Added missing tegra files.HEADmaster

39 files changed, 25590 insertions, 0 deletions

diff --git a/drivers/usb/core/inode.c b/drivers/usb/core/inode.c
new file mode 100644
index 00000000000..2278dad886e
--- /dev/null
+++ b/drivers/usb/core/inode.c
@@ -0,0 +1,776 @@
+/*****************************************************************************/
+
+/*
+ *      inode.c  --  Inode/Dentry functions for the USB device file system.
+ *
+ *      Copyright (C) 2000 Thomas Sailer (sailer@ife.ee.ethz.ch)
+ *      Copyright (C) 2001,2002,2004 Greg Kroah-Hartman (greg@kroah.com)
+ *
+ *      This program is free software; you can redistribute it and/or modify
+ *      it under the terms of the GNU General Public License as published by
+ *      the Free Software Foundation; either version 2 of the License, or
+ *      (at your option) any later version.
+ *
+ *      This program is distributed in the hope that it will be useful,
+ *      but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *      GNU General Public License for more details.
+ *
+ *      You should have received a copy of the GNU General Public License
+ *      along with this program; if not, write to the Free Software
+ *      Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *  History:
+ *   0.1  04.01.2000  Created
+ *   0.2  10.12.2001  converted to use the vfs layer better
+ */
+
+/*****************************************************************************/
+
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/mount.h>
+#include <linux/pagemap.h>
+#include <linux/init.h>
+#include <linux/proc_fs.h>
+#include <linux/usb.h>
+#include <linux/namei.h>
+#include <linux/usbdevice_fs.h>
+#include <linux/parser.h>
+#include <linux/notifier.h>
+#include <linux/seq_file.h>
+#include <linux/usb/hcd.h>
+#include <asm/byteorder.h>
+#include "usb.h"
+
+#define USBFS_DEFAULT_DEVMODE (S_IWUSR | S_IRUGO)
+#define USBFS_DEFAULT_BUSMODE (S_IXUGO | S_IRUGO)
+#define USBFS_DEFAULT_LISTMODE S_IRUGO
+
+static const struct file_operations default_file_operations;
+static struct vfsmount *usbfs_mount;
+static int usbfs_mount_count;   /* = 0 */
+static int ignore_mount = 0;
+
+static struct dentry *devices_usbfs_dentry;
+static int num_buses;   /* = 0 */
+
+static uid_t devuid;    /* = 0 */
+static uid_t busuid;    /* = 0 */
+static uid_t listuid;   /* = 0 */
+static gid_t devgid;    /* = 0 */
+static gid_t busgid;    /* = 0 */
+static gid_t listgid;   /* = 0 */
+static umode_t devmode = USBFS_DEFAULT_DEVMODE;
+static umode_t busmode = USBFS_DEFAULT_BUSMODE;
+static umode_t listmode = USBFS_DEFAULT_LISTMODE;
+
+static int usbfs_show_options(struct seq_file *seq, struct vfsmount *mnt)
+{
+        if (devuid != 0)
+                seq_printf(seq, ",devuid=%u", devuid);
+        if (devgid != 0)
+                seq_printf(seq, ",devgid=%u", devgid);
+        if (devmode != USBFS_DEFAULT_DEVMODE)
+                seq_printf(seq, ",devmode=%o", devmode);
+        if (busuid != 0)
+                seq_printf(seq, ",busuid=%u", busuid);
+        if (busgid != 0)
+                seq_printf(seq, ",busgid=%u", busgid);
+        if (busmode != USBFS_DEFAULT_BUSMODE)
+                seq_printf(seq, ",busmode=%o", busmode);
+        if (listuid != 0)
+                seq_printf(seq, ",listuid=%u", listuid);
+        if (listgid != 0)
+                seq_printf(seq, ",listgid=%u", listgid);
+        if (listmode != USBFS_DEFAULT_LISTMODE)
+                seq_printf(seq, ",listmode=%o", listmode);
+
+        return 0;
+}
+
+enum {
+        Opt_devuid, Opt_devgid, Opt_devmode,
+        Opt_busuid, Opt_busgid, Opt_busmode,
+        Opt_listuid, Opt_listgid, Opt_listmode,
+        Opt_err,
+};
+
+static const match_table_t tokens = {
+        {Opt_devuid, "devuid=%u"},
+        {Opt_devgid, "devgid=%u"},
+        {Opt_devmode, "devmode=%o"},
+        {Opt_busuid, "busuid=%u"},
+        {Opt_busgid, "busgid=%u"},
+        {Opt_busmode, "busmode=%o"},
+        {Opt_listuid, "listuid=%u"},
+        {Opt_listgid, "listgid=%u"},
+        {Opt_listmode, "listmode=%o"},
+        {Opt_err, NULL}
+};
+
+static int parse_options(struct super_block *s, char *data)
+{
+        char *p;
+        int option;
+
+        /* (re)set to defaults. */
+        devuid = 0;
+        busuid = 0;
+        listuid = 0;
+        devgid = 0;
+        busgid = 0;
+        listgid = 0;
+        devmode = USBFS_DEFAULT_DEVMODE;
+        busmode = USBFS_DEFAULT_BUSMODE;
+        listmode = USBFS_DEFAULT_LISTMODE;
+
+        while ((p = strsep(&data, ",")) != NULL) {
+                substring_t args[MAX_OPT_ARGS];
+                int token;
+                if (!*p)
+                        continue;
+
+                token = match_token(p, tokens, args);
+                switch (token) {
+                case Opt_devuid:
+                        if (match_int(&args[0], &option))
+                               return -EINVAL;
+                        devuid = option;
+                        break;
+                case Opt_devgid:
+                        if (match_int(&args[0], &option))
+                               return -EINVAL;
+                        devgid = option;
+                        break;
+                case Opt_devmode:
+                        if (match_octal(&args[0], &option))
+                                return -EINVAL;
+                        devmode = option & S_IRWXUGO;
+                        break;
+                case Opt_busuid:
+                        if (match_int(&args[0], &option))
+                               return -EINVAL;
+                        busuid = option;
+                        break;
+                case Opt_busgid:
+                        if (match_int(&args[0], &option))
+                               return -EINVAL;
+                        busgid = option;
+                        break;
+                case Opt_busmode:
+                        if (match_octal(&args[0], &option))
+                                return -EINVAL;
+                        busmode = option & S_IRWXUGO;
+                        break;
+                case Opt_listuid:
+                        if (match_int(&args[0], &option))
+                               return -EINVAL;
+                        listuid = option;
+                        break;
+                case Opt_listgid:
+                        if (match_int(&args[0], &option))
+                               return -EINVAL;
+                        listgid = option;
+                        break;
+                case Opt_listmode:
+                        if (match_octal(&args[0], &option))
+                                return -EINVAL;
+                        listmode = option & S_IRWXUGO;
+                        break;
+                default:
+                        printk(KERN_ERR "usbfs: unrecognised mount option "
+                               "\"%s\" or missing value\n", p);
+                        return -EINVAL;
+                }
+        }
+
+        return 0;
+}
+
+static void update_special(struct dentry *special)
+{
+        special->d_inode->i_uid = listuid;
+        special->d_inode->i_gid = listgid;
+        special->d_inode->i_mode = S_IFREG | listmode;
+}
+
+static void update_dev(struct dentry *dev)
+{
+        dev->d_inode->i_uid = devuid;
+        dev->d_inode->i_gid = devgid;
+        dev->d_inode->i_mode = S_IFREG | devmode;
+}
+
+static void update_bus(struct dentry *bus)
+{
+        struct dentry *dev = NULL;
+
+        bus->d_inode->i_uid = busuid;
+        bus->d_inode->i_gid = busgid;
+        bus->d_inode->i_mode = S_IFDIR | busmode;
+
+        mutex_lock(&bus->d_inode->i_mutex);
+
+        list_for_each_entry(dev, &bus->d_subdirs, d_u.d_child)
+                if (dev->d_inode)
+                        update_dev(dev);
+
+        mutex_unlock(&bus->d_inode->i_mutex);
+}
+
+static void update_sb(struct super_block *sb)
+{
+        struct dentry *root = sb->s_root;
+        struct dentry *bus = NULL;
+
+        if (!root)
+                return;
+
+        mutex_lock_nested(&root->d_inode->i_mutex, I_MUTEX_PARENT);
+
+        list_for_each_entry(bus, &root->d_subdirs, d_u.d_child) {
+                if (bus->d_inode) {
+                        switch (S_IFMT & bus->d_inode->i_mode) {
+                        case S_IFDIR:
+                                update_bus(bus);
+                                break;
+                        case S_IFREG:
+                                update_special(bus);
+                                break;
+                        default:
+                                printk(KERN_WARNING "usbfs: Unknown node %s "
+                                       "mode %x found on remount!\n",
+                                       bus->d_name.name, bus->d_inode->i_mode);
+                                break;
+                        }
+                }
+        }
+
+        mutex_unlock(&root->d_inode->i_mutex);
+}
+
+static int remount(struct super_block *sb, int *flags, char *data)
+{
+        /* If this is not a real mount,
+         * i.e. it's a simple_pin_fs from create_special_files,
+         * then ignore it.
+         */
+        if (ignore_mount)
+                return 0;
+
+        if (parse_options(sb, data)) {
+                printk(KERN_WARNING "usbfs: mount parameter error.\n");
+                return -EINVAL;
+        }
+
+        if (usbfs_mount && usbfs_mount->mnt_sb)
+                update_sb(usbfs_mount->mnt_sb);
+
+        return 0;
+}
+
+static struct inode *usbfs_get_inode (struct super_block *sb, int mode, dev_t dev)
+{
+        struct inode *inode = new_inode(sb);
+
+        if (inode) {
+                inode->i_ino = get_next_ino();
+                inode->i_mode = mode;
+                inode->i_uid = current_fsuid();
+                inode->i_gid = current_fsgid();
+                inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+                switch (mode & S_IFMT) {
+                default:
+                        init_special_inode(inode, mode, dev);
+                        break;
+                case S_IFREG:
+                        inode->i_fop = &default_file_operations;
+                        break;
+                case S_IFDIR:
+                        inode->i_op = &simple_dir_inode_operations;
+                        inode->i_fop = &simple_dir_operations;
+
+                        /* directory inodes start off with i_nlink == 2 (for "." entry) */
+                        inc_nlink(inode);
+                        break;
+                }
+        }
+        return inode; 
+}
+
+/* SMP-safe */
+static int usbfs_mknod (struct inode *dir, struct dentry *dentry, int mode,
+                        dev_t dev)
+{
+        struct inode *inode = usbfs_get_inode(dir->i_sb, mode, dev);
+        int error = -EPERM;
+
+        if (dentry->d_inode)
+                return -EEXIST;
+
+        if (inode) {
+                d_instantiate(dentry, inode);
+                dget(dentry);
+                error = 0;
+        }
+        return error;
+}
+
+static int usbfs_mkdir (struct inode *dir, struct dentry *dentry, int mode)
+{
+        int res;
+
+        mode = (mode & (S_IRWXUGO | S_ISVTX)) | S_IFDIR;
+        res = usbfs_mknod (dir, dentry, mode, 0);
+        if (!res)
+                inc_nlink(dir);
+        return res;
+}
+
+static int usbfs_create (struct inode *dir, struct dentry *dentry, int mode)
+{
+        mode = (mode & S_IALLUGO) | S_IFREG;
+        return usbfs_mknod (dir, dentry, mode, 0);
+}
+
+static inline int usbfs_positive (struct dentry *dentry)
+{
+        return dentry->d_inode && !d_unhashed(dentry);
+}
+
+static int usbfs_empty (struct dentry *dentry)
+{
+        struct list_head *list;
+
+        spin_lock(&dentry->d_lock);
+        list_for_each(list, &dentry->d_subdirs) {
+                struct dentry *de = list_entry(list, struct dentry, d_u.d_child);
+
+                spin_lock_nested(&de->d_lock, DENTRY_D_LOCK_NESTED);
+                if (usbfs_positive(de)) {
+                        spin_unlock(&de->d_lock);
+                        spin_unlock(&dentry->d_lock);
+                        return 0;
+                }
+                spin_unlock(&de->d_lock);
+        }
+        spin_unlock(&dentry->d_lock);
+        return 1;
+}
+
+static int usbfs_unlink (struct inode *dir, struct dentry *dentry)
+{
+        struct inode *inode = dentry->d_inode;
+        mutex_lock(&inode->i_mutex);
+        drop_nlink(dentry->d_inode);
+        dput(dentry);
+        mutex_unlock(&inode->i_mutex);
+        d_delete(dentry);
+        return 0;
+}
+
+static int usbfs_rmdir(struct inode *dir, struct dentry *dentry)
+{
+        int error = -ENOTEMPTY;
+        struct inode * inode = dentry->d_inode;
+
+        mutex_lock(&inode->i_mutex);
+        dentry_unhash(dentry);
+        if (usbfs_empty(dentry)) {
+                dont_mount(dentry);
+                drop_nlink(dentry->d_inode);
+                drop_nlink(dentry->d_inode);
+                dput(dentry);
+                inode->i_flags |= S_DEAD;
+                drop_nlink(dir);
+                error = 0;
+        }
+        mutex_unlock(&inode->i_mutex);
+        if (!error)
+                d_delete(dentry);
+        return error;
+}
+
+
+/* default file operations */
+static ssize_t default_read_file (struct file *file, char __user *buf,
+                                  size_t count, loff_t *ppos)
+{
+        return 0;
+}
+
+static ssize_t default_write_file (struct file *file, const char __user *buf,
+                                   size_t count, loff_t *ppos)
+{
+        return count;
+}
+
+static loff_t default_file_lseek (struct file *file, loff_t offset, int orig)
+{
+        loff_t retval = -EINVAL;
+
+        mutex_lock(&file->f_path.dentry->d_inode->i_mutex);
+        switch(orig) {
+        case 0:
+                if (offset > 0) {
+                        file->f_pos = offset;
+                        retval = file->f_pos;
+                } 
+                break;
+        case 1:
+                if ((offset + file->f_pos) > 0) {
+                        file->f_pos += offset;
+                        retval = file->f_pos;
+                } 
+                break;
+        default:
+                break;
+        }
+        mutex_unlock(&file->f_path.dentry->d_inode->i_mutex);
+        return retval;
+}
+
+static int default_open (struct inode *inode, struct file *file)
+{
+        if (inode->i_private)
+                file->private_data = inode->i_private;
+
+        return 0;
+}
+
+static const struct file_operations default_file_operations = {
+        .read =         default_read_file,
+        .write =        default_write_file,
+        .open =         default_open,
+        .llseek =       default_file_lseek,
+};
+
+static const struct super_operations usbfs_ops = {
+        .statfs =       simple_statfs,
+        .drop_inode =   generic_delete_inode,
+        .remount_fs =   remount,
+        .show_options = usbfs_show_options,
+};
+
+static int usbfs_fill_super(struct super_block *sb, void *data, int silent)
+{
+        struct inode *inode;
+        struct dentry *root;
+
+        sb->s_blocksize = PAGE_CACHE_SIZE;
+        sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
+        sb->s_magic = USBDEVICE_SUPER_MAGIC;
+        sb->s_op = &usbfs_ops;
+        sb->s_time_gran = 1;
+        inode = usbfs_get_inode(sb, S_IFDIR | 0755, 0);
+
+        if (!inode) {
+                dbg("%s: could not get inode!",__func__);
+                return -ENOMEM;
+        }
+
+        root = d_alloc_root(inode);
+        if (!root) {
+                dbg("%s: could not get root dentry!",__func__);
+                iput(inode);
+                return -ENOMEM;
+        }
+        sb->s_root = root;
+        return 0;
+}
+
+/*
+ * fs_create_by_name - create a file, given a name
+ * @name:       name of file
+ * @mode:       type of file
+ * @parent:     dentry of directory to create it in
+ * @dentry:     resulting dentry of file
+ *
+ * This function handles both regular files and directories.
+ */
+static int fs_create_by_name (const char *name, mode_t mode,
+                              struct dentry *parent, struct dentry **dentry)
+{
+        int error = 0;
+
+        /* If the parent is not specified, we create it in the root.
+         * We need the root dentry to do this, which is in the super 
+         * block. A pointer to that is in the struct vfsmount that we
+         * have around.
+         */
+        if (!parent ) {
+                if (usbfs_mount && usbfs_mount->mnt_sb) {
+                        parent = usbfs_mount->mnt_sb->s_root;
+                }
+        }
+
+        if (!parent) {
+                dbg("Ah! can not find a parent!");
+                return -EFAULT;
+        }
+
+        *dentry = NULL;
+        mutex_lock(&parent->d_inode->i_mutex);
+        *dentry = lookup_one_len(name, parent, strlen(name));
+        if (!IS_ERR(*dentry)) {
+                if ((mode & S_IFMT) == S_IFDIR)
+                        error = usbfs_mkdir (parent->d_inode, *dentry, mode);
+                else 
+                        error = usbfs_create (parent->d_inode, *dentry, mode);
+        } else
+                error = PTR_ERR(*dentry);
+        mutex_unlock(&parent->d_inode->i_mutex);
+
+        return error;
+}
+
+static struct dentry *fs_create_file (const char *name, mode_t mode,
+                                      struct dentry *parent, void *data,
+                                      const struct file_operations *fops,
+                                      uid_t uid, gid_t gid)
+{
+        struct dentry *dentry;
+        int error;
+
+        dbg("creating file '%s'",name);
+
+        error = fs_create_by_name (name, mode, parent, &dentry);
+        if (error) {
+                dentry = NULL;
+        } else {
+                if (dentry->d_inode) {
+                        if (data)
+                                dentry->d_inode->i_private = data;
+                        if (fops)
+                                dentry->d_inode->i_fop = fops;
+                        dentry->d_inode->i_uid = uid;
+                        dentry->d_inode->i_gid = gid;
+                }
+        }
+
+        return dentry;
+}
+
+static void fs_remove_file (struct dentry *dentry)
+{
+        struct dentry *parent = dentry->d_parent;
+        
+        if (!parent || !parent->d_inode)
+                return;
+
+        mutex_lock_nested(&parent->d_inode->i_mutex, I_MUTEX_PARENT);
+        if (usbfs_positive(dentry)) {
+                if (dentry->d_inode) {
+                        if (S_ISDIR(dentry->d_inode->i_mode))
+                                usbfs_rmdir(parent->d_inode, dentry);
+                        else
+                                usbfs_unlink(parent->d_inode, dentry);
+                dput(dentry);
+                }
+        }
+        mutex_unlock(&parent->d_inode->i_mutex);
+}
+
+/* --------------------------------------------------------------------- */
+
+static struct dentry *usb_mount(struct file_system_type *fs_type,
+        int flags, const char *dev_name, void *data)
+{
+        return mount_single(fs_type, flags, data, usbfs_fill_super);
+}
+
+static struct file_system_type usb_fs_type = {
+        .owner =        THIS_MODULE,
+        .name =         "usbfs",
+        .mount =        usb_mount,
+        .kill_sb =      kill_litter_super,
+};
+
+/* --------------------------------------------------------------------- */
+
+static int create_special_files (void)
+{
+        struct dentry *parent;
+        int retval;
+
+        /* the simple_pin_fs calls will call remount with no options
+         * without this flag that would overwrite the real mount options (if any)
+         */
+        ignore_mount = 1;
+
+        /* create the devices special file */
+        retval = simple_pin_fs(&usb_fs_type, &usbfs_mount, &usbfs_mount_count);
+        if (retval) {
+                printk(KERN_ERR "Unable to get usbfs mount\n");
+                goto exit;
+        }
+
+        ignore_mount = 0;
+
+        parent = usbfs_mount->mnt_sb->s_root;
+        devices_usbfs_dentry = fs_create_file ("devices",
+                                               listmode | S_IFREG, parent,
+                                               NULL, &usbfs_devices_fops,
+                                               listuid, listgid);
+        if (devices_usbfs_dentry == NULL) {
+                printk(KERN_ERR "Unable to create devices usbfs file\n");
+                retval = -ENODEV;
+                goto error_clean_mounts;
+        }
+
+        goto exit;
+        
+error_clean_mounts:
+        simple_release_fs(&usbfs_mount, &usbfs_mount_count);
+exit:
+        return retval;
+}
+
+static void remove_special_files (void)
+{
+        if (devices_usbfs_dentry)
+                fs_remove_file (devices_usbfs_dentry);
+        devices_usbfs_dentry = NULL;
+        simple_release_fs(&usbfs_mount, &usbfs_mount_count);
+}
+
+void usbfs_update_special (void)
+{
+        struct inode *inode;
+
+        if (devices_usbfs_dentry) {
+                inode = devices_usbfs_dentry->d_inode;
+                if (inode)
+                        inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+        }
+}
+
+static void usbfs_add_bus(struct usb_bus *bus)
+{
+        struct dentry *parent;
+        char name[8];
+        int retval;
+
+        /* create the special files if this is the first bus added */
+        if (num_buses == 0) {
+                retval = create_special_files();
+                if (retval)
+                        return;
+        }
+        ++num_buses;
+
+        sprintf (name, "%03d", bus->busnum);
+
+        parent = usbfs_mount->mnt_sb->s_root;
+        bus->usbfs_dentry = fs_create_file (name, busmode | S_IFDIR, parent,
+                                            bus, NULL, busuid, busgid);
+        if (bus->usbfs_dentry == NULL) {
+                printk(KERN_ERR "Error creating usbfs bus entry\n");
+                return;
+        }
+}
+
+static void usbfs_remove_bus(struct usb_bus *bus)
+{
+        if (bus->usbfs_dentry) {
+                fs_remove_file (bus->usbfs_dentry);
+                bus->usbfs_dentry = NULL;
+        }
+
+        --num_buses;
+        if (num_buses <= 0) {
+                remove_special_files();
+                num_buses = 0;
+        }
+}
+
+static void usbfs_add_device(struct usb_device *dev)
+{
+        char name[8];
+        int i;
+        int i_size;
+
+        sprintf (name, "%03d", dev->devnum);
+        dev->usbfs_dentry = fs_create_file (name, devmode | S_IFREG,
+                                            dev->bus->usbfs_dentry, dev,
+                                            &usbdev_file_operations,
+                                            devuid, devgid);
+        if (dev->usbfs_dentry == NULL) {
+                printk(KERN_ERR "Error creating usbfs device entry\n");
+                return;
+        }
+
+        /* Set the size of the device's file to be
+         * equal to the size of the device descriptors. */
+        i_size = sizeof (struct usb_device_descriptor);
+        for (i = 0; i < dev->descriptor.bNumConfigurations; ++i) {
+                struct usb_config_descriptor *config =
+                        (struct usb_config_descriptor *)dev->rawdescriptors[i];
+                i_size += le16_to_cpu(config->wTotalLength);
+        }
+        if (dev->usbfs_dentry->d_inode)
+                dev->usbfs_dentry->d_inode->i_size = i_size;
+}
+
+static void usbfs_remove_device(struct usb_device *dev)
+{
+        if (dev->usbfs_dentry) {
+                fs_remove_file (dev->usbfs_dentry);
+                dev->usbfs_dentry = NULL;
+        }
+}
+
+static int usbfs_notify(struct notifier_block *self, unsigned long action, void *dev)
+{
+        switch (action) {
+        case USB_DEVICE_ADD:
+                usbfs_add_device(dev);
+                break;
+        case USB_DEVICE_REMOVE:
+                usbfs_remove_device(dev);
+                break;
+        case USB_BUS_ADD:
+                usbfs_add_bus(dev);
+                break;
+        case USB_BUS_REMOVE:
+                usbfs_remove_bus(dev);
+        }
+
+        usbfs_update_special();
+        usbfs_conn_disc_event();
+        return NOTIFY_OK;
+}
+
+static struct notifier_block usbfs_nb = {
+        .notifier_call =        usbfs_notify,
+};
+
+/* --------------------------------------------------------------------- */
+
+static struct proc_dir_entry *usbdir = NULL;
+
+int __init usbfs_init(void)
+{
+        int retval;
+
+        retval = register_filesystem(&usb_fs_type);
+        if (retval)
+                return retval;
+
+        usb_register_notify(&usbfs_nb);
+
+        /* create mount point for usbfs */
+        usbdir = proc_mkdir("bus/usb", NULL);
+
+        return 0;
+}
+
+void usbfs_cleanup(void)
+{
+        usb_unregister_notify(&usbfs_nb);
+        unregister_filesystem(&usb_fs_type);
+        if (usbdir)
+                remove_proc_entry("bus/usb", NULL);
+}
+
diff --git a/drivers/usb/gadget/android.c b/drivers/usb/gadget/android.c
new file mode 100644
index 00000000000..fbafe8a3bca
--- /dev/null
+++ b/drivers/usb/gadget/android.c
@@ -0,0 +1,1181 @@
+/*
+ * Gadget Driver for Android
+ *
+ * Copyright (C) 2008 Google, Inc.
+ * Author: Mike Lockwood <lockwood@android.com>
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+/* #define DEBUG */
+/* #define VERBOSE_DEBUG */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+
+#include <linux/delay.h>
+#include <linux/kernel.h>
+#include <linux/utsname.h>
+#include <linux/platform_device.h>
+
+#include <linux/usb/ch9.h>
+#include <linux/usb/composite.h>
+#include <linux/usb/gadget.h>
+
+#include "gadget_chips.h"
+
+/*
+ * Kbuild is not very cooperative with respect to linking separately
+ * compiled library objects into one module.  So for now we won't use
+ * separate compilation ... ensuring init/exit sections work to shrink
+ * the runtime footprint, and giving us at least some parts of what
+ * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
+ */
+#include "usbstring.c"
+#include "config.c"
+#include "epautoconf.c"
+#include "composite.c"
+
+#include "f_mass_storage.c"
+#include "u_serial.c"
+#include "f_acm.c"
+#include "f_adb.c"
+#include "f_mtp.c"
+#include "f_accessory.c"
+#define USB_ETH_RNDIS y
+#include "f_rndis.c"
+#include "rndis.c"
+#include "u_ether.c"
+
+MODULE_AUTHOR("Mike Lockwood");
+MODULE_DESCRIPTION("Android Composite USB Driver");
+MODULE_LICENSE("GPL");
+MODULE_VERSION("1.0");
+
+static const char longname[] = "Gadget Android";
+
+/* Default vendor and product IDs, overridden by userspace */
+#define VENDOR_ID               0x18D1
+#define PRODUCT_ID              0x0001
+
+struct android_usb_function {
+        char *name;
+        void *config;
+
+        struct device *dev;
+        char *dev_name;
+        struct device_attribute **attributes;
+
+        /* for android_dev.enabled_functions */
+        struct list_head enabled_list;
+
+        /* Optional: initialization during gadget bind */
+        int (*init)(struct android_usb_function *, struct usb_composite_dev *);
+        /* Optional: cleanup during gadget unbind */
+        void (*cleanup)(struct android_usb_function *);
+
+        int (*bind_config)(struct android_usb_function *, struct usb_configuration *);
+
+        /* Optional: called when the configuration is removed */
+        void (*unbind_config)(struct android_usb_function *, struct usb_configuration *);
+        /* Optional: handle ctrl requests before the device is configured */
+        int (*ctrlrequest)(struct android_usb_function *,
+                                        struct usb_composite_dev *,
+                                        const struct usb_ctrlrequest *);
+};
+
+struct android_dev {
+        struct android_usb_function **functions;
+        struct list_head enabled_functions;
+        struct usb_composite_dev *cdev;
+        struct device *dev;
+
+        bool enabled;
+        struct mutex mutex;
+        bool connected;
+        bool sw_connected;
+        struct work_struct work;
+};
+
+static struct class *android_class;
+static struct android_dev *_android_dev;
+static int android_bind_config(struct usb_configuration *c);
+static void android_unbind_config(struct usb_configuration *c);
+
+/* string IDs are assigned dynamically */
+#define STRING_MANUFACTURER_IDX         0
+#define STRING_PRODUCT_IDX              1
+#define STRING_SERIAL_IDX               2
+
+static char manufacturer_string[256];
+static char product_string[256];
+static char serial_string[256];
+
+/* String Table */
+static struct usb_string strings_dev[] = {
+        [STRING_MANUFACTURER_IDX].s = manufacturer_string,
+        [STRING_PRODUCT_IDX].s = product_string,
+        [STRING_SERIAL_IDX].s = serial_string,
+        {  }                    /* end of list */
+};
+
+static struct usb_gadget_strings stringtab_dev = {
+        .language       = 0x0409,       /* en-us */
+        .strings        = strings_dev,
+};
+
+static struct usb_gadget_strings *dev_strings[] = {
+        &stringtab_dev,
+        NULL,
+};
+
+static struct usb_device_descriptor device_desc = {
+        .bLength              = sizeof(device_desc),
+        .bDescriptorType      = USB_DT_DEVICE,
+        .bcdUSB               = __constant_cpu_to_le16(0x0200),
+        .bDeviceClass         = USB_CLASS_PER_INTERFACE,
+        .idVendor             = __constant_cpu_to_le16(VENDOR_ID),
+        .idProduct            = __constant_cpu_to_le16(PRODUCT_ID),
+        .bcdDevice            = __constant_cpu_to_le16(0xffff),
+        .bNumConfigurations   = 1,
+};
+
+static struct usb_configuration android_config_driver = {
+        .label          = "android",
+        .unbind         = android_unbind_config,
+        .bConfigurationValue = 1,
+};
+
+static void android_work(struct work_struct *data)
+{
+        struct android_dev *dev = container_of(data, struct android_dev, work);
+        struct usb_composite_dev *cdev = dev->cdev;
+        char *disconnected[2] = { "USB_STATE=DISCONNECTED", NULL };
+        char *connected[2]    = { "USB_STATE=CONNECTED", NULL };
+        char *configured[2]   = { "USB_STATE=CONFIGURED", NULL };
+        char **uevent_envp = NULL;
+        unsigned long flags;
+
+        spin_lock_irqsave(&cdev->lock, flags);
+        if (cdev->config)
+                uevent_envp = configured;
+        else if (dev->connected != dev->sw_connected)
+                uevent_envp = dev->connected ? connected : disconnected;
+        dev->sw_connected = dev->connected;
+        spin_unlock_irqrestore(&cdev->lock, flags);
+
+        if (uevent_envp) {
+                kobject_uevent_env(&dev->dev->kobj, KOBJ_CHANGE, uevent_envp);
+                pr_info("%s: sent uevent %s\n", __func__, uevent_envp[0]);
+        } else {
+                pr_info("%s: did not send uevent (%d %d %p)\n", __func__,
+                         dev->connected, dev->sw_connected, cdev->config);
+        }
+}
+
+
+/*-------------------------------------------------------------------------*/
+/* Supported functions initialization */
+
+static int adb_function_init(struct android_usb_function *f, struct usb_composite_dev *cdev)
+{
+        return adb_setup();
+}
+
+static void adb_function_cleanup(struct android_usb_function *f)
+{
+        adb_cleanup();
+}
+
+static int adb_function_bind_config(struct android_usb_function *f, struct usb_configuration *c)
+{
+        return adb_bind_config(c);
+}
+
+static struct android_usb_function adb_function = {
+        .name           = "adb",
+        .init           = adb_function_init,
+        .cleanup        = adb_function_cleanup,
+        .bind_config    = adb_function_bind_config,
+};
+
+
+#define MAX_ACM_INSTANCES 4
+struct acm_function_config {
+        int instances;
+};
+
+static int acm_function_init(struct android_usb_function *f, struct usb_composite_dev *cdev)
+{
+        f->config = kzalloc(sizeof(struct acm_function_config), GFP_KERNEL);
+        if (!f->config)
+                return -ENOMEM;
+
+        return gserial_setup(cdev->gadget, MAX_ACM_INSTANCES);
+}
+
+static void acm_function_cleanup(struct android_usb_function *f)
+{
+        gserial_cleanup();
+        kfree(f->config);
+        f->config = NULL;
+}
+
+static int acm_function_bind_config(struct android_usb_function *f, struct usb_configuration *c)
+{
+        int i;
+        int ret = 0;
+        struct acm_function_config *config = f->config;
+
+        for (i = 0; i < config->instances; i++) {
+                ret = acm_bind_config(c, i);
+                if (ret) {
+                        pr_err("Could not bind acm%u config\n", i);
+                        break;
+                }
+        }
+
+        return ret;
+}
+
+static ssize_t acm_instances_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct acm_function_config *config = f->config;
+        return sprintf(buf, "%d\n", config->instances);
+}
+
+static ssize_t acm_instances_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t size)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct acm_function_config *config = f->config;
+        int value;
+
+        sscanf(buf, "%d", &value);
+        if (value > MAX_ACM_INSTANCES)
+                value = MAX_ACM_INSTANCES;
+        config->instances = value;
+        return size;
+}
+
+static DEVICE_ATTR(instances, S_IRUGO | S_IWUSR, acm_instances_show, acm_instances_store);
+static struct device_attribute *acm_function_attributes[] = { &dev_attr_instances, NULL };
+
+static struct android_usb_function acm_function = {
+        .name           = "acm",
+        .init           = acm_function_init,
+        .cleanup        = acm_function_cleanup,
+        .bind_config    = acm_function_bind_config,
+        .attributes     = acm_function_attributes,
+};
+
+
+static int mtp_function_init(struct android_usb_function *f, struct usb_composite_dev *cdev)
+{
+        return mtp_setup();
+}
+
+static void mtp_function_cleanup(struct android_usb_function *f)
+{
+        mtp_cleanup();
+}
+
+static int mtp_function_bind_config(struct android_usb_function *f, struct usb_configuration *c)
+{
+        return mtp_bind_config(c, false);
+}
+
+static int ptp_function_init(struct android_usb_function *f, struct usb_composite_dev *cdev)
+{
+        /* nothing to do - initialization is handled by mtp_function_init */
+        return 0;
+}
+
+static void ptp_function_cleanup(struct android_usb_function *f)
+{
+        /* nothing to do - cleanup is handled by mtp_function_cleanup */
+}
+
+static int ptp_function_bind_config(struct android_usb_function *f, struct usb_configuration *c)
+{
+        return mtp_bind_config(c, true);
+}
+
+static int mtp_function_ctrlrequest(struct android_usb_function *f,
+                                                struct usb_composite_dev *cdev,
+                                                const struct usb_ctrlrequest *c)
+{
+        return mtp_ctrlrequest(cdev, c);
+}
+
+static struct android_usb_function mtp_function = {
+        .name           = "mtp",
+        .init           = mtp_function_init,
+        .cleanup        = mtp_function_cleanup,
+        .bind_config    = mtp_function_bind_config,
+        .ctrlrequest    = mtp_function_ctrlrequest,
+};
+
+/* PTP function is same as MTP with slightly different interface descriptor */
+static struct android_usb_function ptp_function = {
+        .name           = "ptp",
+        .init           = ptp_function_init,
+        .cleanup        = ptp_function_cleanup,
+        .bind_config    = ptp_function_bind_config,
+};
+
+
+struct rndis_function_config {
+        u8      ethaddr[ETH_ALEN];
+        u32     vendorID;
+        char    manufacturer[256];
+        bool    wceis;
+};
+
+static int rndis_function_init(struct android_usb_function *f, struct usb_composite_dev *cdev)
+{
+        f->config = kzalloc(sizeof(struct rndis_function_config), GFP_KERNEL);
+        if (!f->config)
+                return -ENOMEM;
+        return 0;
+}
+
+static void rndis_function_cleanup(struct android_usb_function *f)
+{
+        kfree(f->config);
+        f->config = NULL;
+}
+
+static int rndis_function_bind_config(struct android_usb_function *f,
+                                        struct usb_configuration *c)
+{
+        int ret;
+        struct rndis_function_config *rndis = f->config;
+
+        if (!rndis) {
+                pr_err("%s: rndis_pdata\n", __func__);
+                return -1;
+        }
+
+        pr_info("%s MAC: %02X:%02X:%02X:%02X:%02X:%02X\n", __func__,
+                rndis->ethaddr[0], rndis->ethaddr[1], rndis->ethaddr[2],
+                rndis->ethaddr[3], rndis->ethaddr[4], rndis->ethaddr[5]);
+
+        ret = gether_setup_name(c->cdev->gadget, rndis->ethaddr, "rndis");
+        if (ret) {
+                pr_err("%s: gether_setup failed\n", __func__);
+                return ret;
+        }
+
+        if (rndis->wceis) {
+                /* "Wireless" RNDIS; auto-detected by Windows */
+                rndis_iad_descriptor.bFunctionClass =
+                                                USB_CLASS_WIRELESS_CONTROLLER;
+                rndis_iad_descriptor.bFunctionSubClass = 0x01;
+                rndis_iad_descriptor.bFunctionProtocol = 0x03;
+                rndis_control_intf.bInterfaceClass =
+                                                USB_CLASS_WIRELESS_CONTROLLER;
+                rndis_control_intf.bInterfaceSubClass =  0x01;
+                rndis_control_intf.bInterfaceProtocol =  0x03;
+        }
+
+        return rndis_bind_config(c, rndis->ethaddr, rndis->vendorID,
+                                    rndis->manufacturer);
+}
+
+static void rndis_function_unbind_config(struct android_usb_function *f,
+                                                struct usb_configuration *c)
+{
+        gether_cleanup();
+}
+
+static ssize_t rndis_manufacturer_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct rndis_function_config *config = f->config;
+        return sprintf(buf, "%s\n", config->manufacturer);
+}
+
+static ssize_t rndis_manufacturer_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t size)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct rndis_function_config *config = f->config;
+
+        if (size >= sizeof(config->manufacturer))
+                return -EINVAL;
+        if (sscanf(buf, "%s", config->manufacturer) == 1)
+                return size;
+        return -1;
+}
+
+static DEVICE_ATTR(manufacturer, S_IRUGO | S_IWUSR, rndis_manufacturer_show,
+                                                    rndis_manufacturer_store);
+
+static ssize_t rndis_wceis_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct rndis_function_config *config = f->config;
+        return sprintf(buf, "%d\n", config->wceis);
+}
+
+static ssize_t rndis_wceis_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t size)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct rndis_function_config *config = f->config;
+        int value;
+
+        if (sscanf(buf, "%d", &value) == 1) {
+                config->wceis = value;
+                return size;
+        }
+        return -EINVAL;
+}
+
+static DEVICE_ATTR(wceis, S_IRUGO | S_IWUSR, rndis_wceis_show,
+                                             rndis_wceis_store);
+
+static ssize_t rndis_ethaddr_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct rndis_function_config *rndis = f->config;
+        return sprintf(buf, "%02x:%02x:%02x:%02x:%02x:%02x\n",
+                rndis->ethaddr[0], rndis->ethaddr[1], rndis->ethaddr[2],
+                rndis->ethaddr[3], rndis->ethaddr[4], rndis->ethaddr[5]);
+}
+
+static ssize_t rndis_ethaddr_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t size)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct rndis_function_config *rndis = f->config;
+
+        if (sscanf(buf, "%02x:%02x:%02x:%02x:%02x:%02x\n",
+                    (int *)&rndis->ethaddr[0], (int *)&rndis->ethaddr[1],
+                    (int *)&rndis->ethaddr[2], (int *)&rndis->ethaddr[3],
+                    (int *)&rndis->ethaddr[4], (int *)&rndis->ethaddr[5]) == 6)
+                return size;
+        return -EINVAL;
+}
+
+static DEVICE_ATTR(ethaddr, S_IRUGO | S_IWUSR, rndis_ethaddr_show,
+                                               rndis_ethaddr_store);
+
+static ssize_t rndis_vendorID_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct rndis_function_config *config = f->config;
+        return sprintf(buf, "%04x\n", config->vendorID);
+}
+
+static ssize_t rndis_vendorID_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t size)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct rndis_function_config *config = f->config;
+        int value;
+
+        if (sscanf(buf, "%04x", &value) == 1) {
+                config->vendorID = value;
+                return size;
+        }
+        return -EINVAL;
+}
+
+static DEVICE_ATTR(vendorID, S_IRUGO | S_IWUSR, rndis_vendorID_show,
+                                                rndis_vendorID_store);
+
+static struct device_attribute *rndis_function_attributes[] = {
+        &dev_attr_manufacturer,
+        &dev_attr_wceis,
+        &dev_attr_ethaddr,
+        &dev_attr_vendorID,
+        NULL
+};
+
+static struct android_usb_function rndis_function = {
+        .name           = "rndis",
+        .init           = rndis_function_init,
+        .cleanup        = rndis_function_cleanup,
+        .bind_config    = rndis_function_bind_config,
+        .unbind_config  = rndis_function_unbind_config,
+        .attributes     = rndis_function_attributes,
+};
+
+
+struct mass_storage_function_config {
+        struct fsg_config fsg;
+        struct fsg_common *common;
+};
+
+static int mass_storage_function_init(struct android_usb_function *f,
+                                        struct usb_composite_dev *cdev)
+{
+        struct mass_storage_function_config *config;
+        struct fsg_common *common;
+        int err;
+
+        config = kzalloc(sizeof(struct mass_storage_function_config),
+                                                                GFP_KERNEL);
+        if (!config)
+                return -ENOMEM;
+
+        config->fsg.nluns = 1;
+        config->fsg.luns[0].removable = 1;
+
+        common = fsg_common_init(NULL, cdev, &config->fsg);
+        if (IS_ERR(common)) {
+                kfree(config);
+                return PTR_ERR(common);
+        }
+
+        err = sysfs_create_link(&f->dev->kobj,
+                                &common->luns[0].dev.kobj,
+                                "lun");
+        if (err) {
+                kfree(config);
+                return err;
+        }
+
+        config->common = common;
+        f->config = config;
+        return 0;
+}
+
+static void mass_storage_function_cleanup(struct android_usb_function *f)
+{
+        kfree(f->config);
+        f->config = NULL;
+}
+
+static int mass_storage_function_bind_config(struct android_usb_function *f,
+                                                struct usb_configuration *c)
+{
+        struct mass_storage_function_config *config = f->config;
+        return fsg_bind_config(c->cdev, c, config->common);
+}
+
+static ssize_t mass_storage_inquiry_show(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct mass_storage_function_config *config = f->config;
+        return sprintf(buf, "%s\n", config->common->inquiry_string);
+}
+
+static ssize_t mass_storage_inquiry_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t size)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct mass_storage_function_config *config = f->config;
+        if (size >= sizeof(config->common->inquiry_string))
+                return -EINVAL;
+        if (sscanf(buf, "%s", config->common->inquiry_string) != 1)
+                return -EINVAL;
+        return size;
+}
+
+static DEVICE_ATTR(inquiry_string, S_IRUGO | S_IWUSR,
+                                        mass_storage_inquiry_show,
+                                        mass_storage_inquiry_store);
+
+static struct device_attribute *mass_storage_function_attributes[] = {
+        &dev_attr_inquiry_string,
+        NULL
+};
+
+static struct android_usb_function mass_storage_function = {
+        .name           = "mass_storage",
+        .init           = mass_storage_function_init,
+        .cleanup        = mass_storage_function_cleanup,
+        .bind_config    = mass_storage_function_bind_config,
+        .attributes     = mass_storage_function_attributes,
+};
+
+
+static int accessory_function_init(struct android_usb_function *f,
+                                        struct usb_composite_dev *cdev)
+{
+        return acc_setup();
+}
+
+static void accessory_function_cleanup(struct android_usb_function *f)
+{
+        acc_cleanup();
+}
+
+static int accessory_function_bind_config(struct android_usb_function *f,
+                                                struct usb_configuration *c)
+{
+        return acc_bind_config(c);
+}
+
+static int accessory_function_ctrlrequest(struct android_usb_function *f,
+                                                struct usb_composite_dev *cdev,
+                                                const struct usb_ctrlrequest *c)
+{
+        return acc_ctrlrequest(cdev, c);
+}
+
+static struct android_usb_function accessory_function = {
+        .name           = "accessory",
+        .init           = accessory_function_init,
+        .cleanup        = accessory_function_cleanup,
+        .bind_config    = accessory_function_bind_config,
+        .ctrlrequest    = accessory_function_ctrlrequest,
+};
+
+
+static struct android_usb_function *supported_functions[] = {
+        &adb_function,
+        &acm_function,
+        &mtp_function,
+        &ptp_function,
+        &rndis_function,
+        &mass_storage_function,
+        &accessory_function,
+        NULL
+};
+
+
+static int android_init_functions(struct android_usb_function **functions,
+                                  struct usb_composite_dev *cdev)
+{
+        struct android_dev *dev = _android_dev;
+        struct android_usb_function *f;
+        struct device_attribute **attrs;
+        struct device_attribute *attr;
+        int err;
+        int index = 0;
+
+        for (; (f = *functions++); index++) {
+                f->dev_name = kasprintf(GFP_KERNEL, "f_%s", f->name);
+                f->dev = device_create(android_class, dev->dev,
+                                MKDEV(0, index), f, f->dev_name);
+                if (IS_ERR(f->dev)) {
+                        pr_err("%s: Failed to create dev %s", __func__,
+                                                        f->dev_name);
+                        err = PTR_ERR(f->dev);
+                        goto err_create;
+                }
+
+                if (f->init) {
+                        err = f->init(f, cdev);
+                        if (err) {
+                                pr_err("%s: Failed to init %s", __func__,
+                                                                f->name);
+                                goto err_out;
+                        }
+                }
+
+                attrs = f->attributes;
+                if (attrs) {
+                        while ((attr = *attrs++) && !err)
+                                err = device_create_file(f->dev, attr);
+                }
+                if (err) {
+                        pr_err("%s: Failed to create function %s attributes",
+                                        __func__, f->name);
+                        goto err_out;
+                }
+        }
+        return 0;
+
+err_out:
+        device_destroy(android_class, f->dev->devt);
+err_create:
+        kfree(f->dev_name);
+        return err;
+}
+
+static void android_cleanup_functions(struct android_usb_function **functions)
+{
+        struct android_usb_function *f;
+
+        while (*functions) {
+                f = *functions++;
+
+                if (f->dev) {
+                        device_destroy(android_class, f->dev->devt);
+                        kfree(f->dev_name);
+                }
+
+                if (f->cleanup)
+                        f->cleanup(f);
+        }
+}
+
+static int
+android_bind_enabled_functions(struct android_dev *dev,
+                               struct usb_configuration *c)
+{
+        struct android_usb_function *f;
+        int ret;
+
+        list_for_each_entry(f, &dev->enabled_functions, enabled_list) {
+                ret = f->bind_config(f, c);
+                if (ret) {
+                        pr_err("%s: %s failed", __func__, f->name);
+                        return ret;
+                }
+        }
+        return 0;
+}
+
+static void
+android_unbind_enabled_functions(struct android_dev *dev,
+                               struct usb_configuration *c)
+{
+        struct android_usb_function *f;
+
+        list_for_each_entry(f, &dev->enabled_functions, enabled_list) {
+                if (f->unbind_config)
+                        f->unbind_config(f, c);
+        }
+}
+
+static int android_enable_function(struct android_dev *dev, char *name)
+{
+        struct android_usb_function **functions = dev->functions;
+        struct android_usb_function *f;
+        while ((f = *functions++)) {
+                if (!strcmp(name, f->name)) {
+                        list_add_tail(&f->enabled_list, &dev->enabled_functions);
+                        return 0;
+                }
+        }
+        return -EINVAL;
+}
+
+/*-------------------------------------------------------------------------*/
+/* /sys/class/android_usb/android%d/ interface */
+
+static ssize_t
+functions_show(struct device *pdev, struct device_attribute *attr, char *buf)
+{
+        struct android_dev *dev = dev_get_drvdata(pdev);
+        struct android_usb_function *f;
+        char *buff = buf;
+
+        mutex_lock(&dev->mutex);
+
+        list_for_each_entry(f, &dev->enabled_functions, enabled_list)
+                buff += sprintf(buff, "%s,", f->name);
+
+        mutex_unlock(&dev->mutex);
+
+        if (buff != buf)
+                *(buff-1) = '\n';
+        return buff - buf;
+}
+
+static ssize_t
+functions_store(struct device *pdev, struct device_attribute *attr,
+                               const char *buff, size_t size)
+{
+        struct android_dev *dev = dev_get_drvdata(pdev);
+        char *name;
+        char buf[256], *b;
+        int err;
+
+        mutex_lock(&dev->mutex);
+
+        if (dev->enabled) {
+                mutex_unlock(&dev->mutex);
+                return -EBUSY;
+        }
+
+        INIT_LIST_HEAD(&dev->enabled_functions);
+
+        strncpy(buf, buff, sizeof(buf));
+        b = strim(buf);
+
+        while (b) {
+                name = strsep(&b, ",");
+                if (name) {
+                        err = android_enable_function(dev, name);
+                        if (err)
+                                pr_err("android_usb: Cannot enable '%s'", name);
+                }
+        }
+
+        mutex_unlock(&dev->mutex);
+
+        return size;
+}
+
+static ssize_t enable_show(struct device *pdev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct android_dev *dev = dev_get_drvdata(pdev);
+        return sprintf(buf, "%d\n", dev->enabled);
+}
+
+static ssize_t enable_store(struct device *pdev, struct device_attribute *attr,
+                            const char *buff, size_t size)
+{
+        struct android_dev *dev = dev_get_drvdata(pdev);
+        struct usb_composite_dev *cdev = dev->cdev;
+        int enabled = 0;
+
+        mutex_lock(&dev->mutex);
+
+        sscanf(buff, "%d", &enabled);
+        if (enabled && !dev->enabled) {
+                /* update values in composite driver's copy of device descriptor */
+                cdev->desc.idVendor = device_desc.idVendor;
+                cdev->desc.idProduct = device_desc.idProduct;
+                cdev->desc.bcdDevice = device_desc.bcdDevice;
+                cdev->desc.bDeviceClass = device_desc.bDeviceClass;
+                cdev->desc.bDeviceSubClass = device_desc.bDeviceSubClass;
+                cdev->desc.bDeviceProtocol = device_desc.bDeviceProtocol;
+                usb_add_config(cdev, &android_config_driver,
+                                        android_bind_config);
+                usb_gadget_connect(cdev->gadget);
+                dev->enabled = true;
+        } else if (!enabled && dev->enabled) {
+                usb_gadget_disconnect(cdev->gadget);
+                /* Cancel pending control requests */
+                usb_ep_dequeue(cdev->gadget->ep0, cdev->req);
+                usb_remove_config(cdev, &android_config_driver);
+                dev->enabled = false;
+        } else {
+                pr_err("android_usb: already %s\n",
+                                dev->enabled ? "enabled" : "disabled");
+        }
+
+        mutex_unlock(&dev->mutex);
+        return size;
+}
+
+static ssize_t state_show(struct device *pdev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct android_dev *dev = dev_get_drvdata(pdev);
+        struct usb_composite_dev *cdev = dev->cdev;
+        char *state = "DISCONNECTED";
+        unsigned long flags;
+
+        if (!cdev)
+                goto out;
+
+        spin_lock_irqsave(&cdev->lock, flags);
+        if (cdev->config)
+                state = "CONFIGURED";
+        else if (dev->connected)
+                state = "CONNECTED";
+        spin_unlock_irqrestore(&cdev->lock, flags);
+out:
+        return sprintf(buf, "%s\n", state);
+}
+
+#define DESCRIPTOR_ATTR(field, format_string)                           \
+static ssize_t                                                          \
+field ## _show(struct device *dev, struct device_attribute *attr,       \
+                char *buf)                                              \
+{                                                                       \
+        return sprintf(buf, format_string, device_desc.field);          \
+}                                                                       \
+static ssize_t                                                          \
+field ## _store(struct device *dev, struct device_attribute *attr,      \
+                const char *buf, size_t size)                           \
+{                                                                       \
+        int value;                                                      \
+        if (sscanf(buf, format_string, &value) == 1) {                  \
+                device_desc.field = value;                              \
+                return size;                                            \
+        }                                                               \
+        return -1;                                                      \
+}                                                                       \
+static DEVICE_ATTR(field, S_IRUGO | S_IWUSR, field ## _show, field ## _store);
+
+#define DESCRIPTOR_STRING_ATTR(field, buffer)                           \
+static ssize_t                                                          \
+field ## _show(struct device *dev, struct device_attribute *attr,       \
+                char *buf)                                              \
+{                                                                       \
+        return sprintf(buf, "%s", buffer);                              \
+}                                                                       \
+static ssize_t                                                          \
+field ## _store(struct device *dev, struct device_attribute *attr,      \
+                const char *buf, size_t size)                           \
+{                                                                       \
+        if (size >= sizeof(buffer)) return -EINVAL;                     \
+        if (sscanf(buf, "%s", buffer) == 1) {                           \
+                return size;                                            \
+        }                                                               \
+        return -1;                                                      \
+}                                                                       \
+static DEVICE_ATTR(field, S_IRUGO | S_IWUSR, field ## _show, field ## _store);
+
+
+DESCRIPTOR_ATTR(idVendor, "%04x\n")
+DESCRIPTOR_ATTR(idProduct, "%04x\n")
+DESCRIPTOR_ATTR(bcdDevice, "%04x\n")
+DESCRIPTOR_ATTR(bDeviceClass, "%d\n")
+DESCRIPTOR_ATTR(bDeviceSubClass, "%d\n")
+DESCRIPTOR_ATTR(bDeviceProtocol, "%d\n")
+DESCRIPTOR_STRING_ATTR(iManufacturer, manufacturer_string)
+DESCRIPTOR_STRING_ATTR(iProduct, product_string)
+DESCRIPTOR_STRING_ATTR(iSerial, serial_string)
+
+static DEVICE_ATTR(functions, S_IRUGO | S_IWUSR, functions_show, functions_store);
+static DEVICE_ATTR(enable, S_IRUGO | S_IWUSR, enable_show, enable_store);
+static DEVICE_ATTR(state, S_IRUGO, state_show, NULL);
+
+static struct device_attribute *android_usb_attributes[] = {
+        &dev_attr_idVendor,
+        &dev_attr_idProduct,
+        &dev_attr_bcdDevice,
+        &dev_attr_bDeviceClass,
+        &dev_attr_bDeviceSubClass,
+        &dev_attr_bDeviceProtocol,
+        &dev_attr_iManufacturer,
+        &dev_attr_iProduct,
+        &dev_attr_iSerial,
+        &dev_attr_functions,
+        &dev_attr_enable,
+        &dev_attr_state,
+        NULL
+};
+
+/*-------------------------------------------------------------------------*/
+/* Composite driver */
+
+static int android_bind_config(struct usb_configuration *c)
+{
+        struct android_dev *dev = _android_dev;
+        int ret = 0;
+
+        ret = android_bind_enabled_functions(dev, c);
+        if (ret)
+                return ret;
+
+        return 0;
+}
+
+static void android_unbind_config(struct usb_configuration *c)
+{
+        struct android_dev *dev = _android_dev;
+
+        android_unbind_enabled_functions(dev, c);
+}
+
+static int android_bind(struct usb_composite_dev *cdev)
+{
+        struct android_dev *dev = _android_dev;
+        struct usb_gadget       *gadget = cdev->gadget;
+        int                     gcnum, id, ret;
+
+        usb_gadget_disconnect(gadget);
+
+        ret = android_init_functions(dev->functions, cdev);
+        if (ret)
+                return ret;
+
+        /* Allocate string descriptor numbers ... note that string
+         * contents can be overridden by the composite_dev glue.
+         */
+        id = usb_string_id(cdev);
+        if (id < 0)
+                return id;
+        strings_dev[STRING_MANUFACTURER_IDX].id = id;
+        device_desc.iManufacturer = id;
+
+        id = usb_string_id(cdev);
+        if (id < 0)
+                return id;
+        strings_dev[STRING_PRODUCT_IDX].id = id;
+        device_desc.iProduct = id;
+
+        /* Default strings - should be updated by userspace */
+        strncpy(manufacturer_string, "Android", sizeof(manufacturer_string) - 1);
+        strncpy(product_string, "Android", sizeof(product_string) - 1);
+        strncpy(serial_string, "0123456789ABCDEF", sizeof(serial_string) - 1);
+
+        id = usb_string_id(cdev);
+        if (id < 0)
+                return id;
+        strings_dev[STRING_SERIAL_IDX].id = id;
+        device_desc.iSerialNumber = id;
+
+        gcnum = usb_gadget_controller_number(gadget);
+        if (gcnum >= 0)
+                device_desc.bcdDevice = cpu_to_le16(0x0200 + gcnum);
+        else {
+                /* gadget zero is so simple (for now, no altsettings) that
+                 * it SHOULD NOT have problems with bulk-capable hardware.
+                 * so just warn about unrcognized controllers -- don't panic.
+                 *
+                 * things like configuration and altsetting numbering
+                 * can need hardware-specific attention though.
+                 */
+                pr_warning("%s: controller '%s' not recognized\n",
+                        longname, gadget->name);
+                device_desc.bcdDevice = __constant_cpu_to_le16(0x9999);
+        }
+
+        dev->cdev = cdev;
+
+        return 0;
+}
+
+static int android_usb_unbind(struct usb_composite_dev *cdev)
+{
+        struct android_dev *dev = _android_dev;
+
+        cancel_work_sync(&dev->work);
+        android_cleanup_functions(dev->functions);
+        return 0;
+}
+
+static struct usb_composite_driver android_usb_driver = {
+        .name           = "android_usb",
+        .dev            = &device_desc,
+        .strings        = dev_strings,
+        .unbind         = android_usb_unbind,
+        .max_speed      = USB_SPEED_HIGH,
+};
+
+static int
+android_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *c)
+{
+        struct android_dev              *dev = _android_dev;
+        struct usb_composite_dev        *cdev = get_gadget_data(gadget);
+        struct usb_request              *req = cdev->req;
+        struct android_usb_function     *f;
+        int value = -EOPNOTSUPP;
+        unsigned long flags;
+
+        req->zero = 0;
+        req->complete = composite_setup_complete;
+        req->length = 0;
+        gadget->ep0->driver_data = cdev;
+
+        list_for_each_entry(f, &dev->enabled_functions, enabled_list) {
+                if (f->ctrlrequest) {
+                        value = f->ctrlrequest(f, cdev, c);
+                        if (value >= 0)
+                                break;
+                }
+        }
+
+        /* Special case the accessory function.
+         * It needs to handle control requests before it is enabled.
+         */
+        if (value < 0)
+                value = acc_ctrlrequest(cdev, c);
+
+        if (value < 0)
+                value = composite_setup(gadget, c);
+
+        spin_lock_irqsave(&cdev->lock, flags);
+        if (!dev->connected) {
+                dev->connected = 1;
+                schedule_work(&dev->work);
+        }
+        else if (c->bRequest == USB_REQ_SET_CONFIGURATION && cdev->config) {
+                schedule_work(&dev->work);
+        }
+        spin_unlock_irqrestore(&cdev->lock, flags);
+
+        return value;
+}
+
+static void android_disconnect(struct usb_gadget *gadget)
+{
+        struct android_dev *dev = _android_dev;
+        struct usb_composite_dev *cdev = get_gadget_data(gadget);
+        unsigned long flags;
+
+        composite_disconnect(gadget);
+
+        spin_lock_irqsave(&cdev->lock, flags);
+        dev->connected = 0;
+        schedule_work(&dev->work);
+        spin_unlock_irqrestore(&cdev->lock, flags);
+}
+
+static int android_create_device(struct android_dev *dev)
+{
+        struct device_attribute **attrs = android_usb_attributes;
+        struct device_attribute *attr;
+        int err;
+
+        dev->dev = device_create(android_class, NULL,
+                                        MKDEV(0, 0), NULL, "android0");
+        if (IS_ERR(dev->dev))
+                return PTR_ERR(dev->dev);
+
+        dev_set_drvdata(dev->dev, dev);
+
+        while ((attr = *attrs++)) {
+                err = device_create_file(dev->dev, attr);
+                if (err) {
+                        device_destroy(android_class, dev->dev->devt);
+                        return err;
+                }
+        }
+        return 0;
+}
+
+
+static int __init init(void)
+{
+        struct android_dev *dev;
+        int err;
+
+        android_class = class_create(THIS_MODULE, "android_usb");
+        if (IS_ERR(android_class))
+                return PTR_ERR(android_class);
+
+        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+        if (!dev)
+                return -ENOMEM;
+
+        dev->functions = supported_functions;
+        INIT_LIST_HEAD(&dev->enabled_functions);
+        INIT_WORK(&dev->work, android_work);
+        mutex_init(&dev->mutex);
+
+        err = android_create_device(dev);
+        if (err) {
+                class_destroy(android_class);
+                kfree(dev);
+                return err;
+        }
+
+        _android_dev = dev;
+
+        /* Override composite driver functions */
+        composite_driver.setup = android_setup;
+        composite_driver.disconnect = android_disconnect;
+
+        return usb_composite_probe(&android_usb_driver, android_bind);
+}
+module_init(init);
+
+static void __exit cleanup(void)
+{
+        usb_composite_unregister(&android_usb_driver);
+        class_destroy(android_class);
+        kfree(_android_dev);
+        _android_dev = NULL;
+}
+module_exit(cleanup);
diff --git a/drivers/usb/gadget/ci13xxx_msm.c b/drivers/usb/gadget/ci13xxx_msm.c
new file mode 100644
index 00000000000..470981ad6f7
--- /dev/null
+++ b/drivers/usb/gadget/ci13xxx_msm.c
@@ -0,0 +1,135 @@
+/* Copyright (c) 2010, Code Aurora Forum. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+#include <linux/usb/msm_hsusb_hw.h>
+#include <linux/usb/ulpi.h>
+
+#include "ci13xxx_udc.c"
+
+#define MSM_USB_BASE    (udc->regs)
+
+static irqreturn_t msm_udc_irq(int irq, void *data)
+{
+        return udc_irq();
+}
+
+static void ci13xxx_msm_notify_event(struct ci13xxx *udc, unsigned event)
+{
+        struct device *dev = udc->gadget.dev.parent;
+        int val;
+
+        switch (event) {
+        case CI13XXX_CONTROLLER_RESET_EVENT:
+                dev_dbg(dev, "CI13XXX_CONTROLLER_RESET_EVENT received\n");
+                writel(0, USB_AHBBURST);
+                writel(0, USB_AHBMODE);
+                break;
+        case CI13XXX_CONTROLLER_STOPPED_EVENT:
+                dev_dbg(dev, "CI13XXX_CONTROLLER_STOPPED_EVENT received\n");
+                /*
+                 * Put the transceiver in non-driving mode. Otherwise host
+                 * may not detect soft-disconnection.
+                 */
+                val = otg_io_read(udc->transceiver, ULPI_FUNC_CTRL);
+                val &= ~ULPI_FUNC_CTRL_OPMODE_MASK;
+                val |= ULPI_FUNC_CTRL_OPMODE_NONDRIVING;
+                otg_io_write(udc->transceiver, val, ULPI_FUNC_CTRL);
+                break;
+        default:
+                dev_dbg(dev, "unknown ci13xxx_udc event\n");
+                break;
+        }
+}
+
+static struct ci13xxx_udc_driver ci13xxx_msm_udc_driver = {
+        .name                   = "ci13xxx_msm",
+        .flags                  = CI13XXX_REGS_SHARED |
+                                  CI13XXX_REQUIRE_TRANSCEIVER |
+                                  CI13XXX_PULLUP_ON_VBUS |
+                                  CI13XXX_DISABLE_STREAMING,
+
+        .notify_event           = ci13xxx_msm_notify_event,
+};
+
+static int ci13xxx_msm_probe(struct platform_device *pdev)
+{
+        struct resource *res;
+        void __iomem *regs;
+        int irq;
+        int ret;
+
+        dev_dbg(&pdev->dev, "ci13xxx_msm_probe\n");
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_err(&pdev->dev, "failed to get platform resource mem\n");
+                return -ENXIO;
+        }
+
+        regs = ioremap(res->start, resource_size(res));
+        if (!regs) {
+                dev_err(&pdev->dev, "ioremap failed\n");
+                return -ENOMEM;
+        }
+
+        ret = udc_probe(&ci13xxx_msm_udc_driver, &pdev->dev, regs);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "udc_probe failed\n");
+                goto iounmap;
+        }
+
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                dev_err(&pdev->dev, "IRQ not found\n");
+                ret = -ENXIO;
+                goto udc_remove;
+        }
+
+        ret = request_irq(irq, msm_udc_irq, IRQF_SHARED, pdev->name, pdev);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "request_irq failed\n");
+                goto udc_remove;
+        }
+
+        pm_runtime_no_callbacks(&pdev->dev);
+        pm_runtime_enable(&pdev->dev);
+
+        return 0;
+
+udc_remove:
+        udc_remove();
+iounmap:
+        iounmap(regs);
+
+        return ret;
+}
+
+static struct platform_driver ci13xxx_msm_driver = {
+        .probe = ci13xxx_msm_probe,
+        .driver = { .name = "msm_hsusb", },
+};
+MODULE_ALIAS("platform:msm_hsusb");
+
+static int __init ci13xxx_msm_init(void)
+{
+        return platform_driver_register(&ci13xxx_msm_driver);
+}
+module_init(ci13xxx_msm_init);
diff --git a/drivers/usb/gadget/ci13xxx_pci.c b/drivers/usb/gadget/ci13xxx_pci.c
new file mode 100644
index 00000000000..883ab5e832d
--- /dev/null
+++ b/drivers/usb/gadget/ci13xxx_pci.c
@@ -0,0 +1,176 @@
+/*
+ * ci13xxx_pci.c - MIPS USB IP core family device controller
+ *
+ * Copyright (C) 2008 Chipidea - MIPS Technologies, Inc. All rights reserved.
+ *
+ * Author: David Lopo
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/pci.h>
+
+#include "ci13xxx_udc.c"
+
+/* driver name */
+#define UDC_DRIVER_NAME   "ci13xxx_pci"
+
+/******************************************************************************
+ * PCI block
+ *****************************************************************************/
+/**
+ * ci13xxx_pci_irq: interrut handler
+ * @irq:  irq number
+ * @pdev: USB Device Controller interrupt source
+ *
+ * This function returns IRQ_HANDLED if the IRQ has been handled
+ * This is an ISR don't trace, use attribute interface instead
+ */
+static irqreturn_t ci13xxx_pci_irq(int irq, void *pdev)
+{
+        if (irq == 0) {
+                dev_err(&((struct pci_dev *)pdev)->dev, "Invalid IRQ0 usage!");
+                return IRQ_HANDLED;
+        }
+        return udc_irq();
+}
+
+static struct ci13xxx_udc_driver ci13xxx_pci_udc_driver = {
+        .name           = UDC_DRIVER_NAME,
+};
+
+/**
+ * ci13xxx_pci_probe: PCI probe
+ * @pdev: USB device controller being probed
+ * @id:   PCI hotplug ID connecting controller to UDC framework
+ *
+ * This function returns an error code
+ * Allocates basic PCI resources for this USB device controller, and then
+ * invokes the udc_probe() method to start the UDC associated with it
+ */
+static int __devinit ci13xxx_pci_probe(struct pci_dev *pdev,
+                                       const struct pci_device_id *id)
+{
+        void __iomem *regs = NULL;
+        int retval = 0;
+
+        if (id == NULL)
+                return -EINVAL;
+
+        retval = pci_enable_device(pdev);
+        if (retval)
+                goto done;
+
+        if (!pdev->irq) {
+                dev_err(&pdev->dev, "No IRQ, check BIOS/PCI setup!");
+                retval = -ENODEV;
+                goto disable_device;
+        }
+
+        retval = pci_request_regions(pdev, UDC_DRIVER_NAME);
+        if (retval)
+                goto disable_device;
+
+        /* BAR 0 holds all the registers */
+        regs = pci_iomap(pdev, 0, 0);
+        if (!regs) {
+                dev_err(&pdev->dev, "Error mapping memory!");
+                retval = -EFAULT;
+                goto release_regions;
+        }
+        pci_set_drvdata(pdev, (__force void *)regs);
+
+        pci_set_master(pdev);
+        pci_try_set_mwi(pdev);
+
+        retval = udc_probe(&ci13xxx_pci_udc_driver, &pdev->dev, regs);
+        if (retval)
+                goto iounmap;
+
+        /* our device does not have MSI capability */
+
+        retval = request_irq(pdev->irq, ci13xxx_pci_irq, IRQF_SHARED,
+                             UDC_DRIVER_NAME, pdev);
+        if (retval)
+                goto gadget_remove;
+
+        return 0;
+
+ gadget_remove:
+        udc_remove();
+ iounmap:
+        pci_iounmap(pdev, regs);
+ release_regions:
+        pci_release_regions(pdev);
+ disable_device:
+        pci_disable_device(pdev);
+ done:
+        return retval;
+}
+
+/**
+ * ci13xxx_pci_remove: PCI remove
+ * @pdev: USB Device Controller being removed
+ *
+ * Reverses the effect of ci13xxx_pci_probe(),
+ * first invoking the udc_remove() and then releases
+ * all PCI resources allocated for this USB device controller
+ */
+static void __devexit ci13xxx_pci_remove(struct pci_dev *pdev)
+{
+        free_irq(pdev->irq, pdev);
+        udc_remove();
+        pci_iounmap(pdev, (__force void __iomem *)pci_get_drvdata(pdev));
+        pci_release_regions(pdev);
+        pci_disable_device(pdev);
+}
+
+/**
+ * PCI device table
+ * PCI device structure
+ *
+ * Check "pci.h" for details
+ */
+static DEFINE_PCI_DEVICE_TABLE(ci13xxx_pci_id_table) = {
+        { PCI_DEVICE(0x153F, 0x1004) },
+        { PCI_DEVICE(0x153F, 0x1006) },
+        { 0, 0, 0, 0, 0, 0, 0 /* end: all zeroes */ }
+};
+MODULE_DEVICE_TABLE(pci, ci13xxx_pci_id_table);
+
+static struct pci_driver ci13xxx_pci_driver = {
+        .name         = UDC_DRIVER_NAME,
+        .id_table     = ci13xxx_pci_id_table,
+        .probe        = ci13xxx_pci_probe,
+        .remove       = __devexit_p(ci13xxx_pci_remove),
+};
+
+/**
+ * ci13xxx_pci_init: module init
+ *
+ * Driver load
+ */
+static int __init ci13xxx_pci_init(void)
+{
+        return pci_register_driver(&ci13xxx_pci_driver);
+}
+module_init(ci13xxx_pci_init);
+
+/**
+ * ci13xxx_pci_exit: module exit
+ *
+ * Driver unload
+ */
+static void __exit ci13xxx_pci_exit(void)
+{
+        pci_unregister_driver(&ci13xxx_pci_driver);
+}
+module_exit(ci13xxx_pci_exit);
+
+MODULE_AUTHOR("MIPS - David Lopo <dlopo@chipidea.mips.com>");
+MODULE_DESCRIPTION("MIPS CI13XXX USB Peripheral Controller");
+MODULE_LICENSE("GPL");
+MODULE_VERSION("June 2008");
diff --git a/drivers/usb/gadget/ci13xxx_udc.c b/drivers/usb/gadget/ci13xxx_udc.c
new file mode 100644
index 00000000000..1265a8502ea
--- /dev/null
+++ b/drivers/usb/gadget/ci13xxx_udc.c
@@ -0,0 +1,2977 @@
+/*
+ * ci13xxx_udc.c - MIPS USB IP core family device controller
+ *
+ * Copyright (C) 2008 Chipidea - MIPS Technologies, Inc. All rights reserved.
