std_as_in_if1_desc.iInterface = id;
+        res = usb_string_ids_tab(cfg->cdev, strings_fn);
+        if (res)
+                return res;
+        iad_desc.iFunction = strings_fn[STR_ASSOC].id;
+        std_ac_if_desc.iInterface = strings_fn[STR_IF_CTRL].id;
+        in_clk_src_desc.iClockSource = strings_fn[STR_CLKSRC_IN].id;
+        out_clk_src_desc.iClockSource = strings_fn[STR_CLKSRC_OUT].id;
+        usb_out_it_desc.iTerminal = strings_fn[STR_USB_IT].id;
+        io_in_it_desc.iTerminal = strings_fn[STR_IO_IT].id;
+        usb_in_ot_desc.iTerminal = strings_fn[STR_USB_OT].id;
+        io_out_ot_desc.iTerminal = strings_fn[STR_IO_OT].id;
+        std_as_out_if0_desc.iInterface = strings_fn[STR_AS_OUT_ALT0].id;
+        std_as_out_if1_desc.iInterface = strings_fn[STR_AS_OUT_ALT1].id;
+        std_as_in_if0_desc.iInterface = strings_fn[STR_AS_IN_ALT0].id;
+        std_as_in_if1_desc.iInterface = strings_fn[STR_AS_IN_ALT1].id;
 
         agdev_g->func.name = "uac2_func";
         agdev_g->func.strings = fn_strings;
diff --git a/drivers/usb/gadget/f_uvc.c b/drivers/usb/gadget/f_uvc.c
index 2a8bf0655c60..5b629876941b 100644
--- a/drivers/usb/gadget/f_uvc.c
+++ b/drivers/usb/gadget/f_uvc.c
@@ -417,7 +417,6 @@ uvc_register_video(struct uvc_device *uvc)
                 return -ENOMEM;
 
         video->parent = &cdev->gadget->dev;
-        video->minor = -1;
         video->fops = &uvc_v4l2_fops;
         video->release = video_device_release;
         strncpy(video->name, cdev->gadget->name, sizeof(video->name));
@@ -577,27 +576,15 @@ uvc_function_unbind(struct usb_configuration *c, struct usb_function *f)
 
         INFO(cdev, "uvc_function_unbind\n");
 
-        if (uvc->vdev) {
-                if (uvc->vdev->minor == -1)
-                        video_device_release(uvc->vdev);
-                else
-                        video_unregister_device(uvc->vdev);
-                uvc->vdev = NULL;
-        }
+        video_unregister_device(uvc->vdev);
+        uvc->control_ep->driver_data = NULL;
+        uvc->video.ep->driver_data = NULL;
 
-        if (uvc->control_ep)
-                uvc->control_ep->driver_data = NULL;
-        if (uvc->video.ep)
-                uvc->video.ep->driver_data = NULL;
-
-        if (uvc->control_req) {
-                usb_ep_free_request(cdev->gadget->ep0, uvc->control_req);
-                kfree(uvc->control_buf);
-        }
+        uvc_en_us_strings[UVC_STRING_ASSOCIATION_IDX].id = 0;
+        usb_ep_free_request(cdev->gadget->ep0, uvc->control_req);
+        kfree(uvc->control_buf);
 
-        kfree(f->descriptors);
-        kfree(f->hs_descriptors);
-        kfree(f->ss_descriptors);
+        usb_free_all_descriptors(f);
 
         kfree(uvc);
 }
@@ -663,49 +650,40 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f)
         /* sanity check the streaming endpoint module parameters */
         if (streaming_maxpacket > 1024)
                 streaming_maxpacket = 1024;
+        /*
+         * Fill in the HS descriptors from the module parameters for the Video
+         * Streaming endpoint.
+         * NOTE: We assume that the user knows what they are doing and won't
+         * give parameters that their UDC doesn't support.
+         */
+        uvc_hs_streaming_ep.wMaxPacketSize = streaming_maxpacket;
+        uvc_hs_streaming_ep.wMaxPacketSize |= streaming_mult << 11;
+        uvc_hs_streaming_ep.bInterval = streaming_interval;
+        uvc_hs_streaming_ep.bEndpointAddress =
+                uvc_fs_streaming_ep.bEndpointAddress;
 
-        /* Copy descriptors for FS. */
-        f->descriptors = uvc_copy_descriptors(uvc, USB_SPEED_FULL);
-
-        /* support high speed hardware */
-        if (gadget_is_dualspeed(cdev->gadget)) {
-                /*
-                 * Fill in the HS descriptors from the module parameters for the
-                 * Video Streaming endpoint.
-                 * NOTE: We assume that the user knows what they are doing and
-                 * won't give parameters that their UDC doesn't support.
-                 */
-                uvc_hs_streaming_ep.wMaxPacketSize = streaming_maxpacket;
-                uvc_hs_streaming_ep.wMaxPacketSize |= streaming_mult << 11;
-                uvc_hs_streaming_ep.bInterval = streaming_interval;
-                uvc_hs_streaming_ep.bEndpointAddress =
-                                uvc_fs_streaming_ep.bEndpointAddress;
-
-                /* Copy descriptors. */
-                f->hs_descriptors = uvc_copy_descriptors(uvc, USB_SPEED_HIGH);
-        }
+        /*
+         * Fill in the SS descriptors from the module parameters for the Video
+         * Streaming endpoint.
+         * NOTE: We assume that the user knows what they are doing and won't
+         * give parameters that their UDC doesn't support.
+         */
+        uvc_ss_streaming_ep.wMaxPacketSize = streaming_maxpacket;
+        uvc_ss_streaming_ep.bInterval = streaming_interval;
+        uvc_ss_streaming_comp.bmAttributes = streaming_mult;
+        uvc_ss_streaming_comp.bMaxBurst = streaming_maxburst;
+        uvc_ss_streaming_comp.wBytesPerInterval =
+                streaming_maxpacket * (streaming_mult + 1) *
+                (streaming_maxburst + 1);
+        uvc_ss_streaming_ep.bEndpointAddress =
+                uvc_fs_streaming_ep.bEndpointAddress;
 
-        /* support super speed hardware */
-        if (gadget_is_superspeed(c->cdev->gadget)) {
-                /*
-                 * Fill in the SS descriptors from the module parameters for the
-                 * Video Streaming endpoint.
-                 * NOTE: We assume that the user knows what they are doing and
-                 * won't give parameters that their UDC doesn't support.
-                 */
-                uvc_ss_streaming_ep.wMaxPacketSize = streaming_maxpacket;
-                uvc_ss_streaming_ep.bInterval = streaming_interval;
-                uvc_ss_streaming_comp.bmAttributes = streaming_mult;
-                uvc_ss_streaming_comp.bMaxBurst = streaming_maxburst;
-                uvc_ss_streaming_comp.wBytesPerInterval =
-                        streaming_maxpacket * (streaming_mult + 1) *
-                        (streaming_maxburst + 1);
-                uvc_ss_streaming_ep.bEndpointAddress =
-                                uvc_fs_streaming_ep.bEndpointAddress;
-
-                /* Copy descriptors. */
+        /* Copy descriptors */
+        f->fs_descriptors = uvc_copy_descriptors(uvc, USB_SPEED_FULL);
+        if (gadget_is_dualspeed(cdev->gadget))
+                f->hs_descriptors = uvc_copy_descriptors(uvc, USB_SPEED_HIGH);
+        if (gadget_is_superspeed(c->cdev->gadget))
                 f->ss_descriptors = uvc_copy_descriptors(uvc, USB_SPEED_SUPER);
-        }
 
         /* Preallocate control endpoint request. */
         uvc->control_req = usb_ep_alloc_request(cdev->gadget->ep0, GFP_KERNEL);
@@ -740,7 +718,20 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f)
         return 0;
 
 error:
-        uvc_function_unbind(c, f);
+        if (uvc->vdev)
+                video_device_release(uvc->vdev);
+
+        if (uvc->control_ep)
+                uvc->control_ep->driver_data = NULL;
+        if (uvc->video.ep)
+                uvc->video.ep->driver_data = NULL;
+
+        if (uvc->control_req) {
+                usb_ep_free_request(cdev->gadget->ep0, uvc->control_req);
+                kfree(uvc->control_buf);
+        }
+
+        usb_free_all_descriptors(f);
         return ret;
 }
 
@@ -808,25 +799,16 @@ uvc_bind_config(struct usb_configuration *c,
         uvc->desc.hs_streaming = hs_streaming;
         uvc->desc.ss_streaming = ss_streaming;
 