+ *
+ * Author: David Lopo
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/*
+ * Description: MIPS USB IP core family device controller
+ *              Currently it only supports IP part number CI13412
+ *
+ * This driver is composed of several blocks:
+ * - HW:     hardware interface
+ * - DBG:    debug facilities (optional)
+ * - UTIL:   utilities
+ * - ISR:    interrupts handling
+ * - ENDPT:  endpoint operations (Gadget API)
+ * - GADGET: gadget operations (Gadget API)
+ * - BUS:    bus glue code, bus abstraction layer
+ *
+ * Compile Options
+ * - CONFIG_USB_GADGET_DEBUG_FILES: enable debug facilities
+ * - STALL_IN:  non-empty bulk-in pipes cannot be halted
+ *              if defined mass storage compliance succeeds but with warnings
+ *              => case 4: Hi >  Dn
+ *              => case 5: Hi >  Di
+ *              => case 8: Hi <> Do
+ *              if undefined usbtest 13 fails
+ * - TRACE:     enable function tracing (depends on DEBUG)
+ *
+ * Main Features
+ * - Chapter 9 & Mass Storage Compliance with Gadget File Storage
+ * - Chapter 9 Compliance with Gadget Zero (STALL_IN undefined)
+ * - Normal & LPM support
+ *
+ * USBTEST Report
+ * - OK: 0-12, 13 (STALL_IN defined) & 14
+ * - Not Supported: 15 & 16 (ISO)
+ *
+ * TODO List
+ * - OTG
+ * - Isochronous & Interrupt Traffic
+ * - Handle requests which spawns into several TDs
+ * - GET_STATUS(device) - always reports 0
+ * - Gadget API (majority of optional features)
+ * - Suspend & Remote Wakeup
+ */
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/dmapool.h>
+#include <linux/dma-mapping.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/irq.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/pm_runtime.h>
+#include <linux/usb/ch9.h>
+#include <linux/usb/gadget.h>
+#include <linux/usb/otg.h>
+
+#include "ci13xxx_udc.h"
+
+
+/******************************************************************************
+ * DEFINE
+ *****************************************************************************/
+/* ctrl register bank access */
+static DEFINE_SPINLOCK(udc_lock);
+
+/* control endpoint description */
+static const struct usb_endpoint_descriptor
+ctrl_endpt_out_desc = {
+        .bLength         = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType = USB_DT_ENDPOINT,
+
+        .bEndpointAddress = USB_DIR_OUT,
+        .bmAttributes    = USB_ENDPOINT_XFER_CONTROL,
+        .wMaxPacketSize  = cpu_to_le16(CTRL_PAYLOAD_MAX),
+};
+
+static const struct usb_endpoint_descriptor
+ctrl_endpt_in_desc = {
+        .bLength         = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType = USB_DT_ENDPOINT,
+
+        .bEndpointAddress = USB_DIR_IN,
+        .bmAttributes    = USB_ENDPOINT_XFER_CONTROL,
+        .wMaxPacketSize  = cpu_to_le16(CTRL_PAYLOAD_MAX),
+};
+
+/* UDC descriptor */
+static struct ci13xxx *_udc;
+
+/* Interrupt statistics */
+#define ISR_MASK   0x1F
+static struct {
+        u32 test;
+        u32 ui;
+        u32 uei;
+        u32 pci;
+        u32 uri;
+        u32 sli;
+        u32 none;
+        struct {
+                u32 cnt;
+                u32 buf[ISR_MASK+1];
+                u32 idx;
+        } hndl;
+} isr_statistics;
+
+/**
+ * ffs_nr: find first (least significant) bit set
+ * @x: the word to search
+ *
+ * This function returns bit number (instead of position)
+ */
+static int ffs_nr(u32 x)
+{
+        int n = ffs(x);
+
+        return n ? n-1 : 32;
+}
+
+/******************************************************************************
+ * HW block
+ *****************************************************************************/
+/* register bank descriptor */
+static struct {
+        unsigned      lpm;    /* is LPM? */
+        void __iomem *abs;    /* bus map offset */
+        void __iomem *cap;    /* bus map offset + CAP offset + CAP data */
+        size_t        size;   /* bank size */
+} hw_bank;
+
+/* MSM specific */
+#define ABS_AHBBURST        (0x0090UL)
+#define ABS_AHBMODE         (0x0098UL)
+/* UDC register map */
+#define ABS_CAPLENGTH       (0x100UL)
+#define ABS_HCCPARAMS       (0x108UL)
+#define ABS_DCCPARAMS       (0x124UL)
+#define ABS_TESTMODE        (hw_bank.lpm ? 0x0FCUL : 0x138UL)
+/* offset to CAPLENTGH (addr + data) */
+#define CAP_USBCMD          (0x000UL)
+#define CAP_USBSTS          (0x004UL)
+#define CAP_USBINTR         (0x008UL)
+#define CAP_DEVICEADDR      (0x014UL)
+#define CAP_ENDPTLISTADDR   (0x018UL)
+#define CAP_PORTSC          (0x044UL)
+#define CAP_DEVLC           (0x084UL)
+#define CAP_USBMODE         (hw_bank.lpm ? 0x0C8UL : 0x068UL)
+#define CAP_ENDPTSETUPSTAT  (hw_bank.lpm ? 0x0D8UL : 0x06CUL)
+#define CAP_ENDPTPRIME      (hw_bank.lpm ? 0x0DCUL : 0x070UL)
+#define CAP_ENDPTFLUSH      (hw_bank.lpm ? 0x0E0UL : 0x074UL)
+#define CAP_ENDPTSTAT       (hw_bank.lpm ? 0x0E4UL : 0x078UL)
+#define CAP_ENDPTCOMPLETE   (hw_bank.lpm ? 0x0E8UL : 0x07CUL)
+#define CAP_ENDPTCTRL       (hw_bank.lpm ? 0x0ECUL : 0x080UL)
+#define CAP_LAST            (hw_bank.lpm ? 0x12CUL : 0x0C0UL)
+
+/* maximum number of enpoints: valid only after hw_device_reset() */
+static unsigned hw_ep_max;
+
+/**
+ * hw_ep_bit: calculates the bit number
+ * @num: endpoint number
+ * @dir: endpoint direction
+ *
+ * This function returns bit number
+ */
+static inline int hw_ep_bit(int num, int dir)
+{
+        return num + (dir ? 16 : 0);
+}
+
+/**
+ * hw_aread: reads from register bitfield
+ * @addr: address relative to bus map
+ * @mask: bitfield mask
+ *
+ * This function returns register bitfield data
+ */
+static u32 hw_aread(u32 addr, u32 mask)
+{
+        return ioread32(addr + hw_bank.abs) & mask;
+}
+
+/**
+ * hw_awrite: writes to register bitfield
+ * @addr: address relative to bus map
+ * @mask: bitfield mask
+ * @data: new data
+ */
+static void hw_awrite(u32 addr, u32 mask, u32 data)
+{
+        iowrite32(hw_aread(addr, ~mask) | (data & mask),
+                  addr + hw_bank.abs);
+}
+
+/**
+ * hw_cread: reads from register bitfield
+ * @addr: address relative to CAP offset plus content
+ * @mask: bitfield mask
+ *
+ * This function returns register bitfield data
+ */
+static u32 hw_cread(u32 addr, u32 mask)
+{
+        return ioread32(addr + hw_bank.cap) & mask;
+}
+
+/**
+ * hw_cwrite: writes to register bitfield
+ * @addr: address relative to CAP offset plus content
+ * @mask: bitfield mask
+ * @data: new data
+ */
+static void hw_cwrite(u32 addr, u32 mask, u32 data)
+{
+        iowrite32(hw_cread(addr, ~mask) | (data & mask),
+                  addr + hw_bank.cap);
+}
+
+/**
+ * hw_ctest_and_clear: tests & clears register bitfield
+ * @addr: address relative to CAP offset plus content
+ * @mask: bitfield mask
+ *
+ * This function returns register bitfield data
+ */
+static u32 hw_ctest_and_clear(u32 addr, u32 mask)
+{
+        u32 reg = hw_cread(addr, mask);
+
+        iowrite32(reg, addr + hw_bank.cap);
+        return reg;
+}
+
+/**
+ * hw_ctest_and_write: tests & writes register bitfield
+ * @addr: address relative to CAP offset plus content
+ * @mask: bitfield mask
+ * @data: new data
+ *
+ * This function returns register bitfield data
+ */
+static u32 hw_ctest_and_write(u32 addr, u32 mask, u32 data)
+{
+        u32 reg = hw_cread(addr, ~0);
+
+        iowrite32((reg & ~mask) | (data & mask), addr + hw_bank.cap);
+        return (reg & mask) >> ffs_nr(mask);
+}
+
+static int hw_device_init(void __iomem *base)
+{
+        u32 reg;
+
+        /* bank is a module variable */
+        hw_bank.abs = base;
+
+        hw_bank.cap = hw_bank.abs;
+        hw_bank.cap += ABS_CAPLENGTH;
+        hw_bank.cap += ioread8(hw_bank.cap);
+
+        reg = hw_aread(ABS_HCCPARAMS, HCCPARAMS_LEN) >> ffs_nr(HCCPARAMS_LEN);
+        hw_bank.lpm  = reg;
+        hw_bank.size = hw_bank.cap - hw_bank.abs;
+        hw_bank.size += CAP_LAST;
+        hw_bank.size /= sizeof(u32);
+
+        reg = hw_aread(ABS_DCCPARAMS, DCCPARAMS_DEN) >> ffs_nr(DCCPARAMS_DEN);
+        hw_ep_max = reg * 2;   /* cache hw ENDPT_MAX */
+
+        if (hw_ep_max == 0 || hw_ep_max > ENDPT_MAX)
+                return -ENODEV;
+
+        /* setup lock mode ? */
+
+        /* ENDPTSETUPSTAT is '0' by default */
+
+        /* HCSPARAMS.bf.ppc SHOULD BE zero for device */
+
+        return 0;
+}
+/**
+ * hw_device_reset: resets chip (execute without interruption)
+ * @base: register base address
+ *
+ * This function returns an error code
+ */
+static int hw_device_reset(struct ci13xxx *udc)
+{
+        /* should flush & stop before reset */
+        hw_cwrite(CAP_ENDPTFLUSH, ~0, ~0);
+        hw_cwrite(CAP_USBCMD, USBCMD_RS, 0);
+
+        hw_cwrite(CAP_USBCMD, USBCMD_RST, USBCMD_RST);
+        while (hw_cread(CAP_USBCMD, USBCMD_RST))
+                udelay(10);             /* not RTOS friendly */
+
+
+        if (udc->udc_driver->notify_event)
+                udc->udc_driver->notify_event(udc,
+                        CI13XXX_CONTROLLER_RESET_EVENT);
+
+        if (udc->udc_driver->flags & CI13XXX_DISABLE_STREAMING)
+                hw_cwrite(CAP_USBMODE, USBMODE_SDIS, USBMODE_SDIS);
+
+        /* USBMODE should be configured step by step */
+        hw_cwrite(CAP_USBMODE, USBMODE_CM, USBMODE_CM_IDLE);
+        hw_cwrite(CAP_USBMODE, USBMODE_CM, USBMODE_CM_DEVICE);
+        hw_cwrite(CAP_USBMODE, USBMODE_SLOM, USBMODE_SLOM);  /* HW >= 2.3 */
+
+        if (hw_cread(CAP_USBMODE, USBMODE_CM) != USBMODE_CM_DEVICE) {
+                pr_err("cannot enter in device mode");
+                pr_err("lpm = %i", hw_bank.lpm);
+                return -ENODEV;
+        }
+
+        return 0;
+}
+
+/**
+ * hw_device_state: enables/disables interrupts & starts/stops device (execute
+ *                  without interruption)
+ * @dma: 0 => disable, !0 => enable and set dma engine
+ *
+ * This function returns an error code
+ */
+static int hw_device_state(u32 dma)
+{
+        if (dma) {
+                hw_cwrite(CAP_ENDPTLISTADDR, ~0, dma);
+                /* interrupt, error, port change, reset, sleep/suspend */
+                hw_cwrite(CAP_USBINTR, ~0,
+                             USBi_UI|USBi_UEI|USBi_PCI|USBi_URI|USBi_SLI);
+                hw_cwrite(CAP_USBCMD, USBCMD_RS, USBCMD_RS);
+        } else {
+                hw_cwrite(CAP_USBCMD, USBCMD_RS, 0);
+                hw_cwrite(CAP_USBINTR, ~0, 0);
+        }
+        return 0;
+}
+
+/**
+ * hw_ep_flush: flush endpoint fifo (execute without interruption)
+ * @num: endpoint number
+ * @dir: endpoint direction
+ *
+ * This function returns an error code
+ */
+static int hw_ep_flush(int num, int dir)
+{
+        int n = hw_ep_bit(num, dir);
+
+        do {
+                /* flush any pending transfer */
+                hw_cwrite(CAP_ENDPTFLUSH, BIT(n), BIT(n));
+                while (hw_cread(CAP_ENDPTFLUSH, BIT(n)))
+                        cpu_relax();
+        } while (hw_cread(CAP_ENDPTSTAT, BIT(n)));
+
+        return 0;
+}
+
+/**
+ * hw_ep_disable: disables endpoint (execute without interruption)
+ * @num: endpoint number
+ * @dir: endpoint direction
+ *
+ * This function returns an error code
+ */
+static int hw_ep_disable(int num, int dir)
+{
+        hw_ep_flush(num, dir);
+        hw_cwrite(CAP_ENDPTCTRL + num * sizeof(u32),
+                  dir ? ENDPTCTRL_TXE : ENDPTCTRL_RXE, 0);
+        return 0;
+}
+
+/**
+ * hw_ep_enable: enables endpoint (execute without interruption)
+ * @num:  endpoint number
+ * @dir:  endpoint direction
+ * @type: endpoint type
+ *
+ * This function returns an error code
+ */
+static int hw_ep_enable(int num, int dir, int type)
+{
+        u32 mask, data;
+
+        if (dir) {
+                mask  = ENDPTCTRL_TXT;  /* type    */
+                data  = type << ffs_nr(mask);
+
+                mask |= ENDPTCTRL_TXS;  /* unstall */
+                mask |= ENDPTCTRL_TXR;  /* reset data toggle */
+                data |= ENDPTCTRL_TXR;
+                mask |= ENDPTCTRL_TXE;  /* enable  */
+                data |= ENDPTCTRL_TXE;
+        } else {
+                mask  = ENDPTCTRL_RXT;  /* type    */
+                data  = type << ffs_nr(mask);
+
+                mask |= ENDPTCTRL_RXS;  /* unstall */
+                mask |= ENDPTCTRL_RXR;  /* reset data toggle */
+                data |= ENDPTCTRL_RXR;
+                mask |= ENDPTCTRL_RXE;  /* enable  */
+                data |= ENDPTCTRL_RXE;
+        }
+        hw_cwrite(CAP_ENDPTCTRL + num * sizeof(u32), mask, data);
+        return 0;
+}
+
+/**
+ * hw_ep_get_halt: return endpoint halt status
+ * @num: endpoint number
+ * @dir: endpoint direction
+ *
+ * This function returns 1 if endpoint halted
+ */
+static int hw_ep_get_halt(int num, int dir)
+{
+        u32 mask = dir ? ENDPTCTRL_TXS : ENDPTCTRL_RXS;
+
+        return hw_cread(CAP_ENDPTCTRL + num * sizeof(u32), mask) ? 1 : 0;
+}
+
+/**
+ * hw_test_and_clear_setup_status: test & clear setup status (execute without
+ *                                 interruption)
+ * @n: bit number (endpoint)
+ *
+ * This function returns setup status
+ */
+static int hw_test_and_clear_setup_status(int n)
+{
+        return hw_ctest_and_clear(CAP_ENDPTSETUPSTAT, BIT(n));
+}
+
+/**
+ * hw_ep_prime: primes endpoint (execute without interruption)
+ * @num:     endpoint number
+ * @dir:     endpoint direction
+ * @is_ctrl: true if control endpoint
+ *
+ * This function returns an error code
+ */
+static int hw_ep_prime(int num, int dir, int is_ctrl)
+{
+        int n = hw_ep_bit(num, dir);
+
+        if (is_ctrl && dir == RX && hw_cread(CAP_ENDPTSETUPSTAT, BIT(num)))
+                return -EAGAIN;
+
+        hw_cwrite(CAP_ENDPTPRIME, BIT(n), BIT(n));
+
+        while (hw_cread(CAP_ENDPTPRIME, BIT(n)))
+                cpu_relax();
+        if (is_ctrl && dir == RX  && hw_cread(CAP_ENDPTSETUPSTAT, BIT(num)))
+                return -EAGAIN;
+
+        /* status shoult be tested according with manual but it doesn't work */
+        return 0;
+}
+
+/**
+ * hw_ep_set_halt: configures ep halt & resets data toggle after clear (execute
+ *                 without interruption)
+ * @num:   endpoint number
+ * @dir:   endpoint direction
+ * @value: true => stall, false => unstall
+ *
+ * This function returns an error code
+ */
+static int hw_ep_set_halt(int num, int dir, int value)
+{
+        if (value != 0 && value != 1)
+                return -EINVAL;
+
+        do {
+                u32 addr = CAP_ENDPTCTRL + num * sizeof(u32);
+                u32 mask_xs = dir ? ENDPTCTRL_TXS : ENDPTCTRL_RXS;
+                u32 mask_xr = dir ? ENDPTCTRL_TXR : ENDPTCTRL_RXR;
+
+                /* data toggle - reserved for EP0 but it's in ESS */
+                hw_cwrite(addr, mask_xs|mask_xr, value ? mask_xs : mask_xr);
+
+        } while (value != hw_ep_get_halt(num, dir));
+
+        return 0;
+}
+
+/**
+ * hw_intr_clear: disables interrupt & clears interrupt status (execute without
+ *                interruption)
+ * @n: interrupt bit
+ *
+ * This function returns an error code
+ */
+static int hw_intr_clear(int n)
+{
+        if (n >= REG_BITS)
+                return -EINVAL;
+
+        hw_cwrite(CAP_USBINTR, BIT(n), 0);
+        hw_cwrite(CAP_USBSTS,  BIT(n), BIT(n));
+        return 0;
+}
+
+/**
+ * hw_intr_force: enables interrupt & forces interrupt status (execute without
+ *                interruption)
+ * @n: interrupt bit
+ *
+ * This function returns an error code
+ */
+static int hw_intr_force(int n)
+{
+        if (n >= REG_BITS)
+                return -EINVAL;
+
+        hw_awrite(ABS_TESTMODE, TESTMODE_FORCE, TESTMODE_FORCE);
+        hw_cwrite(CAP_USBINTR,  BIT(n), BIT(n));
+        hw_cwrite(CAP_USBSTS,   BIT(n), BIT(n));
+        hw_awrite(ABS_TESTMODE, TESTMODE_FORCE, 0);
+        return 0;
+}
+
+/**
+ * hw_is_port_high_speed: test if port is high speed
+ *
+ * This function returns true if high speed port
+ */
+static int hw_port_is_high_speed(void)
+{
+        return hw_bank.lpm ? hw_cread(CAP_DEVLC, DEVLC_PSPD) :
+                hw_cread(CAP_PORTSC, PORTSC_HSP);
+}
+
+/**
+ * hw_port_test_get: reads port test mode value
+ *
+ * This function returns port test mode value
+ */
+static u8 hw_port_test_get(void)
+{
+        return hw_cread(CAP_PORTSC, PORTSC_PTC) >> ffs_nr(PORTSC_PTC);
+}
+
+/**
+ * hw_port_test_set: writes port test mode (execute without interruption)
+ * @mode: new value
+ *
+ * This function returns an error code
+ */
+static int hw_port_test_set(u8 mode)
+{
+        const u8 TEST_MODE_MAX = 7;
+
+        if (mode > TEST_MODE_MAX)
+                return -EINVAL;
+
+        hw_cwrite(CAP_PORTSC, PORTSC_PTC, mode << ffs_nr(PORTSC_PTC));
+        return 0;
+}
+
+/**
+ * hw_read_intr_enable: returns interrupt enable register
+ *
+ * This function returns register data
+ */
+static u32 hw_read_intr_enable(void)
+{
+        return hw_cread(CAP_USBINTR, ~0);
+}
+
+/**
+ * hw_read_intr_status: returns interrupt status register
+ *
+ * This function returns register data
+ */
+static u32 hw_read_intr_status(void)
+{
+        return hw_cread(CAP_USBSTS, ~0);
+}
+
+/**
+ * hw_register_read: reads all device registers (execute without interruption)
+ * @buf:  destination buffer
+ * @size: buffer size
+ *
+ * This function returns number of registers read
+ */
+static size_t hw_register_read(u32 *buf, size_t size)
+{
+        unsigned i;
+
+        if (size > hw_bank.size)
+                size = hw_bank.size;
+
+        for (i = 0; i < size; i++)
+                buf[i] = hw_aread(i * sizeof(u32), ~0);
+
+        return size;
+}
+
+/**
+ * hw_register_write: writes to register
+ * @addr: register address
+ * @data: register value
+ *
+ * This function returns an error code
+ */
+static int hw_register_write(u16 addr, u32 data)
+{
+        /* align */
+        addr /= sizeof(u32);
+
+        if (addr >= hw_bank.size)
+                return -EINVAL;
+
+        /* align */
+        addr *= sizeof(u32);
+
+        hw_awrite(addr, ~0, data);
+        return 0;
+}
+
+/**
+ * hw_test_and_clear_complete: test & clear complete status (execute without
+ *                             interruption)
+ * @n: bit number (endpoint)
+ *
+ * This function returns complete status
+ */
+static int hw_test_and_clear_complete(int n)
+{
+        return hw_ctest_and_clear(CAP_ENDPTCOMPLETE, BIT(n));
+}
+
+/**
+ * hw_test_and_clear_intr_active: test & clear active interrupts (execute
+ *                                without interruption)
+ *
+ * This function returns active interrutps
+ */
+static u32 hw_test_and_clear_intr_active(void)
+{
+        u32 reg = hw_read_intr_status() & hw_read_intr_enable();
+
+        hw_cwrite(CAP_USBSTS, ~0, reg);
+        return reg;
+}
+
+/**
+ * hw_test_and_clear_setup_guard: test & clear setup guard (execute without
+ *                                interruption)
+ *
+ * This function returns guard value
+ */
+static int hw_test_and_clear_setup_guard(void)
+{
+        return hw_ctest_and_write(CAP_USBCMD, USBCMD_SUTW, 0);
+}
+
+/**
+ * hw_test_and_set_setup_guard: test & set setup guard (execute without
+ *                              interruption)
+ *
+ * This function returns guard value
+ */
+static int hw_test_and_set_setup_guard(void)
+{
+        return hw_ctest_and_write(CAP_USBCMD, USBCMD_SUTW, USBCMD_SUTW);
+}
+
+/**
+ * hw_usb_set_address: configures USB address (execute without interruption)
+ * @value: new USB address
+ *
+ * This function returns an error code
+ */
+static int hw_usb_set_address(u8 value)
+{
+        /* advance */
+        hw_cwrite(CAP_DEVICEADDR, DEVICEADDR_USBADR | DEVICEADDR_USBADRA,
+                  value << ffs_nr(DEVICEADDR_USBADR) | DEVICEADDR_USBADRA);
+        return 0;
+}
+
+/**
+ * hw_usb_reset: restart device after a bus reset (execute without
+ *               interruption)
+ *
+ * This function returns an error code
+ */
+static int hw_usb_reset(void)
+{
+        hw_usb_set_address(0);
+
+        /* ESS flushes only at end?!? */
+        hw_cwrite(CAP_ENDPTFLUSH,    ~0, ~0);   /* flush all EPs */
+
+        /* clear setup token semaphores */
+        hw_cwrite(CAP_ENDPTSETUPSTAT, 0,  0);   /* writes its content */
+
+        /* clear complete status */
+        hw_cwrite(CAP_ENDPTCOMPLETE,  0,  0);   /* writes its content */
+
+        /* wait until all bits cleared */
+        while (hw_cread(CAP_ENDPTPRIME, ~0))
+                udelay(10);             /* not RTOS friendly */
+
+        /* reset all endpoints ? */
+
+        /* reset internal status and wait for further instructions
+           no need to verify the port reset status (ESS does it) */
+
+        return 0;
+}
+
+/******************************************************************************
+ * DBG block
+ *****************************************************************************/
+/**
+ * show_device: prints information about device capabilities and status
+ *
+ * Check "device.h" for details
+ */
+static ssize_t show_device(struct device *dev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev);
+        struct usb_gadget *gadget = &udc->gadget;
+        int n = 0;
+
+        dbg_trace("[%s] %p\n", __func__, buf);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                return 0;
+        }
+
+        n += scnprintf(buf + n, PAGE_SIZE - n, "speed             = %d\n",
+                       gadget->speed);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "is_dualspeed      = %d\n",
+                       gadget->is_dualspeed);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "is_otg            = %d\n",
+                       gadget->is_otg);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "is_a_peripheral   = %d\n",
+                       gadget->is_a_peripheral);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "b_hnp_enable      = %d\n",
+                       gadget->b_hnp_enable);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "a_hnp_support     = %d\n",
+                       gadget->a_hnp_support);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "a_alt_hnp_support = %d\n",
+                       gadget->a_alt_hnp_support);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "name              = %s\n",
+                       (gadget->name ? gadget->name : ""));
+
+        return n;
+}
+static DEVICE_ATTR(device, S_IRUSR, show_device, NULL);
+
+/**
+ * show_driver: prints information about attached gadget (if any)
+ *
+ * Check "device.h" for details
+ */
+static ssize_t show_driver(struct device *dev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev);
+        struct usb_gadget_driver *driver = udc->driver;
+        int n = 0;
+
+        dbg_trace("[%s] %p\n", __func__, buf);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                return 0;
+        }
+
+        if (driver == NULL)
+                return scnprintf(buf, PAGE_SIZE,
+                                 "There is no gadget attached!\n");
+
+        n += scnprintf(buf + n, PAGE_SIZE - n, "function  = %s\n",
+                       (driver->function ? driver->function : ""));
+        n += scnprintf(buf + n, PAGE_SIZE - n, "max speed = %d\n",
+                       driver->speed);
+
+        return n;
+}
+static DEVICE_ATTR(driver, S_IRUSR, show_driver, NULL);
+
+/* Maximum event message length */
+#define DBG_DATA_MSG   64UL
+
+/* Maximum event messages */
+#define DBG_DATA_MAX   128UL
+
+/* Event buffer descriptor */
+static struct {
+        char     (buf[DBG_DATA_MAX])[DBG_DATA_MSG];   /* buffer */
+        unsigned idx;   /* index */
+        unsigned tty;   /* print to console? */
+        rwlock_t lck;   /* lock */
+} dbg_data = {
+        .idx = 0,
+        .tty = 0,
+        .lck = __RW_LOCK_UNLOCKED(lck)
+};
+
+/**
+ * dbg_dec: decrements debug event index
+ * @idx: buffer index
+ */
+static void dbg_dec(unsigned *idx)
+{
+        *idx = (*idx - 1) & (DBG_DATA_MAX-1);
+}
+
+/**
+ * dbg_inc: increments debug event index
+ * @idx: buffer index
+ */
+static void dbg_inc(unsigned *idx)
+{
+        *idx = (*idx + 1) & (DBG_DATA_MAX-1);
+}
+
+/**
+ * dbg_print:  prints the common part of the event
+ * @addr:   endpoint address
+ * @name:   event name
+ * @status: status
+ * @extra:  extra information
+ */
+static void dbg_print(u8 addr, const char *name, int status, const char *extra)
+{
+        struct timeval tval;
+        unsigned int stamp;
+        unsigned long flags;
+
+        write_lock_irqsave(&dbg_data.lck, flags);
+
+        do_gettimeofday(&tval);
+        stamp = tval.tv_sec & 0xFFFF;   /* 2^32 = 4294967296. Limit to 4096s */
+        stamp = stamp * 1000000 + tval.tv_usec;
+
+        scnprintf(dbg_data.buf[dbg_data.idx], DBG_DATA_MSG,
+                  "%04X\t? %02X %-7.7s %4i ?\t%s\n",
+                  stamp, addr, name, status, extra);
+
+        dbg_inc(&dbg_data.idx);
+
+        write_unlock_irqrestore(&dbg_data.lck, flags);
+
+        if (dbg_data.tty != 0)
+                pr_notice("%04X\t? %02X %-7.7s %4i ?\t%s\n",
+                          stamp, addr, name, status, extra);
+}
+
+/**
+ * dbg_done: prints a DONE event
+ * @addr:   endpoint address
+ * @td:     transfer descriptor
+ * @status: status
+ */
+static void dbg_done(u8 addr, const u32 token, int status)
+{
+        char msg[DBG_DATA_MSG];
+
+        scnprintf(msg, sizeof(msg), "%d %02X",
+                  (int)(token & TD_TOTAL_BYTES) >> ffs_nr(TD_TOTAL_BYTES),
+                  (int)(token & TD_STATUS)      >> ffs_nr(TD_STATUS));
+        dbg_print(addr, "DONE", status, msg);
+}
+
+/**
+ * dbg_event: prints a generic event
+ * @addr:   endpoint address
+ * @name:   event name
+ * @status: status
+ */
+static void dbg_event(u8 addr, const char *name, int status)
+{
+        if (name != NULL)
+                dbg_print(addr, name, status, "");
+}
+
+/*
+ * dbg_queue: prints a QUEUE event
+ * @addr:   endpoint address
+ * @req:    USB request
+ * @status: status
+ */
+static void dbg_queue(u8 addr, const struct usb_request *req, int status)
+{
+        char msg[DBG_DATA_MSG];
+
+        if (req != NULL) {
+                scnprintf(msg, sizeof(msg),
+                          "%d %d", !req->no_interrupt, req->length);
+                dbg_print(addr, "QUEUE", status, msg);
+        }
+}
+
+/**
+ * dbg_setup: prints a SETUP event
+ * @addr: endpoint address
+ * @req:  setup request
+ */
+static void dbg_setup(u8 addr, const struct usb_ctrlrequest *req)
+{
+        char msg[DBG_DATA_MSG];
+
+        if (req != NULL) {
+                scnprintf(msg, sizeof(msg),
+                          "%02X %02X %04X %04X %d", req->bRequestType,
+                          req->bRequest, le16_to_cpu(req->wValue),
+                          le16_to_cpu(req->wIndex), le16_to_cpu(req->wLength));
+                dbg_print(addr, "SETUP", 0, msg);
+        }
+}
+
+/**
+ * show_events: displays the event buffer
+ *
+ * Check "device.h" for details
+ */
+static ssize_t show_events(struct device *dev, struct device_attribute *attr,
+                           char *buf)
+{
+        unsigned long flags;
+        unsigned i, j, n = 0;
+
+        dbg_trace("[%s] %p\n", __func__, buf);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                return 0;
+        }
+
+        read_lock_irqsave(&dbg_data.lck, flags);
+
+        i = dbg_data.idx;
+        for (dbg_dec(&i); i != dbg_data.idx; dbg_dec(&i)) {
+                n += strlen(dbg_data.buf[i]);
+                if (n >= PAGE_SIZE) {
+                        n -= strlen(dbg_data.buf[i]);
+                        break;
+                }
+        }
+        for (j = 0, dbg_inc(&i); j < n; dbg_inc(&i))
+                j += scnprintf(buf + j, PAGE_SIZE - j,
+                               "%s", dbg_data.buf[i]);
+
+        read_unlock_irqrestore(&dbg_data.lck, flags);
+
+        return n;
+}
+
+/**
+ * store_events: configure if events are going to be also printed to console
+ *
+ * Check "device.h" for details
+ */
+static ssize_t store_events(struct device *dev, struct device_attribute *attr,
+                            const char *buf, size_t count)
+{
+        unsigned tty;
+
+        dbg_trace("[%s] %p, %d\n", __func__, buf, count);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                goto done;
+        }
+
+        if (sscanf(buf, "%u", &tty) != 1 || tty > 1) {
+                dev_err(dev, "<1|0>: enable|disable console log\n");
+                goto done;
+        }
+
+        dbg_data.tty = tty;
+        dev_info(dev, "tty = %u", dbg_data.tty);
+
+ done:
+        return count;
+}
+static DEVICE_ATTR(events, S_IRUSR | S_IWUSR, show_events, store_events);
+
+/**
+ * show_inters: interrupt status, enable status and historic
+ *
+ * Check "device.h" for details
+ */
+static ssize_t show_inters(struct device *dev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev);
+        unsigned long flags;
+        u32 intr;
+        unsigned i, j, n = 0;
+
+        dbg_trace("[%s] %p\n", __func__, buf);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                return 0;
+        }
+
+        spin_lock_irqsave(udc->lock, flags);
+
+        n += scnprintf(buf + n, PAGE_SIZE - n,
+                       "status = %08x\n", hw_read_intr_status());
+        n += scnprintf(buf + n, PAGE_SIZE - n,
+                       "enable = %08x\n", hw_read_intr_enable());
+
+        n += scnprintf(buf + n, PAGE_SIZE - n, "*test = %d\n",
+                       isr_statistics.test);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "? ui  = %d\n",
+                       isr_statistics.ui);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "? uei = %d\n",
+                       isr_statistics.uei);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "? pci = %d\n",
+                       isr_statistics.pci);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "? uri = %d\n",
+                       isr_statistics.uri);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "? sli = %d\n",
+                       isr_statistics.sli);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "*none = %d\n",
+                       isr_statistics.none);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "*hndl = %d\n",
+                       isr_statistics.hndl.cnt);
+
+        for (i = isr_statistics.hndl.idx, j = 0; j <= ISR_MASK; j++, i++) {
+                i   &= ISR_MASK;
+                intr = isr_statistics.hndl.buf[i];
+
+                if (USBi_UI  & intr)
+                        n += scnprintf(buf + n, PAGE_SIZE - n, "ui  ");
+                intr &= ~USBi_UI;
+                if (USBi_UEI & intr)
+                        n += scnprintf(buf + n, PAGE_SIZE - n, "uei ");
+                intr &= ~USBi_UEI;
+                if (USBi_PCI & intr)
+                        n += scnprintf(buf + n, PAGE_SIZE - n, "pci ");
+                intr &= ~USBi_PCI;
+                if (USBi_URI & intr)
+                        n += scnprintf(buf + n, PAGE_SIZE - n, "uri ");
+                intr &= ~USBi_URI;
+                if (USBi_SLI & intr)
+                        n += scnprintf(buf + n, PAGE_SIZE - n, "sli ");
+                intr &= ~USBi_SLI;
+                if (intr)
+                        n += scnprintf(buf + n, PAGE_SIZE - n, "??? ");
+                if (isr_statistics.hndl.buf[i])
+                        n += scnprintf(buf + n, PAGE_SIZE - n, "\n");
+        }
+
+        spin_unlock_irqrestore(udc->lock, flags);
+
+        return n;
+}
+
+/**
+ * store_inters: enable & force or disable an individual interrutps
+ *                   (to be used for test purposes only)
+ *
+ * Check "device.h" for details
+ */
+static ssize_t store_inters(struct device *dev, struct device_attribute *attr,
+                            const char *buf, size_t count)
+{
+        struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev);
+        unsigned long flags;
+        unsigned en, bit;
+
+        dbg_trace("[%s] %p, %d\n", __func__, buf, count);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                goto done;
+        }
+
+        if (sscanf(buf, "%u %u", &en, &bit) != 2 || en > 1) {
+                dev_err(dev, "<1|0> <bit>: enable|disable interrupt");
+                goto done;
+        }
+
+        spin_lock_irqsave(udc->lock, flags);
+        if (en) {
+                if (hw_intr_force(bit))
+                        dev_err(dev, "invalid bit number\n");
+                else
+                        isr_statistics.test++;
+        } else {
+                if (hw_intr_clear(bit))
+                        dev_err(dev, "invalid bit number\n");
+        }
+        spin_unlock_irqrestore(udc->lock, flags);
+
+ done:
+        return count;
+}
+static DEVICE_ATTR(inters, S_IRUSR | S_IWUSR, show_inters, store_inters);
+
+/**
+ * show_port_test: reads port test mode
+ *
+ * Check "device.h" for details
+ */
+static ssize_t show_port_test(struct device *dev,
+                              struct device_attribute *attr, char *buf)
+{
+        struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev);
+        unsigned long flags;
+        unsigned mode;
+
+        dbg_trace("[%s] %p\n", __func__, buf);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                return 0;
+        }
+
+        spin_lock_irqsave(udc->lock, flags);
+        mode = hw_port_test_get();
+        spin_unlock_irqrestore(udc->lock, flags);
+
+        return scnprintf(buf, PAGE_SIZE, "mode = %u\n", mode);
+}
+
+/**
+ * store_port_test: writes port test mode
+ *
+ * Check "device.h" for details
+ */
+static ssize_t store_port_test(struct device *dev,
+                               struct device_attribute *attr,
+                               const char *buf, size_t count)
+{
+        struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev);
+        unsigned long flags;
+        unsigned mode;
+
+        dbg_trace("[%s] %p, %d\n", __func__, buf, count);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                goto done;
+        }
+
+        if (sscanf(buf, "%u", &mode) != 1) {
+                dev_err(dev, "<mode>: set port test mode");
+                goto done;
+        }
+
+        spin_lock_irqsave(udc->lock, flags);
+        if (hw_port_test_set(mode))
+                dev_err(dev, "invalid mode\n");
+        spin_unlock_irqrestore(udc->lock, flags);
+
+ done:
+        return count;
+}
+static DEVICE_ATTR(port_test, S_IRUSR | S_IWUSR,
+                   show_port_test, store_port_test);
+
+/**
+ * show_qheads: DMA contents of all queue heads
+ *
+ * Check "device.h" for details
+ */
+static ssize_t show_qheads(struct device *dev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev);
+        unsigned long flags;
+        unsigned i, j, n = 0;
+
+        dbg_trace("[%s] %p\n", __func__, buf);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                return 0;
+        }
+
+        spin_lock_irqsave(udc->lock, flags);
+        for (i = 0; i < hw_ep_max/2; i++) {
+                struct ci13xxx_ep *mEpRx = &udc->ci13xxx_ep[i];
+                struct ci13xxx_ep *mEpTx = &udc->ci13xxx_ep[i + hw_ep_max/2];
+                n += scnprintf(buf + n, PAGE_SIZE - n,
+                               "EP=%02i: RX=%08X TX=%08X\n",
+                               i, (u32)mEpRx->qh.dma, (u32)mEpTx->qh.dma);
+                for (j = 0; j < (sizeof(struct ci13xxx_qh)/sizeof(u32)); j++) {
+                        n += scnprintf(buf + n, PAGE_SIZE - n,
+                                       " %04X:    %08X    %08X\n", j,
+                                       *((u32 *)mEpRx->qh.ptr + j),
+                                       *((u32 *)mEpTx->qh.ptr + j));
+                }
+        }
+        spin_unlock_irqrestore(udc->lock, flags);
+
+        return n;
+}
+static DEVICE_ATTR(qheads, S_IRUSR, show_qheads, NULL);
+
+/**
+ * show_registers: dumps all registers
+ *
+ * Check "device.h" for details
+ */
+#define DUMP_ENTRIES    512
+static ssize_t show_registers(struct device *dev,
+                              struct device_attribute *attr, char *buf)
+{
+        struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev);
+        unsigned long flags;
+        u32 *dump;
+        unsigned i, k, n = 0;
+
+        dbg_trace("[%s] %p\n", __func__, buf);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                return 0;
+        }
+
+        dump = kmalloc(sizeof(u32) * DUMP_ENTRIES, GFP_KERNEL);
+        if (!dump) {
+                dev_err(dev, "%s: out of memory\n", __func__);
+                return 0;
+        }
+
+        spin_lock_irqsave(udc->lock, flags);
+        k = hw_register_read(dump, DUMP_ENTRIES);
+        spin_unlock_irqrestore(udc->lock, flags);
+
+        for (i = 0; i < k; i++) {
+                n += scnprintf(buf + n, PAGE_SIZE - n,
+                               "reg[0x%04X] = 0x%08X\n",
+                               i * (unsigned)sizeof(u32), dump[i]);
+        }
+        kfree(dump);
+
+        return n;
+}
+
+/**
+ * store_registers: writes value to register address
+ *
+ * Check "device.h" for details
+ */
+static ssize_t store_registers(struct device *dev,
+                               struct device_attribute *attr,
+                               const char *buf, size_t count)
+{
+        struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev);
+        unsigned long addr, data, flags;
+
+        dbg_trace("[%s] %p, %d\n", __func__, buf, count);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                goto done;
+        }
+
+        if (sscanf(buf, "%li %li", &addr, &data) != 2) {
+                dev_err(dev, "<addr> <data>: write data to register address");
+                goto done;
+        }
+
+        spin_lock_irqsave(udc->lock, flags);
+        if (hw_register_write(addr, data))
+                dev_err(dev, "invalid address range\n");
+        spin_unlock_irqrestore(udc->lock, flags);
+
+ done:
+        return count;
+}
+static DEVICE_ATTR(registers, S_IRUSR | S_IWUSR,
+                   show_registers, store_registers);
+
+/**
+ * show_requests: DMA contents of all requests currently queued (all endpts)
+ *
+ * Check "device.h" for details
+ */
+static ssize_t show_requests(struct device *dev, struct device_attribute *attr,
+                             char *buf)
+{
+        struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev);
+        unsigned long flags;
+        struct list_head   *ptr = NULL;
+        struct ci13xxx_req *req = NULL;
+        unsigned i, j, n = 0, qSize = sizeof(struct ci13xxx_td)/sizeof(u32);
+
+        dbg_trace("[%s] %p\n", __func__, buf);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                return 0;
+        }
+
+        spin_lock_irqsave(udc->lock, flags);
+        for (i = 0; i < hw_ep_max; i++)
+                list_for_each(ptr, &udc->ci13xxx_ep[i].qh.queue)
+                {
+                        req = list_entry(ptr, struct ci13xxx_req, queue);
+
+                        n += scnprintf(buf + n, PAGE_SIZE - n,
+                                        "EP=%02i: TD=%08X %s\n",
+                                        i % hw_ep_max/2, (u32)req->dma,
+                                        ((i < hw_ep_max/2) ? "RX" : "TX"));
+
+                        for (j = 0; j < qSize; j++)
+                                n += scnprintf(buf + n, PAGE_SIZE - n,
+                                                " %04X:    %08X\n", j,
+                                                *((u32 *)req->ptr + j));
+                }
+        spin_unlock_irqrestore(udc->lock, flags);
+
+        return n;
+}
+static DEVICE_ATTR(requests, S_IRUSR, show_requests, NULL);
+
+/**
+ * dbg_create_files: initializes the attribute interface
+ * @dev: device
+ *
+ * This function returns an error code
+ */
+__maybe_unused static int dbg_create_files(struct device *dev)
+{
+        int retval = 0;
+
+        if (dev == NULL)
+                return -EINVAL;
+        retval = device_create_file(dev, &dev_attr_device);
+        if (retval)
+                goto done;
+        retval = device_create_file(dev, &dev_attr_driver);
+        if (retval)
+                goto rm_device;
+        retval = device_create_file(dev, &dev_attr_events);
+        if (retval)
+                goto rm_driver;
+        retval = device_create_file(dev, &dev_attr_inters);
+        if (retval)
+                goto rm_events;
+        retval = device_create_file(dev, &dev_attr_port_test);
+        if (retval)
+                goto rm_inters;
+        retval = device_create_file(dev, &dev_attr_qheads);
+        if (retval)
+                goto rm_port_test;
+        retval = device_create_file(dev, &dev_attr_registers);
+        if (retval)
+                goto rm_qheads;
+        retval = device_create_file(dev, &dev_attr_requests);
+        if (retval)
+                goto rm_registers;
+        return 0;
+
+ rm_registers:
+        device_remove_file(dev, &dev_attr_registers);
+ rm_qheads:
+        device_remove_file(dev, &dev_attr_qheads);
+ rm_port_test:
+        device_remove_file(dev, &dev_attr_port_test);
+ rm_inters:
+        device_remove_file(dev, &dev_attr_inters);
+ rm_events:
+        device_remove_file(dev, &dev_attr_events);
+ rm_driver:
+        device_remove_file(dev, &dev_attr_driver);
+ rm_device:
+        device_remove_file(dev, &dev_attr_device);
+ done:
+        return retval;
+}
+
+/**
+ * dbg_remove_files: destroys the attribute interface
+ * @dev: device
+ *
+ * This function returns an error code
+ */
+__maybe_unused static int dbg_remove_files(struct device *dev)
+{
+        if (dev == NULL)
+                return -EINVAL;
+        device_remove_file(dev, &dev_attr_requests);
+        device_remove_file(dev, &dev_attr_registers);
+        device_remove_file(dev, &dev_attr_qheads);
+        device_remove_file(dev, &dev_attr_port_test);
+        device_remove_file(dev, &dev_attr_inters);
+        device_remove_file(dev, &dev_attr_events);
+        device_remove_file(dev, &dev_attr_driver);
+        device_remove_file(dev, &dev_attr_device);
+        return 0;
+}
+
+/******************************************************************************
+ * UTIL block
+ *****************************************************************************/
+/**
+ * _usb_addr: calculates endpoint address from direction & number
+ * @ep:  endpoint
+ */
+static inline u8 _usb_addr(struct ci13xxx_ep *ep)
+{
+        return ((ep->dir == TX) ? USB_ENDPOINT_DIR_MASK : 0) | ep->num;
+}
+
+/**
+ * _hardware_queue: configures a request at hardware level
+ * @gadget: gadget
+ * @mEp:    endpoint
+ *
+ * This function returns an error code
+ */
+static int _hardware_enqueue(struct ci13xxx_ep *mEp, struct ci13xxx_req *mReq)
+{
+        unsigned i;
+        int ret = 0;
+        unsigned length = mReq->req.length;
+
+        trace("%p, %p", mEp, mReq);
+
+        /* don't queue twice */
+        if (mReq->req.status == -EALREADY)
+                return -EALREADY;
+
+        mReq->req.status = -EALREADY;
+        if (length && !mReq->req.dma) {
+                mReq->req.dma = \
+                        dma_map_single(mEp->device, mReq->req.buf,
+                                       length, mEp->dir ? DMA_TO_DEVICE :
+                                       DMA_FROM_DEVICE);
+                if (mReq->req.dma == 0)
+                        return -ENOMEM;
+
+                mReq->map = 1;
+        }
+
+        if (mReq->req.zero && length && (length % mEp->ep.maxpacket == 0)) {
+                mReq->zptr = dma_pool_alloc(mEp->td_pool, GFP_ATOMIC,
+                                           &mReq->zdma);
+                if (mReq->zptr == NULL) {
+                        if (mReq->map) {
+                                dma_unmap_single(mEp->device, mReq->req.dma,
+                                        length, mEp->dir ? DMA_TO_DEVICE :
+                                        DMA_FROM_DEVICE);
+                                mReq->req.dma = 0;
+                                mReq->map     = 0;
+                        }
+                        return -ENOMEM;
+                }
+                memset(mReq->zptr, 0, sizeof(*mReq->zptr));
+                mReq->zptr->next    = TD_TERMINATE;
+                mReq->zptr->token   = TD_STATUS_ACTIVE;
+                if (!mReq->req.no_interrupt)
+                        mReq->zptr->token   |= TD_IOC;
+        }
+        /*
+         * TD configuration
+         * TODO - handle requests which spawns into several TDs
+         */
+        memset(mReq->ptr, 0, sizeof(*mReq->ptr));
+        mReq->ptr->token    = length << ffs_nr(TD_TOTAL_BYTES);
+        mReq->ptr->token   &= TD_TOTAL_BYTES;
+        mReq->ptr->token   |= TD_STATUS_ACTIVE;
+        if (mReq->zptr) {
+                mReq->ptr->next    = mReq->zdma;
+        } else {
+                mReq->ptr->next    = TD_TERMINATE;
+                if (!mReq->req.no_interrupt)
+                        mReq->ptr->token  |= TD_IOC;
+        }
+        mReq->ptr->page[0]  = mReq->req.dma;
+        for (i = 1; i < 5; i++)
+                mReq->ptr->page[i] =
+                        (mReq->req.dma + i * CI13XXX_PAGE_SIZE) & ~TD_RESERVED_MASK;
+
+        if (!list_empty(&mEp->qh.queue)) {
+                struct ci13xxx_req *mReqPrev;
+                int n = hw_ep_bit(mEp->num, mEp->dir);
+                int tmp_stat;
+
+                mReqPrev = list_entry(mEp->qh.queue.prev,
+                                struct ci13xxx_req, queue);
+                if (mReqPrev->zptr)
+                        mReqPrev->zptr->next = mReq->dma & TD_ADDR_MASK;
+                else
+                        mReqPrev->ptr->next = mReq->dma & TD_ADDR_MASK;
+                wmb();
+                if (hw_cread(CAP_ENDPTPRIME, BIT(n)))
+                        goto done;
+                do {
+                        hw_cwrite(CAP_USBCMD, USBCMD_ATDTW, USBCMD_ATDTW);
+                        tmp_stat = hw_cread(CAP_ENDPTSTAT, BIT(n));
+                } while (!hw_cread(CAP_USBCMD, USBCMD_ATDTW));
+                hw_cwrite(CAP_USBCMD, USBCMD_ATDTW, 0);
+                if (tmp_stat)
+                        goto done;
+        }
+
+        /*  QH configuration */
+        mEp->qh.ptr->td.next   = mReq->dma;    /* TERMINATE = 0 */
+        mEp->qh.ptr->td.token &= ~TD_STATUS;   /* clear status */
+        mEp->qh.ptr->cap |=  QH_ZLT;
+
+        wmb();   /* synchronize before ep prime */
+
+        ret = hw_ep_prime(mEp->num, mEp->dir,
+                           mEp->type == USB_ENDPOINT_XFER_CONTROL);
+done:
+        return ret;
+}
+
+/**
+ * _hardware_dequeue: handles a request at hardware level
+ * @gadget: gadget
+ * @mEp:    endpoint
+ *
+ * This function returns an error code
+ */
+static int _hardware_dequeue(struct ci13xxx_ep *mEp, struct ci13xxx_req *mReq)
+{
+        trace("%p, %p", mEp, mReq);
+
+        if (mReq->req.status != -EALREADY)
+                return -EINVAL;
+
+        if ((TD_STATUS_ACTIVE & mReq->ptr->token) != 0)
+                return -EBUSY;
+
+        if (mReq->zptr) {
+                if ((TD_STATUS_ACTIVE & mReq->zptr->token) != 0)
+                        return -EBUSY;
+                dma_pool_free(mEp->td_pool, mReq->zptr, mReq->zdma);
+                mReq->zptr = NULL;
+        }
+
+        mReq->req.status = 0;
+
+        if (mReq->map) {
+                dma_unmap_single(mEp->device, mReq->req.dma, mReq->req.length,
+                                 mEp->dir ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+                mReq->req.dma = 0;
+                mReq->map     = 0;
+        }
+
+        mReq->req.status = mReq->ptr->token & TD_STATUS;
+        if ((TD_STATUS_HALTED & mReq->req.status) != 0)
+                mReq->req.status = -1;
+        else if ((TD_STATUS_DT_ERR & mReq->req.status) != 0)
+                mReq->req.status = -1;
+        else if ((TD_STATUS_TR_ERR & mReq->req.status) != 0)
+                mReq->req.status = -1;
+
+        mReq->req.actual   = mReq->ptr->token & TD_TOTAL_BYTES;
+        mReq->req.actual >>= ffs_nr(TD_TOTAL_BYTES);
+        mReq->req.actual   = mReq->req.length - mReq->req.actual;
+        mReq->req.actual   = mReq->req.status ? 0 : mReq->req.actual;
+
+        return mReq->req.actual;
+}
+
+/**
+ * _ep_nuke: dequeues all endpoint requests
+ * @mEp: endpoint
+ *
+ * This function returns an error code
+ * Caller must hold lock
+ */
+static int _ep_nuke(struct ci13xxx_ep *mEp)
+__releases(mEp->lock)
+__acquires(mEp->lock)
+{
+        trace("%p", mEp);
+
+        if (mEp == NULL)
+                return -EINVAL;
+
+        hw_ep_flush(mEp->num, mEp->dir);
+
+        while (!list_empty(&mEp->qh.queue)) {
+
+                /* pop oldest request */
+                struct ci13xxx_req *mReq = \
+                        list_entry(mEp->qh.queue.next,
+                                   struct ci13xxx_req, queue);
+                list_del_init(&mReq->queue);
+                mReq->req.status = -ESHUTDOWN;
+
+                if (mReq->req.complete != NULL) {
+                        spin_unlock(mEp->lock);
+                        mReq->req.complete(&mEp->ep, &mReq->req);
+                        spin_lock(mEp->lock);
+                }
+        }
+        return 0;
+}
+
+/**
+ * _gadget_stop_activity: stops all USB activity, flushes & disables all endpts
+ * @gadget: gadget
+ *
+ * This function returns an error code
+ * Caller must hold lock
+ */
+static int _gadget_stop_activity(struct usb_gadget *gadget)
+{
+        struct usb_ep *ep;
+        struct ci13xxx    *udc = container_of(gadget, struct ci13xxx, gadget);
+        unsigned long flags;
+
+        trace("%p", gadget);
+
+        if (gadget == NULL)
+                return -EINVAL;
+
+        spin_lock_irqsave(udc->lock, flags);
+        udc->gadget.speed = USB_SPEED_UNKNOWN;
+        udc->remote_wakeup = 0;
+        udc->suspended = 0;
+        spin_unlock_irqrestore(udc->lock, flags);
+
+        /* flush all endpoints */
+        gadget_for_each_ep(ep, gadget) {
+                usb_ep_fifo_flush(ep);
+        }
+        usb_ep_fifo_flush(&udc->ep0out.ep);
+        usb_ep_fifo_flush(&udc->ep0in.ep);
+
+        udc->driver->disconnect(gadget);
+
+        /* make sure to disable all endpoints */
+        gadget_for_each_ep(ep, gadget) {
+                usb_ep_disable(ep);
+        }
+
+        if (udc->status != NULL) {
+                usb_ep_free_request(&udc->ep0in.ep, udc->status);
+                udc->status = NULL;
+        }
+
+        return 0;
+}
+
+/******************************************************************************
+ * ISR block
+ *****************************************************************************/
+/**
+ * isr_reset_handler: USB reset interrupt handler
+ * @udc: UDC device
+ *
+ * This function resets USB engine after a bus reset occurred
+ */
+static void isr_reset_handler(struct ci13xxx *udc)
+__releases(udc->lock)
+__acquires(udc->lock)
+{
+        int retval;
+
+        trace("%p", udc);
+
+        if (udc == NULL) {
+                err("EINVAL");
+                return;
+        }
+
+        dbg_event(0xFF, "BUS RST", 0);
+
+        spin_unlock(udc->lock);
+        retval = _gadget_stop_activity(&udc->gadget);
+        if (retval)
+                goto done;
+
+        retval = hw_usb_reset();
+        if (retval)
+                goto done;
+
+        udc->status = usb_ep_alloc_request(&udc->ep0in.ep, GFP_ATOMIC);
+        if (udc->status == NULL)
+                retval = -ENOMEM;
+
+        spin_lock(udc->lock);
+
+ done:
+        if (retval)
+                err("error: %i", retval);
+}
+
+/**
+ * isr_get_status_complete: get_status request complete function
+ * @ep:  endpoint
+ * @req: request handled
+ *
+ * Caller must release lock
+ */
+static void isr_get_status_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        trace("%p, %p", ep, req);
+
+        if (ep == NULL || req == NULL) {
+                err("EINVAL");
+                return;
+        }
+
+        kfree(req->buf);
+        usb_ep_free_request(ep, req);
+}
+
+/**
+ * isr_get_status_response: get_status request response
+ * @udc: udc struct
+ * @setup: setup request packet
+ *
+ * This function returns an error code
+ */
+static int isr_get_status_response(struct ci13xxx *udc,
+                                   struct usb_ctrlrequest *setup)
+__releases(mEp->lock)
+__acquires(mEp->lock)
+{
+        struct ci13xxx_ep *mEp = &udc->ep0in;
+        struct usb_request *req = NULL;
+        gfp_t gfp_flags = GFP_ATOMIC;
+        int dir, num, retval;
+
+        trace("%p, %p", mEp, setup);
+
+        if (mEp == NULL || setup == NULL)
+                return -EINVAL;
+
+        spin_unlock(mEp->lock);
+        req = usb_ep_alloc_request(&mEp->ep, gfp_flags);
+        spin_lock(mEp->lock);
+        if (req == NULL)
+                return -ENOMEM;
+
+        req->complete = isr_get_status_complete;
+        req->length   = 2;
+        req->buf      = kzalloc(req->length, gfp_flags);
+        if (req->buf == NULL) {
+                retval = -ENOMEM;
+                goto err_free_req;
+        }
+
+        if ((setup->bRequestType & USB_RECIP_MASK) == USB_RECIP_DEVICE) {
+                /* Assume that device is bus powered for now. */
+                *((u16 *)req->buf) = _udc->remote_wakeup << 1;
+                retval = 0;
+        } else if ((setup->bRequestType & USB_RECIP_MASK) \
+                   == USB_RECIP_ENDPOINT) {
+                dir = (le16_to_cpu(setup->wIndex) & USB_ENDPOINT_DIR_MASK) ?
+                        TX : RX;
+                num =  le16_to_cpu(setup->wIndex) & USB_ENDPOINT_NUMBER_MASK;
+                *((u16 *)req->buf) = hw_ep_get_halt(num, dir);
+        }
+        /* else do nothing; reserved for future use */
+
+        spin_unlock(mEp->lock);
+        retval = usb_ep_queue(&mEp->ep, req, gfp_flags);
+        spin_lock(mEp->lock);
+        if (retval)
+                goto err_free_buf;
+
+        return 0;
+
+ err_free_buf:
+        kfree(req->buf);
+ err_free_req:
+        spin_unlock(mEp->lock);
+        usb_ep_free_request(&mEp->ep, req);
+        spin_lock(mEp->lock);
+        return retval;
+}
+
+/**
+ * isr_setup_status_complete: setup_status request complete function
+ * @ep:  endpoint
+ * @req: request handled
+ *
+ * Caller must release lock. Put the port in test mode if test mode
+ * feature is selected.
+ */
+static void
+isr_setup_status_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct ci13xxx *udc = req->context;
+        unsigned long flags;
+
+        trace("%p, %p", ep, req);
+
+        spin_lock_irqsave(udc->lock, flags);
+        if (udc->test_mode)
+                hw_port_test_set(udc->test_mode);
+        spin_unlock_irqrestore(udc->lock, flags);
+}
+
+/**
+ * isr_setup_status_phase: queues the status phase of a setup transation
+ * @udc: udc struct
+ *
+ * This function returns an error code
+ */
+static int isr_setup_status_phase(struct ci13xxx *udc)
+__releases(mEp->lock)
+__acquires(mEp->lock)
+{
+        int retval;
+        struct ci13xxx_ep *mEp;
+
+        trace("%p", udc);
+
+        mEp = (udc->ep0_dir == TX) ? &udc->ep0out : &udc->ep0in;
+        udc->status->context = udc;
+        udc->status->complete = isr_setup_status_complete;
+
+        spin_unlock(mEp->lock);
+        retval = usb_ep_queue(&mEp->ep, udc->status, GFP_ATOMIC);
+        spin_lock(mEp->lock);
+
+        return retval;
+}
+
+/**
+ * isr_tr_complete_low: transaction complete low level handler
+ * @mEp: endpoint
+ *
+ * This function returns an error code
+ * Caller must hold lock
+ */
+static int isr_tr_complete_low(struct ci13xxx_ep *mEp)
+__releases(mEp->lock)
+__acquires(mEp->lock)
+{
+        struct ci13xxx_req *mReq, *mReqTemp;
+        struct ci13xxx_ep *mEpTemp = mEp;
+        int uninitialized_var(retval);
+
+        trace("%p", mEp);
+
+        if (list_empty(&mEp->qh.queue))
+                return -EINVAL;
+
+        list_for_each_entry_safe(mReq, mReqTemp, &mEp->qh.queue,
+                        queue) {
+                retval = _hardware_dequeue(mEp, mReq);
+                if (retval < 0)
+                        break;
+                list_del_init(&mReq->queue);
+                dbg_done(_usb_addr(mEp), mReq->ptr->token, retval);
+                if (mReq->req.complete != NULL) {
+                        spin_unlock(mEp->lock);
+                        if ((mEp->type == USB_ENDPOINT_XFER_CONTROL) &&
+                                        mReq->req.length)
+                                mEpTemp = &_udc->ep0in;
+                        mReq->req.complete(&mEpTemp->ep, &mReq->req);
+                        spin_lock(mEp->lock);
+                }
+        }
+
+        if (retval == -EBUSY)
+                retval = 0;
+        if (retval < 0)
+                dbg_event(_usb_addr(mEp), "DONE", retval);
+
+        return retval;
+}
+
+/**
+ * isr_tr_complete_handler: transaction complete interrupt handler
+ * @udc: UDC descriptor
+ *
+ * This function handles traffic events
+ */
+static void isr_tr_complete_handler(struct ci13xxx *udc)
+__releases(udc->lock)
+__acquires(udc->lock)
+{
+        unsigned i;
+        u8 tmode = 0;
+
+        trace("%p", udc);
+
+        if (udc == NULL) {
+                err("EINVAL");
+                return;
+        }
+
+        for (i = 0; i < hw_ep_max; i++) {
+                struct ci13xxx_ep *mEp  = &udc->ci13xxx_ep[i];
+                int type, num, dir, err = -EINVAL;
+                struct usb_ctrlrequest req;
+
+                if (mEp->desc == NULL)
+                        continue;   /* not configured */
+
+                if (hw_test_and_clear_complete(i)) {
+                        err = isr_tr_complete_low(mEp);
+                        if (mEp->type == USB_ENDPOINT_XFER_CONTROL) {
+                                if (err > 0)   /* needs status phase */
+                                        err = isr_setup_status_phase(udc);
+                                if (err < 0) {
+                                        dbg_event(_usb_addr(mEp),
+                                                  "ERROR", err);
+                                        spin_unlock(udc->lock);
+                                        if (usb_ep_set_halt(&mEp->ep))
+                                                err("error: ep_set_halt");
+                                        spin_lock(udc->lock);
+                                }
+                        }
+                }
+
+                if (mEp->type != USB_ENDPOINT_XFER_CONTROL ||
+                    !hw_test_and_clear_setup_status(i))
+                        continue;
+
+                if (i != 0) {
+                        warn("ctrl traffic received at endpoint");
+                        continue;
+                }
+
+                /*
+                 * Flush data and handshake transactions of previous
+                 * setup packet.
+                 */
+                _ep_nuke(&udc->ep0out);
+                _ep_nuke(&udc->ep0in);
+
+                /* read_setup_packet */
+                do {
+                        hw_test_and_set_setup_guard();
+                        memcpy(&req, &mEp->qh.ptr->setup, sizeof(req));
+                } while (!hw_test_and_clear_setup_guard());
+
+                type = req.bRequestType;
+
+                udc->ep0_dir = (type & USB_DIR_IN) ? TX : RX;
+
+                dbg_setup(_usb_addr(mEp), &req);
+
+                switch (req.bRequest) {
+                case USB_REQ_CLEAR_FEATURE:
+                        if (type == (USB_DIR_OUT|USB_RECIP_ENDPOINT) &&
+                                        le16_to_cpu(req.wValue) ==
+                                        USB_ENDPOINT_HALT) {
+                                if (req.wLength != 0)
+                                        break;
+                                num  = le16_to_cpu(req.wIndex);
+                                dir = num & USB_ENDPOINT_DIR_MASK;
+                                num &= USB_ENDPOINT_NUMBER_MASK;
+                                if (dir) /* TX */
+                                        num += hw_ep_max/2;
+                                if (!udc->ci13xxx_ep[num].wedge) {
+                                        spin_unlock(udc->lock);
+                                        err = usb_ep_clear_halt(
+                                                &udc->ci13xxx_ep[num].ep);
+                                        spin_lock(udc->lock);
+                                        if (err)
+                                                break;
+                                }
+                                err = isr_setup_status_phase(udc);
+                        } else if (type == (USB_DIR_OUT|USB_RECIP_DEVICE) &&
+                                        le16_to_cpu(req.wValue) ==
+                                        USB_DEVICE_REMOTE_WAKEUP) {
+                                if (req.wLength != 0)
+                                        break;
+                                udc->remote_wakeup = 0;
+                                err = isr_setup_status_phase(udc);
+                        } else {
+                                goto delegate;
+                        }
+                        break;
+                case USB_REQ_GET_STATUS:
+                        if (type != (USB_DIR_IN|USB_RECIP_DEVICE)   &&
+                            type != (USB_DIR_IN|USB_RECIP_ENDPOINT) &&
+                            type != (USB_DIR_IN|USB_RECIP_INTERFACE))
+                                goto delegate;
+                        if (le16_to_cpu(req.wLength) != 2 ||
+                            le16_to_cpu(req.wValue)  != 0)
+                                break;
+                        err = isr_get_status_response(udc, &req);
+                        break;
+                case USB_REQ_SET_ADDRESS:
+                        if (type != (USB_DIR_OUT|USB_RECIP_DEVICE))
+                                goto delegate;
+                        if (le16_to_cpu(req.wLength) != 0 ||
+                            le16_to_cpu(req.wIndex)  != 0)
+                                break;
+                        err = hw_usb_set_address((u8)le16_to_cpu(req.wValue));
+                        if (err)
+                                break;
+                        err = isr_setup_status_phase(udc);
+                        break;
+                case USB_REQ_SET_FEATURE:
+                        if (type == (USB_DIR_OUT|USB_RECIP_ENDPOINT) &&
+                                        le16_to_cpu(req.wValue) ==
+                                        USB_ENDPOINT_HALT) {
+                                if (req.wLength != 0)
+                                        break;
+                                num  = le16_to_cpu(req.wIndex);
+                                dir = num & USB_ENDPOINT_DIR_MASK;
+                                num &= USB_ENDPOINT_NUMBER_MASK;
+                                if (dir) /* TX */
+                                        num += hw_ep_max/2;
+
+                                spin_unlock(udc->lock);
+                                err = usb_ep_set_halt(&udc->ci13xxx_ep[num].ep);
+                                spin_lock(udc->lock);
+                                if (!err)
+                                        isr_setup_status_phase(udc);
+                        } else if (type == (USB_DIR_OUT|USB_RECIP_DEVICE)) {
+                                if (req.wLength != 0)
+                                        break;
+                                switch (le16_to_cpu(req.wValue)) {
+                                case USB_DEVICE_REMOTE_WAKEUP:
+                                        udc->remote_wakeup = 1;
+                                        err = isr_setup_status_phase(udc);
+                                        break;
+                                case USB_DEVICE_TEST_MODE:
+                                        tmode = le16_to_cpu(req.wIndex) >> 8;
+                                        switch (tmode) {
+                                        case TEST_J:
+                                        case TEST_K:
+                                        case TEST_SE0_NAK:
+                                        case TEST_PACKET:
+                                        case TEST_FORCE_EN:
+                                                udc->test_mode = tmode;
+                                                err = isr_setup_status_phase(
+                                                                udc);
+                                                break;
+                                        default:
+                                                break;
+                                        }
+                                default:
+                                        goto delegate;
+                                }
+                        } else {
+                                goto delegate;
+                        }
+                        break;
+                default:
+delegate:
+                        if (req.wLength == 0)   /* no data phase */
+                                udc->ep0_dir = TX;
+
+                        spin_unlock(udc->lock);
+                        err = udc->driver->setup(&udc->gadget, &req);
+                        spin_lock(udc->lock);
+                        break;
+                }
+
+                if (err < 0) {
+                        dbg_event(_usb_addr(mEp), "ERROR", err);
+
+                        spin_unlock(udc->lock);
+                        if (usb_ep_set_halt(&mEp->ep))
+                                err("error: ep_set_halt");
+                        spin_lock(udc->lock);
+                }
+        }
+}
+
+/******************************************************************************
+ * ENDPT block
+ *****************************************************************************/
+/**
+ * ep_enable: configure endpoint, making it usable
+ *
+ * Check usb_ep_enable() at "usb_gadget.h" for details
+ */
+static int ep_enable(struct usb_ep *ep,
+                     const struct usb_endpoint_descriptor *desc)
+{
+        struct ci13xxx_ep *mEp = container_of(ep, struct ci13xxx_ep, ep);
+        int retval = 0;
+        unsigned long flags;
+
+        trace("%p, %p", ep, desc);
+
+        if (ep == NULL || desc == NULL)
+                return -EINVAL;
+
+        spin_lock_irqsave(mEp->lock, flags);
+
+        /* only internal SW should enable ctrl endpts */
+
+        mEp->desc = desc;
+
+        if (!list_empty(&mEp->qh.queue))
+                warn("enabling a non-empty endpoint!");
+
+        mEp->dir  = usb_endpoint_dir_in(desc) ? TX : RX;
+        mEp->num  = usb_endpoint_num(desc);
+        mEp->type = usb_endpoint_type(desc);
+
+        mEp->ep.maxpacket = __constant_le16_to_cpu(desc->wMaxPacketSize);
+
+        dbg_event(_usb_addr(mEp), "ENABLE", 0);
+
+        mEp->qh.ptr->cap = 0;
+
+        if (mEp->type == USB_ENDPOINT_XFER_CONTROL)
+                mEp->qh.ptr->cap |=  QH_IOS;
+        else if (mEp->type == USB_ENDPOINT_XFER_ISOC)
+                mEp->qh.ptr->cap &= ~QH_MULT;
+        else
+                mEp->qh.ptr->cap &= ~QH_ZLT;
+
+        mEp->qh.ptr->cap |=
+                (mEp->ep.maxpacket << ffs_nr(QH_MAX_PKT)) & QH_MAX_PKT;
+        mEp->qh.ptr->td.next |= TD_TERMINATE;   /* needed? */
+
+        /*
+         * Enable endpoints in the HW other than ep0 as ep0
+         * is always enabled
+         */
+        if (mEp->num)
+                retval |= hw_ep_enable(mEp->num, mEp->dir, mEp->type);
+
+        spin_unlock_irqrestore(mEp->lock, flags);
+        return retval;
+}
+
+/**
+ * ep_disable: endpoint is no longer usable
+ *
+ * Check usb_ep_disable() at "usb_gadget.h" for details
+ */
+static int ep_disable(struct usb_ep *ep)
+{
+        struct ci13xxx_ep *mEp = container_of(ep, struct ci13xxx_ep, ep);
+        int direction, retval = 0;
+        unsigned long flags;
+
+        trace("%p", ep);
+
+        if (ep == NULL)
+                return -EINVAL;
+        else if (mEp->desc == NULL)
+                return -EBUSY;
+
+        spin_lock_irqsave(mEp->lock, flags);
+
+        /* only internal SW should disable ctrl endpts */
+
+        direction = mEp->dir;
+        do {
+                dbg_event(_usb_addr(mEp), "DISABLE", 0);
+
+                retval |= _ep_nuke(mEp);
+                retval |= hw_ep_disable(mEp->num, mEp->dir);
+
+                if (mEp->type == USB_ENDPOINT_XFER_CONTROL)
+                        mEp->dir = (mEp->dir == TX) ? RX : TX;
+
+        } while (mEp->dir != direction);
+
+        mEp->desc = NULL;
+
+        spin_unlock_irqrestore(mEp->lock, flags);
+        return retval;
+}
+
+/**
+ * ep_alloc_request: allocate a request object to use with this endpoint
+ *
+ * Check usb_ep_alloc_request() at "usb_gadget.h" for details
+ */
+static struct usb_request *ep_alloc_request(struct usb_ep *ep, gfp_t gfp_flags)
+{
+        struct ci13xxx_ep  *mEp  = container_of(ep, struct ci13xxx_ep, ep);
+        struct ci13xxx_req *mReq = NULL;
+
+        trace("%p, %i", ep, gfp_flags);
+
+        if (ep == NULL) {
+                err("EINVAL");
+                return NULL;
+        }
+
+        mReq = kzalloc(sizeof(struct ci13xxx_req), gfp_flags);
+        if (mReq != NULL) {
+                INIT_LIST_HEAD(&mReq->queue);
+
+                mReq->ptr = dma_pool_alloc(mEp->td_pool, gfp_flags,
+                                           &mReq->dma);
+                if (mReq->ptr == NULL) {
+                        kfree(mReq);
+                        mReq = NULL;
+                }
+        }
+
+        dbg_event(_usb_addr(mEp), "ALLOC", mReq == NULL);
+
+        return (mReq == NULL) ? NULL : &mReq->req;
+}
+
+/**
+ * ep_free_request: frees a request object
+ *
+ * Check usb_ep_free_request() at "usb_gadget.h" for details
+ */
+static void ep_free_request(struct usb_ep *ep, struct usb_request *req)
+{
+        struct ci13xxx_ep  *mEp  = container_of(ep,  struct ci13xxx_ep, ep);
+        struct ci13xxx_req *mReq = container_of(req, struct ci13xxx_req, req);
+        unsigned long flags;
+
+        trace("%p, %p", ep, req);
+
+        if (ep == NULL || req == NULL) {
+                err("EINVAL");
+                return;
+        } else if (!list_empty(&mReq->queue)) {
+                err("EBUSY");
+                return;
+        }
+
+        spin_lock_irqsave(mEp->lock, flags);
+
+        if (mReq->ptr)
+                dma_pool_free(mEp->td_pool, mReq->ptr, mReq->dma);
+        kfree(mReq);
+
+        dbg_event(_usb_addr(mEp), "FREE", 0);
+
+        spin_unlock_irqrestore(mEp->lock, flags);
+}
+
+/**
+ * ep_queue: queues (submits) an I/O request to an endpoint
+ *
+ * Check usb_ep_queue()* at usb_gadget.h" for details
+ */
+static int ep_queue(struct usb_ep *ep, struct usb_request *req,
+                    gfp_t __maybe_unused gfp_flags)
+{
+        struct ci13xxx_ep  *mEp  = container_of(ep,  struct ci13xxx_ep, ep);
+        struct ci13xxx_req *mReq = container_of(req, struct ci13xxx_req, req);
+        int retval = 0;
+        unsigned long flags;
+
+        trace("%p, %p, %X", ep, req, gfp_flags);
+
+        if (ep == NULL || req == NULL || mEp->desc == NULL)
+                return -EINVAL;
+
+        spin_lock_irqsave(mEp->lock, flags);
+
+        if (mEp->type == USB_ENDPOINT_XFER_CONTROL) {
+                if (req->length)
+                        mEp = (_udc->ep0_dir == RX) ?
+                                &_udc->ep0out : &_udc->ep0in;
+                if (!list_empty(&mEp->qh.queue)) {
+                        _ep_nuke(mEp);
+                        retval = -EOVERFLOW;
+                        warn("endpoint ctrl %X nuked", _usb_addr(mEp));
+                }
+        }
+
+        /* first nuke then test link, e.g. previous status has not sent */
+        if (!list_empty(&mReq->queue)) {
+                retval = -EBUSY;
+                err("request already in queue");
+                goto done;
+        }
+
+        if (req->length > (4 * CI13XXX_PAGE_SIZE)) {
+                req->length = (4 * CI13XXX_PAGE_SIZE);
+                retval = -EMSGSIZE;
+                warn("request length truncated");
+        }
+
+        dbg_queue(_usb_addr(mEp), req, retval);
+
+        /* push request */
+        mReq->req.status = -EINPROGRESS;
+        mReq->req.actual = 0;
+
+        retval = _hardware_enqueue(mEp, mReq);
+
+        if (retval == -EALREADY) {
+                dbg_event(_usb_addr(mEp), "QUEUE", retval);
+                retval = 0;
+        }
+        if (!retval)
+                list_add_tail(&mReq->queue, &mEp->qh.queue);
+
+ done:
+        spin_unlock_irqrestore(mEp->lock, flags);
+        return retval;
+}
+
+/**
+ * ep_dequeue: dequeues (cancels, unlinks) an I/O request from an endpoint
+ *
+ * Check usb_ep_dequeue() at "usb_gadget.h" for details
+ */
+static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
+{
+        struct ci13xxx_ep  *mEp  = container_of(ep,  struct ci13xxx_ep, ep);
+        struct ci13xxx_req *mReq = container_of(req, struct ci13xxx_req, req);
+        unsigned long flags;
+
+        trace("%p, %p", ep, req);
+
+        if (ep == NULL || req == NULL || mReq->req.status != -EALREADY ||
+                mEp->desc == NULL || list_empty(&mReq->queue) ||
+                list_empty(&mEp->qh.queue))
+                return -EINVAL;
+
+        spin_lock_irqsave(mEp->lock, flags);
+
+        dbg_event(_usb_addr(mEp), "DEQUEUE", 0);
+
+        hw_ep_flush(mEp->num, mEp->dir);
+
+        /* pop request */
+        list_del_init(&mReq->queue);
+        if (mReq->map) {
+                dma_unmap_single(mEp->device, mReq->req.dma, mReq->req.length,
+                                 mEp->dir ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+                mReq->req.dma = 0;
+                mReq->map     = 0;
+        }
+        req->status = -ECONNRESET;
+
+        if (mReq->req.complete != NULL) {
+                spin_unlock(mEp->lock);
+                mReq->req.complete(&mEp->ep, &mReq->req);
+                spin_lock(mEp->lock);
+        }
+
+        spin_unlock_irqrestore(mEp->lock, flags);
+        return 0;
+}
+
+/**
+ * ep_set_halt: sets the endpoint halt feature
+ *
+ * Check usb_ep_set_halt() at "usb_gadget.h" for details
+ */
+static int ep_set_halt(struct usb_ep *ep, int value)
+{
+        struct ci13xxx_ep *mEp = container_of(ep, struct ci13xxx_ep, ep);
+        int direction, retval = 0;
+        unsigned long flags;
+
+        trace("%p, %i", ep, value);
+
+        if (ep == NULL || mEp->desc == NULL)
+                return -EINVAL;
+
+        spin_lock_irqsave(mEp->lock, flags);
+
+#ifndef STALL_IN
+        /* g_file_storage MS compliant but g_zero fails chapter 9 compliance */
+        if (value && mEp->type == USB_ENDPOINT_XFER_BULK && mEp->dir == TX &&
+            !list_empty(&mEp->qh.queue)) {
+                spin_unlock_irqrestore(mEp->lock, flags);
+                return -EAGAIN;
+        }
+#endif
+
+        direction = mEp->dir;
+        do {
+                dbg_event(_usb_addr(mEp), "HALT", value);
+                retval |= hw_ep_set_halt(mEp->num, mEp->dir, value);
+
+                if (!value)
+                        mEp->wedge = 0;
+
+                if (mEp->type == USB_ENDPOINT_XFER_CONTROL)
+                        mEp->dir = (mEp->dir == TX) ? RX : TX;
+
+        } while (mEp->dir != direction);
+
+        spin_unlock_irqrestore(mEp->lock, flags);
+        return retval;
+}
+
+/**
+ * ep_set_wedge: sets the halt feature and ignores clear requests
+ *
+ * Check usb_ep_set_wedge() at "usb_gadget.h" for details
+ */
+static int ep_set_wedge(struct usb_ep *ep)
+{
+        struct ci13xxx_ep *mEp = container_of(ep, struct ci13xxx_ep, ep);
+        unsigned long flags;
+
+        trace("%p", ep);
+
+        if (ep == NULL || mEp->desc == NULL)
+                return -EINVAL;
+
+        spin_lock_irqsave(mEp->lock, flags);
+
+        dbg_event(_usb_addr(mEp), "WEDGE", 0);
+        mEp->wedge = 1;
+
+        spin_unlock_irqrestore(mEp->lock, flags);
+
+        return usb_ep_set_halt(ep);
+}
+
+/**
+ * ep_fifo_flush: flushes contents of a fifo
+ *
+ * Check usb_ep_fifo_flush() at "usb_gadget.h" for details
+ */
+static void ep_fifo_flush(struct usb_ep *ep)
+{
+        struct ci13xxx_ep *mEp = container_of(ep, struct ci13xxx_ep, ep);
+        unsigned long flags;
+
+        trace("%p", ep);
+
+        if (ep == NULL) {
+                err("%02X: -EINVAL", _usb_addr(mEp));
+                return;
+        }
+
+        spin_lock_irqsave(mEp->lock, flags);
+
+        dbg_event(_usb_addr(mEp), "FFLUSH", 0);
+        hw_ep_flush(mEp->num, mEp->dir);
+
+        spin_unlock_irqrestore(mEp->lock, flags);
+}
+
+/**
+ * Endpoint-specific part of the API to the USB controller hardware
+ * Check "usb_gadget.h" for details
+ */
+static const struct usb_ep_ops usb_ep_ops = {
+        .enable        = ep_enable,
+        .disable       = ep_disable,
+        .alloc_request = ep_alloc_request,
+        .free_request  = ep_free_request,
+        .queue         = ep_queue,
+        .dequeue       = ep_dequeue,
+        .set_halt      = ep_set_halt,
+        .set_wedge     = ep_set_wedge,
+        .fifo_flush    = ep_fifo_flush,
+};
+
+/******************************************************************************
+ * GADGET block
+ *****************************************************************************/
+static int ci13xxx_vbus_session(struct usb_gadget *_gadget, int is_active)
+{
+        struct ci13xxx *udc = container_of(_gadget, struct ci13xxx, gadget);
+        unsigned long flags;
+        int gadget_ready = 0;
+
+        if (!(udc->udc_driver->flags & CI13XXX_PULLUP_ON_VBUS))
+                return -EOPNOTSUPP;
+
+        spin_lock_irqsave(udc->lock, flags);
+        udc->vbus_active = is_active;
+        if (udc->driver)
+                gadget_ready = 1;
+        spin_unlock_irqrestore(udc->lock, flags);
+
+        if (gadget_ready) {
+                if (is_active) {
+                        pm_runtime_get_sync(&_gadget->dev);
+                        hw_device_reset(udc);
+                        hw_device_state(udc->ep0out.qh.dma);
+                } else {
+                        hw_device_state(0);
+                        if (udc->udc_driver->notify_event)
+                                udc->udc_driver->notify_event(udc,
+                                CI13XXX_CONTROLLER_STOPPED_EVENT);
+                        _gadget_stop_activity(&udc->gadget);
+                        pm_runtime_put_sync(&_gadget->dev);
+                }
+        }
+
+        return 0;
+}
+
+static int ci13xxx_wakeup(struct usb_gadget *_gadget)
+{
+        struct ci13xxx *udc = container_of(_gadget, struct ci13xxx, gadget);
+        unsigned long flags;
+        int ret = 0;
+
+        trace();
+
+        spin_lock_irqsave(udc->lock, flags);
+        if (!udc->remote_wakeup) {
+                ret = -EOPNOTSUPP;
+                dbg_trace("remote wakeup feature is not enabled\n");
+                goto out;
+        }
+        if (!hw_cread(CAP_PORTSC, PORTSC_SUSP)) {
+                ret = -EINVAL;
+                dbg_trace("port is not suspended\n");
+                goto out;
+        }
+        hw_cwrite(CAP_PORTSC, PORTSC_FPR, PORTSC_FPR);
+out:
+        spin_unlock_irqrestore(udc->lock, flags);
+        return ret;
+}
+
+static int ci13xxx_vbus_draw(struct usb_gadget *_gadget, unsigned mA)
+{
+        struct ci13xxx *udc = container_of(_gadget, struct ci13xxx, gadget);
+
+        if (udc->transceiver)
+                return otg_set_power(udc->transceiver, mA);
+        return -ENOTSUPP;
+}
+
+static int ci13xxx_start(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *));
+static int ci13xxx_stop(struct usb_gadget_driver *driver);
+/**
+ * Device operations part of the API to the USB controller hardware,
+ * which don't involve endpoints (or i/o)
+ * Check  "usb_gadget.h" for details
+ */
+static const struct usb_gadget_ops usb_gadget_ops = {
+        .vbus_session   = ci13xxx_vbus_session,
+        .wakeup         = ci13xxx_wakeup,
+        .vbus_draw      = ci13xxx_vbus_draw,
+        .start          = ci13xxx_start,
+        .stop           = ci13xxx_stop,
+};
+
+/**
+ * ci13xxx_start: register a gadget driver
+ * @driver: the driver being registered
+ * @bind: the driver's bind callback
+ *
+ * Check ci13xxx_start() at <linux/usb/gadget.h> for details.
+ * Interrupts are enabled here.
+ */
+static int ci13xxx_start(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
+{
+        struct ci13xxx *udc = _udc;
+        unsigned long flags;
+        int i, j;
+        int retval = -ENOMEM;
+
+        trace("%p", driver);
+
+        if (driver             == NULL ||
+            bind               == NULL ||
+            driver->setup      == NULL ||
+            driver->disconnect == NULL ||
+            driver->suspend    == NULL ||
+            driver->resume     == NULL)
+                return -EINVAL;
+        else if (udc         == NULL)
+                return -ENODEV;
+        else if (udc->driver != NULL)
+                return -EBUSY;
+
+        /* alloc resources */
+        udc->qh_pool = dma_pool_create("ci13xxx_qh", &udc->gadget.dev,
+                                       sizeof(struct ci13xxx_qh),
+                                       64, CI13XXX_PAGE_SIZE);
+        if (udc->qh_pool == NULL)
+                return -ENOMEM;
+
+        udc->td_pool = dma_pool_create("ci13xxx_td", &udc->gadget.dev,
+                                       sizeof(struct ci13xxx_td),
+                                       64, CI13XXX_PAGE_SIZE);
+        if (udc->td_pool == NULL) {
+                dma_pool_destroy(udc->qh_pool);
+                udc->qh_pool = NULL;
+                return -ENOMEM;
+        }
+
+        spin_lock_irqsave(udc->lock, flags);
+
+        info("hw_ep_max = %d", hw_ep_max);
+
+        udc->gadget.dev.driver = NULL;
+
+        retval = 0;
+        for (i = 0; i < hw_ep_max/2; i++) {
+                for (j = RX; j <= TX; j++) {
+                        int k = i + j * hw_ep_max/2;
+                        struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[k];
+
+                        scnprintf(mEp->name, sizeof(mEp->name), "ep%i%s", i,
+                                        (j == TX)  ? "in" : "out");
+
+                        mEp->lock         = udc->lock;
+                        mEp->device       = &udc->gadget.dev;
+                        mEp->td_pool      = udc->td_pool;
+
+                        mEp->ep.name      = mEp->name;
+                        mEp->ep.ops       = &usb_ep_ops;
+                        mEp->ep.maxpacket = CTRL_PAYLOAD_MAX;
+
+                        INIT_LIST_HEAD(&mEp->qh.queue);
+                        spin_unlock_irqrestore(udc->lock, flags);
+                        mEp->qh.ptr = dma_pool_alloc(udc->qh_pool, GFP_KERNEL,
+                                        &mEp->qh.dma);
+                        spin_lock_irqsave(udc->lock, flags);
+                        if (mEp->qh.ptr == NULL)
+                                retval = -ENOMEM;
+                        else
+                                memset(mEp->qh.ptr, 0, sizeof(*mEp->qh.ptr));
+
+                        /* skip ep0 out and in endpoints */
+                        if (i == 0)
+                                continue;
+
+                        list_add_tail(&mEp->ep.ep_list, &udc->gadget.ep_list);
+                }
+        }
+        if (retval)
+                goto done;
+        spin_unlock_irqrestore(udc->lock, flags);
+        udc->ep0out.ep.desc = &ctrl_endpt_out_desc;
+        retval = usb_ep_enable(&udc->ep0out.ep);
+        if (retval)
+                return retval;
+
+        udc->ep0in.ep.desc = &ctrl_endpt_in_desc;
+        retval = usb_ep_enable(&udc->ep0in.ep);
+        if (retval)
+                return retval;
+        spin_lock_irqsave(udc->lock, flags);
+
+        udc->gadget.ep0 = &udc->ep0in.ep;
+        /* bind gadget */
+        driver->driver.bus     = NULL;
+        udc->gadget.dev.driver = &driver->driver;
+
+        spin_unlock_irqrestore(udc->lock, flags);
+        retval = bind(&udc->gadget);                /* MAY SLEEP */
+        spin_lock_irqsave(udc->lock, flags);
+
+        if (retval) {
+                udc->gadget.dev.driver = NULL;
+                goto done;
+        }
+
+        udc->driver = driver;
+        pm_runtime_get_sync(&udc->gadget.dev);
+        if (udc->udc_driver->flags & CI13XXX_PULLUP_ON_VBUS) {
+                if (udc->vbus_active) {
+                        if (udc->udc_driver->flags & CI13XXX_REGS_SHARED)
+                                hw_device_reset(udc);
+                } else {
+                        pm_runtime_put_sync(&udc->gadget.dev);
+                        goto done;
+                }
+        }
+
+        retval = hw_device_state(udc->ep0out.qh.dma);
+        if (retval)
+                pm_runtime_put_sync(&udc->gadget.dev);
+
+ done:
+        spin_unlock_irqrestore(udc->lock, flags);
+        return retval;
+}
+
+/**
+ * ci13xxx_stop: unregister a gadget driver
+ *
+ * Check usb_gadget_unregister_driver() at "usb_gadget.h" for details
+ */
+static int ci13xxx_stop(struct usb_gadget_driver *driver)
+{
+        struct ci13xxx *udc = _udc;
+        unsigned long i, flags;
+
+        trace("%p", driver);
+
+        if (driver             == NULL ||
+            driver->unbind     == NULL ||
+            driver->setup      == NULL ||
+            driver->disconnect == NULL ||
+            driver->suspend    == NULL ||
+            driver->resume     == NULL ||
+            driver             != udc->driver)
+                return -EINVAL;
+
+        spin_lock_irqsave(udc->lock, flags);
+
+        if (!(udc->udc_driver->flags & CI13XXX_PULLUP_ON_VBUS) ||
+                        udc->vbus_active) {
+                hw_device_state(0);
+                if (udc->udc_driver->notify_event)
+                        udc->udc_driver->notify_event(udc,
+                        CI13XXX_CONTROLLER_STOPPED_EVENT);
+                _gadget_stop_activity(&udc->gadget);
+                pm_runtime_put(&udc->gadget.dev);
+        }
+
+        /* unbind gadget */
+        spin_unlock_irqrestore(udc->lock, flags);
+        driver->unbind(&udc->gadget);               /* MAY SLEEP */
+        spin_lock_irqsave(udc->lock, flags);
+
+        udc->gadget.dev.driver = NULL;
+
+        /* free resources */
+        for (i = 0; i < hw_ep_max; i++) {
+                struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[i];
+
+                if (!list_empty(&mEp->ep.ep_list))
+                        list_del_init(&mEp->ep.ep_list);
+
+                if (mEp->qh.ptr != NULL)
+                        dma_pool_free(udc->qh_pool, mEp->qh.ptr, mEp->qh.dma);
+        }
+
+        udc->gadget.ep0 = NULL;
+        udc->driver = NULL;
+
+        spin_unlock_irqrestore(udc->lock, flags);
+
+        if (udc->td_pool != NULL) {
+                dma_pool_destroy(udc->td_pool);
+                udc->td_pool = NULL;
+        }
+        if (udc->qh_pool != NULL) {
+                dma_pool_destroy(udc->qh_pool);
+                udc->qh_pool = NULL;
+        }
+
+        return 0;
+}
+
+/******************************************************************************
+ * BUS block
+ *****************************************************************************/
+/**
+ * udc_irq: global interrupt handler
+ *
+ * This function returns IRQ_HANDLED if the IRQ has been handled
+ * It locks access to registers
+ */
+static irqreturn_t udc_irq(void)
+{
+        struct ci13xxx *udc = _udc;
+        irqreturn_t retval;
+        u32 intr;
+
+        trace();
+
+        if (udc == NULL) {
+                err("ENODEV");
+                return IRQ_HANDLED;
+        }
+
+        spin_lock(udc->lock);
+
+        if (udc->udc_driver->flags & CI13XXX_REGS_SHARED) {
+                if (hw_cread(CAP_USBMODE, USBMODE_CM) !=
+                                USBMODE_CM_DEVICE) {
+                        spin_unlock(udc->lock);
+                        return IRQ_NONE;
+                }
+        }
+        intr = hw_test_and_clear_intr_active();
+        if (intr) {
+                isr_statistics.hndl.buf[isr_statistics.hndl.idx++] = intr;
+                isr_statistics.hndl.idx &= ISR_MASK;
+                isr_statistics.hndl.cnt++;
+
+                /* order defines priority - do NOT change it */
+                if (USBi_URI & intr) {
+                        isr_statistics.uri++;
+                        isr_reset_handler(udc);
+                }
+                if (USBi_PCI & intr) {
+                        isr_statistics.pci++;
+                        udc->gadget.speed = hw_port_is_high_speed() ?
+                                USB_SPEED_HIGH : USB_SPEED_FULL;
+                        if (udc->suspended) {
+                                spin_unlock(udc->lock);
+                                udc->driver->resume(&udc->gadget);
+                                spin_lock(udc->lock);
+                                udc->suspended = 0;
+                        }
+                }
+                if (USBi_UEI & intr)
+                        isr_statistics.uei++;
+                if (USBi_UI  & intr) {
+                        isr_statistics.ui++;
+                        isr_tr_complete_handler(udc);
+                }
+                if (USBi_SLI & intr) {
+                        if (udc->gadget.speed != USB_SPEED_UNKNOWN) {
+                                udc->suspended = 1;
+                                spin_unlock(udc->lock);
+                                udc->driver->suspend(&udc->gadget);
+                                spin_lock(udc->lock);
+                        }
+                        isr_statistics.sli++;
+                }
+                retval = IRQ_HANDLED;
+        } else {
+                isr_statistics.none++;
+                retval = IRQ_NONE;
+        }
+        spin_unlock(udc->lock);
+
+        return retval;
+}
+
+/**
+ * udc_release: driver release function
+ * @dev: device
+ *
+ * Currently does nothing
+ */
+static void udc_release(struct device *dev)
+{
+        trace("%p", dev);
+
+        if (dev == NULL)
+                err("EINVAL");
+}
+
+/**
+ * udc_probe: parent probe must call this to initialize UDC
+ * @dev:  parent device
+ * @regs: registers base address
+ * @name: driver name
+ *
+ * This function returns an error code
+ * No interrupts active, the IRQ has not been requested yet
+ * Kernel assumes 32-bit DMA operations by default, no need to dma_set_mask
+ */
+static int udc_probe(struct ci13xxx_udc_driver *driver, struct device *dev,
+                void __iomem *regs)
+{
+        struct ci13xxx *udc;
+        int retval = 0;
+
+        trace("%p, %p, %p", dev, regs, name);
+
+        if (dev == NULL || regs == NULL || driver == NULL ||
+                        driver->name == NULL)
+                return -EINVAL;
+
+        udc = kzalloc(sizeof(struct ci13xxx), GFP_KERNEL);
+        if (udc == NULL)
+                return -ENOMEM;
+
+        udc->lock = &udc_lock;
+        udc->regs = regs;
+        udc->udc_driver = driver;
+
+        udc->gadget.ops          = &usb_gadget_ops;
+        udc->gadget.speed        = USB_SPEED_UNKNOWN;
+        udc->gadget.is_dualspeed = 1;
+        udc->gadget.is_otg       = 0;
+        udc->gadget.name         = driver->name;
+
+        INIT_LIST_HEAD(&udc->gadget.ep_list);
+        udc->gadget.ep0 = NULL;
+
+        dev_set_name(&udc->gadget.dev, "gadget");
+        udc->gadget.dev.dma_mask = dev->dma_mask;
+        udc->gadget.dev.coherent_dma_mask = dev->coherent_dma_mask;
+        udc->gadget.dev.parent   = dev;
+        udc->gadget.dev.release  = udc_release;
+
+        retval = hw_device_init(regs);
+        if (retval < 0)
+                goto free_udc;
+
+        udc->transceiver = otg_get_transceiver();
+
+        if (udc->udc_driver->flags & CI13XXX_REQUIRE_TRANSCEIVER) {
+                if (udc->transceiver == NULL) {
+                        retval = -ENODEV;
+                        goto free_udc;
+                }
+        }
+
+        if (!(udc->udc_driver->flags & CI13XXX_REGS_SHARED)) {
+                retval = hw_device_reset(udc);
+                if (retval)
+                        goto put_transceiver;
+        }
+
+        retval = device_register(&udc->gadget.dev);
+        if (retval) {
+                put_device(&udc->gadget.dev);
+                goto put_transceiver;
+        }
+
+#ifdef CONFIG_USB_GADGET_DEBUG_FILES
+        retval = dbg_create_files(&udc->gadget.dev);
+#endif
+        if (retval)
+                goto unreg_device;
+
+        if (udc->transceiver) {
+                retval = otg_set_peripheral(udc->transceiver, &udc->gadget);
+                if (retval)
+                        goto remove_dbg;
+        }
+
+        retval = usb_add_gadget_udc(dev, &udc->gadget);
+        if (retval)
+                goto remove_trans;
+
+        pm_runtime_no_callbacks(&udc->gadget.dev);
+        pm_runtime_enable(&udc->gadget.dev);
+
+        _udc = udc;
+        return retval;
+
+remove_trans:
+        if (udc->transceiver) {
+                otg_set_peripheral(udc->transceiver, &udc->gadget);
+                otg_put_transceiver(udc->transceiver);
+        }
+
+        err("error = %i", retval);
+remove_dbg:
+#ifdef CONFIG_USB_GADGET_DEBUG_FILES
+        dbg_remove_files(&udc->gadget.dev);
+#endif
+unreg_device:
+        device_unregister(&udc->gadget.dev);
+put_transceiver:
+        if (udc->transceiver)
+                otg_put_transceiver(udc->transceiver);
+free_udc:
+        kfree(udc);
+        _udc = NULL;
+        return retval;
+}
+
+/**
+ * udc_remove: parent remove must call this to remove UDC
+ *
+ * No interrupts active, the IRQ has been released
+ */
+static void udc_remove(void)
+{
+        struct ci13xxx *udc = _udc;
+
+        if (udc == NULL) {
+                err("EINVAL");
+                return;
+        }
+        usb_del_gadget_udc(&udc->gadget);
+
+        if (udc->transceiver) {
+                otg_set_peripheral(udc->transceiver, &udc->gadget);
+                otg_put_transceiver(udc->transceiver);
+        }
+#ifdef CONFIG_USB_GADGET_DEBUG_FILES
+        dbg_remove_files(&udc->gadget.dev);
+#endif
+        device_unregister(&udc->gadget.dev);
+
+        kfree(udc);
+        _udc = NULL;
+}
diff --git a/drivers/usb/gadget/ci13xxx_udc.h b/drivers/usb/gadget/ci13xxx_udc.h
new file mode 100644
index 00000000000..23707775cb4
--- /dev/null
+++ b/drivers/usb/gadget/ci13xxx_udc.h
@@ -0,0 +1,227 @@
+/*
+ * ci13xxx_udc.h - structures, registers, and macros MIPS USB IP core
+ *
+ * Copyright (C) 2008 Chipidea - MIPS Technologies, Inc. All rights reserved.
+ *
+ * Author: David Lopo
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Description: MIPS USB IP core family device controller
+ *              Structures, registers and logging macros
+ */
+
+#ifndef _CI13XXX_h_
+#define _CI13XXX_h_
+
+/******************************************************************************
+ * DEFINE
+ *****************************************************************************/
+#define CI13XXX_PAGE_SIZE  4096ul /* page size for TD's */
+#define ENDPT_MAX          (32)
+#define CTRL_PAYLOAD_MAX   (64)
+#define RX        (0)  /* similar to USB_DIR_OUT but can be used as an index */
+#define TX        (1)  /* similar to USB_DIR_IN  but can be used as an index */
+
+/******************************************************************************
+ * STRUCTURES
+ *****************************************************************************/
+/* DMA layout of transfer descriptors */
+struct ci13xxx_td {
+        /* 0 */
+        u32 next;
+#define TD_TERMINATE          BIT(0)
+#define TD_ADDR_MASK          (0xFFFFFFEUL << 5)
+        /* 1 */
+        u32 token;
+#define TD_STATUS             (0x00FFUL <<  0)
+#define TD_STATUS_TR_ERR      BIT(3)
+#define TD_STATUS_DT_ERR      BIT(5)
+#define TD_STATUS_HALTED      BIT(6)
+#define TD_STATUS_ACTIVE      BIT(7)
+#define TD_MULTO              (0x0003UL << 10)
+#define TD_IOC                BIT(15)
+#define TD_TOTAL_BYTES        (0x7FFFUL << 16)
+        /* 2 */
+        u32 page[5];
+#define TD_CURR_OFFSET        (0x0FFFUL <<  0)
+#define TD_FRAME_NUM          (0x07FFUL <<  0)
+#define TD_RESERVED_MASK      (0x0FFFUL <<  0)
+} __attribute__ ((packed));
+
+/* DMA layout of queue heads */
+struct ci13xxx_qh {
+        /* 0 */
+        u32 cap;
+#define QH_IOS                BIT(15)
+#define QH_MAX_PKT            (0x07FFUL << 16)
+#define QH_ZLT                BIT(29)
+#define QH_MULT               (0x0003UL << 30)
+        /* 1 */
+        u32 curr;
+        /* 2 - 8 */
+        struct ci13xxx_td        td;
+        /* 9 */
+        u32 RESERVED;
+        struct usb_ctrlrequest   setup;
+} __attribute__ ((packed));
+
+/* Extension of usb_request */
+struct ci13xxx_req {
+        struct usb_request   req;
+        unsigned             map;
+        struct list_head     queue;
+        struct ci13xxx_td   *ptr;
+        dma_addr_t           dma;
+        struct ci13xxx_td   *zptr;
+        dma_addr_t           zdma;
+};
+
+/* Extension of usb_ep */
+struct ci13xxx_ep {
+        struct usb_ep                          ep;
+        const struct usb_endpoint_descriptor  *desc;
+        u8                                     dir;
+        u8                                     num;
+        u8                                     type;
+        char                                   name[16];
+        struct {
+                struct list_head   queue;
+                struct ci13xxx_qh *ptr;
+                dma_addr_t         dma;
+        }                                      qh;
+        int                                    wedge;
+
+        /* global resources */
+        spinlock_t                            *lock;
+        struct device                         *device;
+        struct dma_pool                       *td_pool;
+};
+
+struct ci13xxx;
+struct ci13xxx_udc_driver {
+        const char      *name;
+        unsigned long    flags;
+#define CI13XXX_REGS_SHARED             BIT(0)
+#define CI13XXX_REQUIRE_TRANSCEIVER     BIT(1)
+#define CI13XXX_PULLUP_ON_VBUS          BIT(2)
+#define CI13XXX_DISABLE_STREAMING       BIT(3)
+
+#define CI13XXX_CONTROLLER_RESET_EVENT          0
+#define CI13XXX_CONTROLLER_STOPPED_EVENT        1
+        void    (*notify_event) (struct ci13xxx *udc, unsigned event);
+};
+
+/* CI13XXX UDC descriptor & global resources */
+struct ci13xxx {
+        spinlock_t                *lock;      /* ctrl register bank access */
+        void __iomem              *regs;      /* registers address space */
+
+        struct dma_pool           *qh_pool;   /* DMA pool for queue heads */
+        struct dma_pool           *td_pool;   /* DMA pool for transfer descs */
+        struct usb_request        *status;    /* ep0 status request */
+
+        struct usb_gadget          gadget;     /* USB slave device */
+        struct ci13xxx_ep          ci13xxx_ep[ENDPT_MAX]; /* extended endpts */
+        u32                        ep0_dir;    /* ep0 direction */
+#define ep0out ci13xxx_ep[0]
+#define ep0in  ci13xxx_ep[16]
+        u8                         remote_wakeup; /* Is remote wakeup feature
+                                                        enabled by the host? */
+        u8                         suspended;  /* suspended by the host */
+        u8                         test_mode;  /* the selected test mode */
+
+        struct usb_gadget_driver  *driver;     /* 3rd party gadget driver */
+        struct ci13xxx_udc_driver *udc_driver; /* device controller driver */
+        int                        vbus_active; /* is VBUS active */
+        struct otg_transceiver    *transceiver; /* Transceiver struct */
+};
+
+/******************************************************************************
+ * REGISTERS
+ *****************************************************************************/
+/* register size */
+#define REG_BITS   (32)
+
+/* HCCPARAMS */
+#define HCCPARAMS_LEN         BIT(17)
+
+/* DCCPARAMS */
+#define DCCPARAMS_DEN         (0x1F << 0)
+#define DCCPARAMS_DC          BIT(7)
+
+/* TESTMODE */
+#define TESTMODE_FORCE        BIT(0)
+
+/* USBCMD */
+#define USBCMD_RS             BIT(0)
+#define USBCMD_RST            BIT(1)
+#define USBCMD_SUTW           BIT(13)
+#define USBCMD_ATDTW          BIT(14)
+
+/* USBSTS & USBINTR */
+#define USBi_UI               BIT(0)
+#define USBi_UEI              BIT(1)
+#define USBi_PCI              BIT(2)
+#define USBi_URI              BIT(6)
+#define USBi_SLI              BIT(8)
+
+/* DEVICEADDR */
+#define DEVICEADDR_USBADRA    BIT(24)
+#define DEVICEADDR_USBADR     (0x7FUL << 25)
+
+/* PORTSC */
+#define PORTSC_FPR            BIT(6)
+#define PORTSC_SUSP           BIT(7)
+#define PORTSC_HSP            BIT(9)
+#define PORTSC_PTC            (0x0FUL << 16)
+
+/* DEVLC */
+#define DEVLC_PSPD            (0x03UL << 25)
+#define    DEVLC_PSPD_HS      (0x02UL << 25)
+
+/* USBMODE */
+#define USBMODE_CM            (0x03UL <<  0)
+#define    USBMODE_CM_IDLE    (0x00UL <<  0)
+#define    USBMODE_CM_DEVICE  (0x02UL <<  0)
+#define    USBMODE_CM_HOST    (0x03UL <<  0)
+#define USBMODE_SLOM          BIT(3)
+#define USBMODE_SDIS          BIT(4)
+
+/* ENDPTCTRL */
+#define ENDPTCTRL_RXS         BIT(0)
+#define ENDPTCTRL_RXT         (0x03UL <<  2)
+#define ENDPTCTRL_RXR         BIT(6)         /* reserved for port 0 */
+#define ENDPTCTRL_RXE         BIT(7)
+#define ENDPTCTRL_TXS         BIT(16)
+#define ENDPTCTRL_TXT         (0x03UL << 18)
+#define ENDPTCTRL_TXR         BIT(22)        /* reserved for port 0 */
+#define ENDPTCTRL_TXE         BIT(23)
+
+/******************************************************************************
+ * LOGGING
+ *****************************************************************************/
+#define ci13xxx_printk(level, format, args...) \
+do { \
+        if (_udc == NULL) \
+                printk(level "[%s] " format "\n", __func__, ## args); \
+        else \
+                dev_printk(level, _udc->gadget.dev.parent, \
+                           "[%s] " format "\n", __func__, ## args); \
+} while (0)
+
+#define err(format, args...)    ci13xxx_printk(KERN_ERR, format, ## args)
+#define warn(format, args...)   ci13xxx_printk(KERN_WARNING, format, ## args)
+#define info(format, args...)   ci13xxx_printk(KERN_INFO, format, ## args)
+
+#ifdef TRACE
+#define trace(format, args...)      ci13xxx_printk(KERN_DEBUG, format, ## args)
+#define dbg_trace(format, args...)  dev_dbg(dev, format, ##args)
+#else
+#define trace(format, args...)      do {} while (0)
+#define dbg_trace(format, args...)  do {} while (0)
+#endif
+
+#endif  /* _CI13XXX_h_ */
diff --git a/drivers/usb/gadget/f_accessory.c b/drivers/usb/gadget/f_accessory.c
new file mode 100644
index 00000000000..ae65faaf3d7
--- /dev/null
+++ b/drivers/usb/gadget/f_accessory.c
@@ -0,0 +1,788 @@
+/*
+ * Gadget Function Driver for Android USB accessories
+ *
+ * Copyright (C) 2011 Google, Inc.
+ * Author: Mike Lockwood <lockwood@android.com>
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+/* #define DEBUG */
+/* #define VERBOSE_DEBUG */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/poll.h>
+#include <linux/delay.h>
+#include <linux/wait.h>
+#include <linux/err.h>
+#include <linux/interrupt.h>
+#include <linux/kthread.h>
+#include <linux/freezer.h>
+
+#include <linux/types.h>
+#include <linux/file.h>
+#include <linux/device.h>
+#include <linux/miscdevice.h>
+
+#include <linux/usb.h>
+#include <linux/usb/ch9.h>
+#include <linux/usb/f_accessory.h>
+
+#define BULK_BUFFER_SIZE    16384
+#define ACC_STRING_SIZE     256
+
+#define PROTOCOL_VERSION    1
+
+/* String IDs */
+#define INTERFACE_STRING_INDEX  0
+
+/* number of tx and rx requests to allocate */
+#define TX_REQ_MAX 4
+#define RX_REQ_MAX 2
+
+struct acc_dev {
+        struct usb_function function;
+        struct usb_composite_dev *cdev;
+        spinlock_t lock;
+
+        struct usb_ep *ep_in;
+        struct usb_ep *ep_out;
+
+        /* set to 1 when we connect */
+        int online:1;
+        /* Set to 1 when we disconnect.
+         * Not cleared until our file is closed.
+         */
+        int disconnected:1;
+
+        /* strings sent by the host */
+        char manufacturer[ACC_STRING_SIZE];
+        char model[ACC_STRING_SIZE];
+        char description[ACC_STRING_SIZE];
+        char version[ACC_STRING_SIZE];
+        char uri[ACC_STRING_SIZE];
+        char serial[ACC_STRING_SIZE];
+
+        /* for acc_complete_set_string */
+        int string_index;
+
+        /* set to 1 if we have a pending start request */
+        int start_requested;
+
+        /* synchronize access to our device file */
+        atomic_t open_excl;
+
+        struct list_head tx_idle;
+
+        wait_queue_head_t read_wq;
+        wait_queue_head_t write_wq;
+        struct usb_request *rx_req[RX_REQ_MAX];
+        int rx_done;
+        struct delayed_work work;
+};
+
+static struct usb_interface_descriptor acc_interface_desc = {
+        .bLength                = USB_DT_INTERFACE_SIZE,
+        .bDescriptorType        = USB_DT_INTERFACE,
+        .bInterfaceNumber       = 0,
+        .bNumEndpoints          = 2,
+        .bInterfaceClass        = USB_CLASS_VENDOR_SPEC,
+        .bInterfaceSubClass     = USB_SUBCLASS_VENDOR_SPEC,
+        .bInterfaceProtocol     = 0,
+};
+
+static struct usb_endpoint_descriptor acc_highspeed_in_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_IN,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize         = __constant_cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor acc_highspeed_out_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_OUT,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize         = __constant_cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor acc_fullspeed_in_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_IN,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_endpoint_descriptor acc_fullspeed_out_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_OUT,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_descriptor_header *fs_acc_descs[] = {
+        (struct usb_descriptor_header *) &acc_interface_desc,
+        (struct usb_descriptor_header *) &acc_fullspeed_in_desc,
+        (struct usb_descriptor_header *) &acc_fullspeed_out_desc,
+        NULL,
+};
+
+static struct usb_descriptor_header *hs_acc_descs[] = {
+        (struct usb_descriptor_header *) &acc_interface_desc,
+        (struct usb_descriptor_header *) &acc_highspeed_in_desc,
+        (struct usb_descriptor_header *) &acc_highspeed_out_desc,
+        NULL,
+};
+
+static struct usb_string acc_string_defs[] = {
+        [INTERFACE_STRING_INDEX].s      = "Android Accessory Interface",
+        {  },   /* end of list */
+};
+
+static struct usb_gadget_strings acc_string_table = {
+        .language               = 0x0409,       /* en-US */
+        .strings                = acc_string_defs,
+};
+
+static struct usb_gadget_strings *acc_strings[] = {
+        &acc_string_table,
+        NULL,
+};
+
+/* temporary variable used between acc_open() and acc_gadget_bind() */
+static struct acc_dev *_acc_dev;
+
+static inline struct acc_dev *func_to_dev(struct usb_function *f)
+{
+        return container_of(f, struct acc_dev, function);
+}
+
+static struct usb_request *acc_request_new(struct usb_ep *ep, int buffer_size)
+{
+        struct usb_request *req = usb_ep_alloc_request(ep, GFP_KERNEL);
+        if (!req)
+                return NULL;
+
+        /* now allocate buffers for the requests */
+        req->buf = kmalloc(buffer_size, GFP_KERNEL);
+        if (!req->buf) {
+                usb_ep_free_request(ep, req);
+                return NULL;
+        }
+
+        return req;
+}
+
+static void acc_request_free(struct usb_request *req, struct usb_ep *ep)
+{
+        if (req) {
+                kfree(req->buf);
+                usb_ep_free_request(ep, req);
+        }
+}
+
+/* add a request to the tail of a list */
+static void req_put(struct acc_dev *dev, struct list_head *head,
+                struct usb_request *req)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&dev->lock, flags);
+        list_add_tail(&req->list, head);
+        spin_unlock_irqrestore(&dev->lock, flags);
+}
+
+/* remove a request from the head of a list */
+static struct usb_request *req_get(struct acc_dev *dev, struct list_head *head)
+{
+        unsigned long flags;
+        struct usb_request *req;
+
+        spin_lock_irqsave(&dev->lock, flags);
+        if (list_empty(head)) {
+                req = 0;
+        } else {
+                req = list_first_entry(head, struct usb_request, list);
+                list_del(&req->list);
+        }
+        spin_unlock_irqrestore(&dev->lock, flags);
+        return req;
+}
+
+static void acc_set_disconnected(struct acc_dev *dev)
+{
+        dev->online = 0;
+        dev->disconnected = 1;
+}
+
+static void acc_complete_in(struct usb_ep *ep, struct usb_request *req)
+{
+        struct acc_dev *dev = _acc_dev;
+
+        if (req->status != 0)
+                acc_set_disconnected(dev);
+
+        req_put(dev, &dev->tx_idle, req);
+
+        wake_up(&dev->write_wq);
+}
+
+static void acc_complete_out(struct usb_ep *ep, struct usb_request *req)
+{
+        struct acc_dev *dev = _acc_dev;
+
+        dev->rx_done = 1;
+        if (req->status != 0)
+                acc_set_disconnected(dev);
+
+        wake_up(&dev->read_wq);
+}
+
+static void acc_complete_set_string(struct usb_ep *ep, struct usb_request *req)
+{
+        struct acc_dev  *dev = ep->driver_data;
+        char *string_dest = NULL;
+        int length = req->actual;
+
+        if (req->status != 0) {
+                pr_err("acc_complete_set_string, err %d\n", req->status);
+                return;
+        }
+
+        switch (dev->string_index) {
+        case ACCESSORY_STRING_MANUFACTURER:
+                string_dest = dev->manufacturer;
+                break;
+        case ACCESSORY_STRING_MODEL:
+                string_dest = dev->model;
+                break;
+        case ACCESSORY_STRING_DESCRIPTION:
+                string_dest = dev->description;
+                break;
+        case ACCESSORY_STRING_VERSION:
+                string_dest = dev->version;
+                break;
+        case ACCESSORY_STRING_URI:
+                string_dest = dev->uri;
+                break;
+        case ACCESSORY_STRING_SERIAL:
+                string_dest = dev->serial;
+                break;
+        }
+        if (string_dest) {
+                unsigned long flags;
+
+                if (length >= ACC_STRING_SIZE)
+                        length = ACC_STRING_SIZE - 1;
+
+                spin_lock_irqsave(&dev->lock, flags);
+                memcpy(string_dest, req->buf, length);
+                /* ensure zero termination */
+                string_dest[length] = 0;
+                spin_unlock_irqrestore(&dev->lock, flags);
+        } else {
+                pr_err("unknown accessory string index %d\n",
+                        dev->string_index);
+        }
+}
+
+static int __init create_bulk_endpoints(struct acc_dev *dev,
+                                struct usb_endpoint_descriptor *in_desc,
+                                struct usb_endpoint_descriptor *out_desc)
+{
+        struct usb_composite_dev *cdev = dev->cdev;
+        struct usb_request *req;
+        struct usb_ep *ep;
+        int i;
+
+        DBG(cdev, "create_bulk_endpoints dev: %p\n", dev);
+
+        ep = usb_ep_autoconfig(cdev->gadget, in_desc);
+        if (!ep) {
+                DBG(cdev, "usb_ep_autoconfig for ep_in failed\n");
+                return -ENODEV;
+        }
+        DBG(cdev, "usb_ep_autoconfig for ep_in got %s\n", ep->name);
+        ep->driver_data = dev;          /* claim the endpoint */
+        dev->ep_in = ep;
+
+        ep = usb_ep_autoconfig(cdev->gadget, out_desc);
+        if (!ep) {
+                DBG(cdev, "usb_ep_autoconfig for ep_out failed\n");
+                return -ENODEV;
+        }
+        DBG(cdev, "usb_ep_autoconfig for ep_out got %s\n", ep->name);
+        ep->driver_data = dev;          /* claim the endpoint */
+        dev->ep_out = ep;
+
+        ep = usb_ep_autoconfig(cdev->gadget, out_desc);
+        if (!ep) {
+                DBG(cdev, "usb_ep_autoconfig for ep_out failed\n");
+                return -ENODEV;
+        }
+        DBG(cdev, "usb_ep_autoconfig for ep_out got %s\n", ep->name);
+        ep->driver_data = dev;          /* claim the endpoint */
+        dev->ep_out = ep;
+
+        /* now allocate requests for our endpoints */
+        for (i = 0; i < TX_REQ_MAX; i++) {
+                req = acc_request_new(dev->ep_in, BULK_BUFFER_SIZE);
+                if (!req)
+                        goto fail;
+                req->complete = acc_complete_in;
+                req_put(dev, &dev->tx_idle, req);
+        }
+        for (i = 0; i < RX_REQ_MAX; i++) {
+                req = acc_request_new(dev->ep_out, BULK_BUFFER_SIZE);
+                if (!req)
+                        goto fail;
+                req->complete = acc_complete_out;
+                dev->rx_req[i] = req;
+        }
+
+        return 0;
+
+fail:
+        printk(KERN_ERR "acc_bind() could not allocate requests\n");
+        while ((req = req_get(dev, &dev->tx_idle)))
+                acc_request_free(req, dev->ep_in);
+        for (i = 0; i < RX_REQ_MAX; i++)
+                acc_request_free(dev->rx_req[i], dev->ep_out);
+        return -1;
+}
+
+static ssize_t acc_read(struct file *fp, char __user *buf,
+        size_t count, loff_t *pos)
+{
+        struct acc_dev *dev = fp->private_data;
+        struct usb_request *req;
+        int r = count, xfer;
+        int ret = 0;
+
+        pr_debug("acc_read(%d)\n", count);
+
+        if (dev->disconnected)
+                return -ENODEV;
+
+        if (count > BULK_BUFFER_SIZE)
+                count = BULK_BUFFER_SIZE;
+
+        /* we will block until we're online */
+        pr_debug("acc_read: waiting for online\n");
+        ret = wait_event_interruptible(dev->read_wq, dev->online);
+        if (ret < 0) {
+                r = ret;
+                goto done;
+        }
+
+requeue_req:
+        /* queue a request */
+        req = dev->rx_req[0];
+        req->length = count;
+        dev->rx_done = 0;
+        ret = usb_ep_queue(dev->ep_out, req, GFP_KERNEL);
+        if (ret < 0) {
+                r = -EIO;
+                goto done;
+        } else {
+                pr_debug("rx %p queue\n", req);
+        }
+
+        /* wait for a request to complete */
+        ret = wait_event_interruptible(dev->read_wq, dev->rx_done);
+        if (ret < 0) {
+                r = ret;
+                usb_ep_dequeue(dev->ep_out, req);
+                goto done;
+        }
+        if (dev->online) {
+                /* If we got a 0-len packet, throw it back and try again. */
+                if (req->actual == 0)
+                        goto requeue_req;
+
+                pr_debug("rx %p %d\n", req, req->actual);
+                xfer = (req->actual < count) ? req->actual : count;
+                r = xfer;
+                if (copy_to_user(buf, req->buf, xfer))
+                        r = -EFAULT;
+        } else
+                r = -EIO;
+
+done:
+        pr_debug("acc_read returning %d\n", r);
+        return r;
+}
+
+static ssize_t acc_write(struct file *fp, const char __user *buf,
+        size_t count, loff_t *pos)
+{
+        struct acc_dev *dev = fp->private_data;
+        struct usb_request *req = 0;
+        int r = count, xfer;
+        int ret;
+
+        pr_debug("acc_write(%d)\n", count);
+
+        if (!dev->online || dev->disconnected)
+                return -ENODEV;
+
+        while (count > 0) {
+                if (!dev->online) {
+                        pr_debug("acc_write dev->error\n");
+                        r = -EIO;
+                        break;
+                }
+
+                /* get an idle tx request to use */
+                req = 0;
+                ret = wait_event_interruptible(dev->write_wq,
+                        ((req = req_get(dev, &dev->tx_idle)) || !dev->online));
+                if (!req) {
+                        r = ret;
+                        break;
+                }
+
+                if (count > BULK_BUFFER_SIZE)
+                        xfer = BULK_BUFFER_SIZE;
+                else
+                        xfer = count;
+                if (copy_from_user(req->buf, buf, xfer)) {
+                        r = -EFAULT;
+                        break;
+                }
+
+                req->length = xfer;
+                ret = usb_ep_queue(dev->ep_in, req, GFP_KERNEL);
+                if (ret < 0) {
+                        pr_debug("acc_write: xfer error %d\n", ret);
+                        r = -EIO;
+                        break;
+                }
+
+                buf += xfer;
+                count -= xfer;
+
+                /* zero this so we don't try to free it on error exit */
+                req = 0;
+        }
+
+        if (req)
+                req_put(dev, &dev->tx_idle, req);
+
+        pr_debug("acc_write returning %d\n", r);
+        return r;
+}
+
+static long acc_ioctl(struct file *fp, unsigned code, unsigned long value)
+{
+        struct acc_dev *dev = fp->private_data;
+        char *src = NULL;
+        int ret;
+
+        switch (code) {
+        case ACCESSORY_GET_STRING_MANUFACTURER:
+                src = dev->manufacturer;
+                break;
+        case ACCESSORY_GET_STRING_MODEL:
+                src = dev->model;
+                break;
+        case ACCESSORY_GET_STRING_DESCRIPTION:
+                src = dev->description;
+                break;
+        case ACCESSORY_GET_STRING_VERSION:
+                src = dev->version;
+                break;
+        case ACCESSORY_GET_STRING_URI:
+                src = dev->uri;
+                break;
+        case ACCESSORY_GET_STRING_SERIAL:
+                src = dev->serial;
+                break;
+        case ACCESSORY_IS_START_REQUESTED:
+                return dev->start_requested;
+        }
+        if (!src)
+                return -EINVAL;
+
+        ret = strlen(src) + 1;
+        if (copy_to_user((void __user *)value, src, ret))
+                ret = -EFAULT;
+        return ret;
+}
+
+static int acc_open(struct inode *ip, struct file *fp)
+{
+        printk(KERN_INFO "acc_open\n");
+        if (atomic_xchg(&_acc_dev->open_excl, 1))
+                return -EBUSY;
+
+        _acc_dev->disconnected = 0;
+        fp->private_data = _acc_dev;
+        return 0;
+}
+
+static int acc_release(struct inode *ip, struct file *fp)
+{
+        printk(KERN_INFO "acc_release\n");
+
+        WARN_ON(!atomic_xchg(&_acc_dev->open_excl, 0));
+        _acc_dev->disconnected = 0;
+        return 0;
+}
+
+/* file operations for /dev/acc_usb */
+static const struct file_operations acc_fops = {
+        .owner = THIS_MODULE,
+        .read = acc_read,
+        .write = acc_write,
+        .unlocked_ioctl = acc_ioctl,
+        .open = acc_open,
+        .release = acc_release,
+};
+
+static struct miscdevice acc_device = {
+        .minor = MISC_DYNAMIC_MINOR,
+        .name = "usb_accessory",
+        .fops = &acc_fops,
+};
+
+
+static int acc_ctrlrequest(struct usb_composite_dev *cdev,
+                                const struct usb_ctrlrequest *ctrl)
+{
+        struct acc_dev  *dev = _acc_dev;
+        int     value = -EOPNOTSUPP;
+        u8 b_requestType = ctrl->bRequestType;
+        u8 b_request = ctrl->bRequest;
+        u16     w_index = le16_to_cpu(ctrl->wIndex);
+        u16     w_value = le16_to_cpu(ctrl->wValue);
+        u16     w_length = le16_to_cpu(ctrl->wLength);
+
+/*
+        printk(KERN_INFO "acc_ctrlrequest "
+                        "%02x.%02x v%04x i%04x l%u\n",
+                        b_requestType, b_request,
+                        w_value, w_index, w_length);
+*/
+
+        if (b_requestType == (USB_DIR_OUT | USB_TYPE_VENDOR)) {
+                if (b_request == ACCESSORY_START) {
+                        dev->start_requested = 1;
+                        schedule_delayed_work(
+                                &dev->work, msecs_to_jiffies(10));
+                        value = 0;
+                } else if (b_request == ACCESSORY_SEND_STRING) {
+                        dev->string_index = w_index;
+                        cdev->gadget->ep0->driver_data = dev;
+                        cdev->req->complete = acc_complete_set_string;
+                        value = w_length;
+                }
+        } else if (b_requestType == (USB_DIR_IN | USB_TYPE_VENDOR)) {
+                if (b_request == ACCESSORY_GET_PROTOCOL) {
+                        *((u16 *)cdev->req->buf) = PROTOCOL_VERSION;
+                        value = sizeof(u16);
+
+                        /* clear any strings left over from a previous session */
+                        memset(dev->manufacturer, 0, sizeof(dev->manufacturer));
+                        memset(dev->model, 0, sizeof(dev->model));
+                        memset(dev->description, 0, sizeof(dev->description));
+                        memset(dev->version, 0, sizeof(dev->version));
+                        memset(dev->uri, 0, sizeof(dev->uri));
+                        memset(dev->serial, 0, sizeof(dev->serial));
+                        dev->start_requested = 0;
+                }
+        }
+
+        if (value >= 0) {
+                cdev->req->zero = 0;
+                cdev->req->length = value;
+                value = usb_ep_queue(cdev->gadget->ep0, cdev->req, GFP_ATOMIC);
+                if (value < 0)
+                        ERROR(cdev, "%s setup response queue error\n",
+                                __func__);
+        }
+
+        if (value == -EOPNOTSUPP)
+                VDBG(cdev,
+                        "unknown class-specific control req "
+                        "%02x.%02x v%04x i%04x l%u\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, w_length);
+        return value;
+}
+
+static int
+acc_function_bind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct usb_composite_dev *cdev = c->cdev;
+        struct acc_dev  *dev = func_to_dev(f);
+        int                     id;
+        int                     ret;
+
+        DBG(cdev, "acc_function_bind dev: %p\n", dev);
+
+        dev->start_requested = 0;
+
+        /* allocate interface ID(s) */
+        id = usb_interface_id(c, f);
+        if (id < 0)
+                return id;
+        acc_interface_desc.bInterfaceNumber = id;
+
+        /* allocate endpoints */
+        ret = create_bulk_endpoints(dev, &acc_fullspeed_in_desc,
+                        &acc_fullspeed_out_desc);
+        if (ret)
+                return ret;
+
+        /* support high speed hardware */
+        if (gadget_is_dualspeed(c->cdev->gadget)) {
+                acc_highspeed_in_desc.bEndpointAddress =
+                        acc_fullspeed_in_desc.bEndpointAddress;
+                acc_highspeed_out_desc.bEndpointAddress =
+                        acc_fullspeed_out_desc.bEndpointAddress;
+        }
+
+        DBG(cdev, "%s speed %s: IN/%s, OUT/%s\n",
+                        gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
+                        f->name, dev->ep_in->name, dev->ep_out->name);
+        return 0;
+}
+
+static void
+acc_function_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct acc_dev  *dev = func_to_dev(f);
+        struct usb_request *req;
+        int i;
+
+        while ((req = req_get(dev, &dev->tx_idle)))
+                acc_request_free(req, dev->ep_in);
+        for (i = 0; i < RX_REQ_MAX; i++)
+                acc_request_free(dev->rx_req[i], dev->ep_out);
+}
+
+static void acc_work(struct work_struct *data)
+{
+        char *envp[2] = { "ACCESSORY=START", NULL };
+        kobject_uevent_env(&acc_device.this_device->kobj, KOBJ_CHANGE, envp);
+}
+
+static int acc_function_set_alt(struct usb_function *f,
+                unsigned intf, unsigned alt)
+{
+        struct acc_dev  *dev = func_to_dev(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+        int ret;
+
+        DBG(cdev, "acc_function_set_alt intf: %d alt: %d\n", intf, alt);
+        config_ep_by_speed(cdev->gadget, f, dev->ep_in);
+        ret = usb_ep_enable(dev->ep_in);
+        if (ret)
+                return ret;
+        config_ep_by_speed(cdev->gadget, f, dev->ep_out);
+        ret = usb_ep_enable(dev->ep_out);
+        if (ret) {
+                usb_ep_disable(dev->ep_in);
+                return ret;
+        }
+
+        dev->online = 1;
+
+        /* readers may be blocked waiting for us to go online */
+        wake_up(&dev->read_wq);
+        return 0;
+}
+
+static void acc_function_disable(struct usb_function *f)
+{
+        struct acc_dev  *dev = func_to_dev(f);
+        struct usb_composite_dev        *cdev = dev->cdev;
+
+        DBG(cdev, "acc_function_disable\n");
+        acc_set_disconnected(dev);
+        usb_ep_disable(dev->ep_in);
+        usb_ep_disable(dev->ep_out);
+
+        /* readers may be blocked waiting for us to go online */
+        wake_up(&dev->read_wq);
+
+        VDBG(cdev, "%s disabled\n", dev->function.name);
+}
+
+static int acc_bind_config(struct usb_configuration *c)
+{
+        struct acc_dev *dev = _acc_dev;
+        int ret;
+
+        printk(KERN_INFO "acc_bind_config\n");
+
+        /* allocate a string ID for our interface */
+        if (acc_string_defs[INTERFACE_STRING_INDEX].id == 0) {
+                ret = usb_string_id(c->cdev);
+                if (ret < 0)
+                        return ret;
+                acc_string_defs[INTERFACE_STRING_INDEX].id = ret;
+                acc_interface_desc.iInterface = ret;
+        }
+
+        dev->cdev = c->cdev;
+        dev->function.name = "accessory";
+        dev->function.strings = acc_strings,
+        dev->function.descriptors = fs_acc_descs;
+        dev->function.hs_descriptors = hs_acc_descs;
+        dev->function.bind = acc_function_bind;
+        dev->function.unbind = acc_function_unbind;
+        dev->function.set_alt = acc_function_set_alt;
+        dev->function.disable = acc_function_disable;
+
+        return usb_add_function(c, &dev->function);
+}
+
+static int acc_setup(void)
+{
+        struct acc_dev *dev;
+        int ret;
+
+        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+        if (!dev)
+                return -ENOMEM;
+
+        spin_lock_init(&dev->lock);
+        init_waitqueue_head(&dev->read_wq);
+        init_waitqueue_head(&dev->write_wq);
+        atomic_set(&dev->open_excl, 0);
+        INIT_LIST_HEAD(&dev->tx_idle);
+        INIT_DELAYED_WORK(&dev->work, acc_work);
+
+        /* _acc_dev must be set before calling usb_gadget_register_driver */
+        _acc_dev = dev;
+
+        ret = misc_register(&acc_device);
+        if (ret)
+                goto err;
+
+        return 0;
+
+err:
+        kfree(dev);
+        printk(KERN_ERR "USB accessory gadget driver failed to initialize\n");
+        return ret;
+}
+
+static void acc_cleanup(void)
+{
+        misc_deregister(&acc_device);
+        kfree(_acc_dev);
+        _acc_dev = NULL;
+}
diff --git a/drivers/usb/gadget/f_adb.c b/drivers/usb/gadget/f_adb.c
new file mode 100644
index 00000000000..94a793f4390
--- /dev/null
+++ b/drivers/usb/gadget/f_adb.c
@@ -0,0 +1,635 @@
+/*
+ * Gadget Driver for Android ADB
+ *
+ * Copyright (C) 2008 Google, Inc.
+ * Author: Mike Lockwood <lockwood@android.com>
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/poll.h>
+#include <linux/delay.h>
+#include <linux/wait.h>
+#include <linux/err.h>
+#include <linux/interrupt.h>
+#include <linux/sched.h>
+#include <linux/types.h>
+#include <linux/device.h>
+#include <linux/miscdevice.h>
+
+#define ADB_BULK_BUFFER_SIZE           4096
+
+/* number of tx requests to allocate */
+#define TX_REQ_MAX 4
+
+static const char adb_shortname[] = "android_adb";
+
+struct adb_dev {
+        struct usb_function function;
+        struct usb_composite_dev *cdev;
+        spinlock_t lock;
+
+        struct usb_ep *ep_in;
+        struct usb_ep *ep_out;
+
+        int online;
+        int error;
+
+        atomic_t read_excl;
+        atomic_t write_excl;
+        atomic_t open_excl;
+
+        struct list_head tx_idle;
+
+        wait_queue_head_t read_wq;
+        wait_queue_head_t write_wq;
+        struct usb_request *rx_req;
+        int rx_done;
+};
+
+static struct usb_interface_descriptor adb_interface_desc = {
+        .bLength                = USB_DT_INTERFACE_SIZE,
+        .bDescriptorType        = USB_DT_INTERFACE,
+        .bInterfaceNumber       = 0,
+        .bNumEndpoints          = 2,
+        .bInterfaceClass        = 0xFF,
+        .bInterfaceSubClass     = 0x42,
+        .bInterfaceProtocol     = 1,
+};
+
+static struct usb_endpoint_descriptor adb_highspeed_in_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_IN,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize         = __constant_cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor adb_highspeed_out_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_OUT,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize         = __constant_cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor adb_fullspeed_in_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_IN,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_endpoint_descriptor adb_fullspeed_out_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_OUT,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_descriptor_header *fs_adb_descs[] = {
+        (struct usb_descriptor_header *) &adb_interface_desc,
+        (struct usb_descriptor_header *) &adb_fullspeed_in_desc,
+        (struct usb_descriptor_header *) &adb_fullspeed_out_desc,
+        NULL,
+};
+
+static struct usb_descriptor_header *hs_adb_descs[] = {
+        (struct usb_descriptor_header *) &adb_interface_desc,
+        (struct usb_descriptor_header *) &adb_highspeed_in_desc,
+        (struct usb_descriptor_header *) &adb_highspeed_out_desc,
+        NULL,
+};
+
+
+/* temporary variable used between adb_open() and adb_gadget_bind() */
+static struct adb_dev *_adb_dev;
+
+static inline struct adb_dev *func_to_adb(struct usb_function *f)
+{
+        return container_of(f, struct adb_dev, function);
+}
+
+
+static struct usb_request *adb_request_new(struct usb_ep *ep, int buffer_size)
+{
+        struct usb_request *req = usb_ep_alloc_request(ep, GFP_KERNEL);
+        if (!req)
+                return NULL;
+
+        /* now allocate buffers for the requests */
+        req->buf = kmalloc(buffer_size, GFP_KERNEL);
+        if (!req->buf) {
+                usb_ep_free_request(ep, req);
+                return NULL;
+        }
+
+        return req;
+}
+
+static void adb_request_free(struct usb_request *req, struct usb_ep *ep)
+{
+        if (req) {
+                kfree(req->buf);
+                usb_ep_free_request(ep, req);
+        }
+}
+
+static inline int adb_lock(atomic_t *excl)
+{
+        int ret = -1;
+
+        preempt_disable();
+        if (atomic_inc_return(excl) == 1) {
+                ret = 0;
+        } else
+                atomic_dec(excl);
+
+        preempt_enable();
+        return ret;
+}
+
+static inline void adb_unlock(atomic_t *excl)
+{
+        atomic_dec(excl);
+}
+
+/* add a request to the tail of a list */
+void adb_req_put(struct adb_dev *dev, struct list_head *head,
+                struct usb_request *req)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&dev->lock, flags);
+        list_add_tail(&req->list, head);
+        spin_unlock_irqrestore(&dev->lock, flags);
+}
+
+/* remove a request from the head of a list */
+struct usb_request *adb_req_get(struct adb_dev *dev, struct list_head *head)
+{
+        unsigned long flags;
+        struct usb_request *req;
+
+        spin_lock_irqsave(&dev->lock, flags);
+        if (list_empty(head)) {
+                req = 0;
+        } else {
+                req = list_first_entry(head, struct usb_request, list);
+                list_del(&req->list);
+        }
+        spin_unlock_irqrestore(&dev->lock, flags);
+        return req;
+}
+
+static void adb_complete_in(struct usb_ep *ep, struct usb_request *req)
+{
+        struct adb_dev *dev = _adb_dev;
+
+        if (req->status != 0)
+                dev->error = 1;
+
+        adb_req_put(dev, &dev->tx_idle, req);
+
+        wake_up(&dev->write_wq);
+}
+
+static void adb_complete_out(struct usb_ep *ep, struct usb_request *req)
+{
+        struct adb_dev *dev = _adb_dev;
+
+        dev->rx_done = 1;
+        if (req->status != 0)
+                dev->error = 1;
+
+        wake_up(&dev->read_wq);
+}
+
+static int adb_create_bulk_endpoints(struct adb_dev *dev,
+                                struct usb_endpoint_descriptor *in_desc,
+                                struct usb_endpoint_descriptor *out_desc)
+{
+        struct usb_composite_dev *cdev = dev->cdev;
+        struct usb_request *req;
+        struct usb_ep *ep;
+        int i;
+
+        DBG(cdev, "create_bulk_endpoints dev: %p\n", dev);
+
+        ep = usb_ep_autoconfig(cdev->gadget, in_desc);
+        if (!ep) {
+                DBG(cdev, "usb_ep_autoconfig for ep_in failed\n");
+                return -ENODEV;
+        }
+        DBG(cdev, "usb_ep_autoconfig for ep_in got %s\n", ep->name);
+        ep->driver_data = dev;          /* claim the endpoint */
+        dev->ep_in = ep;
+
+        ep = usb_ep_autoconfig(cdev->gadget, out_desc);
+        if (!ep) {
+                DBG(cdev, "usb_ep_autoconfig for ep_out failed\n");
+                return -ENODEV;
+        }
+        DBG(cdev, "usb_ep_autoconfig for adb ep_out got %s\n", ep->name);
+        ep->driver_data = dev;          /* claim the endpoint */
+        dev->ep_out = ep;
+
+        /* now allocate requests for our endpoints */
+        req = adb_request_new(dev->ep_out, ADB_BULK_BUFFER_SIZE);
+        if (!req)
+                goto fail;
+        req->complete = adb_complete_out;
+        dev->rx_req = req;
+
+        for (i = 0; i < TX_REQ_MAX; i++) {
+                req = adb_request_new(dev->ep_in, ADB_BULK_BUFFER_SIZE);
+                if (!req)
+                        goto fail;
+                req->complete = adb_complete_in;
+                adb_req_put(dev, &dev->tx_idle, req);
+        }
+
+        return 0;
+
+fail:
+        printk(KERN_ERR "adb_bind() could not allocate requests\n");
+        return -1;
+}
+
+static ssize_t adb_read(struct file *fp, char __user *buf,
+                                size_t count, loff_t *pos)
+{
+        struct adb_dev *dev = fp->private_data;
+        struct usb_request *req;
+        int r = count, xfer;
+        int ret;
+
+        pr_debug("adb_read(%d)\n", count);
+        if (!_adb_dev)
+                return -ENODEV;
+
+        if (count > ADB_BULK_BUFFER_SIZE)
+                return -EINVAL;
+
+        if (adb_lock(&dev->read_excl))
+                return -EBUSY;
+
+        /* we will block until we're online */
+        while (!(dev->online || dev->error)) {
+                pr_debug("adb_read: waiting for online state\n");
+                ret = wait_event_interruptible(dev->read_wq,
+                                (dev->online || dev->error));
+                if (ret < 0) {
+                        adb_unlock(&dev->read_excl);
+                        return ret;
+                }
+        }
+        if (dev->error) {
+                r = -EIO;
+                goto done;
+        }
+
+requeue_req:
+        /* queue a request */
+        req = dev->rx_req;
+        req->length = count;
+        dev->rx_done = 0;
+        ret = usb_ep_queue(dev->ep_out, req, GFP_ATOMIC);
+        if (ret < 0) {
+                pr_debug("adb_read: failed to queue req %p (%d)\n", req, ret);
+                r = -EIO;
+                dev->error = 1;
+                goto done;
+        } else {
+                pr_debug("rx %p queue\n", req);
+        }
+
+        /* wait for a request to complete */
+        ret = wait_event_interruptible(dev->read_wq, dev->rx_done);
+        if (ret < 0) {
+                dev->error = 1;
+                r = ret;
+                usb_ep_dequeue(dev->ep_out, req);
+                goto done;
+        }
+        if (!dev->error) {
+                /* If we got a 0-len packet, throw it back and try again. */
+                if (req->actual == 0)
+                        goto requeue_req;
+
+                pr_debug("rx %p %d\n", req, req->actual);
+                xfer = (req->actual < count) ? req->actual : count;
+                if (copy_to_user(buf, req->buf, xfer))
+                        r = -EFAULT;
+
+        } else
+                r = -EIO;
+
+done:
+        adb_unlock(&dev->read_excl);
+        pr_debug("adb_read returning %d\n", r);
+        return r;
+}
+
+static ssize_t adb_write(struct file *fp, const char __user *buf,
+                                 size_t count, loff_t *pos)
+{
+        struct adb_dev *dev = fp->private_data;
+        struct usb_request *req = 0;
+        int r = count, xfer;
+        int ret;
+
+        if (!_adb_dev)
+                return -ENODEV;
+        pr_debug("adb_write(%d)\n", count);
+
+        if (adb_lock(&dev->write_excl))
+                return -EBUSY;
+
+        while (count > 0) {
+                if (dev->error) {
+                        pr_debug("adb_write dev->error\n");
+                        r = -EIO;
+                        break;
+                }
+
+                /* get an idle tx request to use */
+                req = 0;
+                ret = wait_event_interruptible(dev->write_wq,
+                        (req = adb_req_get(dev, &dev->tx_idle)) || dev->error);
+
+                if (ret < 0) {
+                        r = ret;
+                        break;
+                }
+
+                if (req != 0) {
+                        if (count > ADB_BULK_BUFFER_SIZE)
+                                xfer = ADB_BULK_BUFFER_SIZE;
+                        else
+                                xfer = count;
+                        if (copy_from_user(req->buf, buf, xfer)) {
+                                r = -EFAULT;
+                                break;
+                        }
+
+                        req->length = xfer;
+                        ret = usb_ep_queue(dev->ep_in, req, GFP_ATOMIC);
+                        if (ret < 0) {
+                                pr_debug("adb_write: xfer error %d\n", ret);
+                                dev->error = 1;
+                                r = -EIO;
+                                break;
+                        }
+
+                        buf += xfer;
+                        count -= xfer;
+
+                        /* zero this so we don't try to free it on error exit */
+                        req = 0;
+                }
+        }
+
+        if (req)
+                adb_req_put(dev, &dev->tx_idle, req);
+
+        adb_unlock(&dev->write_excl);
+        pr_debug("adb_write returning %d\n", r);
+        return r;
+}
+
+static int adb_open(struct inode *ip, struct file *fp)
+{
+        static unsigned long last_print;
+        static unsigned long count = 0;
+
+        if (!_adb_dev)
+                return -ENODEV;
+
+        if (++count == 1)
+                last_print = jiffies;
+        else {
+                if (!time_before(jiffies, last_print + HZ/2))
+                        count = 0;
+                last_print = jiffies;
+        }
+
+        if (adb_lock(&_adb_dev->open_excl)) {
+                cpu_relax();
+                return -EBUSY;
+        }
+
+        if (count < 5)
+                printk(KERN_INFO "adb_open(%s)\n", current->comm);
+
+
+        fp->private_data = _adb_dev;
+
+        /* clear the error latch */
+        _adb_dev->error = 0;
+
+        return 0;
+}
+
+static int adb_release(struct inode *ip, struct file *fp)
+{
+        static unsigned long last_print;
+        static unsigned long count = 0;
+
+        if (++count == 1)
+                last_print = jiffies;
+        else {
+                if (!time_before(jiffies, last_print + HZ/2))
+                        count = 0;
+                last_print = jiffies;
+        }
+
+        if (count < 5)
+                printk(KERN_INFO "adb_release\n");
+        adb_unlock(&_adb_dev->open_excl);
+        return 0;
+}
+
+/* file operations for ADB device /dev/android_adb */
+static struct file_operations adb_fops = {
+        .owner = THIS_MODULE,
+        .read = adb_read,
+        .write = adb_write,
+        .open = adb_open,
+        .release = adb_release,
+};
+
+static struct miscdevice adb_device = {
+        .minor = MISC_DYNAMIC_MINOR,
+        .name = adb_shortname,
+        .fops = &adb_fops,
+};
+
+
+
+
+static int
+adb_function_bind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct usb_composite_dev *cdev = c->cdev;
+        struct adb_dev  *dev = func_to_adb(f);
+        int                     id;
+        int                     ret;
+
+        dev->cdev = cdev;
+        DBG(cdev, "adb_function_bind dev: %p\n", dev);
+
+        /* allocate interface ID(s) */
+        id = usb_interface_id(c, f);
+        if (id < 0)
+                return id;
+        adb_interface_desc.bInterfaceNumber = id;
+
+        /* allocate endpoints */
+        ret = adb_create_bulk_endpoints(dev, &adb_fullspeed_in_desc,
+                        &adb_fullspeed_out_desc);
+        if (ret)
+                return ret;
+
+        /* support high speed hardware */
+        if (gadget_is_dualspeed(c->cdev->gadget)) {
+                adb_highspeed_in_desc.bEndpointAddress =
+                        adb_fullspeed_in_desc.bEndpointAddress;
+                adb_highspeed_out_desc.bEndpointAddress =
+                        adb_fullspeed_out_desc.bEndpointAddress;
+        }
+
+        DBG(cdev, "%s speed %s: IN/%s, OUT/%s\n",
+                        gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
+                        f->name, dev->ep_in->name, dev->ep_out->name);
+        return 0;
+}
+
+static void
+adb_function_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct adb_dev  *dev = func_to_adb(f);
+        struct usb_request *req;
+
+
+        dev->online = 0;
+        dev->error = 1;
+
+        wake_up(&dev->read_wq);
+
+        adb_request_free(dev->rx_req, dev->ep_out);
+        while ((req = adb_req_get(dev, &dev->tx_idle)))
+                adb_request_free(req, dev->ep_in);
+}
+
+static int adb_function_set_alt(struct usb_function *f,
+                unsigned intf, unsigned alt)
+{
+        struct adb_dev  *dev = func_to_adb(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+        int ret;
+
+        DBG(cdev, "adb_function_set_alt intf: %d alt: %d\n", intf, alt);
+        config_ep_by_speed(cdev->gadget, f, dev->ep_in);
+        ret = usb_ep_enable(dev->ep_in);
+        if (ret)
+                return ret;
+        config_ep_by_speed(cdev->gadget, f, dev->ep_out);
+        ret = usb_ep_enable(dev->ep_out);
+        if (ret) {
+                usb_ep_disable(dev->ep_in);
+                return ret;
+        }
+        dev->online = 1;
+
+        /* readers may be blocked waiting for us to go online */
+        wake_up(&dev->read_wq);
+        return 0;
+}
+
+static void adb_function_disable(struct usb_function *f)
+{
+        struct adb_dev  *dev = func_to_adb(f);
+        struct usb_composite_dev        *cdev = dev->cdev;
+
+        DBG(cdev, "adb_function_disable cdev %p\n", cdev);
+        dev->online = 0;
+        dev->error = 1;
+        usb_ep_disable(dev->ep_in);
+        usb_ep_disable(dev->ep_out);
+
+        /* readers may be blocked waiting for us to go online */
+        wake_up(&dev->read_wq);
+
+        VDBG(cdev, "%s disabled\n", dev->function.name);
+}
+
+static int adb_bind_config(struct usb_configuration *c)
+{
+        struct adb_dev *dev = _adb_dev;
+
+        printk(KERN_INFO "adb_bind_config\n");
+
+        dev->cdev = c->cdev;
+        dev->function.name = "adb";
+        dev->function.descriptors = fs_adb_descs;
+        dev->function.hs_descriptors = hs_adb_descs;
+        dev->function.bind = adb_function_bind;
+        dev->function.unbind = adb_function_unbind;
+        dev->function.set_alt = adb_function_set_alt;
+        dev->function.disable = adb_function_disable;
+
+        return usb_add_function(c, &dev->function);
+}
+
+static int adb_setup(void)
+{
+        struct adb_dev *dev;
+        int ret;
+
+        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+        if (!dev)
+                return -ENOMEM;
+
+        spin_lock_init(&dev->lock);
+
+        init_waitqueue_head(&dev->read_wq);
+        init_waitqueue_head(&dev->write_wq);
+
+        atomic_set(&dev->open_excl, 0);
+        atomic_set(&dev->read_excl, 0);
+        atomic_set(&dev->write_excl, 0);
+
+        INIT_LIST_HEAD(&dev->tx_idle);
+
+        _adb_dev = dev;
+
+        ret = misc_register(&adb_device);
+        if (ret)
+                goto err;
+
+        return 0;
+
+err:
+        kfree(dev);
+        printk(KERN_ERR "adb gadget driver failed to initialize\n");
+        return ret;
+}
+
+static void adb_cleanup(void)
+{
+        misc_deregister(&adb_device);
+
+        kfree(_adb_dev);
+        _adb_dev = NULL;
+}
diff --git a/drivers/usb/gadget/f_audio.c b/drivers/usb/gadget/f_audio.c
new file mode 100644
index 00000000000..a9a4eade7e8
--- /dev/null
+++ b/drivers/usb/gadget/f_audio.c
@@ -0,0 +1,798 @@
+/*
+ * f_audio.c -- USB Audio class function driver
+  *
+ * Copyright (C) 2008 Bryan Wu <cooloney@kernel.org>
+ * Copyright (C) 2008 Analog Devices, Inc
+ *
+ * Enter bugs at http://blackfin.uclinux.org/
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#include <linux/slab.h>
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/atomic.h>
+
+#include "u_audio.h"
+
+#define OUT_EP_MAX_PACKET_SIZE  200
+static int req_buf_size = OUT_EP_MAX_PACKET_SIZE;
+module_param(req_buf_size, int, S_IRUGO);
+MODULE_PARM_DESC(req_buf_size, "ISO OUT endpoint request buffer size");
+
+static int req_count = 256;
+module_param(req_count, int, S_IRUGO);
+MODULE_PARM_DESC(req_count, "ISO OUT endpoint request count");
+
+static int audio_buf_size = 48000;
+module_param(audio_buf_size, int, S_IRUGO);
+MODULE_PARM_DESC(audio_buf_size, "Audio buffer size");
+
+static int generic_set_cmd(struct usb_audio_control *con, u8 cmd, int value);
+static int generic_get_cmd(struct usb_audio_control *con, u8 cmd);
+
+/*
+ * DESCRIPTORS ... most are static, but strings and full
+ * configuration descriptors are built on demand.