-        /* maybe allocate device-global string IDs, and patch descriptors */
+        /* Allocate string descriptor numbers. */
         if (uvc_en_us_strings[UVC_STRING_ASSOCIATION_IDX].id == 0) {
-                /* Allocate string descriptor numbers. */
-                ret = usb_string_id(c->cdev);
-                if (ret < 0)
-                        goto error;
-                uvc_en_us_strings[UVC_STRING_ASSOCIATION_IDX].id = ret;
-                uvc_iad.iFunction = ret;
-
-                ret = usb_string_id(c->cdev);
-                if (ret < 0)
-                        goto error;
-                uvc_en_us_strings[UVC_STRING_CONTROL_IDX].id = ret;
-                uvc_control_intf.iInterface = ret;
-
-                ret = usb_string_id(c->cdev);
-                if (ret < 0)
+                ret = usb_string_ids_tab(c->cdev, uvc_en_us_strings);
+                if (ret)
                         goto error;
-                uvc_en_us_strings[UVC_STRING_STREAMING_IDX].id = ret;
+                uvc_iad.iFunction =
+                        uvc_en_us_strings[UVC_STRING_ASSOCIATION_IDX].id;
+                uvc_control_intf.iInterface =
+                        uvc_en_us_strings[UVC_STRING_CONTROL_IDX].id;
+                ret = uvc_en_us_strings[UVC_STRING_STREAMING_IDX].id;
                 uvc_streaming_intf_alt0.iInterface = ret;
                 uvc_streaming_intf_alt1.iInterface = ret;
         }
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
deleted file mode 100644
index 3f7d640b6758..000000000000
--- a/drivers/usb/gadget/file_storage.c
+++ /dev/null
@@ -1,3656 +0,0 @@
-/*
- * file_storage.c -- File-backed USB Storage Gadget, for USB development
- *
- * Copyright (C) 2003-2008 Alan Stern
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. The names of the above-listed copyright holders may not be used
- *    to endorse or promote products derived from this software without
- *    specific prior written permission.
- *
- * ALTERNATIVELY, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") as published by the Free Software
- * Foundation, either version 2 of that License or (at your option) any
- * later version.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
- * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-
-/*
- * The File-backed Storage Gadget acts as a USB Mass Storage device,
- * appearing to the host as a disk drive or as a CD-ROM drive.  In addition
- * to providing an example of a genuinely useful gadget driver for a USB
- * device, it also illustrates a technique of double-buffering for increased
- * throughput.  Last but not least, it gives an easy way to probe the
- * behavior of the Mass Storage drivers in a USB host.
- *
- * Backing storage is provided by a regular file or a block device, specified
- * by the "file" module parameter.  Access can be limited to read-only by
- * setting the optional "ro" module parameter.  (For CD-ROM emulation,
- * access is always read-only.)  The gadget will indicate that it has
- * removable media if the optional "removable" module parameter is set.
- *
- * The gadget supports the Control-Bulk (CB), Control-Bulk-Interrupt (CBI),
- * and Bulk-Only (also known as Bulk-Bulk-Bulk or BBB) transports, selected
- * by the optional "transport" module parameter.  It also supports the
- * following protocols: RBC (0x01), ATAPI or SFF-8020i (0x02), QIC-157 (0c03),
- * UFI (0x04), SFF-8070i (0x05), and transparent SCSI (0x06), selected by
- * the optional "protocol" module parameter.  In addition, the default
- * Vendor ID, Product ID, release number and serial number can be overridden.
- *
- * There is support for multiple logical units (LUNs), each of which has
- * its own backing file.  The number of LUNs can be set using the optional
- * "luns" module parameter (anywhere from 1 to 8), and the corresponding
- * files are specified using comma-separated lists for "file" and "ro".
- * The default number of LUNs is taken from the number of "file" elements;
- * it is 1 if "file" is not given.  If "removable" is not set then a backing
- * file must be specified for each LUN.  If it is set, then an unspecified
- * or empty backing filename means the LUN's medium is not loaded.  Ideally
- * each LUN would be settable independently as a disk drive or a CD-ROM
- * drive, but currently all LUNs have to be the same type.  The CD-ROM
- * emulation includes a single data track and no audio tracks; hence there
- * need be only one backing file per LUN.
- *
- * Requirements are modest; only a bulk-in and a bulk-out endpoint are
- * needed (an interrupt-out endpoint is also needed for CBI).  The memory
- * requirement amounts to two 16K buffers, size configurable by a parameter.
- * Support is included for both full-speed and high-speed operation.
- *
- * Note that the driver is slightly non-portable in that it assumes a
- * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
- * interrupt-in endpoints.  With most device controllers this isn't an
- * issue, but there may be some with hardware restrictions that prevent
- * a buffer from being used by more than one endpoint.
- *
- * Module options:
- *
- *      file=filename[,filename...]
- *                              Required if "removable" is not set, names of
- *                                      the files or block devices used for
- *                                      backing storage
- *      serial=HHHH...          Required serial number (string of hex chars)
- *      ro=b[,b...]             Default false, booleans for read-only access
- *      removable               Default false, boolean for removable media
- *      luns=N                  Default N = number of filenames, number of
- *                                      LUNs to support
- *      nofua=b[,b...]          Default false, booleans for ignore FUA flag
- *                                      in SCSI WRITE(10,12) commands
- *      stall                   Default determined according to the type of
- *                                      USB device controller (usually true),
- *                                      boolean to permit the driver to halt
- *                                      bulk endpoints
- *      cdrom                   Default false, boolean for whether to emulate
- *                                      a CD-ROM drive
- *      transport=XXX           Default BBB, transport name (CB, CBI, or BBB)
- *      protocol=YYY            Default SCSI, protocol name (RBC, 8020 or
- *                                      ATAPI, QIC, UFI, 8070, or SCSI;
- *                                      also 1 - 6)
- *      vendor=0xVVVV           Default 0x0525 (NetChip), USB Vendor ID
- *      product=0xPPPP          Default 0xa4a5 (FSG), USB Product ID
- *      release=0xRRRR          Override the USB release number (bcdDevice)
- *      buflen=N                Default N=16384, buffer size used (will be
- *                                      rounded down to a multiple of
- *                                      PAGE_CACHE_SIZE)
- *
- * If CONFIG_USB_FILE_STORAGE_TEST is not set, only the "file", "serial", "ro",
- * "removable", "luns", "nofua", "stall", and "cdrom" options are available;
- * default values are used for everything else.
- *
- * The pathnames of the backing files and the ro settings are available in
- * the attribute files "file", "nofua", and "ro" in the lun<n> subdirectory of
- * the gadget's sysfs directory.  If the "removable" option is set, writing to
- * these files will simulate ejecting/loading the medium (writing an empty
- * line means eject) and adjusting a write-enable tab.  Changes to the ro
- * setting are not allowed when the medium is loaded or if CD-ROM emulation
- * is being used.
- *
- * This gadget driver is heavily based on "Gadget Zero" by David Brownell.
- * The driver's SCSI command interface was based on the "Information
- * technology - Small Computer System Interface - 2" document from
- * X3T9.2 Project 375D, Revision 10L, 7-SEP-93, available at
- * <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>.  The single exception
- * is opcode 0x23 (READ FORMAT CAPACITIES), which was based on the
- * "Universal Serial Bus Mass Storage Class UFI Command Specification"
- * document, Revision 1.0, December 14, 1998, available at
- * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
- */
-
-
-/*
- *                              Driver Design
- *
- * The FSG driver is fairly straightforward.  There is a main kernel
- * thread that handles most of the work.  Interrupt routines field
- * callbacks from the controller driver: bulk- and interrupt-request
- * completion notifications, endpoint-0 events, and disconnect events.
- * Completion events are passed to the main thread by wakeup calls.  Many
- * ep0 requests are handled at interrupt time, but SetInterface,
- * SetConfiguration, and device reset requests are forwarded to the
- * thread in the form of "exceptions" using SIGUSR1 signals (since they
- * should interrupt any ongoing file I/O operations).
- *
- * The thread's main routine implements the standard command/data/status
- * parts of a SCSI interaction.  It and its subroutines are full of tests
- * for pending signals/exceptions -- all this polling is necessary since
- * the kernel has no setjmp/longjmp equivalents.  (Maybe this is an
- * indication that the driver really wants to be running in userspace.)
- * An important point is that so long as the thread is alive it keeps an
- * open reference to the backing file.  This will prevent unmounting
- * the backing file's underlying filesystem and could cause problems
- * during system shutdown, for example.  To prevent such problems, the
- * thread catches INT, TERM, and KILL signals and converts them into
- * an EXIT exception.
- *
- * In normal operation the main thread is started during the gadget's
- * fsg_bind() callback and stopped during fsg_unbind().  But it can also
- * exit when it receives a signal, and there's no point leaving the
- * gadget running when the thread is dead.  So just before the thread
- * exits, it deregisters the gadget driver.  This makes things a little
- * tricky: The driver is deregistered at two places, and the exiting
- * thread can indirectly call fsg_unbind() which in turn can tell the
- * thread to exit.  The first problem is resolved through the use of the
- * REGISTERED atomic bitflag; the driver will only be deregistered once.
- * The second problem is resolved by having fsg_unbind() check
- * fsg->state; it won't try to stop the thread if the state is already
- * FSG_STATE_TERMINATED.
- *
- * To provide maximum throughput, the driver uses a circular pipeline of
- * buffer heads (struct fsg_buffhd).  In principle the pipeline can be
- * arbitrarily long; in practice the benefits don't justify having more
- * than 2 stages (i.e., double buffering).  But it helps to think of the
- * pipeline as being a long one.  Each buffer head contains a bulk-in and
- * a bulk-out request pointer (since the buffer can be used for both
- * output and input -- directions always are given from the host's
- * point of view) as well as a pointer to the buffer and various state
- * variables.
- *
- * Use of the pipeline follows a simple protocol.  There is a variable
- * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
- * At any time that buffer head may still be in use from an earlier
- * request, so each buffer head has a state variable indicating whether
- * it is EMPTY, FULL, or BUSY.  Typical use involves waiting for the
- * buffer head to be EMPTY, filling the buffer either by file I/O or by
- * USB I/O (during which the buffer head is BUSY), and marking the buffer
- * head FULL when the I/O is complete.  Then the buffer will be emptied
- * (again possibly by USB I/O, during which it is marked BUSY) and
- * finally marked EMPTY again (possibly by a completion routine).
- *
- * A module parameter tells the driver to avoid stalling the bulk
- * endpoints wherever the transport specification allows.  This is
- * necessary for some UDCs like the SuperH, which cannot reliably clear a
- * halt on a bulk endpoint.  However, under certain circumstances the
- * Bulk-only specification requires a stall.  In such cases the driver
- * will halt the endpoint and set a flag indicating that it should clear
- * the halt in software during the next device reset.  Hopefully this
- * will permit everything to work correctly.  Furthermore, although the
- * specification allows the bulk-out endpoint to halt when the host sends
- * too much data, implementing this would cause an unavoidable race.
- * The driver will always use the "no-stall" approach for OUT transfers.
- *
- * One subtle point concerns sending status-stage responses for ep0
- * requests.  Some of these requests, such as device reset, can involve
- * interrupting an ongoing file I/O operation, which might take an
- * arbitrarily long time.  During that delay the host might give up on
- * the original ep0 request and issue a new one.  When that happens the
- * driver should not notify the host about completion of the original
- * request, as the host will no longer be waiting for it.  So the driver
- * assigns to each ep0 request a unique tag, and it keeps track of the
- * tag value of the request associated with a long-running exception
- * (device-reset, interface-change, or configuration-change).  When the
- * exception handler is finished, the status-stage response is submitted
- * only if the current ep0 request tag is equal to the exception request
- * tag.  Thus only the most recently received ep0 request will get a
- * status-stage response.
- *
- * Warning: This driver source file is too long.  It ought to be split up
- * into a header file plus about 3 separate .c files, to handle the details
- * of the Gadget, USB Mass Storage, and SCSI protocols.
- */
-
-
-/* #define VERBOSE_DEBUG */
-/* #define DUMP_MSGS */
-
-
-#include <linux/blkdev.h>
-#include <linux/completion.h>
-#include <linux/dcache.h>
-#include <linux/delay.h>
-#include <linux/device.h>
-#include <linux/fcntl.h>
-#include <linux/file.h>
-#include <linux/fs.h>
-#include <linux/kref.h>
-#include <linux/kthread.h>
-#include <linux/limits.h>
-#include <linux/module.h>
-#include <linux/rwsem.h>
-#include <linux/slab.h>
-#include <linux/spinlock.h>
-#include <linux/string.h>
-#include <linux/freezer.h>
-#include <linux/utsname.h>
-
-#include <linux/usb/composite.h>
-#include <linux/usb/ch9.h>
-#include <linux/usb/gadget.h>
-
-#include "gadget_chips.h"
-
-#define DRIVER_DESC             "File-backed Storage Gadget"
-#define DRIVER_NAME             "g_file_storage"
-#define DRIVER_VERSION          "1 September 2010"
-
-static       char fsg_string_manufacturer[64];
-static const char fsg_string_product[] = DRIVER_DESC;
-static const char fsg_string_config[] = "Self-powered";
-static const char fsg_string_interface[] = "Mass Storage";
-
-
-#include "storage_common.c"
-
-
-MODULE_DESCRIPTION(DRIVER_DESC);
-MODULE_AUTHOR("Alan Stern");
-MODULE_LICENSE("Dual BSD/GPL");
-
-/*
- * This driver assumes self-powered hardware and has no way for users to
- * trigger remote wakeup.  It uses autoconfiguration to select endpoints
- * and endpoint addresses.
- */
-
-
-/*-------------------------------------------------------------------------*/
-
-
-/* Encapsulate the module parameter settings */
-
-static struct {
-        char            *file[FSG_MAX_LUNS];
-        char            *serial;
-        bool            ro[FSG_MAX_LUNS];
-        bool            nofua[FSG_MAX_LUNS];
-        unsigned int    num_filenames;
-        unsigned int    num_ros;
-        unsigned int    num_nofuas;
-        unsigned int    nluns;
-
-        bool            removable;
-        bool            can_stall;
-        bool            cdrom;
-
-        char            *transport_parm;
-        char            *protocol_parm;
-        unsigned short  vendor;
-        unsigned short  product;
-        unsigned short  release;
-        unsigned int    buflen;
-
-        int             transport_type;
-        char            *transport_name;
-        int             protocol_type;
-        char            *protocol_name;
-
-} mod_data = {                                  // Default values
-        .transport_parm         = "BBB",
-        .protocol_parm          = "SCSI",
-        .removable              = 0,
-        .can_stall              = 1,
-        .cdrom                  = 0,
-        .vendor                 = FSG_VENDOR_ID,
-        .product                = FSG_PRODUCT_ID,
-        .release                = 0xffff,       // Use controller chip type
-        .buflen                 = 16384,
-        };
-
-
-module_param_array_named(file, mod_data.file, charp, &mod_data.num_filenames,
-                S_IRUGO);
-MODULE_PARM_DESC(file, "names of backing files or devices");
-
-module_param_named(serial, mod_data.serial, charp, S_IRUGO);
-MODULE_PARM_DESC(serial, "USB serial number");
-
-module_param_array_named(ro, mod_data.ro, bool, &mod_data.num_ros, S_IRUGO);
-MODULE_PARM_DESC(ro, "true to force read-only");
-
-module_param_array_named(nofua, mod_data.nofua, bool, &mod_data.num_nofuas,
-                S_IRUGO);
-MODULE_PARM_DESC(nofua, "true to ignore SCSI WRITE(10,12) FUA bit");
-
-module_param_named(luns, mod_data.nluns, uint, S_IRUGO);
-MODULE_PARM_DESC(luns, "number of LUNs");
-
-module_param_named(removable, mod_data.removable, bool, S_IRUGO);
-MODULE_PARM_DESC(removable, "true to simulate removable media");
-
-module_param_named(stall, mod_data.can_stall, bool, S_IRUGO);
-MODULE_PARM_DESC(stall, "false to prevent bulk stalls");
-
-module_param_named(cdrom, mod_data.cdrom, bool, S_IRUGO);
-MODULE_PARM_DESC(cdrom, "true to emulate cdrom instead of disk");
-
-/* In the non-TEST version, only the module parameters listed above
- * are available. */
-#ifdef CONFIG_USB_FILE_STORAGE_TEST
-
-module_param_named(transport, mod_data.transport_parm, charp, S_IRUGO);
-MODULE_PARM_DESC(transport, "type of transport (BBB, CBI, or CB)");
-
-module_param_named(protocol, mod_data.protocol_parm, charp, S_IRUGO);
-MODULE_PARM_DESC(protocol, "type of protocol (RBC, 8020, QIC, UFI, "
-                "8070, or SCSI)");
-
-module_param_named(vendor, mod_data.vendor, ushort, S_IRUGO);
-MODULE_PARM_DESC(vendor, "USB Vendor ID");
-
-module_param_named(product, mod_data.product, ushort, S_IRUGO);
-MODULE_PARM_DESC(product, "USB Product ID");
-
-module_param_named(release, mod_data.release, ushort, S_IRUGO);
-MODULE_PARM_DESC(release, "USB release number");
-
-module_param_named(buflen, mod_data.buflen, uint, S_IRUGO);
-MODULE_PARM_DESC(buflen, "I/O buffer size");
-
-#endif /* CONFIG_USB_FILE_STORAGE_TEST */
-
-
-/*
- * These definitions will permit the compiler to avoid generating code for
- * parts of the driver that aren't used in the non-TEST version.  Even gcc
- * can recognize when a test of a constant expression yields a dead code
- * path.
- */
-
-#ifdef CONFIG_USB_FILE_STORAGE_TEST
-
-#define transport_is_bbb()      (mod_data.transport_type == USB_PR_BULK)
-#define transport_is_cbi()      (mod_data.transport_type == USB_PR_CBI)
-#define protocol_is_scsi()      (mod_data.protocol_type == USB_SC_SCSI)
-
-#else
-
-#define transport_is_bbb()      1
-#define transport_is_cbi()      0
-#define protocol_is_scsi()      1
-
-#endif /* CONFIG_USB_FILE_STORAGE_TEST */
-
-
-/*-------------------------------------------------------------------------*/
-
-
-struct fsg_dev {
-        /* lock protects: state, all the req_busy's, and cbbuf_cmnd */
-        spinlock_t              lock;
-        struct usb_gadget       *gadget;
-
-        /* filesem protects: backing files in use */
-        struct rw_semaphore     filesem;
-
-        /* reference counting: wait until all LUNs are released */
-        struct kref             ref;
-
-        struct usb_ep           *ep0;           // Handy copy of gadget->ep0
-        struct usb_request      *ep0req;        // For control responses
-        unsigned int            ep0_req_tag;
-        const char              *ep0req_name;
-
-        struct usb_request      *intreq;        // For interrupt responses
-        int                     intreq_busy;
-        struct fsg_buffhd       *intr_buffhd;
-
-        unsigned int            bulk_out_maxpacket;
-        enum fsg_state          state;          // For exception handling
-        unsigned int            exception_req_tag;
-
-        u8                      config, new_config;
-
-        unsigned int            running : 1;
-        unsigned int            bulk_in_enabled : 1;
-        unsigned int            bulk_out_enabled : 1;
-        unsigned int            intr_in_enabled : 1;
-        unsigned int            phase_error : 1;
-        unsigned int            short_packet_received : 1;
-        unsigned int            bad_lun_okay : 1;
-
-        unsigned long           atomic_bitflags;
-#define REGISTERED              0
-#define IGNORE_BULK_OUT         1
-#define SUSPENDED               2
-
-        struct usb_ep           *bulk_in;
-        struct usb_ep           *bulk_out;
-        struct usb_ep           *intr_in;
-
-        struct fsg_buffhd       *next_buffhd_to_fill;
-        struct fsg_buffhd       *next_buffhd_to_drain;
-
-        int                     thread_wakeup_needed;
-        struct completion       thread_notifier;
-        struct task_struct      *thread_task;
-
-        int                     cmnd_size;
-        u8                      cmnd[MAX_COMMAND_SIZE];
-        enum data_direction     data_dir;
-        u32                     data_size;
-        u32                     data_size_from_cmnd;
-        u32                     tag;
-        unsigned int            lun;
-        u32                     residue;
-        u32                     usb_amount_left;
-
-        /* The CB protocol offers no way for a host to know when a command
-         * has completed.  As a result the next command may arrive early,
-         * and we will still have to handle it.  For that reason we need
-         * a buffer to store new commands when using CB (or CBI, which
-         * does not oblige a host to wait for command completion either). */
-        int                     cbbuf_cmnd_size;
-        u8                      cbbuf_cmnd[MAX_COMMAND_SIZE];
-
-        unsigned int            nluns;
-        struct fsg_lun          *luns;
-        struct fsg_lun          *curlun;
-        /* Must be the last entry */
-        struct fsg_buffhd       buffhds[];
-};
-
-typedef void (*fsg_routine_t)(struct fsg_dev *);
-
-static int exception_in_progress(struct fsg_dev *fsg)
-{
-        return (fsg->state > FSG_STATE_IDLE);
-}
-
-/* Make bulk-out requests be divisible by the maxpacket size */
-static void set_bulk_out_req_length(struct fsg_dev *fsg,
-                struct fsg_buffhd *bh, unsigned int length)
-{
-        unsigned int    rem;
-
-        bh->bulk_out_intended_length = length;
-        rem = length % fsg->bulk_out_maxpacket;
-        if (rem > 0)
-                length += fsg->bulk_out_maxpacket - rem;
-        bh->outreq->length = length;
-}
-
-static struct fsg_dev                   *the_fsg;
-static struct usb_gadget_driver         fsg_driver;
-
-
-/*-------------------------------------------------------------------------*/
-
-static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
-{
-        const char      *name;
-
-        if (ep == fsg->bulk_in)
-                name = "bulk-in";
-        else if (ep == fsg->bulk_out)
-                name = "bulk-out";
-        else
-                name = ep->name;
-        DBG(fsg, "%s set halt\n", name);
-        return usb_ep_set_halt(ep);
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-/*
- * DESCRIPTORS ... most are static, but strings and (full) configuration
- * descriptors are built on demand.  Also the (static) config and interface
- * descriptors are adjusted during fsg_bind().
- */
-
-/* There is only one configuration. */
-#define CONFIG_VALUE            1
-
-static struct usb_device_descriptor
-device_desc = {
-        .bLength =              sizeof device_desc,
-        .bDescriptorType =      USB_DT_DEVICE,
-
-        .bcdUSB =               cpu_to_le16(0x0200),
-        .bDeviceClass =         USB_CLASS_PER_INTERFACE,
-
-        /* The next three values can be overridden by module parameters */
-        .idVendor =             cpu_to_le16(FSG_VENDOR_ID),
-        .idProduct =            cpu_to_le16(FSG_PRODUCT_ID),
-        .bcdDevice =            cpu_to_le16(0xffff),
-
-        .iManufacturer =        FSG_STRING_MANUFACTURER,
-        .iProduct =             FSG_STRING_PRODUCT,
-        .iSerialNumber =        FSG_STRING_SERIAL,
-        .bNumConfigurations =   1,
-};
-
-static struct usb_config_descriptor
-config_desc = {
-        .bLength =              sizeof config_desc,
-        .bDescriptorType =      USB_DT_CONFIG,
-
-        /* wTotalLength computed by usb_gadget_config_buf() */
-        .bNumInterfaces =       1,
-        .bConfigurationValue =  CONFIG_VALUE,
-        .iConfiguration =       FSG_STRING_CONFIG,
-        .bmAttributes =         USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
-        .bMaxPower =            CONFIG_USB_GADGET_VBUS_DRAW / 2,
-};
-
-
-static struct usb_qualifier_descriptor
-dev_qualifier = {
-        .bLength =              sizeof dev_qualifier,
-        .bDescriptorType =      USB_DT_DEVICE_QUALIFIER,
-
-        .bcdUSB =               cpu_to_le16(0x0200),
-        .bDeviceClass =         USB_CLASS_PER_INTERFACE,
-
-        .bNumConfigurations =   1,
-};
-
-static int populate_bos(struct fsg_dev *fsg, u8 *buf)
-{
-        memcpy(buf, &fsg_bos_desc, USB_DT_BOS_SIZE);
-        buf += USB_DT_BOS_SIZE;
-
-        memcpy(buf, &fsg_ext_cap_desc, USB_DT_USB_EXT_CAP_SIZE);
-        buf += USB_DT_USB_EXT_CAP_SIZE;
-
-        memcpy(buf, &fsg_ss_cap_desc, USB_DT_USB_SS_CAP_SIZE);
-
-        return USB_DT_BOS_SIZE + USB_DT_USB_SS_CAP_SIZE
-                + USB_DT_USB_EXT_CAP_SIZE;
-}
-
-/*
- * Config descriptors must agree with the code that sets configurations
- * and with code managing interfaces and their altsettings.  They must
- * also handle different speeds and other-speed requests.
- */
-static int populate_config_buf(struct usb_gadget *gadget,
-                u8 *buf, u8 type, unsigned index)
-{
-        enum usb_device_speed                   speed = gadget->speed;
-        int                                     len;
-        const struct usb_descriptor_header      **function;
-
-        if (index > 0)
-                return -EINVAL;
-
-        if (gadget_is_dualspeed(gadget) && type == USB_DT_OTHER_SPEED_CONFIG)
-                speed = (USB_SPEED_FULL + USB_SPEED_HIGH) - speed;
-        function = gadget_is_dualspeed(gadget) && speed == USB_SPEED_HIGH
-                ? (const struct usb_descriptor_header **)fsg_hs_function
-                : (const struct usb_descriptor_header **)fsg_fs_function;
-
-        /* for now, don't advertise srp-only devices */
-        if (!gadget_is_otg(gadget))
-                function++;
-
-        len = usb_gadget_config_buf(&config_desc, buf, EP0_BUFSIZE, function);
-        ((struct usb_config_descriptor *) buf)->bDescriptorType = type;
-        return len;
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-/* These routines may be called in process context or in_irq */
-
-/* Caller must hold fsg->lock */
-static void wakeup_thread(struct fsg_dev *fsg)
-{
-        /* Tell the main thread that something has happened */
-        fsg->thread_wakeup_needed = 1;
-        if (fsg->thread_task)
-                wake_up_process(fsg->thread_task);
-}
-
-
-static void raise_exception(struct fsg_dev *fsg, enum fsg_state new_state)
-{
-        unsigned long           flags;
-
-        /* Do nothing if a higher-priority exception is already in progress.
-         * If a lower-or-equal priority exception is in progress, preempt it
-         * and notify the main thread by sending it a signal. */
-        spin_lock_irqsave(&fsg->lock, flags);
-        if (fsg->state <= new_state) {
-                fsg->exception_req_tag = fsg->ep0_req_tag;
-                fsg->state = new_state;
-                if (fsg->thread_task)
-                        send_sig_info(SIGUSR1, SEND_SIG_FORCED,
-                                        fsg->thread_task);
-        }
-        spin_unlock_irqrestore(&fsg->lock, flags);
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-/* The disconnect callback and ep0 routines.  These always run in_irq,
- * except that ep0_queue() is called in the main thread to acknowledge
- * completion of various requests: set config, set interface, and
- * Bulk-only device reset. */
-
-static void fsg_disconnect(struct usb_gadget *gadget)
-{
-        struct fsg_dev          *fsg = get_gadget_data(gadget);
-
-        DBG(fsg, "disconnect or port reset\n");
-        raise_exception(fsg, FSG_STATE_DISCONNECT);
-}
-
-
-static int ep0_queue(struct fsg_dev *fsg)
-{
-        int     rc;
-
-        rc = usb_ep_queue(fsg->ep0, fsg->ep0req, GFP_ATOMIC);
-        if (rc != 0 && rc != -ESHUTDOWN) {
-
-                /* We can't do much more than wait for a reset */
-                WARNING(fsg, "error in submission: %s --> %d\n",
-                                fsg->ep0->name, rc);
-        }