+ */
+
+/*
+ * We have two interfaces- AudioControl and AudioStreaming
+ * TODO: only supcard playback currently
+ */
+#define F_AUDIO_AC_INTERFACE    0
+#define F_AUDIO_AS_INTERFACE    1
+#define F_AUDIO_NUM_INTERFACES  2
+
+/* B.3.1  Standard AC Interface Descriptor */
+static struct usb_interface_descriptor ac_interface_desc __initdata = {
+        .bLength =              USB_DT_INTERFACE_SIZE,
+        .bDescriptorType =      USB_DT_INTERFACE,
+        .bNumEndpoints =        0,
+        .bInterfaceClass =      USB_CLASS_AUDIO,
+        .bInterfaceSubClass =   USB_SUBCLASS_AUDIOCONTROL,
+};
+
+DECLARE_UAC_AC_HEADER_DESCRIPTOR(2);
+
+#define UAC_DT_AC_HEADER_LENGTH UAC_DT_AC_HEADER_SIZE(F_AUDIO_NUM_INTERFACES)
+/* 1 input terminal, 1 output terminal and 1 feature unit */
+#define UAC_DT_TOTAL_LENGTH (UAC_DT_AC_HEADER_LENGTH + UAC_DT_INPUT_TERMINAL_SIZE \
+        + UAC_DT_OUTPUT_TERMINAL_SIZE + UAC_DT_FEATURE_UNIT_SIZE(0))
+/* B.3.2  Class-Specific AC Interface Descriptor */
+static struct uac1_ac_header_descriptor_2 ac_header_desc = {
+        .bLength =              UAC_DT_AC_HEADER_LENGTH,
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubtype =   UAC_HEADER,
+        .bcdADC =               __constant_cpu_to_le16(0x0100),
+        .wTotalLength =         __constant_cpu_to_le16(UAC_DT_TOTAL_LENGTH),
+        .bInCollection =        F_AUDIO_NUM_INTERFACES,
+        .baInterfaceNr = {
+                [0] =           F_AUDIO_AC_INTERFACE,
+                [1] =           F_AUDIO_AS_INTERFACE,
+        }
+};
+
+#define INPUT_TERMINAL_ID       1
+static struct uac_input_terminal_descriptor input_terminal_desc = {
+        .bLength =              UAC_DT_INPUT_TERMINAL_SIZE,
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubtype =   UAC_INPUT_TERMINAL,
+        .bTerminalID =          INPUT_TERMINAL_ID,
+        .wTerminalType =        UAC_TERMINAL_STREAMING,
+        .bAssocTerminal =       0,
+        .wChannelConfig =       0x3,
+};
+
+DECLARE_UAC_FEATURE_UNIT_DESCRIPTOR(0);
+
+#define FEATURE_UNIT_ID         2
+static struct uac_feature_unit_descriptor_0 feature_unit_desc = {
+        .bLength                = UAC_DT_FEATURE_UNIT_SIZE(0),
+        .bDescriptorType        = USB_DT_CS_INTERFACE,
+        .bDescriptorSubtype     = UAC_FEATURE_UNIT,
+        .bUnitID                = FEATURE_UNIT_ID,
+        .bSourceID              = INPUT_TERMINAL_ID,
+        .bControlSize           = 2,
+        .bmaControls[0]         = (UAC_FU_MUTE | UAC_FU_VOLUME),
+};
+
+static struct usb_audio_control mute_control = {
+        .list = LIST_HEAD_INIT(mute_control.list),
+        .name = "Mute Control",
+        .type = UAC_FU_MUTE,
+        /* Todo: add real Mute control code */
+        .set = generic_set_cmd,
+        .get = generic_get_cmd,
+};
+
+static struct usb_audio_control volume_control = {
+        .list = LIST_HEAD_INIT(volume_control.list),
+        .name = "Volume Control",
+        .type = UAC_FU_VOLUME,
+        /* Todo: add real Volume control code */
+        .set = generic_set_cmd,
+        .get = generic_get_cmd,
+};
+
+static struct usb_audio_control_selector feature_unit = {
+        .list = LIST_HEAD_INIT(feature_unit.list),
+        .id = FEATURE_UNIT_ID,
+        .name = "Mute & Volume Control",
+        .type = UAC_FEATURE_UNIT,
+        .desc = (struct usb_descriptor_header *)&feature_unit_desc,
+};
+
+#define OUTPUT_TERMINAL_ID      3
+static struct uac1_output_terminal_descriptor output_terminal_desc = {
+        .bLength                = UAC_DT_OUTPUT_TERMINAL_SIZE,
+        .bDescriptorType        = USB_DT_CS_INTERFACE,
+        .bDescriptorSubtype     = UAC_OUTPUT_TERMINAL,
+        .bTerminalID            = OUTPUT_TERMINAL_ID,
+        .wTerminalType          = UAC_OUTPUT_TERMINAL_SPEAKER,
+        .bAssocTerminal         = FEATURE_UNIT_ID,
+        .bSourceID              = FEATURE_UNIT_ID,
+};
+
+/* B.4.1  Standard AS Interface Descriptor */
+static struct usb_interface_descriptor as_interface_alt_0_desc = {
+        .bLength =              USB_DT_INTERFACE_SIZE,
+        .bDescriptorType =      USB_DT_INTERFACE,
+        .bAlternateSetting =    0,
+        .bNumEndpoints =        0,
+        .bInterfaceClass =      USB_CLASS_AUDIO,
+        .bInterfaceSubClass =   USB_SUBCLASS_AUDIOSTREAMING,
+};
+
+static struct usb_interface_descriptor as_interface_alt_1_desc = {
+        .bLength =              USB_DT_INTERFACE_SIZE,
+        .bDescriptorType =      USB_DT_INTERFACE,
+        .bAlternateSetting =    1,
+        .bNumEndpoints =        1,
+        .bInterfaceClass =      USB_CLASS_AUDIO,
+        .bInterfaceSubClass =   USB_SUBCLASS_AUDIOSTREAMING,
+};
+
+/* B.4.2  Class-Specific AS Interface Descriptor */
+static struct uac1_as_header_descriptor as_header_desc = {
+        .bLength =              UAC_DT_AS_HEADER_SIZE,
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubtype =   UAC_AS_GENERAL,
+        .bTerminalLink =        INPUT_TERMINAL_ID,
+        .bDelay =               1,
+        .wFormatTag =           UAC_FORMAT_TYPE_I_PCM,
+};
+
+DECLARE_UAC_FORMAT_TYPE_I_DISCRETE_DESC(1);
+
+static struct uac_format_type_i_discrete_descriptor_1 as_type_i_desc = {
+        .bLength =              UAC_FORMAT_TYPE_I_DISCRETE_DESC_SIZE(1),
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubtype =   UAC_FORMAT_TYPE,
+        .bFormatType =          UAC_FORMAT_TYPE_I,
+        .bSubframeSize =        2,
+        .bBitResolution =       16,
+        .bSamFreqType =         1,
+};
+
+/* Standard ISO OUT Endpoint Descriptor */
+static struct usb_endpoint_descriptor as_out_ep_desc  = {
+        .bLength =              USB_DT_ENDPOINT_AUDIO_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+        .bEndpointAddress =     USB_DIR_OUT,
+        .bmAttributes =         USB_ENDPOINT_SYNC_ADAPTIVE
+                                | USB_ENDPOINT_XFER_ISOC,
+        .wMaxPacketSize =       __constant_cpu_to_le16(OUT_EP_MAX_PACKET_SIZE),
+        .bInterval =            4,
+};
+
+/* Class-specific AS ISO OUT Endpoint Descriptor */
+static struct uac_iso_endpoint_descriptor as_iso_out_desc __initdata = {
+        .bLength =              UAC_ISO_ENDPOINT_DESC_SIZE,
+        .bDescriptorType =      USB_DT_CS_ENDPOINT,
+        .bDescriptorSubtype =   UAC_EP_GENERAL,
+        .bmAttributes =         1,
+        .bLockDelayUnits =      1,
+        .wLockDelay =           __constant_cpu_to_le16(1),
+};
+
+static struct usb_descriptor_header *f_audio_desc[] __initdata = {
+        (struct usb_descriptor_header *)&ac_interface_desc,
+        (struct usb_descriptor_header *)&ac_header_desc,
+
+        (struct usb_descriptor_header *)&input_terminal_desc,
+        (struct usb_descriptor_header *)&output_terminal_desc,
+        (struct usb_descriptor_header *)&feature_unit_desc,
+
+        (struct usb_descriptor_header *)&as_interface_alt_0_desc,
+        (struct usb_descriptor_header *)&as_interface_alt_1_desc,
+        (struct usb_descriptor_header *)&as_header_desc,
+
+        (struct usb_descriptor_header *)&as_type_i_desc,
+
+        (struct usb_descriptor_header *)&as_out_ep_desc,
+        (struct usb_descriptor_header *)&as_iso_out_desc,
+        NULL,
+};
+
+/* string IDs are assigned dynamically */
+
+#define STRING_MANUFACTURER_IDX         0
+#define STRING_PRODUCT_IDX              1
+
+static char manufacturer[50];
+
+static struct usb_string strings_dev[] = {
+        [STRING_MANUFACTURER_IDX].s = manufacturer,
+        [STRING_PRODUCT_IDX].s = DRIVER_DESC,
+        {  } /* end of list */
+};
+
+static struct usb_gadget_strings stringtab_dev = {
+        .language       = 0x0409,       /* en-us */
+        .strings        = strings_dev,
+};
+
+static struct usb_gadget_strings *audio_strings[] = {
+        &stringtab_dev,
+        NULL,
+};
+
+/*
+ * This function is an ALSA sound card following USB Audio Class Spec 1.0.
+ */
+
+/*-------------------------------------------------------------------------*/
+struct f_audio_buf {
+        u8 *buf;
+        int actual;
+        struct list_head list;
+};
+
+static struct f_audio_buf *f_audio_buffer_alloc(int buf_size)
+{
+        struct f_audio_buf *copy_buf;
+
+        copy_buf = kzalloc(sizeof *copy_buf, GFP_ATOMIC);
+        if (!copy_buf)
+                return ERR_PTR(-ENOMEM);
+
+        copy_buf->buf = kzalloc(buf_size, GFP_ATOMIC);
+        if (!copy_buf->buf) {
+                kfree(copy_buf);
+                return ERR_PTR(-ENOMEM);
+        }
+
+        return copy_buf;
+}
+
+static void f_audio_buffer_free(struct f_audio_buf *audio_buf)
+{
+        kfree(audio_buf->buf);
+        kfree(audio_buf);
+}
+/*-------------------------------------------------------------------------*/
+
+struct f_audio {
+        struct gaudio                   card;
+
+        /* endpoints handle full and/or high speeds */
+        struct usb_ep                   *out_ep;
+
+        spinlock_t                      lock;
+        struct f_audio_buf *copy_buf;
+        struct work_struct playback_work;
+        struct list_head play_queue;
+
+        /* Control Set command */
+        struct list_head cs;
+        u8 set_cmd;
+        struct usb_audio_control *set_con;
+};
+
+static inline struct f_audio *func_to_audio(struct usb_function *f)
+{
+        return container_of(f, struct f_audio, card.func);
+}
+
+/*-------------------------------------------------------------------------*/
+
+static void f_audio_playback_work(struct work_struct *data)
+{
+        struct f_audio *audio = container_of(data, struct f_audio,
+                                        playback_work);
+        struct f_audio_buf *play_buf;
+
+        spin_lock_irq(&audio->lock);
+        if (list_empty(&audio->play_queue)) {
+                spin_unlock_irq(&audio->lock);
+                return;
+        }
+        play_buf = list_first_entry(&audio->play_queue,
+                        struct f_audio_buf, list);
+        list_del(&play_buf->list);
+        spin_unlock_irq(&audio->lock);
+
+        u_audio_playback(&audio->card, play_buf->buf, play_buf->actual);
+        f_audio_buffer_free(play_buf);
+}
+
+static int f_audio_out_ep_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct f_audio *audio = req->context;
+        struct usb_composite_dev *cdev = audio->card.func.config->cdev;
+        struct f_audio_buf *copy_buf = audio->copy_buf;
+        int err;
+
+        if (!copy_buf)
+                return -EINVAL;
+
+        /* Copy buffer is full, add it to the play_queue */
+        if (audio_buf_size - copy_buf->actual < req->actual) {
+                list_add_tail(&copy_buf->list, &audio->play_queue);
+                schedule_work(&audio->playback_work);
+                copy_buf = f_audio_buffer_alloc(audio_buf_size);
+                if (IS_ERR(copy_buf))
+                        return -ENOMEM;
+        }
+
+        memcpy(copy_buf->buf + copy_buf->actual, req->buf, req->actual);
+        copy_buf->actual += req->actual;
+        audio->copy_buf = copy_buf;
+
+        err = usb_ep_queue(ep, req, GFP_ATOMIC);
+        if (err)
+                ERROR(cdev, "%s queue req: %d\n", ep->name, err);
+
+        return 0;
+
+}
+
+static void f_audio_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct f_audio *audio = req->context;
+        int status = req->status;
+        u32 data = 0;
+        struct usb_ep *out_ep = audio->out_ep;
+
+        switch (status) {
+
+        case 0:                         /* normal completion? */
+                if (ep == out_ep)
+                        f_audio_out_ep_complete(ep, req);
+                else if (audio->set_con) {
+                        memcpy(&data, req->buf, req->length);
+                        audio->set_con->set(audio->set_con, audio->set_cmd,
+                                        le16_to_cpu(data));
+                        audio->set_con = NULL;
+                }
+                break;
+        default:
+                break;
+        }
+}
+
+static int audio_set_intf_req(struct usb_function *f,
+                const struct usb_ctrlrequest *ctrl)
+{
+        struct f_audio          *audio = func_to_audio(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+        struct usb_request      *req = cdev->req;
+        u8                      id = ((le16_to_cpu(ctrl->wIndex) >> 8) & 0xFF);
+        u16                     len = le16_to_cpu(ctrl->wLength);
+        u16                     w_value = le16_to_cpu(ctrl->wValue);
+        u8                      con_sel = (w_value >> 8) & 0xFF;
+        u8                      cmd = (ctrl->bRequest & 0x0F);
+        struct usb_audio_control_selector *cs;
+        struct usb_audio_control *con;
+
+        DBG(cdev, "bRequest 0x%x, w_value 0x%04x, len %d, entity %d\n",
+                        ctrl->bRequest, w_value, len, id);
+
+        list_for_each_entry(cs, &audio->cs, list) {
+                if (cs->id == id) {
+                        list_for_each_entry(con, &cs->control, list) {
+                                if (con->type == con_sel) {
+                                        audio->set_con = con;
+                                        break;
+                                }
+                        }
+                        break;
+                }
+        }
+
+        audio->set_cmd = cmd;
+        req->context = audio;
+        req->complete = f_audio_complete;
+
+        return len;
+}
+
+static int audio_get_intf_req(struct usb_function *f,
+                const struct usb_ctrlrequest *ctrl)
+{
+        struct f_audio          *audio = func_to_audio(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+        struct usb_request      *req = cdev->req;
+        int                     value = -EOPNOTSUPP;
+        u8                      id = ((le16_to_cpu(ctrl->wIndex) >> 8) & 0xFF);
+        u16                     len = le16_to_cpu(ctrl->wLength);
+        u16                     w_value = le16_to_cpu(ctrl->wValue);
+        u8                      con_sel = (w_value >> 8) & 0xFF;
+        u8                      cmd = (ctrl->bRequest & 0x0F);
+        struct usb_audio_control_selector *cs;
+        struct usb_audio_control *con;
+
+        DBG(cdev, "bRequest 0x%x, w_value 0x%04x, len %d, entity %d\n",
+                        ctrl->bRequest, w_value, len, id);
+
+        list_for_each_entry(cs, &audio->cs, list) {
+                if (cs->id == id) {
+                        list_for_each_entry(con, &cs->control, list) {
+                                if (con->type == con_sel && con->get) {
+                                        value = con->get(con, cmd);
+                                        break;
+                                }
+                        }
+                        break;
+                }
+        }
+
+        req->context = audio;
+        req->complete = f_audio_complete;
+        memcpy(req->buf, &value, len);
+
+        return len;
+}
+
+static int audio_set_endpoint_req(struct usb_function *f,
+                const struct usb_ctrlrequest *ctrl)
+{
+        struct usb_composite_dev *cdev = f->config->cdev;
+        int                     value = -EOPNOTSUPP;
+        u16                     ep = le16_to_cpu(ctrl->wIndex);
+        u16                     len = le16_to_cpu(ctrl->wLength);
+        u16                     w_value = le16_to_cpu(ctrl->wValue);
+
+        DBG(cdev, "bRequest 0x%x, w_value 0x%04x, len %d, endpoint %d\n",
+                        ctrl->bRequest, w_value, len, ep);
+
+        switch (ctrl->bRequest) {
+        case UAC_SET_CUR:
+                value = 0;
+                break;
+
+        case UAC_SET_MIN:
+                break;
+
+        case UAC_SET_MAX:
+                break;
+
+        case UAC_SET_RES:
+                break;
+
+        case UAC_SET_MEM:
+                break;
+
+        default:
+                break;
+        }
+
+        return value;
+}
+
+static int audio_get_endpoint_req(struct usb_function *f,
+                const struct usb_ctrlrequest *ctrl)
+{
+        struct usb_composite_dev *cdev = f->config->cdev;
+        int value = -EOPNOTSUPP;
+        u8 ep = ((le16_to_cpu(ctrl->wIndex) >> 8) & 0xFF);
+        u16 len = le16_to_cpu(ctrl->wLength);
+        u16 w_value = le16_to_cpu(ctrl->wValue);
+
+        DBG(cdev, "bRequest 0x%x, w_value 0x%04x, len %d, endpoint %d\n",
+                        ctrl->bRequest, w_value, len, ep);
+
+        switch (ctrl->bRequest) {
+        case UAC_GET_CUR:
+        case UAC_GET_MIN:
+        case UAC_GET_MAX:
+        case UAC_GET_RES:
+                value = 3;
+                break;
+        case UAC_GET_MEM:
+                break;
+        default:
+                break;
+        }
+
+        return value;
+}
+
+static int
+f_audio_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
+{
+        struct usb_composite_dev *cdev = f->config->cdev;
+        struct usb_request      *req = cdev->req;
+        int                     value = -EOPNOTSUPP;
+        u16                     w_index = le16_to_cpu(ctrl->wIndex);
+        u16                     w_value = le16_to_cpu(ctrl->wValue);
+        u16                     w_length = le16_to_cpu(ctrl->wLength);
+
+        /* composite driver infrastructure handles everything; interface
+         * activation uses set_alt().
+         */
+        switch (ctrl->bRequestType) {
+        case USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE:
+                value = audio_set_intf_req(f, ctrl);
+                break;
+
+        case USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE:
+                value = audio_get_intf_req(f, ctrl);
+                break;
+
+        case USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_ENDPOINT:
+                value = audio_set_endpoint_req(f, ctrl);
+                break;
+
+        case USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_ENDPOINT:
+                value = audio_get_endpoint_req(f, ctrl);
+                break;
+
+        default:
+                ERROR(cdev, "invalid control req%02x.%02x v%04x i%04x l%d\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, w_length);
+        }
+
+        /* respond with data transfer or status phase? */
+        if (value >= 0) {
+                DBG(cdev, "audio req%02x.%02x v%04x i%04x l%d\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, w_length);
+                req->zero = 0;
+                req->length = value;
+                value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
+                if (value < 0)
+                        ERROR(cdev, "audio response on err %d\n", value);
+        }
+
+        /* device either stalls (value < 0) or reports success */
+        return value;
+}
+
+static int f_audio_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
+{
+        struct f_audio          *audio = func_to_audio(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+        struct usb_ep *out_ep = audio->out_ep;
+        struct usb_request *req;
+        int i = 0, err = 0;
+
+        DBG(cdev, "intf %d, alt %d\n", intf, alt);
+
+        if (intf == 1) {
+                if (alt == 1) {
+                        usb_ep_enable(out_ep);
+                        out_ep->driver_data = audio;
+                        audio->copy_buf = f_audio_buffer_alloc(audio_buf_size);
+                        if (IS_ERR(audio->copy_buf))
+                                return -ENOMEM;
+
+                        /*
+                         * allocate a bunch of read buffers
+                         * and queue them all at once.
+                         */
+                        for (i = 0; i < req_count && err == 0; i++) {
+                                req = usb_ep_alloc_request(out_ep, GFP_ATOMIC);
+                                if (req) {
+                                        req->buf = kzalloc(req_buf_size,
+                                                        GFP_ATOMIC);
+                                        if (req->buf) {
+                                                req->length = req_buf_size;
+                                                req->context = audio;
+                                                req->complete =
+                                                        f_audio_complete;
+                                                err = usb_ep_queue(out_ep,
+                                                        req, GFP_ATOMIC);
+                                                if (err)
+                                                        ERROR(cdev,
+                                                        "%s queue req: %d\n",
+                                                        out_ep->name, err);
+                                        } else
+                                                err = -ENOMEM;
+                                } else
+                                        err = -ENOMEM;
+                        }
+
+                } else {
+                        struct f_audio_buf *copy_buf = audio->copy_buf;
+                        if (copy_buf) {
+                                list_add_tail(&copy_buf->list,
+                                                &audio->play_queue);
+                                schedule_work(&audio->playback_work);
+                        }
+                }
+        }
+
+        return err;
+}
+
+static void f_audio_disable(struct usb_function *f)
+{
+        return;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static void f_audio_build_desc(struct f_audio *audio)
+{
+        struct gaudio *card = &audio->card;
+        u8 *sam_freq;
+        int rate;
+
+        /* Set channel numbers */
+        input_terminal_desc.bNrChannels = u_audio_get_playback_channels(card);
+        as_type_i_desc.bNrChannels = u_audio_get_playback_channels(card);
+
+        /* Set sample rates */
+        rate = u_audio_get_playback_rate(card);
+        sam_freq = as_type_i_desc.tSamFreq[0];
+        memcpy(sam_freq, &rate, 3);
+
+        /* Todo: Set Sample bits and other parameters */
+
+        return;
+}
+
+/* audio function driver setup/binding */
+static int __init
+f_audio_bind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct usb_composite_dev *cdev = c->cdev;
+        struct f_audio          *audio = func_to_audio(f);
+        int                     status;
+        struct usb_ep           *ep;
+
+        f_audio_build_desc(audio);
+
+        /* allocate instance-specific interface IDs, and patch descriptors */
+        status = usb_interface_id(c, f);
+        if (status < 0)
+                goto fail;
+        ac_interface_desc.bInterfaceNumber = status;
+
+        status = usb_interface_id(c, f);
+        if (status < 0)
+                goto fail;
+        as_interface_alt_0_desc.bInterfaceNumber = status;
+        as_interface_alt_1_desc.bInterfaceNumber = status;
+
+        status = -ENODEV;
+
+        /* allocate instance-specific endpoints */
+        ep = usb_ep_autoconfig(cdev->gadget, &as_out_ep_desc);
+        if (!ep)
+                goto fail;
+        audio->out_ep = ep;
+        audio->out_ep->desc = &as_out_ep_desc;
+        ep->driver_data = cdev; /* claim */
+
+        status = -ENOMEM;
+
+        /* supcard all relevant hardware speeds... we expect that when
+         * hardware is dual speed, all bulk-capable endpoints work at
+         * both speeds
+         */
+
+        /* copy descriptors, and track endpoint copies */
+        if (gadget_is_dualspeed(c->cdev->gadget)) {
+                c->highspeed = true;
+                f->hs_descriptors = usb_copy_descriptors(f_audio_desc);
+        } else
+                f->descriptors = usb_copy_descriptors(f_audio_desc);
+
+        return 0;
+
+fail:
+
+        return status;
+}
+
+static void
+f_audio_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct f_audio          *audio = func_to_audio(f);
+
+        usb_free_descriptors(f->descriptors);
+        usb_free_descriptors(f->hs_descriptors);
+        kfree(audio);
+}
+
+/*-------------------------------------------------------------------------*/
+
+static int generic_set_cmd(struct usb_audio_control *con, u8 cmd, int value)
+{
+        con->data[cmd] = value;
+
+        return 0;
+}
+
+static int generic_get_cmd(struct usb_audio_control *con, u8 cmd)
+{
+        return con->data[cmd];
+}
+
+/* Todo: add more control selecotor dynamically */
+int __init control_selector_init(struct f_audio *audio)
+{
+        INIT_LIST_HEAD(&audio->cs);
+        list_add(&feature_unit.list, &audio->cs);
+
+        INIT_LIST_HEAD(&feature_unit.control);
+        list_add(&mute_control.list, &feature_unit.control);
+        list_add(&volume_control.list, &feature_unit.control);
+
+        volume_control.data[UAC__CUR] = 0xffc0;
+        volume_control.data[UAC__MIN] = 0xe3a0;
+        volume_control.data[UAC__MAX] = 0xfff0;
+        volume_control.data[UAC__RES] = 0x0030;
+
+        return 0;
+}
+
+/**
+ * audio_bind_config - add USB audio function to a configuration
+ * @c: the configuration to supcard the USB audio function
+ * Context: single threaded during gadget setup
+ *
+ * Returns zero on success, else negative errno.
+ */
+int __init audio_bind_config(struct usb_configuration *c)
+{
+        struct f_audio *audio;
+        int status;
+
+        /* allocate and initialize one new instance */
+        audio = kzalloc(sizeof *audio, GFP_KERNEL);
+        if (!audio)
+                return -ENOMEM;
+
+        audio->card.func.name = "g_audio";
+        audio->card.gadget = c->cdev->gadget;
+
+        INIT_LIST_HEAD(&audio->play_queue);
+        spin_lock_init(&audio->lock);
+
+        /* set up ASLA audio devices */
+        status = gaudio_setup(&audio->card);
+        if (status < 0)
+                goto setup_fail;
+
+        audio->card.func.strings = audio_strings;
+        audio->card.func.bind = f_audio_bind;
+        audio->card.func.unbind = f_audio_unbind;
+        audio->card.func.set_alt = f_audio_set_alt;
+        audio->card.func.setup = f_audio_setup;
+        audio->card.func.disable = f_audio_disable;
+
+        control_selector_init(audio);
+
+        INIT_WORK(&audio->playback_work, f_audio_playback_work);
+
+        status = usb_add_function(c, &audio->card.func);
+        if (status)
+                goto add_fail;
+
+        INFO(c->cdev, "audio_buf_size %d, req_buf_size %d, req_count %d\n",
+                audio_buf_size, req_buf_size, req_count);
+
+        return status;
+
+add_fail:
+        gaudio_cleanup();
+setup_fail:
+        kfree(audio);
+        return status;
+}
diff --git a/drivers/usb/gadget/f_mtp.c b/drivers/usb/gadget/f_mtp.c
new file mode 100644
index 00000000000..5aa5214297d
--- /dev/null
+++ b/drivers/usb/gadget/f_mtp.c
@@ -0,0 +1,1264 @@
+/*
+ * Gadget Function Driver for MTP
+ *
+ * Copyright (C) 2010 Google, Inc.
+ * Author: Mike Lockwood <lockwood@android.com>
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+/* #define DEBUG */
+/* #define VERBOSE_DEBUG */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/poll.h>
+#include <linux/delay.h>
+#include <linux/wait.h>
+#include <linux/err.h>
+#include <linux/interrupt.h>
+
+#include <linux/types.h>
+#include <linux/file.h>
+#include <linux/device.h>
+#include <linux/miscdevice.h>
+
+#include <linux/usb.h>
+#include <linux/usb_usual.h>
+#include <linux/usb/ch9.h>
+#include <linux/usb/f_mtp.h>
+
+#define MTP_BULK_BUFFER_SIZE       16384
+#define INTR_BUFFER_SIZE           28
+
+/* String IDs */
+#define INTERFACE_STRING_INDEX  0
+
+/* values for mtp_dev.state */
+#define STATE_OFFLINE               0   /* initial state, disconnected */
+#define STATE_READY                 1   /* ready for userspace calls */
+#define STATE_BUSY                  2   /* processing userspace calls */
+#define STATE_CANCELED              3   /* transaction canceled by host */
+#define STATE_ERROR                 4   /* error from completion routine */
+
+/* number of tx and rx requests to allocate */
+#define TX_REQ_MAX 4
+#define RX_REQ_MAX 2
+#define INTR_REQ_MAX 5
+
+/* ID for Microsoft MTP OS String */
+#define MTP_OS_STRING_ID   0xEE
+
+/* MTP class reqeusts */
+#define MTP_REQ_CANCEL              0x64
+#define MTP_REQ_GET_EXT_EVENT_DATA  0x65
+#define MTP_REQ_RESET               0x66
+#define MTP_REQ_GET_DEVICE_STATUS   0x67
+
+/* constants for device status */
+#define MTP_RESPONSE_OK             0x2001
+#define MTP_RESPONSE_DEVICE_BUSY    0x2019
+
+static const char mtp_shortname[] = "mtp_usb";
+
+struct mtp_dev {
+        struct usb_function function;
+        struct usb_composite_dev *cdev;
+        spinlock_t lock;
+
+        struct usb_ep *ep_in;
+        struct usb_ep *ep_out;
+        struct usb_ep *ep_intr;
+
+        int state;
+
+        /* synchronize access to our device file */
+        atomic_t open_excl;
+        /* to enforce only one ioctl at a time */
+        atomic_t ioctl_excl;
+
+        struct list_head tx_idle;
+        struct list_head intr_idle;
+
+        wait_queue_head_t read_wq;
+        wait_queue_head_t write_wq;
+        wait_queue_head_t intr_wq;
+        struct usb_request *rx_req[RX_REQ_MAX];
+        int rx_done;
+
+        /* for processing MTP_SEND_FILE, MTP_RECEIVE_FILE and
+         * MTP_SEND_FILE_WITH_HEADER ioctls on a work queue
+         */
+        struct workqueue_struct *wq;
+        struct work_struct send_file_work;
+        struct work_struct receive_file_work;
+        struct file *xfer_file;
+        loff_t xfer_file_offset;
+        int64_t xfer_file_length;
+        unsigned xfer_send_header;
+        uint16_t xfer_command;
+        uint32_t xfer_transaction_id;
+        int xfer_result;
+};
+
+static struct usb_interface_descriptor mtp_interface_desc = {
+        .bLength                = USB_DT_INTERFACE_SIZE,
+        .bDescriptorType        = USB_DT_INTERFACE,
+        .bInterfaceNumber       = 0,
+        .bNumEndpoints          = 3,
+        .bInterfaceClass        = USB_CLASS_VENDOR_SPEC,
+        .bInterfaceSubClass     = USB_SUBCLASS_VENDOR_SPEC,
+        .bInterfaceProtocol     = 0,
+};
+
+static struct usb_interface_descriptor ptp_interface_desc = {
+        .bLength                = USB_DT_INTERFACE_SIZE,
+        .bDescriptorType        = USB_DT_INTERFACE,
+        .bInterfaceNumber       = 0,
+        .bNumEndpoints          = 3,
+        .bInterfaceClass        = USB_CLASS_STILL_IMAGE,
+        .bInterfaceSubClass     = 1,
+        .bInterfaceProtocol     = 1,
+};
+
+static struct usb_endpoint_descriptor mtp_highspeed_in_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_IN,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize         = __constant_cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor mtp_highspeed_out_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_OUT,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize         = __constant_cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor mtp_fullspeed_in_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_IN,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_endpoint_descriptor mtp_fullspeed_out_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_OUT,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_endpoint_descriptor mtp_intr_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_IN,
+        .bmAttributes           = USB_ENDPOINT_XFER_INT,
+        .wMaxPacketSize         = __constant_cpu_to_le16(INTR_BUFFER_SIZE),
+        .bInterval              = 6,
+};
+
+static struct usb_descriptor_header *fs_mtp_descs[] = {
+        (struct usb_descriptor_header *) &mtp_interface_desc,
+        (struct usb_descriptor_header *) &mtp_fullspeed_in_desc,
+        (struct usb_descriptor_header *) &mtp_fullspeed_out_desc,
+        (struct usb_descriptor_header *) &mtp_intr_desc,
+        NULL,
+};
+
+static struct usb_descriptor_header *hs_mtp_descs[] = {
+        (struct usb_descriptor_header *) &mtp_interface_desc,
+        (struct usb_descriptor_header *) &mtp_highspeed_in_desc,
+        (struct usb_descriptor_header *) &mtp_highspeed_out_desc,
+        (struct usb_descriptor_header *) &mtp_intr_desc,
+        NULL,
+};
+
+static struct usb_descriptor_header *fs_ptp_descs[] = {
+        (struct usb_descriptor_header *) &ptp_interface_desc,
+        (struct usb_descriptor_header *) &mtp_fullspeed_in_desc,
+        (struct usb_descriptor_header *) &mtp_fullspeed_out_desc,
+        (struct usb_descriptor_header *) &mtp_intr_desc,
+        NULL,
+};
+
+static struct usb_descriptor_header *hs_ptp_descs[] = {
+        (struct usb_descriptor_header *) &ptp_interface_desc,
+        (struct usb_descriptor_header *) &mtp_highspeed_in_desc,
+        (struct usb_descriptor_header *) &mtp_highspeed_out_desc,
+        (struct usb_descriptor_header *) &mtp_intr_desc,
+        NULL,
+};
+
+static struct usb_string mtp_string_defs[] = {
+        /* Naming interface "MTP" so libmtp will recognize us */
+        [INTERFACE_STRING_INDEX].s      = "MTP",
+        {  },   /* end of list */
+};
+
+static struct usb_gadget_strings mtp_string_table = {
+        .language               = 0x0409,       /* en-US */
+        .strings                = mtp_string_defs,
+};
+
+static struct usb_gadget_strings *mtp_strings[] = {
+        &mtp_string_table,
+        NULL,
+};
+
+/* Microsoft MTP OS String */
+static u8 mtp_os_string[] = {
+        18, /* sizeof(mtp_os_string) */
+        USB_DT_STRING,
+        /* Signature field: "MSFT100" */
+        'M', 0, 'S', 0, 'F', 0, 'T', 0, '1', 0, '0', 0, '0', 0,
+        /* vendor code */
+        1,
+        /* padding */
+        0
+};
+
+/* Microsoft Extended Configuration Descriptor Header Section */
+struct mtp_ext_config_desc_header {
+        __le32  dwLength;
+        __u16   bcdVersion;
+        __le16  wIndex;
+        __u8    bCount;
+        __u8    reserved[7];
+};
+
+/* Microsoft Extended Configuration Descriptor Function Section */
+struct mtp_ext_config_desc_function {
+        __u8    bFirstInterfaceNumber;
+        __u8    bInterfaceCount;
+        __u8    compatibleID[8];
+        __u8    subCompatibleID[8];
+        __u8    reserved[6];
+};
+
+/* MTP Extended Configuration Descriptor */
+struct {
+        struct mtp_ext_config_desc_header       header;
+        struct mtp_ext_config_desc_function    function;
+} mtp_ext_config_desc = {
+        .header = {
+                .dwLength = __constant_cpu_to_le32(sizeof(mtp_ext_config_desc)),
+                .bcdVersion = __constant_cpu_to_le16(0x0100),
+                .wIndex = __constant_cpu_to_le16(4),
+                .bCount = __constant_cpu_to_le16(1),
+        },
+        .function = {
+                .bFirstInterfaceNumber = 0,
+                .bInterfaceCount = 1,
+                .compatibleID = { 'M', 'T', 'P' },
+        },
+};
+
+struct mtp_device_status {
+        __le16  wLength;
+        __le16  wCode;
+};
+
+/* temporary variable used between mtp_open() and mtp_gadget_bind() */
+static struct mtp_dev *_mtp_dev;
+
+static inline struct mtp_dev *func_to_mtp(struct usb_function *f)
+{
+        return container_of(f, struct mtp_dev, function);
+}
+
+static struct usb_request *mtp_request_new(struct usb_ep *ep, int buffer_size)
+{
+        struct usb_request *req = usb_ep_alloc_request(ep, GFP_KERNEL);
+        if (!req)
+                return NULL;
+
+        /* now allocate buffers for the requests */
+        req->buf = kmalloc(buffer_size, GFP_KERNEL);
+        if (!req->buf) {
+                usb_ep_free_request(ep, req);
+                return NULL;
+        }
+
+        return req;
+}
+
+static void mtp_request_free(struct usb_request *req, struct usb_ep *ep)
+{
+        if (req) {
+                kfree(req->buf);
+                usb_ep_free_request(ep, req);
+        }
+}
+
+static inline int mtp_lock(atomic_t *excl)
+{
+        if (atomic_inc_return(excl) == 1) {
+                return 0;
+        } else {
+                atomic_dec(excl);
+                return -1;
+        }
+}
+
+static inline void mtp_unlock(atomic_t *excl)
+{
+        atomic_dec(excl);
+}
+
+/* add a request to the tail of a list */
+static void mtp_req_put(struct mtp_dev *dev, struct list_head *head,
+                struct usb_request *req)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&dev->lock, flags);
+        list_add_tail(&req->list, head);
+        spin_unlock_irqrestore(&dev->lock, flags);
+}
+
+/* remove a request from the head of a list */
+static struct usb_request
+*mtp_req_get(struct mtp_dev *dev, struct list_head *head)
+{
+        unsigned long flags;
+        struct usb_request *req;
+
+        spin_lock_irqsave(&dev->lock, flags);
+        if (list_empty(head)) {
+                req = 0;
+        } else {
+                req = list_first_entry(head, struct usb_request, list);
+                list_del(&req->list);
+        }
+        spin_unlock_irqrestore(&dev->lock, flags);
+        return req;
+}
+
+static void mtp_complete_in(struct usb_ep *ep, struct usb_request *req)
+{
+        struct mtp_dev *dev = _mtp_dev;
+
+        if (req->status != 0)
+                dev->state = STATE_ERROR;
+
+        mtp_req_put(dev, &dev->tx_idle, req);
+
+        wake_up(&dev->write_wq);
+}
+
+static void mtp_complete_out(struct usb_ep *ep, struct usb_request *req)
+{
+        struct mtp_dev *dev = _mtp_dev;
+
+        dev->rx_done = 1;
+        if (req->status != 0)
+                dev->state = STATE_ERROR;
+
+        wake_up(&dev->read_wq);
+}
+
+static void mtp_complete_intr(struct usb_ep *ep, struct usb_request *req)
+{
+        struct mtp_dev *dev = _mtp_dev;
+
+        if (req->status != 0)
+                dev->state = STATE_ERROR;
+
+        mtp_req_put(dev, &dev->intr_idle, req);
+
+        wake_up(&dev->intr_wq);
+}
+
+static int mtp_create_bulk_endpoints(struct mtp_dev *dev,
+                                struct usb_endpoint_descriptor *in_desc,
+                                struct usb_endpoint_descriptor *out_desc,
+                                struct usb_endpoint_descriptor *intr_desc)
+{
+        struct usb_composite_dev *cdev = dev->cdev;
+        struct usb_request *req;
+        struct usb_ep *ep;
+        int i;
+
+        DBG(cdev, "create_bulk_endpoints dev: %p\n", dev);
+
+        ep = usb_ep_autoconfig(cdev->gadget, in_desc);
+        if (!ep) {
+                DBG(cdev, "usb_ep_autoconfig for ep_in failed\n");
+                return -ENODEV;
+        }
+        DBG(cdev, "usb_ep_autoconfig for ep_in got %s\n", ep->name);
+        ep->driver_data = dev;          /* claim the endpoint */
+        dev->ep_in = ep;
+
+        ep = usb_ep_autoconfig(cdev->gadget, out_desc);
+        if (!ep) {
+                DBG(cdev, "usb_ep_autoconfig for ep_out failed\n");
+                return -ENODEV;
+        }
+        DBG(cdev, "usb_ep_autoconfig for mtp ep_out got %s\n", ep->name);
+        ep->driver_data = dev;          /* claim the endpoint */
+        dev->ep_out = ep;
+
+        ep = usb_ep_autoconfig(cdev->gadget, out_desc);
+        if (!ep) {
+                DBG(cdev, "usb_ep_autoconfig for ep_out failed\n");
+                return -ENODEV;
+        }
+        DBG(cdev, "usb_ep_autoconfig for mtp ep_out got %s\n", ep->name);
+        ep->driver_data = dev;          /* claim the endpoint */
+        dev->ep_out = ep;
+
+        ep = usb_ep_autoconfig(cdev->gadget, intr_desc);
+        if (!ep) {
+                DBG(cdev, "usb_ep_autoconfig for ep_intr failed\n");
+                return -ENODEV;
+        }
+        DBG(cdev, "usb_ep_autoconfig for mtp ep_intr got %s\n", ep->name);
+        ep->driver_data = dev;          /* claim the endpoint */
+        dev->ep_intr = ep;
+
+        /* now allocate requests for our endpoints */
+        for (i = 0; i < TX_REQ_MAX; i++) {
+                req = mtp_request_new(dev->ep_in, MTP_BULK_BUFFER_SIZE);
+                if (!req)
+                        goto fail;
+                req->complete = mtp_complete_in;
+                mtp_req_put(dev, &dev->tx_idle, req);
+        }
+        for (i = 0; i < RX_REQ_MAX; i++) {
+                req = mtp_request_new(dev->ep_out, MTP_BULK_BUFFER_SIZE);
+                if (!req)
+                        goto fail;
+                req->complete = mtp_complete_out;
+                dev->rx_req[i] = req;
+        }
+        for (i = 0; i < INTR_REQ_MAX; i++) {
+                req = mtp_request_new(dev->ep_intr, INTR_BUFFER_SIZE);
+                if (!req)
+                        goto fail;
+                req->complete = mtp_complete_intr;
+                mtp_req_put(dev, &dev->intr_idle, req);
+        }
+
+        return 0;
+
+fail:
+        printk(KERN_ERR "mtp_bind() could not allocate requests\n");
+        return -1;
+}
+
+static ssize_t mtp_read(struct file *fp, char __user *buf,
+        size_t count, loff_t *pos)
+{
+        struct mtp_dev *dev = fp->private_data;
+        struct usb_composite_dev *cdev = dev->cdev;
+        struct usb_request *req;
+        int r = count, xfer;
+        int ret = 0;
+
+        DBG(cdev, "mtp_read(%d)\n", count);
+
+        if (count > MTP_BULK_BUFFER_SIZE)
+                return -EINVAL;
+
+        /* we will block until we're online */
+        DBG(cdev, "mtp_read: waiting for online state\n");
+        ret = wait_event_interruptible(dev->read_wq,
+                dev->state != STATE_OFFLINE);
+        if (ret < 0) {
+                r = ret;
+                goto done;
+        }
+        spin_lock_irq(&dev->lock);
+        if (dev->state == STATE_CANCELED) {
+                /* report cancelation to userspace */
+                dev->state = STATE_READY;
+                spin_unlock_irq(&dev->lock);
+                return -ECANCELED;
+        }
+        dev->state = STATE_BUSY;
+        spin_unlock_irq(&dev->lock);
+
+requeue_req:
+        /* queue a request */
+        req = dev->rx_req[0];
+        req->length = count;
+        dev->rx_done = 0;
+        ret = usb_ep_queue(dev->ep_out, req, GFP_KERNEL);
+        if (ret < 0) {
+                r = -EIO;
+                goto done;
+        } else {
+                DBG(cdev, "rx %p queue\n", req);
+        }
+
+        /* wait for a request to complete */
+        ret = wait_event_interruptible(dev->read_wq, dev->rx_done);
+        if (ret < 0) {
+                r = ret;
+                usb_ep_dequeue(dev->ep_out, req);
+                goto done;
+        }
+        if (dev->state == STATE_BUSY) {
+                /* If we got a 0-len packet, throw it back and try again. */
+                if (req->actual == 0)
+                        goto requeue_req;
+
+                DBG(cdev, "rx %p %d\n", req, req->actual);
+                xfer = (req->actual < count) ? req->actual : count;
+                r = xfer;
+                if (copy_to_user(buf, req->buf, xfer))
+                        r = -EFAULT;
+        } else
+                r = -EIO;
+
+done:
+        spin_lock_irq(&dev->lock);
+        if (dev->state == STATE_CANCELED)
+                r = -ECANCELED;
+        else if (dev->state != STATE_OFFLINE)
+                dev->state = STATE_READY;
+        spin_unlock_irq(&dev->lock);
+
+        DBG(cdev, "mtp_read returning %d\n", r);
+        return r;
+}
+
+static ssize_t mtp_write(struct file *fp, const char __user *buf,
+        size_t count, loff_t *pos)
+{
+        struct mtp_dev *dev = fp->private_data;
+        struct usb_composite_dev *cdev = dev->cdev;
+        struct usb_request *req = 0;
+        int r = count, xfer;
+        int sendZLP = 0;
+        int ret;
+
+        DBG(cdev, "mtp_write(%d)\n", count);
+
+        spin_lock_irq(&dev->lock);
+        if (dev->state == STATE_CANCELED) {
+                /* report cancelation to userspace */
+                dev->state = STATE_READY;
+                spin_unlock_irq(&dev->lock);
+                return -ECANCELED;
+        }
+        if (dev->state == STATE_OFFLINE) {
+                spin_unlock_irq(&dev->lock);
+                return -ENODEV;
+        }
+        dev->state = STATE_BUSY;
+        spin_unlock_irq(&dev->lock);
+
+        /* we need to send a zero length packet to signal the end of transfer
+         * if the transfer size is aligned to a packet boundary.
+         */
+        if ((count & (dev->ep_in->maxpacket - 1)) == 0) {
+                sendZLP = 1;
+        }
+
+        while (count > 0 || sendZLP) {
+                /* so we exit after sending ZLP */
+                if (count == 0)
+                        sendZLP = 0;
+
+                if (dev->state != STATE_BUSY) {
+                        DBG(cdev, "mtp_write dev->error\n");
+                        r = -EIO;
+                        break;
+                }
+
+                /* get an idle tx request to use */
+                req = 0;
+                ret = wait_event_interruptible(dev->write_wq,
+                        ((req = mtp_req_get(dev, &dev->tx_idle))
+                                || dev->state != STATE_BUSY));
+                if (!req) {
+                        r = ret;
+                        break;
+                }
+
+                if (count > MTP_BULK_BUFFER_SIZE)
+                        xfer = MTP_BULK_BUFFER_SIZE;
+                else
+                        xfer = count;
+                if (xfer && copy_from_user(req->buf, buf, xfer)) {
+                        r = -EFAULT;
+                        break;
+                }
+
+                req->length = xfer;
+                ret = usb_ep_queue(dev->ep_in, req, GFP_KERNEL);
+                if (ret < 0) {
+                        DBG(cdev, "mtp_write: xfer error %d\n", ret);
+                        r = -EIO;
+                        break;
+                }
+
+                buf += xfer;
+                count -= xfer;
+
+                /* zero this so we don't try to free it on error exit */
+                req = 0;
+        }
+
+        if (req)
+                mtp_req_put(dev, &dev->tx_idle, req);
+
+        spin_lock_irq(&dev->lock);
+        if (dev->state == STATE_CANCELED)
+                r = -ECANCELED;
+        else if (dev->state != STATE_OFFLINE)
+                dev->state = STATE_READY;
+        spin_unlock_irq(&dev->lock);
+
+        DBG(cdev, "mtp_write returning %d\n", r);
+        return r;
+}
+
+/* read from a local file and write to USB */
+static void send_file_work(struct work_struct *data) {
+        struct mtp_dev  *dev = container_of(data, struct mtp_dev, send_file_work);
+        struct usb_composite_dev *cdev = dev->cdev;
+        struct usb_request *req = 0;
+        struct mtp_data_header *header;
+        struct file *filp;
+        loff_t offset;
+        int64_t count;
+        int xfer, ret, hdr_size;
+        int r = 0;
+        int sendZLP = 0;
+
+        /* read our parameters */
+        smp_rmb();
+        filp = dev->xfer_file;
+        offset = dev->xfer_file_offset;
+        count = dev->xfer_file_length;
+
+        DBG(cdev, "send_file_work(%lld %lld)\n", offset, count);
+
+        if (dev->xfer_send_header) {
+                hdr_size = sizeof(struct mtp_data_header);
+                count += hdr_size;
+        } else {
+                hdr_size = 0;
+        }
+
+        /* we need to send a zero length packet to signal the end of transfer
+         * if the transfer size is aligned to a packet boundary.
+         */
+        if ((count & (dev->ep_in->maxpacket - 1)) == 0) {
+                sendZLP = 1;
+        }
+
+        while (count > 0 || sendZLP) {
+                /* so we exit after sending ZLP */
+                if (count == 0)
+                        sendZLP = 0;
+
+                /* get an idle tx request to use */
+                req = 0;
+                ret = wait_event_interruptible(dev->write_wq,
+                        (req = mtp_req_get(dev, &dev->tx_idle))
+                        || dev->state != STATE_BUSY);
+                if (dev->state == STATE_CANCELED) {
+                        r = -ECANCELED;
+                        break;
+                }
+                if (!req) {
+                        r = ret;
+                        break;
+                }
+
+                if (count > MTP_BULK_BUFFER_SIZE)
+                        xfer = MTP_BULK_BUFFER_SIZE;
+                else
+                        xfer = count;
+
+                if (hdr_size) {
+                        /* prepend MTP data header */
+                        header = (struct mtp_data_header *)req->buf;
+                        header->length = __cpu_to_le32(count);
+                        header->type = __cpu_to_le16(2); /* data packet */
+                        header->command = __cpu_to_le16(dev->xfer_command);
+                        header->transaction_id = __cpu_to_le32(dev->xfer_transaction_id);
+                }
+
+                ret = vfs_read(filp, req->buf + hdr_size, xfer - hdr_size, &offset);
+                if (ret < 0) {
+                        r = ret;
+                        break;
+                }
+                xfer = ret + hdr_size;
+                hdr_size = 0;
+
+                req->length = xfer;
+                ret = usb_ep_queue(dev->ep_in, req, GFP_KERNEL);
+                if (ret < 0) {
+                        DBG(cdev, "send_file_work: xfer error %d\n", ret);
+                        dev->state = STATE_ERROR;
+                        r = -EIO;
+                        break;
+                }
+
+                count -= xfer;
+
+                /* zero this so we don't try to free it on error exit */
+                req = 0;
+        }
+
+        if (req)
+                mtp_req_put(dev, &dev->tx_idle, req);
+
+        DBG(cdev, "send_file_work returning %d\n", r);
+        /* write the result */
+        dev->xfer_result = r;
+        smp_wmb();
+}
+
+/* read from USB and write to a local file */
+static void receive_file_work(struct work_struct *data)
+{
+        struct mtp_dev  *dev = container_of(data, struct mtp_dev, receive_file_work);
+        struct usb_composite_dev *cdev = dev->cdev;
+        struct usb_request *read_req = NULL, *write_req = NULL;
+        struct file *filp;
+        loff_t offset;
+        int64_t count;
+        int ret, cur_buf = 0;
+        int r = 0;
+
+        /* read our parameters */
+        smp_rmb();
+        filp = dev->xfer_file;
+        offset = dev->xfer_file_offset;
+        count = dev->xfer_file_length;
+
+        DBG(cdev, "receive_file_work(%lld)\n", count);
+
+        while (count > 0 || write_req) {
+                if (count > 0) {
+                        /* queue a request */
+                        read_req = dev->rx_req[cur_buf];
+                        cur_buf = (cur_buf + 1) % RX_REQ_MAX;
+
+                        read_req->length = (count > MTP_BULK_BUFFER_SIZE
+                                        ? MTP_BULK_BUFFER_SIZE : count);
+                        dev->rx_done = 0;
+                        ret = usb_ep_queue(dev->ep_out, read_req, GFP_KERNEL);
+                        if (ret < 0) {
+                                r = -EIO;
+                                dev->state = STATE_ERROR;
+                                break;
+                        }
+                }
+
+                if (write_req) {
+                        DBG(cdev, "rx %p %d\n", write_req, write_req->actual);
+                        ret = vfs_write(filp, write_req->buf, write_req->actual,
+                                &offset);
+                        DBG(cdev, "vfs_write %d\n", ret);
+                        if (ret != write_req->actual) {
+                                r = -EIO;
+                                dev->state = STATE_ERROR;
+                                break;
+                        }
+                        write_req = NULL;
+                }
+
+                if (read_req) {
+                        /* wait for our last read to complete */
+                        ret = wait_event_interruptible(dev->read_wq,
+                                dev->rx_done || dev->state != STATE_BUSY);
+                        if (dev->state == STATE_CANCELED) {
+                                r = -ECANCELED;
+                                if (!dev->rx_done)
+                                        usb_ep_dequeue(dev->ep_out, read_req);
+                                break;
+                        }
+                        /* if xfer_file_length is 0xFFFFFFFF, then we read until
+                         * we get a zero length packet
+                         */
+                        if (count != 0xFFFFFFFF)
+                                count -= read_req->actual;
+                        if (read_req->actual < read_req->length) {
+                                /* short packet is used to signal EOF for sizes > 4 gig */
+                                DBG(cdev, "got short packet\n");
+                                count = 0;
+                        }
+
+                        write_req = read_req;
+                        read_req = NULL;
+                }
+        }
+
+        DBG(cdev, "receive_file_work returning %d\n", r);
+        /* write the result */
+        dev->xfer_result = r;
+        smp_wmb();
+}
+
+static int mtp_send_event(struct mtp_dev *dev, struct mtp_event *event)
+{
+        struct usb_request *req= NULL;
+        int ret;
+        int length = event->length;
+
+        DBG(dev->cdev, "mtp_send_event(%d)\n", event->length);
+
+        if (length < 0 || length > INTR_BUFFER_SIZE)
+                return -EINVAL;
+        if (dev->state == STATE_OFFLINE)
+                return -ENODEV;
+
+        ret = wait_event_interruptible_timeout(dev->intr_wq,
+                (req = mtp_req_get(dev, &dev->intr_idle)), msecs_to_jiffies(1000));
+        if (!req)
+            return -ETIME;
+
+        if (copy_from_user(req->buf, (void __user *)event->data, length)) {
+                mtp_req_put(dev, &dev->intr_idle, req);
+                return -EFAULT;
+        }
+        req->length = length;
+        ret = usb_ep_queue(dev->ep_intr, req, GFP_KERNEL);
+        if (ret)
+                mtp_req_put(dev, &dev->intr_idle, req);
+
+        return ret;
+}
+
+static long mtp_ioctl(struct file *fp, unsigned code, unsigned long value)
+{
+        struct mtp_dev *dev = fp->private_data;
+        struct file *filp = NULL;
+        int ret = -EINVAL;
+
+        if (mtp_lock(&dev->ioctl_excl))
+                return -EBUSY;
+
+        switch (code) {
+        case MTP_SEND_FILE:
+        case MTP_RECEIVE_FILE:
+        case MTP_SEND_FILE_WITH_HEADER:
+        {
+                struct mtp_file_range   mfr;
+                struct work_struct *work;
+
+                spin_lock_irq(&dev->lock);
+                if (dev->state == STATE_CANCELED) {
+                        /* report cancelation to userspace */
+                        dev->state = STATE_READY;
+                        spin_unlock_irq(&dev->lock);
+                        ret = -ECANCELED;
+                        goto out;
+                }
+                if (dev->state == STATE_OFFLINE) {
+                        spin_unlock_irq(&dev->lock);
+                        ret = -ENODEV;
+                        goto out;
+                }
+                dev->state = STATE_BUSY;
+                spin_unlock_irq(&dev->lock);
+
+                if (copy_from_user(&mfr, (void __user *)value, sizeof(mfr))) {
+                        ret = -EFAULT;
+                        goto fail;
+                }
+                /* hold a reference to the file while we are working with it */
+                filp = fget(mfr.fd);
+                if (!filp) {
+                        ret = -EBADF;
+                        goto fail;
+                }
+
+                /* write the parameters */
+                dev->xfer_file = filp;
+                dev->xfer_file_offset = mfr.offset;
+                dev->xfer_file_length = mfr.length;
+                smp_wmb();
+
+                if (code == MTP_SEND_FILE_WITH_HEADER) {
+                        work = &dev->send_file_work;
+                        dev->xfer_send_header = 1;
+                        dev->xfer_command = mfr.command;
+                        dev->xfer_transaction_id = mfr.transaction_id;
+                } else if (code == MTP_SEND_FILE) {
+                        work = &dev->send_file_work;
+                        dev->xfer_send_header = 0;
+                } else {
+                        work = &dev->receive_file_work;
+                }
+
+                /* We do the file transfer on a work queue so it will run
+                 * in kernel context, which is necessary for vfs_read and
+                 * vfs_write to use our buffers in the kernel address space.
+                 */
+                queue_work(dev->wq, work);
+                /* wait for operation to complete */
+                flush_workqueue(dev->wq);
+                fput(filp);
+
+                /* read the result */
+                smp_rmb();
+                ret = dev->xfer_result;
+                break;
+        }
+        case MTP_SEND_EVENT:
+        {
+                struct mtp_event        event;
+                /* return here so we don't change dev->state below,
+                 * which would interfere with bulk transfer state.
+                 */
+                if (copy_from_user(&event, (void __user *)value, sizeof(event)))
+                        ret = -EFAULT;
+                else
+                        ret = mtp_send_event(dev, &event);
+                goto out;
+        }
+        }
+
+fail:
+        spin_lock_irq(&dev->lock);
+        if (dev->state == STATE_CANCELED)
+                ret = -ECANCELED;
+        else if (dev->state != STATE_OFFLINE)
+                dev->state = STATE_READY;
+        spin_unlock_irq(&dev->lock);
+out:
+        mtp_unlock(&dev->ioctl_excl);
+        DBG(dev->cdev, "ioctl returning %d\n", ret);
+        return ret;
+}
+
+static int mtp_open(struct inode *ip, struct file *fp)
+{
+        printk(KERN_INFO "mtp_open\n");
+        if (mtp_lock(&_mtp_dev->open_excl))
+                return -EBUSY;
+
+        /* clear any error condition */
+        if (_mtp_dev->state != STATE_OFFLINE)
+                _mtp_dev->state = STATE_READY;
+
+        fp->private_data = _mtp_dev;
+        return 0;
+}
+
+static int mtp_release(struct inode *ip, struct file *fp)
+{
+        printk(KERN_INFO "mtp_release\n");
+
+        mtp_unlock(&_mtp_dev->open_excl);
+        return 0;
+}
+
+/* file operations for /dev/mtp_usb */
+static const struct file_operations mtp_fops = {
+        .owner = THIS_MODULE,
+        .read = mtp_read,
+        .write = mtp_write,
+        .unlocked_ioctl = mtp_ioctl,
+        .open = mtp_open,
+        .release = mtp_release,
+};
+
+static struct miscdevice mtp_device = {
+        .minor = MISC_DYNAMIC_MINOR,
+        .name = mtp_shortname,
+        .fops = &mtp_fops,
+};
+
+static int mtp_ctrlrequest(struct usb_composite_dev *cdev,
+                                const struct usb_ctrlrequest *ctrl)
+{
+        struct mtp_dev *dev = _mtp_dev;
+        int     value = -EOPNOTSUPP;
+        u16     w_index = le16_to_cpu(ctrl->wIndex);
+        u16     w_value = le16_to_cpu(ctrl->wValue);
+        u16     w_length = le16_to_cpu(ctrl->wLength);
+        unsigned long   flags;
+
+        VDBG(cdev, "mtp_ctrlrequest "
+                        "%02x.%02x v%04x i%04x l%u\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, w_length);
+
+        /* Handle MTP OS string */
+        if (ctrl->bRequestType ==
+                        (USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_DEVICE)
+                        && ctrl->bRequest == USB_REQ_GET_DESCRIPTOR
+                        && (w_value >> 8) == USB_DT_STRING
+                        && (w_value & 0xFF) == MTP_OS_STRING_ID) {
+                value = (w_length < sizeof(mtp_os_string)
+                                ? w_length : sizeof(mtp_os_string));
+                memcpy(cdev->req->buf, mtp_os_string, value);
+        } else if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_VENDOR) {
+                /* Handle MTP OS descriptor */
+                DBG(cdev, "vendor request: %d index: %d value: %d length: %d\n",
+                        ctrl->bRequest, w_index, w_value, w_length);
+
+                if (ctrl->bRequest == 1
+                                && (ctrl->bRequestType & USB_DIR_IN)
+                                && (w_index == 4 || w_index == 5)) {
+                        value = (w_length < sizeof(mtp_ext_config_desc) ?
+                                        w_length : sizeof(mtp_ext_config_desc));
+                        memcpy(cdev->req->buf, &mtp_ext_config_desc, value);
+                }
+        } else if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS) {
+                DBG(cdev, "class request: %d index: %d value: %d length: %d\n",
+                        ctrl->bRequest, w_index, w_value, w_length);
+
+                if (ctrl->bRequest == MTP_REQ_CANCEL && w_index == 0
+                                && w_value == 0) {
+                        DBG(cdev, "MTP_REQ_CANCEL\n");
+
+                        spin_lock_irqsave(&dev->lock, flags);
+                        if (dev->state == STATE_BUSY) {
+                                dev->state = STATE_CANCELED;
+                                wake_up(&dev->read_wq);
+                                wake_up(&dev->write_wq);
+                        }
+                        spin_unlock_irqrestore(&dev->lock, flags);
+
+                        /* We need to queue a request to read the remaining
+                         *  bytes, but we don't actually need to look at
+                         * the contents.
+                         */
+                        value = w_length;
+                } else if (ctrl->bRequest == MTP_REQ_GET_DEVICE_STATUS
+                                && w_index == 0 && w_value == 0) {
+                        struct mtp_device_status *status = cdev->req->buf;
+                        status->wLength =
+                                __constant_cpu_to_le16(sizeof(*status));
+
+                        DBG(cdev, "MTP_REQ_GET_DEVICE_STATUS\n");
+                        spin_lock_irqsave(&dev->lock, flags);
+                        /* device status is "busy" until we report
+                         * the cancelation to userspace
+                         */
+                        if (dev->state == STATE_CANCELED)
+                                status->wCode =
+                                        __cpu_to_le16(MTP_RESPONSE_DEVICE_BUSY);
+                        else
+                                status->wCode =
+                                        __cpu_to_le16(MTP_RESPONSE_OK);
+                        spin_unlock_irqrestore(&dev->lock, flags);
+                        value = sizeof(*status);
+                }
+        }
+
+        /* respond with data transfer or status phase? */
+        if (value >= 0) {
+                int rc;
+                cdev->req->zero = value < w_length;
+                cdev->req->length = value;
+                rc = usb_ep_queue(cdev->gadget->ep0, cdev->req, GFP_ATOMIC);
+                if (rc < 0)
+                        ERROR(cdev, "%s setup response queue error\n", __func__);
+        }
+        return value;
+}
+
+static int
+mtp_function_bind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct usb_composite_dev *cdev = c->cdev;
+        struct mtp_dev  *dev = func_to_mtp(f);
+        int                     id;
+        int                     ret;
+
+        dev->cdev = cdev;
+        DBG(cdev, "mtp_function_bind dev: %p\n", dev);
+
+        /* allocate interface ID(s) */
+        id = usb_interface_id(c, f);
+        if (id < 0)
+                return id;
+        mtp_interface_desc.bInterfaceNumber = id;
+
+        /* allocate endpoints */
+        ret = mtp_create_bulk_endpoints(dev, &mtp_fullspeed_in_desc,
+                        &mtp_fullspeed_out_desc, &mtp_intr_desc);
+        if (ret)
+                return ret;
+
+        /* support high speed hardware */
+        if (gadget_is_dualspeed(c->cdev->gadget)) {
+                mtp_highspeed_in_desc.bEndpointAddress =
+                        mtp_fullspeed_in_desc.bEndpointAddress;
+                mtp_highspeed_out_desc.bEndpointAddress =
+                        mtp_fullspeed_out_desc.bEndpointAddress;
+        }
+
+        DBG(cdev, "%s speed %s: IN/%s, OUT/%s\n",
+                        gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
+                        f->name, dev->ep_in->name, dev->ep_out->name);
+        return 0;
+}
+
+static void
+mtp_function_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct mtp_dev  *dev = func_to_mtp(f);
+        struct usb_request *req;
+        int i;
+
+        while ((req = mtp_req_get(dev, &dev->tx_idle)))
+                mtp_request_free(req, dev->ep_in);
+        for (i = 0; i < RX_REQ_MAX; i++)
+                mtp_request_free(dev->rx_req[i], dev->ep_out);
+        while ((req = mtp_req_get(dev, &dev->intr_idle)))
+                mtp_request_free(req, dev->ep_intr);
+        dev->state = STATE_OFFLINE;
+}
+
+static int mtp_function_set_alt(struct usb_function *f,
+                unsigned intf, unsigned alt)
+{
+        struct mtp_dev  *dev = func_to_mtp(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+        int ret;
+
+        DBG(cdev, "mtp_function_set_alt intf: %d alt: %d\n", intf, alt);
+        config_ep_by_speed(cdev->gadget, f, dev->ep_in);
+        ret = usb_ep_enable(dev->ep_in);
+        if (ret)
+                return ret;
+        config_ep_by_speed(cdev->gadget, f, dev->ep_out);
+        ret = usb_ep_enable(dev->ep_out);
+        if (ret) {
+                usb_ep_disable(dev->ep_in);
+                return ret;
+        }
+        dev->ep_intr->desc = &mtp_intr_desc;
+        ret = usb_ep_enable(dev->ep_intr);
+        if (ret) {
+                usb_ep_disable(dev->ep_out);
+                usb_ep_disable(dev->ep_in);
+                return ret;
+        }
+        dev->state = STATE_READY;
+
+        /* readers may be blocked waiting for us to go online */
+        wake_up(&dev->read_wq);
+        return 0;
+}
+
+static void mtp_function_disable(struct usb_function *f)
+{
+        struct mtp_dev  *dev = func_to_mtp(f);
+        struct usb_composite_dev        *cdev = dev->cdev;
+
+        DBG(cdev, "mtp_function_disable\n");
+        dev->state = STATE_OFFLINE;
+        usb_ep_disable(dev->ep_in);
+        usb_ep_disable(dev->ep_out);
+        usb_ep_disable(dev->ep_intr);
+
+        /* readers may be blocked waiting for us to go online */
+        wake_up(&dev->read_wq);
+
+        VDBG(cdev, "%s disabled\n", dev->function.name);
+}
+
+static int mtp_bind_config(struct usb_configuration *c, bool ptp_config)
+{
+        struct mtp_dev *dev = _mtp_dev;
+        int ret = 0;
+
+        printk(KERN_INFO "mtp_bind_config\n");
+
+        /* allocate a string ID for our interface */
+        if (mtp_string_defs[INTERFACE_STRING_INDEX].id == 0) {
+                ret = usb_string_id(c->cdev);
+                if (ret < 0)
+                        return ret;
+                mtp_string_defs[INTERFACE_STRING_INDEX].id = ret;
+                mtp_interface_desc.iInterface = ret;
+        }
+
+        dev->cdev = c->cdev;
+        dev->function.name = "mtp";
+        dev->function.strings = mtp_strings;
+        if (ptp_config) {
+                dev->function.descriptors = fs_ptp_descs;
+                dev->function.hs_descriptors = hs_ptp_descs;
+        } else {
+                dev->function.descriptors = fs_mtp_descs;
+                dev->function.hs_descriptors = hs_mtp_descs;
+        }
+        dev->function.bind = mtp_function_bind;
+        dev->function.unbind = mtp_function_unbind;
+        dev->function.set_alt = mtp_function_set_alt;
+        dev->function.disable = mtp_function_disable;
+
+        return usb_add_function(c, &dev->function);
+}
+
+static int mtp_setup(void)
+{
+        struct mtp_dev *dev;
+        int ret;
+
+        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+        if (!dev)
+                return -ENOMEM;
+
+        spin_lock_init(&dev->lock);
+        init_waitqueue_head(&dev->read_wq);
+        init_waitqueue_head(&dev->write_wq);
+        init_waitqueue_head(&dev->intr_wq);
+        atomic_set(&dev->open_excl, 0);
+        atomic_set(&dev->ioctl_excl, 0);
+        INIT_LIST_HEAD(&dev->tx_idle);
+        INIT_LIST_HEAD(&dev->intr_idle);
+
+        dev->wq = create_singlethread_workqueue("f_mtp");
+        if (!dev->wq) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+        INIT_WORK(&dev->send_file_work, send_file_work);
+        INIT_WORK(&dev->receive_file_work, receive_file_work);
+
+        _mtp_dev = dev;
+
+        ret = misc_register(&mtp_device);
+        if (ret)
+                goto err2;
+
+        return 0;
+
+err2:
+        destroy_workqueue(dev->wq);
+err1:
+        _mtp_dev = NULL;
+        kfree(dev);
+        printk(KERN_ERR "mtp gadget driver failed to initialize\n");
+        return ret;
+}
+
+static void mtp_cleanup(void)
+{
+        struct mtp_dev *dev = _mtp_dev;
+
+        if (!dev)
+                return;
+
+        misc_deregister(&mtp_device);
+        destroy_workqueue(dev->wq);
+        _mtp_dev = NULL;
+        kfree(dev);
+}
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
new file mode 100644
index 00000000000..639e14a2fd1
--- /dev/null
+++ b/drivers/usb/gadget/file_storage.c
@@ -0,0 +1,3631 @@
+/*
+ * file_storage.c -- File-backed USB Storage Gadget, for USB development
+ *
+ * Copyright (C) 2003-2008 Alan Stern
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+/*
+ * The File-backed Storage Gadget acts as a USB Mass Storage device,
+ * appearing to the host as a disk drive or as a CD-ROM drive.  In addition
+ * to providing an example of a genuinely useful gadget driver for a USB
+ * device, it also illustrates a technique of double-buffering for increased
+ * throughput.  Last but not least, it gives an easy way to probe the
+ * behavior of the Mass Storage drivers in a USB host.
+ *
+ * Backing storage is provided by a regular file or a block device, specified
+ * by the "file" module parameter.  Access can be limited to read-only by
+ * setting the optional "ro" module parameter.  (For CD-ROM emulation,
+ * access is always read-only.)  The gadget will indicate that it has
+ * removable media if the optional "removable" module parameter is set.
+ *
+ * The gadget supports the Control-Bulk (CB), Control-Bulk-Interrupt (CBI),
+ * and Bulk-Only (also known as Bulk-Bulk-Bulk or BBB) transports, selected
+ * by the optional "transport" module parameter.  It also supports the
+ * following protocols: RBC (0x01), ATAPI or SFF-8020i (0x02), QIC-157 (0c03),
+ * UFI (0x04), SFF-8070i (0x05), and transparent SCSI (0x06), selected by
+ * the optional "protocol" module parameter.  In addition, the default
+ * Vendor ID, Product ID, release number and serial number can be overridden.
+ *
+ * There is support for multiple logical units (LUNs), each of which has
+ * its own backing file.  The number of LUNs can be set using the optional
+ * "luns" module parameter (anywhere from 1 to 8), and the corresponding
+ * files are specified using comma-separated lists for "file" and "ro".
+ * The default number of LUNs is taken from the number of "file" elements;
+ * it is 1 if "file" is not given.  If "removable" is not set then a backing
+ * file must be specified for each LUN.  If it is set, then an unspecified
+ * or empty backing filename means the LUN's medium is not loaded.  Ideally
+ * each LUN would be settable independently as a disk drive or a CD-ROM
+ * drive, but currently all LUNs have to be the same type.  The CD-ROM
+ * emulation includes a single data track and no audio tracks; hence there
+ * need be only one backing file per LUN.  Note also that the CD-ROM block
+ * length is set to 512 rather than the more common value 2048.
+ *
+ * Requirements are modest; only a bulk-in and a bulk-out endpoint are
+ * needed (an interrupt-out endpoint is also needed for CBI).  The memory
+ * requirement amounts to two 16K buffers, size configurable by a parameter.
+ * Support is included for both full-speed and high-speed operation.
+ *
+ * Note that the driver is slightly non-portable in that it assumes a
+ * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
+ * interrupt-in endpoints.  With most device controllers this isn't an
+ * issue, but there may be some with hardware restrictions that prevent
+ * a buffer from being used by more than one endpoint.
+ *
+ * Module options:
+ *
+ *      file=filename[,filename...]
+ *                              Required if "removable" is not set, names of
+ *                                      the files or block devices used for
+ *                                      backing storage
+ *      serial=HHHH...          Required serial number (string of hex chars)
+ *      ro=b[,b...]             Default false, booleans for read-only access
+ *      removable               Default false, boolean for removable media
+ *      luns=N                  Default N = number of filenames, number of
+ *                                      LUNs to support
+ *      nofua=b[,b...]          Default false, booleans for ignore FUA flag
+ *                                      in SCSI WRITE(10,12) commands
+ *      stall                   Default determined according to the type of
+ *                                      USB device controller (usually true),
+ *                                      boolean to permit the driver to halt
+ *                                      bulk endpoints
+ *      cdrom                   Default false, boolean for whether to emulate
+ *                                      a CD-ROM drive
+ *      transport=XXX           Default BBB, transport name (CB, CBI, or BBB)
+ *      protocol=YYY            Default SCSI, protocol name (RBC, 8020 or
+ *                                      ATAPI, QIC, UFI, 8070, or SCSI;
+ *                                      also 1 - 6)
+ *      vendor=0xVVVV           Default 0x0525 (NetChip), USB Vendor ID
+ *      product=0xPPPP          Default 0xa4a5 (FSG), USB Product ID
+ *      release=0xRRRR          Override the USB release number (bcdDevice)
+ *      buflen=N                Default N=16384, buffer size used (will be
+ *                                      rounded down to a multiple of
+ *                                      PAGE_CACHE_SIZE)
+ *
+ * If CONFIG_USB_FILE_STORAGE_TEST is not set, only the "file", "serial", "ro",
+ * "removable", "luns", "nofua", "stall", and "cdrom" options are available;
+ * default values are used for everything else.
+ *
+ * The pathnames of the backing files and the ro settings are available in
+ * the attribute files "file", "nofua", and "ro" in the lun<n> subdirectory of
+ * the gadget's sysfs directory.  If the "removable" option is set, writing to
+ * these files will simulate ejecting/loading the medium (writing an empty
+ * line means eject) and adjusting a write-enable tab.  Changes to the ro
+ * setting are not allowed when the medium is loaded or if CD-ROM emulation
+ * is being used.
+ *
+ * This gadget driver is heavily based on "Gadget Zero" by David Brownell.
+ * The driver's SCSI command interface was based on the "Information
+ * technology - Small Computer System Interface - 2" document from
+ * X3T9.2 Project 375D, Revision 10L, 7-SEP-93, available at
+ * <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>.  The single exception
+ * is opcode 0x23 (READ FORMAT CAPACITIES), which was based on the
+ * "Universal Serial Bus Mass Storage Class UFI Command Specification"
+ * document, Revision 1.0, December 14, 1998, available at
+ * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
+ */
+
+
+/*
+ *                              Driver Design
+ *
+ * The FSG driver is fairly straightforward.  There is a main kernel
+ * thread that handles most of the work.  Interrupt routines field
+ * callbacks from the controller driver: bulk- and interrupt-request
+ * completion notifications, endpoint-0 events, and disconnect events.
+ * Completion events are passed to the main thread by wakeup calls.  Many
+ * ep0 requests are handled at interrupt time, but SetInterface,
+ * SetConfiguration, and device reset requests are forwarded to the
+ * thread in the form of "exceptions" using SIGUSR1 signals (since they
+ * should interrupt any ongoing file I/O operations).
+ *
+ * The thread's main routine implements the standard command/data/status
+ * parts of a SCSI interaction.  It and its subroutines are full of tests
+ * for pending signals/exceptions -- all this polling is necessary since
+ * the kernel has no setjmp/longjmp equivalents.  (Maybe this is an
+ * indication that the driver really wants to be running in userspace.)
+ * An important point is that so long as the thread is alive it keeps an
+ * open reference to the backing file.  This will prevent unmounting
+ * the backing file's underlying filesystem and could cause problems
+ * during system shutdown, for example.  To prevent such problems, the
+ * thread catches INT, TERM, and KILL signals and converts them into
+ * an EXIT exception.
+ *
+ * In normal operation the main thread is started during the gadget's
+ * fsg_bind() callback and stopped during fsg_unbind().  But it can also
+ * exit when it receives a signal, and there's no point leaving the
+ * gadget running when the thread is dead.  So just before the thread
+ * exits, it deregisters the gadget driver.  This makes things a little
+ * tricky: The driver is deregistered at two places, and the exiting
+ * thread can indirectly call fsg_unbind() which in turn can tell the
+ * thread to exit.  The first problem is resolved through the use of the
+ * REGISTERED atomic bitflag; the driver will only be deregistered once.
+ * The second problem is resolved by having fsg_unbind() check
+ * fsg->state; it won't try to stop the thread if the state is already
+ * FSG_STATE_TERMINATED.
+ *
+ * To provide maximum throughput, the driver uses a circular pipeline of
+ * buffer heads (struct fsg_buffhd).  In principle the pipeline can be
+ * arbitrarily long; in practice the benefits don't justify having more
+ * than 2 stages (i.e., double buffering).  But it helps to think of the
+ * pipeline as being a long one.  Each buffer head contains a bulk-in and
+ * a bulk-out request pointer (since the buffer can be used for both
+ * output and input -- directions always are given from the host's
+ * point of view) as well as a pointer to the buffer and various state
+ * variables.
+ *
+ * Use of the pipeline follows a simple protocol.  There is a variable
+ * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
+ * At any time that buffer head may still be in use from an earlier
+ * request, so each buffer head has a state variable indicating whether
+ * it is EMPTY, FULL, or BUSY.  Typical use involves waiting for the
+ * buffer head to be EMPTY, filling the buffer either by file I/O or by
+ * USB I/O (during which the buffer head is BUSY), and marking the buffer
+ * head FULL when the I/O is complete.  Then the buffer will be emptied
+ * (again possibly by USB I/O, during which it is marked BUSY) and
+ * finally marked EMPTY again (possibly by a completion routine).
+ *
+ * A module parameter tells the driver to avoid stalling the bulk
+ * endpoints wherever the transport specification allows.  This is
+ * necessary for some UDCs like the SuperH, which cannot reliably clear a
+ * halt on a bulk endpoint.  However, under certain circumstances the
+ * Bulk-only specification requires a stall.  In such cases the driver
+ * will halt the endpoint and set a flag indicating that it should clear
+ * the halt in software during the next device reset.  Hopefully this
+ * will permit everything to work correctly.  Furthermore, although the
+ * specification allows the bulk-out endpoint to halt when the host sends
+ * too much data, implementing this would cause an unavoidable race.
+ * The driver will always use the "no-stall" approach for OUT transfers.
+ *
+ * One subtle point concerns sending status-stage responses for ep0
+ * requests.  Some of these requests, such as device reset, can involve
+ * interrupting an ongoing file I/O operation, which might take an
+ * arbitrarily long time.  During that delay the host might give up on
+ * the original ep0 request and issue a new one.  When that happens the
+ * driver should not notify the host about completion of the original
+ * request, as the host will no longer be waiting for it.  So the driver
+ * assigns to each ep0 request a unique tag, and it keeps track of the
+ * tag value of the request associated with a long-running exception
+ * (device-reset, interface-change, or configuration-change).  When the
+ * exception handler is finished, the status-stage response is submitted
+ * only if the current ep0 request tag is equal to the exception request
+ * tag.  Thus only the most recently received ep0 request will get a
+ * status-stage response.
+ *
+ * Warning: This driver source file is too long.  It ought to be split up
+ * into a header file plus about 3 separate .c files, to handle the details
+ * of the Gadget, USB Mass Storage, and SCSI protocols.
+ */
+
+
+/* #define VERBOSE_DEBUG */
+/* #define DUMP_MSGS */
+
+
+#include <linux/blkdev.h>
+#include <linux/completion.h>
+#include <linux/dcache.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/fcntl.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/kref.h>
+#include <linux/kthread.h>
+#include <linux/limits.h>
+#include <linux/rwsem.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/string.h>
+#include <linux/freezer.h>
+#include <linux/utsname.h>
+
+#include <linux/usb/ch9.h>
+#include <linux/usb/gadget.h>
+
+#include "gadget_chips.h"
+
+
+
+/*
+ * Kbuild is not very cooperative with respect to linking separately
+ * compiled library objects into one module.  So for now we won't use
+ * separate compilation ... ensuring init/exit sections work to shrink
+ * the runtime footprint, and giving us at least some parts of what
+ * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
+ */
+#include "usbstring.c"
+#include "config.c"
+#include "epautoconf.c"
+
+/*-------------------------------------------------------------------------*/
+
+#define DRIVER_DESC             "File-backed Storage Gadget"
+#define DRIVER_NAME             "g_file_storage"
+#define DRIVER_VERSION          "1 September 2010"
+
+static       char fsg_string_manufacturer[64];
+static const char fsg_string_product[] = DRIVER_DESC;
+static const char fsg_string_config[] = "Self-powered";
+static const char fsg_string_interface[] = "Mass Storage";
+
+
+#include "storage_common.c"
+
+
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_AUTHOR("Alan Stern");
+MODULE_LICENSE("Dual BSD/GPL");
+
+/*
+ * This driver assumes self-powered hardware and has no way for users to
+ * trigger remote wakeup.  It uses autoconfiguration to select endpoints
+ * and endpoint addresses.
+ */
+
+
+/*-------------------------------------------------------------------------*/
+
+
+/* Encapsulate the module parameter settings */
+
+static struct {
+        char            *file[FSG_MAX_LUNS];
+        char            *serial;
+        int             ro[FSG_MAX_LUNS];
+        int             nofua[FSG_MAX_LUNS];
+        unsigned int    num_filenames;
+        unsigned int    num_ros;
+        unsigned int    num_nofuas;
+        unsigned int    nluns;
+
+        int             removable;
+        int             can_stall;
+        int             cdrom;
+
+        char            *transport_parm;
+        char            *protocol_parm;
+        unsigned short  vendor;
+        unsigned short  product;
+        unsigned short  release;
+        unsigned int    buflen;
+
+        int             transport_type;
+        char            *transport_name;
+        int             protocol_type;
+        char            *protocol_name;
+
+} mod_data = {                                  // Default values
+        .transport_parm         = "BBB",
+        .protocol_parm          = "SCSI",
+        .removable              = 0,
+        .can_stall              = 1,
+        .cdrom                  = 0,
+        .vendor                 = FSG_VENDOR_ID,
+        .product                = FSG_PRODUCT_ID,
+        .release                = 0xffff,       // Use controller chip type
+        .buflen                 = 16384,
+        };
+
+
+module_param_array_named(file, mod_data.file, charp, &mod_data.num_filenames,
+                S_IRUGO);
+MODULE_PARM_DESC(file, "names of backing files or devices");
+
+module_param_named(serial, mod_data.serial, charp, S_IRUGO);
+MODULE_PARM_DESC(serial, "USB serial number");
+
+module_param_array_named(ro, mod_data.ro, bool, &mod_data.num_ros, S_IRUGO);
+MODULE_PARM_DESC(ro, "true to force read-only");
+
+module_param_array_named(nofua, mod_data.nofua, bool, &mod_data.num_nofuas,
+                S_IRUGO);
+MODULE_PARM_DESC(nofua, "true to ignore SCSI WRITE(10,12) FUA bit");
+
+module_param_named(luns, mod_data.nluns, uint, S_IRUGO);
+MODULE_PARM_DESC(luns, "number of LUNs");
+
+module_param_named(removable, mod_data.removable, bool, S_IRUGO);
+MODULE_PARM_DESC(removable, "true to simulate removable media");
+
+module_param_named(stall, mod_data.can_stall, bool, S_IRUGO);
+MODULE_PARM_DESC(stall, "false to prevent bulk stalls");
+
+module_param_named(cdrom, mod_data.cdrom, bool, S_IRUGO);
+MODULE_PARM_DESC(cdrom, "true to emulate cdrom instead of disk");
+
+/* In the non-TEST version, only the module parameters listed above
+ * are available. */
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+
+module_param_named(transport, mod_data.transport_parm, charp, S_IRUGO);
+MODULE_PARM_DESC(transport, "type of transport (BBB, CBI, or CB)");
+
+module_param_named(protocol, mod_data.protocol_parm, charp, S_IRUGO);
+MODULE_PARM_DESC(protocol, "type of protocol (RBC, 8020, QIC, UFI, "
+                "8070, or SCSI)");
+
+module_param_named(vendor, mod_data.vendor, ushort, S_IRUGO);
+MODULE_PARM_DESC(vendor, "USB Vendor ID");
+
+module_param_named(product, mod_data.product, ushort, S_IRUGO);
+MODULE_PARM_DESC(product, "USB Product ID");
+
+module_param_named(release, mod_data.release, ushort, S_IRUGO);
+MODULE_PARM_DESC(release, "USB release number");
+
+module_param_named(buflen, mod_data.buflen, uint, S_IRUGO);
+MODULE_PARM_DESC(buflen, "I/O buffer size");
+
+#endif /* CONFIG_USB_FILE_STORAGE_TEST */
+
+
+/*
+ * These definitions will permit the compiler to avoid generating code for
+ * parts of the driver that aren't used in the non-TEST version.  Even gcc
+ * can recognize when a test of a constant expression yields a dead code
+ * path.
+ */
+
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+
+#define transport_is_bbb()      (mod_data.transport_type == USB_PR_BULK)
+#define transport_is_cbi()      (mod_data.transport_type == USB_PR_CBI)
+#define protocol_is_scsi()      (mod_data.protocol_type == USB_SC_SCSI)
+
+#else
+
+#define transport_is_bbb()      1
+#define transport_is_cbi()      0
+#define protocol_is_scsi()      1
+
+#endif /* CONFIG_USB_FILE_STORAGE_TEST */
+
+
+/*-------------------------------------------------------------------------*/
+
+
+struct fsg_dev {
+        /* lock protects: state, all the req_busy's, and cbbuf_cmnd */
+        spinlock_t              lock;
+        struct usb_gadget       *gadget;
+
+        /* filesem protects: backing files in use */
+        struct rw_semaphore     filesem;
+
+        /* reference counting: wait until all LUNs are released */
+        struct kref             ref;
+
+        struct usb_ep           *ep0;           // Handy copy of gadget->ep0
+        struct usb_request      *ep0req;        // For control responses
+        unsigned int            ep0_req_tag;
+        const char              *ep0req_name;
+
+        struct usb_request      *intreq;        // For interrupt responses
+        int                     intreq_busy;
+        struct fsg_buffhd       *intr_buffhd;
+
+        unsigned int            bulk_out_maxpacket;
+        enum fsg_state          state;          // For exception handling
+        unsigned int            exception_req_tag;
+
+        u8                      config, new_config;
+
+        unsigned int            running : 1;
+        unsigned int            bulk_in_enabled : 1;
+        unsigned int            bulk_out_enabled : 1;
+        unsigned int            intr_in_enabled : 1;
+        unsigned int            phase_error : 1;
+        unsigned int            short_packet_received : 1;
+        unsigned int            bad_lun_okay : 1;
+
+        unsigned long           atomic_bitflags;
+#define REGISTERED              0
+#define IGNORE_BULK_OUT         1
+#define SUSPENDED               2
+
+        struct usb_ep           *bulk_in;
+        struct usb_ep           *bulk_out;
+        struct usb_ep           *intr_in;
+
+        struct fsg_buffhd       *next_buffhd_to_fill;
+        struct fsg_buffhd       *next_buffhd_to_drain;
+        struct fsg_buffhd       buffhds[FSG_NUM_BUFFERS];
+
+        int                     thread_wakeup_needed;
+        struct completion       thread_notifier;
+        struct task_struct      *thread_task;
+
+        int                     cmnd_size;
+        u8                      cmnd[MAX_COMMAND_SIZE];
+        enum data_direction     data_dir;
+        u32                     data_size;
+        u32                     data_size_from_cmnd;
+        u32                     tag;
+        unsigned int            lun;
+        u32                     residue;
+        u32                     usb_amount_left;
+
+        /* The CB protocol offers no way for a host to know when a command
+         * has completed.  As a result the next command may arrive early,
+         * and we will still have to handle it.  For that reason we need
+         * a buffer to store new commands when using CB (or CBI, which
+         * does not oblige a host to wait for command completion either). */
+        int                     cbbuf_cmnd_size;
+        u8                      cbbuf_cmnd[MAX_COMMAND_SIZE];
+
+        unsigned int            nluns;
+        struct fsg_lun          *luns;
+        struct fsg_lun          *curlun;
+};
+
+typedef void (*fsg_routine_t)(struct fsg_dev *);
+
+static int exception_in_progress(struct fsg_dev *fsg)
+{
+        return (fsg->state > FSG_STATE_IDLE);
+}
+
+/* Make bulk-out requests be divisible by the maxpacket size */
+static void set_bulk_out_req_length(struct fsg_dev *fsg,
+                struct fsg_buffhd *bh, unsigned int length)
+{
+        unsigned int    rem;
+
+        bh->bulk_out_intended_length = length;
+        rem = length % fsg->bulk_out_maxpacket;
+        if (rem > 0)
+                length += fsg->bulk_out_maxpacket - rem;
+        bh->outreq->length = length;
+}
+
+static struct fsg_dev                   *the_fsg;
+static struct usb_gadget_driver         fsg_driver;
+
+
+/*-------------------------------------------------------------------------*/
+
+static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
+{
+        const char      *name;
+
+        if (ep == fsg->bulk_in)
+                name = "bulk-in";
+        else if (ep == fsg->bulk_out)
+                name = "bulk-out";
+        else
+                name = ep->name;
+        DBG(fsg, "%s set halt\n", name);
+        return usb_ep_set_halt(ep);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * DESCRIPTORS ... most are static, but strings and (full) configuration
+ * descriptors are built on demand.  Also the (static) config and interface
+ * descriptors are adjusted during fsg_bind().
+ */
+
+/* There is only one configuration. */
+#define CONFIG_VALUE            1
+
+static struct usb_device_descriptor
+device_desc = {
+        .bLength =              sizeof device_desc,
+        .bDescriptorType =      USB_DT_DEVICE,
+
+        .bcdUSB =               cpu_to_le16(0x0200),
+        .bDeviceClass =         USB_CLASS_PER_INTERFACE,
+
+        /* The next three values can be overridden by module parameters */
+        .idVendor =             cpu_to_le16(FSG_VENDOR_ID),
+        .idProduct =            cpu_to_le16(FSG_PRODUCT_ID),
+        .bcdDevice =            cpu_to_le16(0xffff),
+
+        .iManufacturer =        FSG_STRING_MANUFACTURER,
+        .iProduct =             FSG_STRING_PRODUCT,
+        .iSerialNumber =        FSG_STRING_SERIAL,
+        .bNumConfigurations =   1,
+};
+
+static struct usb_config_descriptor
+config_desc = {
+        .bLength =              sizeof config_desc,
+        .bDescriptorType =      USB_DT_CONFIG,
+
+        /* wTotalLength computed by usb_gadget_config_buf() */
+        .bNumInterfaces =       1,
+        .bConfigurationValue =  CONFIG_VALUE,
+        .iConfiguration =       FSG_STRING_CONFIG,
+        .bmAttributes =         USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
+        .bMaxPower =            CONFIG_USB_GADGET_VBUS_DRAW / 2,
+};
+
+
+static struct usb_qualifier_descriptor
+dev_qualifier = {
+        .bLength =              sizeof dev_qualifier,
+        .bDescriptorType =      USB_DT_DEVICE_QUALIFIER,
+
+        .bcdUSB =               cpu_to_le16(0x0200),
+        .bDeviceClass =         USB_CLASS_PER_INTERFACE,
+
+        .bNumConfigurations =   1,
+};
+
+
+
+/*
+ * Config descriptors must agree with the code that sets configurations
+ * and with code managing interfaces and their altsettings.  They must
+ * also handle different speeds and other-speed requests.
+ */
+static int populate_config_buf(struct usb_gadget *gadget,
+                u8 *buf, u8 type, unsigned index)
+{
+        enum usb_device_speed                   speed = gadget->speed;
+        int                                     len;
+        const struct usb_descriptor_header      **function;
+
+        if (index > 0)
+                return -EINVAL;
+
+        if (gadget_is_dualspeed(gadget) && type == USB_DT_OTHER_SPEED_CONFIG)
+                speed = (USB_SPEED_FULL + USB_SPEED_HIGH) - speed;
+        function = gadget_is_dualspeed(gadget) && speed == USB_SPEED_HIGH
+                ? (const struct usb_descriptor_header **)fsg_hs_function
+                : (const struct usb_descriptor_header **)fsg_fs_function;
+
+        /* for now, don't advertise srp-only devices */
+        if (!gadget_is_otg(gadget))
+                function++;
+
+        len = usb_gadget_config_buf(&config_desc, buf, EP0_BUFSIZE, function);
+        ((struct usb_config_descriptor *) buf)->bDescriptorType = type;
+        return len;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* These routines may be called in process context or in_irq */
+
+/* Caller must hold fsg->lock */
+static void wakeup_thread(struct fsg_dev *fsg)
+{
+        /* Tell the main thread that something has happened */
+        fsg->thread_wakeup_needed = 1;
+        if (fsg->thread_task)
+                wake_up_process(fsg->thread_task);
+}
+
+
+static void raise_exception(struct fsg_dev *fsg, enum fsg_state new_state)
+{
+        unsigned long           flags;
+
+        /* Do nothing if a higher-priority exception is already in progress.
+         * If a lower-or-equal priority exception is in progress, preempt it
+         * and notify the main thread by sending it a signal. */
+        spin_lock_irqsave(&fsg->lock, flags);
+        if (fsg->state <= new_state) {
+                fsg->exception_req_tag = fsg->ep0_req_tag;
+                fsg->state = new_state;
+                if (fsg->thread_task)
+                        send_sig_info(SIGUSR1, SEND_SIG_FORCED,
+                                        fsg->thread_task);
+        }
+        spin_unlock_irqrestore(&fsg->lock, flags);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* The disconnect callback and ep0 routines.  These always run in_irq,
+ * except that ep0_queue() is called in the main thread to acknowledge
+ * completion of various requests: set config, set interface, and
+ * Bulk-only device reset. */
+
+static void fsg_disconnect(struct usb_gadget *gadget)
+{
+        struct fsg_dev          *fsg = get_gadget_data(gadget);
+
+        DBG(fsg, "disconnect or port reset\n");
+        raise_exception(fsg, FSG_STATE_DISCONNECT);
+}
+
+
+static int ep0_queue(struct fsg_dev *fsg)
+{
+        int     rc;
+
+        rc = usb_ep_queue(fsg->ep0, fsg->ep0req, GFP_ATOMIC);
+        if (rc != 0 && rc != -ESHUTDOWN) {
+
+                /* We can't do much more than wait for a reset */
+                WARNING(fsg, "error in submission: %s --> %d\n",
+                                fsg->ep0->name, rc);
+        }
+        return rc;
+}
+
+static void ep0_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct fsg_dev          *fsg = ep->driver_data;
+
+        if (req->actual > 0)
+                dump_msg(fsg, fsg->ep0req_name, req->buf, req->actual);
+        if (req->status || req->actual != req->length)
+                DBG(fsg, "%s --> %d, %u/%u\n", __func__,
+                                req->status, req->actual, req->length);
+        if (req->status == -ECONNRESET)         // Request was cancelled
+                usb_ep_fifo_flush(ep);
+
+        if (req->status == 0 && req->context)
+                ((fsg_routine_t) (req->context))(fsg);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* Bulk and interrupt endpoint completion handlers.
+ * These always run in_irq. */
+
+static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct fsg_dev          *fsg = ep->driver_data;
+        struct fsg_buffhd       *bh = req->context;
+
+        if (req->status || req->actual != req->length)
+                DBG(fsg, "%s --> %d, %u/%u\n", __func__,
+                                req->status, req->actual, req->length);
+        if (req->status == -ECONNRESET)         // Request was cancelled
+                usb_ep_fifo_flush(ep);
+
+        /* Hold the lock while we update the request and buffer states */
+        smp_wmb();
+        spin_lock(&fsg->lock);
+        bh->inreq_busy = 0;
+        bh->state = BUF_STATE_EMPTY;
+        wakeup_thread(fsg);
+        spin_unlock(&fsg->lock);
+}
+
+static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct fsg_dev          *fsg = ep->driver_data;
+        struct fsg_buffhd       *bh = req->context;
+
+        dump_msg(fsg, "bulk-out", req->buf, req->actual);
+        if (req->status || req->actual != bh->bulk_out_intended_length)
+                DBG(fsg, "%s --> %d, %u/%u\n", __func__,
+                                req->status, req->actual,
+                                bh->bulk_out_intended_length);
+        if (req->status == -ECONNRESET)         // Request was cancelled
+                usb_ep_fifo_flush(ep);
+
+        /* Hold the lock while we update the request and buffer states */
+        smp_wmb();
+        spin_lock(&fsg->lock);
+        bh->outreq_busy = 0;
+        bh->state = BUF_STATE_FULL;
+        wakeup_thread(fsg);
+        spin_unlock(&fsg->lock);
+}
+
+
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct fsg_dev          *fsg = ep->driver_data;
+        struct fsg_buffhd       *bh = req->context;
+
+        if (req->status || req->actual != req->length)
+                DBG(fsg, "%s --> %d, %u/%u\n", __func__,
+                                req->status, req->actual, req->length);
+        if (req->status == -ECONNRESET)         // Request was cancelled
+                usb_ep_fifo_flush(ep);
+
+        /* Hold the lock while we update the request and buffer states */
+        smp_wmb();
+        spin_lock(&fsg->lock);
+        fsg->intreq_busy = 0;
+        bh->state = BUF_STATE_EMPTY;
+        wakeup_thread(fsg);
+        spin_unlock(&fsg->lock);
+}
+
+#else
+static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
+{}
+#endif /* CONFIG_USB_FILE_STORAGE_TEST */
+
+
+/*-------------------------------------------------------------------------*/
+
+/* Ep0 class-specific handlers.  These always run in_irq. */
+
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+        struct usb_request      *req = fsg->ep0req;
+        static u8               cbi_reset_cmnd[6] = {
+                        SEND_DIAGNOSTIC, 4, 0xff, 0xff, 0xff, 0xff};
+
+        /* Error in command transfer? */
+        if (req->status || req->length != req->actual ||
+                        req->actual < 6 || req->actual > MAX_COMMAND_SIZE) {
+
+                /* Not all controllers allow a protocol stall after
+                 * receiving control-out data, but we'll try anyway. */
+                fsg_set_halt(fsg, fsg->ep0);
+                return;                 // Wait for reset
+        }
+
+        /* Is it the special reset command? */
+        if (req->actual >= sizeof cbi_reset_cmnd &&
+                        memcmp(req->buf, cbi_reset_cmnd,
+                                sizeof cbi_reset_cmnd) == 0) {
+
+                /* Raise an exception to stop the current operation
+                 * and reinitialize our state. */
+                DBG(fsg, "cbi reset request\n");
+                raise_exception(fsg, FSG_STATE_RESET);
+                return;
+        }
+
+        VDBG(fsg, "CB[I] accept device-specific command\n");
+        spin_lock(&fsg->lock);
+
+        /* Save the command for later */
+        if (fsg->cbbuf_cmnd_size)
+                WARNING(fsg, "CB[I] overwriting previous command\n");
+        fsg->cbbuf_cmnd_size = req->actual;
+        memcpy(fsg->cbbuf_cmnd, req->buf, fsg->cbbuf_cmnd_size);
+
+        wakeup_thread(fsg);
+        spin_unlock(&fsg->lock);
+}
+
+#else
+static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{}
+#endif /* CONFIG_USB_FILE_STORAGE_TEST */
+
+
+static int class_setup_req(struct fsg_dev *fsg,
+                const struct usb_ctrlrequest *ctrl)
+{
+        struct usb_request      *req = fsg->ep0req;
+        int                     value = -EOPNOTSUPP;
+        u16                     w_index = le16_to_cpu(ctrl->wIndex);
+        u16                     w_value = le16_to_cpu(ctrl->wValue);
+        u16                     w_length = le16_to_cpu(ctrl->wLength);
+
+        if (!fsg->config)
+                return value;
+
+        /* Handle Bulk-only class-specific requests */
+        if (transport_is_bbb()) {
+                switch (ctrl->bRequest) {
+
+                case USB_BULK_RESET_REQUEST:
+                        if (ctrl->bRequestType != (USB_DIR_OUT |
+                                        USB_TYPE_CLASS | USB_RECIP_INTERFACE))
+                                break;
+                        if (w_index != 0 || w_value != 0) {
+                                value = -EDOM;
+                                break;
+                        }
+
+                        /* Raise an exception to stop the current operation
+                         * and reinitialize our state. */
+                        DBG(fsg, "bulk reset request\n");
+                        raise_exception(fsg, FSG_STATE_RESET);
+                        value = DELAYED_STATUS;
+                        break;
+
+                case USB_BULK_GET_MAX_LUN_REQUEST:
+                        if (ctrl->bRequestType != (USB_DIR_IN |
+                                        USB_TYPE_CLASS | USB_RECIP_INTERFACE))
+                                break;
+                        if (w_index != 0 || w_value != 0) {
+                                value = -EDOM;
+                                break;
+                        }
+                        VDBG(fsg, "get max LUN\n");
+                        *(u8 *) req->buf = fsg->nluns - 1;
+                        value = 1;
+                        break;
+                }
+        }
+
+        /* Handle CBI class-specific requests */
+        else {
+                switch (ctrl->bRequest) {
+
+                case USB_CBI_ADSC_REQUEST:
+                        if (ctrl->bRequestType != (USB_DIR_OUT |
+                                        USB_TYPE_CLASS | USB_RECIP_INTERFACE))
+                                break;
+                        if (w_index != 0 || w_value != 0) {
+                                value = -EDOM;
+                                break;
+                        }
+                        if (w_length > MAX_COMMAND_SIZE) {
+                                value = -EOVERFLOW;
+                                break;
+                        }
+                        value = w_length;
+                        fsg->ep0req->context = received_cbi_adsc;
+                        break;
+                }
+        }
+
+        if (value == -EOPNOTSUPP)
+                VDBG(fsg,
+                        "unknown class-specific control req "
+                        "%02x.%02x v%04x i%04x l%u\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        le16_to_cpu(ctrl->wValue), w_index, w_length);
+        return value;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* Ep0 standard request handlers.  These always run in_irq. */
+
+static int standard_setup_req(struct fsg_dev *fsg,
+                const struct usb_ctrlrequest *ctrl)
+{
+        struct usb_request      *req = fsg->ep0req;
+        int                     value = -EOPNOTSUPP;
+        u16                     w_index = le16_to_cpu(ctrl->wIndex);
+        u16                     w_value = le16_to_cpu(ctrl->wValue);
+
+        /* Usually this just stores reply data in the pre-allocated ep0 buffer,
+         * but config change events will also reconfigure hardware. */
+        switch (ctrl->bRequest) {
+
+        case USB_REQ_GET_DESCRIPTOR:
+                if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
+                                USB_RECIP_DEVICE))
+                        break;
+                switch (w_value >> 8) {
+
+                case USB_DT_DEVICE:
+                        VDBG(fsg, "get device descriptor\n");
+                        device_desc.bMaxPacketSize0 = fsg->ep0->maxpacket;
+                        value = sizeof device_desc;
+                        memcpy(req->buf, &device_desc, value);
+                        break;
+                case USB_DT_DEVICE_QUALIFIER:
+                        VDBG(fsg, "get device qualifier\n");
+                        if (!gadget_is_dualspeed(fsg->gadget))
+                                break;
+                        /*
+                         * Assume ep0 uses the same maxpacket value for both
+                         * speeds
+                         */
+                        dev_qualifier.bMaxPacketSize0 = fsg->ep0->maxpacket;
+                        value = sizeof dev_qualifier;
+                        memcpy(req->buf, &dev_qualifier, value);
+                        break;
+
+                case USB_DT_OTHER_SPEED_CONFIG:
+                        VDBG(fsg, "get other-speed config descriptor\n");
+                        if (!gadget_is_dualspeed(fsg->gadget))
+                                break;
+                        goto get_config;
+                case USB_DT_CONFIG:
+                        VDBG(fsg, "get configuration descriptor\n");
+get_config:
+                        value = populate_config_buf(fsg->gadget,
+                                        req->buf,
+                                        w_value >> 8,
+                                        w_value & 0xff);
+                        break;
+
+                case USB_DT_STRING:
+                        VDBG(fsg, "get string descriptor\n");
+
+                        /* wIndex == language code */
+                        value = usb_gadget_get_string(&fsg_stringtab,
+                                        w_value & 0xff, req->buf);
+                        break;
+                }
+                break;
+
+        /* One config, two speeds */
+        case USB_REQ_SET_CONFIGURATION:
+                if (ctrl->bRequestType != (USB_DIR_OUT | USB_TYPE_STANDARD |
+                                USB_RECIP_DEVICE))
+                        break;
+                VDBG(fsg, "set configuration\n");
+                if (w_value == CONFIG_VALUE || w_value == 0) {
+                        fsg->new_config = w_value;
+
+                        /* Raise an exception to wipe out previous transaction
+                         * state (queued bufs, etc) and set the new config. */
+                        raise_exception(fsg, FSG_STATE_CONFIG_CHANGE);
+                        value = DELAYED_STATUS;
+                }
+                break;
+        case USB_REQ_GET_CONFIGURATION:
+                if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
+                                USB_RECIP_DEVICE))
+                        break;
+                VDBG(fsg, "get configuration\n");
+                *(u8 *) req->buf = fsg->config;
+                value = 1;
+                break;
+
+        case USB_REQ_SET_INTERFACE:
+                if (ctrl->bRequestType != (USB_DIR_OUT| USB_TYPE_STANDARD |
+                                USB_RECIP_INTERFACE))
+                        break;
+                if (fsg->config && w_index == 0) {
+
+                        /* Raise an exception to wipe out previous transaction
+                         * state (queued bufs, etc) and install the new
+                         * interface altsetting. */
+                        raise_exception(fsg, FSG_STATE_INTERFACE_CHANGE);
+                        value = DELAYED_STATUS;
+                }
+                break;
+        case USB_REQ_GET_INTERFACE:
+                if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
+                                USB_RECIP_INTERFACE))
+                        break;
+                if (!fsg->config)
+                        break;
+                if (w_index != 0) {
+                        value = -EDOM;
+                        break;
+                }
+                VDBG(fsg, "get interface\n");
+                *(u8 *) req->buf = 0;
+                value = 1;
+                break;
+
+        default:
+                VDBG(fsg,
+                        "unknown control req %02x.%02x v%04x i%04x l%u\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, le16_to_cpu(ctrl->wLength));
+        }
+
+        return value;
+}
+
+
+static int fsg_setup(struct usb_gadget *gadget,
+                const struct usb_ctrlrequest *ctrl)
+{
+        struct fsg_dev          *fsg = get_gadget_data(gadget);
+        int                     rc;
+        int                     w_length = le16_to_cpu(ctrl->wLength);
+
+        ++fsg->ep0_req_tag;             // Record arrival of a new request
+        fsg->ep0req->context = NULL;
+        fsg->ep0req->length = 0;
+        dump_msg(fsg, "ep0-setup", (u8 *) ctrl, sizeof(*ctrl));
+
+        if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS)
+                rc = class_setup_req(fsg, ctrl);
+        else
+                rc = standard_setup_req(fsg, ctrl);
+
+        /* Respond with data/status or defer until later? */
+        if (rc >= 0 && rc != DELAYED_STATUS) {
+                rc = min(rc, w_length);
+                fsg->ep0req->length = rc;
+                fsg->ep0req->zero = rc < w_length;
+                fsg->ep0req_name = (ctrl->bRequestType & USB_DIR_IN ?
+                                "ep0-in" : "ep0-out");
+                rc = ep0_queue(fsg);
+        }
+
+        /* Device either stalls (rc < 0) or reports success */
+        return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* All the following routines run in process context */
+
+
+/* Use this for bulk or interrupt transfers, not ep0 */
+static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
+                struct usb_request *req, int *pbusy,
+                enum fsg_buffer_state *state)
+{
+        int     rc;
+
+        if (ep == fsg->bulk_in)
+                dump_msg(fsg, "bulk-in", req->buf, req->length);
+        else if (ep == fsg->intr_in)
+                dump_msg(fsg, "intr-in", req->buf, req->length);
+
+        spin_lock_irq(&fsg->lock);
+        *pbusy = 1;
+        *state = BUF_STATE_BUSY;
+        spin_unlock_irq(&fsg->lock);
+        rc = usb_ep_queue(ep, req, GFP_KERNEL);
+        if (rc != 0) {
+                *pbusy = 0;
+                *state = BUF_STATE_EMPTY;
+
+                /* We can't do much more than wait for a reset */
+
+                /* Note: currently the net2280 driver fails zero-length
+                 * submissions if DMA is enabled. */
+                if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
+                                                req->length == 0))
+                        WARNING(fsg, "error in submission: %s --> %d\n",
+                                        ep->name, rc);
+        }
+}
+
+
+static int sleep_thread(struct fsg_dev *fsg)
+{
+        int     rc = 0;
+
+        /* Wait until a signal arrives or we are woken up */
+        for (;;) {
+                try_to_freeze();
+                set_current_state(TASK_INTERRUPTIBLE);
+                if (signal_pending(current)) {
+                        rc = -EINTR;
+                        break;
+                }
+                if (fsg->thread_wakeup_needed)
+                        break;
+                schedule();
+        }
+        __set_current_state(TASK_RUNNING);
+        fsg->thread_wakeup_needed = 0;
+        return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int do_read(struct fsg_dev *fsg)
+{
+        struct fsg_lun          *curlun = fsg->curlun;
+        u32                     lba;
+        struct fsg_buffhd       *bh;
+        int                     rc;
+        u32                     amount_left;
+        loff_t                  file_offset, file_offset_tmp;
+        unsigned int            amount;
+        unsigned int            partial_page;
+        ssize_t                 nread;
+
+        /* Get the starting Logical Block Address and check that it's
+         * not too big */
+        if (fsg->cmnd[0] == READ_6)
+                lba = get_unaligned_be24(&fsg->cmnd[1]);
+        else {
+                lba = get_unaligned_be32(&fsg->cmnd[2]);
+
+                /* We allow DPO (Disable Page Out = don't save data in the
+                 * cache) and FUA (Force Unit Access = don't read from the
+                 * cache), but we don't implement them. */
+                if ((fsg->cmnd[1] & ~0x18) != 0) {
+                        curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                        return -EINVAL;
+                }
+        }
+        if (lba >= curlun->num_sectors) {
+                curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+                return -EINVAL;
+        }
+        file_offset = ((loff_t) lba) << 9;
+
+        /* Carry out the file reads */
+        amount_left = fsg->data_size_from_cmnd;
+        if (unlikely(amount_left == 0))
+                return -EIO;            // No default reply
+
+        for (;;) {
+
+                /* Figure out how much we need to read:
+                 * Try to read the remaining amount.
+                 * But don't read more than the buffer size.
+                 * And don't try to read past the end of the file.
+                 * Finally, if we're not at a page boundary, don't read past
+                 *      the next page.
+                 * If this means reading 0 then we were asked to read past
+                 *      the end of file. */
+                amount = min((unsigned int) amount_left, mod_data.buflen);
+                amount = min((loff_t) amount,
+                                curlun->file_length - file_offset);
+                partial_page = file_offset & (PAGE_CACHE_SIZE - 1);
+                if (partial_page > 0)
+                        amount = min(amount, (unsigned int) PAGE_CACHE_SIZE -
+                                        partial_page);
+
+                /* Wait for the next buffer to become available */
+                bh = fsg->next_buffhd_to_fill;
+                while (bh->state != BUF_STATE_EMPTY) {
+                        rc = sleep_thread(fsg);
+                        if (rc)
+                                return rc;
+                }
+
+                /* If we were asked to read past the end of file,
+                 * end with an empty buffer. */
+                if (amount == 0) {
+                        curlun->sense_data =
+                                        SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+                        curlun->sense_data_info = file_offset >> 9;
+                        curlun->info_valid = 1;
+                        bh->inreq->length = 0;
+                        bh->state = BUF_STATE_FULL;
+                        break;
+                }
+
+                /* Perform the read */
+                file_offset_tmp = file_offset;
+                nread = vfs_read(curlun->filp,
+                                (char __user *) bh->buf,
+                                amount, &file_offset_tmp);
+                VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
+                                (unsigned long long) file_offset,
+                                (int) nread);
+                if (signal_pending(current))
+                        return -EINTR;
+
+                if (nread < 0) {
+                        LDBG(curlun, "error in file read: %d\n",
+                                        (int) nread);
+                        nread = 0;
+                } else if (nread < amount) {
+                        LDBG(curlun, "partial file read: %d/%u\n",
+                                        (int) nread, amount);
+                        nread -= (nread & 511); // Round down to a block
+                }
+                file_offset  += nread;
+                amount_left  -= nread;
+                fsg->residue -= nread;
+                bh->inreq->length = nread;
+                bh->state = BUF_STATE_FULL;
+
+                /* If an error occurred, report it and its position */
+                if (nread < amount) {
+                        curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
+                        curlun->sense_data_info = file_offset >> 9;
+                        curlun->info_valid = 1;
+                        break;
+                }
+
+                if (amount_left == 0)
+                        break;          // No more left to read
+
+                /* Send this buffer and go read some more */
+                bh->inreq->zero = 0;
+                start_transfer(fsg, fsg->bulk_in, bh->inreq,
+                                &bh->inreq_busy, &bh->state);
+                fsg->next_buffhd_to_fill = bh->next;
+        }
+
+        return -EIO;            // No default reply
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int do_write(struct fsg_dev *fsg)
+{
+        struct fsg_lun          *curlun = fsg->curlun;
+        u32                     lba;
+        struct fsg_buffhd       *bh;
+        int                     get_some_more;
+        u32                     amount_left_to_req, amount_left_to_write;
+        loff_t                  usb_offset, file_offset, file_offset_tmp;
+        unsigned int            amount;
+        unsigned int            partial_page;
+        ssize_t                 nwritten;
+        int                     rc;
+
+        if (curlun->ro) {
+                curlun->sense_data = SS_WRITE_PROTECTED;
+                return -EINVAL;
+        }
+        spin_lock(&curlun->filp->f_lock);
+        curlun->filp->f_flags &= ~O_SYNC;       // Default is not to wait
+        spin_unlock(&curlun->filp->f_lock);
+
+        /* Get the starting Logical Block Address and check that it's
+         * not too big */
+        if (fsg->cmnd[0] == WRITE_6)
+                lba = get_unaligned_be24(&fsg->cmnd[1]);
+        else {
+                lba = get_unaligned_be32(&fsg->cmnd[2]);
+
+                /* We allow DPO (Disable Page Out = don't save data in the
+                 * cache) and FUA (Force Unit Access = write directly to the
+                 * medium).  We don't implement DPO; we implement FUA by
+                 * performing synchronous output. */
+                if ((fsg->cmnd[1] & ~0x18) != 0) {
+                        curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                        return -EINVAL;
+                }
+                /* FUA */
+                if (!curlun->nofua && (fsg->cmnd[1] & 0x08)) {
+                        spin_lock(&curlun->filp->f_lock);
+                        curlun->filp->f_flags |= O_DSYNC;
+                        spin_unlock(&curlun->filp->f_lock);
+                }
+        }
+        if (lba >= curlun->num_sectors) {
+                curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+                return -EINVAL;
+        }
+
+        /* Carry out the file writes */
+        get_some_more = 1;
+        file_offset = usb_offset = ((loff_t) lba) << 9;
+        amount_left_to_req = amount_left_to_write = fsg->data_size_from_cmnd;
+
+        while (amount_left_to_write > 0) {
+
+                /* Queue a request for more data from the host */
+                bh = fsg->next_buffhd_to_fill;
+                if (bh->state == BUF_STATE_EMPTY && get_some_more) {
+
+                        /* Figure out how much we want to get:
+                         * Try to get the remaining amount.
+                         * But don't get more than the buffer size.
+                         * And don't try to go past the end of the file.
+                         * If we're not at a page boundary,
+                         *      don't go past the next page.
+                         * If this means getting 0, then we were asked
+                         *      to write past the end of file.
+                         * Finally, round down to a block boundary. */
+                        amount = min(amount_left_to_req, mod_data.buflen);
+                        amount = min((loff_t) amount, curlun->file_length -
+                                        usb_offset);
+                        partial_page = usb_offset & (PAGE_CACHE_SIZE - 1);
+                        if (partial_page > 0)
+                                amount = min(amount,
+        (unsigned int) PAGE_CACHE_SIZE - partial_page);
+
+                        if (amount == 0) {
+                                get_some_more = 0;
+                                curlun->sense_data =
+                                        SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+                                curlun->sense_data_info = usb_offset >> 9;
+                                curlun->info_valid = 1;
+                                continue;
+                        }
+                        amount -= (amount & 511);
+                        if (amount == 0) {
+
+                                /* Why were we were asked to transfer a
+                                 * partial block? */
+                                get_some_more = 0;
+                                continue;
+                        }
+
+                        /* Get the next buffer */
+                        usb_offset += amount;
+                        fsg->usb_amount_left -= amount;
+                        amount_left_to_req -= amount;
+                        if (amount_left_to_req == 0)
+                                get_some_more = 0;
+
+                        /* amount is always divisible by 512, hence by
+                         * the bulk-out maxpacket size */
+                        bh->outreq->length = bh->bulk_out_intended_length =
+                                        amount;
+                        bh->outreq->short_not_ok = 1;
+                        start_transfer(fsg, fsg->bulk_out, bh->outreq,
+                                        &bh->outreq_busy, &bh->state);
+                        fsg->next_buffhd_to_fill = bh->next;
+                        continue;
+                }
+
+                /* Write the received data to the backing file */
+                bh = fsg->next_buffhd_to_drain;
+                if (bh->state == BUF_STATE_EMPTY && !get_some_more)
+                        break;                  // We stopped early
+                if (bh->state == BUF_STATE_FULL) {
+                        smp_rmb();
+                        fsg->next_buffhd_to_drain = bh->next;
+                        bh->state = BUF_STATE_EMPTY;
+
+                        /* Did something go wrong with the transfer? */
+                        if (bh->outreq->status != 0) {
+                                curlun->sense_data = SS_COMMUNICATION_FAILURE;
+                                curlun->sense_data_info = file_offset >> 9;
+                                curlun->info_valid = 1;
+                                break;
+                        }
+
+                        amount = bh->outreq->actual;
+                        if (curlun->file_length - file_offset < amount) {
+                                LERROR(curlun,
+        "write %u @ %llu beyond end %llu\n",
+        amount, (unsigned long long) file_offset,
+        (unsigned long long) curlun->file_length);
+                                amount = curlun->file_length - file_offset;
+                        }
+
+                        /* Perform the write */
+                        file_offset_tmp = file_offset;
+                        nwritten = vfs_write(curlun->filp,
+                                        (char __user *) bh->buf,
+                                        amount, &file_offset_tmp);
+                        VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
+                                        (unsigned long long) file_offset,
+                                        (int) nwritten);
+                        if (signal_pending(current))
+                                return -EINTR;          // Interrupted!
+
+                        if (nwritten < 0) {
+                                LDBG(curlun, "error in file write: %d\n",
+                                                (int) nwritten);
+                                nwritten = 0;
+                        } else if (nwritten < amount) {
+                                LDBG(curlun, "partial file write: %d/%u\n",
+                                                (int) nwritten, amount);
+                                nwritten -= (nwritten & 511);
+                                                // Round down to a block
+                        }
+                        file_offset += nwritten;
+                        amount_left_to_write -= nwritten;
+                        fsg->residue -= nwritten;
+
+                        /* If an error occurred, report it and its position */
+                        if (nwritten < amount) {
+                                curlun->sense_data = SS_WRITE_ERROR;
+                                curlun->sense_data_info = file_offset >> 9;
+                                curlun->info_valid = 1;
+                                break;
+                        }
+
+                        /* Did the host decide to stop early? */
+                        if (bh->outreq->actual != bh->outreq->length) {
+                                fsg->short_packet_received = 1;
+                                break;
+                        }
+                        continue;
+                }
+
+                /* Wait for something to happen */
+                rc = sleep_thread(fsg);
+                if (rc)
+                        return rc;
+        }
+
+        return -EIO;            // No default reply
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int do_synchronize_cache(struct fsg_dev *fsg)
+{
+        struct fsg_lun  *curlun = fsg->curlun;
+        int             rc;
+
+        /* We ignore the requested LBA and write out all file's
+         * dirty data buffers. */
+        rc = fsg_lun_fsync_sub(curlun);
+        if (rc)
+                curlun->sense_data = SS_WRITE_ERROR;
+        return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static void invalidate_sub(struct fsg_lun *curlun)
+{
+        struct file     *filp = curlun->filp;
+        struct inode    *inode = filp->f_path.dentry->d_inode;
+        unsigned long   rc;
+
+        rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
+        VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc);
+}
+
+static int do_verify(struct fsg_dev *fsg)
+{
+        struct fsg_lun          *curlun = fsg->curlun;
+        u32                     lba;
+        u32                     verification_length;
+        struct fsg_buffhd       *bh = fsg->next_buffhd_to_fill;
+        loff_t                  file_offset, file_offset_tmp;
+        u32                     amount_left;
+        unsigned int            amount;
+        ssize_t                 nread;
+
+        /* Get the starting Logical Block Address and check that it's
+         * not too big */
+        lba = get_unaligned_be32(&fsg->cmnd[2]);
+        if (lba >= curlun->num_sectors) {
+                curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+                return -EINVAL;
+        }
+
+        /* We allow DPO (Disable Page Out = don't save data in the
+         * cache) but we don't implement it. */
+        if ((fsg->cmnd[1] & ~0x10) != 0) {
+                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                return -EINVAL;
+        }
+
+        verification_length = get_unaligned_be16(&fsg->cmnd[7]);
+        if (unlikely(verification_length == 0))
+                return -EIO;            // No default reply
+
+        /* Prepare to carry out the file verify */
+        amount_left = verification_length << 9;
+        file_offset = ((loff_t) lba) << 9;
+
+        /* Write out all the dirty buffers before invalidating them */
+        fsg_lun_fsync_sub(curlun);
+        if (signal_pending(current))
+                return -EINTR;
+
+        invalidate_sub(curlun);
+        if (signal_pending(current))
+                return -EINTR;
+
+        /* Just try to read the requested blocks */
+        while (amount_left > 0) {
+
+                /* Figure out how much we need to read:
+                 * Try to read the remaining amount, but not more than
+                 * the buffer size.
+                 * And don't try to read past the end of the file.
+                 * If this means reading 0 then we were asked to read
+                 * past the end of file. */
+                amount = min((unsigned int) amount_left, mod_data.buflen);
+                amount = min((loff_t) amount,
+                                curlun->file_length - file_offset);
+                if (amount == 0) {
+                        curlun->sense_data =
+                                        SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+                        curlun->sense_data_info = file_offset >> 9;
+                        curlun->info_valid = 1;
+                        break;
+                }
+
+                /* Perform the read */
+                file_offset_tmp = file_offset;
+                nread = vfs_read(curlun->filp,
+                                (char __user *) bh->buf,
+                                amount, &file_offset_tmp);
+                VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
+                                (unsigned long long) file_offset,
+                                (int) nread);
+                if (signal_pending(current))
+                        return -EINTR;
+
+                if (nread < 0) {
+                        LDBG(curlun, "error in file verify: %d\n",
+                                        (int) nread);
+                        nread = 0;
+                } else if (nread < amount) {
+                        LDBG(curlun, "partial file verify: %d/%u\n",
+                                        (int) nread, amount);
+                        nread -= (nread & 511); // Round down to a sector
+                }
+                if (nread == 0) {
+                        curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
+                        curlun->sense_data_info = file_offset >> 9;
+                        curlun->info_valid = 1;
+                        break;
+                }
+                file_offset += nread;
+                amount_left -= nread;
+        }
+        return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int do_inquiry(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+        u8      *buf = (u8 *) bh->buf;
+
+        static char vendor_id[] = "Linux   ";
+        static char product_disk_id[] = "File-Stor Gadget";
+        static char product_cdrom_id[] = "File-CD Gadget  ";
+
+        if (!fsg->curlun) {             // Unsupported LUNs are okay
+                fsg->bad_lun_okay = 1;
+                memset(buf, 0, 36);
+                buf[0] = 0x7f;          // Unsupported, no device-type
+                buf[4] = 31;            // Additional length
+                return 36;
+        }
+
+        memset(buf, 0, 8);
+        buf[0] = (mod_data.cdrom ? TYPE_ROM : TYPE_DISK);
+        if (mod_data.removable)
+                buf[1] = 0x80;
+        buf[2] = 2;             // ANSI SCSI level 2
+        buf[3] = 2;             // SCSI-2 INQUIRY data format
+        buf[4] = 31;            // Additional length
+                                // No special options
+        sprintf(buf + 8, "%-8s%-16s%04x", vendor_id,
+                        (mod_data.cdrom ? product_cdrom_id :
+                                product_disk_id),
+                        mod_data.release);
+        return 36;
+}
+
+
+static int do_request_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+        struct fsg_lun  *curlun = fsg->curlun;
+        u8              *buf = (u8 *) bh->buf;
+        u32             sd, sdinfo;
+        int             valid;
+
+        /*
+         * From the SCSI-2 spec., section 7.9 (Unit attention condition):
+         *
+         * If a REQUEST SENSE command is received from an initiator
+         * with a pending unit attention condition (before the target
+         * generates the contingent allegiance condition), then the
+         * target shall either:
+         *   a) report any pending sense data and preserve the unit
+         *      attention condition on the logical unit, or,
+         *   b) report the unit attention condition, may discard any
+         *      pending sense data, and clear the unit attention
+         *      condition on the logical unit for that initiator.
+         *
+         * FSG normally uses option a); enable this code to use option b).
+         */
+#if 0
+        if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
+                curlun->sense_data = curlun->unit_attention_data;
+                curlun->unit_attention_data = SS_NO_SENSE;
+        }
+#endif
+
+        if (!curlun) {          // Unsupported LUNs are okay
+                fsg->bad_lun_okay = 1;
+                sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
+                sdinfo = 0;
+                valid = 0;
+        } else {
+                sd = curlun->sense_data;
+                sdinfo = curlun->sense_data_info;
+                valid = curlun->info_valid << 7;
+                curlun->sense_data = SS_NO_SENSE;
+                curlun->sense_data_info = 0;
+                curlun->info_valid = 0;
+        }
+
+        memset(buf, 0, 18);
+        buf[0] = valid | 0x70;                  // Valid, current error
+        buf[2] = SK(sd);
+        put_unaligned_be32(sdinfo, &buf[3]);    /* Sense information */
+        buf[7] = 18 - 8;                        // Additional sense length
+        buf[12] = ASC(sd);
+        buf[13] = ASCQ(sd);
+        return 18;
+}
+
+
+static int do_read_capacity(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+        struct fsg_lun  *curlun = fsg->curlun;
+        u32             lba = get_unaligned_be32(&fsg->cmnd[2]);
+        int             pmi = fsg->cmnd[8];
+        u8              *buf = (u8 *) bh->buf;
+
+        /* Check the PMI and LBA fields */
+        if (pmi > 1 || (pmi == 0 && lba != 0)) {
+                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                return -EINVAL;
+        }
+
+        put_unaligned_be32(curlun->num_sectors - 1, &buf[0]);
+                                                /* Max logical block */
+        put_unaligned_be32(512, &buf[4]);       /* Block length */
+        return 8;
+}
+
+
+static int do_read_header(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+        struct fsg_lun  *curlun = fsg->curlun;
+        int             msf = fsg->cmnd[1] & 0x02;
+        u32             lba = get_unaligned_be32(&fsg->cmnd[2]);
+        u8              *buf = (u8 *) bh->buf;
+
+        if ((fsg->cmnd[1] & ~0x02) != 0) {              /* Mask away MSF */
+                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                return -EINVAL;
+        }
+        if (lba >= curlun->num_sectors) {
+                curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+                return -EINVAL;
+        }
+
+        memset(buf, 0, 8);
+        buf[0] = 0x01;          /* 2048 bytes of user data, rest is EC */
+        store_cdrom_address(&buf[4], msf, lba);
+        return 8;
+}
+
+
+static int do_read_toc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+        struct fsg_lun  *curlun = fsg->curlun;
+        int             msf = fsg->cmnd[1] & 0x02;
+        int             start_track = fsg->cmnd[6];
+        u8              *buf = (u8 *) bh->buf;
+
+        if ((fsg->cmnd[1] & ~0x02) != 0 ||              /* Mask away MSF */
+                        start_track > 1) {
+                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                return -EINVAL;
+        }
+
+        memset(buf, 0, 20);
+        buf[1] = (20-2);                /* TOC data length */
+        buf[2] = 1;                     /* First track number */
+        buf[3] = 1;                     /* Last track number */
+        buf[5] = 0x16;                  /* Data track, copying allowed */
+        buf[6] = 0x01;                  /* Only track is number 1 */
+        store_cdrom_address(&buf[8], msf, 0);
+
+        buf[13] = 0x16;                 /* Lead-out track is data */
+        buf[14] = 0xAA;                 /* Lead-out track number */
+        store_cdrom_address(&buf[16], msf, curlun->num_sectors);
+        return 20;
+}
+
+
+static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+        struct fsg_lun  *curlun = fsg->curlun;
+        int             mscmnd = fsg->cmnd[0];
+        u8              *buf = (u8 *) bh->buf;
+        u8              *buf0 = buf;
+        int             pc, page_code;
+        int             changeable_values, all_pages;
+        int             valid_page = 0;
+        int             len, limit;
+
+        if ((fsg->cmnd[1] & ~0x08) != 0) {              // Mask away DBD
+                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                return -EINVAL;
+        }
+        pc = fsg->cmnd[2] >> 6;
+        page_code = fsg->cmnd[2] & 0x3f;
+        if (pc == 3) {
+                curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
+                return -EINVAL;
+        }
+        changeable_values = (pc == 1);
+        all_pages = (page_code == 0x3f);
+
+        /* Write the mode parameter header.  Fixed values are: default
+         * medium type, no cache control (DPOFUA), and no block descriptors.