-        return rc;
-}
-
-static void ep0_complete(struct usb_ep *ep, struct usb_request *req)
-{
-        struct fsg_dev          *fsg = ep->driver_data;
-
-        if (req->actual > 0)
-                dump_msg(fsg, fsg->ep0req_name, req->buf, req->actual);
-        if (req->status || req->actual != req->length)
-                DBG(fsg, "%s --> %d, %u/%u\n", __func__,
-                                req->status, req->actual, req->length);
-        if (req->status == -ECONNRESET)         // Request was cancelled
-                usb_ep_fifo_flush(ep);
-
-        if (req->status == 0 && req->context)
-                ((fsg_routine_t) (req->context))(fsg);
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-/* Bulk and interrupt endpoint completion handlers.
- * These always run in_irq. */
-
-static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
-{
-        struct fsg_dev          *fsg = ep->driver_data;
-        struct fsg_buffhd       *bh = req->context;
-
-        if (req->status || req->actual != req->length)
-                DBG(fsg, "%s --> %d, %u/%u\n", __func__,
-                                req->status, req->actual, req->length);
-        if (req->status == -ECONNRESET)         // Request was cancelled
-                usb_ep_fifo_flush(ep);
-
-        /* Hold the lock while we update the request and buffer states */
-        smp_wmb();
-        spin_lock(&fsg->lock);
-        bh->inreq_busy = 0;
-        bh->state = BUF_STATE_EMPTY;
-        wakeup_thread(fsg);
-        spin_unlock(&fsg->lock);
-}
-
-static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
-{
-        struct fsg_dev          *fsg = ep->driver_data;
-        struct fsg_buffhd       *bh = req->context;
-
-        dump_msg(fsg, "bulk-out", req->buf, req->actual);
-        if (req->status || req->actual != bh->bulk_out_intended_length)
-                DBG(fsg, "%s --> %d, %u/%u\n", __func__,
-                                req->status, req->actual,
-                                bh->bulk_out_intended_length);
-        if (req->status == -ECONNRESET)         // Request was cancelled
-                usb_ep_fifo_flush(ep);
-
-        /* Hold the lock while we update the request and buffer states */
-        smp_wmb();
-        spin_lock(&fsg->lock);
-        bh->outreq_busy = 0;
-        bh->state = BUF_STATE_FULL;
-        wakeup_thread(fsg);
-        spin_unlock(&fsg->lock);
-}
-
-
-#ifdef CONFIG_USB_FILE_STORAGE_TEST
-static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
-{
-        struct fsg_dev          *fsg = ep->driver_data;
-        struct fsg_buffhd       *bh = req->context;
-
-        if (req->status || req->actual != req->length)
-                DBG(fsg, "%s --> %d, %u/%u\n", __func__,
-                                req->status, req->actual, req->length);
-        if (req->status == -ECONNRESET)         // Request was cancelled
-                usb_ep_fifo_flush(ep);
-
-        /* Hold the lock while we update the request and buffer states */
-        smp_wmb();
-        spin_lock(&fsg->lock);
-        fsg->intreq_busy = 0;
-        bh->state = BUF_STATE_EMPTY;
-        wakeup_thread(fsg);
-        spin_unlock(&fsg->lock);
-}
-
-#else
-static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
-{}
-#endif /* CONFIG_USB_FILE_STORAGE_TEST */
-
-
-/*-------------------------------------------------------------------------*/
-
-/* Ep0 class-specific handlers.  These always run in_irq. */
-
-#ifdef CONFIG_USB_FILE_STORAGE_TEST
-static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
-{
-        struct usb_request      *req = fsg->ep0req;
-        static u8               cbi_reset_cmnd[6] = {
-                        SEND_DIAGNOSTIC, 4, 0xff, 0xff, 0xff, 0xff};
-
-        /* Error in command transfer? */
-        if (req->status || req->length != req->actual ||
-                        req->actual < 6 || req->actual > MAX_COMMAND_SIZE) {
-
-                /* Not all controllers allow a protocol stall after
-                 * receiving control-out data, but we'll try anyway. */
-                fsg_set_halt(fsg, fsg->ep0);
-                return;                 // Wait for reset
-        }
-
-        /* Is it the special reset command? */
-        if (req->actual >= sizeof cbi_reset_cmnd &&
-                        memcmp(req->buf, cbi_reset_cmnd,
-                                sizeof cbi_reset_cmnd) == 0) {
-
-                /* Raise an exception to stop the current operation
-                 * and reinitialize our state. */
-                DBG(fsg, "cbi reset request\n");
-                raise_exception(fsg, FSG_STATE_RESET);
-                return;
-        }
-
-        VDBG(fsg, "CB[I] accept device-specific command\n");
-        spin_lock(&fsg->lock);
-
-        /* Save the command for later */
-        if (fsg->cbbuf_cmnd_size)
-                WARNING(fsg, "CB[I] overwriting previous command\n");
-        fsg->cbbuf_cmnd_size = req->actual;
-        memcpy(fsg->cbbuf_cmnd, req->buf, fsg->cbbuf_cmnd_size);
-
-        wakeup_thread(fsg);
-        spin_unlock(&fsg->lock);
-}
-
-#else
-static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
-{}
-#endif /* CONFIG_USB_FILE_STORAGE_TEST */
-
-
-static int class_setup_req(struct fsg_dev *fsg,
-                const struct usb_ctrlrequest *ctrl)
-{
-        struct usb_request      *req = fsg->ep0req;
-        int                     value = -EOPNOTSUPP;
-        u16                     w_index = le16_to_cpu(ctrl->wIndex);
-        u16                     w_value = le16_to_cpu(ctrl->wValue);
-        u16                     w_length = le16_to_cpu(ctrl->wLength);
-
-        if (!fsg->config)
-                return value;
-
-        /* Handle Bulk-only class-specific requests */
-        if (transport_is_bbb()) {
-                switch (ctrl->bRequest) {
-
-                case US_BULK_RESET_REQUEST:
-                        if (ctrl->bRequestType != (USB_DIR_OUT |
-                                        USB_TYPE_CLASS | USB_RECIP_INTERFACE))
-                                break;
-                        if (w_index != 0 || w_value != 0 || w_length != 0) {
-                                value = -EDOM;
-                                break;
-                        }
-
-                        /* Raise an exception to stop the current operation
-                         * and reinitialize our state. */
-                        DBG(fsg, "bulk reset request\n");
-                        raise_exception(fsg, FSG_STATE_RESET);
-                        value = DELAYED_STATUS;
-                        break;
-
-                case US_BULK_GET_MAX_LUN:
-                        if (ctrl->bRequestType != (USB_DIR_IN |
-                                        USB_TYPE_CLASS | USB_RECIP_INTERFACE))
-                                break;
-                        if (w_index != 0 || w_value != 0 || w_length != 1) {
-                                value = -EDOM;
-                                break;
-                        }
-                        VDBG(fsg, "get max LUN\n");
-                        *(u8 *) req->buf = fsg->nluns - 1;
-                        value = 1;
-                        break;
-                }
-        }
-
-        /* Handle CBI class-specific requests */
-        else {
-                switch (ctrl->bRequest) {
-
-                case USB_CBI_ADSC_REQUEST:
-                        if (ctrl->bRequestType != (USB_DIR_OUT |
-                                        USB_TYPE_CLASS | USB_RECIP_INTERFACE))
-                                break;
-                        if (w_index != 0 || w_value != 0) {
-                                value = -EDOM;
-                                break;
-                        }
-                        if (w_length > MAX_COMMAND_SIZE) {
-                                value = -EOVERFLOW;
-                                break;
-                        }
-                        value = w_length;
-                        fsg->ep0req->context = received_cbi_adsc;
-                        break;
-                }
-        }
-
-        if (value == -EOPNOTSUPP)
-                VDBG(fsg,
-                        "unknown class-specific control req "
-                        "%02x.%02x v%04x i%04x l%u\n",
-                        ctrl->bRequestType, ctrl->bRequest,
-                        le16_to_cpu(ctrl->wValue), w_index, w_length);
-        return value;
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-/* Ep0 standard request handlers.  These always run in_irq. */
-
-static int standard_setup_req(struct fsg_dev *fsg,
-                const struct usb_ctrlrequest *ctrl)
-{
-        struct usb_request      *req = fsg->ep0req;
-        int                     value = -EOPNOTSUPP;
-        u16                     w_index = le16_to_cpu(ctrl->wIndex);
-        u16                     w_value = le16_to_cpu(ctrl->wValue);
-
-        /* Usually this just stores reply data in the pre-allocated ep0 buffer,
-         * but config change events will also reconfigure hardware. */
-        switch (ctrl->bRequest) {
-
-        case USB_REQ_GET_DESCRIPTOR:
-                if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
-                                USB_RECIP_DEVICE))
-                        break;
-                switch (w_value >> 8) {
-
-                case USB_DT_DEVICE:
-                        VDBG(fsg, "get device descriptor\n");
-                        device_desc.bMaxPacketSize0 = fsg->ep0->maxpacket;
-                        value = sizeof device_desc;
-                        memcpy(req->buf, &device_desc, value);
-                        break;
-                case USB_DT_DEVICE_QUALIFIER:
-                        VDBG(fsg, "get device qualifier\n");
-                        if (!gadget_is_dualspeed(fsg->gadget) ||
-                                        fsg->gadget->speed == USB_SPEED_SUPER)
-                                break;
-                        /*
-                         * Assume ep0 uses the same maxpacket value for both
-                         * speeds
-                         */
-                        dev_qualifier.bMaxPacketSize0 = fsg->ep0->maxpacket;
-                        value = sizeof dev_qualifier;
-                        memcpy(req->buf, &dev_qualifier, value);
-                        break;
-
-                case USB_DT_OTHER_SPEED_CONFIG:
-                        VDBG(fsg, "get other-speed config descriptor\n");
-                        if (!gadget_is_dualspeed(fsg->gadget) ||
-                                        fsg->gadget->speed == USB_SPEED_SUPER)
-                                break;
-                        goto get_config;
-                case USB_DT_CONFIG:
-                        VDBG(fsg, "get configuration descriptor\n");
-get_config:
-                        value = populate_config_buf(fsg->gadget,
-                                        req->buf,
-                                        w_value >> 8,
-                                        w_value & 0xff);
-                        break;
-
-                case USB_DT_STRING:
-                        VDBG(fsg, "get string descriptor\n");
-
-                        /* wIndex == language code */
-                        value = usb_gadget_get_string(&fsg_stringtab,
-                                        w_value & 0xff, req->buf);
-                        break;
-
-                case USB_DT_BOS:
-                        VDBG(fsg, "get bos descriptor\n");
-
-                        if (gadget_is_superspeed(fsg->gadget))
-                                value = populate_bos(fsg, req->buf);
-                        break;
-                }
-
-                break;
-
-        /* One config, two speeds */
-        case USB_REQ_SET_CONFIGURATION:
-                if (ctrl->bRequestType != (USB_DIR_OUT | USB_TYPE_STANDARD |
-                                USB_RECIP_DEVICE))
-                        break;
-                VDBG(fsg, "set configuration\n");
-                if (w_value == CONFIG_VALUE || w_value == 0) {
-                        fsg->new_config = w_value;
-
-                        /* Raise an exception to wipe out previous transaction
-                         * state (queued bufs, etc) and set the new config. */
-                        raise_exception(fsg, FSG_STATE_CONFIG_CHANGE);
-                        value = DELAYED_STATUS;
-                }
-                break;
-        case USB_REQ_GET_CONFIGURATION:
-                if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
-                                USB_RECIP_DEVICE))
-                        break;
-                VDBG(fsg, "get configuration\n");
-                *(u8 *) req->buf = fsg->config;
-                value = 1;
-                break;
-
-        case USB_REQ_SET_INTERFACE:
-                if (ctrl->bRequestType != (USB_DIR_OUT| USB_TYPE_STANDARD |
-                                USB_RECIP_INTERFACE))
-                        break;
-                if (fsg->config && w_index == 0) {
-
-                        /* Raise an exception to wipe out previous transaction
-                         * state (queued bufs, etc) and install the new
-                         * interface altsetting. */
-                        raise_exception(fsg, FSG_STATE_INTERFACE_CHANGE);
-                        value = DELAYED_STATUS;
-                }
-                break;
-        case USB_REQ_GET_INTERFACE:
-                if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
-                                USB_RECIP_INTERFACE))
-                        break;
-                if (!fsg->config)
-                        break;
-                if (w_index != 0) {
-                        value = -EDOM;
-                        break;
-                }
-                VDBG(fsg, "get interface\n");
-                *(u8 *) req->buf = 0;
-                value = 1;
-                break;
-
-        default:
-                VDBG(fsg,
-                        "unknown control req %02x.%02x v%04x i%04x l%u\n",
-                        ctrl->bRequestType, ctrl->bRequest,
-                        w_value, w_index, le16_to_cpu(ctrl->wLength));
-        }
-
-        return value;
-}
-
-
-static int fsg_setup(struct usb_gadget *gadget,
-                const struct usb_ctrlrequest *ctrl)
-{
-        struct fsg_dev          *fsg = get_gadget_data(gadget);
-        int                     rc;
-        int                     w_length = le16_to_cpu(ctrl->wLength);
-
-        ++fsg->ep0_req_tag;             // Record arrival of a new request
-        fsg->ep0req->context = NULL;
-        fsg->ep0req->length = 0;
-        dump_msg(fsg, "ep0-setup", (u8 *) ctrl, sizeof(*ctrl));
-
-        if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS)
-                rc = class_setup_req(fsg, ctrl);
-        else
-                rc = standard_setup_req(fsg, ctrl);
-
-        /* Respond with data/status or defer until later? */
-        if (rc >= 0 && rc != DELAYED_STATUS) {
-                rc = min(rc, w_length);
-                fsg->ep0req->length = rc;
-                fsg->ep0req->zero = rc < w_length;
-                fsg->ep0req_name = (ctrl->bRequestType & USB_DIR_IN ?
-                                "ep0-in" : "ep0-out");
-                rc = ep0_queue(fsg);
-        }
-
-        /* Device either stalls (rc < 0) or reports success */
-        return rc;
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-/* All the following routines run in process context */
-
-
-/* Use this for bulk or interrupt transfers, not ep0 */
-static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
-                struct usb_request *req, int *pbusy,
-                enum fsg_buffer_state *state)
-{
-        int     rc;
-
-        if (ep == fsg->bulk_in)
-                dump_msg(fsg, "bulk-in", req->buf, req->length);
-        else if (ep == fsg->intr_in)
-                dump_msg(fsg, "intr-in", req->buf, req->length);
-
-        spin_lock_irq(&fsg->lock);
-        *pbusy = 1;
-        *state = BUF_STATE_BUSY;
-        spin_unlock_irq(&fsg->lock);
-        rc = usb_ep_queue(ep, req, GFP_KERNEL);
-        if (rc != 0) {
-                *pbusy = 0;
-                *state = BUF_STATE_EMPTY;
-
-                /* We can't do much more than wait for a reset */
-
-                /* Note: currently the net2280 driver fails zero-length
-                 * submissions if DMA is enabled. */
-                if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
-                                                req->length == 0))
-                        WARNING(fsg, "error in submission: %s --> %d\n",
-                                        ep->name, rc);
-        }
-}
-
-
-static int sleep_thread(struct fsg_dev *fsg)
-{
-        int     rc = 0;
-
-        /* Wait until a signal arrives or we are woken up */
-        for (;;) {
-                try_to_freeze();
-                set_current_state(TASK_INTERRUPTIBLE);
-                if (signal_pending(current)) {
-                        rc = -EINTR;
-                        break;
-                }
-                if (fsg->thread_wakeup_needed)
-                        break;
-                schedule();
-        }
-        __set_current_state(TASK_RUNNING);
-        fsg->thread_wakeup_needed = 0;
-        return rc;
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-static int do_read(struct fsg_dev *fsg)
-{
-        struct fsg_lun          *curlun = fsg->curlun;
-        u32                     lba;
-        struct fsg_buffhd       *bh;
-        int                     rc;
-        u32                     amount_left;
-        loff_t                  file_offset, file_offset_tmp;
-        unsigned int            amount;
-        ssize_t                 nread;
-
-        /* Get the starting Logical Block Address and check that it's
-         * not too big */
-        if (fsg->cmnd[0] == READ_6)
-                lba = get_unaligned_be24(&fsg->cmnd[1]);
-        else {
-                lba = get_unaligned_be32(&fsg->cmnd[2]);
-
-                /* We allow DPO (Disable Page Out = don't save data in the
-                 * cache) and FUA (Force Unit Access = don't read from the
-                 * cache), but we don't implement them. */
-                if ((fsg->cmnd[1] & ~0x18) != 0) {
-                        curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
-                        return -EINVAL;
-                }
-        }
-        if (lba >= curlun->num_sectors) {
-                curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
-                return -EINVAL;
-        }
-        file_offset = ((loff_t) lba) << curlun->blkbits;
-
-        /* Carry out the file reads */
-        amount_left = fsg->data_size_from_cmnd;
-        if (unlikely(amount_left == 0))
-                return -EIO;            // No default reply
-
-        for (;;) {
-
-                /* Figure out how much we need to read:
-                 * Try to read the remaining amount.
-                 * But don't read more than the buffer size.
-                 * And don't try to read past the end of the file.
-                 */
-                amount = min((unsigned int) amount_left, mod_data.buflen);
-                amount = min((loff_t) amount,
-                                curlun->file_length - file_offset);
-
-                /* Wait for the next buffer to become available */
-                bh = fsg->next_buffhd_to_fill;
-                while (bh->state != BUF_STATE_EMPTY) {
-                        rc = sleep_thread(fsg);
-                        if (rc)
-                                return rc;
-                }
-
-                /* If we were asked to read past the end of file,
-                 * end with an empty buffer. */
-                if (amount == 0) {
-                        curlun->sense_data =
-                                        SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
-                        curlun->sense_data_info = file_offset >> curlun->blkbits;
-                        curlun->info_valid = 1;
-                        bh->inreq->length = 0;
-                        bh->state = BUF_STATE_FULL;
-                        break;
-                }
-
-                /* Perform the read */
-                file_offset_tmp = file_offset;
-                nread = vfs_read(curlun->filp,
-                                (char __user *) bh->buf,
-                                amount, &file_offset_tmp);
-                VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
-                                (unsigned long long) file_offset,
-                                (int) nread);
-                if (signal_pending(current))
-                        return -EINTR;
-
-                if (nread < 0) {
-                        LDBG(curlun, "error in file read: %d\n",
-                                        (int) nread);
-                        nread = 0;
-                } else if (nread < amount) {
-                        LDBG(curlun, "partial file read: %d/%u\n",
-                                        (int) nread, amount);
-                        nread = round_down(nread, curlun->blksize);
-                }
-                file_offset  += nread;
-                amount_left  -= nread;
-                fsg->residue -= nread;
-
-                /* Except at the end of the transfer, nread will be
-                 * equal to the buffer size, which is divisible by the
-                 * bulk-in maxpacket size.
-                 */
-                bh->inreq->length = nread;
-                bh->state = BUF_STATE_FULL;
-
-                /* If an error occurred, report it and its position */
-                if (nread < amount) {
-                        curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
-                        curlun->sense_data_info = file_offset >> curlun->blkbits;
-                        curlun->info_valid = 1;
-                        break;
-                }
-
-                if (amount_left == 0)
-                        break;          // No more left to read
-
-                /* Send this buffer and go read some more */
-                bh->inreq->zero = 0;
-                start_transfer(fsg, fsg->bulk_in, bh->inreq,
-                                &bh->inreq_busy, &bh->state);
-                fsg->next_buffhd_to_fill = bh->next;
-        }
-
-        return -EIO;            // No default reply
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-static int do_write(struct fsg_dev *fsg)
-{
-        struct fsg_lun          *curlun = fsg->curlun;
-        u32                     lba;
-        struct fsg_buffhd       *bh;
-        int                     get_some_more;
-        u32                     amount_left_to_req, amount_left_to_write;
-        loff_t                  usb_offset, file_offset, file_offset_tmp;
-        unsigned int            amount;
-        ssize_t                 nwritten;
-        int                     rc;
-
-        if (curlun->ro) {
-                curlun->sense_data = SS_WRITE_PROTECTED;
-                return -EINVAL;
-        }
-        spin_lock(&curlun->filp->f_lock);
-        curlun->filp->f_flags &= ~O_SYNC;       // Default is not to wait
-        spin_unlock(&curlun->filp->f_lock);
-
-        /* Get the starting Logical Block Address and check that it's
-         * not too big */
-        if (fsg->cmnd[0] == WRITE_6)
-                lba = get_unaligned_be24(&fsg->cmnd[1]);
-        else {
-                lba = get_unaligned_be32(&fsg->cmnd[2]);
-
-                /* We allow DPO (Disable Page Out = don't save data in the
-                 * cache) and FUA (Force Unit Access = write directly to the
-                 * medium).  We don't implement DPO; we implement FUA by
-                 * performing synchronous output. */
-                if ((fsg->cmnd[1] & ~0x18) != 0) {
-                        curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
-                        return -EINVAL;
-                }
-                /* FUA */
-                if (!curlun->nofua && (fsg->cmnd[1] & 0x08)) {
-                        spin_lock(&curlun->filp->f_lock);
-                        curlun->filp->f_flags |= O_DSYNC;
-                        spin_unlock(&curlun->filp->f_lock);
-                }
-        }
-        if (lba >= curlun->num_sectors) {
-                curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
-                return -EINVAL;
-        }
-
-        /* Carry out the file writes */
-        get_some_more = 1;
-        file_offset = usb_offset = ((loff_t) lba) << curlun->blkbits;
-        amount_left_to_req = amount_left_to_write = fsg->data_size_from_cmnd;
-
-        while (amount_left_to_write > 0) {
-
-                /* Queue a request for more data from the host */
-                bh = fsg->next_buffhd_to_fill;
-                if (bh->state == BUF_STATE_EMPTY && get_some_more) {
-
-                        /* Figure out how much we want to get:
-                         * Try to get the remaining amount,
-                         * but not more than the buffer size.
-                         */
-                        amount = min(amount_left_to_req, mod_data.buflen);
-
-                        /* Beyond the end of the backing file? */
-                        if (usb_offset >= curlun->file_length) {
-                                get_some_more = 0;
-                                curlun->sense_data =
-                                        SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
-                                curlun->sense_data_info = usb_offset >> curlun->blkbits;
-                                curlun->info_valid = 1;
-                                continue;
-                        }
-
-                        /* Get the next buffer */
-                        usb_offset += amount;
-                        fsg->usb_amount_left -= amount;
-                        amount_left_to_req -= amount;
-                        if (amount_left_to_req == 0)
-                                get_some_more = 0;
-
-                        /* Except at the end of the transfer, amount will be
-                         * equal to the buffer size, which is divisible by
-                         * the bulk-out maxpacket size.
-                         */
-                        set_bulk_out_req_length(fsg, bh, amount);
-                        start_transfer(fsg, fsg->bulk_out, bh->outreq,
-                                        &bh->outreq_busy, &bh->state);
-                        fsg->next_buffhd_to_fill = bh->next;
-                        continue;
-                }
-
-                /* Write the received data to the backing file */
-                bh = fsg->next_buffhd_to_drain;
-                if (bh->state == BUF_STATE_EMPTY && !get_some_more)
-                        break;                  // We stopped early
-                if (bh->state == BUF_STATE_FULL) {
-                        smp_rmb();
-                        fsg->next_buffhd_to_drain = bh->next;
-                        bh->state = BUF_STATE_EMPTY;
-
-                        /* Did something go wrong with the transfer? */
-                        if (bh->outreq->status != 0) {
-                                curlun->sense_data = SS_COMMUNICATION_FAILURE;
-                                curlun->sense_data_info = file_offset >> curlun->blkbits;
-                                curlun->info_valid = 1;
-                                break;
-                        }
-
-                        amount = bh->outreq->actual;
-                        if (curlun->file_length - file_offset < amount) {
-                                LERROR(curlun,
-        "write %u @ %llu beyond end %llu\n",
-        amount, (unsigned long long) file_offset,
-        (unsigned long long) curlun->file_length);
-                                amount = curlun->file_length - file_offset;
-                        }
-
-                        /* Don't accept excess data.  The spec doesn't say
-                         * what to do in this case.  We'll ignore the error.
-                         */
-                        amount = min(amount, bh->bulk_out_intended_length);
-
-                        /* Don't write a partial block */
-                        amount = round_down(amount, curlun->blksize);
-                        if (amount == 0)
-                                goto empty_write;
-
-                        /* Perform the write */
-                        file_offset_tmp = file_offset;
-                        nwritten = vfs_write(curlun->filp,
-                                        (char __user *) bh->buf,
-                                        amount, &file_offset_tmp);
-                        VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
-                                        (unsigned long long) file_offset,
-                                        (int) nwritten);
-                        if (signal_pending(current))
-                                return -EINTR;          // Interrupted!
-
-                        if (nwritten < 0) {
-                                LDBG(curlun, "error in file write: %d\n",