+         * The only variable value is the WriteProtect bit.  We will fill in
+         * the mode data length later. */
+        memset(buf, 0, 8);
+        if (mscmnd == MODE_SENSE) {
+                buf[2] = (curlun->ro ? 0x80 : 0x00);            // WP, DPOFUA
+                buf += 4;
+                limit = 255;
+        } else {                        // MODE_SENSE_10
+                buf[3] = (curlun->ro ? 0x80 : 0x00);            // WP, DPOFUA
+                buf += 8;
+                limit = 65535;          // Should really be mod_data.buflen
+        }
+
+        /* No block descriptors */
+
+        /* The mode pages, in numerical order.  The only page we support
+         * is the Caching page. */
+        if (page_code == 0x08 || all_pages) {
+                valid_page = 1;
+                buf[0] = 0x08;          // Page code
+                buf[1] = 10;            // Page length
+                memset(buf+2, 0, 10);   // None of the fields are changeable
+
+                if (!changeable_values) {
+                        buf[2] = 0x04;  // Write cache enable,
+                                        // Read cache not disabled
+                                        // No cache retention priorities
+                        put_unaligned_be16(0xffff, &buf[4]);
+                                        /* Don't disable prefetch */
+                                        /* Minimum prefetch = 0 */
+                        put_unaligned_be16(0xffff, &buf[8]);
+                                        /* Maximum prefetch */
+                        put_unaligned_be16(0xffff, &buf[10]);
+                                        /* Maximum prefetch ceiling */
+                }
+                buf += 12;
+        }
+
+        /* Check that a valid page was requested and the mode data length
+         * isn't too long. */
+        len = buf - buf0;
+        if (!valid_page || len > limit) {
+                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                return -EINVAL;
+        }
+
+        /*  Store the mode data length */
+        if (mscmnd == MODE_SENSE)
+                buf0[0] = len - 1;
+        else
+                put_unaligned_be16(len - 2, buf0);
+        return len;
+}
+
+
+static int do_start_stop(struct fsg_dev *fsg)
+{
+        struct fsg_lun  *curlun = fsg->curlun;
+        int             loej, start;
+
+        if (!mod_data.removable) {
+                curlun->sense_data = SS_INVALID_COMMAND;
+                return -EINVAL;
+        }
+
+        // int immed = fsg->cmnd[1] & 0x01;
+        loej = fsg->cmnd[4] & 0x02;
+        start = fsg->cmnd[4] & 0x01;
+
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+        if ((fsg->cmnd[1] & ~0x01) != 0 ||              // Mask away Immed
+                        (fsg->cmnd[4] & ~0x03) != 0) {  // Mask LoEj, Start
+                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                return -EINVAL;
+        }
+
+        if (!start) {
+
+                /* Are we allowed to unload the media? */
+                if (curlun->prevent_medium_removal) {
+                        LDBG(curlun, "unload attempt prevented\n");
+                        curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
+                        return -EINVAL;
+                }
+                if (loej) {             // Simulate an unload/eject
+                        up_read(&fsg->filesem);
+                        down_write(&fsg->filesem);
+                        fsg_lun_close(curlun);
+                        up_write(&fsg->filesem);
+                        down_read(&fsg->filesem);
+                }
+        } else {
+
+                /* Our emulation doesn't support mounting; the medium is
+                 * available for use as soon as it is loaded. */
+                if (!fsg_lun_is_open(curlun)) {
+                        curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
+                        return -EINVAL;
+                }
+        }
+#endif
+        return 0;
+}
+
+
+static int do_prevent_allow(struct fsg_dev *fsg)
+{
+        struct fsg_lun  *curlun = fsg->curlun;
+        int             prevent;
+
+        if (!mod_data.removable) {
+                curlun->sense_data = SS_INVALID_COMMAND;
+                return -EINVAL;
+        }
+
+        prevent = fsg->cmnd[4] & 0x01;
+        if ((fsg->cmnd[4] & ~0x01) != 0) {              // Mask away Prevent
+                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                return -EINVAL;
+        }
+
+        if (curlun->prevent_medium_removal && !prevent)
+                fsg_lun_fsync_sub(curlun);
+        curlun->prevent_medium_removal = prevent;
+        return 0;
+}
+
+
+static int do_read_format_capacities(struct fsg_dev *fsg,
+                        struct fsg_buffhd *bh)
+{
+        struct fsg_lun  *curlun = fsg->curlun;
+        u8              *buf = (u8 *) bh->buf;
+
+        buf[0] = buf[1] = buf[2] = 0;
+        buf[3] = 8;             // Only the Current/Maximum Capacity Descriptor
+        buf += 4;
+
+        put_unaligned_be32(curlun->num_sectors, &buf[0]);
+                                                /* Number of blocks */
+        put_unaligned_be32(512, &buf[4]);       /* Block length */
+        buf[4] = 0x02;                          /* Current capacity */
+        return 12;
+}
+
+
+static int do_mode_select(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+        struct fsg_lun  *curlun = fsg->curlun;
+
+        /* We don't support MODE SELECT */
+        curlun->sense_data = SS_INVALID_COMMAND;
+        return -EINVAL;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
+{
+        int     rc;
+
+        rc = fsg_set_halt(fsg, fsg->bulk_in);
+        if (rc == -EAGAIN)
+                VDBG(fsg, "delayed bulk-in endpoint halt\n");
+        while (rc != 0) {
+                if (rc != -EAGAIN) {
+                        WARNING(fsg, "usb_ep_set_halt -> %d\n", rc);
+                        rc = 0;
+                        break;
+                }
+
+                /* Wait for a short time and then try again */
+                if (msleep_interruptible(100) != 0)
+                        return -EINTR;
+                rc = usb_ep_set_halt(fsg->bulk_in);
+        }
+        return rc;
+}
+
+static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
+{
+        int     rc;
+
+        DBG(fsg, "bulk-in set wedge\n");
+        rc = usb_ep_set_wedge(fsg->bulk_in);
+        if (rc == -EAGAIN)
+                VDBG(fsg, "delayed bulk-in endpoint wedge\n");
+        while (rc != 0) {
+                if (rc != -EAGAIN) {
+                        WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc);
+                        rc = 0;
+                        break;
+                }
+
+                /* Wait for a short time and then try again */
+                if (msleep_interruptible(100) != 0)
+                        return -EINTR;
+                rc = usb_ep_set_wedge(fsg->bulk_in);
+        }
+        return rc;
+}
+
+static int throw_away_data(struct fsg_dev *fsg)
+{
+        struct fsg_buffhd       *bh;
+        u32                     amount;
+        int                     rc;
+
+        while ((bh = fsg->next_buffhd_to_drain)->state != BUF_STATE_EMPTY ||
+                        fsg->usb_amount_left > 0) {
+
+                /* Throw away the data in a filled buffer */
+                if (bh->state == BUF_STATE_FULL) {
+                        smp_rmb();
+                        bh->state = BUF_STATE_EMPTY;
+                        fsg->next_buffhd_to_drain = bh->next;
+
+                        /* A short packet or an error ends everything */
+                        if (bh->outreq->actual != bh->outreq->length ||
+                                        bh->outreq->status != 0) {
+                                raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
+                                return -EINTR;
+                        }
+                        continue;
+                }
+
+                /* Try to submit another request if we need one */
+                bh = fsg->next_buffhd_to_fill;
+                if (bh->state == BUF_STATE_EMPTY && fsg->usb_amount_left > 0) {
+                        amount = min(fsg->usb_amount_left,
+                                        (u32) mod_data.buflen);
+
+                        /* amount is always divisible by 512, hence by
+                         * the bulk-out maxpacket size */
+                        bh->outreq->length = bh->bulk_out_intended_length =
+                                        amount;
+                        bh->outreq->short_not_ok = 1;
+                        start_transfer(fsg, fsg->bulk_out, bh->outreq,
+                                        &bh->outreq_busy, &bh->state);
+                        fsg->next_buffhd_to_fill = bh->next;
+                        fsg->usb_amount_left -= amount;
+                        continue;
+                }
+
+                /* Otherwise wait for something to happen */
+                rc = sleep_thread(fsg);
+                if (rc)
+                        return rc;
+        }
+        return 0;
+}
+
+
+static int finish_reply(struct fsg_dev *fsg)
+{
+        struct fsg_buffhd       *bh = fsg->next_buffhd_to_fill;
+        int                     rc = 0;
+
+        switch (fsg->data_dir) {
+        case DATA_DIR_NONE:
+                break;                  // Nothing to send
+
+        /* If we don't know whether the host wants to read or write,
+         * this must be CB or CBI with an unknown command.  We mustn't
+         * try to send or receive any data.  So stall both bulk pipes
+         * if we can and wait for a reset. */
+        case DATA_DIR_UNKNOWN:
+                if (mod_data.can_stall) {
+                        fsg_set_halt(fsg, fsg->bulk_out);
+                        rc = halt_bulk_in_endpoint(fsg);
+                }
+                break;
+
+        /* All but the last buffer of data must have already been sent */
+        case DATA_DIR_TO_HOST:
+                if (fsg->data_size == 0)
+                        ;               // Nothing to send
+
+                /* If there's no residue, simply send the last buffer */
+                else if (fsg->residue == 0) {
+                        bh->inreq->zero = 0;
+                        start_transfer(fsg, fsg->bulk_in, bh->inreq,
+                                        &bh->inreq_busy, &bh->state);
+                        fsg->next_buffhd_to_fill = bh->next;
+                }
+
+                /* There is a residue.  For CB and CBI, simply mark the end
+                 * of the data with a short packet.  However, if we are
+                 * allowed to stall, there was no data at all (residue ==
+                 * data_size), and the command failed (invalid LUN or
+                 * sense data is set), then halt the bulk-in endpoint
+                 * instead. */
+                else if (!transport_is_bbb()) {
+                        if (mod_data.can_stall &&
+                                        fsg->residue == fsg->data_size &&
+        (!fsg->curlun || fsg->curlun->sense_data != SS_NO_SENSE)) {
+                                bh->state = BUF_STATE_EMPTY;
+                                rc = halt_bulk_in_endpoint(fsg);
+                        } else {
+                                bh->inreq->zero = 1;
+                                start_transfer(fsg, fsg->bulk_in, bh->inreq,
+                                                &bh->inreq_busy, &bh->state);
+                                fsg->next_buffhd_to_fill = bh->next;
+                        }
+                }
+
+                /*
+                 * For Bulk-only, mark the end of the data with a short
+                 * packet.  If we are allowed to stall, halt the bulk-in
+                 * endpoint.  (Note: This violates the Bulk-Only Transport
+                 * specification, which requires us to pad the data if we
+                 * don't halt the endpoint.  Presumably nobody will mind.)
+                 */
+                else {
+                        bh->inreq->zero = 1;
+                        start_transfer(fsg, fsg->bulk_in, bh->inreq,
+                                        &bh->inreq_busy, &bh->state);
+                        fsg->next_buffhd_to_fill = bh->next;
+                        if (mod_data.can_stall)
+                                rc = halt_bulk_in_endpoint(fsg);
+                }
+                break;
+
+        /* We have processed all we want from the data the host has sent.
+         * There may still be outstanding bulk-out requests. */
+        case DATA_DIR_FROM_HOST:
+                if (fsg->residue == 0)
+                        ;               // Nothing to receive
+
+                /* Did the host stop sending unexpectedly early? */
+                else if (fsg->short_packet_received) {
+                        raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
+                        rc = -EINTR;
+                }
+
+                /* We haven't processed all the incoming data.  Even though
+                 * we may be allowed to stall, doing so would cause a race.
+                 * The controller may already have ACK'ed all the remaining
+                 * bulk-out packets, in which case the host wouldn't see a
+                 * STALL.  Not realizing the endpoint was halted, it wouldn't
+                 * clear the halt -- leading to problems later on. */
+#if 0
+                else if (mod_data.can_stall) {
+                        fsg_set_halt(fsg, fsg->bulk_out);
+                        raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
+                        rc = -EINTR;
+                }
+#endif
+
+                /* We can't stall.  Read in the excess data and throw it
+                 * all away. */
+                else
+                        rc = throw_away_data(fsg);
+                break;
+        }
+        return rc;
+}
+
+
+static int send_status(struct fsg_dev *fsg)
+{
+        struct fsg_lun          *curlun = fsg->curlun;
+        struct fsg_buffhd       *bh;
+        int                     rc;
+        u8                      status = USB_STATUS_PASS;
+        u32                     sd, sdinfo = 0;
+
+        /* Wait for the next buffer to become available */
+        bh = fsg->next_buffhd_to_fill;
+        while (bh->state != BUF_STATE_EMPTY) {
+                rc = sleep_thread(fsg);
+                if (rc)
+                        return rc;
+        }
+
+        if (curlun) {
+                sd = curlun->sense_data;
+                sdinfo = curlun->sense_data_info;
+        } else if (fsg->bad_lun_okay)
+                sd = SS_NO_SENSE;
+        else
+                sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
+
+        if (fsg->phase_error) {
+                DBG(fsg, "sending phase-error status\n");
+                status = USB_STATUS_PHASE_ERROR;
+                sd = SS_INVALID_COMMAND;
+        } else if (sd != SS_NO_SENSE) {
+                DBG(fsg, "sending command-failure status\n");
+                status = USB_STATUS_FAIL;
+                VDBG(fsg, "  sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
+                                "  info x%x\n",
+                                SK(sd), ASC(sd), ASCQ(sd), sdinfo);
+        }
+
+        if (transport_is_bbb()) {
+                struct bulk_cs_wrap     *csw = bh->buf;
+
+                /* Store and send the Bulk-only CSW */
+                csw->Signature = cpu_to_le32(USB_BULK_CS_SIG);
+                csw->Tag = fsg->tag;
+                csw->Residue = cpu_to_le32(fsg->residue);
+                csw->Status = status;
+
+                bh->inreq->length = USB_BULK_CS_WRAP_LEN;
+                bh->inreq->zero = 0;
+                start_transfer(fsg, fsg->bulk_in, bh->inreq,
+                                &bh->inreq_busy, &bh->state);
+
+        } else if (mod_data.transport_type == USB_PR_CB) {
+
+                /* Control-Bulk transport has no status phase! */
+                return 0;
+
+        } else {                        // USB_PR_CBI
+                struct interrupt_data   *buf = bh->buf;
+
+                /* Store and send the Interrupt data.  UFI sends the ASC
+                 * and ASCQ bytes.  Everything else sends a Type (which
+                 * is always 0) and the status Value. */
+                if (mod_data.protocol_type == USB_SC_UFI) {
+                        buf->bType = ASC(sd);
+                        buf->bValue = ASCQ(sd);
+                } else {
+                        buf->bType = 0;
+                        buf->bValue = status;
+                }
+                fsg->intreq->length = CBI_INTERRUPT_DATA_LEN;
+
+                fsg->intr_buffhd = bh;          // Point to the right buffhd
+                fsg->intreq->buf = bh->inreq->buf;
+                fsg->intreq->context = bh;
+                start_transfer(fsg, fsg->intr_in, fsg->intreq,
+                                &fsg->intreq_busy, &bh->state);
+        }
+
+        fsg->next_buffhd_to_fill = bh->next;
+        return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* Check whether the command is properly formed and whether its data size
+ * and direction agree with the values we already have. */
+static int check_command(struct fsg_dev *fsg, int cmnd_size,
+                enum data_direction data_dir, unsigned int mask,
+                int needs_medium, const char *name)
+{
+        int                     i;
+        int                     lun = fsg->cmnd[1] >> 5;
+        static const char       dirletter[4] = {'u', 'o', 'i', 'n'};
+        char                    hdlen[20];
+        struct fsg_lun          *curlun;
+
+        /* Adjust the expected cmnd_size for protocol encapsulation padding.
+         * Transparent SCSI doesn't pad. */
+        if (protocol_is_scsi())
+                ;
+
+        /* There's some disagreement as to whether RBC pads commands or not.
+         * We'll play it safe and accept either form. */
+        else if (mod_data.protocol_type == USB_SC_RBC) {
+                if (fsg->cmnd_size == 12)
+                        cmnd_size = 12;
+
+        /* All the other protocols pad to 12 bytes */
+        } else
+                cmnd_size = 12;
+
+        hdlen[0] = 0;
+        if (fsg->data_dir != DATA_DIR_UNKNOWN)
+                sprintf(hdlen, ", H%c=%u", dirletter[(int) fsg->data_dir],
+                                fsg->data_size);
+        VDBG(fsg, "SCSI command: %s;  Dc=%d, D%c=%u;  Hc=%d%s\n",
+                        name, cmnd_size, dirletter[(int) data_dir],
+                        fsg->data_size_from_cmnd, fsg->cmnd_size, hdlen);
+
+        /* We can't reply at all until we know the correct data direction
+         * and size. */
+        if (fsg->data_size_from_cmnd == 0)
+                data_dir = DATA_DIR_NONE;
+        if (fsg->data_dir == DATA_DIR_UNKNOWN) {        // CB or CBI
+                fsg->data_dir = data_dir;
+                fsg->data_size = fsg->data_size_from_cmnd;
+
+        } else {                                        // Bulk-only
+                if (fsg->data_size < fsg->data_size_from_cmnd) {
+
+                        /* Host data size < Device data size is a phase error.
+                         * Carry out the command, but only transfer as much
+                         * as we are allowed. */
+                        fsg->data_size_from_cmnd = fsg->data_size;
+                        fsg->phase_error = 1;
+                }
+        }
+        fsg->residue = fsg->usb_amount_left = fsg->data_size;
+
+        /* Conflicting data directions is a phase error */
+        if (fsg->data_dir != data_dir && fsg->data_size_from_cmnd > 0) {
+                fsg->phase_error = 1;
+                return -EINVAL;
+        }
+
+        /* Verify the length of the command itself */
+        if (cmnd_size != fsg->cmnd_size) {
+
+                /* Special case workaround: There are plenty of buggy SCSI
+                 * implementations. Many have issues with cbw->Length
+                 * field passing a wrong command size. For those cases we
+                 * always try to work around the problem by using the length
+                 * sent by the host side provided it is at least as large
+                 * as the correct command length.
+                 * Examples of such cases would be MS-Windows, which issues
+                 * REQUEST SENSE with cbw->Length == 12 where it should
+                 * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
+                 * REQUEST SENSE with cbw->Length == 10 where it should
+                 * be 6 as well.
+                 */
+                if (cmnd_size <= fsg->cmnd_size) {
+                        DBG(fsg, "%s is buggy! Expected length %d "
+                                        "but we got %d\n", name,
+                                        cmnd_size, fsg->cmnd_size);
+                        cmnd_size = fsg->cmnd_size;
+                } else {
+                        fsg->phase_error = 1;
+                        return -EINVAL;
+                }
+        }
+
+        /* Check that the LUN values are consistent */
+        if (transport_is_bbb()) {
+                if (fsg->lun != lun)
+                        DBG(fsg, "using LUN %d from CBW, "
+                                        "not LUN %d from CDB\n",
+                                        fsg->lun, lun);
+        } else
+                fsg->lun = lun;         // Use LUN from the command
+
+        /* Check the LUN */
+        if (fsg->lun < fsg->nluns) {
+                fsg->curlun = curlun = &fsg->luns[fsg->lun];
+                if (fsg->cmnd[0] != REQUEST_SENSE) {
+                        curlun->sense_data = SS_NO_SENSE;
+                        curlun->sense_data_info = 0;
+                        curlun->info_valid = 0;
+                }
+        } else {
+                fsg->curlun = curlun = NULL;
+                fsg->bad_lun_okay = 0;
+
+                /* INQUIRY and REQUEST SENSE commands are explicitly allowed
+                 * to use unsupported LUNs; all others may not. */
+                if (fsg->cmnd[0] != INQUIRY &&
+                                fsg->cmnd[0] != REQUEST_SENSE) {
+                        DBG(fsg, "unsupported LUN %d\n", fsg->lun);
+                        return -EINVAL;
+                }
+        }
+
+        /* If a unit attention condition exists, only INQUIRY and
+         * REQUEST SENSE commands are allowed; anything else must fail. */
+        if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
+                        fsg->cmnd[0] != INQUIRY &&
+                        fsg->cmnd[0] != REQUEST_SENSE) {
+                curlun->sense_data = curlun->unit_attention_data;
+                curlun->unit_attention_data = SS_NO_SENSE;
+                return -EINVAL;
+        }
+
+        /* Check that only command bytes listed in the mask are non-zero */
+        fsg->cmnd[1] &= 0x1f;                   // Mask away the LUN
+        for (i = 1; i < cmnd_size; ++i) {
+                if (fsg->cmnd[i] && !(mask & (1 << i))) {
+                        if (curlun)
+                                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                        return -EINVAL;
+                }
+        }
+
+        /* If the medium isn't mounted and the command needs to access
+         * it, return an error. */
+        if (curlun && !fsg_lun_is_open(curlun) && needs_medium) {
+                curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+
+static int do_scsi_command(struct fsg_dev *fsg)
+{
+        struct fsg_buffhd       *bh;
+        int                     rc;
+        int                     reply = -EINVAL;
+        int                     i;
+        static char             unknown[16];
+
+        dump_cdb(fsg);
+
+        /* Wait for the next buffer to become available for data or status */
+        bh = fsg->next_buffhd_to_drain = fsg->next_buffhd_to_fill;
+        while (bh->state != BUF_STATE_EMPTY) {
+                rc = sleep_thread(fsg);
+                if (rc)
+                        return rc;
+        }
+        fsg->phase_error = 0;
+        fsg->short_packet_received = 0;
+
+        down_read(&fsg->filesem);       // We're using the backing file
+        switch (fsg->cmnd[0]) {
+
+        case INQUIRY:
+                fsg->data_size_from_cmnd = fsg->cmnd[4];
+                if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
+                                (1<<4), 0,
+                                "INQUIRY")) == 0)
+                        reply = do_inquiry(fsg, bh);
+                break;
+
+        case MODE_SELECT:
+                fsg->data_size_from_cmnd = fsg->cmnd[4];
+                if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
+                                (1<<1) | (1<<4), 0,
+                                "MODE SELECT(6)")) == 0)
+                        reply = do_mode_select(fsg, bh);
+                break;
+
+        case MODE_SELECT_10:
+                fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+                if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
+                                (1<<1) | (3<<7), 0,
+                                "MODE SELECT(10)")) == 0)
+                        reply = do_mode_select(fsg, bh);
+                break;
+
+        case MODE_SENSE:
+                fsg->data_size_from_cmnd = fsg->cmnd[4];
+                if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
+                                (1<<1) | (1<<2) | (1<<4), 0,
+                                "MODE SENSE(6)")) == 0)
+                        reply = do_mode_sense(fsg, bh);
+                break;
+
+        case MODE_SENSE_10:
+                fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+                if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+                                (1<<1) | (1<<2) | (3<<7), 0,
+                                "MODE SENSE(10)")) == 0)
+                        reply = do_mode_sense(fsg, bh);
+                break;
+
+        case ALLOW_MEDIUM_REMOVAL:
+                fsg->data_size_from_cmnd = 0;
+                if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
+                                (1<<4), 0,
+                                "PREVENT-ALLOW MEDIUM REMOVAL")) == 0)
+                        reply = do_prevent_allow(fsg);
+                break;
+
+        case READ_6:
+                i = fsg->cmnd[4];
+                fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
+                if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
+                                (7<<1) | (1<<4), 1,
+                                "READ(6)")) == 0)
+                        reply = do_read(fsg);
+                break;
+
+        case READ_10:
+                fsg->data_size_from_cmnd =
+                                get_unaligned_be16(&fsg->cmnd[7]) << 9;
+                if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+                                (1<<1) | (0xf<<2) | (3<<7), 1,
+                                "READ(10)")) == 0)
+                        reply = do_read(fsg);
+                break;
+
+        case READ_12:
+                fsg->data_size_from_cmnd =
+                                get_unaligned_be32(&fsg->cmnd[6]) << 9;
+                if ((reply = check_command(fsg, 12, DATA_DIR_TO_HOST,
+                                (1<<1) | (0xf<<2) | (0xf<<6), 1,
+                                "READ(12)")) == 0)
+                        reply = do_read(fsg);
+                break;
+
+        case READ_CAPACITY:
+                fsg->data_size_from_cmnd = 8;
+                if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+                                (0xf<<2) | (1<<8), 1,
+                                "READ CAPACITY")) == 0)
+                        reply = do_read_capacity(fsg, bh);
+                break;
+
+        case READ_HEADER:
+                if (!mod_data.cdrom)
+                        goto unknown_cmnd;
+                fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+                if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+                                (3<<7) | (0x1f<<1), 1,
+                                "READ HEADER")) == 0)
+                        reply = do_read_header(fsg, bh);
+                break;
+
+        case READ_TOC:
+                if (!mod_data.cdrom)
+                        goto unknown_cmnd;
+                fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+                if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+                                (7<<6) | (1<<1), 1,
+                                "READ TOC")) == 0)
+                        reply = do_read_toc(fsg, bh);
+                break;
+
+        case READ_FORMAT_CAPACITIES:
+                fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+                if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+                                (3<<7), 1,
+                                "READ FORMAT CAPACITIES")) == 0)
+                        reply = do_read_format_capacities(fsg, bh);
+                break;
+
+        case REQUEST_SENSE:
+                fsg->data_size_from_cmnd = fsg->cmnd[4];
+                if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
+                                (1<<4), 0,
+                                "REQUEST SENSE")) == 0)
+                        reply = do_request_sense(fsg, bh);
+                break;
+
+        case START_STOP:
+                fsg->data_size_from_cmnd = 0;
+                if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
+                                (1<<1) | (1<<4), 0,
+                                "START-STOP UNIT")) == 0)
+                        reply = do_start_stop(fsg);
+                break;
+
+        case SYNCHRONIZE_CACHE:
+                fsg->data_size_from_cmnd = 0;
+                if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
+                                (0xf<<2) | (3<<7), 1,
+                                "SYNCHRONIZE CACHE")) == 0)
+                        reply = do_synchronize_cache(fsg);
+                break;
+
+        case TEST_UNIT_READY:
+                fsg->data_size_from_cmnd = 0;
+                reply = check_command(fsg, 6, DATA_DIR_NONE,
+                                0, 1,
+                                "TEST UNIT READY");
+                break;
+
+        /* Although optional, this command is used by MS-Windows.  We
+         * support a minimal version: BytChk must be 0. */
+        case VERIFY:
+                fsg->data_size_from_cmnd = 0;
+                if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
+                                (1<<1) | (0xf<<2) | (3<<7), 1,
+                                "VERIFY")) == 0)
+                        reply = do_verify(fsg);
+                break;
+
+        case WRITE_6:
+                i = fsg->cmnd[4];
+                fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
+                if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
+                                (7<<1) | (1<<4), 1,
+                                "WRITE(6)")) == 0)
+                        reply = do_write(fsg);
+                break;
+
+        case WRITE_10:
+                fsg->data_size_from_cmnd =
+                                get_unaligned_be16(&fsg->cmnd[7]) << 9;
+                if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
+                                (1<<1) | (0xf<<2) | (3<<7), 1,
+                                "WRITE(10)")) == 0)
+                        reply = do_write(fsg);
+                break;
+
+        case WRITE_12:
+                fsg->data_size_from_cmnd =
+                                get_unaligned_be32(&fsg->cmnd[6]) << 9;
+                if ((reply = check_command(fsg, 12, DATA_DIR_FROM_HOST,
+                                (1<<1) | (0xf<<2) | (0xf<<6), 1,
+                                "WRITE(12)")) == 0)
+                        reply = do_write(fsg);
+                break;
+
+        /* Some mandatory commands that we recognize but don't implement.
+         * They don't mean much in this setting.  It's left as an exercise
+         * for anyone interested to implement RESERVE and RELEASE in terms
+         * of Posix locks. */
+        case FORMAT_UNIT:
+        case RELEASE:
+        case RESERVE:
+        case SEND_DIAGNOSTIC:
+                // Fall through
+
+        default:
+ unknown_cmnd:
+                fsg->data_size_from_cmnd = 0;
+                sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]);
+                if ((reply = check_command(fsg, fsg->cmnd_size,
+                                DATA_DIR_UNKNOWN, 0xff, 0, unknown)) == 0) {
+                        fsg->curlun->sense_data = SS_INVALID_COMMAND;
+                        reply = -EINVAL;
+                }
+                break;
+        }
+        up_read(&fsg->filesem);
+
+        if (reply == -EINTR || signal_pending(current))
+                return -EINTR;
+
+        /* Set up the single reply buffer for finish_reply() */
+        if (reply == -EINVAL)
+                reply = 0;              // Error reply length
+        if (reply >= 0 && fsg->data_dir == DATA_DIR_TO_HOST) {
+                reply = min((u32) reply, fsg->data_size_from_cmnd);
+                bh->inreq->length = reply;
+                bh->state = BUF_STATE_FULL;
+                fsg->residue -= reply;
+        }                               // Otherwise it's already set
+
+        return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+        struct usb_request              *req = bh->outreq;
+        struct fsg_bulk_cb_wrap *cbw = req->buf;
+
+        /* Was this a real packet?  Should it be ignored? */
+        if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
+                return -EINVAL;
+
+        /* Is the CBW valid? */
+        if (req->actual != USB_BULK_CB_WRAP_LEN ||
+                        cbw->Signature != cpu_to_le32(
+                                USB_BULK_CB_SIG)) {
+                DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
+                                req->actual,
+                                le32_to_cpu(cbw->Signature));
+
+                /* The Bulk-only spec says we MUST stall the IN endpoint
+                 * (6.6.1), so it's unavoidable.  It also says we must
+                 * retain this state until the next reset, but there's
+                 * no way to tell the controller driver it should ignore
+                 * Clear-Feature(HALT) requests.
+                 *
+                 * We aren't required to halt the OUT endpoint; instead
+                 * we can simply accept and discard any data received
+                 * until the next reset. */
+                wedge_bulk_in_endpoint(fsg);
+                set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
+                return -EINVAL;
+        }
+
+        /* Is the CBW meaningful? */
+        if (cbw->Lun >= FSG_MAX_LUNS || cbw->Flags & ~USB_BULK_IN_FLAG ||
+                        cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) {
+                DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
+                                "cmdlen %u\n",
+                                cbw->Lun, cbw->Flags, cbw->Length);
+
+                /* We can do anything we want here, so let's stall the
+                 * bulk pipes if we are allowed to. */
+                if (mod_data.can_stall) {
+                        fsg_set_halt(fsg, fsg->bulk_out);
+                        halt_bulk_in_endpoint(fsg);
+                }
+                return -EINVAL;
+        }
+
+        /* Save the command for later */
+        fsg->cmnd_size = cbw->Length;
+        memcpy(fsg->cmnd, cbw->CDB, fsg->cmnd_size);
+        if (cbw->Flags & USB_BULK_IN_FLAG)
+                fsg->data_dir = DATA_DIR_TO_HOST;
+        else
+                fsg->data_dir = DATA_DIR_FROM_HOST;
+        fsg->data_size = le32_to_cpu(cbw->DataTransferLength);
+        if (fsg->data_size == 0)
+                fsg->data_dir = DATA_DIR_NONE;
+        fsg->lun = cbw->Lun;
+        fsg->tag = cbw->Tag;
+        return 0;
+}
+
+
+static int get_next_command(struct fsg_dev *fsg)
+{
+        struct fsg_buffhd       *bh;
+        int                     rc = 0;
+
+        if (transport_is_bbb()) {
+
+                /* Wait for the next buffer to become available */
+                bh = fsg->next_buffhd_to_fill;
+                while (bh->state != BUF_STATE_EMPTY) {
+                        rc = sleep_thread(fsg);
+                        if (rc)
+                                return rc;
+                }
+
+                /* Queue a request to read a Bulk-only CBW */
+                set_bulk_out_req_length(fsg, bh, USB_BULK_CB_WRAP_LEN);
+                bh->outreq->short_not_ok = 1;
+                start_transfer(fsg, fsg->bulk_out, bh->outreq,
+                                &bh->outreq_busy, &bh->state);
+
+                /* We will drain the buffer in software, which means we
+                 * can reuse it for the next filling.  No need to advance
+                 * next_buffhd_to_fill. */
+
+                /* Wait for the CBW to arrive */
+                while (bh->state != BUF_STATE_FULL) {
+                        rc = sleep_thread(fsg);
+                        if (rc)
+                                return rc;
+                }
+                smp_rmb();
+                rc = received_cbw(fsg, bh);
+                bh->state = BUF_STATE_EMPTY;
+
+        } else {                // USB_PR_CB or USB_PR_CBI
+
+                /* Wait for the next command to arrive */
+                while (fsg->cbbuf_cmnd_size == 0) {
+                        rc = sleep_thread(fsg);
+                        if (rc)
+                                return rc;
+                }
+
+                /* Is the previous status interrupt request still busy?
+                 * The host is allowed to skip reading the status,
+                 * so we must cancel it. */
+                if (fsg->intreq_busy)
+                        usb_ep_dequeue(fsg->intr_in, fsg->intreq);
+
+                /* Copy the command and mark the buffer empty */
+                fsg->data_dir = DATA_DIR_UNKNOWN;
+                spin_lock_irq(&fsg->lock);
+                fsg->cmnd_size = fsg->cbbuf_cmnd_size;
+                memcpy(fsg->cmnd, fsg->cbbuf_cmnd, fsg->cmnd_size);
+                fsg->cbbuf_cmnd_size = 0;
+                spin_unlock_irq(&fsg->lock);
+        }
+        return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int enable_endpoint(struct fsg_dev *fsg, struct usb_ep *ep,
+                const struct usb_endpoint_descriptor *d)
+{
+        int     rc;
+
+        ep->driver_data = fsg;
+        ep->desc = d;
+        rc = usb_ep_enable(ep);
+        if (rc)
+                ERROR(fsg, "can't enable %s, result %d\n", ep->name, rc);
+        return rc;
+}
+
+static int alloc_request(struct fsg_dev *fsg, struct usb_ep *ep,
+                struct usb_request **preq)
+{
+        *preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
+        if (*preq)
+                return 0;
+        ERROR(fsg, "can't allocate request for %s\n", ep->name);
+        return -ENOMEM;
+}
+
+/*
+ * Reset interface setting and re-init endpoint state (toggle etc).
+ * Call with altsetting < 0 to disable the interface.  The only other
+ * available altsetting is 0, which enables the interface.
+ */
+static int do_set_interface(struct fsg_dev *fsg, int altsetting)
+{
+        int     rc = 0;
+        int     i;
+        const struct usb_endpoint_descriptor    *d;
+
+        if (fsg->running)
+                DBG(fsg, "reset interface\n");
+
+reset:
+        /* Deallocate the requests */
+        for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+                struct fsg_buffhd *bh = &fsg->buffhds[i];
+
+                if (bh->inreq) {
+                        usb_ep_free_request(fsg->bulk_in, bh->inreq);
+                        bh->inreq = NULL;
+                }
+                if (bh->outreq) {
+                        usb_ep_free_request(fsg->bulk_out, bh->outreq);
+                        bh->outreq = NULL;
+                }
+        }
+        if (fsg->intreq) {
+                usb_ep_free_request(fsg->intr_in, fsg->intreq);
+                fsg->intreq = NULL;
+        }
+
+        /* Disable the endpoints */
+        if (fsg->bulk_in_enabled) {
+                usb_ep_disable(fsg->bulk_in);
+                fsg->bulk_in_enabled = 0;
+        }
+        if (fsg->bulk_out_enabled) {
+                usb_ep_disable(fsg->bulk_out);
+                fsg->bulk_out_enabled = 0;
+        }
+        if (fsg->intr_in_enabled) {
+                usb_ep_disable(fsg->intr_in);
+                fsg->intr_in_enabled = 0;
+        }
+
+        fsg->running = 0;
+        if (altsetting < 0 || rc != 0)
+                return rc;
+
+        DBG(fsg, "set interface %d\n", altsetting);
+
+        /* Enable the endpoints */
+        d = fsg_ep_desc(fsg->gadget,
+                        &fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc);
+        if ((rc = enable_endpoint(fsg, fsg->bulk_in, d)) != 0)
+                goto reset;
+        fsg->bulk_in_enabled = 1;
+
+        d = fsg_ep_desc(fsg->gadget,
+                        &fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc);
+        if ((rc = enable_endpoint(fsg, fsg->bulk_out, d)) != 0)
+                goto reset;
+        fsg->bulk_out_enabled = 1;
+        fsg->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
+        clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
+
+        if (transport_is_cbi()) {
+                d = fsg_ep_desc(fsg->gadget,
+                                &fsg_fs_intr_in_desc, &fsg_hs_intr_in_desc);
+                if ((rc = enable_endpoint(fsg, fsg->intr_in, d)) != 0)
+                        goto reset;
+                fsg->intr_in_enabled = 1;
+        }
+
+        /* Allocate the requests */
+        for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+                struct fsg_buffhd       *bh = &fsg->buffhds[i];
+
+                if ((rc = alloc_request(fsg, fsg->bulk_in, &bh->inreq)) != 0)
+                        goto reset;
+                if ((rc = alloc_request(fsg, fsg->bulk_out, &bh->outreq)) != 0)
+                        goto reset;
+                bh->inreq->buf = bh->outreq->buf = bh->buf;
+                bh->inreq->context = bh->outreq->context = bh;
+                bh->inreq->complete = bulk_in_complete;
+                bh->outreq->complete = bulk_out_complete;
+        }
+        if (transport_is_cbi()) {
+                if ((rc = alloc_request(fsg, fsg->intr_in, &fsg->intreq)) != 0)
+                        goto reset;
+                fsg->intreq->complete = intr_in_complete;
+        }
+
+        fsg->running = 1;
+        for (i = 0; i < fsg->nluns; ++i)
+                fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
+        return rc;
+}
+
+
+/*
+ * Change our operational configuration.  This code must agree with the code
+ * that returns config descriptors, and with interface altsetting code.
+ *
+ * It's also responsible for power management interactions.  Some
+ * configurations might not work with our current power sources.
+ * For now we just assume the gadget is always self-powered.
+ */
+static int do_set_config(struct fsg_dev *fsg, u8 new_config)
+{
+        int     rc = 0;
+
+        /* Disable the single interface */
+        if (fsg->config != 0) {
+                DBG(fsg, "reset config\n");
+                fsg->config = 0;
+                rc = do_set_interface(fsg, -1);
+        }
+
+        /* Enable the interface */
+        if (new_config != 0) {
+                fsg->config = new_config;
+                if ((rc = do_set_interface(fsg, 0)) != 0)
+                        fsg->config = 0;        // Reset on errors
+                else {
+                        char *speed;
+
+                        switch (fsg->gadget->speed) {
+                        case USB_SPEED_LOW:     speed = "low";  break;
+                        case USB_SPEED_FULL:    speed = "full"; break;
+                        case USB_SPEED_HIGH:    speed = "high"; break;
+                        default:                speed = "?";    break;
+                        }
+                        INFO(fsg, "%s speed config #%d\n", speed, fsg->config);
+                }
+        }
+        return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static void handle_exception(struct fsg_dev *fsg)
+{
+        siginfo_t               info;
+        int                     sig;
+        int                     i;
+        int                     num_active;
+        struct fsg_buffhd       *bh;
+        enum fsg_state          old_state;
+        u8                      new_config;
+        struct fsg_lun          *curlun;
+        unsigned int            exception_req_tag;
+        int                     rc;
+
+        /* Clear the existing signals.  Anything but SIGUSR1 is converted
+         * into a high-priority EXIT exception. */
+        for (;;) {
+                sig = dequeue_signal_lock(current, &current->blocked, &info);
+                if (!sig)
+                        break;
+                if (sig != SIGUSR1) {
+                        if (fsg->state < FSG_STATE_EXIT)
+                                DBG(fsg, "Main thread exiting on signal\n");
+                        raise_exception(fsg, FSG_STATE_EXIT);
+                }
+        }
+
+        /* Cancel all the pending transfers */
+        if (fsg->intreq_busy)
+                usb_ep_dequeue(fsg->intr_in, fsg->intreq);
+        for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+                bh = &fsg->buffhds[i];
+                if (bh->inreq_busy)
+                        usb_ep_dequeue(fsg->bulk_in, bh->inreq);
+                if (bh->outreq_busy)
+                        usb_ep_dequeue(fsg->bulk_out, bh->outreq);
+        }
+
+        /* Wait until everything is idle */
+        for (;;) {
+                num_active = fsg->intreq_busy;
+                for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+                        bh = &fsg->buffhds[i];
+                        num_active += bh->inreq_busy + bh->outreq_busy;
+                }
+                if (num_active == 0)
+                        break;
+                if (sleep_thread(fsg))
+                        return;
+        }
+
+        /* Clear out the controller's fifos */
+        if (fsg->bulk_in_enabled)
+                usb_ep_fifo_flush(fsg->bulk_in);
+        if (fsg->bulk_out_enabled)
+                usb_ep_fifo_flush(fsg->bulk_out);
+        if (fsg->intr_in_enabled)
+                usb_ep_fifo_flush(fsg->intr_in);
+
+        /* Reset the I/O buffer states and pointers, the SCSI
+         * state, and the exception.  Then invoke the handler. */
+        spin_lock_irq(&fsg->lock);
+
+        for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+                bh = &fsg->buffhds[i];
+                bh->state = BUF_STATE_EMPTY;
+        }
+        fsg->next_buffhd_to_fill = fsg->next_buffhd_to_drain =
+                        &fsg->buffhds[0];
+
+        exception_req_tag = fsg->exception_req_tag;
+        new_config = fsg->new_config;
+        old_state = fsg->state;
+
+        if (old_state == FSG_STATE_ABORT_BULK_OUT)
+                fsg->state = FSG_STATE_STATUS_PHASE;
+        else {
+                for (i = 0; i < fsg->nluns; ++i) {
+                        curlun = &fsg->luns[i];
+                        curlun->prevent_medium_removal = 0;
+                        curlun->sense_data = curlun->unit_attention_data =
+                                        SS_NO_SENSE;
+                        curlun->sense_data_info = 0;
+                        curlun->info_valid = 0;
+                }
+                fsg->state = FSG_STATE_IDLE;
+        }
+        spin_unlock_irq(&fsg->lock);
+
+        /* Carry out any extra actions required for the exception */
+        switch (old_state) {
+        default:
+                break;
+
+        case FSG_STATE_ABORT_BULK_OUT:
+                send_status(fsg);
+                spin_lock_irq(&fsg->lock);
+                if (fsg->state == FSG_STATE_STATUS_PHASE)
+                        fsg->state = FSG_STATE_IDLE;
+                spin_unlock_irq(&fsg->lock);
+                break;
+
+        case FSG_STATE_RESET:
+                /* In case we were forced against our will to halt a
+                 * bulk endpoint, clear the halt now.  (The SuperH UDC
+                 * requires this.) */
+                if (test_and_clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
+                        usb_ep_clear_halt(fsg->bulk_in);
+
+                if (transport_is_bbb()) {
+                        if (fsg->ep0_req_tag == exception_req_tag)
+                                ep0_queue(fsg); // Complete the status stage
+
+                } else if (transport_is_cbi())
+                        send_status(fsg);       // Status by interrupt pipe
+
+                /* Technically this should go here, but it would only be
+                 * a waste of time.  Ditto for the INTERFACE_CHANGE and
+                 * CONFIG_CHANGE cases. */
+                // for (i = 0; i < fsg->nluns; ++i)
+                //      fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
+                break;
+
+        case FSG_STATE_INTERFACE_CHANGE:
+                rc = do_set_interface(fsg, 0);
+                if (fsg->ep0_req_tag != exception_req_tag)
+                        break;
+                if (rc != 0)                    // STALL on errors
+                        fsg_set_halt(fsg, fsg->ep0);
+                else                            // Complete the status stage
+                        ep0_queue(fsg);
+                break;
+
+        case FSG_STATE_CONFIG_CHANGE:
+                rc = do_set_config(fsg, new_config);
+                if (fsg->ep0_req_tag != exception_req_tag)
+                        break;
+                if (rc != 0)                    // STALL on errors
+                        fsg_set_halt(fsg, fsg->ep0);
+                else                            // Complete the status stage
+                        ep0_queue(fsg);
+                break;
+
+        case FSG_STATE_DISCONNECT:
+                for (i = 0; i < fsg->nluns; ++i)
+                        fsg_lun_fsync_sub(fsg->luns + i);
+                do_set_config(fsg, 0);          // Unconfigured state
+                break;
+
+        case FSG_STATE_EXIT:
+        case FSG_STATE_TERMINATED:
+                do_set_config(fsg, 0);                  // Free resources
+                spin_lock_irq(&fsg->lock);
+                fsg->state = FSG_STATE_TERMINATED;      // Stop the thread
+                spin_unlock_irq(&fsg->lock);
+                break;
+        }
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int fsg_main_thread(void *fsg_)
+{
+        struct fsg_dev          *fsg = fsg_;
+
+        /* Allow the thread to be killed by a signal, but set the signal mask
+         * to block everything but INT, TERM, KILL, and USR1. */
+        allow_signal(SIGINT);
+        allow_signal(SIGTERM);
+        allow_signal(SIGKILL);
+        allow_signal(SIGUSR1);
+
+        /* Allow the thread to be frozen */
+        set_freezable();
+
+        /* Arrange for userspace references to be interpreted as kernel
+         * pointers.  That way we can pass a kernel pointer to a routine
+         * that expects a __user pointer and it will work okay. */
+        set_fs(get_ds());
+
+        /* The main loop */
+        while (fsg->state != FSG_STATE_TERMINATED) {
+                if (exception_in_progress(fsg) || signal_pending(current)) {
+                        handle_exception(fsg);
+                        continue;
+                }
+
+                if (!fsg->running) {
+                        sleep_thread(fsg);
+                        continue;
+                }
+
+                if (get_next_command(fsg))
+                        continue;
+
+                spin_lock_irq(&fsg->lock);
+                if (!exception_in_progress(fsg))
+                        fsg->state = FSG_STATE_DATA_PHASE;
+                spin_unlock_irq(&fsg->lock);
+
+                if (do_scsi_command(fsg) || finish_reply(fsg))
+                        continue;
+
+                spin_lock_irq(&fsg->lock);
+                if (!exception_in_progress(fsg))
+                        fsg->state = FSG_STATE_STATUS_PHASE;
+                spin_unlock_irq(&fsg->lock);
+
+                if (send_status(fsg))
+                        continue;
+
+                spin_lock_irq(&fsg->lock);
+                if (!exception_in_progress(fsg))
+                        fsg->state = FSG_STATE_IDLE;
+                spin_unlock_irq(&fsg->lock);
+                }
+
+        spin_lock_irq(&fsg->lock);
+        fsg->thread_task = NULL;
+        spin_unlock_irq(&fsg->lock);
+
+        /* If we are exiting because of a signal, unregister the
+         * gadget driver. */
+        if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
+                usb_gadget_unregister_driver(&fsg_driver);
+
+        /* Let the unbind and cleanup routines know the thread has exited */
+        complete_and_exit(&fsg->thread_notifier, 0);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+
+/* The write permissions and store_xxx pointers are set in fsg_bind() */
+static DEVICE_ATTR(ro, 0444, fsg_show_ro, NULL);
+static DEVICE_ATTR(nofua, 0644, fsg_show_nofua, NULL);
+static DEVICE_ATTR(file, 0444, fsg_show_file, NULL);
+
+
+/*-------------------------------------------------------------------------*/
+
+static void fsg_release(struct kref *ref)
+{
+        struct fsg_dev  *fsg = container_of(ref, struct fsg_dev, ref);
+
+        kfree(fsg->luns);
+        kfree(fsg);
+}
+
+static void lun_release(struct device *dev)
+{
+        struct rw_semaphore     *filesem = dev_get_drvdata(dev);
+        struct fsg_dev          *fsg =
+                container_of(filesem, struct fsg_dev, filesem);
+
+        kref_put(&fsg->ref, fsg_release);
+}
+
+static void /* __init_or_exit */ fsg_unbind(struct usb_gadget *gadget)
+{
+        struct fsg_dev          *fsg = get_gadget_data(gadget);
+        int                     i;
+        struct fsg_lun          *curlun;
+        struct usb_request      *req = fsg->ep0req;
+
+        DBG(fsg, "unbind\n");
+        clear_bit(REGISTERED, &fsg->atomic_bitflags);
+
+        /* Unregister the sysfs attribute files and the LUNs */
+        for (i = 0; i < fsg->nluns; ++i) {
+                curlun = &fsg->luns[i];
+                if (curlun->registered) {
+                        device_remove_file(&curlun->dev, &dev_attr_nofua);
+                        device_remove_file(&curlun->dev, &dev_attr_ro);
+                        device_remove_file(&curlun->dev, &dev_attr_file);
+                        fsg_lun_close(curlun);
+                        device_unregister(&curlun->dev);
+                        curlun->registered = 0;
+                }
+        }
+
+        /* If the thread isn't already dead, tell it to exit now */
+        if (fsg->state != FSG_STATE_TERMINATED) {
+                raise_exception(fsg, FSG_STATE_EXIT);
+                wait_for_completion(&fsg->thread_notifier);
+
+                /* The cleanup routine waits for this completion also */
+                complete(&fsg->thread_notifier);
+        }
+
+        /* Free the data buffers */
+        for (i = 0; i < FSG_NUM_BUFFERS; ++i)
+                kfree(fsg->buffhds[i].buf);
+
+        /* Free the request and buffer for endpoint 0 */
+        if (req) {
+                kfree(req->buf);
+                usb_ep_free_request(fsg->ep0, req);
+        }
+
+        set_gadget_data(gadget, NULL);
+}
+
+
+static int __init check_parameters(struct fsg_dev *fsg)
+{
+        int     prot;
+        int     gcnum;
+
+        /* Store the default values */
+        mod_data.transport_type = USB_PR_BULK;
+        mod_data.transport_name = "Bulk-only";
+        mod_data.protocol_type = USB_SC_SCSI;
+        mod_data.protocol_name = "Transparent SCSI";
+
+        /* Some peripheral controllers are known not to be able to
+         * halt bulk endpoints correctly.  If one of them is present,
+         * disable stalls.
+         */
+        if (gadget_is_at91(fsg->gadget))
+                mod_data.can_stall = 0;
+
+        if (mod_data.release == 0xffff) {       // Parameter wasn't set
+                gcnum = usb_gadget_controller_number(fsg->gadget);
+                if (gcnum >= 0)
+                        mod_data.release = 0x0300 + gcnum;
+                else {
+                        WARNING(fsg, "controller '%s' not recognized\n",
+                                fsg->gadget->name);
+                        mod_data.release = 0x0399;
+                }
+        }
+
+        prot = simple_strtol(mod_data.protocol_parm, NULL, 0);
+
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+        if (strnicmp(mod_data.transport_parm, "BBB", 10) == 0) {
+                ;               // Use default setting
+        } else if (strnicmp(mod_data.transport_parm, "CB", 10) == 0) {
+                mod_data.transport_type = USB_PR_CB;
+                mod_data.transport_name = "Control-Bulk";
+        } else if (strnicmp(mod_data.transport_parm, "CBI", 10) == 0) {
+                mod_data.transport_type = USB_PR_CBI;
+                mod_data.transport_name = "Control-Bulk-Interrupt";
+        } else {
+                ERROR(fsg, "invalid transport: %s\n", mod_data.transport_parm);
+                return -EINVAL;
+        }
+
+        if (strnicmp(mod_data.protocol_parm, "SCSI", 10) == 0 ||
+                        prot == USB_SC_SCSI) {
+                ;               // Use default setting
+        } else if (strnicmp(mod_data.protocol_parm, "RBC", 10) == 0 ||
+                        prot == USB_SC_RBC) {
+                mod_data.protocol_type = USB_SC_RBC;
+                mod_data.protocol_name = "RBC";
+        } else if (strnicmp(mod_data.protocol_parm, "8020", 4) == 0 ||
+                        strnicmp(mod_data.protocol_parm, "ATAPI", 10) == 0 ||
+                        prot == USB_SC_8020) {
+                mod_data.protocol_type = USB_SC_8020;
+                mod_data.protocol_name = "8020i (ATAPI)";
+        } else if (strnicmp(mod_data.protocol_parm, "QIC", 3) == 0 ||
+                        prot == USB_SC_QIC) {
+                mod_data.protocol_type = USB_SC_QIC;
+                mod_data.protocol_name = "QIC-157";
+        } else if (strnicmp(mod_data.protocol_parm, "UFI", 10) == 0 ||
+                        prot == USB_SC_UFI) {
+                mod_data.protocol_type = USB_SC_UFI;
+                mod_data.protocol_name = "UFI";
+        } else if (strnicmp(mod_data.protocol_parm, "8070", 4) == 0 ||
+                        prot == USB_SC_8070) {
+                mod_data.protocol_type = USB_SC_8070;
+                mod_data.protocol_name = "8070i";
+        } else {
+                ERROR(fsg, "invalid protocol: %s\n", mod_data.protocol_parm);
+                return -EINVAL;
+        }
+
+        mod_data.buflen &= PAGE_CACHE_MASK;
+        if (mod_data.buflen <= 0) {
+                ERROR(fsg, "invalid buflen\n");
+                return -ETOOSMALL;
+        }
+
+#endif /* CONFIG_USB_FILE_STORAGE_TEST */
+
+        /* Serial string handling.
+         * On a real device, the serial string would be loaded
+         * from permanent storage. */
+        if (mod_data.serial) {
+                const char *ch;
+                unsigned len = 0;
+
+                /* Sanity check :
+                 * The CB[I] specification limits the serial string to
+                 * 12 uppercase hexadecimal characters.
+                 * BBB need at least 12 uppercase hexadecimal characters,
+                 * with a maximum of 126. */
+                for (ch = mod_data.serial; *ch; ++ch) {
+                        ++len;
+                        if ((*ch < '0' || *ch > '9') &&
+                            (*ch < 'A' || *ch > 'F')) { /* not uppercase hex */
+                                WARNING(fsg,
+                                        "Invalid serial string character: %c\n",
+                                        *ch);
+                                goto no_serial;
+                        }
+                }
+                if (len > 126 ||
+                    (mod_data.transport_type == USB_PR_BULK && len < 12) ||
+                    (mod_data.transport_type != USB_PR_BULK && len > 12)) {
+                        WARNING(fsg, "Invalid serial string length!\n");
+                        goto no_serial;
+                }
+                fsg_strings[FSG_STRING_SERIAL - 1].s = mod_data.serial;
+        } else {
+                WARNING(fsg, "No serial-number string provided!\n");
+ no_serial:
+                device_desc.iSerialNumber = 0;
+        }
+
+        return 0;
+}
+
+
+static int __init fsg_bind(struct usb_gadget *gadget)
+{
+        struct fsg_dev          *fsg = the_fsg;
+        int                     rc;
+        int                     i;
+        struct fsg_lun          *curlun;
+        struct usb_ep           *ep;
+        struct usb_request      *req;
+        char                    *pathbuf, *p;
+
+        fsg->gadget = gadget;
+        set_gadget_data(gadget, fsg);
+        fsg->ep0 = gadget->ep0;
+        fsg->ep0->driver_data = fsg;
+
+        if ((rc = check_parameters(fsg)) != 0)
+                goto out;
+
+        if (mod_data.removable) {       // Enable the store_xxx attributes
+                dev_attr_file.attr.mode = 0644;
+                dev_attr_file.store = fsg_store_file;
+                if (!mod_data.cdrom) {
+                        dev_attr_ro.attr.mode = 0644;
+                        dev_attr_ro.store = fsg_store_ro;
+                }
+        }
+
+        /* Only for removable media? */
+        dev_attr_nofua.attr.mode = 0644;
+        dev_attr_nofua.store = fsg_store_nofua;
+
+        /* Find out how many LUNs there should be */
+        i = mod_data.nluns;
+        if (i == 0)
+                i = max(mod_data.num_filenames, 1u);
+        if (i > FSG_MAX_LUNS) {
+                ERROR(fsg, "invalid number of LUNs: %d\n", i);
+                rc = -EINVAL;
+                goto out;
+        }
+
+        /* Create the LUNs, open their backing files, and register the
+         * LUN devices in sysfs. */
+        fsg->luns = kzalloc(i * sizeof(struct fsg_lun), GFP_KERNEL);
+        if (!fsg->luns) {
+                rc = -ENOMEM;
+                goto out;
+        }
+        fsg->nluns = i;
+
+        for (i = 0; i < fsg->nluns; ++i) {
+                curlun = &fsg->luns[i];
+                curlun->cdrom = !!mod_data.cdrom;
+                curlun->ro = mod_data.cdrom || mod_data.ro[i];
+                curlun->initially_ro = curlun->ro;
+                curlun->removable = mod_data.removable;
+                curlun->nofua = mod_data.nofua[i];
+                curlun->dev.release = lun_release;
+                curlun->dev.parent = &gadget->dev;
+                curlun->dev.driver = &fsg_driver.driver;
+                dev_set_drvdata(&curlun->dev, &fsg->filesem);
+                dev_set_name(&curlun->dev,"%s-lun%d",
+                             dev_name(&gadget->dev), i);
+
+                kref_get(&fsg->ref);
+                rc = device_register(&curlun->dev);
+                if (rc) {
+                        INFO(fsg, "failed to register LUN%d: %d\n", i, rc);
+                        put_device(&curlun->dev);
+                        goto out;
+                }
+                curlun->registered = 1;
+
+                rc = device_create_file(&curlun->dev, &dev_attr_ro);
+                if (rc)
+                        goto out;
+                rc = device_create_file(&curlun->dev, &dev_attr_nofua);
+                if (rc)
+                        goto out;
+                rc = device_create_file(&curlun->dev, &dev_attr_file);
+                if (rc)
+                        goto out;
+
+                if (mod_data.file[i] && *mod_data.file[i]) {
+                        rc = fsg_lun_open(curlun, mod_data.file[i]);
+                        if (rc)
+                                goto out;
+                } else if (!mod_data.removable) {
+                        ERROR(fsg, "no file given for LUN%d\n", i);
+                        rc = -EINVAL;
+                        goto out;
+                }
+        }
+
+        /* Find all the endpoints we will use */
+        usb_ep_autoconfig_reset(gadget);
+        ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc);
+        if (!ep)
+                goto autoconf_fail;
+        ep->driver_data = fsg;          // claim the endpoint
+        fsg->bulk_in = ep;
+
+        ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc);
+        if (!ep)
+                goto autoconf_fail;
+        ep->driver_data = fsg;          // claim the endpoint
+        fsg->bulk_out = ep;
+
+        if (transport_is_cbi()) {
+                ep = usb_ep_autoconfig(gadget, &fsg_fs_intr_in_desc);
+                if (!ep)
+                        goto autoconf_fail;
+                ep->driver_data = fsg;          // claim the endpoint
+                fsg->intr_in = ep;
+        }
+
+        /* Fix up the descriptors */
+        device_desc.idVendor = cpu_to_le16(mod_data.vendor);
+        device_desc.idProduct = cpu_to_le16(mod_data.product);
+        device_desc.bcdDevice = cpu_to_le16(mod_data.release);
+
+        i = (transport_is_cbi() ? 3 : 2);       // Number of endpoints
+        fsg_intf_desc.bNumEndpoints = i;
+        fsg_intf_desc.bInterfaceSubClass = mod_data.protocol_type;
+        fsg_intf_desc.bInterfaceProtocol = mod_data.transport_type;
+        fsg_fs_function[i + FSG_FS_FUNCTION_PRE_EP_ENTRIES] = NULL;
+
+        if (gadget_is_dualspeed(gadget)) {
+                fsg_hs_function[i + FSG_HS_FUNCTION_PRE_EP_ENTRIES] = NULL;
+
+                /* Assume endpoint addresses are the same for both speeds */
+                fsg_hs_bulk_in_desc.bEndpointAddress =
+                        fsg_fs_bulk_in_desc.bEndpointAddress;
+                fsg_hs_bulk_out_desc.bEndpointAddress =
+                        fsg_fs_bulk_out_desc.bEndpointAddress;
+                fsg_hs_intr_in_desc.bEndpointAddress =
+                        fsg_fs_intr_in_desc.bEndpointAddress;
+        }
+
+        if (gadget_is_otg(gadget))
+                fsg_otg_desc.bmAttributes |= USB_OTG_HNP;
+
+        rc = -ENOMEM;
+
+        /* Allocate the request and buffer for endpoint 0 */
+        fsg->ep0req = req = usb_ep_alloc_request(fsg->ep0, GFP_KERNEL);
+        if (!req)
+                goto out;
+        req->buf = kmalloc(EP0_BUFSIZE, GFP_KERNEL);
+        if (!req->buf)
+                goto out;
+        req->complete = ep0_complete;
+
+        /* Allocate the data buffers */
+        for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+                struct fsg_buffhd       *bh = &fsg->buffhds[i];
+
+                /* Allocate for the bulk-in endpoint.  We assume that
+                 * the buffer will also work with the bulk-out (and
+                 * interrupt-in) endpoint. */
+                bh->buf = kmalloc(mod_data.buflen, GFP_KERNEL);
+                if (!bh->buf)
+                        goto out;
+                bh->next = bh + 1;
+        }
+        fsg->buffhds[FSG_NUM_BUFFERS - 1].next = &fsg->buffhds[0];
+
+        /* This should reflect the actual gadget power source */
+        usb_gadget_set_selfpowered(gadget);
+
+        snprintf(fsg_string_manufacturer, sizeof fsg_string_manufacturer,
+                        "%s %s with %s",
+                        init_utsname()->sysname, init_utsname()->release,
+                        gadget->name);
+
+        fsg->thread_task = kthread_create(fsg_main_thread, fsg,
+                        "file-storage-gadget");
+        if (IS_ERR(fsg->thread_task)) {
+                rc = PTR_ERR(fsg->thread_task);
+                goto out;
+        }
+
+        INFO(fsg, DRIVER_DESC ", version: " DRIVER_VERSION "\n");
+        INFO(fsg, "NOTE: This driver is deprecated.  "
+                        "Consider using g_mass_storage instead.\n");
+        INFO(fsg, "Number of LUNs=%d\n", fsg->nluns);
+
+        pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
+        for (i = 0; i < fsg->nluns; ++i) {
+                curlun = &fsg->luns[i];
+                if (fsg_lun_is_open(curlun)) {
+                        p = NULL;
+                        if (pathbuf) {
+                                p = d_path(&curlun->filp->f_path,
+                                           pathbuf, PATH_MAX);
+                                if (IS_ERR(p))
+                                        p = NULL;
+                        }
+                        LINFO(curlun, "ro=%d, nofua=%d, file: %s\n",
+                              curlun->ro, curlun->nofua, (p ? p : "(error)"));
+                }
+        }
+        kfree(pathbuf);
+
+        DBG(fsg, "transport=%s (x%02x)\n",
+                        mod_data.transport_name, mod_data.transport_type);
+        DBG(fsg, "protocol=%s (x%02x)\n",
+                        mod_data.protocol_name, mod_data.protocol_type);
+        DBG(fsg, "VendorID=x%04x, ProductID=x%04x, Release=x%04x\n",
+                        mod_data.vendor, mod_data.product, mod_data.release);
+        DBG(fsg, "removable=%d, stall=%d, cdrom=%d, buflen=%u\n",
+                        mod_data.removable, mod_data.can_stall,
+                        mod_data.cdrom, mod_data.buflen);
+        DBG(fsg, "I/O thread pid: %d\n", task_pid_nr(fsg->thread_task));
+
+        set_bit(REGISTERED, &fsg->atomic_bitflags);
+
+        /* Tell the thread to start working */
+        wake_up_process(fsg->thread_task);
+        return 0;
+
+autoconf_fail:
+        ERROR(fsg, "unable to autoconfigure all endpoints\n");
+        rc = -ENOTSUPP;
+
+out:
+        fsg->state = FSG_STATE_TERMINATED;      // The thread is dead
+        fsg_unbind(gadget);
+        complete(&fsg->thread_notifier);
+        return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static void fsg_suspend(struct usb_gadget *gadget)
+{
+        struct fsg_dev          *fsg = get_gadget_data(gadget);
+
+        DBG(fsg, "suspend\n");
+        set_bit(SUSPENDED, &fsg->atomic_bitflags);
+}
+
+static void fsg_resume(struct usb_gadget *gadget)
+{
+        struct fsg_dev          *fsg = get_gadget_data(gadget);
+
+        DBG(fsg, "resume\n");
+        clear_bit(SUSPENDED, &fsg->atomic_bitflags);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static struct usb_gadget_driver         fsg_driver = {
+#ifdef CONFIG_USB_GADGET_DUALSPEED
+        .speed          = USB_SPEED_HIGH,
+#else
+        .speed          = USB_SPEED_FULL,
+#endif
+        .function       = (char *) fsg_string_product,
+        .unbind         = fsg_unbind,
+        .disconnect     = fsg_disconnect,
+        .setup          = fsg_setup,
+        .suspend        = fsg_suspend,
+        .resume         = fsg_resume,
+
+        .driver         = {
+                .name           = DRIVER_NAME,
+                .owner          = THIS_MODULE,
+                // .release = ...
+                // .suspend = ...
+                // .resume = ...
+        },
+};
+
+
+static int __init fsg_alloc(void)
+{
+        struct fsg_dev          *fsg;
+
+        fsg = kzalloc(sizeof *fsg, GFP_KERNEL);
+        if (!fsg)
+                return -ENOMEM;
+        spin_lock_init(&fsg->lock);
+        init_rwsem(&fsg->filesem);
+        kref_init(&fsg->ref);
+        init_completion(&fsg->thread_notifier);
+
+        the_fsg = fsg;
+        return 0;
+}
+
+
+static int __init fsg_init(void)
+{
+        int             rc;
+        struct fsg_dev  *fsg;
+
+        if ((rc = fsg_alloc()) != 0)
+                return rc;
+        fsg = the_fsg;
+        if ((rc = usb_gadget_probe_driver(&fsg_driver, fsg_bind)) != 0)
+                kref_put(&fsg->ref, fsg_release);
+        return rc;
+}
+module_init(fsg_init);
+
+
+static void __exit fsg_cleanup(void)
+{
+        struct fsg_dev  *fsg = the_fsg;
+
+        /* Unregister the driver iff the thread hasn't already done so */
+        if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
+                usb_gadget_unregister_driver(&fsg_driver);
+
+        /* Wait for the thread to finish up */
+        wait_for_completion(&fsg->thread_notifier);
+
+        kref_put(&fsg->ref, fsg_release);
+}
+module_exit(fsg_cleanup);
diff --git a/drivers/usb/gadget/fsl_tegra_udc.c b/drivers/usb/gadget/fsl_tegra_udc.c
new file mode 100644
index 00000000000..b254258726f
--- /dev/null
+++ b/drivers/usb/gadget/fsl_tegra_udc.c
@@ -0,0 +1,155 @@
+/*
+ * Description:
+ * Helper functions to support the tegra USB controller
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#include <linux/fsl_devices.h>
+#include <linux/platform_device.h>
+#include <linux/err.h>
+#include <linux/io.h>
+#include <mach/usb_phy.h>
+
+static struct tegra_usb_phy *phy;
+static struct clk *udc_clk;
+static struct clk *emc_clk;
+static struct clk *sclk_clk;
+static void *udc_base;
+
+int fsl_udc_clk_init(struct platform_device *pdev)
+{
+        struct resource *res;
+        int err;
+        int instance;
+        struct fsl_usb2_platform_data *pdata = pdev->dev.platform_data;
+
+
+        udc_clk = clk_get(&pdev->dev, NULL);
+        if (IS_ERR(udc_clk)) {
+                dev_err(&pdev->dev, "Can't get udc clock\n");
+                return PTR_ERR(udc_clk);
+        }
+
+        clk_enable(udc_clk);
+
+        sclk_clk = clk_get(&pdev->dev, "sclk");
+        if (IS_ERR(sclk_clk)) {
+                dev_err(&pdev->dev, "Can't get sclk clock\n");
+                err = PTR_ERR(sclk_clk);
+                goto err_sclk;
+        }
+
+        clk_set_rate(sclk_clk, 80000000);
+        clk_enable(sclk_clk);
+
+        emc_clk = clk_get(&pdev->dev, "emc");
+        if (IS_ERR(emc_clk)) {
+                dev_err(&pdev->dev, "Can't get emc clock\n");
+                err = PTR_ERR(emc_clk);
+                goto err_emc;
+        }
+
+        clk_enable(emc_clk);
+#ifdef CONFIG_ARCH_TEGRA_2x_SOC
+        /* Set DDR busy hints to 150MHz. For Tegra 2x SOC, DDR rate is half of EMC rate */
+        clk_set_rate(emc_clk, 300000000);
+#else
+        /* Set DDR busy hints to 100MHz. For Tegra 3x SOC DDR rate equals to EMC rate */
+        clk_set_rate(emc_clk, 100000000);
+#endif
+
+        /* we have to remap the registers ourselves as fsl_udc does not
+         * export them for us.
+         */
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                err = -ENXIO;
+                goto err0;
+        }
+        udc_base = ioremap(res->start, resource_size(res));
+        if (!udc_base) {
+                err = -ENOMEM;
+                goto err0;
+        }
+
+        instance = pdev->id;
+        if (instance == -1)
+                instance = 0;
+
+        phy = tegra_usb_phy_open(instance, udc_base, pdata->phy_config,
+                                        TEGRA_USB_PHY_MODE_DEVICE, pdata->usb_phy_type);
+        if (IS_ERR(phy)) {
+                dev_err(&pdev->dev, "Can't open phy\n");
+                err = PTR_ERR(phy);
+                goto err1;
+        }
+        tegra_usb_phy_power_on(phy, true);
+
+        return 0;
+err1:
+        iounmap(udc_base);
+err0:
+        clk_disable(emc_clk);
+        clk_put(emc_clk);
+err_emc:
+        clk_disable(sclk_clk);
+        clk_put(sclk_clk);
+err_sclk:
+        clk_disable(udc_clk);
+        clk_put(udc_clk);
+        return err;
+}
+
+void fsl_udc_clk_finalize(struct platform_device *pdev)
+{
+}
+
+void fsl_udc_clk_release(void)
+{
+        tegra_usb_phy_close(phy);
+
+        iounmap(udc_base);
+
+        clk_disable(udc_clk);
+        clk_put(udc_clk);
+
+        clk_disable(sclk_clk);
+        clk_put(sclk_clk);
+
+        clk_disable(emc_clk);
+        clk_put(emc_clk);
+}
+
+void fsl_udc_clk_suspend(bool is_dpd)
+{
+        tegra_usb_phy_power_off(phy, is_dpd);
+        clk_disable(udc_clk);
+        clk_disable(sclk_clk);
+        clk_disable(emc_clk);
+}
+
+void fsl_udc_clk_resume(bool is_dpd)
+{
+        clk_enable(emc_clk);
+        clk_enable(sclk_clk);
+        clk_enable(udc_clk);
+        tegra_usb_phy_power_on(phy,  is_dpd);
+}
+
+void fsl_udc_clk_enable(void)
+{
+        clk_enable(udc_clk);
+}
+
+void fsl_udc_clk_disable(void)
+{
+        clk_disable(udc_clk);
+}
+
+bool fsl_udc_charger_detect(void)
+{
+        return tegra_usb_phy_charger_detect(phy);
+}
diff --git a/drivers/usb/gadget/langwell_udc.c b/drivers/usb/gadget/langwell_udc.c
new file mode 100644
index 00000000000..a06e2c27b43
--- /dev/null
+++ b/drivers/usb/gadget/langwell_udc.c
@@ -0,0 +1,3607 @@
+/*
+ * Intel Langwell USB Device Controller driver
+ * Copyright (C) 2008-2009, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+
+/* #undef       DEBUG */
+/* #undef       VERBOSE_DEBUG */
+
+#if defined(CONFIG_USB_LANGWELL_OTG)
+#define OTG_TRANSCEIVER
+#endif
+
+
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/dma-mapping.h>
+#include <linux/kernel.h>
+#include <linux/delay.h>
+#include <linux/ioport.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/timer.h>
+#include <linux/list.h>
+#include <linux/interrupt.h>
+#include <linux/moduleparam.h>
+#include <linux/device.h>
+#include <linux/usb/ch9.h>
+#include <linux/usb/gadget.h>
+#include <linux/usb/otg.h>
+#include <linux/pm.h>
+#include <linux/io.h>
+#include <linux/irq.h>
+#include <asm/system.h>
+#include <asm/unaligned.h>
+
+#include "langwell_udc.h"
+
+
+#define DRIVER_DESC             "Intel Langwell USB Device Controller driver"
+#define DRIVER_VERSION          "16 May 2009"
+
+static const char driver_name[] = "langwell_udc";
+static const char driver_desc[] = DRIVER_DESC;
+
+
+/* controller device global variable */
+static struct langwell_udc      *the_controller;
+
+/* for endpoint 0 operations */
+static const struct usb_endpoint_descriptor
+langwell_ep0_desc = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+        .bEndpointAddress =     0,
+        .bmAttributes =         USB_ENDPOINT_XFER_CONTROL,
+        .wMaxPacketSize =       EP0_MAX_PKT_SIZE,
+};
+
+
+/*-------------------------------------------------------------------------*/
+/* debugging */
+
+#ifdef  VERBOSE_DEBUG
+static inline void print_all_registers(struct langwell_udc *dev)
+{
+        int     i;
+
+        /* Capability Registers */
+        dev_dbg(&dev->pdev->dev,
+                "Capability Registers (offset: 0x%04x, length: 0x%08x)\n",
+                CAP_REG_OFFSET, (u32)sizeof(struct langwell_cap_regs));
+        dev_dbg(&dev->pdev->dev, "caplength=0x%02x\n",
+                        readb(&dev->cap_regs->caplength));
+        dev_dbg(&dev->pdev->dev, "hciversion=0x%04x\n",
+                        readw(&dev->cap_regs->hciversion));
+        dev_dbg(&dev->pdev->dev, "hcsparams=0x%08x\n",
+                        readl(&dev->cap_regs->hcsparams));
+        dev_dbg(&dev->pdev->dev, "hccparams=0x%08x\n",
+                        readl(&dev->cap_regs->hccparams));
+        dev_dbg(&dev->pdev->dev, "dciversion=0x%04x\n",
+                        readw(&dev->cap_regs->dciversion));
+        dev_dbg(&dev->pdev->dev, "dccparams=0x%08x\n",
+                        readl(&dev->cap_regs->dccparams));
+
+        /* Operational Registers */
+        dev_dbg(&dev->pdev->dev,
+                "Operational Registers (offset: 0x%04x, length: 0x%08x)\n",
+                OP_REG_OFFSET, (u32)sizeof(struct langwell_op_regs));
+        dev_dbg(&dev->pdev->dev, "extsts=0x%08x\n",
+                        readl(&dev->op_regs->extsts));
+        dev_dbg(&dev->pdev->dev, "extintr=0x%08x\n",
+                        readl(&dev->op_regs->extintr));
+        dev_dbg(&dev->pdev->dev, "usbcmd=0x%08x\n",
+                        readl(&dev->op_regs->usbcmd));
+        dev_dbg(&dev->pdev->dev, "usbsts=0x%08x\n",
+                        readl(&dev->op_regs->usbsts));
+        dev_dbg(&dev->pdev->dev, "usbintr=0x%08x\n",
+                        readl(&dev->op_regs->usbintr));
+        dev_dbg(&dev->pdev->dev, "frindex=0x%08x\n",
+                        readl(&dev->op_regs->frindex));
+        dev_dbg(&dev->pdev->dev, "ctrldssegment=0x%08x\n",
+                        readl(&dev->op_regs->ctrldssegment));
+        dev_dbg(&dev->pdev->dev, "deviceaddr=0x%08x\n",
+                        readl(&dev->op_regs->deviceaddr));
+        dev_dbg(&dev->pdev->dev, "endpointlistaddr=0x%08x\n",
+                        readl(&dev->op_regs->endpointlistaddr));
+        dev_dbg(&dev->pdev->dev, "ttctrl=0x%08x\n",
+                        readl(&dev->op_regs->ttctrl));
+        dev_dbg(&dev->pdev->dev, "burstsize=0x%08x\n",
+                        readl(&dev->op_regs->burstsize));
+        dev_dbg(&dev->pdev->dev, "txfilltuning=0x%08x\n",
+                        readl(&dev->op_regs->txfilltuning));
+        dev_dbg(&dev->pdev->dev, "txttfilltuning=0x%08x\n",
+                        readl(&dev->op_regs->txttfilltuning));
+        dev_dbg(&dev->pdev->dev, "ic_usb=0x%08x\n",
+                        readl(&dev->op_regs->ic_usb));
+        dev_dbg(&dev->pdev->dev, "ulpi_viewport=0x%08x\n",
+                        readl(&dev->op_regs->ulpi_viewport));
+        dev_dbg(&dev->pdev->dev, "configflag=0x%08x\n",
+                        readl(&dev->op_regs->configflag));
+        dev_dbg(&dev->pdev->dev, "portsc1=0x%08x\n",
+                        readl(&dev->op_regs->portsc1));
+        dev_dbg(&dev->pdev->dev, "devlc=0x%08x\n",
+                        readl(&dev->op_regs->devlc));
+        dev_dbg(&dev->pdev->dev, "otgsc=0x%08x\n",
+                        readl(&dev->op_regs->otgsc));
+        dev_dbg(&dev->pdev->dev, "usbmode=0x%08x\n",
+                        readl(&dev->op_regs->usbmode));
+        dev_dbg(&dev->pdev->dev, "endptnak=0x%08x\n",
+                        readl(&dev->op_regs->endptnak));
+        dev_dbg(&dev->pdev->dev, "endptnaken=0x%08x\n",
+                        readl(&dev->op_regs->endptnaken));
+        dev_dbg(&dev->pdev->dev, "endptsetupstat=0x%08x\n",
+                        readl(&dev->op_regs->endptsetupstat));
+        dev_dbg(&dev->pdev->dev, "endptprime=0x%08x\n",
+                        readl(&dev->op_regs->endptprime));
+        dev_dbg(&dev->pdev->dev, "endptflush=0x%08x\n",
+                        readl(&dev->op_regs->endptflush));
+        dev_dbg(&dev->pdev->dev, "endptstat=0x%08x\n",
+                        readl(&dev->op_regs->endptstat));
+        dev_dbg(&dev->pdev->dev, "endptcomplete=0x%08x\n",
+                        readl(&dev->op_regs->endptcomplete));
+
+        for (i = 0; i < dev->ep_max / 2; i++) {
+                dev_dbg(&dev->pdev->dev, "endptctrl[%d]=0x%08x\n",
+                                i, readl(&dev->op_regs->endptctrl[i]));
+        }
+}
+#else
+
+#define print_all_registers(dev)        do { } while (0)
+
+#endif /* VERBOSE_DEBUG */
+
+
+/*-------------------------------------------------------------------------*/
+
+#define is_in(ep)       (((ep)->ep_num == 0) ? ((ep)->dev->ep0_dir ==   \
+                        USB_DIR_IN) : (usb_endpoint_dir_in((ep)->desc)))
+
+#define DIR_STRING(ep)  (is_in(ep) ? "in" : "out")
+
+
+static char *type_string(const struct usb_endpoint_descriptor *desc)
+{
+        switch (usb_endpoint_type(desc)) {
+        case USB_ENDPOINT_XFER_BULK:
+                return "bulk";
+        case USB_ENDPOINT_XFER_ISOC:
+                return "iso";
+        case USB_ENDPOINT_XFER_INT:
+                return "int";
+        };
+
+        return "control";
+}
+
+
+/* configure endpoint control registers */
+static void ep_reset(struct langwell_ep *ep, unsigned char ep_num,
+                unsigned char is_in, unsigned char ep_type)
+{
+        struct langwell_udc     *dev;
+        u32                     endptctrl;
+
+        dev = ep->dev;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        endptctrl = readl(&dev->op_regs->endptctrl[ep_num]);
+        if (is_in) {    /* TX */
+                if (ep_num)
+                        endptctrl |= EPCTRL_TXR;
+                endptctrl |= EPCTRL_TXE;
+                endptctrl |= ep_type << EPCTRL_TXT_SHIFT;
+        } else {        /* RX */
+                if (ep_num)
+                        endptctrl |= EPCTRL_RXR;
+                endptctrl |= EPCTRL_RXE;
+                endptctrl |= ep_type << EPCTRL_RXT_SHIFT;
+        }
+
+        writel(endptctrl, &dev->op_regs->endptctrl[ep_num]);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* reset ep0 dQH and endptctrl */
+static void ep0_reset(struct langwell_udc *dev)
+{
+        struct langwell_ep      *ep;
+        int                     i;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* ep0 in and out */
+        for (i = 0; i < 2; i++) {
+                ep = &dev->ep[i];
+                ep->dev = dev;
+
+                /* ep0 dQH */
+                ep->dqh = &dev->ep_dqh[i];
+
+                /* configure ep0 endpoint capabilities in dQH */
+                ep->dqh->dqh_ios = 1;
+                ep->dqh->dqh_mpl = EP0_MAX_PKT_SIZE;
+
+                /* enable ep0-in HW zero length termination select */
+                if (is_in(ep))
+                        ep->dqh->dqh_zlt = 0;
+                ep->dqh->dqh_mult = 0;
+
+                ep->dqh->dtd_next = DTD_TERM;
+
+                /* configure ep0 control registers */
+                ep_reset(&dev->ep[0], 0, i, USB_ENDPOINT_XFER_CONTROL);
+        }
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* endpoints operations */
+
+/* configure endpoint, making it usable */
+static int langwell_ep_enable(struct usb_ep *_ep,
+                const struct usb_endpoint_descriptor *desc)
+{
+        struct langwell_udc     *dev;
+        struct langwell_ep      *ep;
+        u16                     max = 0;
+        unsigned long           flags;
+        int                     i, retval = 0;
+        unsigned char           zlt, ios = 0, mult = 0;
+
+        ep = container_of(_ep, struct langwell_ep, ep);
+        dev = ep->dev;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (!_ep || !desc || ep->desc
+                        || desc->bDescriptorType != USB_DT_ENDPOINT)
+                return -EINVAL;
+
+        if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
+                return -ESHUTDOWN;
+
+        max = le16_to_cpu(desc->wMaxPacketSize);
+
+        /*
+         * disable HW zero length termination select
+         * driver handles zero length packet through req->req.zero
+         */
+        zlt = 1;
+
+        /*
+         * sanity check type, direction, address, and then
+         * initialize the endpoint capabilities fields in dQH
+         */
+        switch (usb_endpoint_type(desc)) {
+        case USB_ENDPOINT_XFER_CONTROL:
+                ios = 1;
+                break;
+        case USB_ENDPOINT_XFER_BULK:
+                if ((dev->gadget.speed == USB_SPEED_HIGH
+                                        && max != 512)
+                                || (dev->gadget.speed == USB_SPEED_FULL
+                                        && max > 64)) {
+                        goto done;
+                }
+                break;
+        case USB_ENDPOINT_XFER_INT:
+                if (strstr(ep->ep.name, "-iso")) /* bulk is ok */
+                        goto done;
+
+                switch (dev->gadget.speed) {
+                case USB_SPEED_HIGH:
+                        if (max <= 1024)
+                                break;
+                case USB_SPEED_FULL:
+                        if (max <= 64)
+                                break;
+                default:
+                        if (max <= 8)
+                                break;
+                        goto done;
+                }
+                break;
+        case USB_ENDPOINT_XFER_ISOC:
+                if (strstr(ep->ep.name, "-bulk")
+                                || strstr(ep->ep.name, "-int"))
+                        goto done;
+
+                switch (dev->gadget.speed) {
+                case USB_SPEED_HIGH:
+                        if (max <= 1024)
+                                break;
+                case USB_SPEED_FULL:
+                        if (max <= 1023)
+                                break;
+                default:
+                        goto done;
+                }
+                /*
+                 * FIXME:
+                 * calculate transactions needed for high bandwidth iso
+                 */
+                mult = (unsigned char)(1 + ((max >> 11) & 0x03));
+                max = max & 0x8ff;      /* bit 0~10 */
+                /* 3 transactions at most */
+                if (mult > 3)
+                        goto done;
+                break;
+        default:
+                goto done;
+        }
+
+        spin_lock_irqsave(&dev->lock, flags);
+
+        ep->ep.maxpacket = max;
+        ep->desc = desc;
+        ep->stopped = 0;
+        ep->ep_num = usb_endpoint_num(desc);
+
+        /* ep_type */
+        ep->ep_type = usb_endpoint_type(desc);
+
+        /* configure endpoint control registers */
+        ep_reset(ep, ep->ep_num, is_in(ep), ep->ep_type);
+
+        /* configure endpoint capabilities in dQH */
+        i = ep->ep_num * 2 + is_in(ep);
+        ep->dqh = &dev->ep_dqh[i];
+        ep->dqh->dqh_ios = ios;
+        ep->dqh->dqh_mpl = cpu_to_le16(max);
+        ep->dqh->dqh_zlt = zlt;
+        ep->dqh->dqh_mult = mult;
+        ep->dqh->dtd_next = DTD_TERM;
+
+        dev_dbg(&dev->pdev->dev, "enabled %s (ep%d%s-%s), max %04x\n",
+                        _ep->name,
+                        ep->ep_num,
+                        DIR_STRING(ep),
+                        type_string(desc),
+                        max);
+
+        spin_unlock_irqrestore(&dev->lock, flags);
+done:
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return retval;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* retire a request */
+static void done(struct langwell_ep *ep, struct langwell_request *req,
+                int status)
+{
+        struct langwell_udc     *dev = ep->dev;
+        unsigned                stopped = ep->stopped;
+        struct langwell_dtd     *curr_dtd, *next_dtd;
+        int                     i;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* remove the req from ep->queue */
+        list_del_init(&req->queue);
+
+        if (req->req.status == -EINPROGRESS)
+                req->req.status = status;
+        else
+                status = req->req.status;
+
+        /* free dTD for the request */
+        next_dtd = req->head;
+        for (i = 0; i < req->dtd_count; i++) {
+                curr_dtd = next_dtd;
+                if (i != req->dtd_count - 1)
+                        next_dtd = curr_dtd->next_dtd_virt;
+                dma_pool_free(dev->dtd_pool, curr_dtd, curr_dtd->dtd_dma);
+        }
+
+        if (req->mapped) {
+                dma_unmap_single(&dev->pdev->dev,
+                        req->req.dma, req->req.length,
+                        is_in(ep) ? PCI_DMA_TODEVICE : PCI_DMA_FROMDEVICE);
+                req->req.dma = DMA_ADDR_INVALID;
+                req->mapped = 0;
+        } else
+                dma_sync_single_for_cpu(&dev->pdev->dev, req->req.dma,
+                                req->req.length,
+                                is_in(ep) ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+
+        if (status != -ESHUTDOWN)
+                dev_dbg(&dev->pdev->dev,
+                                "complete %s, req %p, stat %d, len %u/%u\n",
+                                ep->ep.name, &req->req, status,
+                                req->req.actual, req->req.length);
+
+        /* don't modify queue heads during completion callback */
+        ep->stopped = 1;
+
+        spin_unlock(&dev->lock);
+        /* complete routine from gadget driver */
+        if (req->req.complete)
+                req->req.complete(&ep->ep, &req->req);
+
+        spin_lock(&dev->lock);
+        ep->stopped = stopped;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+static void langwell_ep_fifo_flush(struct usb_ep *_ep);
+
+/* delete all endpoint requests, called with spinlock held */
+static void nuke(struct langwell_ep *ep, int status)
+{
+        /* called with spinlock held */
+        ep->stopped = 1;
+
+        /* endpoint fifo flush */
+        if (&ep->ep && ep->desc)
+                langwell_ep_fifo_flush(&ep->ep);
+
+        while (!list_empty(&ep->queue)) {
+                struct langwell_request *req = NULL;
+                req = list_entry(ep->queue.next, struct langwell_request,
+                                queue);
+                done(ep, req, status);
+        }
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* endpoint is no longer usable */
+static int langwell_ep_disable(struct usb_ep *_ep)
+{
+        struct langwell_ep      *ep;
+        unsigned long           flags;
+        struct langwell_udc     *dev;
+        int                     ep_num;
+        u32                     endptctrl;
+
+        ep = container_of(_ep, struct langwell_ep, ep);
+        dev = ep->dev;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (!_ep || !ep->desc)
+                return -EINVAL;
+
+        spin_lock_irqsave(&dev->lock, flags);
+
+        /* disable endpoint control register */
+        ep_num = ep->ep_num;
+        endptctrl = readl(&dev->op_regs->endptctrl[ep_num]);
+        if (is_in(ep))
+                endptctrl &= ~EPCTRL_TXE;
+        else
+                endptctrl &= ~EPCTRL_RXE;
+        writel(endptctrl, &dev->op_regs->endptctrl[ep_num]);
+
+        /* nuke all pending requests (does flush) */
+        nuke(ep, -ESHUTDOWN);
+
+        ep->desc = NULL;
+        ep->stopped = 1;
+
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        dev_dbg(&dev->pdev->dev, "disabled %s\n", _ep->name);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+
+        return 0;
+}
+
+
+/* allocate a request object to use with this endpoint */
+static struct usb_request *langwell_alloc_request(struct usb_ep *_ep,
+                gfp_t gfp_flags)
+{
+        struct langwell_ep      *ep;
+        struct langwell_udc     *dev;
+        struct langwell_request *req = NULL;
+
+        if (!_ep)
+                return NULL;
+
+        ep = container_of(_ep, struct langwell_ep, ep);
+        dev = ep->dev;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        req = kzalloc(sizeof(*req), gfp_flags);
+        if (!req)
+                return NULL;
+
+        req->req.dma = DMA_ADDR_INVALID;
+        INIT_LIST_HEAD(&req->queue);
+
+        dev_vdbg(&dev->pdev->dev, "alloc request for %s\n", _ep->name);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return &req->req;
+}
+
+
+/* free a request object */
+static void langwell_free_request(struct usb_ep *_ep,
+                struct usb_request *_req)
+{
+        struct langwell_ep      *ep;
+        struct langwell_udc     *dev;
+        struct langwell_request *req = NULL;
+
+        ep = container_of(_ep, struct langwell_ep, ep);
+        dev = ep->dev;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (!_ep || !_req)
+                return;
+
+        req = container_of(_req, struct langwell_request, req);
+        WARN_ON(!list_empty(&req->queue));
+
+        if (_req)
+                kfree(req);
+
+        dev_vdbg(&dev->pdev->dev, "free request for %s\n", _ep->name);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* queue dTD and PRIME endpoint */
+static int queue_dtd(struct langwell_ep *ep, struct langwell_request *req)
+{
+        u32                     bit_mask, usbcmd, endptstat, dtd_dma;
+        u8                      dtd_status;
+        int                     i;
+        struct langwell_dqh     *dqh;
+        struct langwell_udc     *dev;
+
+        dev = ep->dev;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        i = ep->ep_num * 2 + is_in(ep);
+        dqh = &dev->ep_dqh[i];
+
+        if (ep->ep_num)
+                dev_vdbg(&dev->pdev->dev, "%s\n", ep->name);
+        else
+                /* ep0 */
+                dev_vdbg(&dev->pdev->dev, "%s-%s\n", ep->name, DIR_STRING(ep));
+
+        dev_vdbg(&dev->pdev->dev, "ep_dqh[%d] addr: 0x%p\n",
+                        i, &(dev->ep_dqh[i]));
+
+        bit_mask = is_in(ep) ?
+                (1 << (ep->ep_num + 16)) : (1 << (ep->ep_num));
+
+        dev_vdbg(&dev->pdev->dev, "bit_mask = 0x%08x\n", bit_mask);
+
+        /* check if the pipe is empty */
+        if (!(list_empty(&ep->queue))) {
+                /* add dTD to the end of linked list */
+                struct langwell_request *lastreq;
+                lastreq = list_entry(ep->queue.prev,
+                                struct langwell_request, queue);
+
+                lastreq->tail->dtd_next =
+                        cpu_to_le32(req->head->dtd_dma & DTD_NEXT_MASK);
+
+                /* read prime bit, if 1 goto out */
+                if (readl(&dev->op_regs->endptprime) & bit_mask)
+                        goto out;
+
+                do {
+                        /* set ATDTW bit in USBCMD */
+                        usbcmd = readl(&dev->op_regs->usbcmd);
+                        writel(usbcmd | CMD_ATDTW, &dev->op_regs->usbcmd);
+
+                        /* read correct status bit */
+                        endptstat = readl(&dev->op_regs->endptstat) & bit_mask;
+
+                } while (!(readl(&dev->op_regs->usbcmd) & CMD_ATDTW));
+
+                /* write ATDTW bit to 0 */
+                usbcmd = readl(&dev->op_regs->usbcmd);
+                writel(usbcmd & ~CMD_ATDTW, &dev->op_regs->usbcmd);
+
+                if (endptstat)
+                        goto out;
+        }
+
+        /* write dQH next pointer and terminate bit to 0 */
+        dtd_dma = req->head->dtd_dma & DTD_NEXT_MASK;
+        dqh->dtd_next = cpu_to_le32(dtd_dma);
+
+        /* clear active and halt bit */
+        dtd_status = (u8) ~(DTD_STS_ACTIVE | DTD_STS_HALTED);
+        dqh->dtd_status &= dtd_status;
+        dev_vdbg(&dev->pdev->dev, "dqh->dtd_status = 0x%x\n", dqh->dtd_status);
+
+        /* ensure that updates to the dQH will occur before priming */
+        wmb();
+
+        /* write 1 to endptprime register to PRIME endpoint */
+        bit_mask = is_in(ep) ? (1 << (ep->ep_num + 16)) : (1 << ep->ep_num);
+        dev_vdbg(&dev->pdev->dev, "endprime bit_mask = 0x%08x\n", bit_mask);
+        writel(bit_mask, &dev->op_regs->endptprime);
+out:
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+
+/* fill in the dTD structure to build a transfer descriptor */
+static struct langwell_dtd *build_dtd(struct langwell_request *req,
+                unsigned *length, dma_addr_t *dma, int *is_last)
+{
+        u32                      buf_ptr;
+        struct langwell_dtd     *dtd;
+        struct langwell_udc     *dev;
+        int                     i;
+
+        dev = req->ep->dev;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* the maximum transfer length, up to 16k bytes */
+        *length = min(req->req.length - req->req.actual,
+                        (unsigned)DTD_MAX_TRANSFER_LENGTH);
+
+        /* create dTD dma_pool resource */
+        dtd = dma_pool_alloc(dev->dtd_pool, GFP_KERNEL, dma);
+        if (dtd == NULL)
+                return dtd;
+        dtd->dtd_dma = *dma;
+
+        /* initialize buffer page pointers */
+        buf_ptr = (u32)(req->req.dma + req->req.actual);
+        for (i = 0; i < 5; i++)
+                dtd->dtd_buf[i] = cpu_to_le32(buf_ptr + i * PAGE_SIZE);
+
+        req->req.actual += *length;
+
+        /* fill in total bytes with transfer size */
+        dtd->dtd_total = cpu_to_le16(*length);
+        dev_vdbg(&dev->pdev->dev, "dtd->dtd_total = %d\n", dtd->dtd_total);
+
+        /* set is_last flag if req->req.zero is set or not */
+        if (req->req.zero) {
+                if (*length == 0 || (*length % req->ep->ep.maxpacket) != 0)
+                        *is_last = 1;
+                else
+                        *is_last = 0;
+        } else if (req->req.length == req->req.actual) {
+                *is_last = 1;
+        } else
+                *is_last = 0;
+
+        if (*is_last == 0)
+                dev_vdbg(&dev->pdev->dev, "multi-dtd request!\n");
+
+        /* set interrupt on complete bit for the last dTD */
+        if (*is_last && !req->req.no_interrupt)
+                dtd->dtd_ioc = 1;
+
+        /* set multiplier override 0 for non-ISO and non-TX endpoint */
+        dtd->dtd_multo = 0;
+
+        /* set the active bit of status field to 1 */
+        dtd->dtd_status = DTD_STS_ACTIVE;
+        dev_vdbg(&dev->pdev->dev, "dtd->dtd_status = 0x%02x\n",
+                        dtd->dtd_status);
+
+        dev_vdbg(&dev->pdev->dev, "length = %d, dma addr= 0x%08x\n",
+                        *length, (int)*dma);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return dtd;
+}
+
+
+/* generate dTD linked list for a request */
+static int req_to_dtd(struct langwell_request *req)
+{
+        unsigned                count;
+        int                     is_last, is_first = 1;
+        struct langwell_dtd     *dtd, *last_dtd = NULL;
+        struct langwell_udc     *dev;
+        dma_addr_t              dma;
+
+        dev = req->ep->dev;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+        do {
+                dtd = build_dtd(req, &count, &dma, &is_last);
+                if (dtd == NULL)
+                        return -ENOMEM;
+
+                if (is_first) {
+                        is_first = 0;
+                        req->head = dtd;
+                } else {
+                        last_dtd->dtd_next = cpu_to_le32(dma);
+                        last_dtd->next_dtd_virt = dtd;
+                }
+                last_dtd = dtd;
+                req->dtd_count++;
+        } while (!is_last);
+
+        /* set terminate bit to 1 for the last dTD */
+        dtd->dtd_next = DTD_TERM;
+
+        req->tail = dtd;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* queue (submits) an I/O requests to an endpoint */
+static int langwell_ep_queue(struct usb_ep *_ep, struct usb_request *_req,
+                gfp_t gfp_flags)
+{
+        struct langwell_request *req;
+        struct langwell_ep      *ep;
+        struct langwell_udc     *dev;
+        unsigned long           flags;
+        int                     is_iso = 0, zlflag = 0;
+
+        /* always require a cpu-view buffer */
+        req = container_of(_req, struct langwell_request, req);
+        ep = container_of(_ep, struct langwell_ep, ep);
+
+        if (!_req || !_req->complete || !_req->buf
+                        || !list_empty(&req->queue)) {
+                return -EINVAL;
+        }
+
+        if (unlikely(!_ep || !ep->desc))
+                return -EINVAL;
+
+        dev = ep->dev;
+        req->ep = ep;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (usb_endpoint_xfer_isoc(ep->desc)) {
+                if (req->req.length > ep->ep.maxpacket)
+                        return -EMSGSIZE;
+                is_iso = 1;
+        }
+
+        if (unlikely(!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN))
+                return -ESHUTDOWN;
+
+        /* set up dma mapping in case the caller didn't */
+        if (_req->dma == DMA_ADDR_INVALID) {
+                /* WORKAROUND: WARN_ON(size == 0) */
+                if (_req->length == 0) {
+                        dev_vdbg(&dev->pdev->dev, "req->length: 0->1\n");
+                        zlflag = 1;
+                        _req->length++;
+                }
+
+                _req->dma = dma_map_single(&dev->pdev->dev,
+                                _req->buf, _req->length,
+                                is_in(ep) ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+                if (zlflag && (_req->length == 1)) {
+                        dev_vdbg(&dev->pdev->dev, "req->length: 1->0\n");
+                        zlflag = 0;
+                        _req->length = 0;
+                }
+
+                req->mapped = 1;
+                dev_vdbg(&dev->pdev->dev, "req->mapped = 1\n");
+        } else {
+                dma_sync_single_for_device(&dev->pdev->dev,
+                                _req->dma, _req->length,
+                                is_in(ep) ?  DMA_TO_DEVICE : DMA_FROM_DEVICE);
+                req->mapped = 0;
+                dev_vdbg(&dev->pdev->dev, "req->mapped = 0\n");
+        }
+
+        dev_dbg(&dev->pdev->dev,
+                        "%s queue req %p, len %u, buf %p, dma 0x%08x\n",
+                        _ep->name,
+                        _req, _req->length, _req->buf, (int)_req->dma);
+
+        _req->status = -EINPROGRESS;
+        _req->actual = 0;
+        req->dtd_count = 0;
+
+        spin_lock_irqsave(&dev->lock, flags);
+
+        /* build and put dTDs to endpoint queue */
+        if (!req_to_dtd(req)) {
+                queue_dtd(ep, req);
+        } else {
+                spin_unlock_irqrestore(&dev->lock, flags);
+                return -ENOMEM;
+        }
+
+        /* update ep0 state */
+        if (ep->ep_num == 0)
+                dev->ep0_state = DATA_STATE_XMIT;
+
+        if (likely(req != NULL)) {
+                list_add_tail(&req->queue, &ep->queue);
+                dev_vdbg(&dev->pdev->dev, "list_add_tail()\n");
+        }
+
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+
+/* dequeue (cancels, unlinks) an I/O request from an endpoint */
+static int langwell_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
+{
+        struct langwell_ep      *ep;
+        struct langwell_udc     *dev;
+        struct langwell_request *req;
+        unsigned long           flags;
+        int                     stopped, ep_num, retval = 0;
+        u32                     endptctrl;
+
+        ep = container_of(_ep, struct langwell_ep, ep);
+        dev = ep->dev;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (!_ep || !ep->desc || !_req)
+                return -EINVAL;
+
+        if (!dev->driver)
+                return -ESHUTDOWN;
+
+        spin_lock_irqsave(&dev->lock, flags);
+        stopped = ep->stopped;
+
+        /* quiesce dma while we patch the queue */
+        ep->stopped = 1;
+        ep_num = ep->ep_num;
+
+        /* disable endpoint control register */
+        endptctrl = readl(&dev->op_regs->endptctrl[ep_num]);
+        if (is_in(ep))
+                endptctrl &= ~EPCTRL_TXE;
+        else
+                endptctrl &= ~EPCTRL_RXE;
+        writel(endptctrl, &dev->op_regs->endptctrl[ep_num]);
+
+        /* make sure it's still queued on this endpoint */
+        list_for_each_entry(req, &ep->queue, queue) {
+                if (&req->req == _req)
+                        break;
+        }
+
+        if (&req->req != _req) {
+                retval = -EINVAL;
+                goto done;
+        }
+
+        /* queue head may be partially complete. */
+        if (ep->queue.next == &req->queue) {
+                dev_dbg(&dev->pdev->dev, "unlink (%s) dma\n", _ep->name);
+                _req->status = -ECONNRESET;
+                langwell_ep_fifo_flush(&ep->ep);
+
+                /* not the last request in endpoint queue */
+                if (likely(ep->queue.next == &req->queue)) {
+                        struct langwell_dqh     *dqh;
+                        struct langwell_request *next_req;
+
+                        dqh = ep->dqh;
+                        next_req = list_entry(req->queue.next,
+                                        struct langwell_request, queue);
+
+                        /* point the dQH to the first dTD of next request */
+                        writel((u32) next_req->head, &dqh->dqh_current);
+                }
+        } else {
+                struct langwell_request *prev_req;
+
+                prev_req = list_entry(req->queue.prev,
+                                struct langwell_request, queue);
+                writel(readl(&req->tail->dtd_next),
+                                &prev_req->tail->dtd_next);
+        }
+
+        done(ep, req, -ECONNRESET);
+
+done:
+        /* enable endpoint again */
+        endptctrl = readl(&dev->op_regs->endptctrl[ep_num]);
+        if (is_in(ep))
+                endptctrl |= EPCTRL_TXE;
+        else
+                endptctrl |= EPCTRL_RXE;
+        writel(endptctrl, &dev->op_regs->endptctrl[ep_num]);
+
+        ep->stopped = stopped;
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return retval;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* endpoint set/clear halt */
+static void ep_set_halt(struct langwell_ep *ep, int value)
+{
+        u32                     endptctrl = 0;
+        int                     ep_num;
+        struct langwell_udc     *dev = ep->dev;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        ep_num = ep->ep_num;
+        endptctrl = readl(&dev->op_regs->endptctrl[ep_num]);
+
+        /* value: 1 - set halt, 0 - clear halt */
+        if (value) {
+                /* set the stall bit */
+                if (is_in(ep))
+                        endptctrl |= EPCTRL_TXS;
+                else
+                        endptctrl |= EPCTRL_RXS;
+        } else {
+                /* clear the stall bit and reset data toggle */
+                if (is_in(ep)) {
+                        endptctrl &= ~EPCTRL_TXS;
+                        endptctrl |= EPCTRL_TXR;
+                } else {
+                        endptctrl &= ~EPCTRL_RXS;
+                        endptctrl |= EPCTRL_RXR;
+                }
+        }
+
+        writel(endptctrl, &dev->op_regs->endptctrl[ep_num]);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* set the endpoint halt feature */
+static int langwell_ep_set_halt(struct usb_ep *_ep, int value)
+{
+        struct langwell_ep      *ep;
+        struct langwell_udc     *dev;
+        unsigned long           flags;
+        int                     retval = 0;
+
+        ep = container_of(_ep, struct langwell_ep, ep);
+        dev = ep->dev;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (!_ep || !ep->desc)
+                return -EINVAL;
+
+        if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
+                return -ESHUTDOWN;
+
+        if (usb_endpoint_xfer_isoc(ep->desc))
+                return  -EOPNOTSUPP;
+
+        spin_lock_irqsave(&dev->lock, flags);
+
+        /*
+         * attempt to halt IN ep will fail if any transfer requests
+         * are still queue
+         */
+        if (!list_empty(&ep->queue) && is_in(ep) && value) {
+                /* IN endpoint FIFO holds bytes */
+                dev_dbg(&dev->pdev->dev, "%s FIFO holds bytes\n", _ep->name);
+                retval = -EAGAIN;
+                goto done;
+        }
+
+        /* endpoint set/clear halt */
+        if (ep->ep_num) {
+                ep_set_halt(ep, value);
+        } else { /* endpoint 0 */
+                dev->ep0_state = WAIT_FOR_SETUP;
+                dev->ep0_dir = USB_DIR_OUT;
+        }
+done:
+        spin_unlock_irqrestore(&dev->lock, flags);
+        dev_dbg(&dev->pdev->dev, "%s %s halt\n",
+                        _ep->name, value ? "set" : "clear");
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return retval;
+}
+
+
+/* set the halt feature and ignores clear requests */
+static int langwell_ep_set_wedge(struct usb_ep *_ep)
+{
+        struct langwell_ep      *ep;
+        struct langwell_udc     *dev;
+
+        ep = container_of(_ep, struct langwell_ep, ep);
+        dev = ep->dev;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (!_ep || !ep->desc)
+                return -EINVAL;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return usb_ep_set_halt(_ep);
+}
+
+
+/* flush contents of a fifo */
+static void langwell_ep_fifo_flush(struct usb_ep *_ep)
+{
+        struct langwell_ep      *ep;
+        struct langwell_udc     *dev;
+        u32                     flush_bit;
+        unsigned long           timeout;
+
+        ep = container_of(_ep, struct langwell_ep, ep);
+        dev = ep->dev;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (!_ep || !ep->desc) {
+                dev_vdbg(&dev->pdev->dev, "ep or ep->desc is NULL\n");
+                dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+                return;
+        }
+
+        dev_vdbg(&dev->pdev->dev, "%s-%s fifo flush\n",
+                        _ep->name, DIR_STRING(ep));
+
+        /* flush endpoint buffer */
+        if (ep->ep_num == 0)
+                flush_bit = (1 << 16) | 1;
+        else if (is_in(ep))
+                flush_bit = 1 << (ep->ep_num + 16);     /* TX */
+        else
+                flush_bit = 1 << ep->ep_num;            /* RX */
+
+        /* wait until flush complete */
+        timeout = jiffies + FLUSH_TIMEOUT;
+        do {
+                writel(flush_bit, &dev->op_regs->endptflush);
+                while (readl(&dev->op_regs->endptflush)) {
+                        if (time_after(jiffies, timeout)) {
+                                dev_err(&dev->pdev->dev, "ep flush timeout\n");
+                                goto done;
+                        }
+                        cpu_relax();
+                }
+        } while (readl(&dev->op_regs->endptstat) & flush_bit);
+done:
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* endpoints operations structure */
+static const struct usb_ep_ops langwell_ep_ops = {
+
+        /* configure endpoint, making it usable */
+        .enable         = langwell_ep_enable,
+
+        /* endpoint is no longer usable */
+        .disable        = langwell_ep_disable,
+
+        /* allocate a request object to use with this endpoint */
+        .alloc_request  = langwell_alloc_request,
+
+        /* free a request object */
+        .free_request   = langwell_free_request,
+
+        /* queue (submits) an I/O requests to an endpoint */
+        .queue          = langwell_ep_queue,
+
+        /* dequeue (cancels, unlinks) an I/O request from an endpoint */
+        .dequeue        = langwell_ep_dequeue,
+
+        /* set the endpoint halt feature */
+        .set_halt       = langwell_ep_set_halt,
+
+        /* set the halt feature and ignores clear requests */
+        .set_wedge      = langwell_ep_set_wedge,
+
+        /* flush contents of a fifo */
+        .fifo_flush     = langwell_ep_fifo_flush,
+};
+
+
+/*-------------------------------------------------------------------------*/
+
+/* device controller usb_gadget_ops structure */
+
+/* returns the current frame number */
+static int langwell_get_frame(struct usb_gadget *_gadget)
+{
+        struct langwell_udc     *dev;
+        u16                     retval;
+
+        if (!_gadget)
+                return -ENODEV;
+
+        dev = container_of(_gadget, struct langwell_udc, gadget);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        retval = readl(&dev->op_regs->frindex) & FRINDEX_MASK;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return retval;
+}
+
+
+/* enter or exit PHY low power state */
+static void langwell_phy_low_power(struct langwell_udc *dev, bool flag)
+{
+        u32             devlc;
+        u8              devlc_byte2;
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        devlc = readl(&dev->op_regs->devlc);
+        dev_vdbg(&dev->pdev->dev, "devlc = 0x%08x\n", devlc);
+
+        if (flag)
+                devlc |= LPM_PHCD;
+        else
+                devlc &= ~LPM_PHCD;
+
+        /* FIXME: workaround for Langwell A1/A2/A3 sighting */
+        devlc_byte2 = (devlc >> 16) & 0xff;
+        writeb(devlc_byte2, (u8 *)&dev->op_regs->devlc + 2);
+
+        devlc = readl(&dev->op_regs->devlc);
+        dev_vdbg(&dev->pdev->dev,
+                        "%s PHY low power suspend, devlc = 0x%08x\n",
+                        flag ? "enter" : "exit", devlc);
+}
+
+
+/* tries to wake up the host connected to this gadget */
+static int langwell_wakeup(struct usb_gadget *_gadget)
+{
+        struct langwell_udc     *dev;
+        u32                     portsc1;
+        unsigned long           flags;
+
+        if (!_gadget)
+                return 0;
+
+        dev = container_of(_gadget, struct langwell_udc, gadget);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* remote wakeup feature not enabled by host */
+        if (!dev->remote_wakeup) {
+                dev_info(&dev->pdev->dev, "remote wakeup is disabled\n");
+                return -ENOTSUPP;
+        }
+
+        spin_lock_irqsave(&dev->lock, flags);
+
+        portsc1 = readl(&dev->op_regs->portsc1);
+        if (!(portsc1 & PORTS_SUSP)) {
+                spin_unlock_irqrestore(&dev->lock, flags);
+                return 0;
+        }
+
+        /* LPM L1 to L0 or legacy remote wakeup */
+        if (dev->lpm && dev->lpm_state == LPM_L1)
+                dev_info(&dev->pdev->dev, "LPM L1 to L0 remote wakeup\n");
+        else
+                dev_info(&dev->pdev->dev, "device remote wakeup\n");
+
+        /* exit PHY low power suspend */
+        if (dev->pdev->device != 0x0829)
+                langwell_phy_low_power(dev, 0);
+
+        /* force port resume */
+        portsc1 |= PORTS_FPR;
+        writel(portsc1, &dev->op_regs->portsc1);
+
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+
+/* notify controller that VBUS is powered or not */
+static int langwell_vbus_session(struct usb_gadget *_gadget, int is_active)
+{
+        struct langwell_udc     *dev;
+        unsigned long           flags;
+        u32                     usbcmd;
+
+        if (!_gadget)
+                return -ENODEV;
+
+        dev = container_of(_gadget, struct langwell_udc, gadget);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        spin_lock_irqsave(&dev->lock, flags);
+        dev_vdbg(&dev->pdev->dev, "VBUS status: %s\n",
+                        is_active ? "on" : "off");
+
+        dev->vbus_active = (is_active != 0);
+        if (dev->driver && dev->softconnected && dev->vbus_active) {
+                usbcmd = readl(&dev->op_regs->usbcmd);
+                usbcmd |= CMD_RUNSTOP;
+                writel(usbcmd, &dev->op_regs->usbcmd);
+        } else {
+                usbcmd = readl(&dev->op_regs->usbcmd);
+                usbcmd &= ~CMD_RUNSTOP;
+                writel(usbcmd, &dev->op_regs->usbcmd);
+        }
+
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+
+/* constrain controller's VBUS power usage */
+static int langwell_vbus_draw(struct usb_gadget *_gadget, unsigned mA)
+{
+        struct langwell_udc     *dev;
+
+        if (!_gadget)
+                return -ENODEV;
+
+        dev = container_of(_gadget, struct langwell_udc, gadget);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (dev->transceiver) {
+                dev_vdbg(&dev->pdev->dev, "otg_set_power\n");
+                dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+                return otg_set_power(dev->transceiver, mA);
+        }
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return -ENOTSUPP;
+}
+
+
+/* D+ pullup, software-controlled connect/disconnect to USB host */
+static int langwell_pullup(struct usb_gadget *_gadget, int is_on)
+{
+        struct langwell_udc     *dev;
+        u32                     usbcmd;
+        unsigned long           flags;
+
+        if (!_gadget)
+                return -ENODEV;
+
+        dev = container_of(_gadget, struct langwell_udc, gadget);
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        spin_lock_irqsave(&dev->lock, flags);
+        dev->softconnected = (is_on != 0);
+
+        if (dev->driver && dev->softconnected && dev->vbus_active) {
+                usbcmd = readl(&dev->op_regs->usbcmd);
+                usbcmd |= CMD_RUNSTOP;
+                writel(usbcmd, &dev->op_regs->usbcmd);
+        } else {
+                usbcmd = readl(&dev->op_regs->usbcmd);
+                usbcmd &= ~CMD_RUNSTOP;
+                writel(usbcmd, &dev->op_regs->usbcmd);
+        }
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+static int langwell_start(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *));
+static int langwell_stop(struct usb_gadget_driver *driver);
+/* device controller usb_gadget_ops structure */
+static const struct usb_gadget_ops langwell_ops = {
+
+        /* returns the current frame number */
+        .get_frame      = langwell_get_frame,
+
+        /* tries to wake up the host connected to this gadget */
+        .wakeup         = langwell_wakeup,
+
+        /* set the device selfpowered feature, always selfpowered */
+        /* .set_selfpowered = langwell_set_selfpowered, */
+
+        /* notify controller that VBUS is powered or not */
+        .vbus_session   = langwell_vbus_session,
+
+        /* constrain controller's VBUS power usage */
+        .vbus_draw      = langwell_vbus_draw,
+
+        /* D+ pullup, software-controlled connect/disconnect to USB host */
+        .pullup         = langwell_pullup,
+
+        .start          = langwell_start,
+        .stop           = langwell_stop,
+};
+
+
+/*-------------------------------------------------------------------------*/
+
+/* device controller operations */
+
+/* reset device controller */
+static int langwell_udc_reset(struct langwell_udc *dev)
+{
+        u32             usbcmd, usbmode, devlc, endpointlistaddr;
+        u8              devlc_byte0, devlc_byte2;
+        unsigned long   timeout;
+
+        if (!dev)
+                return -EINVAL;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* set controller to stop state */
+        usbcmd = readl(&dev->op_regs->usbcmd);
+        usbcmd &= ~CMD_RUNSTOP;
+        writel(usbcmd, &dev->op_regs->usbcmd);
+
+        /* reset device controller */
+        usbcmd = readl(&dev->op_regs->usbcmd);
+        usbcmd |= CMD_RST;
+        writel(usbcmd, &dev->op_regs->usbcmd);
+
+        /* wait for reset to complete */
+        timeout = jiffies + RESET_TIMEOUT;
+        while (readl(&dev->op_regs->usbcmd) & CMD_RST) {
+                if (time_after(jiffies, timeout)) {
+                        dev_err(&dev->pdev->dev, "device reset timeout\n");
+                        return -ETIMEDOUT;
+                }
+                cpu_relax();
+        }
+
+        /* set controller to device mode */
+        usbmode = readl(&dev->op_regs->usbmode);
+        usbmode |= MODE_DEVICE;
+
+        /* turn setup lockout off, require setup tripwire in usbcmd */
+        usbmode |= MODE_SLOM;
+
+        writel(usbmode, &dev->op_regs->usbmode);
+        usbmode = readl(&dev->op_regs->usbmode);
+        dev_vdbg(&dev->pdev->dev, "usbmode=0x%08x\n", usbmode);
+
+        /* Write-Clear setup status */
+        writel(0, &dev->op_regs->usbsts);
+
+        /* if support USB LPM, ACK all LPM token */
+        if (dev->lpm) {
+                devlc = readl(&dev->op_regs->devlc);
+                dev_vdbg(&dev->pdev->dev, "devlc = 0x%08x\n", devlc);
+                /* FIXME: workaround for Langwell A1/A2/A3 sighting */
+                devlc &= ~LPM_STL;      /* don't STALL LPM token */
+                devlc &= ~LPM_NYT_ACK;  /* ACK LPM token */
+                devlc_byte0 = devlc & 0xff;
+                devlc_byte2 = (devlc >> 16) & 0xff;
+                writeb(devlc_byte0, (u8 *)&dev->op_regs->devlc);
+                writeb(devlc_byte2, (u8 *)&dev->op_regs->devlc + 2);
+                devlc = readl(&dev->op_regs->devlc);
+                dev_vdbg(&dev->pdev->dev,
+                                "ACK LPM token, devlc = 0x%08x\n", devlc);
+        }
+
+        /* fill endpointlistaddr register */
+        endpointlistaddr = dev->ep_dqh_dma;
+        endpointlistaddr &= ENDPOINTLISTADDR_MASK;
+        writel(endpointlistaddr, &dev->op_regs->endpointlistaddr);
+
+        dev_vdbg(&dev->pdev->dev,
+                "dQH base (vir: %p, phy: 0x%08x), endpointlistaddr=0x%08x\n",
+                dev->ep_dqh, endpointlistaddr,
+                readl(&dev->op_regs->endpointlistaddr));
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+
+/* reinitialize device controller endpoints */
+static int eps_reinit(struct langwell_udc *dev)
+{
+        struct langwell_ep      *ep;
+        char                    name[14];
+        int                     i;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* initialize ep0 */
+        ep = &dev->ep[0];
+        ep->dev = dev;
+        strncpy(ep->name, "ep0", sizeof(ep->name));
+        ep->ep.name = ep->name;
+        ep->ep.ops = &langwell_ep_ops;
+        ep->stopped = 0;
+        ep->ep.maxpacket = EP0_MAX_PKT_SIZE;
+        ep->ep_num = 0;
+        ep->desc = &langwell_ep0_desc;
+        INIT_LIST_HEAD(&ep->queue);
+
+        ep->ep_type = USB_ENDPOINT_XFER_CONTROL;
+
+        /* initialize other endpoints */
+        for (i = 2; i < dev->ep_max; i++) {
+                ep = &dev->ep[i];
+                if (i % 2)
+                        snprintf(name, sizeof(name), "ep%din", i / 2);
+                else
+                        snprintf(name, sizeof(name), "ep%dout", i / 2);
+                ep->dev = dev;
+                strncpy(ep->name, name, sizeof(ep->name));
+                ep->ep.name = ep->name;
+
+                ep->ep.ops = &langwell_ep_ops;
+                ep->stopped = 0;
+                ep->ep.maxpacket = (unsigned short) ~0;
+                ep->ep_num = i / 2;
+
+                INIT_LIST_HEAD(&ep->queue);
+                list_add_tail(&ep->ep.ep_list, &dev->gadget.ep_list);
+        }
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+
+/* enable interrupt and set controller to run state */
+static void langwell_udc_start(struct langwell_udc *dev)
+{
+        u32     usbintr, usbcmd;
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* enable interrupts */
+        usbintr = INTR_ULPIE    /* ULPI */
+                | INTR_SLE      /* suspend */
+                /* | INTR_SRE   SOF received */
+                | INTR_URE      /* USB reset */
+                | INTR_AAE      /* async advance */
+                | INTR_SEE      /* system error */
+                | INTR_FRE      /* frame list rollover */
+                | INTR_PCE      /* port change detect */
+                | INTR_UEE      /* USB error interrupt */
+                | INTR_UE;      /* USB interrupt */
+        writel(usbintr, &dev->op_regs->usbintr);
+
+        /* clear stopped bit */
+        dev->stopped = 0;
+
+        /* set controller to run */
+        usbcmd = readl(&dev->op_regs->usbcmd);
+        usbcmd |= CMD_RUNSTOP;
+        writel(usbcmd, &dev->op_regs->usbcmd);
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* disable interrupt and set controller to stop state */
+static void langwell_udc_stop(struct langwell_udc *dev)
+{
+        u32     usbcmd;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* disable all interrupts */
+        writel(0, &dev->op_regs->usbintr);
+
+        /* set stopped bit */
+        dev->stopped = 1;
+
+        /* set controller to stop state */
+        usbcmd = readl(&dev->op_regs->usbcmd);
+        usbcmd &= ~CMD_RUNSTOP;
+        writel(usbcmd, &dev->op_regs->usbcmd);
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* stop all USB activities */
+static void stop_activity(struct langwell_udc *dev,
+                struct usb_gadget_driver *driver)
+{
+        struct langwell_ep      *ep;
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        nuke(&dev->ep[0], -ESHUTDOWN);
+
+        list_for_each_entry(ep, &dev->gadget.ep_list, ep.ep_list) {
+                nuke(ep, -ESHUTDOWN);
+        }
+
+        /* report disconnect; the driver is already quiesced */
+        if (driver) {
+                spin_unlock(&dev->lock);
+                driver->disconnect(&dev->gadget);
+                spin_lock(&dev->lock);
+        }
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* device "function" sysfs attribute file */
+static ssize_t show_function(struct device *_dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct langwell_udc     *dev = the_controller;
+
+        if (!dev->driver || !dev->driver->function
+                        || strlen(dev->driver->function) > PAGE_SIZE)
+                return 0;
+
+        return scnprintf(buf, PAGE_SIZE, "%s\n", dev->driver->function);
+}
+static DEVICE_ATTR(function, S_IRUGO, show_function, NULL);
+
+
+/* device "langwell_udc" sysfs attribute file */
+static ssize_t show_langwell_udc(struct device *_dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct langwell_udc     *dev = the_controller;
+        struct langwell_request *req;
+        struct langwell_ep      *ep = NULL;
+        char                    *next;
+        unsigned                size;
+        unsigned                t;
+        unsigned                i;
+        unsigned long           flags;
+        u32                     tmp_reg;
+
+        next = buf;
+        size = PAGE_SIZE;
+        spin_lock_irqsave(&dev->lock, flags);
+
+        /* driver basic information */
+        t = scnprintf(next, size,
+                        DRIVER_DESC "\n"
+                        "%s version: %s\n"
+                        "Gadget driver: %s\n\n",
+                        driver_name, DRIVER_VERSION,
+                        dev->driver ? dev->driver->driver.name : "(none)");
+        size -= t;
+        next += t;
+
+        /* device registers */
+        tmp_reg = readl(&dev->op_regs->usbcmd);
+        t = scnprintf(next, size,
+                        "USBCMD reg:\n"
+                        "SetupTW: %d\n"
+                        "Run/Stop: %s\n\n",
+                        (tmp_reg & CMD_SUTW) ? 1 : 0,
+                        (tmp_reg & CMD_RUNSTOP) ? "Run" : "Stop");
+        size -= t;
+        next += t;
+
+        tmp_reg = readl(&dev->op_regs->usbsts);
+        t = scnprintf(next, size,
+                        "USB Status Reg:\n"
+                        "Device Suspend: %d\n"
+                        "Reset Received: %d\n"
+                        "System Error: %s\n"
+                        "USB Error Interrupt: %s\n\n",
+                        (tmp_reg & STS_SLI) ? 1 : 0,
+                        (tmp_reg & STS_URI) ? 1 : 0,
+                        (tmp_reg & STS_SEI) ? "Error" : "No error",
+                        (tmp_reg & STS_UEI) ? "Error detected" : "No error");
+        size -= t;
+        next += t;
+
+        tmp_reg = readl(&dev->op_regs->usbintr);
+        t = scnprintf(next, size,
+                        "USB Intrrupt Enable Reg:\n"
+                        "Sleep Enable: %d\n"
+                        "SOF Received Enable: %d\n"
+                        "Reset Enable: %d\n"
+                        "System Error Enable: %d\n"
+                        "Port Change Dectected Enable: %d\n"
+                        "USB Error Intr Enable: %d\n"
+                        "USB Intr Enable: %d\n\n",
+                        (tmp_reg & INTR_SLE) ? 1 : 0,
+                        (tmp_reg & INTR_SRE) ? 1 : 0,
+                        (tmp_reg & INTR_URE) ? 1 : 0,
+                        (tmp_reg & INTR_SEE) ? 1 : 0,
+                        (tmp_reg & INTR_PCE) ? 1 : 0,
+                        (tmp_reg & INTR_UEE) ? 1 : 0,
+                        (tmp_reg & INTR_UE) ? 1 : 0);
+        size -= t;
+        next += t;
+
+        tmp_reg = readl(&dev->op_regs->frindex);
+        t = scnprintf(next, size,
+                        "USB Frame Index Reg:\n"
+                        "Frame Number is 0x%08x\n\n",
+                        (tmp_reg & FRINDEX_MASK));
+        size -= t;
+        next += t;
+
+        tmp_reg = readl(&dev->op_regs->deviceaddr);
+        t = scnprintf(next, size,
+                        "USB Device Address Reg:\n"
+                        "Device Addr is 0x%x\n\n",
+                        USBADR(tmp_reg));
+        size -= t;
+        next += t;
+
+        tmp_reg = readl(&dev->op_regs->endpointlistaddr);
+        t = scnprintf(next, size,
+                        "USB Endpoint List Address Reg:\n"
+                        "Endpoint List Pointer is 0x%x\n\n",
+                        EPBASE(tmp_reg));
+        size -= t;
+        next += t;
+
+        tmp_reg = readl(&dev->op_regs->portsc1);
+        t = scnprintf(next, size,
+                "USB Port Status & Control Reg:\n"
+                "Port Reset: %s\n"
+                "Port Suspend Mode: %s\n"
+                "Over-current Change: %s\n"
+                "Port Enable/Disable Change: %s\n"
+                "Port Enabled/Disabled: %s\n"
+                "Current Connect Status: %s\n"
+                "LPM Suspend Status: %s\n\n",
+                (tmp_reg & PORTS_PR) ? "Reset" : "Not Reset",
+                (tmp_reg & PORTS_SUSP) ? "Suspend " : "Not Suspend",
+                (tmp_reg & PORTS_OCC) ? "Detected" : "No",
+                (tmp_reg & PORTS_PEC) ? "Changed" : "Not Changed",
+                (tmp_reg & PORTS_PE) ? "Enable" : "Not Correct",
+                (tmp_reg & PORTS_CCS) ?  "Attached" : "Not Attached",
+                (tmp_reg & PORTS_SLP) ? "LPM L1" : "LPM L0");
+        size -= t;
+        next += t;
+
+        tmp_reg = readl(&dev->op_regs->devlc);
+        t = scnprintf(next, size,
+                "Device LPM Control Reg:\n"
+                "Parallel Transceiver : %d\n"
+                "Serial Transceiver : %d\n"
+                "Port Speed: %s\n"
+                "Port Force Full Speed Connenct: %s\n"
+                "PHY Low Power Suspend Clock: %s\n"
+                "BmAttributes: %d\n\n",
+                LPM_PTS(tmp_reg),
+                (tmp_reg & LPM_STS) ? 1 : 0,
+                ({
+                        char    *s;
+                        switch (LPM_PSPD(tmp_reg)) {
+                        case LPM_SPEED_FULL:
+                                s = "Full Speed"; break;
+                        case LPM_SPEED_LOW:
+                                s = "Low Speed"; break;
+                        case LPM_SPEED_HIGH:
+                                s = "High Speed"; break;
+                        default:
+                                s = "Unknown Speed"; break;
+                        }
+                        s;
+                }),
+                (tmp_reg & LPM_PFSC) ? "Force Full Speed" : "Not Force",
+                (tmp_reg & LPM_PHCD) ? "Disabled" : "Enabled",
+                LPM_BA(tmp_reg));
+        size -= t;
+        next += t;
+
+        tmp_reg = readl(&dev->op_regs->usbmode);
+        t = scnprintf(next, size,
+                        "USB Mode Reg:\n"
+                        "Controller Mode is : %s\n\n", ({
+                                char *s;
+                                switch (MODE_CM(tmp_reg)) {
+                                case MODE_IDLE:
+                                        s = "Idle"; break;
+                                case MODE_DEVICE:
+                                        s = "Device Controller"; break;
+                                case MODE_HOST:
+                                        s = "Host Controller"; break;
+                                default:
+                                        s = "None"; break;
+                                }
+                                s;
+                        }));
+        size -= t;
+        next += t;
+
+        tmp_reg = readl(&dev->op_regs->endptsetupstat);
+        t = scnprintf(next, size,
+                        "Endpoint Setup Status Reg:\n"
+                        "SETUP on ep 0x%04x\n\n",
+                        tmp_reg & SETUPSTAT_MASK);
+        size -= t;
+        next += t;
+
+        for (i = 0; i < dev->ep_max / 2; i++) {
+                tmp_reg = readl(&dev->op_regs->endptctrl[i]);
+                t = scnprintf(next, size, "EP Ctrl Reg [%d]: 0x%08x\n",
+                                i, tmp_reg);
+                size -= t;
+                next += t;
+        }
+        tmp_reg = readl(&dev->op_regs->endptprime);
+        t = scnprintf(next, size, "EP Prime Reg: 0x%08x\n\n", tmp_reg);
+        size -= t;
+        next += t;
+
+        /* langwell_udc, langwell_ep, langwell_request structure information */
+        ep = &dev->ep[0];
+        t = scnprintf(next, size, "%s MaxPacketSize: 0x%x, ep_num: %d\n",
+                        ep->ep.name, ep->ep.maxpacket, ep->ep_num);
+        size -= t;
+        next += t;
+
+        if (list_empty(&ep->queue)) {
+                t = scnprintf(next, size, "its req queue is empty\n\n");
+                size -= t;
+                next += t;
+        } else {
+                list_for_each_entry(req, &ep->queue, queue) {
+                        t = scnprintf(next, size,
+                                "req %p actual 0x%x length 0x%x  buf %p\n",
+                                &req->req, req->req.actual,
+                                req->req.length, req->req.buf);
+                        size -= t;
+                        next += t;
+                }
+        }
+        /* other gadget->eplist ep */
+        list_for_each_entry(ep, &dev->gadget.ep_list, ep.ep_list) {
+                if (ep->desc) {
+                        t = scnprintf(next, size,
+                                        "\n%s MaxPacketSize: 0x%x, "
+                                        "ep_num: %d\n",
+                                        ep->ep.name, ep->ep.maxpacket,
+                                        ep->ep_num);
+                        size -= t;
+                        next += t;
+
+                        if (list_empty(&ep->queue)) {
+                                t = scnprintf(next, size,
+                                                "its req queue is empty\n\n");
+                                size -= t;
+                                next += t;
+                        } else {
+                                list_for_each_entry(req, &ep->queue, queue) {
+                                        t = scnprintf(next, size,
+                                                "req %p actual 0x%x length "
+                                                "0x%x  buf %p\n",
+                                                &req->req, req->req.actual,
+                                                req->req.length, req->req.buf);
+                                        size -= t;
+                                        next += t;
+                                }
+                        }
+                }
+        }
+
+        spin_unlock_irqrestore(&dev->lock, flags);
+        return PAGE_SIZE - size;
+}
+static DEVICE_ATTR(langwell_udc, S_IRUGO, show_langwell_udc, NULL);
+
+
+/* device "remote_wakeup" sysfs attribute file */
+static ssize_t store_remote_wakeup(struct device *_dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct langwell_udc     *dev = the_controller;
+        unsigned long           flags;
+        ssize_t                 rc = count;
+
+        if (count > 2)
+                return -EINVAL;
+
+        if (count > 0 && buf[count-1] == '\n')
+                ((char *) buf)[count-1] = 0;
+
+        if (buf[0] != '1')
+                return -EINVAL;
+
+        /* force remote wakeup enabled in case gadget driver doesn't support */
+        spin_lock_irqsave(&dev->lock, flags);
+        dev->remote_wakeup = 1;
+        dev->dev_status |= (1 << USB_DEVICE_REMOTE_WAKEUP);
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        langwell_wakeup(&dev->gadget);
+
+        return rc;
+}
+static DEVICE_ATTR(remote_wakeup, S_IWUSR, NULL, store_remote_wakeup);
+
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * when a driver is successfully registered, it will receive
+ * control requests including set_configuration(), which enables
+ * non-control requests.  then usb traffic follows until a
+ * disconnect is reported.  then a host may connect again, or
+ * the driver might get unbound.