-                                                (int) nwritten);
-                                nwritten = 0;
-                        } else if (nwritten < amount) {
-                                LDBG(curlun, "partial file write: %d/%u\n",
-                                                (int) nwritten, amount);
-                                nwritten = round_down(nwritten, curlun->blksize);
-                        }
-                        file_offset += nwritten;
-                        amount_left_to_write -= nwritten;
-                        fsg->residue -= nwritten;
-
-                        /* If an error occurred, report it and its position */
-                        if (nwritten < amount) {
-                                curlun->sense_data = SS_WRITE_ERROR;
-                                curlun->sense_data_info = file_offset >> curlun->blkbits;
-                                curlun->info_valid = 1;
-                                break;
-                        }
-
- empty_write:
-                        /* Did the host decide to stop early? */
-                        if (bh->outreq->actual < bh->bulk_out_intended_length) {
-                                fsg->short_packet_received = 1;
-                                break;
-                        }
-                        continue;
-                }
-
-                /* Wait for something to happen */
-                rc = sleep_thread(fsg);
-                if (rc)
-                        return rc;
-        }
-
-        return -EIO;            // No default reply
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-static int do_synchronize_cache(struct fsg_dev *fsg)
-{
-        struct fsg_lun  *curlun = fsg->curlun;
-        int             rc;
-
-        /* We ignore the requested LBA and write out all file's
-         * dirty data buffers. */
-        rc = fsg_lun_fsync_sub(curlun);
-        if (rc)
-                curlun->sense_data = SS_WRITE_ERROR;
-        return 0;
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-static void invalidate_sub(struct fsg_lun *curlun)
-{
-        struct file     *filp = curlun->filp;
-        struct inode    *inode = filp->f_path.dentry->d_inode;
-        unsigned long   rc;
-
-        rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
-        VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc);
-}
-
-static int do_verify(struct fsg_dev *fsg)
-{
-        struct fsg_lun          *curlun = fsg->curlun;
-        u32                     lba;
-        u32                     verification_length;
-        struct fsg_buffhd       *bh = fsg->next_buffhd_to_fill;
-        loff_t                  file_offset, file_offset_tmp;
-        u32                     amount_left;
-        unsigned int            amount;
-        ssize_t                 nread;
-
-        /* Get the starting Logical Block Address and check that it's
-         * not too big */
-        lba = get_unaligned_be32(&fsg->cmnd[2]);
-        if (lba >= curlun->num_sectors) {
-                curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
-                return -EINVAL;
-        }
-
-        /* We allow DPO (Disable Page Out = don't save data in the
-         * cache) but we don't implement it. */
-        if ((fsg->cmnd[1] & ~0x10) != 0) {
-                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
-                return -EINVAL;
-        }
-
-        verification_length = get_unaligned_be16(&fsg->cmnd[7]);
-        if (unlikely(verification_length == 0))
-                return -EIO;            // No default reply
-
-        /* Prepare to carry out the file verify */
-        amount_left = verification_length << curlun->blkbits;
-        file_offset = ((loff_t) lba) << curlun->blkbits;
-
-        /* Write out all the dirty buffers before invalidating them */
-        fsg_lun_fsync_sub(curlun);
-        if (signal_pending(current))
-                return -EINTR;
-
-        invalidate_sub(curlun);
-        if (signal_pending(current))
-                return -EINTR;
-
-        /* Just try to read the requested blocks */
-        while (amount_left > 0) {
-
-                /* Figure out how much we need to read:
-                 * Try to read the remaining amount, but not more than
-                 * the buffer size.
-                 * And don't try to read past the end of the file.
-                 */
-                amount = min((unsigned int) amount_left, mod_data.buflen);
-                amount = min((loff_t) amount,
-                                curlun->file_length - file_offset);
-                if (amount == 0) {
-                        curlun->sense_data =
-                                        SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
-                        curlun->sense_data_info = file_offset >> curlun->blkbits;
-                        curlun->info_valid = 1;
-                        break;
-                }
-
-                /* Perform the read */
-                file_offset_tmp = file_offset;
-                nread = vfs_read(curlun->filp,
-                                (char __user *) bh->buf,
-                                amount, &file_offset_tmp);
-                VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
-                                (unsigned long long) file_offset,
-                                (int) nread);
-                if (signal_pending(current))
-                        return -EINTR;
-
-                if (nread < 0) {
-                        LDBG(curlun, "error in file verify: %d\n",
-                                        (int) nread);
-                        nread = 0;
-                } else if (nread < amount) {
-                        LDBG(curlun, "partial file verify: %d/%u\n",
-                                        (int) nread, amount);
-                        nread = round_down(nread, curlun->blksize);
-                }
-                if (nread == 0) {
-                        curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
-                        curlun->sense_data_info = file_offset >> curlun->blkbits;
-                        curlun->info_valid = 1;
-                        break;
-                }
-                file_offset += nread;
-                amount_left -= nread;
-        }
-        return 0;
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-static int do_inquiry(struct fsg_dev *fsg, struct fsg_buffhd *bh)
-{
-        u8      *buf = (u8 *) bh->buf;
-
-        static char vendor_id[] = "Linux   ";
-        static char product_disk_id[] = "File-Stor Gadget";
-        static char product_cdrom_id[] = "File-CD Gadget  ";
-
-        if (!fsg->curlun) {             // Unsupported LUNs are okay
-                fsg->bad_lun_okay = 1;
-                memset(buf, 0, 36);
-                buf[0] = 0x7f;          // Unsupported, no device-type
-                buf[4] = 31;            // Additional length
-                return 36;
-        }
-
-        memset(buf, 0, 8);
-        buf[0] = (mod_data.cdrom ? TYPE_ROM : TYPE_DISK);
-        if (mod_data.removable)
-                buf[1] = 0x80;
-        buf[2] = 2;             // ANSI SCSI level 2
-        buf[3] = 2;             // SCSI-2 INQUIRY data format
-        buf[4] = 31;            // Additional length
-                                // No special options
-        sprintf(buf + 8, "%-8s%-16s%04x", vendor_id,
-                        (mod_data.cdrom ? product_cdrom_id :
-                                product_disk_id),
-                        mod_data.release);
-        return 36;
-}
-
-
-static int do_request_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
-{
-        struct fsg_lun  *curlun = fsg->curlun;
-        u8              *buf = (u8 *) bh->buf;
-        u32             sd, sdinfo;
-        int             valid;
-
-        /*
-         * From the SCSI-2 spec., section 7.9 (Unit attention condition):
-         *
-         * If a REQUEST SENSE command is received from an initiator
-         * with a pending unit attention condition (before the target
-         * generates the contingent allegiance condition), then the
-         * target shall either:
-         *   a) report any pending sense data and preserve the unit
-         *      attention condition on the logical unit, or,
-         *   b) report the unit attention condition, may discard any
-         *      pending sense data, and clear the unit attention
-         *      condition on the logical unit for that initiator.
-         *
-         * FSG normally uses option a); enable this code to use option b).
-         */
-#if 0
-        if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
-                curlun->sense_data = curlun->unit_attention_data;
-                curlun->unit_attention_data = SS_NO_SENSE;
-        }
-#endif
-
-        if (!curlun) {          // Unsupported LUNs are okay
-                fsg->bad_lun_okay = 1;
-                sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
-                sdinfo = 0;
-                valid = 0;
-        } else {
-                sd = curlun->sense_data;
-                sdinfo = curlun->sense_data_info;
-                valid = curlun->info_valid << 7;
-                curlun->sense_data = SS_NO_SENSE;
-                curlun->sense_data_info = 0;
-                curlun->info_valid = 0;
-        }
-
-        memset(buf, 0, 18);
-        buf[0] = valid | 0x70;                  // Valid, current error
-        buf[2] = SK(sd);
-        put_unaligned_be32(sdinfo, &buf[3]);    /* Sense information */
-        buf[7] = 18 - 8;                        // Additional sense length
-        buf[12] = ASC(sd);
-        buf[13] = ASCQ(sd);
-        return 18;
-}
-
-
-static int do_read_capacity(struct fsg_dev *fsg, struct fsg_buffhd *bh)
-{
-        struct fsg_lun  *curlun = fsg->curlun;
-        u32             lba = get_unaligned_be32(&fsg->cmnd[2]);
-        int             pmi = fsg->cmnd[8];
-        u8              *buf = (u8 *) bh->buf;
-
-        /* Check the PMI and LBA fields */
-        if (pmi > 1 || (pmi == 0 && lba != 0)) {
-                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
-                return -EINVAL;
-        }
-
-        put_unaligned_be32(curlun->num_sectors - 1, &buf[0]);
-                                                /* Max logical block */
-        put_unaligned_be32(curlun->blksize, &buf[4]);   /* Block length */
-        return 8;
-}
-
-
-static int do_read_header(struct fsg_dev *fsg, struct fsg_buffhd *bh)
-{
-        struct fsg_lun  *curlun = fsg->curlun;
-        int             msf = fsg->cmnd[1] & 0x02;
-        u32             lba = get_unaligned_be32(&fsg->cmnd[2]);
-        u8              *buf = (u8 *) bh->buf;
-
-        if ((fsg->cmnd[1] & ~0x02) != 0) {              /* Mask away MSF */
-                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
-                return -EINVAL;
-        }
-        if (lba >= curlun->num_sectors) {
-                curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
-                return -EINVAL;
-        }
-
-        memset(buf, 0, 8);
-        buf[0] = 0x01;          /* 2048 bytes of user data, rest is EC */
-        store_cdrom_address(&buf[4], msf, lba);
-        return 8;
-}
-
-
-static int do_read_toc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
-{
-        struct fsg_lun  *curlun = fsg->curlun;
-        int             msf = fsg->cmnd[1] & 0x02;
-        int             start_track = fsg->cmnd[6];
-        u8              *buf = (u8 *) bh->buf;
-
-        if ((fsg->cmnd[1] & ~0x02) != 0 ||              /* Mask away MSF */
-                        start_track > 1) {
-                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
-                return -EINVAL;
-        }
-
-        memset(buf, 0, 20);
-        buf[1] = (20-2);                /* TOC data length */
-        buf[2] = 1;                     /* First track number */
-        buf[3] = 1;                     /* Last track number */
-        buf[5] = 0x16;                  /* Data track, copying allowed */
-        buf[6] = 0x01;                  /* Only track is number 1 */
-        store_cdrom_address(&buf[8], msf, 0);
-
-        buf[13] = 0x16;                 /* Lead-out track is data */
-        buf[14] = 0xAA;                 /* Lead-out track number */
-        store_cdrom_address(&buf[16], msf, curlun->num_sectors);
-        return 20;
-}
-
-
-static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
-{
-        struct fsg_lun  *curlun = fsg->curlun;
-        int             mscmnd = fsg->cmnd[0];
-        u8              *buf = (u8 *) bh->buf;
-        u8              *buf0 = buf;
-        int             pc, page_code;
-        int             changeable_values, all_pages;
-        int             valid_page = 0;
-        int             len, limit;
-
-        if ((fsg->cmnd[1] & ~0x08) != 0) {              // Mask away DBD
-                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
-                return -EINVAL;
-        }
-        pc = fsg->cmnd[2] >> 6;
-        page_code = fsg->cmnd[2] & 0x3f;
-        if (pc == 3) {
-                curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
-                return -EINVAL;
-        }
-        changeable_values = (pc == 1);
-        all_pages = (page_code == 0x3f);
-
-        /* Write the mode parameter header.  Fixed values are: default
-         * medium type, no cache control (DPOFUA), and no block descriptors.
-         * The only variable value is the WriteProtect bit.  We will fill in
-         * the mode data length later. */
-        memset(buf, 0, 8);
-        if (mscmnd == MODE_SENSE) {
-                buf[2] = (curlun->ro ? 0x80 : 0x00);            // WP, DPOFUA
-                buf += 4;
-                limit = 255;
-        } else {                        // MODE_SENSE_10
-                buf[3] = (curlun->ro ? 0x80 : 0x00);            // WP, DPOFUA
-                buf += 8;
-                limit = 65535;          // Should really be mod_data.buflen
-        }
-
-        /* No block descriptors */
-
-        /* The mode pages, in numerical order.  The only page we support
-         * is the Caching page. */
-        if (page_code == 0x08 || all_pages) {
-                valid_page = 1;
-                buf[0] = 0x08;          // Page code
-                buf[1] = 10;            // Page length
-                memset(buf+2, 0, 10);   // None of the fields are changeable
-
-                if (!changeable_values) {
-                        buf[2] = 0x04;  // Write cache enable,
-                                        // Read cache not disabled
-                                        // No cache retention priorities
-                        put_unaligned_be16(0xffff, &buf[4]);
-                                        /* Don't disable prefetch */
-                                        /* Minimum prefetch = 0 */
-                        put_unaligned_be16(0xffff, &buf[8]);
-                                        /* Maximum prefetch */
-                        put_unaligned_be16(0xffff, &buf[10]);
-                                        /* Maximum prefetch ceiling */
-                }
-                buf += 12;
-        }
-
-        /* Check that a valid page was requested and the mode data length
-         * isn't too long. */
-        len = buf - buf0;
-        if (!valid_page || len > limit) {
-                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
-                return -EINVAL;
-        }
-
-        /*  Store the mode data length */
-        if (mscmnd == MODE_SENSE)
-                buf0[0] = len - 1;
-        else
-                put_unaligned_be16(len - 2, buf0);
-        return len;
-}
-
-
-static int do_start_stop(struct fsg_dev *fsg)
-{
-        struct fsg_lun  *curlun = fsg->curlun;
-        int             loej, start;
-
-        if (!mod_data.removable) {
-                curlun->sense_data = SS_INVALID_COMMAND;
-                return -EINVAL;
-        }
-
-        // int immed = fsg->cmnd[1] & 0x01;
-        loej = fsg->cmnd[4] & 0x02;
-        start = fsg->cmnd[4] & 0x01;
-
-#ifdef CONFIG_USB_FILE_STORAGE_TEST
-        if ((fsg->cmnd[1] & ~0x01) != 0 ||              // Mask away Immed
-                        (fsg->cmnd[4] & ~0x03) != 0) {  // Mask LoEj, Start
-                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
-                return -EINVAL;
-        }
-
-        if (!start) {
-
-                /* Are we allowed to unload the media? */
-                if (curlun->prevent_medium_removal) {
-                        LDBG(curlun, "unload attempt prevented\n");
-                        curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
-                        return -EINVAL;
-                }
-                if (loej) {             // Simulate an unload/eject
-                        up_read(&fsg->filesem);
-                        down_write(&fsg->filesem);
-                        fsg_lun_close(curlun);
-                        up_write(&fsg->filesem);
-                        down_read(&fsg->filesem);
-                }
-        } else {
-
-                /* Our emulation doesn't support mounting; the medium is
-                 * available for use as soon as it is loaded. */
-                if (!fsg_lun_is_open(curlun)) {
-                        curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
-                        return -EINVAL;
-                }
-        }
-#endif
-        return 0;
-}
-
-
-static int do_prevent_allow(struct fsg_dev *fsg)
-{
-        struct fsg_lun  *curlun = fsg->curlun;
-        int             prevent;
-
-        if (!mod_data.removable) {
-                curlun->sense_data = SS_INVALID_COMMAND;
-                return -EINVAL;
-        }
-
-        prevent = fsg->cmnd[4] & 0x01;
-        if ((fsg->cmnd[4] & ~0x01) != 0) {              // Mask away Prevent
-                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
-                return -EINVAL;
-        }
-
-        if (curlun->prevent_medium_removal && !prevent)
-                fsg_lun_fsync_sub(curlun);
-        curlun->prevent_medium_removal = prevent;
-        return 0;
-}
-
-
-static int do_read_format_capacities(struct fsg_dev *fsg,
-                        struct fsg_buffhd *bh)
-{
-        struct fsg_lun  *curlun = fsg->curlun;
-        u8              *buf = (u8 *) bh->buf;
-
-        buf[0] = buf[1] = buf[2] = 0;
-        buf[3] = 8;             // Only the Current/Maximum Capacity Descriptor
-        buf += 4;
-
-        put_unaligned_be32(curlun->num_sectors, &buf[0]);
-                                                /* Number of blocks */
-        put_unaligned_be32(curlun->blksize, &buf[4]);   /* Block length */
-        buf[4] = 0x02;                          /* Current capacity */
-        return 12;
-}
-
-
-static int do_mode_select(struct fsg_dev *fsg, struct fsg_buffhd *bh)
-{
-        struct fsg_lun  *curlun = fsg->curlun;
-
-        /* We don't support MODE SELECT */
-        curlun->sense_data = SS_INVALID_COMMAND;
-        return -EINVAL;
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
-{
-        int     rc;
-
-        rc = fsg_set_halt(fsg, fsg->bulk_in);
-        if (rc == -EAGAIN)
-                VDBG(fsg, "delayed bulk-in endpoint halt\n");
-        while (rc != 0) {
-                if (rc != -EAGAIN) {
-                        WARNING(fsg, "usb_ep_set_halt -> %d\n", rc);
-                        rc = 0;
-                        break;
-                }
-
-                /* Wait for a short time and then try again */
-                if (msleep_interruptible(100) != 0)
-                        return -EINTR;
-                rc = usb_ep_set_halt(fsg->bulk_in);
-        }
-        return rc;
-}
-
-static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
-{
-        int     rc;
-
-        DBG(fsg, "bulk-in set wedge\n");
-        rc = usb_ep_set_wedge(fsg->bulk_in);
-        if (rc == -EAGAIN)
-                VDBG(fsg, "delayed bulk-in endpoint wedge\n");
-        while (rc != 0) {
-                if (rc != -EAGAIN) {
-                        WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc);
-                        rc = 0;
-                        break;
-                }
-
-                /* Wait for a short time and then try again */
-                if (msleep_interruptible(100) != 0)
-                        return -EINTR;
-                rc = usb_ep_set_wedge(fsg->bulk_in);
-        }
-        return rc;
-}
-
-static int throw_away_data(struct fsg_dev *fsg)
-{
-        struct fsg_buffhd       *bh;
-        u32                     amount;
-        int                     rc;
-
-        while ((bh = fsg->next_buffhd_to_drain)->state != BUF_STATE_EMPTY ||
-                        fsg->usb_amount_left > 0) {
-
-                /* Throw away the data in a filled buffer */
-                if (bh->state == BUF_STATE_FULL) {
-                        smp_rmb();
-                        bh->state = BUF_STATE_EMPTY;
-                        fsg->next_buffhd_to_drain = bh->next;
-
-                        /* A short packet or an error ends everything */
-                        if (bh->outreq->actual < bh->bulk_out_intended_length ||
-                                        bh->outreq->status != 0) {
-                                raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
-                                return -EINTR;
-                        }
-                        continue;
-                }
-
-                /* Try to submit another request if we need one */
-                bh = fsg->next_buffhd_to_fill;
-                if (bh->state == BUF_STATE_EMPTY && fsg->usb_amount_left > 0) {
-                        amount = min(fsg->usb_amount_left,
-                                        (u32) mod_data.buflen);
-
-                        /* Except at the end of the transfer, amount will be
-                         * equal to the buffer size, which is divisible by
-                         * the bulk-out maxpacket size.
-                         */
-                        set_bulk_out_req_length(fsg, bh, amount);
-                        start_transfer(fsg, fsg->bulk_out, bh->outreq,
-                                        &bh->outreq_busy, &bh->state);
-                        fsg->next_buffhd_to_fill = bh->next;
-                        fsg->usb_amount_left -= amount;
-                        continue;
-                }
-
-                /* Otherwise wait for something to happen */
-                rc = sleep_thread(fsg);
-                if (rc)
-                        return rc;
-        }
-        return 0;
-}
-
-
-static int finish_reply(struct fsg_dev *fsg)
-{
-        struct fsg_buffhd       *bh = fsg->next_buffhd_to_fill;
-        int                     rc = 0;
-
-        switch (fsg->data_dir) {
-        case DATA_DIR_NONE:
-                break;                  // Nothing to send
-
-        /* If we don't know whether the host wants to read or write,
-         * this must be CB or CBI with an unknown command.  We mustn't
-         * try to send or receive any data.  So stall both bulk pipes
-         * if we can and wait for a reset. */
-        case DATA_DIR_UNKNOWN:
-                if (mod_data.can_stall) {
-                        fsg_set_halt(fsg, fsg->bulk_out);
-                        rc = halt_bulk_in_endpoint(fsg);
-                }
-                break;
-
-        /* All but the last buffer of data must have already been sent */
-        case DATA_DIR_TO_HOST:
-                if (fsg->data_size == 0)
-                        ;               // Nothing to send
-
-                /* If there's no residue, simply send the last buffer */
-                else if (fsg->residue == 0) {
-                        bh->inreq->zero = 0;
-                        start_transfer(fsg, fsg->bulk_in, bh->inreq,
-                                        &bh->inreq_busy, &bh->state);
-                        fsg->next_buffhd_to_fill = bh->next;
-                }
-
-                /* There is a residue.  For CB and CBI, simply mark the end
-                 * of the data with a short packet.  However, if we are
-                 * allowed to stall, there was no data at all (residue ==
-                 * data_size), and the command failed (invalid LUN or
-                 * sense data is set), then halt the bulk-in endpoint
-                 * instead. */
-                else if (!transport_is_bbb()) {
-                        if (mod_data.can_stall &&
-                                        fsg->residue == fsg->data_size &&
-        (!fsg->curlun || fsg->curlun->sense_data != SS_NO_SENSE)) {
-                                bh->state = BUF_STATE_EMPTY;
-                                rc = halt_bulk_in_endpoint(fsg);
-                        } else {
-                                bh->inreq->zero = 1;
-                                start_transfer(fsg, fsg->bulk_in, bh->inreq,
-                                                &bh->inreq_busy, &bh->state);
-                                fsg->next_buffhd_to_fill = bh->next;
-                        }
-                }
-
-                /*
-                 * For Bulk-only, mark the end of the data with a short
-                 * packet.  If we are allowed to stall, halt the bulk-in
-                 * endpoint.  (Note: This violates the Bulk-Only Transport
-                 * specification, which requires us to pad the data if we
-                 * don't halt the endpoint.  Presumably nobody will mind.)
-                 */
-                else {
-                        bh->inreq->zero = 1;
-                        start_transfer(fsg, fsg->bulk_in, bh->inreq,
-                                        &bh->inreq_busy, &bh->state);
-                        fsg->next_buffhd_to_fill = bh->next;
-                        if (mod_data.can_stall)
-                                rc = halt_bulk_in_endpoint(fsg);
-                }
-                break;
-
-        /* We have processed all we want from the data the host has sent.
-         * There may still be outstanding bulk-out requests. */
-        case DATA_DIR_FROM_HOST:
-                if (fsg->residue == 0)
-                        ;               // Nothing to receive
-
-                /* Did the host stop sending unexpectedly early? */
-                else if (fsg->short_packet_received) {
-                        raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
-                        rc = -EINTR;
-                }
-
-                /* We haven't processed all the incoming data.  Even though
-                 * we may be allowed to stall, doing so would cause a race.
-                 * The controller may already have ACK'ed all the remaining
-                 * bulk-out packets, in which case the host wouldn't see a
-                 * STALL.  Not realizing the endpoint was halted, it wouldn't
-                 * clear the halt -- leading to problems later on. */
-#if 0
-                else if (mod_data.can_stall) {
-                        fsg_set_halt(fsg, fsg->bulk_out);
-                        raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
-                        rc = -EINTR;
-                }
-#endif
-
-                /* We can't stall.  Read in the excess data and throw it
-                 * all away. */
-                else
-                        rc = throw_away_data(fsg);
-                break;
-        }
-        return rc;
-}
-
-
-static int send_status(struct fsg_dev *fsg)
-{
-        struct fsg_lun          *curlun = fsg->curlun;
-        struct fsg_buffhd       *bh;
-        int                     rc;
-        u8                      status = US_BULK_STAT_OK;
-        u32                     sd, sdinfo = 0;
-
-        /* Wait for the next buffer to become available */
-        bh = fsg->next_buffhd_to_fill;
-        while (bh->state != BUF_STATE_EMPTY) {
-                rc = sleep_thread(fsg);
-                if (rc)
-                        return rc;
-        }
-
-        if (curlun) {
-                sd = curlun->sense_data;
-                sdinfo = curlun->sense_data_info;
-        } else if (fsg->bad_lun_okay)
-                sd = SS_NO_SENSE;
-        else
-                sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
-
-        if (fsg->phase_error) {
-                DBG(fsg, "sending phase-error status\n");
-                status = US_BULK_STAT_PHASE;
-                sd = SS_INVALID_COMMAND;
-        } else if (sd != SS_NO_SENSE) {
-                DBG(fsg, "sending command-failure status\n");
-                status = US_BULK_STAT_FAIL;
-                VDBG(fsg, "  sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
-                                "  info x%x\n",
-                                SK(sd), ASC(sd), ASCQ(sd), sdinfo);
-        }
-
-        if (transport_is_bbb()) {
-                struct bulk_cs_wrap     *csw = bh->buf;
-
-                /* Store and send the Bulk-only CSW */
-                csw->Signature = cpu_to_le32(US_BULK_CS_SIGN);
-                csw->Tag = fsg->tag;
-                csw->Residue = cpu_to_le32(fsg->residue);
-                csw->Status = status;
-
-                bh->inreq->length = US_BULK_CS_WRAP_LEN;
-                bh->inreq->zero = 0;
-                start_transfer(fsg, fsg->bulk_in, bh->inreq,
-                                &bh->inreq_busy, &bh->state);
-
-        } else if (mod_data.transport_type == USB_PR_CB) {
-
-                /* Control-Bulk transport has no status phase! */
-                return 0;
-
-        } else {                        // USB_PR_CBI
-                struct interrupt_data   *buf = bh->buf;
-
-                /* Store and send the Interrupt data.  UFI sends the ASC
-                 * and ASCQ bytes.  Everything else sends a Type (which
-                 * is always 0) and the status Value. */
-                if (mod_data.protocol_type == USB_SC_UFI) {
-                        buf->bType = ASC(sd);
-                        buf->bValue = ASCQ(sd);
-                } else {
-                        buf->bType = 0;
-                        buf->bValue = status;
-                }
-                fsg->intreq->length = CBI_INTERRUPT_DATA_LEN;
-
-                fsg->intr_buffhd = bh;          // Point to the right buffhd
-                fsg->intreq->buf = bh->inreq->buf;
-                fsg->intreq->context = bh;
-                start_transfer(fsg, fsg->intr_in, fsg->intreq,
-                                &fsg->intreq_busy, &bh->state);
-        }
-
-        fsg->next_buffhd_to_fill = bh->next;
-        return 0;
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-/* Check whether the command is properly formed and whether its data size
- * and direction agree with the values we already have. */
-static int check_command(struct fsg_dev *fsg, int cmnd_size,
-                enum data_direction data_dir, unsigned int mask,
-                int needs_medium, const char *name)
-{
-        int                     i;
-        int                     lun = fsg->cmnd[1] >> 5;
-        static const char       dirletter[4] = {'u', 'o', 'i', 'n'};
-        char                    hdlen[20];
-        struct fsg_lun          *curlun;
-
-        /* Adjust the expected cmnd_size for protocol encapsulation padding.
-         * Transparent SCSI doesn't pad. */
-        if (protocol_is_scsi())
-                ;
-
-        /* There's some disagreement as to whether RBC pads commands or not.
-         * We'll play it safe and accept either form. */
-        else if (mod_data.protocol_type == USB_SC_RBC) {
-                if (fsg->cmnd_size == 12)
-                        cmnd_size = 12;
-
-        /* All the other protocols pad to 12 bytes */
-        } else
-                cmnd_size = 12;
-
-        hdlen[0] = 0;
-        if (fsg->data_dir != DATA_DIR_UNKNOWN)
-                sprintf(hdlen, ", H%c=%u", dirletter[(int) fsg->data_dir],
-                                fsg->data_size);
-        VDBG(fsg, "SCSI command: %s;  Dc=%d, D%c=%u;  Hc=%d%s\n",
-                        name, cmnd_size, dirletter[(int) data_dir],
-                        fsg->data_size_from_cmnd, fsg->cmnd_size, hdlen);
-
-        /* We can't reply at all until we know the correct data direction
-         * and size. */
-        if (fsg->data_size_from_cmnd == 0)
-                data_dir = DATA_DIR_NONE;
-        if (fsg->data_dir == DATA_DIR_UNKNOWN) {        // CB or CBI
-                fsg->data_dir = data_dir;
-                fsg->data_size = fsg->data_size_from_cmnd;
-
-        } else {                                        // Bulk-only
-                if (fsg->data_size < fsg->data_size_from_cmnd) {
-
-                        /* Host data size < Device data size is a phase error.
-                         * Carry out the command, but only transfer as much
-                         * as we are allowed. */
-                        fsg->data_size_from_cmnd = fsg->data_size;
-                        fsg->phase_error = 1;
-                }
-        }
-        fsg->residue = fsg->usb_amount_left = fsg->data_size;
-
-        /* Conflicting data directions is a phase error */
-        if (fsg->data_dir != data_dir && fsg->data_size_from_cmnd > 0) {
-                fsg->phase_error = 1;
-                return -EINVAL;
-        }
-
-        /* Verify the length of the command itself */
-        if (cmnd_size != fsg->cmnd_size) {
-
-                /* Special case workaround: There are plenty of buggy SCSI
-                 * implementations. Many have issues with cbw->Length
-                 * field passing a wrong command size. For those cases we
-                 * always try to work around the problem by using the length
-                 * sent by the host side provided it is at least as large
-                 * as the correct command length.
-                 * Examples of such cases would be MS-Windows, which issues
-                 * REQUEST SENSE with cbw->Length == 12 where it should
-                 * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
-                 * REQUEST SENSE with cbw->Length == 10 where it should
-                 * be 6 as well.
-                 */
-                if (cmnd_size <= fsg->cmnd_size) {
-                        DBG(fsg, "%s is buggy! Expected length %d "
-                                        "but we got %d\n", name,
-                                        cmnd_size, fsg->cmnd_size);
-                        cmnd_size = fsg->cmnd_size;
-                } else {
-                        fsg->phase_error = 1;
-                        return -EINVAL;
-                }
-        }
-
-        /* Check that the LUN values are consistent */
-        if (transport_is_bbb()) {
-                if (fsg->lun != lun)
-                        DBG(fsg, "using LUN %d from CBW, "
-                                        "not LUN %d from CDB\n",
-                                        fsg->lun, lun);
-        }
-
-        /* Check the LUN */
-        curlun = fsg->curlun;
-        if (curlun) {
-                if (fsg->cmnd[0] != REQUEST_SENSE) {
-                        curlun->sense_data = SS_NO_SENSE;
-                        curlun->sense_data_info = 0;
-                        curlun->info_valid = 0;
-                }
-        } else {
-                fsg->bad_lun_okay = 0;
-
-                /* INQUIRY and REQUEST SENSE commands are explicitly allowed
-                 * to use unsupported LUNs; all others may not. */
-                if (fsg->cmnd[0] != INQUIRY &&
-                                fsg->cmnd[0] != REQUEST_SENSE) {
-                        DBG(fsg, "unsupported LUN %d\n", fsg->lun);
-                        return -EINVAL;
-                }
-        }
-
-        /* If a unit attention condition exists, only INQUIRY and
-         * REQUEST SENSE commands are allowed; anything else must fail. */
-        if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
-                        fsg->cmnd[0] != INQUIRY &&
-                        fsg->cmnd[0] != REQUEST_SENSE) {
-                curlun->sense_data = curlun->unit_attention_data;
-                curlun->unit_attention_data = SS_NO_SENSE;
-                return -EINVAL;
-        }
-
-        /* Check that only command bytes listed in the mask are non-zero */
-        fsg->cmnd[1] &= 0x1f;                   // Mask away the LUN
-        for (i = 1; i < cmnd_size; ++i) {
-                if (fsg->cmnd[i] && !(mask & (1 << i))) {
-                        if (curlun)
-                                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
-                        return -EINVAL;
-                }
-        }
-
-        /* If the medium isn't mounted and the command needs to access
-         * it, return an error. */
-        if (curlun && !fsg_lun_is_open(curlun) && needs_medium) {
-                curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
-                return -EINVAL;
-        }
-
-        return 0;
-}
-
-/* wrapper of check_command for data size in blocks handling */
-static int check_command_size_in_blocks(struct fsg_dev *fsg, int cmnd_size,
-                enum data_direction data_dir, unsigned int mask,
-                int needs_medium, const char *name)
-{
-        if (fsg->curlun)
-                fsg->data_size_from_cmnd <<= fsg->curlun->blkbits;
-        return check_command(fsg, cmnd_size, data_dir,
-                        mask, needs_medium, name);
-}
-
-static int do_scsi_command(struct fsg_dev *fsg)
-{
-        struct fsg_buffhd       *bh;
-        int                     rc;
-        int                     reply = -EINVAL;
-        int                     i;
-        static char             unknown[16];
-
-        dump_cdb(fsg);
-
-        /* Wait for the next buffer to become available for data or status */
-        bh = fsg->next_buffhd_to_drain = fsg->next_buffhd_to_fill;
-        while (bh->state != BUF_STATE_EMPTY) {
-                rc = sleep_thread(fsg);
-                if (rc)
-                        return rc;
-        }
-        fsg->phase_error = 0;
-        fsg->short_packet_received = 0;
-
-        down_read(&fsg->filesem);       // We're using the backing file
-        switch (fsg->cmnd[0]) {
-
-        case INQUIRY:
-                fsg->data_size_from_cmnd = fsg->cmnd[4];
-                if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
-                                (1<<4), 0,
-                                "INQUIRY")) == 0)
-                        reply = do_inquiry(fsg, bh);
-                break;
-
-        case MODE_SELECT:
-                fsg->data_size_from_cmnd = fsg->cmnd[4];
-                if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
-                                (1<<1) | (1<<4), 0,
-                                "MODE SELECT(6)")) == 0)
-                        reply = do_mode_select(fsg, bh);
-                break;
-
-        case MODE_SELECT_10:
-                fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
-                if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
-                                (1<<1) | (3<<7), 0,
-                                "MODE SELECT(10)")) == 0)
-                        reply = do_mode_select(fsg, bh);
-                break;
-
-        case MODE_SENSE:
-                fsg->data_size_from_cmnd = fsg->cmnd[4];
-                if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
-                                (1<<1) | (1<<2) | (1<<4), 0,
-                                "MODE SENSE(6)")) == 0)
-                        reply = do_mode_sense(fsg, bh);
-                break;
-
-        case MODE_SENSE_10:
-                fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
-                if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
-                                (1<<1) | (1<<2) | (3<<7), 0,
-                                "MODE SENSE(10)")) == 0)
-                        reply = do_mode_sense(fsg, bh);
-                break;
-
-        case ALLOW_MEDIUM_REMOVAL:
-                fsg->data_size_from_cmnd = 0;
-                if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
-                                (1<<4), 0,
-                                "PREVENT-ALLOW MEDIUM REMOVAL")) == 0)
-                        reply = do_prevent_allow(fsg);
-                break;
-
-        case READ_6:
-                i = fsg->cmnd[4];
-                fsg->data_size_from_cmnd = (i == 0) ? 256 : i;
-                if ((reply = check_command_size_in_blocks(fsg, 6,
-                                DATA_DIR_TO_HOST,
-                                (7<<1) | (1<<4), 1,
-                                "READ(6)")) == 0)
-                        reply = do_read(fsg);
-                break;
-
-        case READ_10:
-                fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
-                if ((reply = check_command_size_in_blocks(fsg, 10,
-                                DATA_DIR_TO_HOST,
-                                (1<<1) | (0xf<<2) | (3<<7), 1,
-                                "READ(10)")) == 0)
-                        reply = do_read(fsg);
-                break;
-
-        case READ_12:
-                fsg->data_size_from_cmnd = get_unaligned_be32(&fsg->cmnd[6]);
-                if ((reply = check_command_size_in_blocks(fsg, 12,
-                                DATA_DIR_TO_HOST,
-                                (1<<1) | (0xf<<2) | (0xf<<6), 1,
-                                "READ(12)")) == 0)
-                        reply = do_read(fsg);
-                break;
-
-        case READ_CAPACITY:
-                fsg->data_size_from_cmnd = 8;
-                if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
-                                (0xf<<2) | (1<<8), 1,
-                                "READ CAPACITY")) == 0)
-                        reply = do_read_capacity(fsg, bh);
-                break;
-
-        case READ_HEADER:
-                if (!mod_data.cdrom)
-                        goto unknown_cmnd;
-                fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
-                if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
-                                (3<<7) | (0x1f<<1), 1,
-                                "READ HEADER")) == 0)
-                        reply = do_read_header(fsg, bh);
-                break;
-
-        case READ_TOC:
-                if (!mod_data.cdrom)
-                        goto unknown_cmnd;
-                fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
-                if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
-                                (7<<6) | (1<<1), 1,
-                                "READ TOC")) == 0)
-                        reply = do_read_toc(fsg, bh);
-                break;
-
-        case READ_FORMAT_CAPACITIES:
-                fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
-                if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
-                                (3<<7), 1,
-                                "READ FORMAT CAPACITIES")) == 0)
-                        reply = do_read_format_capacities(fsg, bh);
-                break;
-
-        case REQUEST_SENSE:
-                fsg->data_size_from_cmnd = fsg->cmnd[4];
-                if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
-                                (1<<4), 0,
-                                "REQUEST SENSE")) == 0)
-                        reply = do_request_sense(fsg, bh);
-                break;
-
-        case START_STOP:
-                fsg->data_size_from_cmnd = 0;
-                if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
-                                (1<<1) | (1<<4), 0,
-                                "START-STOP UNIT")) == 0)
-                        reply = do_start_stop(fsg);
-                break;
-
-        case SYNCHRONIZE_CACHE:
-                fsg->data_size_from_cmnd = 0;
-                if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
-                                (0xf<<2) | (3<<7), 1,
-                                "SYNCHRONIZE CACHE")) == 0)
-                        reply = do_synchronize_cache(fsg);
-                break;
-
-        case TEST_UNIT_READY:
-                fsg->data_size_from_cmnd = 0;
-                reply = check_command(fsg, 6, DATA_DIR_NONE,
-                                0, 1,
-                                "TEST UNIT READY");
-                break;
-
-        /* Although optional, this command is used by MS-Windows.  We
-         * support a minimal version: BytChk must be 0. */
-        case VERIFY:
-                fsg->data_size_from_cmnd = 0;
-                if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
-                                (1<<1) | (0xf<<2) | (3<<7), 1,
-                                "VERIFY")) == 0)
-                        reply = do_verify(fsg);
-                break;
-
-        case WRITE_6:
-                i = fsg->cmnd[4];
-                fsg->data_size_from_cmnd = (i == 0) ? 256 : i;
-                if ((reply = check_command_size_in_blocks(fsg, 6,
-                                DATA_DIR_FROM_HOST,
-                                (7<<1) | (1<<4), 1,
-                                "WRITE(6)")) == 0)
-                        reply = do_write(fsg);
-                break;
-
-        case WRITE_10:
-                fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
-                if ((reply = check_command_size_in_blocks(fsg, 10,
-                                DATA_DIR_FROM_HOST,
-                                (1<<1) | (0xf<<2) | (3<<7), 1,
-                                "WRITE(10)")) == 0)
-                        reply = do_write(fsg);
-                break;
-
-        case WRITE_12:
-                fsg->data_size_from_cmnd = get_unaligned_be32(&fsg->cmnd[6]);
-                if ((reply = check_command_size_in_blocks(fsg, 12,
-                                DATA_DIR_FROM_HOST,
-                                (1<<1) | (0xf<<2) | (0xf<<6), 1,
-                                "WRITE(12)")) == 0)
-                        reply = do_write(fsg);
-                break;
-
-        /* Some mandatory commands that we recognize but don't implement.
-         * They don't mean much in this setting.  It's left as an exercise
-         * for anyone interested to implement RESERVE and RELEASE in terms
-         * of Posix locks. */
-        case FORMAT_UNIT:
-        case RELEASE:
-        case RESERVE:
-        case SEND_DIAGNOSTIC:
-                // Fall through
-
-        default:
- unknown_cmnd:
-                fsg->data_size_from_cmnd = 0;
-                sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]);
-                if ((reply = check_command(fsg, fsg->cmnd_size,
-                                DATA_DIR_UNKNOWN, ~0, 0, unknown)) == 0) {
-                        fsg->curlun->sense_data = SS_INVALID_COMMAND;
-                        reply = -EINVAL;
-                }
-                break;
-        }
-        up_read(&fsg->filesem);
-
-        if (reply == -EINTR || signal_pending(current))
-                return -EINTR;
-
-        /* Set up the single reply buffer for finish_reply() */
-        if (reply == -EINVAL)
-                reply = 0;              // Error reply length
-        if (reply >= 0 && fsg->data_dir == DATA_DIR_TO_HOST) {
-                reply = min((u32) reply, fsg->data_size_from_cmnd);
-                bh->inreq->length = reply;
-                bh->state = BUF_STATE_FULL;
-                fsg->residue -= reply;
-        }                               // Otherwise it's already set
-
-        return 0;
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
-{
-        struct usb_request              *req = bh->outreq;
-        struct bulk_cb_wrap     *cbw = req->buf;
-
-        /* Was this a real packet?  Should it be ignored? */
-        if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
-                return -EINVAL;
-
-        /* Is the CBW valid? */
-        if (req->actual != US_BULK_CB_WRAP_LEN ||
-                        cbw->Signature != cpu_to_le32(
-                                US_BULK_CB_SIGN)) {
-                DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
-                                req->actual,
-                                le32_to_cpu(cbw->Signature));
-
-                /* The Bulk-only spec says we MUST stall the IN endpoint
-                 * (6.6.1), so it's unavoidable.  It also says we must
-                 * retain this state until the next reset, but there's
-                 * no way to tell the controller driver it should ignore
-                 * Clear-Feature(HALT) requests.
-                 *
-                 * We aren't required to halt the OUT endpoint; instead
-                 * we can simply accept and discard any data received
-                 * until the next reset. */
-                wedge_bulk_in_endpoint(fsg);
-                set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
-                return -EINVAL;
-        }
-
-        /* Is the CBW meaningful? */
-        if (cbw->Lun >= FSG_MAX_LUNS || cbw->Flags & ~US_BULK_FLAG_IN ||
-                        cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) {
-                DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
-                                "cmdlen %u\n",
-                                cbw->Lun, cbw->Flags, cbw->Length);
-
-                /* We can do anything we want here, so let's stall the
-                 * bulk pipes if we are allowed to. */
-                if (mod_data.can_stall) {
-                        fsg_set_halt(fsg, fsg->bulk_out);
-                        halt_bulk_in_endpoint(fsg);
-                }
-                return -EINVAL;
-        }
-
-        /* Save the command for later */
-        fsg->cmnd_size = cbw->Length;
-        memcpy(fsg->cmnd, cbw->CDB, fsg->cmnd_size);
-        if (cbw->Flags & US_BULK_FLAG_IN)
-                fsg->data_dir = DATA_DIR_TO_HOST;
-        else
-                fsg->data_dir = DATA_DIR_FROM_HOST;
-        fsg->data_size = le32_to_cpu(cbw->DataTransferLength);
-        if (fsg->data_size == 0)
-                fsg->data_dir = DATA_DIR_NONE;
-        fsg->lun = cbw->Lun;
-        fsg->tag = cbw->Tag;
-        return 0;
-}
-
-
-static int get_next_command(struct fsg_dev *fsg)
-{
-        struct fsg_buffhd       *bh;
-        int                     rc = 0;
-
-        if (transport_is_bbb()) {
-
-                /* Wait for the next buffer to become available */
-                bh = fsg->next_buffhd_to_fill;
-                while (bh->state != BUF_STATE_EMPTY) {
-                        rc = sleep_thread(fsg);
-                        if (rc)
-                                return rc;
-                }
-
-                /* Queue a request to read a Bulk-only CBW */
-                set_bulk_out_req_length(fsg, bh, US_BULK_CB_WRAP_LEN);
-                start_transfer(fsg, fsg->bulk_out, bh->outreq,
-                                &bh->outreq_busy, &bh->state);
-
-                /* We will drain the buffer in software, which means we
-                 * can reuse it for the next filling.  No need to advance
-                 * next_buffhd_to_fill. */
-
-                /* Wait for the CBW to arrive */
-                while (bh->state != BUF_STATE_FULL) {
-                        rc = sleep_thread(fsg);
-                        if (rc)
-                                return rc;
-                }
-                smp_rmb();
-                rc = received_cbw(fsg, bh);
-                bh->state = BUF_STATE_EMPTY;
-
-        } else {                // USB_PR_CB or USB_PR_CBI
-
-                /* Wait for the next command to arrive */
-                while (fsg->cbbuf_cmnd_size == 0) {
-                        rc = sleep_thread(fsg);
-                        if (rc)
-                                return rc;
-                }
-
-                /* Is the previous status interrupt request still busy?
-                 * The host is allowed to skip reading the status,
-                 * so we must cancel it. */
-                if (fsg->intreq_busy)
-                        usb_ep_dequeue(fsg->intr_in, fsg->intreq);
-
-                /* Copy the command and mark the buffer empty */
-                fsg->data_dir = DATA_DIR_UNKNOWN;
-                spin_lock_irq(&fsg->lock);
-                fsg->cmnd_size = fsg->cbbuf_cmnd_size;
-                memcpy(fsg->cmnd, fsg->cbbuf_cmnd, fsg->cmnd_size);
-                fsg->cbbuf_cmnd_size = 0;
-                spin_unlock_irq(&fsg->lock);
-
-                /* Use LUN from the command */
-                fsg->lun = fsg->cmnd[1] >> 5;
-        }
-
-        /* Update current lun */
-        if (fsg->lun >= 0 && fsg->lun < fsg->nluns)
-                fsg->curlun = &fsg->luns[fsg->lun];
-        else
-                fsg->curlun = NULL;
-
-        return rc;
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-static int enable_endpoint(struct fsg_dev *fsg, struct usb_ep *ep,
-                const struct usb_endpoint_descriptor *d)
-{
-        int     rc;
-
-        ep->driver_data = fsg;
-        ep->desc = d;
-        rc = usb_ep_enable(ep);
-        if (rc)
-                ERROR(fsg, "can't enable %s, result %d\n", ep->name, rc);
-        return rc;
-}
-
-static int alloc_request(struct fsg_dev *fsg, struct usb_ep *ep,
-                struct usb_request **preq)
-{
-        *preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
-        if (*preq)
-                return 0;
-        ERROR(fsg, "can't allocate request for %s\n", ep->name);
-        return -ENOMEM;
-}
-
-/*
- * Reset interface setting and re-init endpoint state (toggle etc).
- * Call with altsetting < 0 to disable the interface.  The only other
- * available altsetting is 0, which enables the interface.
- */
-static int do_set_interface(struct fsg_dev *fsg, int altsetting)
-{
-        int     rc = 0;
-        int     i;
-        const struct usb_endpoint_descriptor    *d;
-
-        if (fsg->running)
-                DBG(fsg, "reset interface\n");
-
-reset:
-        /* Deallocate the requests */
-        for (i = 0; i < fsg_num_buffers; ++i) {
-                struct fsg_buffhd *bh = &fsg->buffhds[i];
-
-                if (bh->inreq) {
-                        usb_ep_free_request(fsg->bulk_in, bh->inreq);
-                        bh->inreq = NULL;
-                }
-                if (bh->outreq) {
-                        usb_ep_free_request(fsg->bulk_out, bh->outreq);
-                        bh->outreq = NULL;
-                }
-        }
-        if (fsg->intreq) {
-                usb_ep_free_request(fsg->intr_in, fsg->intreq);
-                fsg->intreq = NULL;
-        }
-
-        /* Disable the endpoints */
-        if (fsg->bulk_in_enabled) {
-                usb_ep_disable(fsg->bulk_in);
-                fsg->bulk_in_enabled = 0;
-        }
-        if (fsg->bulk_out_enabled) {
-                usb_ep_disable(fsg->bulk_out);
-                fsg->bulk_out_enabled = 0;
-        }
-        if (fsg->intr_in_enabled) {
-                usb_ep_disable(fsg->intr_in);
-                fsg->intr_in_enabled = 0;
-        }
-
-        fsg->running = 0;
-        if (altsetting < 0 || rc != 0)
-                return rc;
-
-        DBG(fsg, "set interface %d\n", altsetting);
-
-        /* Enable the endpoints */
-        d = fsg_ep_desc(fsg->gadget,
-                        &fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc,
-                        &fsg_ss_bulk_in_desc);
-        if ((rc = enable_endpoint(fsg, fsg->bulk_in, d)) != 0)
-                goto reset;
-        fsg->bulk_in_enabled = 1;
-
-        d = fsg_ep_desc(fsg->gadget,
-                        &fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc,
-                        &fsg_ss_bulk_out_desc);
-        if ((rc = enable_endpoint(fsg, fsg->bulk_out, d)) != 0)
-                goto reset;
-        fsg->bulk_out_enabled = 1;
-        fsg->bulk_out_maxpacket = usb_endpoint_maxp(d);
-        clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
-
-        if (transport_is_cbi()) {
-                d = fsg_ep_desc(fsg->gadget,
-                                &fsg_fs_intr_in_desc, &fsg_hs_intr_in_desc,
-                                &fsg_ss_intr_in_desc);
-                if ((rc = enable_endpoint(fsg, fsg->intr_in, d)) != 0)
-                        goto reset;
-                fsg->intr_in_enabled = 1;
-        }
-
-        /* Allocate the requests */
-        for (i = 0; i < fsg_num_buffers; ++i) {
-                struct fsg_buffhd       *bh = &fsg->buffhds[i];
-
-                if ((rc = alloc_request(fsg, fsg->bulk_in, &bh->inreq)) != 0)
-                        goto reset;
-                if ((rc = alloc_request(fsg, fsg->bulk_out, &bh->outreq)) != 0)
-                        goto reset;
-                bh->inreq->buf = bh->outreq->buf = bh->buf;
-                bh->inreq->context = bh->outreq->context = bh;
-                bh->inreq->complete = bulk_in_complete;
-                bh->outreq->complete = bulk_out_complete;
-        }
-        if (transport_is_cbi()) {
-                if ((rc = alloc_request(fsg, fsg->intr_in, &fsg->intreq)) != 0)
-                        goto reset;
-                fsg->intreq->complete = intr_in_complete;
-        }
-
-        fsg->running = 1;
-        for (i = 0; i < fsg->nluns; ++i)
-                fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
-        return rc;
-}
-
-
-/*
- * Change our operational configuration.  This code must agree with the code
- * that returns config descriptors, and with interface altsetting code.
- *
- * It's also responsible for power management interactions.  Some
- * configurations might not work with our current power sources.
- * For now we just assume the gadget is always self-powered.
- */
-static int do_set_config(struct fsg_dev *fsg, u8 new_config)
-{
-        int     rc = 0;
-
-        /* Disable the single interface */
-        if (fsg->config != 0) {
-                DBG(fsg, "reset config\n");
-                fsg->config = 0;
-                rc = do_set_interface(fsg, -1);
-        }
-
-        /* Enable the interface */
-        if (new_config != 0) {
-                fsg->config = new_config;
-                if ((rc = do_set_interface(fsg, 0)) != 0)
-                        fsg->config = 0;        // Reset on errors
-                else
-                        INFO(fsg, "%s config #%d\n",
-                             usb_speed_string(fsg->gadget->speed),
-                             fsg->config);
-        }
-        return rc;
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-static void handle_exception(struct fsg_dev *fsg)
-{
-        siginfo_t               info;
-        int                     sig;
-        int                     i;
-        int                     num_active;
-        struct fsg_buffhd       *bh;
-        enum fsg_state          old_state;
-        u8                      new_config;
-        struct fsg_lun          *curlun;
-        unsigned int            exception_req_tag;
-        int                     rc;
-
-        /* Clear the existing signals.  Anything but SIGUSR1 is converted
-         * into a high-priority EXIT exception. */
-        for (;;) {
-                sig = dequeue_signal_lock(current, &current->blocked, &info);
-                if (!sig)
-                        break;
-                if (sig != SIGUSR1) {
-                        if (fsg->state < FSG_STATE_EXIT)
-                                DBG(fsg, "Main thread exiting on signal\n");
-                        raise_exception(fsg, FSG_STATE_EXIT);
-                }
-        }
-
-        /* Cancel all the pending transfers */
-        if (fsg->intreq_busy)
-                usb_ep_dequeue(fsg->intr_in, fsg->intreq);
-        for (i = 0; i < fsg_num_buffers; ++i) {
-                bh = &fsg->buffhds[i];
-                if (bh->inreq_busy)
-                        usb_ep_dequeue(fsg->bulk_in, bh->inreq);
-                if (bh->outreq_busy)
-                        usb_ep_dequeue(fsg->bulk_out, bh->outreq);
-        }
-
-        /* Wait until everything is idle */
-        for (;;) {
-                num_active = fsg->intreq_busy;
-                for (i = 0; i < fsg_num_buffers; ++i) {
-                        bh = &fsg->buffhds[i];
-                        num_active += bh->inreq_busy + bh->outreq_busy;
-                }
-                if (num_active == 0)
-                        break;
-                if (sleep_thread(fsg))
-                        return;
-        }
-
-        /* Clear out the controller's fifos */
-        if (fsg->bulk_in_enabled)
-                usb_ep_fifo_flush(fsg->bulk_in);
-        if (fsg->bulk_out_enabled)
-                usb_ep_fifo_flush(fsg->bulk_out);
-        if (fsg->intr_in_enabled)
-                usb_ep_fifo_flush(fsg->intr_in);
-
-        /* Reset the I/O buffer states and pointers, the SCSI
-         * state, and the exception.  Then invoke the handler. */
-        spin_lock_irq(&fsg->lock);
-
-        for (i = 0; i < fsg_num_buffers; ++i) {
-                bh = &fsg->buffhds[i];
-                bh->state = BUF_STATE_EMPTY;
-        }
-        fsg->next_buffhd_to_fill = fsg->next_buffhd_to_drain =
-                        &fsg->buffhds[0];
-
-        exception_req_tag = fsg->exception_req_tag;
-        new_config = fsg->new_config;
-        old_state = fsg->state;
-
-        if (old_state == FSG_STATE_ABORT_BULK_OUT)
-                fsg->state = FSG_STATE_STATUS_PHASE;
-        else {
-                for (i = 0; i < fsg->nluns; ++i) {
-                        curlun = &fsg->luns[i];
-                        curlun->prevent_medium_removal = 0;
-                        curlun->sense_data = curlun->unit_attention_data =
-                                        SS_NO_SENSE;
-                        curlun->sense_data_info = 0;
-                        curlun->info_valid = 0;
-                }
-                fsg->state = FSG_STATE_IDLE;
-        }
-        spin_unlock_irq(&fsg->lock);
-
-        /* Carry out any extra actions required for the exception */
-        switch (old_state) {
-        default:
-                break;
-
-        case FSG_STATE_ABORT_BULK_OUT:
-                send_status(fsg);
-                spin_lock_irq(&fsg->lock);
-                if (fsg->state == FSG_STATE_STATUS_PHASE)
-                        fsg->state = FSG_STATE_IDLE;
-                spin_unlock_irq(&fsg->lock);
-                break;
-
-        case FSG_STATE_RESET:
-                /* In case we were forced against our will to halt a
-                 * bulk endpoint, clear the halt now.  (The SuperH UDC
-                 * requires this.) */
-                if (test_and_clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
-                        usb_ep_clear_halt(fsg->bulk_in);
-
-                if (transport_is_bbb()) {
-                        if (fsg->ep0_req_tag == exception_req_tag)
-                                ep0_queue(fsg); // Complete the status stage
-
-                } else if (transport_is_cbi())
-                        send_status(fsg);       // Status by interrupt pipe
-
-                /* Technically this should go here, but it would only be
-                 * a waste of time.  Ditto for the INTERFACE_CHANGE and
-                 * CONFIG_CHANGE cases. */
-                // for (i = 0; i < fsg->nluns; ++i)
-                //      fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
-                break;
-
-        case FSG_STATE_INTERFACE_CHANGE:
-                rc = do_set_interface(fsg, 0);
-                if (fsg->ep0_req_tag != exception_req_tag)
-                        break;
-                if (rc != 0)                    // STALL on errors
-                        fsg_set_halt(fsg, fsg->ep0);
-                else                            // Complete the status stage
-                        ep0_queue(fsg);
-                break;
-
-        case FSG_STATE_CONFIG_CHANGE:
-                rc = do_set_config(fsg, new_config);
-                if (fsg->ep0_req_tag != exception_req_tag)
-                        break;
-                if (rc != 0)                    // STALL on errors
-                        fsg_set_halt(fsg, fsg->ep0);
-                else                            // Complete the status stage
-                        ep0_queue(fsg);
-                break;
-
-        case FSG_STATE_DISCONNECT:
-                for (i = 0; i < fsg->nluns; ++i)
-                        fsg_lun_fsync_sub(fsg->luns + i);
-                do_set_config(fsg, 0);          // Unconfigured state
-                break;
-
-        case FSG_STATE_EXIT:
-        case FSG_STATE_TERMINATED:
-                do_set_config(fsg, 0);                  // Free resources
-                spin_lock_irq(&fsg->lock);
-                fsg->state = FSG_STATE_TERMINATED;      // Stop the thread
-                spin_unlock_irq(&fsg->lock);
-                break;
-        }
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-static int fsg_main_thread(void *fsg_)
-{
-        struct fsg_dev          *fsg = fsg_;
-
-        /* Allow the thread to be killed by a signal, but set the signal mask
-         * to block everything but INT, TERM, KILL, and USR1. */
-        allow_signal(SIGINT);
-        allow_signal(SIGTERM);
-        allow_signal(SIGKILL);
-        allow_signal(SIGUSR1);
-
-        /* Allow the thread to be frozen */
-        set_freezable();
-
-        /* Arrange for userspace references to be interpreted as kernel
-         * pointers.  That way we can pass a kernel pointer to a routine
-         * that expects a __user pointer and it will work okay. */
-        set_fs(get_ds());
-
-        /* The main loop */
-        while (fsg->state != FSG_STATE_TERMINATED) {
-                if (exception_in_progress(fsg) || signal_pending(current)) {
-                        handle_exception(fsg);
-                        continue;
-                }
-
-                if (!fsg->running) {
-                        sleep_thread(fsg);
-                        continue;
-                }
-
-                if (get_next_command(fsg))
-                        continue;
-
-                spin_lock_irq(&fsg->lock);
-                if (!exception_in_progress(fsg))
-                        fsg->state = FSG_STATE_DATA_PHASE;
-                spin_unlock_irq(&fsg->lock);
-
-                if (do_scsi_command(fsg) || finish_reply(fsg))
-                        continue;
-
-                spin_lock_irq(&fsg->lock);
-                if (!exception_in_progress(fsg))
-                        fsg->state = FSG_STATE_STATUS_PHASE;
-                spin_unlock_irq(&fsg->lock);
-
-                if (send_status(fsg))
-                        continue;
-
-                spin_lock_irq(&fsg->lock);
-                if (!exception_in_progress(fsg))
-                        fsg->state = FSG_STATE_IDLE;
-                spin_unlock_irq(&fsg->lock);
-                }
-
-        spin_lock_irq(&fsg->lock);
-        fsg->thread_task = NULL;
-        spin_unlock_irq(&fsg->lock);
-
-        /* If we are exiting because of a signal, unregister the
-         * gadget driver. */
-        if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
-                usb_gadget_unregister_driver(&fsg_driver);
-
-        /* Let the unbind and cleanup routines know the thread has exited */
-        complete_and_exit(&fsg->thread_notifier, 0);
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-
-/* The write permissions and store_xxx pointers are set in fsg_bind() */
-static DEVICE_ATTR(ro, 0444, fsg_show_ro, NULL);
-static DEVICE_ATTR(nofua, 0644, fsg_show_nofua, NULL);
-static DEVICE_ATTR(file, 0444, fsg_show_file, NULL);
-
-
-/*-------------------------------------------------------------------------*/
-
-static void fsg_release(struct kref *ref)
-{
-        struct fsg_dev  *fsg = container_of(ref, struct fsg_dev, ref);
-
-        kfree(fsg->luns);
-        kfree(fsg);
-}
-
-static void lun_release(struct device *dev)
-{
-        struct rw_semaphore     *filesem = dev_get_drvdata(dev);
-        struct fsg_dev          *fsg =
-                container_of(filesem, struct fsg_dev, filesem);
-
-        kref_put(&fsg->ref, fsg_release);
-}
-
-static void /* __init_or_exit */ fsg_unbind(struct usb_gadget *gadget)
-{
-        struct fsg_dev          *fsg = get_gadget_data(gadget);
-        int                     i;
-        struct fsg_lun          *curlun;
-        struct usb_request      *req = fsg->ep0req;
-
-        DBG(fsg, "unbind\n");
-        clear_bit(REGISTERED, &fsg->atomic_bitflags);
-
-        /* If the thread isn't already dead, tell it to exit now */
-        if (fsg->state != FSG_STATE_TERMINATED) {
-                raise_exception(fsg, FSG_STATE_EXIT);
-                wait_for_completion(&fsg->thread_notifier);
-
-                /* The cleanup routine waits for this completion also */
-                complete(&fsg->thread_notifier);
-        }
-
-        /* Unregister the sysfs attribute files and the LUNs */
-        for (i = 0; i < fsg->nluns; ++i) {
-                curlun = &fsg->luns[i];
-                if (curlun->registered) {
-                        device_remove_file(&curlun->dev, &dev_attr_nofua);
-                        device_remove_file(&curlun->dev, &dev_attr_ro);
-                        device_remove_file(&curlun->dev, &dev_attr_file);
-                        fsg_lun_close(curlun);
-                        device_unregister(&curlun->dev);
-                        curlun->registered = 0;
-                }
-        }
-
-        /* Free the data buffers */
-        for (i = 0; i < fsg_num_buffers; ++i)
-                kfree(fsg->buffhds[i].buf);
-
-        /* Free the request and buffer for endpoint 0 */
-        if (req) {
-                kfree(req->buf);
-                usb_ep_free_request(fsg->ep0, req);
-        }
-
-        set_gadget_data(gadget, NULL);
-}
-
-
-static int __init check_parameters(struct fsg_dev *fsg)
-{
-        int     prot;
-
-        /* Store the default values */
-        mod_data.transport_type = USB_PR_BULK;
-        mod_data.transport_name = "Bulk-only";
-        mod_data.protocol_type = USB_SC_SCSI;
-        mod_data.protocol_name = "Transparent SCSI";
-
-        /* Some peripheral controllers are known not to be able to
-         * halt bulk endpoints correctly.  If one of them is present,
-         * disable stalls.
-         */
-        if (gadget_is_at91(fsg->gadget))
-                mod_data.can_stall = 0;
-
-        if (mod_data.release == 0xffff)
-                mod_data.release = get_default_bcdDevice();
-
-        prot = simple_strtol(mod_data.protocol_parm, NULL, 0);
-
-#ifdef CONFIG_USB_FILE_STORAGE_TEST
-        if (strnicmp(mod_data.transport_parm, "BBB", 10) == 0) {
-                ;               // Use default setting
-        } else if (strnicmp(mod_data.transport_parm, "CB", 10) == 0) {
-                mod_data.transport_type = USB_PR_CB;
-                mod_data.transport_name = "Control-Bulk";
-        } else if (strnicmp(mod_data.transport_parm, "CBI", 10) == 0) {
-                mod_data.transport_type = USB_PR_CBI;
-                mod_data.transport_name = "Control-Bulk-Interrupt";
-        } else {
-                ERROR(fsg, "invalid transport: %s\n", mod_data.transport_parm);
-                return -EINVAL;
-        }
-
-        if (strnicmp(mod_data.protocol_parm, "SCSI", 10) == 0 ||
-                        prot == USB_SC_SCSI) {
-                ;               // Use default setting
-        } else if (strnicmp(mod_data.protocol_parm, "RBC", 10) == 0 ||
-                        prot == USB_SC_RBC) {
-                mod_data.protocol_type = USB_SC_RBC;
-                mod_data.protocol_name = "RBC";
-        } else if (strnicmp(mod_data.protocol_parm, "8020", 4) == 0 ||
-                        strnicmp(mod_data.protocol_parm, "ATAPI", 10) == 0 ||
-                        prot == USB_SC_8020) {
-                mod_data.protocol_type = USB_SC_8020;
-                mod_data.protocol_name = "8020i (ATAPI)";
-        } else if (strnicmp(mod_data.protocol_parm, "QIC", 3) == 0 ||
-                        prot == USB_SC_QIC) {
-                mod_data.protocol_type = USB_SC_QIC;
-                mod_data.protocol_name = "QIC-157";
-        } else if (strnicmp(mod_data.protocol_parm, "UFI", 10) == 0 ||
-                        prot == USB_SC_UFI) {
-                mod_data.protocol_type = USB_SC_UFI;
-                mod_data.protocol_name = "UFI";
-        } else if (strnicmp(mod_data.protocol_parm, "8070", 4) == 0 ||
-                        prot == USB_SC_8070) {
-                mod_data.protocol_type = USB_SC_8070;
-                mod_data.protocol_name = "8070i";
-        } else {
-                ERROR(fsg, "invalid protocol: %s\n", mod_data.protocol_parm);
-                return -EINVAL;
-        }
-
-        mod_data.buflen &= PAGE_CACHE_MASK;
-        if (mod_data.buflen <= 0) {
-                ERROR(fsg, "invalid buflen\n");
-                return -ETOOSMALL;
-        }
-
-#endif /* CONFIG_USB_FILE_STORAGE_TEST */
-
-        /* Serial string handling.
-         * On a real device, the serial string would be loaded
-         * from permanent storage. */
-        if (mod_data.serial) {
-                const char *ch;
-                unsigned len = 0;
-
-                /* Sanity check :
-                 * The CB[I] specification limits the serial string to
-                 * 12 uppercase hexadecimal characters.
-                 * BBB need at least 12 uppercase hexadecimal characters,
-                 * with a maximum of 126. */
-                for (ch = mod_data.serial; *ch; ++ch) {
-                        ++len;
-                        if ((*ch < '0' || *ch > '9') &&
-                            (*ch < 'A' || *ch > 'F')) { /* not uppercase hex */
-                                WARNING(fsg,
-                                        "Invalid serial string character: %c\n",
-                                        *ch);
-                                goto no_serial;
-                        }
-                }
-                if (len > 126 ||
-                    (mod_data.transport_type == USB_PR_BULK && len < 12) ||
-                    (mod_data.transport_type != USB_PR_BULK && len > 12)) {
-                        WARNING(fsg, "Invalid serial string length!\n");
-                        goto no_serial;
-                }
-                fsg_strings[FSG_STRING_SERIAL - 1].s = mod_data.serial;
-        } else {
-                WARNING(fsg, "No serial-number string provided!\n");
- no_serial:
-                device_desc.iSerialNumber = 0;
-        }
-
-        return 0;
-}
-
-
-static int __init fsg_bind(struct usb_gadget *gadget,
-                struct usb_gadget_driver *driver)
-{
-        struct fsg_dev          *fsg = the_fsg;
-        int                     rc;
-        int                     i;
-        struct fsg_lun          *curlun;
-        struct usb_ep           *ep;
-        struct usb_request      *req;
-        char                    *pathbuf, *p;
-
-        fsg->gadget = gadget;
-        set_gadget_data(gadget, fsg);
-        fsg->ep0 = gadget->ep0;
-        fsg->ep0->driver_data = fsg;
-
-        if ((rc = check_parameters(fsg)) != 0)
-                goto out;
-
-        if (mod_data.removable) {       // Enable the store_xxx attributes
-                dev_attr_file.attr.mode = 0644;
-                dev_attr_file.store = fsg_store_file;
-                if (!mod_data.cdrom) {
-                        dev_attr_ro.attr.mode = 0644;
-                        dev_attr_ro.store = fsg_store_ro;
-                }
-        }
-
-        /* Only for removable media? */
-        dev_attr_nofua.attr.mode = 0644;
-        dev_attr_nofua.store = fsg_store_nofua;
-
-        /* Find out how many LUNs there should be */
-        i = mod_data.nluns;
-        if (i == 0)
-                i = max(mod_data.num_filenames, 1u);
-        if (i > FSG_MAX_LUNS) {
-                ERROR(fsg, "invalid number of LUNs: %d\n", i);
-                rc = -EINVAL;
-                goto out;
-        }
-
-        /* Create the LUNs, open their backing files, and register the
-         * LUN devices in sysfs. */
-        fsg->luns = kzalloc(i * sizeof(struct fsg_lun), GFP_KERNEL);
-        if (!fsg->luns) {
-                rc = -ENOMEM;
-                goto out;
-        }
-        fsg->nluns = i;
-
-        for (i = 0; i < fsg->nluns; ++i) {
-                curlun = &fsg->luns[i];
-                curlun->cdrom = !!mod_data.cdrom;
-                curlun->ro = mod_data.cdrom || mod_data.ro[i];
-                curlun->initially_ro = curlun->ro;
-                curlun->removable = mod_data.removable;
-                curlun->nofua = mod_data.nofua[i];
-                curlun->dev.release = lun_release;
-                curlun->dev.parent = &gadget->dev;
-                curlun->dev.driver = &fsg_driver.driver;
-                dev_set_drvdata(&curlun->dev, &fsg->filesem);
-                dev_set_name(&curlun->dev,"%s-lun%d",
-                             dev_name(&gadget->dev), i);
-
-                kref_get(&fsg->ref);
-                rc = device_register(&curlun->dev);
-                if (rc) {
-                        INFO(fsg, "failed to register LUN%d: %d\n", i, rc);
-                        put_device(&curlun->dev);
-                        goto out;
-                }
-                curlun->registered = 1;
-
-                rc = device_create_file(&curlun->dev, &dev_attr_ro);
-                if (rc)
-                        goto out;
-                rc = device_create_file(&curlun->dev, &dev_attr_nofua);
-                if (rc)
-                        goto out;
-                rc = device_create_file(&curlun->dev, &dev_attr_file);
-                if (rc)
-                        goto out;
-
-                if (mod_data.file[i] && *mod_data.file[i]) {
-                        rc = fsg_lun_open(curlun, mod_data.file[i]);
-                        if (rc)
-                                goto out;
-                } else if (!mod_data.removable) {
-                        ERROR(fsg, "no file given for LUN%d\n", i);
-                        rc = -EINVAL;
-                        goto out;
-                }
-        }
-
-        /* Find all the endpoints we will use */
-        usb_ep_autoconfig_reset(gadget);
-        ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc);
-        if (!ep)
-                goto autoconf_fail;
-        ep->driver_data = fsg;          // claim the endpoint
-        fsg->bulk_in = ep;
-
-        ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc);
-        if (!ep)
-                goto autoconf_fail;
-        ep->driver_data = fsg;          // claim the endpoint
-        fsg->bulk_out = ep;
-
-        if (transport_is_cbi()) {
-                ep = usb_ep_autoconfig(gadget, &fsg_fs_intr_in_desc);
-                if (!ep)
-                        goto autoconf_fail;
-                ep->driver_data = fsg;          // claim the endpoint
-                fsg->intr_in = ep;
-        }
-
-        /* Fix up the descriptors */
-        device_desc.idVendor = cpu_to_le16(mod_data.vendor);
-        device_desc.idProduct = cpu_to_le16(mod_data.product);
-        device_desc.bcdDevice = cpu_to_le16(mod_data.release);
-
-        i = (transport_is_cbi() ? 3 : 2);       // Number of endpoints
-        fsg_intf_desc.bNumEndpoints = i;
-        fsg_intf_desc.bInterfaceSubClass = mod_data.protocol_type;
-        fsg_intf_desc.bInterfaceProtocol = mod_data.transport_type;
-        fsg_fs_function[i + FSG_FS_FUNCTION_PRE_EP_ENTRIES] = NULL;
-
-        if (gadget_is_dualspeed(gadget)) {
-                fsg_hs_function[i + FSG_HS_FUNCTION_PRE_EP_ENTRIES] = NULL;
-
-                /* Assume endpoint addresses are the same for both speeds */
-                fsg_hs_bulk_in_desc.bEndpointAddress =
-                        fsg_fs_bulk_in_desc.bEndpointAddress;
-                fsg_hs_bulk_out_desc.bEndpointAddress =
-                        fsg_fs_bulk_out_desc.bEndpointAddress;
-                fsg_hs_intr_in_desc.bEndpointAddress =
-                        fsg_fs_intr_in_desc.bEndpointAddress;
-        }
-
-        if (gadget_is_superspeed(gadget)) {
-                unsigned                max_burst;
-
-                fsg_ss_function[i + FSG_SS_FUNCTION_PRE_EP_ENTRIES] = NULL;
-
-                /* Calculate bMaxBurst, we know packet size is 1024 */
-                max_burst = min_t(unsigned, mod_data.buflen / 1024, 15);
-
-                /* Assume endpoint addresses are the same for both speeds */
-                fsg_ss_bulk_in_desc.bEndpointAddress =
-                        fsg_fs_bulk_in_desc.bEndpointAddress;
-                fsg_ss_bulk_in_comp_desc.bMaxBurst = max_burst;
-
-                fsg_ss_bulk_out_desc.bEndpointAddress =
-                        fsg_fs_bulk_out_desc.bEndpointAddress;
-                fsg_ss_bulk_out_comp_desc.bMaxBurst = max_burst;
-        }
-
-        if (gadget_is_otg(gadget))
-                fsg_otg_desc.bmAttributes |= USB_OTG_HNP;
-
-        rc = -ENOMEM;
-
-        /* Allocate the request and buffer for endpoint 0 */
-        fsg->ep0req = req = usb_ep_alloc_request(fsg->ep0, GFP_KERNEL);
-        if (!req)
-                goto out;
-        req->buf = kmalloc(EP0_BUFSIZE, GFP_KERNEL);
-        if (!req->buf)
-                goto out;
-        req->complete = ep0_complete;
-
-        /* Allocate the data buffers */
-        for (i = 0; i < fsg_num_buffers; ++i) {
-                struct fsg_buffhd       *bh = &fsg->buffhds[i];
-
-                /* Allocate for the bulk-in endpoint.  We assume that
-                 * the buffer will also work with the bulk-out (and
-                 * interrupt-in) endpoint. */
-                bh->buf = kmalloc(mod_data.buflen, GFP_KERNEL);
-                if (!bh->buf)
-                        goto out;
-                bh->next = bh + 1;
-        }
-        fsg->buffhds[fsg_num_buffers - 1].next = &fsg->buffhds[0];
-
-        /* This should reflect the actual gadget power source */
-        usb_gadget_set_selfpowered(gadget);
-
-        snprintf(fsg_string_manufacturer, sizeof fsg_string_manufacturer,
-                        "%s %s with %s",
-                        init_utsname()->sysname, init_utsname()->release,
-                        gadget->name);
-
-        fsg->thread_task = kthread_create(fsg_main_thread, fsg,
-                        "file-storage-gadget");
-        if (IS_ERR(fsg->thread_task)) {
-                rc = PTR_ERR(fsg->thread_task);
-                goto out;
-        }
-
-        INFO(fsg, DRIVER_DESC ", version: " DRIVER_VERSION "\n");
-        INFO(fsg, "NOTE: This driver is deprecated.  "
-                        "Consider using g_mass_storage instead.\n");
-        INFO(fsg, "Number of LUNs=%d\n", fsg->nluns);
-
-        pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
-        for (i = 0; i < fsg->nluns; ++i) {
-                curlun = &fsg->luns[i];
-                if (fsg_lun_is_open(curlun)) {
-                        p = NULL;
-                        if (pathbuf) {
-                                p = d_path(&curlun->filp->f_path,
-                                           pathbuf, PATH_MAX);
-                                if (IS_ERR(p))
-                                        p = NULL;
-                        }
-                        LINFO(curlun, "ro=%d, nofua=%d, file: %s\n",
-                              curlun->ro, curlun->nofua, (p ? p : "(error)"));
-                }
-        }
-        kfree(pathbuf);
-
-        DBG(fsg, "transport=%s (x%02x)\n",
-                        mod_data.transport_name, mod_data.transport_type);
-        DBG(fsg, "protocol=%s (x%02x)\n",
-                        mod_data.protocol_name, mod_data.protocol_type);
-        DBG(fsg, "VendorID=x%04x, ProductID=x%04x, Release=x%04x\n",
-                        mod_data.vendor, mod_data.product, mod_data.release);
-        DBG(fsg, "removable=%d, stall=%d, cdrom=%d, buflen=%u\n",
-                        mod_data.removable, mod_data.can_stall,
-                        mod_data.cdrom, mod_data.buflen);
-        DBG(fsg, "I/O thread pid: %d\n", task_pid_nr(fsg->thread_task));
-
-        set_bit(REGISTERED, &fsg->atomic_bitflags);
-
-        /* Tell the thread to start working */
-        wake_up_process(fsg->thread_task);
-        return 0;
-
-autoconf_fail:
-        ERROR(fsg, "unable to autoconfigure all endpoints\n");
-        rc = -ENOTSUPP;
-
-out:
-        fsg->state = FSG_STATE_TERMINATED;      // The thread is dead
-        fsg_unbind(gadget);
-        complete(&fsg->thread_notifier);
-        return rc;
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-static void fsg_suspend(struct usb_gadget *gadget)
-{
-        struct fsg_dev          *fsg = get_gadget_data(gadget);
-
-        DBG(fsg, "suspend\n");
-        set_bit(SUSPENDED, &fsg->atomic_bitflags);
-}
-
-static void fsg_resume(struct usb_gadget *gadget)
-{
-        struct fsg_dev          *fsg = get_gadget_data(gadget);
-
-        DBG(fsg, "resume\n");
-        clear_bit(SUSPENDED, &fsg->atomic_bitflags);
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-static __refdata struct usb_gadget_driver               fsg_driver = {
-        .max_speed      = USB_SPEED_SUPER,
-        .function       = (char *) fsg_string_product,
-        .bind           = fsg_bind,
-        .unbind         = fsg_unbind,
-        .disconnect     = fsg_disconnect,
-        .setup          = fsg_setup,
-        .suspend        = fsg_suspend,
-        .resume         = fsg_resume,
-
-        .driver         = {
-                .name           = DRIVER_NAME,
-                .owner          = THIS_MODULE,
-                // .release = ...
-                // .suspend = ...
-                // .resume = ...
-        },
-};
-
-
-static int __init fsg_alloc(void)
-{
-        struct fsg_dev          *fsg;
-
-        fsg = kzalloc(sizeof *fsg +
-                      fsg_num_buffers * sizeof *(fsg->buffhds), GFP_KERNEL);
-
-        if (!fsg)
-                return -ENOMEM;
-        spin_lock_init(&fsg->lock);
-        init_rwsem(&fsg->filesem);
-        kref_init(&fsg->ref);
-        init_completion(&fsg->thread_notifier);
-
-        the_fsg = fsg;
-        return 0;
-}
-
-
-static int __init fsg_init(void)
-{
-        int             rc;
-        struct fsg_dev  *fsg;
-
-        rc = fsg_num_buffers_validate();
-        if (rc != 0)
-                return rc;
-
-        if ((rc = fsg_alloc()) != 0)
-                return rc;
-        fsg = the_fsg;
-        rc = usb_gadget_probe_driver(&fsg_driver);
-        if (rc != 0)
-                kref_put(&fsg->ref, fsg_release);
-        return rc;
-}
-module_init(fsg_init);
-
-
-static void __exit fsg_cleanup(void)
-{
-        struct fsg_dev  *fsg = the_fsg;
-
-        /* Unregister the driver iff the thread hasn't already done so */
-        if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
-                usb_gadget_unregister_driver(&fsg_driver);
-
-        /* Wait for the thread to finish up */
-        wait_for_completion(&fsg->thread_notifier);
-
-        kref_put(&fsg->ref, fsg_release);
-}
-module_exit(fsg_cleanup);
diff --git a/drivers/usb/gadget/fsl_qe_udc.c b/drivers/usb/gadget/fsl_qe_udc.c
index b09452d6f33a..ec50f18c8890 100644
--- a/drivers/usb/gadget/fsl_qe_udc.c
+++ b/drivers/usb/gadget/fsl_qe_udc.c
@@ -2347,7 +2347,7 @@ static int fsl_qe_stop(struct usb_gadget *gadget,
 }
 
 /* udc structure's alloc and setup, include ep-param alloc */
-static struct qe_udc __devinit *qe_udc_config(struct platform_device *ofdev)
+static struct qe_udc *qe_udc_config(struct platform_device *ofdev)
 {
         struct qe_udc *udc;
         struct device_node *np = ofdev->dev.of_node;
@@ -2402,7 +2402,7 @@ cleanup:
 }
 
 /* USB Controller register init */
-static int __devinit qe_udc_reg_init(struct qe_udc *udc)
+static int qe_udc_reg_init(struct qe_udc *udc)
 {
         struct usb_ctlr __iomem *qe_usbregs;
         qe_usbregs = udc->usb_regs;
@@ -2420,7 +2420,7 @@ static int __devinit qe_udc_reg_init(struct qe_udc *udc)
         return 0;
 }
 
-static int __devinit qe_ep_config(struct qe_udc *udc, unsigned char pipe_num)
+static int qe_ep_config(struct qe_udc *udc, unsigned char pipe_num)
 {
         struct qe_ep *ep = &udc->eps[pipe_num];
 
@@ -2473,7 +2473,7 @@ static void qe_udc_release(struct device *dev)
 
 /* Driver probe functions */
 static const struct of_device_id qe_udc_match[];
-static int __devinit qe_udc_probe(struct platform_device *ofdev)
+static int qe_udc_probe(struct platform_device *ofdev)
 {
         struct qe_udc *udc;
         const struct of_device_id *match;
@@ -2651,7 +2651,7 @@ static int qe_udc_resume(struct platform_device *dev)
 }
 #endif
 
-static int __devexit qe_udc_remove(struct platform_device *ofdev)
+static int qe_udc_remove(struct platform_device *ofdev)
 {
         struct qe_udc *udc = dev_get_drvdata(&ofdev->dev);
         struct qe_ep *ep;
@@ -2710,7 +2710,7 @@ static int __devexit qe_udc_remove(struct platform_device *ofdev)
 }
 
 /*-------------------------------------------------------------------------*/
-static const struct of_device_id qe_udc_match[] __devinitconst = {
+static const struct of_device_id qe_udc_match[] = {
         {
                 .compatible = "fsl,mpc8323-qe-usb",
                 .data = (void *)PORT_QE,
@@ -2735,7 +2735,7 @@ static struct platform_driver udc_driver = {
                 .of_match_table = qe_udc_match,
         },
         .probe          = qe_udc_probe,
-        .remove         = __devexit_p(qe_udc_remove),
+        .remove         = qe_udc_remove,
 #ifdef CONFIG_PM
         .suspend        = qe_udc_suspend,
         .resume         = qe_udc_resume,
diff --git a/drivers/usb/gadget/fsl_udc_core.c b/drivers/usb/gadget/fsl_udc_core.c
index 6ae70cba0c4a..c19f7f13790b 100644
--- a/drivers/usb/gadget/fsl_udc_core.c
+++ b/drivers/usb/gadget/fsl_udc_core.c
@@ -2126,7 +2126,7 @@ static int fsl_proc_read(char *page, char **start, off_t off, int count,
 
         tmp_reg = fsl_readl(&dr_regs->usbintr);
         t = scnprintf(next, size,
-                        "USB Intrrupt Enable Reg:\n"
+                        "USB Interrupt Enable Reg:\n"
                         "Sleep Enable: %d SOF Received Enable: %d "
                         "Reset Enable: %d\n"
                         "System Error Enable: %d "
diff --git a/drivers/usb/gadget/hid.c b/drivers/usb/gadget/hid.c
index 74130f6c12c0..c36260ea8bf2 100644
--- a/drivers/usb/gadget/hid.c
+++ b/drivers/usb/gadget/hid.c
@@ -203,7 +203,7 @@ static int __init hidg_plat_driver_probe(struct platform_device *pdev)
         return 0;
 }
 
-static int __devexit hidg_plat_driver_remove(struct platform_device *pdev)
+static int hidg_plat_driver_remove(struct platform_device *pdev)
 {
         struct hidg_func_node *e, *n;
 
@@ -229,7 +229,7 @@ static __refdata struct usb_composite_driver hidg_driver = {
 };
 
 static struct platform_driver hidg_plat_driver = {
-        .remove         = __devexit_p(hidg_plat_driver_remove),
+        .remove         = hidg_plat_driver_remove,
         .driver         = {
                 .owner  = THIS_MODULE,
                 .name   = "hidg",
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index 76494cabf4e4..8ac840f25ba9 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -76,7 +76,6 @@ MODULE_LICENSE ("GPL");
 /*----------------------------------------------------------------------*/
 
 #define GADGETFS_MAGIC          0xaee71ee7
-#define DMA_ADDR_INVALID        (~(dma_addr_t)0)
 
 /* /dev/gadget/$CHIP represents ep0 and the whole device */
 enum ep0_state {
@@ -918,7 +917,6 @@ static void clean_req (struct usb_ep *ep, struct usb_request *req)
         if (req->buf != dev->rbuf) {
                 kfree(req->buf);
                 req->buf = dev->rbuf;
-                req->dma = DMA_ADDR_INVALID;
         }
         req->complete = epio_complete;
         dev->setup_out_ready = 0;
@@ -1408,7 +1406,6 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
                 dev->setup_abort = 1;
 
         req->buf = dev->rbuf;
-        req->dma = DMA_ADDR_INVALID;
         req->context = NULL;
         value = -EOPNOTSUPP;
         switch (ctrl->bRequest) {
diff --git a/drivers/usb/gadget/lpc32xx_udc.c b/drivers/usb/gadget/lpc32xx_udc.c
index 21a9861dabf0..dd1c9b1fe528 100644
--- a/drivers/usb/gadget/lpc32xx_udc.c
+++ b/drivers/usb/gadget/lpc32xx_udc.c
@@ -2399,7 +2399,7 @@ static void udc_handle_ep0_setup(struct lpc32xx_udc *udc)
 
                 if (i < 0) {
                         /* setup processing failed, force stall */
-                        dev_err(udc->dev,
+                        dev_dbg(udc->dev,
                                 "req %02x.%02x protocol STALL; stat %d\n",
                                 reqtype, req, i);
                         udc->ep0state = WAIT_FOR_SETUP;
@@ -3352,7 +3352,7 @@ phy_fail:
         return retval;
 }
 
-static int __devexit lpc32xx_udc_remove(struct platform_device *pdev)
+static int lpc32xx_udc_remove(struct platform_device *pdev)
 {
         struct lpc32xx_udc *udc = platform_get_drvdata(pdev);
 
@@ -3447,7 +3447,7 @@ MODULE_DEVICE_TABLE(of, lpc32xx_udc_of_match);
 #endif
 
 static struct platform_driver lpc32xx_udc_driver = {
-        .remove         = __devexit_p(lpc32xx_udc_remove),
+        .remove         = lpc32xx_udc_remove,
         .shutdown       = lpc32xx_udc_shutdown,
         .suspend        = lpc32xx_udc_suspend,
         .resume         = lpc32xx_udc_resume,
diff --git a/drivers/usb/gadget/mv_u3d_core.c b/drivers/usb/gadget/mv_u3d_core.c
index 8cfd5b028dbd..b5cea273c957 100644
--- a/drivers/usb/gadget/mv_u3d_core.c
+++ b/drivers/usb/gadget/mv_u3d_core.c
@@ -1763,7 +1763,7 @@ static void mv_u3d_gadget_release(struct device *dev)
         dev_dbg(dev, "%s\n", __func__);
 }
 
-static __devexit int mv_u3d_remove(struct platform_device *dev)
+static int mv_u3d_remove(struct platform_device *dev)
 {
         struct mv_u3d *u3d = platform_get_drvdata(dev);
 
diff --git a/drivers/usb/gadget/mv_udc_core.c b/drivers/usb/gadget/mv_udc_core.c
index ea45224f78c8..379aac7b82fc 100644
--- a/drivers/usb/gadget/mv_udc_core.c
+++ b/drivers/usb/gadget/mv_udc_core.c
@@ -2128,7 +2128,7 @@ static void gadget_release(struct device *_dev)
         complete(udc->done);
 }
 
-static int __devexit mv_udc_remove(struct platform_device *dev)
+static int mv_udc_remove(struct platform_device *dev)
 {
         struct mv_udc *udc = the_controller;
         int clk_i;
@@ -2188,7 +2188,7 @@ static int __devexit mv_udc_remove(struct platform_device *dev)
         return 0;
 }
 
-static int __devinit mv_udc_probe(struct platform_device *dev)
+static int mv_udc_probe(struct platform_device *dev)
 {
         struct mv_usb_platform_data *pdata = dev->dev.platform_data;
         struct mv_udc *udc;
diff --git a/drivers/usb/gadget/net2272.c b/drivers/usb/gadget/net2272.c
index c009263a47e3..d226058e3b88 100644
--- a/drivers/usb/gadget/net2272.c
+++ b/drivers/usb/gadget/net2272.c
@@ -2193,7 +2193,7 @@ net2272_gadget_release(struct device *_dev)
 
 /*---------------------------------------------------------------------------*/
 
-static void __devexit
+static void
 net2272_remove(struct net2272 *dev)
 {
         usb_del_gadget_udc(&dev->gadget);
@@ -2215,8 +2215,7 @@ net2272_remove(struct net2272 *dev)
         dev_info(dev->dev, "unbind\n");
 }
 
-static struct net2272 * __devinit
-net2272_probe_init(struct device *dev, unsigned int irq)
+static struct net2272 *net2272_probe_init(struct device *dev, unsigned int irq)
 {
         struct net2272 *ret;
 
@@ -2246,7 +2245,7 @@ net2272_probe_init(struct device *dev, unsigned int irq)
         return ret;
 }
 
-static int __devinit
+static int
 net2272_probe_fin(struct net2272 *dev, unsigned int irqflags)
 {
         int ret;
@@ -2306,7 +2305,7 @@ err_add_udc:
  * don't respond over USB until a gadget driver binds to us
  */
 
-static int __devinit
+static int
 net2272_rdk1_probe(struct pci_dev *pdev, struct net2272 *dev)
 {
         unsigned long resource, len, tmp;
@@ -2389,7 +2388,7 @@ net2272_rdk1_probe(struct pci_dev *pdev, struct net2272 *dev)
         return ret;
 }
 
-static int __devinit
+static int
 net2272_rdk2_probe(struct pci_dev *pdev, struct net2272 *dev)
 {
         unsigned long resource, len;
@@ -2447,7 +2446,7 @@ net2272_rdk2_probe(struct pci_dev *pdev, struct net2272 *dev)
         return ret;
 }
 
-static int __devinit
+static int
 net2272_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
         struct net2272 *dev;
@@ -2489,7 +2488,7 @@ net2272_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         return ret;
 }
 
-static void __devexit
+static void
 net2272_rdk1_remove(struct pci_dev *pdev, struct net2272 *dev)
 {
         int i;
@@ -2511,7 +2510,7 @@ net2272_rdk1_remove(struct pci_dev *pdev, struct net2272 *dev)
         }
 }
 
-static void __devexit
+static void
 net2272_rdk2_remove(struct pci_dev *pdev, struct net2272 *dev)
 {
         int i;
@@ -2530,7 +2529,7 @@ net2272_rdk2_remove(struct pci_dev *pdev, struct net2272 *dev)
                         pci_resource_len(pdev, i));
 }
 
-static void __devexit
+static void
 net2272_pci_remove(struct pci_dev *pdev)
 {
         struct net2272 *dev = pci_get_drvdata(pdev);
@@ -2549,7 +2548,7 @@ net2272_pci_remove(struct pci_dev *pdev)
 }
 
 /* Table of matching PCI IDs */
-static struct pci_device_id __devinitdata pci_ids[] = {
+static struct pci_device_id pci_ids[] = {
         {       /* RDK 1 card */
                 .class       = ((PCI_CLASS_BRIDGE_OTHER << 8) | 0xfe),
                 .class_mask  = 0,
@@ -2575,7 +2574,7 @@ static struct pci_driver net2272_pci_driver = {
         .id_table = pci_ids,
 
         .probe    = net2272_pci_probe,
-        .remove   = __devexit_p(net2272_pci_remove),
+        .remove   = net2272_pci_remove,
 };
 
 static int net2272_pci_register(void)
@@ -2595,7 +2594,7 @@ static inline void net2272_pci_unregister(void) { }
 
 /*---------------------------------------------------------------------------*/
 
-static int __devinit
+static int
 net2272_plat_probe(struct platform_device *pdev)
 {
         struct net2272 *dev;
@@ -2661,7 +2660,7 @@ net2272_plat_probe(struct platform_device *pdev)
         return ret;
 }
 
-static int __devexit
+static int
 net2272_plat_remove(struct platform_device *pdev)
 {
         struct net2272 *dev = platform_get_drvdata(pdev);
@@ -2678,7 +2677,7 @@ net2272_plat_remove(struct platform_device *pdev)
 
 static struct platform_driver net2272_plat_driver = {
         .probe   = net2272_plat_probe,
-        .remove  = __devexit_p(net2272_plat_remove),
+        .remove  = net2272_plat_remove,
         .driver  = {
                 .name  = driver_name,
                 .owner = THIS_MODULE,
diff --git a/drivers/usb/gadget/net2280.c b/drivers/usb/gadget/net2280.c
index ac335af154ba..708c0b55dcc8 100644
--- a/drivers/usb/gadget/net2280.c
+++ b/drivers/usb/gadget/net2280.c
@@ -9,7 +9,7 @@
  * CODE STATUS HIGHLIGHTS
  *
  * This driver should work well with most "gadget" drivers, including
- * the File Storage, Serial, and Ethernet/RNDIS gadget drivers
+ * the Mass Storage, Serial, and Ethernet/RNDIS gadget drivers
  * as well as Gadget Zero and Gadgetfs.
  *
  * DMA is enabled by default.  Drivers using transfer queues might use
diff --git a/drivers/usb/gadget/omap_udc.c b/drivers/usb/gadget/omap_udc.c
index 2a4749c3eb3f..9412bf53b864 100644
--- a/drivers/usb/gadget/omap_udc.c
+++ b/drivers/usb/gadget/omap_udc.c
@@ -2506,7 +2506,7 @@ static inline void remove_proc_file(void) {}
  * UDC_SYSCON_1.CFG_LOCK is set can now work.  We won't use that
  * capability yet though.
  */
-static unsigned __devinit
+static unsigned
 omap_ep_setup(char *name, u8 addr, u8 type,
                 unsigned buf, unsigned maxp, int dbuf)
 {
@@ -2624,7 +2624,7 @@ static void omap_udc_release(struct device *dev)
         udc = NULL;
 }
 
-static int __devinit
+static int
 omap_udc_setup(struct platform_device *odev, struct usb_phy *xceiv)
 {
         unsigned        tmp, buf;
@@ -2761,7 +2761,7 @@ omap_udc_setup(struct platform_device *odev, struct usb_phy *xceiv)
         return 0;
 }
 
-static int __devinit omap_udc_probe(struct platform_device *pdev)
+static int omap_udc_probe(struct platform_device *pdev)
 {
         int                     status = -ENODEV;
         int                     hmc;
@@ -2974,7 +2974,7 @@ cleanup0:
         return status;
 }
 
-static int __devexit omap_udc_remove(struct platform_device *pdev)
+static int omap_udc_remove(struct platform_device *pdev)
 {
         DECLARE_COMPLETION_ONSTACK(done);
 
@@ -3060,7 +3060,7 @@ static int omap_udc_resume(struct platform_device *dev)
 
 static struct platform_driver udc_driver = {
         .probe          = omap_udc_probe,
-        .remove         = __devexit_p(omap_udc_remove),
+        .remove         = omap_udc_remove,
         .suspend        = omap_udc_suspend,
         .resume         = omap_udc_resume,
         .driver         = {
diff --git a/drivers/usb/gadget/printer.c b/drivers/usb/gadget/printer.c
index e156e3f26727..35bcc83d1e04 100644
--- a/drivers/usb/gadget/printer.c
+++ b/drivers/usb/gadget/printer.c
@@ -983,8 +983,10 @@ static int __init printer_func_bind(struct usb_configuration *c,
 {
         struct printer_dev *dev = container_of(f, struct printer_dev, function);
         struct usb_composite_dev *cdev = c->cdev;
-        struct usb_ep           *in_ep, *out_ep;
+        struct usb_ep *in_ep;
+        struct usb_ep *out_ep = NULL;
         int id;
+        int ret;
 
         id = usb_interface_id(c, f);
         if (id < 0)
@@ -1010,6 +1012,11 @@ autoconf_fail:
         hs_ep_in_desc.bEndpointAddress = fs_ep_in_desc.bEndpointAddress;
         hs_ep_out_desc.bEndpointAddress = fs_ep_out_desc.bEndpointAddress;
 
+        ret = usb_assign_descriptors(f, fs_printer_function,
+                        hs_printer_function, NULL);
+        if (ret)
+                return ret;
+
         dev->in_ep = in_ep;
         dev->out_ep = out_ep;
         return 0;
@@ -1018,6 +1025,7 @@ autoconf_fail:
 static void printer_func_unbind(struct usb_configuration *c,
                 struct usb_function *f)
 {
+        usb_free_all_descriptors(f);
 }
 
 static int printer_func_set_alt(struct usb_function *f,
@@ -1110,8 +1118,6 @@ static int __init printer_bind_config(struct usb_configuration *c)
         dev = &usb_printer_gadget;
 
         dev->function.name = shortname;
-        dev->function.descriptors = fs_printer_function;
-        dev->function.hs_descriptors = hs_printer_function;
         dev->function.bind = printer_func_bind;
         dev->function.setup = printer_func_setup;
         dev->function.unbind = printer_func_unbind;
diff --git a/drivers/usb/gadget/pxa27x_udc.h b/drivers/usb/gadget/pxa27x_udc.h
index a1d268c6f2cc..79d81a4b2344 100644
--- a/drivers/usb/gadget/pxa27x_udc.h
+++ b/drivers/usb/gadget/pxa27x_udc.h
@@ -418,7 +418,7 @@ struct udc_stats {
  * @irq: udc irq
  * @clk: udc clock
  * @usb_gadget: udc gadget structure
- * @driver: bound gadget (zero, g_ether, g_file_storage, ...)
+ * @driver: bound gadget (zero, g_ether, g_mass_storage, ...)
  * @dev: device
  * @mach: machine info, used to activate specific GPIO
  * @transceiver: external transceiver to handle vbus sense and D+ pullup
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index 6f696ee8b817..141971d9051e 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -3072,7 +3072,7 @@ static struct usb_gadget_ops s3c_hsotg_gadget_ops = {
  * creation) to give to the gadget driver. Setup the endpoint name, any
  * direction information and other state that may be required.
  */
-static void __devinit s3c_hsotg_initep(struct s3c_hsotg *hsotg,
+static void s3c_hsotg_initep(struct s3c_hsotg *hsotg,
                                        struct s3c_hsotg_ep *hs_ep,
                                        int epnum)
 {
@@ -3414,7 +3414,7 @@ static const struct file_operations ep_fops = {
  * with the same name as the device itself, in case we end up
  * with multiple blocks in future systems.
  */
-static void __devinit s3c_hsotg_create_debug(struct s3c_hsotg *hsotg)
+static void s3c_hsotg_create_debug(struct s3c_hsotg *hsotg)
 {
         struct dentry *root;
         unsigned epidx;
@@ -3460,7 +3460,7 @@ static void __devinit s3c_hsotg_create_debug(struct s3c_hsotg *hsotg)
  *
  * Cleanup (remove) the debugfs files for use on module exit.
  */
-static void __devexit s3c_hsotg_delete_debug(struct s3c_hsotg *hsotg)
+static void s3c_hsotg_delete_debug(struct s3c_hsotg *hsotg)
 {
         unsigned epidx;
 
@@ -3490,7 +3490,7 @@ static void s3c_hsotg_release(struct device *dev)
  * @pdev: The platform information for the driver
  */
 
-static int __devinit s3c_hsotg_probe(struct platform_device *pdev)
+static int s3c_hsotg_probe(struct platform_device *pdev)
 {
         struct s3c_hsotg_plat *plat = pdev->dev.platform_data;
         struct device *dev = &pdev->dev;
@@ -3675,7 +3675,7 @@ err_clk:
  * s3c_hsotg_remove - remove function for hsotg driver
  * @pdev: The platform information for the driver
  */
-static int __devexit s3c_hsotg_remove(struct platform_device *pdev)
+static int s3c_hsotg_remove(struct platform_device *pdev)
 {
         struct s3c_hsotg *hsotg = platform_get_drvdata(pdev);
 
@@ -3708,7 +3708,7 @@ static struct platform_driver s3c_hsotg_driver = {
                 .owner  = THIS_MODULE,
         },
         .probe          = s3c_hsotg_probe,
-        .remove         = __devexit_p(s3c_hsotg_remove),
+        .remove         = s3c_hsotg_remove,
         .suspend        = s3c_hsotg_suspend,
         .resume         = s3c_hsotg_resume,
 };
diff --git a/drivers/usb/gadget/s3c-hsudc.c b/drivers/usb/gadget/s3c-hsudc.c
index d8e785d4ad59..52379b11f080 100644
--- a/drivers/usb/gadget/s3c-hsudc.c
+++ b/drivers/usb/gadget/s3c-hsudc.c
@@ -1261,7 +1261,7 @@ static struct usb_gadget_ops s3c_hsudc_gadget_ops = {
         .vbus_draw      = s3c_hsudc_vbus_draw,
 };
 
-static int __devinit s3c_hsudc_probe(struct platform_device *pdev)
+static int s3c_hsudc_probe(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
         struct resource *res;
diff --git a/drivers/usb/gadget/storage_common.c b/drivers/usb/gadget/storage_common.c
index 8d9bcd8207c8..0e3ae43454a2 100644
--- a/drivers/usb/gadget/storage_common.c
+++ b/drivers/usb/gadget/storage_common.c
@@ -11,30 +11,10 @@
  * (at your option) any later version.
  */
 
-
 /*
  * This file requires the following identifiers used in USB strings to
  * be defined (each of type pointer to char):
- *  - fsg_string_manufacturer -- name of the manufacturer
- *  - fsg_string_product      -- name of the product
- *  - fsg_string_config       -- name of the configuration
  *  - fsg_string_interface    -- name of the interface
- * The first four are only needed when FSG_DESCRIPTORS_DEVICE_STRINGS
- * macro is defined prior to including this file.
- */
-
-/*
- * When FSG_NO_INTR_EP is defined fsg_fs_intr_in_desc and
- * fsg_hs_intr_in_desc objects as well as
- * FSG_FS_FUNCTION_PRE_EP_ENTRIES and FSG_HS_FUNCTION_PRE_EP_ENTRIES
- * macros are not defined.
- *
- * When FSG_NO_DEVICE_STRINGS is defined FSG_STRING_MANUFACTURER,
- * FSG_STRING_PRODUCT, FSG_STRING_SERIAL and FSG_STRING_CONFIG are not
- * defined (as well as corresponding entries in string tables are
- * missing) and FSG_STRING_INTERFACE has value of zero.
- *
- * When FSG_NO_OTG is defined fsg_otg_desc won't be defined.
  */
 
 /*
@@ -78,34 +58,6 @@
 #define LWARN(lun, fmt, args...)  dev_warn(&(lun)->dev, fmt, ## args)
 #define LINFO(lun, fmt, args...)  dev_info(&(lun)->dev, fmt, ## args)
 
-/*
- * Keep those macros in sync with those in
- * include/linux/usb/composite.h or else GCC will complain.  If they
- * are identical (the same names of arguments, white spaces in the
- * same places) GCC will allow redefinition otherwise (even if some
- * white space is removed or added) warning will be issued.
- *
- * Those macros are needed here because File Storage Gadget does not
- * include the composite.h header.  For composite gadgets those macros
- * are redundant since composite.h is included any way.
- *
- * One could check whether those macros are already defined (which
- * would indicate composite.h had been included) or not (which would
- * indicate we were in FSG) but this is not done because a warning is
- * desired if definitions here differ from the ones in composite.h.
- *
- * We want the definitions to match and be the same in File Storage
- * Gadget as well as Mass Storage Function (and so composite gadgets
- * using MSF).  If someone changes them in composite.h it will produce
- * a warning in this file when building MSF.
- */
-#define DBG(d, fmt, args...)     dev_dbg(&(d)->gadget->dev , fmt , ## args)
-#define VDBG(d, fmt, args...)    dev_vdbg(&(d)->gadget->dev , fmt , ## args)
-#define ERROR(d, fmt, args...)   dev_err(&(d)->gadget->dev , fmt , ## args)
-#define WARNING(d, fmt, args...) dev_warn(&(d)->gadget->dev , fmt , ## args)
-#define INFO(d, fmt, args...)    dev_info(&(d)->gadget->dev , fmt , ## args)
-
-
 
 #ifdef DUMP_MSGS
 
@@ -203,9 +155,12 @@ struct fsg_lun {
         struct device   dev;
 };
 
-#define fsg_lun_is_open(curlun) ((curlun)->filp != NULL)
+static inline bool fsg_lun_is_open(struct fsg_lun *curlun)
+{
+        return curlun->filp != NULL;
+}
 
-static struct fsg_lun *fsg_lun_from_dev(struct device *dev)
+static inline struct fsg_lun *fsg_lun_from_dev(struct device *dev)
 {
         return container_of(dev, struct fsg_lun, dev);
 }
@@ -308,26 +263,10 @@ static inline u32 get_unaligned_be24(u8 *buf)
 
 
 enum {
-#ifndef FSG_NO_DEVICE_STRINGS
-        FSG_STRING_MANUFACTURER = 1,
-        FSG_STRING_PRODUCT,
-        FSG_STRING_SERIAL,
-        FSG_STRING_CONFIG,
-#endif
         FSG_STRING_INTERFACE
 };
 
 
-#ifndef FSG_NO_OTG
-static struct usb_otg_descriptor
-fsg_otg_desc = {
-        .bLength =              sizeof fsg_otg_desc,
-        .bDescriptorType =      USB_DT_OTG,
-
-        .bmAttributes =         USB_OTG_SRP,
-};
-#endif
-
 /* There is only one interface. */
 
 static struct usb_interface_descriptor
@@ -367,37 +306,10 @@ fsg_fs_bulk_out_desc = {
         /* wMaxPacketSize set by autoconfiguration */
 };
 
-#ifndef FSG_NO_INTR_EP
-
-static struct usb_endpoint_descriptor
-fsg_fs_intr_in_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-
-        .bEndpointAddress =     USB_DIR_IN,
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(2),
-        .bInterval =            32,     /* frames -> 32 ms */
-};
-
-#ifndef FSG_NO_OTG
-#  define FSG_FS_FUNCTION_PRE_EP_ENTRIES        2
-#else
-#  define FSG_FS_FUNCTION_PRE_EP_ENTRIES        1
-#endif
-
-#endif
-
 static struct usb_descriptor_header *fsg_fs_function[] = {
-#ifndef FSG_NO_OTG
-        (struct usb_descriptor_header *) &fsg_otg_desc,
-#endif
         (struct usb_descriptor_header *) &fsg_intf_desc,
         (struct usb_descriptor_header *) &fsg_fs_bulk_in_desc,
         (struct usb_descriptor_header *) &fsg_fs_bulk_out_desc,
-#ifndef FSG_NO_INTR_EP
-        (struct usb_descriptor_header *) &fsg_fs_intr_in_desc,
-#endif
         NULL,
 };
 
@@ -431,37 +343,11 @@ fsg_hs_bulk_out_desc = {
         .bInterval =            1,      /* NAK every 1 uframe */
 };
 
-#ifndef FSG_NO_INTR_EP
-
-static struct usb_endpoint_descriptor
-fsg_hs_intr_in_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-
-        /* bEndpointAddress copied from fs_intr_in_desc during fsg_bind() */
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(2),
-        .bInterval =            9,      /* 2**(9-1) = 256 uframes -> 32 ms */
-};
-
-#ifndef FSG_NO_OTG
-#  define FSG_HS_FUNCTION_PRE_EP_ENTRIES        2
-#else
-#  define FSG_HS_FUNCTION_PRE_EP_ENTRIES        1
-#endif
-
-#endif
 
 static struct usb_descriptor_header *fsg_hs_function[] = {
-#ifndef FSG_NO_OTG
-        (struct usb_descriptor_header *) &fsg_otg_desc,
-#endif
         (struct usb_descriptor_header *) &fsg_intf_desc,
         (struct usb_descriptor_header *) &fsg_hs_bulk_in_desc,
         (struct usb_descriptor_header *) &fsg_hs_bulk_out_desc,
-#ifndef FSG_NO_INTR_EP
-        (struct usb_descriptor_header *) &fsg_hs_intr_in_desc,
-#endif
         NULL,
 };
 
@@ -499,34 +385,6 @@ static struct usb_ss_ep_comp_descriptor fsg_ss_bulk_out_comp_desc = {
         /*.bMaxBurst =          DYNAMIC, */
 };
 
-#ifndef FSG_NO_INTR_EP
-
-static struct usb_endpoint_descriptor
-fsg_ss_intr_in_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-
-        /* bEndpointAddress copied from fs_intr_in_desc during fsg_bind() */
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(2),
-        .bInterval =            9,      /* 2**(9-1) = 256 uframes -> 32 ms */
-};
-
-static struct usb_ss_ep_comp_descriptor fsg_ss_intr_in_comp_desc = {
-        .bLength =              sizeof(fsg_ss_bulk_in_comp_desc),
-        .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
-
-        .wBytesPerInterval =    cpu_to_le16(2),
-};
-
-#ifndef FSG_NO_OTG
-#  define FSG_SS_FUNCTION_PRE_EP_ENTRIES        2
-#else
-#  define FSG_SS_FUNCTION_PRE_EP_ENTRIES        1
-#endif
-
-#endif
-
 static __maybe_unused struct usb_ext_cap_descriptor fsg_ext_cap_desc = {
         .bLength =              USB_DT_USB_EXT_CAP_SIZE,
         .bDescriptorType =      USB_DT_DEVICE_CAPABILITY,
@@ -563,18 +421,11 @@ static __maybe_unused struct usb_bos_descriptor fsg_bos_desc = {
 };
 
 static struct usb_descriptor_header *fsg_ss_function[] = {
-#ifndef FSG_NO_OTG
-        (struct usb_descriptor_header *) &fsg_otg_desc,
-#endif
         (struct usb_descriptor_header *) &fsg_intf_desc,
         (struct usb_descriptor_header *) &fsg_ss_bulk_in_desc,
         (struct usb_descriptor_header *) &fsg_ss_bulk_in_comp_desc,
         (struct usb_descriptor_header *) &fsg_ss_bulk_out_desc,
         (struct usb_descriptor_header *) &fsg_ss_bulk_out_comp_desc,
-#ifndef FSG_NO_INTR_EP
-        (struct usb_descriptor_header *) &fsg_ss_intr_in_desc,
-        (struct usb_descriptor_header *) &fsg_ss_intr_in_comp_desc,
-#endif
         NULL,
 };
 
@@ -594,12 +445,6 @@ fsg_ep_desc(struct usb_gadget *g, struct usb_endpoint_descriptor *fs,
 
 /* Static strings, in UTF-8 (for simplicity we use only ASCII characters) */
 static struct usb_string                fsg_strings[] = {
-#ifndef FSG_NO_DEVICE_STRINGS
-        {FSG_STRING_MANUFACTURER,       fsg_string_manufacturer},
-        {FSG_STRING_PRODUCT,            fsg_string_product},
-        {FSG_STRING_SERIAL,             ""},
-        {FSG_STRING_CONFIG,             fsg_string_config},
-#endif
         {FSG_STRING_INTERFACE,          fsg_string_interface},
         {}
 };
diff --git a/drivers/usb/gadget/tcm_usb_gadget.c b/drivers/usb/gadget/tcm_usb_gadget.c
index 97e68b38cfdf..4f7f76f00c74 100644
--- a/drivers/usb/gadget/tcm_usb_gadget.c
+++ b/drivers/usb/gadget/tcm_usb_gadget.c
@@ -1384,7 +1384,7 @@ static struct se_node_acl *usbg_alloc_fabric_acl(struct se_portal_group *se_tpg)
 
         nacl = kzalloc(sizeof(struct usbg_nacl), GFP_KERNEL);
         if (!nacl) {
-                printk(KERN_ERR "Unable to alocate struct usbg_nacl\n");
+                printk(KERN_ERR "Unable to allocate struct usbg_nacl\n");
                 return NULL;
         }
 
@@ -2139,6 +2139,7 @@ static struct usb_descriptor_header *uasp_fs_function_desc[] = {
         (struct usb_descriptor_header *) &uasp_status_pipe_desc,
         (struct usb_descriptor_header *) &uasp_fs_cmd_desc,
         (struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
+        NULL,
 };
 
 static struct usb_descriptor_header *uasp_hs_function_desc[] = {
@@ -2239,6 +2240,7 @@ static int usbg_bind(struct usb_configuration *c, struct usb_function *f)
         struct usb_gadget       *gadget = c->cdev->gadget;
         struct usb_ep           *ep;
         int                     iface;
+        int                     ret;
 
         iface = usb_interface_id(c, f);
         if (iface < 0)
@@ -2289,6 +2291,11 @@ static int usbg_bind(struct usb_configuration *c, struct usb_function *f)
                 uasp_ss_status_desc.bEndpointAddress;
         uasp_fs_cmd_desc.bEndpointAddress = uasp_ss_cmd_desc.bEndpointAddress;
 
+        ret = usb_assign_descriptors(f, uasp_fs_function_desc,
+                        uasp_hs_function_desc, uasp_ss_function_desc);
+        if (ret)
+                goto ep_fail;
+
         return 0;
 ep_fail:
         pr_err("Can't claim all required eps\n");
@@ -2304,6 +2311,7 @@ static void usbg_unbind(struct usb_configuration *c, struct usb_function *f)
 {
         struct f_uas *fu = to_f_uas(f);
 
+        usb_free_all_descriptors(f);
         kfree(fu);
 }
 
@@ -2384,9 +2392,6 @@ static int usbg_cfg_bind(struct usb_configuration *c)
         if (!fu)
                 return -ENOMEM;
         fu->function.name = "Target Function";
-        fu->function.descriptors = uasp_fs_function_desc;
-        fu->function.hs_descriptors = uasp_hs_function_desc;
-        fu->function.ss_descriptors = uasp_ss_function_desc;
         fu->function.bind = usbg_bind;
         fu->function.unbind = usbg_unbind;
         fu->function.set_alt = usbg_set_alt;
diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c
index f3cd9690b101..4d90a800063c 100644
--- a/drivers/usb/gadget/udc-core.c
+++ b/drivers/usb/gadget/udc-core.c
@@ -439,16 +439,6 @@ static DEVICE_ATTR(name, S_IRUSR, usb_udc_##param##_show, NULL)
 static USB_UDC_SPEED_ATTR(current_speed, speed);
 static USB_UDC_SPEED_ATTR(maximum_speed, max_speed);
 
-/* TODO: Scheduled for removal in 3.8. */
-static ssize_t usb_udc_is_dualspeed_show(struct device *dev,
-                struct device_attribute *attr, char *buf)
-{
-        struct usb_udc          *udc = container_of(dev, struct usb_udc, dev);
-        return snprintf(buf, PAGE_SIZE, "%d\n",
-                        gadget_is_dualspeed(udc->gadget));
-}
-static DEVICE_ATTR(is_dualspeed, S_IRUSR, usb_udc_is_dualspeed_show, NULL);
-
 #define USB_UDC_ATTR(name)                                      \
 ssize_t usb_udc_##name##_show(struct device *dev,               \
                 struct device_attribute *attr, char *buf)       \
@@ -472,7 +462,6 @@ static struct attribute *usb_udc_attrs[] = {
         &dev_attr_current_speed.attr,
         &dev_attr_maximum_speed.attr,
 
-        &dev_attr_is_dualspeed.attr,
         &dev_attr_is_otg.attr,
         &dev_attr_is_a_peripheral.attr,
         &dev_attr_b_hnp_enable.attr,