+ */
+
+static int langwell_start(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
+{
+        struct langwell_udc     *dev = the_controller;
+        unsigned long           flags;
+        int                     retval;
+
+        if (!dev)
+                return -ENODEV;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (dev->driver)
+                return -EBUSY;
+
+        spin_lock_irqsave(&dev->lock, flags);
+
+        /* hook up the driver ... */
+        driver->driver.bus = NULL;
+        dev->driver = driver;
+        dev->gadget.dev.driver = &driver->driver;
+
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        retval = bind(&dev->gadget);
+        if (retval) {
+                dev_dbg(&dev->pdev->dev, "bind to driver %s --> %d\n",
+                                driver->driver.name, retval);
+                dev->driver = NULL;
+                dev->gadget.dev.driver = NULL;
+                return retval;
+        }
+
+        retval = device_create_file(&dev->pdev->dev, &dev_attr_function);
+        if (retval)
+                goto err_unbind;
+
+        dev->usb_state = USB_STATE_ATTACHED;
+        dev->ep0_state = WAIT_FOR_SETUP;
+        dev->ep0_dir = USB_DIR_OUT;
+
+        /* enable interrupt and set controller to run state */
+        if (dev->got_irq)
+                langwell_udc_start(dev);
+
+        dev_vdbg(&dev->pdev->dev,
+                        "After langwell_udc_start(), print all registers:\n");
+        print_all_registers(dev);
+
+        dev_info(&dev->pdev->dev, "register driver: %s\n",
+                        driver->driver.name);
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+
+err_unbind:
+        driver->unbind(&dev->gadget);
+        dev->gadget.dev.driver = NULL;
+        dev->driver = NULL;
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return retval;
+}
+
+/* unregister gadget driver */
+static int langwell_stop(struct usb_gadget_driver *driver)
+{
+        struct langwell_udc     *dev = the_controller;
+        unsigned long           flags;
+
+        if (!dev)
+                return -ENODEV;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (unlikely(!driver || !driver->unbind))
+                return -EINVAL;
+
+        /* exit PHY low power suspend */
+        if (dev->pdev->device != 0x0829)
+                langwell_phy_low_power(dev, 0);
+
+        /* unbind OTG transceiver */
+        if (dev->transceiver)
+                (void)otg_set_peripheral(dev->transceiver, 0);
+
+        /* disable interrupt and set controller to stop state */
+        langwell_udc_stop(dev);
+
+        dev->usb_state = USB_STATE_ATTACHED;
+        dev->ep0_state = WAIT_FOR_SETUP;
+        dev->ep0_dir = USB_DIR_OUT;
+
+        spin_lock_irqsave(&dev->lock, flags);
+
+        /* stop all usb activities */
+        dev->gadget.speed = USB_SPEED_UNKNOWN;
+        stop_activity(dev, driver);
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        /* unbind gadget driver */
+        driver->unbind(&dev->gadget);
+        dev->gadget.dev.driver = NULL;
+        dev->driver = NULL;
+
+        device_remove_file(&dev->pdev->dev, &dev_attr_function);
+
+        dev_info(&dev->pdev->dev, "unregistered driver '%s'\n",
+                        driver->driver.name);
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * setup tripwire is used as a semaphore to ensure that the setup data
+ * payload is extracted from a dQH without being corrupted
+ */
+static void setup_tripwire(struct langwell_udc *dev)
+{
+        u32                     usbcmd,
+                                endptsetupstat;
+        unsigned long           timeout;
+        struct langwell_dqh     *dqh;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* ep0 OUT dQH */
+        dqh = &dev->ep_dqh[EP_DIR_OUT];
+
+        /* Write-Clear endptsetupstat */
+        endptsetupstat = readl(&dev->op_regs->endptsetupstat);
+        writel(endptsetupstat, &dev->op_regs->endptsetupstat);
+
+        /* wait until endptsetupstat is cleared */
+        timeout = jiffies + SETUPSTAT_TIMEOUT;
+        while (readl(&dev->op_regs->endptsetupstat)) {
+                if (time_after(jiffies, timeout)) {
+                        dev_err(&dev->pdev->dev, "setup_tripwire timeout\n");
+                        break;
+                }
+                cpu_relax();
+        }
+
+        /* while a hazard exists when setup packet arrives */
+        do {
+                /* set setup tripwire bit */
+                usbcmd = readl(&dev->op_regs->usbcmd);
+                writel(usbcmd | CMD_SUTW, &dev->op_regs->usbcmd);
+
+                /* copy the setup packet to local buffer */
+                memcpy(&dev->local_setup_buff, &dqh->dqh_setup, 8);
+        } while (!(readl(&dev->op_regs->usbcmd) & CMD_SUTW));
+
+        /* Write-Clear setup tripwire bit */
+        usbcmd = readl(&dev->op_regs->usbcmd);
+        writel(usbcmd & ~CMD_SUTW, &dev->op_regs->usbcmd);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* protocol ep0 stall, will automatically be cleared on new transaction */
+static void ep0_stall(struct langwell_udc *dev)
+{
+        u32     endptctrl;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* set TX and RX to stall */
+        endptctrl = readl(&dev->op_regs->endptctrl[0]);
+        endptctrl |= EPCTRL_TXS | EPCTRL_RXS;
+        writel(endptctrl, &dev->op_regs->endptctrl[0]);
+
+        /* update ep0 state */
+        dev->ep0_state = WAIT_FOR_SETUP;
+        dev->ep0_dir = USB_DIR_OUT;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* PRIME a status phase for ep0 */
+static int prime_status_phase(struct langwell_udc *dev, int dir)
+{
+        struct langwell_request *req;
+        struct langwell_ep      *ep;
+        int                     status = 0;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (dir == EP_DIR_IN)
+                dev->ep0_dir = USB_DIR_IN;
+        else
+                dev->ep0_dir = USB_DIR_OUT;
+
+        ep = &dev->ep[0];
+        dev->ep0_state = WAIT_FOR_OUT_STATUS;
+
+        req = dev->status_req;
+
+        req->ep = ep;
+        req->req.length = 0;
+        req->req.status = -EINPROGRESS;
+        req->req.actual = 0;
+        req->req.complete = NULL;
+        req->dtd_count = 0;
+
+        if (!req_to_dtd(req))
+                status = queue_dtd(ep, req);
+        else
+                return -ENOMEM;
+
+        if (status)
+                dev_err(&dev->pdev->dev, "can't queue ep0 status request\n");
+
+        list_add_tail(&req->queue, &ep->queue);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return status;
+}
+
+
+/* SET_ADDRESS request routine */
+static void set_address(struct langwell_udc *dev, u16 value,
+                u16 index, u16 length)
+{
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* save the new address to device struct */
+        dev->dev_addr = (u8) value;
+        dev_vdbg(&dev->pdev->dev, "dev->dev_addr = %d\n", dev->dev_addr);
+
+        /* update usb state */
+        dev->usb_state = USB_STATE_ADDRESS;
+
+        /* STATUS phase */
+        if (prime_status_phase(dev, EP_DIR_IN))
+                ep0_stall(dev);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* return endpoint by windex */
+static struct langwell_ep *get_ep_by_windex(struct langwell_udc *dev,
+                u16 wIndex)
+{
+        struct langwell_ep              *ep;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if ((wIndex & USB_ENDPOINT_NUMBER_MASK) == 0)
+                return &dev->ep[0];
+
+        list_for_each_entry(ep, &dev->gadget.ep_list, ep.ep_list) {
+                u8      bEndpointAddress;
+                if (!ep->desc)
+                        continue;
+
+                bEndpointAddress = ep->desc->bEndpointAddress;
+                if ((wIndex ^ bEndpointAddress) & USB_DIR_IN)
+                        continue;
+
+                if ((wIndex & USB_ENDPOINT_NUMBER_MASK)
+                        == (bEndpointAddress & USB_ENDPOINT_NUMBER_MASK))
+                        return ep;
+        }
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return NULL;
+}
+
+
+/* return whether endpoint is stalled, 0: not stalled; 1: stalled */
+static int ep_is_stall(struct langwell_ep *ep)
+{
+        struct langwell_udc     *dev = ep->dev;
+        u32                     endptctrl;
+        int                     retval;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        endptctrl = readl(&dev->op_regs->endptctrl[ep->ep_num]);
+        if (is_in(ep))
+                retval = endptctrl & EPCTRL_TXS ? 1 : 0;
+        else
+                retval = endptctrl & EPCTRL_RXS ? 1 : 0;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return retval;
+}
+
+
+/* GET_STATUS request routine */
+static void get_status(struct langwell_udc *dev, u8 request_type, u16 value,
+                u16 index, u16 length)
+{
+        struct langwell_request *req;
+        struct langwell_ep      *ep;
+        u16     status_data = 0;        /* 16 bits cpu view status data */
+        int     status = 0;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        ep = &dev->ep[0];
+
+        if ((request_type & USB_RECIP_MASK) == USB_RECIP_DEVICE) {
+                /* get device status */
+                status_data = dev->dev_status;
+        } else if ((request_type & USB_RECIP_MASK) == USB_RECIP_INTERFACE) {
+                /* get interface status */
+                status_data = 0;
+        } else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) {
+                /* get endpoint status */
+                struct langwell_ep      *epn;
+                epn = get_ep_by_windex(dev, index);
+                /* stall if endpoint doesn't exist */
+                if (!epn)
+                        goto stall;
+
+                status_data = ep_is_stall(epn) << USB_ENDPOINT_HALT;
+        }
+
+        dev_dbg(&dev->pdev->dev, "get status data: 0x%04x\n", status_data);
+
+        dev->ep0_dir = USB_DIR_IN;
+
+        /* borrow the per device status_req */
+        req = dev->status_req;
+
+        /* fill in the reqest structure */
+        *((u16 *) req->req.buf) = cpu_to_le16(status_data);
+        req->ep = ep;
+        req->req.length = 2;
+        req->req.status = -EINPROGRESS;
+        req->req.actual = 0;
+        req->req.complete = NULL;
+        req->dtd_count = 0;
+
+        /* prime the data phase */
+        if (!req_to_dtd(req))
+                status = queue_dtd(ep, req);
+        else                    /* no mem */
+                goto stall;
+
+        if (status) {
+                dev_err(&dev->pdev->dev,
+                                "response error on GET_STATUS request\n");
+                goto stall;
+        }
+
+        list_add_tail(&req->queue, &ep->queue);
+        dev->ep0_state = DATA_STATE_XMIT;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return;
+stall:
+        ep0_stall(dev);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* setup packet interrupt handler */
+static void handle_setup_packet(struct langwell_udc *dev,
+                struct usb_ctrlrequest *setup)
+{
+        u16     wValue = le16_to_cpu(setup->wValue);
+        u16     wIndex = le16_to_cpu(setup->wIndex);
+        u16     wLength = le16_to_cpu(setup->wLength);
+        u32     portsc1;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* ep0 fifo flush */
+        nuke(&dev->ep[0], -ESHUTDOWN);
+
+        dev_dbg(&dev->pdev->dev, "SETUP %02x.%02x v%04x i%04x l%04x\n",
+                        setup->bRequestType, setup->bRequest,
+                        wValue, wIndex, wLength);
+
+        /* RNDIS gadget delegate */
+        if ((setup->bRequestType == 0x21) && (setup->bRequest == 0x00)) {
+                /* USB_CDC_SEND_ENCAPSULATED_COMMAND */
+                goto delegate;
+        }
+
+        /* USB_CDC_GET_ENCAPSULATED_RESPONSE */
+        if ((setup->bRequestType == 0xa1) && (setup->bRequest == 0x01)) {
+                /* USB_CDC_GET_ENCAPSULATED_RESPONSE */
+                goto delegate;
+        }
+
+        /* We process some stardard setup requests here */
+        switch (setup->bRequest) {
+        case USB_REQ_GET_STATUS:
+                dev_dbg(&dev->pdev->dev, "SETUP: USB_REQ_GET_STATUS\n");
+                /* get status, DATA and STATUS phase */
+                if ((setup->bRequestType & (USB_DIR_IN | USB_TYPE_MASK))
+                                        != (USB_DIR_IN | USB_TYPE_STANDARD))
+                        break;
+                get_status(dev, setup->bRequestType, wValue, wIndex, wLength);
+                goto end;
+
+        case USB_REQ_SET_ADDRESS:
+                dev_dbg(&dev->pdev->dev, "SETUP: USB_REQ_SET_ADDRESS\n");
+                /* STATUS phase */
+                if (setup->bRequestType != (USB_DIR_OUT | USB_TYPE_STANDARD
+                                                | USB_RECIP_DEVICE))
+                        break;
+                set_address(dev, wValue, wIndex, wLength);
+                goto end;
+
+        case USB_REQ_CLEAR_FEATURE:
+        case USB_REQ_SET_FEATURE:
+                /* STATUS phase */
+        {
+                int rc = -EOPNOTSUPP;
+                if (setup->bRequest == USB_REQ_SET_FEATURE)
+                        dev_dbg(&dev->pdev->dev,
+                                        "SETUP: USB_REQ_SET_FEATURE\n");
+                else if (setup->bRequest == USB_REQ_CLEAR_FEATURE)
+                        dev_dbg(&dev->pdev->dev,
+                                        "SETUP: USB_REQ_CLEAR_FEATURE\n");
+
+                if ((setup->bRequestType & (USB_RECIP_MASK | USB_TYPE_MASK))
+                                == (USB_RECIP_ENDPOINT | USB_TYPE_STANDARD)) {
+                        struct langwell_ep      *epn;
+                        epn = get_ep_by_windex(dev, wIndex);
+                        /* stall if endpoint doesn't exist */
+                        if (!epn) {
+                                ep0_stall(dev);
+                                goto end;
+                        }
+
+                        if (wValue != 0 || wLength != 0
+                                        || epn->ep_num > dev->ep_max)
+                                break;
+
+                        spin_unlock(&dev->lock);
+                        rc = langwell_ep_set_halt(&epn->ep,
+                                (setup->bRequest == USB_REQ_SET_FEATURE)
+                                ? 1 : 0);
+                        spin_lock(&dev->lock);
+
+                } else if ((setup->bRequestType & (USB_RECIP_MASK
+                                | USB_TYPE_MASK)) == (USB_RECIP_DEVICE
+                                | USB_TYPE_STANDARD)) {
+                        rc = 0;
+                        switch (wValue) {
+                        case USB_DEVICE_REMOTE_WAKEUP:
+                                if (setup->bRequest == USB_REQ_SET_FEATURE) {
+                                        dev->remote_wakeup = 1;
+                                        dev->dev_status |= (1 << wValue);
+                                } else {
+                                        dev->remote_wakeup = 0;
+                                        dev->dev_status &= ~(1 << wValue);
+                                }
+                                break;
+                        case USB_DEVICE_TEST_MODE:
+                                dev_dbg(&dev->pdev->dev, "SETUP: TEST MODE\n");
+                                if ((wIndex & 0xff) ||
+                                        (dev->gadget.speed != USB_SPEED_HIGH))
+                                        ep0_stall(dev);
+
+                                switch (wIndex >> 8) {
+                                case TEST_J:
+                                case TEST_K:
+                                case TEST_SE0_NAK:
+                                case TEST_PACKET:
+                                case TEST_FORCE_EN:
+                                        if (prime_status_phase(dev, EP_DIR_IN))
+                                                ep0_stall(dev);
+                                        portsc1 = readl(&dev->op_regs->portsc1);
+                                        portsc1 |= (wIndex & 0xf00) << 8;
+                                        writel(portsc1, &dev->op_regs->portsc1);
+                                        goto end;
+                                default:
+                                        rc = -EOPNOTSUPP;
+                                }
+                                break;
+                        default:
+                                rc = -EOPNOTSUPP;
+                                break;
+                        }
+
+                        if (!gadget_is_otg(&dev->gadget))
+                                break;
+                        else if (setup->bRequest == USB_DEVICE_B_HNP_ENABLE) {
+                                dev->gadget.b_hnp_enable = 1;
+#ifdef  OTG_TRANSCEIVER
+                                if (!dev->lotg->otg.default_a)
+                                        dev->lotg->hsm.b_hnp_enable = 1;
+#endif
+                        } else if (setup->bRequest == USB_DEVICE_A_HNP_SUPPORT)
+                                dev->gadget.a_hnp_support = 1;
+                        else if (setup->bRequest ==
+                                        USB_DEVICE_A_ALT_HNP_SUPPORT)
+                                dev->gadget.a_alt_hnp_support = 1;
+                        else
+                                break;
+                } else
+                        break;
+
+                if (rc == 0) {
+                        if (prime_status_phase(dev, EP_DIR_IN))
+                                ep0_stall(dev);
+                }
+                goto end;
+        }
+
+        case USB_REQ_GET_DESCRIPTOR:
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_GET_DESCRIPTOR\n");
+                goto delegate;
+
+        case USB_REQ_SET_DESCRIPTOR:
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_SET_DESCRIPTOR unsupported\n");
+                goto delegate;
+
+        case USB_REQ_GET_CONFIGURATION:
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_GET_CONFIGURATION\n");
+                goto delegate;
+
+        case USB_REQ_SET_CONFIGURATION:
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_SET_CONFIGURATION\n");
+                goto delegate;
+
+        case USB_REQ_GET_INTERFACE:
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_GET_INTERFACE\n");
+                goto delegate;
+
+        case USB_REQ_SET_INTERFACE:
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_SET_INTERFACE\n");
+                goto delegate;
+
+        case USB_REQ_SYNCH_FRAME:
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_SYNCH_FRAME unsupported\n");
+                goto delegate;
+
+        default:
+                /* delegate USB standard requests to the gadget driver */
+                goto delegate;
+delegate:
+                /* USB requests handled by gadget */
+                if (wLength) {
+                        /* DATA phase from gadget, STATUS phase from udc */
+                        dev->ep0_dir = (setup->bRequestType & USB_DIR_IN)
+                                        ?  USB_DIR_IN : USB_DIR_OUT;
+                        dev_vdbg(&dev->pdev->dev,
+                                        "dev->ep0_dir = 0x%x, wLength = %d\n",
+                                        dev->ep0_dir, wLength);
+                        spin_unlock(&dev->lock);
+                        if (dev->driver->setup(&dev->gadget,
+                                        &dev->local_setup_buff) < 0)
+                                ep0_stall(dev);
+                        spin_lock(&dev->lock);
+                        dev->ep0_state = (setup->bRequestType & USB_DIR_IN)
+                                        ?  DATA_STATE_XMIT : DATA_STATE_RECV;
+                } else {
+                        /* no DATA phase, IN STATUS phase from gadget */
+                        dev->ep0_dir = USB_DIR_IN;
+                        dev_vdbg(&dev->pdev->dev,
+                                        "dev->ep0_dir = 0x%x, wLength = %d\n",
+                                        dev->ep0_dir, wLength);
+                        spin_unlock(&dev->lock);
+                        if (dev->driver->setup(&dev->gadget,
+                                        &dev->local_setup_buff) < 0)
+                                ep0_stall(dev);
+                        spin_lock(&dev->lock);
+                        dev->ep0_state = WAIT_FOR_OUT_STATUS;
+                }
+                break;
+        }
+end:
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* transfer completion, process endpoint request and free the completed dTDs
+ * for this request
+ */
+static int process_ep_req(struct langwell_udc *dev, int index,
+                struct langwell_request *curr_req)
+{
+        struct langwell_dtd     *curr_dtd;
+        struct langwell_dqh     *curr_dqh;
+        int                     td_complete, actual, remaining_length;
+        int                     i, dir;
+        u8                      dtd_status = 0;
+        int                     retval = 0;
+
+        curr_dqh = &dev->ep_dqh[index];
+        dir = index % 2;
+
+        curr_dtd = curr_req->head;
+        td_complete = 0;
+        actual = curr_req->req.length;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        for (i = 0; i < curr_req->dtd_count; i++) {
+
+                /* command execution states by dTD */
+                dtd_status = curr_dtd->dtd_status;
+
+                barrier();
+                remaining_length = le16_to_cpu(curr_dtd->dtd_total);
+                actual -= remaining_length;
+
+                if (!dtd_status) {
+                        /* transfers completed successfully */
+                        if (!remaining_length) {
+                                td_complete++;
+                                dev_vdbg(&dev->pdev->dev,
+                                        "dTD transmitted successfully\n");
+                        } else {
+                                if (dir) {
+                                        dev_vdbg(&dev->pdev->dev,
+                                                "TX dTD remains data\n");
+                                        retval = -EPROTO;
+                                        break;
+
+                                } else {
+                                        td_complete++;
+                                        break;
+                                }
+                        }
+                } else {
+                        /* transfers completed with errors */
+                        if (dtd_status & DTD_STS_ACTIVE) {
+                                dev_dbg(&dev->pdev->dev,
+                                        "dTD status ACTIVE dQH[%d]\n", index);
+                                retval = 1;
+                                return retval;
+                        } else if (dtd_status & DTD_STS_HALTED) {
+                                dev_err(&dev->pdev->dev,
+                                        "dTD error %08x dQH[%d]\n",
+                                        dtd_status, index);
+                                /* clear the errors and halt condition */
+                                curr_dqh->dtd_status = 0;
+                                retval = -EPIPE;
+                                break;
+                        } else if (dtd_status & DTD_STS_DBE) {
+                                dev_dbg(&dev->pdev->dev,
+                                        "data buffer (overflow) error\n");
+                                retval = -EPROTO;
+                                break;
+                        } else if (dtd_status & DTD_STS_TRE) {
+                                dev_dbg(&dev->pdev->dev,
+                                        "transaction(ISO) error\n");
+                                retval = -EILSEQ;
+                                break;
+                        } else
+                                dev_err(&dev->pdev->dev,
+                                        "unknown error (0x%x)!\n",
+                                        dtd_status);
+                }
+
+                if (i != curr_req->dtd_count - 1)
+                        curr_dtd = (struct langwell_dtd *)
+                                curr_dtd->next_dtd_virt;
+        }
+
+        if (retval)
+                return retval;
+
+        curr_req->req.actual = actual;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+
+/* complete DATA or STATUS phase of ep0 prime status phase if needed */
+static void ep0_req_complete(struct langwell_udc *dev,
+                struct langwell_ep *ep0, struct langwell_request *req)
+{
+        u32     new_addr;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (dev->usb_state == USB_STATE_ADDRESS) {
+                /* set the new address */
+                new_addr = (u32)dev->dev_addr;
+                writel(new_addr << USBADR_SHIFT, &dev->op_regs->deviceaddr);
+
+                new_addr = USBADR(readl(&dev->op_regs->deviceaddr));
+                dev_vdbg(&dev->pdev->dev, "new_addr = %d\n", new_addr);
+        }
+
+        done(ep0, req, 0);
+
+        switch (dev->ep0_state) {
+        case DATA_STATE_XMIT:
+                /* receive status phase */
+                if (prime_status_phase(dev, EP_DIR_OUT))
+                        ep0_stall(dev);
+                break;
+        case DATA_STATE_RECV:
+                /* send status phase */
+                if (prime_status_phase(dev, EP_DIR_IN))
+                        ep0_stall(dev);
+                break;
+        case WAIT_FOR_OUT_STATUS:
+                dev->ep0_state = WAIT_FOR_SETUP;
+                break;
+        case WAIT_FOR_SETUP:
+                dev_err(&dev->pdev->dev, "unexpect ep0 packets\n");
+                break;
+        default:
+                ep0_stall(dev);
+                break;
+        }
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* USB transfer completion interrupt */
+static void handle_trans_complete(struct langwell_udc *dev)
+{
+        u32                     complete_bits;
+        int                     i, ep_num, dir, bit_mask, status;
+        struct langwell_ep      *epn;
+        struct langwell_request *curr_req, *temp_req;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        complete_bits = readl(&dev->op_regs->endptcomplete);
+        dev_vdbg(&dev->pdev->dev, "endptcomplete register: 0x%08x\n",
+                        complete_bits);
+
+        /* Write-Clear the bits in endptcomplete register */
+        writel(complete_bits, &dev->op_regs->endptcomplete);
+
+        if (!complete_bits) {
+                dev_dbg(&dev->pdev->dev, "complete_bits = 0\n");
+                goto done;
+        }
+
+        for (i = 0; i < dev->ep_max; i++) {
+                ep_num = i / 2;
+                dir = i % 2;
+
+                bit_mask = 1 << (ep_num + 16 * dir);
+
+                if (!(complete_bits & bit_mask))
+                        continue;
+
+                /* ep0 */
+                if (i == 1)
+                        epn = &dev->ep[0];
+                else
+                        epn = &dev->ep[i];
+
+                if (epn->name == NULL) {
+                        dev_warn(&dev->pdev->dev, "invalid endpoint\n");
+                        continue;
+                }
+
+                if (i < 2)
+                        /* ep0 in and out */
+                        dev_dbg(&dev->pdev->dev, "%s-%s transfer completed\n",
+                                        epn->name,
+                                        is_in(epn) ? "in" : "out");
+                else
+                        dev_dbg(&dev->pdev->dev, "%s transfer completed\n",
+                                        epn->name);
+
+                /* process the req queue until an uncomplete request */
+                list_for_each_entry_safe(curr_req, temp_req,
+                                &epn->queue, queue) {
+                        status = process_ep_req(dev, i, curr_req);
+                        dev_vdbg(&dev->pdev->dev, "%s req status: %d\n",
+                                        epn->name, status);
+
+                        if (status)
+                                break;
+
+                        /* write back status to req */
+                        curr_req->req.status = status;
+
+                        /* ep0 request completion */
+                        if (ep_num == 0) {
+                                ep0_req_complete(dev, epn, curr_req);
+                                break;
+                        } else {
+                                done(epn, curr_req, status);
+                        }
+                }
+        }
+done:
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* port change detect interrupt handler */
+static void handle_port_change(struct langwell_udc *dev)
+{
+        u32     portsc1, devlc;
+        u32     speed;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (dev->bus_reset)
+                dev->bus_reset = 0;
+
+        portsc1 = readl(&dev->op_regs->portsc1);
+        devlc = readl(&dev->op_regs->devlc);
+        dev_vdbg(&dev->pdev->dev, "portsc1 = 0x%08x, devlc = 0x%08x\n",
+                        portsc1, devlc);
+
+        /* bus reset is finished */
+        if (!(portsc1 & PORTS_PR)) {
+                /* get the speed */
+                speed = LPM_PSPD(devlc);
+                switch (speed) {
+                case LPM_SPEED_HIGH:
+                        dev->gadget.speed = USB_SPEED_HIGH;
+                        break;
+                case LPM_SPEED_FULL:
+                        dev->gadget.speed = USB_SPEED_FULL;
+                        break;
+                case LPM_SPEED_LOW:
+                        dev->gadget.speed = USB_SPEED_LOW;
+                        break;
+                default:
+                        dev->gadget.speed = USB_SPEED_UNKNOWN;
+                        break;
+                }
+                dev_vdbg(&dev->pdev->dev,
+                                "speed = %d, dev->gadget.speed = %d\n",
+                                speed, dev->gadget.speed);
+        }
+
+        /* LPM L0 to L1 */
+        if (dev->lpm && dev->lpm_state == LPM_L0)
+                if (portsc1 & PORTS_SUSP && portsc1 & PORTS_SLP) {
+                        dev_info(&dev->pdev->dev, "LPM L0 to L1\n");
+                        dev->lpm_state = LPM_L1;
+                }
+
+        /* LPM L1 to L0, force resume or remote wakeup finished */
+        if (dev->lpm && dev->lpm_state == LPM_L1)
+                if (!(portsc1 & PORTS_SUSP)) {
+                        dev_info(&dev->pdev->dev, "LPM L1 to L0\n");
+                        dev->lpm_state = LPM_L0;
+                }
+
+        /* update USB state */
+        if (!dev->resume_state)
+                dev->usb_state = USB_STATE_DEFAULT;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* USB reset interrupt handler */
+static void handle_usb_reset(struct langwell_udc *dev)
+{
+        u32             deviceaddr,
+                        endptsetupstat,
+                        endptcomplete;
+        unsigned long   timeout;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* Write-Clear the device address */
+        deviceaddr = readl(&dev->op_regs->deviceaddr);
+        writel(deviceaddr & ~USBADR_MASK, &dev->op_regs->deviceaddr);
+
+        dev->dev_addr = 0;
+
+        /* clear usb state */
+        dev->resume_state = 0;
+
+        /* LPM L1 to L0, reset */
+        if (dev->lpm)
+                dev->lpm_state = LPM_L0;
+
+        dev->ep0_dir = USB_DIR_OUT;
+        dev->ep0_state = WAIT_FOR_SETUP;
+
+        /* remote wakeup reset to 0 when the device is reset */
+        dev->remote_wakeup = 0;
+        dev->dev_status = 1 << USB_DEVICE_SELF_POWERED;
+        dev->gadget.b_hnp_enable = 0;
+        dev->gadget.a_hnp_support = 0;
+        dev->gadget.a_alt_hnp_support = 0;
+
+        /* Write-Clear all the setup token semaphores */
+        endptsetupstat = readl(&dev->op_regs->endptsetupstat);
+        writel(endptsetupstat, &dev->op_regs->endptsetupstat);
+
+        /* Write-Clear all the endpoint complete status bits */
+        endptcomplete = readl(&dev->op_regs->endptcomplete);
+        writel(endptcomplete, &dev->op_regs->endptcomplete);
+
+        /* wait until all endptprime bits cleared */
+        timeout = jiffies + PRIME_TIMEOUT;
+        while (readl(&dev->op_regs->endptprime)) {
+                if (time_after(jiffies, timeout)) {
+                        dev_err(&dev->pdev->dev, "USB reset timeout\n");
+                        break;
+                }
+                cpu_relax();
+        }
+
+        /* write 1s to endptflush register to clear any primed buffers */
+        writel((u32) ~0, &dev->op_regs->endptflush);
+
+        if (readl(&dev->op_regs->portsc1) & PORTS_PR) {
+                dev_vdbg(&dev->pdev->dev, "USB bus reset\n");
+                /* bus is reseting */
+                dev->bus_reset = 1;
+
+                /* reset all the queues, stop all USB activities */
+                stop_activity(dev, dev->driver);
+                dev->usb_state = USB_STATE_DEFAULT;
+        } else {
+                dev_vdbg(&dev->pdev->dev, "device controller reset\n");
+                /* controller reset */
+                langwell_udc_reset(dev);
+
+                /* reset all the queues, stop all USB activities */
+                stop_activity(dev, dev->driver);
+
+                /* reset ep0 dQH and endptctrl */
+                ep0_reset(dev);
+
+                /* enable interrupt and set controller to run state */
+                langwell_udc_start(dev);
+
+                dev->usb_state = USB_STATE_ATTACHED;
+        }
+
+#ifdef  OTG_TRANSCEIVER
+        /* refer to USB OTG 6.6.2.3 b_hnp_en is cleared */
+        if (!dev->lotg->otg.default_a)
+                dev->lotg->hsm.b_hnp_enable = 0;
+#endif
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* USB bus suspend/resume interrupt */
+static void handle_bus_suspend(struct langwell_udc *dev)
+{
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        dev->resume_state = dev->usb_state;
+        dev->usb_state = USB_STATE_SUSPENDED;
+
+#ifdef  OTG_TRANSCEIVER
+        if (dev->lotg->otg.default_a) {
+                if (dev->lotg->hsm.b_bus_suspend_vld == 1) {
+                        dev->lotg->hsm.b_bus_suspend = 1;
+                        /* notify transceiver the state changes */
+                        if (spin_trylock(&dev->lotg->wq_lock)) {
+                                langwell_update_transceiver();
+                                spin_unlock(&dev->lotg->wq_lock);
+                        }
+                }
+                dev->lotg->hsm.b_bus_suspend_vld++;
+        } else {
+                if (!dev->lotg->hsm.a_bus_suspend) {
+                        dev->lotg->hsm.a_bus_suspend = 1;
+                        /* notify transceiver the state changes */
+                        if (spin_trylock(&dev->lotg->wq_lock)) {
+                                langwell_update_transceiver();
+                                spin_unlock(&dev->lotg->wq_lock);
+                        }
+                }
+        }
+#endif
+
+        /* report suspend to the driver */
+        if (dev->driver) {
+                if (dev->driver->suspend) {
+                        spin_unlock(&dev->lock);
+                        dev->driver->suspend(&dev->gadget);
+                        spin_lock(&dev->lock);
+                        dev_dbg(&dev->pdev->dev, "suspend %s\n",
+                                        dev->driver->driver.name);
+                }
+        }
+
+        /* enter PHY low power suspend */
+        if (dev->pdev->device != 0x0829)
+                langwell_phy_low_power(dev, 0);
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+static void handle_bus_resume(struct langwell_udc *dev)
+{
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        dev->usb_state = dev->resume_state;
+        dev->resume_state = 0;
+
+        /* exit PHY low power suspend */
+        if (dev->pdev->device != 0x0829)
+                langwell_phy_low_power(dev, 0);
+
+#ifdef  OTG_TRANSCEIVER
+        if (dev->lotg->otg.default_a == 0)
+                dev->lotg->hsm.a_bus_suspend = 0;
+#endif
+
+        /* report resume to the driver */
+        if (dev->driver) {
+                if (dev->driver->resume) {
+                        spin_unlock(&dev->lock);
+                        dev->driver->resume(&dev->gadget);
+                        spin_lock(&dev->lock);
+                        dev_dbg(&dev->pdev->dev, "resume %s\n",
+                                        dev->driver->driver.name);
+                }
+        }
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* USB device controller interrupt handler */
+static irqreturn_t langwell_irq(int irq, void *_dev)
+{
+        struct langwell_udc     *dev = _dev;
+        u32                     usbsts,
+                                usbintr,
+                                irq_sts,
+                                portsc1;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (dev->stopped) {
+                dev_vdbg(&dev->pdev->dev, "handle IRQ_NONE\n");
+                dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+                return IRQ_NONE;
+        }
+
+        spin_lock(&dev->lock);
+
+        /* USB status */
+        usbsts = readl(&dev->op_regs->usbsts);
+
+        /* USB interrupt enable */
+        usbintr = readl(&dev->op_regs->usbintr);
+
+        irq_sts = usbsts & usbintr;
+        dev_vdbg(&dev->pdev->dev,
+                        "usbsts = 0x%08x, usbintr = 0x%08x, irq_sts = 0x%08x\n",
+                        usbsts, usbintr, irq_sts);
+
+        if (!irq_sts) {
+                dev_vdbg(&dev->pdev->dev, "handle IRQ_NONE\n");
+                dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+                spin_unlock(&dev->lock);
+                return IRQ_NONE;
+        }
+
+        /* Write-Clear interrupt status bits */
+        writel(irq_sts, &dev->op_regs->usbsts);
+
+        /* resume from suspend */
+        portsc1 = readl(&dev->op_regs->portsc1);
+        if (dev->usb_state == USB_STATE_SUSPENDED)
+                if (!(portsc1 & PORTS_SUSP))
+                        handle_bus_resume(dev);
+
+        /* USB interrupt */
+        if (irq_sts & STS_UI) {
+                dev_vdbg(&dev->pdev->dev, "USB interrupt\n");
+
+                /* setup packet received from ep0 */
+                if (readl(&dev->op_regs->endptsetupstat)
+                                & EP0SETUPSTAT_MASK) {
+                        dev_vdbg(&dev->pdev->dev,
+                                "USB SETUP packet received interrupt\n");
+                        /* setup tripwire semaphone */
+                        setup_tripwire(dev);
+                        handle_setup_packet(dev, &dev->local_setup_buff);
+                }
+
+                /* USB transfer completion */
+                if (readl(&dev->op_regs->endptcomplete)) {
+                        dev_vdbg(&dev->pdev->dev,
+                                "USB transfer completion interrupt\n");
+                        handle_trans_complete(dev);
+                }
+        }
+
+        /* SOF received interrupt (for ISO transfer) */
+        if (irq_sts & STS_SRI) {
+                /* FIXME */
+                /* dev_vdbg(&dev->pdev->dev, "SOF received interrupt\n"); */
+        }
+
+        /* port change detect interrupt */
+        if (irq_sts & STS_PCI) {
+                dev_vdbg(&dev->pdev->dev, "port change detect interrupt\n");
+                handle_port_change(dev);
+        }
+
+        /* suspend interrrupt */
+        if (irq_sts & STS_SLI) {
+                dev_vdbg(&dev->pdev->dev, "suspend interrupt\n");
+                handle_bus_suspend(dev);
+        }
+
+        /* USB reset interrupt */
+        if (irq_sts & STS_URI) {
+                dev_vdbg(&dev->pdev->dev, "USB reset interrupt\n");
+                handle_usb_reset(dev);
+        }
+
+        /* USB error or system error interrupt */
+        if (irq_sts & (STS_UEI | STS_SEI)) {
+                /* FIXME */
+                dev_warn(&dev->pdev->dev, "error IRQ, irq_sts: %x\n", irq_sts);
+        }
+
+        spin_unlock(&dev->lock);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return IRQ_HANDLED;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* release device structure */
+static void gadget_release(struct device *_dev)
+{
+        struct langwell_udc     *dev = the_controller;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        complete(dev->done);
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        kfree(dev);
+}
+
+
+/* enable SRAM caching if SRAM detected */
+static void sram_init(struct langwell_udc *dev)
+{
+        struct pci_dev          *pdev = dev->pdev;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        dev->sram_addr = pci_resource_start(pdev, 1);
+        dev->sram_size = pci_resource_len(pdev, 1);
+        dev_info(&dev->pdev->dev, "Found private SRAM at %x size:%x\n",
+                        dev->sram_addr, dev->sram_size);
+        dev->got_sram = 1;
+
+        if (pci_request_region(pdev, 1, kobject_name(&pdev->dev.kobj))) {
+                dev_warn(&dev->pdev->dev, "SRAM request failed\n");
+                dev->got_sram = 0;
+        } else if (!dma_declare_coherent_memory(&pdev->dev, dev->sram_addr,
+                        dev->sram_addr, dev->sram_size, DMA_MEMORY_MAP)) {
+                dev_warn(&dev->pdev->dev, "SRAM DMA declare failed\n");
+                pci_release_region(pdev, 1);
+                dev->got_sram = 0;
+        }
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* release SRAM caching */
+static void sram_deinit(struct langwell_udc *dev)
+{
+        struct pci_dev *pdev = dev->pdev;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        dma_release_declared_memory(&pdev->dev);
+        pci_release_region(pdev, 1);
+
+        dev->got_sram = 0;
+
+        dev_info(&dev->pdev->dev, "release SRAM caching\n");
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* tear down the binding between this driver and the pci device */
+static void langwell_udc_remove(struct pci_dev *pdev)
+{
+        struct langwell_udc     *dev = the_controller;
+
+        DECLARE_COMPLETION(done);
+
+        BUG_ON(dev->driver);
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        dev->done = &done;
+
+#ifndef OTG_TRANSCEIVER
+        /* free dTD dma_pool and dQH */
+        if (dev->dtd_pool)
+                dma_pool_destroy(dev->dtd_pool);
+
+        if (dev->ep_dqh)
+                dma_free_coherent(&pdev->dev, dev->ep_dqh_size,
+                        dev->ep_dqh, dev->ep_dqh_dma);
+
+        /* release SRAM caching */
+        if (dev->has_sram && dev->got_sram)
+                sram_deinit(dev);
+#endif
+
+        if (dev->status_req) {
+                kfree(dev->status_req->req.buf);
+                kfree(dev->status_req);
+        }
+
+        kfree(dev->ep);
+
+        /* disable IRQ handler */
+        if (dev->got_irq)
+                free_irq(pdev->irq, dev);
+
+#ifndef OTG_TRANSCEIVER
+        if (dev->cap_regs)
+                iounmap(dev->cap_regs);
+
+        if (dev->region)
+                release_mem_region(pci_resource_start(pdev, 0),
+                                pci_resource_len(pdev, 0));
+
+        if (dev->enabled)
+                pci_disable_device(pdev);
+#else
+        if (dev->transceiver) {
+                otg_put_transceiver(dev->transceiver);
+                dev->transceiver = NULL;
+                dev->lotg = NULL;
+        }
+#endif
+
+        dev->cap_regs = NULL;
+
+        dev_info(&dev->pdev->dev, "unbind\n");
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+
+        device_unregister(&dev->gadget.dev);
+        device_remove_file(&pdev->dev, &dev_attr_langwell_udc);
+        device_remove_file(&pdev->dev, &dev_attr_remote_wakeup);
+
+#ifndef OTG_TRANSCEIVER
+        pci_set_drvdata(pdev, NULL);
+#endif
+
+        /* free dev, wait for the release() finished */
+        wait_for_completion(&done);
+
+        the_controller = NULL;
+}
+
+
+/*
+ * wrap this driver around the specified device, but
+ * don't respond over USB until a gadget driver binds to us.
+ */
+static int langwell_udc_probe(struct pci_dev *pdev,
+                const struct pci_device_id *id)
+{
+        struct langwell_udc     *dev;
+#ifndef OTG_TRANSCEIVER
+        unsigned long           resource, len;
+#endif
+        void                    __iomem *base = NULL;
+        size_t                  size;
+        int                     retval;
+
+        if (the_controller) {
+                dev_warn(&pdev->dev, "ignoring\n");
+                return -EBUSY;
+        }
+
+        /* alloc, and start init */
+        dev = kzalloc(sizeof *dev, GFP_KERNEL);
+        if (dev == NULL) {
+                retval = -ENOMEM;
+                goto error;
+        }
+
+        /* initialize device spinlock */
+        spin_lock_init(&dev->lock);
+
+        dev->pdev = pdev;
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+#ifdef  OTG_TRANSCEIVER
+        /* PCI device is already enabled by otg_transceiver driver */
+        dev->enabled = 1;
+
+        /* mem region and register base */
+        dev->region = 1;
+        dev->transceiver = otg_get_transceiver();
+        dev->lotg = otg_to_langwell(dev->transceiver);
+        base = dev->lotg->regs;
+#else
+        pci_set_drvdata(pdev, dev);
+
+        /* now all the pci goodies ... */
+        if (pci_enable_device(pdev) < 0) {
+                retval = -ENODEV;
+                goto error;
+        }
+        dev->enabled = 1;
+
+        /* control register: BAR 0 */
+        resource = pci_resource_start(pdev, 0);
+        len = pci_resource_len(pdev, 0);
+        if (!request_mem_region(resource, len, driver_name)) {
+                dev_err(&dev->pdev->dev, "controller already in use\n");
+                retval = -EBUSY;
+                goto error;
+        }
+        dev->region = 1;
+
+        base = ioremap_nocache(resource, len);
+#endif
+        if (base == NULL) {
+                dev_err(&dev->pdev->dev, "can't map memory\n");
+                retval = -EFAULT;
+                goto error;
+        }
+
+        dev->cap_regs = (struct langwell_cap_regs __iomem *) base;
+        dev_vdbg(&dev->pdev->dev, "dev->cap_regs: %p\n", dev->cap_regs);
+        dev->op_regs = (struct langwell_op_regs __iomem *)
+                (base + OP_REG_OFFSET);
+        dev_vdbg(&dev->pdev->dev, "dev->op_regs: %p\n", dev->op_regs);
+
+        /* irq setup after old hardware is cleaned up */
+        if (!pdev->irq) {
+                dev_err(&dev->pdev->dev, "No IRQ. Check PCI setup!\n");
+                retval = -ENODEV;
+                goto error;
+        }
+
+        dev->has_sram = 1;
+        dev->got_sram = 0;
+        dev_vdbg(&dev->pdev->dev, "dev->has_sram: %d\n", dev->has_sram);
+
+#ifndef OTG_TRANSCEIVER
+        /* enable SRAM caching if detected */
+        if (dev->has_sram && !dev->got_sram)
+                sram_init(dev);
+
+        dev_info(&dev->pdev->dev,
+                        "irq %d, io mem: 0x%08lx, len: 0x%08lx, pci mem 0x%p\n",
+                        pdev->irq, resource, len, base);
+        /* enables bus-mastering for device dev */
+        pci_set_master(pdev);
+
+        if (request_irq(pdev->irq, langwell_irq, IRQF_SHARED,
+                                driver_name, dev) != 0) {
+                dev_err(&dev->pdev->dev,
+                                "request interrupt %d failed\n", pdev->irq);
+                retval = -EBUSY;
+                goto error;
+        }
+        dev->got_irq = 1;
+#endif
+
+        /* set stopped bit */
+        dev->stopped = 1;
+
+        /* capabilities and endpoint number */
+        dev->lpm = (readl(&dev->cap_regs->hccparams) & HCC_LEN) ? 1 : 0;
+        dev->dciversion = readw(&dev->cap_regs->dciversion);
+        dev->devcap = (readl(&dev->cap_regs->dccparams) & DEVCAP) ? 1 : 0;
+        dev_vdbg(&dev->pdev->dev, "dev->lpm: %d\n", dev->lpm);
+        dev_vdbg(&dev->pdev->dev, "dev->dciversion: 0x%04x\n",
+                        dev->dciversion);
+        dev_vdbg(&dev->pdev->dev, "dccparams: 0x%08x\n",
+                        readl(&dev->cap_regs->dccparams));
+        dev_vdbg(&dev->pdev->dev, "dev->devcap: %d\n", dev->devcap);
+        if (!dev->devcap) {
+                dev_err(&dev->pdev->dev, "can't support device mode\n");
+                retval = -ENODEV;
+                goto error;
+        }
+
+        /* a pair of endpoints (out/in) for each address */
+        dev->ep_max = DEN(readl(&dev->cap_regs->dccparams)) * 2;
+        dev_vdbg(&dev->pdev->dev, "dev->ep_max: %d\n", dev->ep_max);
+
+        /* allocate endpoints memory */
+        dev->ep = kzalloc(sizeof(struct langwell_ep) * dev->ep_max,
+                        GFP_KERNEL);
+        if (!dev->ep) {
+                dev_err(&dev->pdev->dev, "allocate endpoints memory failed\n");
+                retval = -ENOMEM;
+                goto error;
+        }
+
+        /* allocate device dQH memory */
+        size = dev->ep_max * sizeof(struct langwell_dqh);
+        dev_vdbg(&dev->pdev->dev, "orig size = %zd\n", size);
+        if (size < DQH_ALIGNMENT)
+                size = DQH_ALIGNMENT;
+        else if ((size % DQH_ALIGNMENT) != 0) {
+                size += DQH_ALIGNMENT + 1;
+                size &= ~(DQH_ALIGNMENT - 1);
+        }
+        dev->ep_dqh = dma_alloc_coherent(&pdev->dev, size,
+                                        &dev->ep_dqh_dma, GFP_KERNEL);
+        if (!dev->ep_dqh) {
+                dev_err(&dev->pdev->dev, "allocate dQH memory failed\n");
+                retval = -ENOMEM;
+                goto error;
+        }
+        dev->ep_dqh_size = size;
+        dev_vdbg(&dev->pdev->dev, "ep_dqh_size = %zd\n", dev->ep_dqh_size);
+
+        /* initialize ep0 status request structure */
+        dev->status_req = kzalloc(sizeof(struct langwell_request), GFP_KERNEL);
+        if (!dev->status_req) {
+                dev_err(&dev->pdev->dev,
+                                "allocate status_req memory failed\n");
+                retval = -ENOMEM;
+                goto error;
+        }
+        INIT_LIST_HEAD(&dev->status_req->queue);
+
+        /* allocate a small amount of memory to get valid address */
+        dev->status_req->req.buf = kmalloc(8, GFP_KERNEL);
+        dev->status_req->req.dma = virt_to_phys(dev->status_req->req.buf);
+
+        dev->resume_state = USB_STATE_NOTATTACHED;
+        dev->usb_state = USB_STATE_POWERED;
+        dev->ep0_dir = USB_DIR_OUT;
+
+        /* remote wakeup reset to 0 when the device is reset */
+        dev->remote_wakeup = 0;
+        dev->dev_status = 1 << USB_DEVICE_SELF_POWERED;
+
+#ifndef OTG_TRANSCEIVER
+        /* reset device controller */
+        langwell_udc_reset(dev);
+#endif
+
+        /* initialize gadget structure */
+        dev->gadget.ops = &langwell_ops;        /* usb_gadget_ops */
+        dev->gadget.ep0 = &dev->ep[0].ep;       /* gadget ep0 */
+        INIT_LIST_HEAD(&dev->gadget.ep_list);   /* ep_list */
+        dev->gadget.speed = USB_SPEED_UNKNOWN;  /* speed */
+        dev->gadget.is_dualspeed = 1;           /* support dual speed */
+#ifdef  OTG_TRANSCEIVER
+        dev->gadget.is_otg = 1;                 /* support otg mode */
+#endif
+
+        /* the "gadget" abstracts/virtualizes the controller */
+        dev_set_name(&dev->gadget.dev, "gadget");
+        dev->gadget.dev.parent = &pdev->dev;
+        dev->gadget.dev.dma_mask = pdev->dev.dma_mask;
+        dev->gadget.dev.release = gadget_release;
+        dev->gadget.name = driver_name;         /* gadget name */
+
+        /* controller endpoints reinit */
+        eps_reinit(dev);
+
+#ifndef OTG_TRANSCEIVER
+        /* reset ep0 dQH and endptctrl */
+        ep0_reset(dev);
+#endif
+
+        /* create dTD dma_pool resource */
+        dev->dtd_pool = dma_pool_create("langwell_dtd",
+                        &dev->pdev->dev,
+                        sizeof(struct langwell_dtd),
+                        DTD_ALIGNMENT,
+                        DMA_BOUNDARY);
+
+        if (!dev->dtd_pool) {
+                retval = -ENOMEM;
+                goto error;
+        }
+
+        /* done */
+        dev_info(&dev->pdev->dev, "%s\n", driver_desc);
+        dev_info(&dev->pdev->dev, "irq %d, pci mem %p\n", pdev->irq, base);
+        dev_info(&dev->pdev->dev, "Driver version: " DRIVER_VERSION "\n");
+        dev_info(&dev->pdev->dev, "Support (max) %d endpoints\n", dev->ep_max);
+        dev_info(&dev->pdev->dev, "Device interface version: 0x%04x\n",
+                        dev->dciversion);
+        dev_info(&dev->pdev->dev, "Controller mode: %s\n",
+                        dev->devcap ? "Device" : "Host");
+        dev_info(&dev->pdev->dev, "Support USB LPM: %s\n",
+                        dev->lpm ? "Yes" : "No");
+
+        dev_vdbg(&dev->pdev->dev,
+                        "After langwell_udc_probe(), print all registers:\n");
+        print_all_registers(dev);
+
+        the_controller = dev;
+
+        retval = device_register(&dev->gadget.dev);
+        if (retval)
+                goto error;
+
+        retval = usb_add_gadget_udc(&pdev->dev, &dev->gadget);
+        if (retval)
+                goto error;
+
+        retval = device_create_file(&pdev->dev, &dev_attr_langwell_udc);
+        if (retval)
+                goto error;
+
+        retval = device_create_file(&pdev->dev, &dev_attr_remote_wakeup);
+        if (retval)
+                goto error_attr1;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+
+error_attr1:
+        device_remove_file(&pdev->dev, &dev_attr_langwell_udc);
+error:
+        if (dev) {
+                dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+                langwell_udc_remove(pdev);
+        }
+
+        return retval;
+}
+
+
+/* device controller suspend */
+static int langwell_udc_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+        struct langwell_udc     *dev = the_controller;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        usb_del_gadget_udc(&dev->gadget);
+        /* disable interrupt and set controller to stop state */
+        langwell_udc_stop(dev);
+
+        /* disable IRQ handler */
+        if (dev->got_irq)
+                free_irq(pdev->irq, dev);
+        dev->got_irq = 0;
+
+        /* save PCI state */
+        pci_save_state(pdev);
+
+        spin_lock_irq(&dev->lock);
+        /* stop all usb activities */
+        stop_activity(dev, dev->driver);
+        spin_unlock_irq(&dev->lock);
+
+        /* free dTD dma_pool and dQH */
+        if (dev->dtd_pool)
+                dma_pool_destroy(dev->dtd_pool);
+
+        if (dev->ep_dqh)
+                dma_free_coherent(&pdev->dev, dev->ep_dqh_size,
+                        dev->ep_dqh, dev->ep_dqh_dma);
+
+        /* release SRAM caching */
+        if (dev->has_sram && dev->got_sram)
+                sram_deinit(dev);
+
+        /* set device power state */
+        pci_set_power_state(pdev, PCI_D3hot);
+
+        /* enter PHY low power suspend */
+        if (dev->pdev->device != 0x0829)
+                langwell_phy_low_power(dev, 1);
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+
+/* device controller resume */
+static int langwell_udc_resume(struct pci_dev *pdev)
+{
+        struct langwell_udc     *dev = the_controller;
+        size_t                  size;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* exit PHY low power suspend */
+        if (dev->pdev->device != 0x0829)
+                langwell_phy_low_power(dev, 0);
+
+        /* set device D0 power state */
+        pci_set_power_state(pdev, PCI_D0);
+
+        /* enable SRAM caching if detected */
+        if (dev->has_sram && !dev->got_sram)
+                sram_init(dev);
+
+        /* allocate device dQH memory */
+        size = dev->ep_max * sizeof(struct langwell_dqh);
+        dev_vdbg(&dev->pdev->dev, "orig size = %zd\n", size);
+        if (size < DQH_ALIGNMENT)
+                size = DQH_ALIGNMENT;
+        else if ((size % DQH_ALIGNMENT) != 0) {
+                size += DQH_ALIGNMENT + 1;
+                size &= ~(DQH_ALIGNMENT - 1);
+        }
+        dev->ep_dqh = dma_alloc_coherent(&pdev->dev, size,
+                                        &dev->ep_dqh_dma, GFP_KERNEL);
+        if (!dev->ep_dqh) {
+                dev_err(&dev->pdev->dev, "allocate dQH memory failed\n");
+                return -ENOMEM;
+        }
+        dev->ep_dqh_size = size;
+        dev_vdbg(&dev->pdev->dev, "ep_dqh_size = %zd\n", dev->ep_dqh_size);
+
+        /* create dTD dma_pool resource */
+        dev->dtd_pool = dma_pool_create("langwell_dtd",
+                        &dev->pdev->dev,
+                        sizeof(struct langwell_dtd),
+                        DTD_ALIGNMENT,
+                        DMA_BOUNDARY);
+
+        if (!dev->dtd_pool)
+                return -ENOMEM;
+
+        /* restore PCI state */
+        pci_restore_state(pdev);
+
+        /* enable IRQ handler */
+        if (request_irq(pdev->irq, langwell_irq, IRQF_SHARED,
+                                driver_name, dev) != 0) {
+                dev_err(&dev->pdev->dev, "request interrupt %d failed\n",
+                                pdev->irq);
+                return -EBUSY;
+        }
+        dev->got_irq = 1;
+
+        /* reset and start controller to run state */
+        if (dev->stopped) {
+                /* reset device controller */
+                langwell_udc_reset(dev);
+
+                /* reset ep0 dQH and endptctrl */
+                ep0_reset(dev);
+
+                /* start device if gadget is loaded */
+                if (dev->driver)
+                        langwell_udc_start(dev);
+        }
+
+        /* reset USB status */
+        dev->usb_state = USB_STATE_ATTACHED;
+        dev->ep0_state = WAIT_FOR_SETUP;
+        dev->ep0_dir = USB_DIR_OUT;
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+
+/* pci driver shutdown */
+static void langwell_udc_shutdown(struct pci_dev *pdev)
+{
+        struct langwell_udc     *dev = the_controller;
+        u32                     usbmode;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* reset controller mode to IDLE */
+        usbmode = readl(&dev->op_regs->usbmode);
+        dev_dbg(&dev->pdev->dev, "usbmode = 0x%08x\n", usbmode);
+        usbmode &= (~3 | MODE_IDLE);
+        writel(usbmode, &dev->op_regs->usbmode);
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+/*-------------------------------------------------------------------------*/
+
+static const struct pci_device_id pci_ids[] = { {
+        .class =        ((PCI_CLASS_SERIAL_USB << 8) | 0xfe),
+        .class_mask =   ~0,
+        .vendor =       0x8086,
+        .device =       0x0811,
+        .subvendor =    PCI_ANY_ID,
+        .subdevice =    PCI_ANY_ID,
+}, { /* end: all zeroes */ }
+};
+
+MODULE_DEVICE_TABLE(pci, pci_ids);
+
+
+static struct pci_driver langwell_pci_driver = {
+        .name =         (char *) driver_name,
+        .id_table =     pci_ids,
+
+        .probe =        langwell_udc_probe,
+        .remove =       langwell_udc_remove,
+
+        /* device controller suspend/resume */
+        .suspend =      langwell_udc_suspend,
+        .resume =       langwell_udc_resume,
+
+        .shutdown =     langwell_udc_shutdown,
+};
+
+
+static int __init init(void)
+{
+#ifdef  OTG_TRANSCEIVER
+        return langwell_register_peripheral(&langwell_pci_driver);
+#else
+        return pci_register_driver(&langwell_pci_driver);
+#endif
+}
+module_init(init);
+
+
+static void __exit cleanup(void)
+{
+#ifdef  OTG_TRANSCEIVER
+        return langwell_unregister_peripheral(&langwell_pci_driver);
+#else
+        pci_unregister_driver(&langwell_pci_driver);
+#endif
+}
+module_exit(cleanup);
+
+
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_AUTHOR("Xiaochen Shen <xiaochen.shen@intel.com>");
+MODULE_VERSION(DRIVER_VERSION);
+MODULE_LICENSE("GPL");
+
diff --git a/drivers/usb/gadget/langwell_udc.h b/drivers/usb/gadget/langwell_udc.h
new file mode 100644
index 00000000000..f1d9c1bb04f
--- /dev/null
+++ b/drivers/usb/gadget/langwell_udc.h
@@ -0,0 +1,233 @@
+/*
+ * Intel Langwell USB Device Controller driver
+ * Copyright (C) 2008-2009, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <linux/usb/langwell_udc.h>
+#include <linux/usb/langwell_otg.h>
+
+/*-------------------------------------------------------------------------*/
+
+/* driver data structures and utilities */
+
+/*
+ * dTD: Device Endpoint Transfer Descriptor
+ * describe to the device controller the location and quantity of
+ * data to be send/received for given transfer
+ */
+struct langwell_dtd {
+        u32     dtd_next;
+/* bits 31:5, next transfer element pointer */
+#define DTD_NEXT(d)     (((d)>>5)&0x7ffffff)
+#define DTD_NEXT_MASK   (0x7ffffff << 5)
+/* terminate */
+#define DTD_TERM        BIT(0)
+        /* bits 7:0, execution back states */
+        u32     dtd_status:8;
+#define DTD_STATUS(d)   (((d)>>0)&0xff)
+#define DTD_STS_ACTIVE  BIT(7)  /* active */
+#define DTD_STS_HALTED  BIT(6)  /* halted */
+#define DTD_STS_DBE     BIT(5)  /* data buffer error */
+#define DTD_STS_TRE     BIT(3)  /* transaction error  */
+        /* bits 9:8 */
+        u32     dtd_res0:2;
+        /* bits 11:10, multipier override */
+        u32     dtd_multo:2;
+#define DTD_MULTO       (BIT(11) | BIT(10))
+        /* bits 14:12 */
+        u32     dtd_res1:3;
+        /* bit 15, interrupt on complete */
+        u32     dtd_ioc:1;
+#define DTD_IOC         BIT(15)
+        /* bits 30:16, total bytes */
+        u32     dtd_total:15;
+#define DTD_TOTAL(d)    (((d)>>16)&0x7fff)
+#define DTD_MAX_TRANSFER_LENGTH 0x4000
+        /* bit 31 */
+        u32     dtd_res2:1;
+        /* dTD buffer pointer page 0 to 4 */
+        u32     dtd_buf[5];
+#define DTD_OFFSET_MASK 0xfff
+/* bits 31:12, buffer pointer */
+#define DTD_BUFFER(d)   (((d)>>12)&0x3ff)
+/* bits 11:0, current offset */
+#define DTD_C_OFFSET(d) (((d)>>0)&0xfff)
+/* bits 10:0, frame number */
+#define DTD_FRAME(d)    (((d)>>0)&0x7ff)
+
+        /* driver-private parts */
+
+        /* dtd dma address */
+        dma_addr_t              dtd_dma;
+        /* next dtd virtual address */
+        struct langwell_dtd     *next_dtd_virt;
+};
+
+
+/*
+ * dQH: Device Endpoint Queue Head
+ * describe where all transfers are managed
+ * 48-byte data structure, aligned on 64-byte boundary
+ *
+ * These are associated with dTD structure
+ */
+struct langwell_dqh {
+        /* endpoint capabilities and characteristics */
+        u32     dqh_res0:15;    /* bits 14:0 */
+        u32     dqh_ios:1;      /* bit 15, interrupt on setup */
+#define DQH_IOS         BIT(15)
+        u32     dqh_mpl:11;     /* bits 26:16, maximum packet length */
+#define DQH_MPL         (0x7ff << 16)
+        u32     dqh_res1:2;     /* bits 28:27 */
+        u32     dqh_zlt:1;      /* bit 29, zero length termination */
+#define DQH_ZLT         BIT(29)
+        u32     dqh_mult:2;     /* bits 31:30 */
+#define DQH_MULT        (BIT(30) | BIT(31))
+
+        /* current dTD pointer */
+        u32     dqh_current;    /* locate the transfer in progress */
+#define DQH_C_DTD(e)    \
+        (((e)>>5)&0x7ffffff)    /* bits 31:5, current dTD pointer */
+
+        /* transfer overlay, hardware parts of a struct langwell_dtd */
+        u32     dtd_next;
+        u32     dtd_status:8;   /* bits 7:0, execution back states */
+        u32     dtd_res0:2;     /* bits 9:8 */
+        u32     dtd_multo:2;    /* bits 11:10, multipier override */
+        u32     dtd_res1:3;     /* bits 14:12 */
+        u32     dtd_ioc:1;      /* bit 15, interrupt on complete */
+        u32     dtd_total:15;   /* bits 30:16, total bytes */
+        u32     dtd_res2:1;     /* bit 31 */
+        u32     dtd_buf[5];     /* dTD buffer pointer page 0 to 4 */
+
+        u32     dqh_res2;
+        struct usb_ctrlrequest  dqh_setup;      /* setup packet buffer */
+} __attribute__ ((aligned(64)));
+
+
+/* endpoint data structure */
+struct langwell_ep {
+        struct usb_ep           ep;
+        dma_addr_t              dma;
+        struct langwell_udc     *dev;
+        unsigned long           irqs;
+        struct list_head        queue;
+        struct langwell_dqh     *dqh;
+        const struct usb_endpoint_descriptor    *desc;
+        char                    name[14];
+        unsigned                stopped:1,
+                                ep_type:2,
+                                ep_num:8;
+};
+
+
+/* request data structure */
+struct langwell_request {
+        struct usb_request      req;
+        struct langwell_dtd     *dtd, *head, *tail;
+        struct langwell_ep      *ep;
+        dma_addr_t              dtd_dma;
+        struct list_head        queue;
+        unsigned                dtd_count;
+        unsigned                mapped:1;
+};
+
+
+/* ep0 transfer state */
+enum ep0_state {
+        WAIT_FOR_SETUP,
+        DATA_STATE_XMIT,
+        DATA_STATE_NEED_ZLP,
+        WAIT_FOR_OUT_STATUS,
+        DATA_STATE_RECV,
+};
+
+
+/* device suspend state */
+enum lpm_state {
+        LPM_L0, /* on */
+        LPM_L1, /* LPM L1 sleep */
+        LPM_L2, /* suspend */
+        LPM_L3, /* off */
+};
+
+
+/* device data structure */
+struct langwell_udc {
+        /* each pci device provides one gadget, several endpoints */
+        struct usb_gadget       gadget;
+        spinlock_t              lock;   /* device lock */
+        struct langwell_ep      *ep;
+        struct usb_gadget_driver        *driver;
+        struct otg_transceiver  *transceiver;
+        u8                      dev_addr;
+        u32                     usb_state;
+        u32                     resume_state;
+        u32                     bus_reset;
+        enum lpm_state          lpm_state;
+        enum ep0_state          ep0_state;
+        u32                     ep0_dir;
+        u16                     dciversion;
+        unsigned                ep_max;
+        unsigned                devcap:1,
+                                enabled:1,
+                                region:1,
+                                got_irq:1,
+                                powered:1,
+                                remote_wakeup:1,
+                                rate:1,
+                                is_reset:1,
+                                softconnected:1,
+                                vbus_active:1,
+                                suspended:1,
+                                stopped:1,
+                                lpm:1,          /* LPM capability */
+                                has_sram:1,     /* SRAM caching */
+                                got_sram:1;
+
+        /* pci state used to access those endpoints */
+        struct pci_dev          *pdev;
+
+        /* Langwell otg transceiver */
+        struct langwell_otg     *lotg;
+
+        /* control registers */
+        struct langwell_cap_regs        __iomem *cap_regs;
+        struct langwell_op_regs         __iomem *op_regs;
+
+        struct usb_ctrlrequest  local_setup_buff;
+        struct langwell_dqh     *ep_dqh;
+        size_t                  ep_dqh_size;
+        dma_addr_t              ep_dqh_dma;
+
+        /* ep0 status request */
+        struct langwell_request *status_req;
+
+        /* dma pool */
+        struct dma_pool         *dtd_pool;
+
+        /* make sure release() is done */
+        struct completion       *done;
+
+        /* for private SRAM caching */
+        unsigned int            sram_addr;
+        unsigned int            sram_size;
+
+        /* device status data for get_status request */
+        u16                     dev_status;
+};
+
diff --git a/drivers/usb/gadget/mv_udc_phy.c b/drivers/usb/gadget/mv_udc_phy.c
new file mode 100644
index 00000000000..d4dea97e38a
--- /dev/null
+++ b/drivers/usb/gadget/mv_udc_phy.c
@@ -0,0 +1,214 @@
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/io.h>
+#include <linux/errno.h>
+
+#include <mach/cputype.h>
+
+#ifdef CONFIG_ARCH_MMP
+
+#define UTMI_REVISION           0x0
+#define UTMI_CTRL               0x4
+#define UTMI_PLL                0x8
+#define UTMI_TX                 0xc
+#define UTMI_RX                 0x10
+#define UTMI_IVREF              0x14
+#define UTMI_T0                 0x18
+#define UTMI_T1                 0x1c
+#define UTMI_T2                 0x20
+#define UTMI_T3                 0x24
+#define UTMI_T4                 0x28
+#define UTMI_T5                 0x2c
+#define UTMI_RESERVE            0x30
+#define UTMI_USB_INT            0x34
+#define UTMI_DBG_CTL            0x38
+#define UTMI_OTG_ADDON          0x3c
+
+/* For UTMICTRL Register */
+#define UTMI_CTRL_USB_CLK_EN                    (1 << 31)
+/* pxa168 */
+#define UTMI_CTRL_SUSPEND_SET1                  (1 << 30)
+#define UTMI_CTRL_SUSPEND_SET2                  (1 << 29)
+#define UTMI_CTRL_RXBUF_PDWN                    (1 << 24)
+#define UTMI_CTRL_TXBUF_PDWN                    (1 << 11)
+
+#define UTMI_CTRL_INPKT_DELAY_SHIFT             30
+#define UTMI_CTRL_INPKT_DELAY_SOF_SHIFT         28
+#define UTMI_CTRL_PU_REF_SHIFT                  20
+#define UTMI_CTRL_ARC_PULLDN_SHIFT              12
+#define UTMI_CTRL_PLL_PWR_UP_SHIFT              1
+#define UTMI_CTRL_PWR_UP_SHIFT                  0
+/* For UTMI_PLL Register */
+#define UTMI_PLL_CLK_BLK_EN_SHIFT               24
+#define UTMI_PLL_FBDIV_SHIFT                    4
+#define UTMI_PLL_REFDIV_SHIFT                   0
+#define UTMI_PLL_FBDIV_MASK                     0x00000FF0
+#define UTMI_PLL_REFDIV_MASK                    0x0000000F
+#define UTMI_PLL_ICP_MASK                       0x00007000
+#define UTMI_PLL_KVCO_MASK                      0x00031000
+#define UTMI_PLL_PLLCALI12_SHIFT                29
+#define UTMI_PLL_PLLCALI12_MASK                 (0x3 << 29)
+#define UTMI_PLL_PLLVDD18_SHIFT                 27
+#define UTMI_PLL_PLLVDD18_MASK                  (0x3 << 27)
+#define UTMI_PLL_PLLVDD12_SHIFT                 25
+#define UTMI_PLL_PLLVDD12_MASK                  (0x3 << 25)
+#define UTMI_PLL_KVCO_SHIFT                     15
+#define UTMI_PLL_ICP_SHIFT                      12
+/* For UTMI_TX Register */
+#define UTMI_TX_REG_EXT_FS_RCAL_SHIFT           27
+#define UTMI_TX_REG_EXT_FS_RCAL_MASK            (0xf << 27)
+#define UTMI_TX_REG_EXT_FS_RCAL_EN_MASK         26
+#define UTMI_TX_REG_EXT_FS_RCAL_EN              (0x1 << 26)
+#define UTMI_TX_LOW_VDD_EN_SHIFT                11
+#define UTMI_TX_IMPCAL_VTH_SHIFT                14
+#define UTMI_TX_IMPCAL_VTH_MASK                 (0x7 << 14)
+#define UTMI_TX_CK60_PHSEL_SHIFT                17
+#define UTMI_TX_CK60_PHSEL_MASK                 (0xf << 17)
+#define UTMI_TX_TXVDD12_SHIFT                   22
+#define UTMI_TX_TXVDD12_MASK                    (0x3 << 22)
+#define UTMI_TX_AMP_SHIFT                       0
+#define UTMI_TX_AMP_MASK                        (0x7 << 0)
+/* For UTMI_RX Register */
+#define UTMI_RX_SQ_THRESH_SHIFT                 4
+#define UTMI_RX_SQ_THRESH_MASK                  (0xf << 4)
+#define UTMI_REG_SQ_LENGTH_SHIFT                15
+#define UTMI_REG_SQ_LENGTH_MASK                 (0x3 << 15)
+
+#define REG_RCAL_START                          0x00001000
+#define VCOCAL_START                            0x00200000
+#define KVCO_EXT                                0x00400000
+#define PLL_READY                               0x00800000
+#define CLK_BLK_EN                              0x01000000
+#endif
+
+static unsigned int u2o_read(unsigned int base, unsigned int offset)
+{
+        return readl(base + offset);
+}
+
+static void u2o_set(unsigned int base, unsigned int offset, unsigned int value)
+{
+        unsigned int reg;
+
+        reg = readl(base + offset);
+        reg |= value;
+        writel(reg, base + offset);
+        readl(base + offset);
+}
+
+static void u2o_clear(unsigned int base, unsigned int offset,
+        unsigned int value)
+{
+        unsigned int reg;
+
+        reg = readl(base + offset);
+        reg &= ~value;
+        writel(reg, base + offset);
+        readl(base + offset);
+}
+
+static void u2o_write(unsigned int base, unsigned int offset,
+        unsigned int value)
+{
+        writel(value, base + offset);
+        readl(base + offset);
+}
+
+#ifdef CONFIG_ARCH_MMP
+int mv_udc_phy_init(unsigned int base)
+{
+        unsigned long timeout;
+
+        /* Initialize the USB PHY power */
+        if (cpu_is_pxa910()) {
+                u2o_set(base, UTMI_CTRL, (1 << UTMI_CTRL_INPKT_DELAY_SOF_SHIFT)
+                        | (1 << UTMI_CTRL_PU_REF_SHIFT));
+        }
+
+        u2o_set(base, UTMI_CTRL, 1 << UTMI_CTRL_PLL_PWR_UP_SHIFT);
+        u2o_set(base, UTMI_CTRL, 1 << UTMI_CTRL_PWR_UP_SHIFT);
+
+        /* UTMI_PLL settings */
+        u2o_clear(base, UTMI_PLL, UTMI_PLL_PLLVDD18_MASK
+                | UTMI_PLL_PLLVDD12_MASK | UTMI_PLL_PLLCALI12_MASK
+                | UTMI_PLL_FBDIV_MASK | UTMI_PLL_REFDIV_MASK
+                | UTMI_PLL_ICP_MASK | UTMI_PLL_KVCO_MASK);
+
+        u2o_set(base, UTMI_PLL, (0xee << UTMI_PLL_FBDIV_SHIFT)
+                | (0xb << UTMI_PLL_REFDIV_SHIFT)
+                | (3 << UTMI_PLL_PLLVDD18_SHIFT)
+                | (3 << UTMI_PLL_PLLVDD12_SHIFT)
+                | (3 << UTMI_PLL_PLLCALI12_SHIFT)
+                | (1 << UTMI_PLL_ICP_SHIFT) | (3 << UTMI_PLL_KVCO_SHIFT));
+
+        /* UTMI_TX */
+        u2o_clear(base, UTMI_TX, UTMI_TX_REG_EXT_FS_RCAL_EN_MASK
+                | UTMI_TX_TXVDD12_MASK
+                | UTMI_TX_CK60_PHSEL_MASK | UTMI_TX_IMPCAL_VTH_MASK
+                | UTMI_TX_REG_EXT_FS_RCAL_MASK | UTMI_TX_AMP_MASK);
+        u2o_set(base, UTMI_TX, (3 << UTMI_TX_TXVDD12_SHIFT)
+                | (4 << UTMI_TX_CK60_PHSEL_SHIFT)
+                | (4 << UTMI_TX_IMPCAL_VTH_SHIFT)
+                | (8 << UTMI_TX_REG_EXT_FS_RCAL_SHIFT)
+                | (3 << UTMI_TX_AMP_SHIFT));
+
+        /* UTMI_RX */
+        u2o_clear(base, UTMI_RX, UTMI_RX_SQ_THRESH_MASK
+                | UTMI_REG_SQ_LENGTH_MASK);
+        if (cpu_is_pxa168())
+                u2o_set(base, UTMI_RX, (7 << UTMI_RX_SQ_THRESH_SHIFT)
+                        | (2 << UTMI_REG_SQ_LENGTH_SHIFT));
+        else
+                u2o_set(base, UTMI_RX, (0x7 << UTMI_RX_SQ_THRESH_SHIFT)
+                        | (2 << UTMI_REG_SQ_LENGTH_SHIFT));
+
+        /* UTMI_IVREF */
+        if (cpu_is_pxa168())
+                /*
+                 * fixing Microsoft Altair board interface with NEC hub issue -
+                 * Set UTMI_IVREF from 0x4a3 to 0x4bf
+                 */
+                u2o_write(base, UTMI_IVREF, 0x4bf);
+
+        /* calibrate */
+        timeout = jiffies + 100;
+        while ((u2o_read(base, UTMI_PLL) & PLL_READY) == 0) {
+                if (time_after(jiffies, timeout))
+                        return -ETIME;
+                cpu_relax();
+        }
+
+        /* toggle VCOCAL_START bit of UTMI_PLL */
+        udelay(200);
+        u2o_set(base, UTMI_PLL, VCOCAL_START);
+        udelay(40);
+        u2o_clear(base, UTMI_PLL, VCOCAL_START);
+
+        /* toggle REG_RCAL_START bit of UTMI_TX */
+        udelay(200);
+        u2o_set(base, UTMI_TX, REG_RCAL_START);
+        udelay(40);
+        u2o_clear(base, UTMI_TX, REG_RCAL_START);
+        udelay(200);
+
+        /* make sure phy is ready */
+        timeout = jiffies + 100;
+        while ((u2o_read(base, UTMI_PLL) & PLL_READY) == 0) {
+                if (time_after(jiffies, timeout))
+                        return -ETIME;
+                cpu_relax();
+        }
+
+        if (cpu_is_pxa168()) {
+                u2o_set(base, UTMI_RESERVE, 1 << 5);
+                /* Turn on UTMI PHY OTG extension */
+                u2o_write(base, UTMI_OTG_ADDON, 1);
+        }
+        return 0;
+}
+#else
+int mv_udc_phy_init(unsigned int base)
+{
+        return 0;
+}
+#endif
diff --git a/drivers/usb/gadget/u_audio.c b/drivers/usb/gadget/u_audio.c
new file mode 100644
index 00000000000..59ffe1ecf1c
--- /dev/null
+++ b/drivers/usb/gadget/u_audio.c
@@ -0,0 +1,327 @@
+/*
+ * u_audio.c -- ALSA audio utilities for Gadget stack
+ *
+ * Copyright (C) 2008 Bryan Wu <cooloney@kernel.org>
+ * Copyright (C) 2008 Analog Devices, Inc
+ *
+ * Enter bugs at http://blackfin.uclinux.org/
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/device.h>
+#include <linux/delay.h>
+#include <linux/ctype.h>
+#include <linux/random.h>
+#include <linux/syscalls.h>
+
+#include "u_audio.h"
+
+/*
+ * This component encapsulates the ALSA devices for USB audio gadget
+ */
+
+#define FILE_PCM_PLAYBACK       "/dev/snd/pcmC0D0p"
+#define FILE_PCM_CAPTURE        "/dev/snd/pcmC0D0c"
+#define FILE_CONTROL            "/dev/snd/controlC0"
+
+static char *fn_play = FILE_PCM_PLAYBACK;
+module_param(fn_play, charp, S_IRUGO);
+MODULE_PARM_DESC(fn_play, "Playback PCM device file name");
+
+static char *fn_cap = FILE_PCM_CAPTURE;
+module_param(fn_cap, charp, S_IRUGO);
+MODULE_PARM_DESC(fn_cap, "Capture PCM device file name");
+
+static char *fn_cntl = FILE_CONTROL;
+module_param(fn_cntl, charp, S_IRUGO);
+MODULE_PARM_DESC(fn_cntl, "Control device file name");
+
+/*-------------------------------------------------------------------------*/
+
+/**
+ * Some ALSA internal helper functions
+ */
+static int snd_interval_refine_set(struct snd_interval *i, unsigned int val)
+{
+        struct snd_interval t;
+        t.empty = 0;
+        t.min = t.max = val;
+        t.openmin = t.openmax = 0;
+        t.integer = 1;
+        return snd_interval_refine(i, &t);
+}
+
+static int _snd_pcm_hw_param_set(struct snd_pcm_hw_params *params,
+                                 snd_pcm_hw_param_t var, unsigned int val,
+                                 int dir)
+{
+        int changed;
+        if (hw_is_mask(var)) {
+                struct snd_mask *m = hw_param_mask(params, var);
+                if (val == 0 && dir < 0) {
+                        changed = -EINVAL;
+                        snd_mask_none(m);
+                } else {
+                        if (dir > 0)
+                                val++;
+                        else if (dir < 0)
+                                val--;
+                        changed = snd_mask_refine_set(
+                                        hw_param_mask(params, var), val);
+                }
+        } else if (hw_is_interval(var)) {
+                struct snd_interval *i = hw_param_interval(params, var);
+                if (val == 0 && dir < 0) {
+                        changed = -EINVAL;
+                        snd_interval_none(i);
+                } else if (dir == 0)
+                        changed = snd_interval_refine_set(i, val);
+                else {
+                        struct snd_interval t;
+                        t.openmin = 1;
+                        t.openmax = 1;
+                        t.empty = 0;
+                        t.integer = 0;
+                        if (dir < 0) {
+                                t.min = val - 1;
+                                t.max = val;
+                        } else {
+                                t.min = val;
+                                t.max = val+1;
+                        }
+                        changed = snd_interval_refine(i, &t);
+                }
+        } else
+                return -EINVAL;
+        if (changed) {
+                params->cmask |= 1 << var;
+                params->rmask |= 1 << var;
+        }
+        return changed;
+}
+/*-------------------------------------------------------------------------*/
+
+/**
+ * Set default hardware params
+ */
+static int playback_default_hw_params(struct gaudio_snd_dev *snd)
+{
+        struct snd_pcm_substream *substream = snd->substream;
+        struct snd_pcm_hw_params *params;
+        snd_pcm_sframes_t result;
+
+       /*
+        * SNDRV_PCM_ACCESS_RW_INTERLEAVED,
+        * SNDRV_PCM_FORMAT_S16_LE
+        * CHANNELS: 2
+        * RATE: 48000
+        */
+        snd->access = SNDRV_PCM_ACCESS_RW_INTERLEAVED;
+        snd->format = SNDRV_PCM_FORMAT_S16_LE;
+        snd->channels = 2;
+        snd->rate = 48000;
+
+        params = kzalloc(sizeof(*params), GFP_KERNEL);
+        if (!params)
+                return -ENOMEM;
+
+        _snd_pcm_hw_params_any(params);
+        _snd_pcm_hw_param_set(params, SNDRV_PCM_HW_PARAM_ACCESS,
+                        snd->access, 0);
+        _snd_pcm_hw_param_set(params, SNDRV_PCM_HW_PARAM_FORMAT,
+                        snd->format, 0);
+        _snd_pcm_hw_param_set(params, SNDRV_PCM_HW_PARAM_CHANNELS,
+                        snd->channels, 0);
+        _snd_pcm_hw_param_set(params, SNDRV_PCM_HW_PARAM_RATE,
+                        snd->rate, 0);
+
+        snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
+        snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS, params);
+
+        result = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_PREPARE, NULL);
+        if (result < 0) {
+                ERROR(snd->card,
+                        "Preparing sound card failed: %d\n", (int)result);
+                kfree(params);
+                return result;
+        }
+
+        /* Store the hardware parameters */
+        snd->access = params_access(params);
+        snd->format = params_format(params);
+        snd->channels = params_channels(params);
+        snd->rate = params_rate(params);
+
+        kfree(params);
+
+        INFO(snd->card,
+                "Hardware params: access %x, format %x, channels %d, rate %d\n",
+                snd->access, snd->format, snd->channels, snd->rate);
+
+        return 0;
+}
+
+/**
+ * Playback audio buffer data by ALSA PCM device
+ */
+static size_t u_audio_playback(struct gaudio *card, void *buf, size_t count)
+{
+        struct gaudio_snd_dev   *snd = &card->playback;
+        struct snd_pcm_substream *substream = snd->substream;
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        mm_segment_t old_fs;
+        ssize_t result;
+        snd_pcm_sframes_t frames;
+
+try_again:
+        if (runtime->status->state == SNDRV_PCM_STATE_XRUN ||
+                runtime->status->state == SNDRV_PCM_STATE_SUSPENDED) {
+                result = snd_pcm_kernel_ioctl(substream,
+                                SNDRV_PCM_IOCTL_PREPARE, NULL);
+                if (result < 0) {
+                        ERROR(card, "Preparing sound card failed: %d\n",
+                                        (int)result);
+                        return result;
+                }
+        }
+
+        frames = bytes_to_frames(runtime, count);
+        old_fs = get_fs();
+        set_fs(KERNEL_DS);
+        result = snd_pcm_lib_write(snd->substream, buf, frames);
+        if (result != frames) {
+                ERROR(card, "Playback error: %d\n", (int)result);
+                set_fs(old_fs);
+                goto try_again;
+        }
+        set_fs(old_fs);
+
+        return 0;
+}
+
+static int u_audio_get_playback_channels(struct gaudio *card)
+{
+        return card->playback.channels;
+}
+
+static int u_audio_get_playback_rate(struct gaudio *card)
+{
+        return card->playback.rate;
+}
+
+/**
+ * Open ALSA PCM and control device files
+ * Initial the PCM or control device
+ */
+static int gaudio_open_snd_dev(struct gaudio *card)
+{
+        struct snd_pcm_file *pcm_file;
+        struct gaudio_snd_dev *snd;
+
+        if (!card)
+                return -ENODEV;
+
+        /* Open control device */
+        snd = &card->control;
+        snd->filp = filp_open(fn_cntl, O_RDWR, 0);
+        if (IS_ERR(snd->filp)) {
+                int ret = PTR_ERR(snd->filp);
+                ERROR(card, "unable to open sound control device file: %s\n",
+                                fn_cntl);
+                snd->filp = NULL;
+                return ret;
+        }
+        snd->card = card;
+
+        /* Open PCM playback device and setup substream */
+        snd = &card->playback;
+        snd->filp = filp_open(fn_play, O_WRONLY, 0);
+        if (IS_ERR(snd->filp)) {
+                ERROR(card, "No such PCM playback device: %s\n", fn_play);
+                snd->filp = NULL;
+        }
+        pcm_file = snd->filp->private_data;
+        snd->substream = pcm_file->substream;
+        snd->card = card;
+        playback_default_hw_params(snd);
+
+        /* Open PCM capture device and setup substream */
+        snd = &card->capture;
+        snd->filp = filp_open(fn_cap, O_RDONLY, 0);
+        if (IS_ERR(snd->filp)) {
+                ERROR(card, "No such PCM capture device: %s\n", fn_cap);
+                snd->substream = NULL;
+                snd->card = NULL;
+                snd->filp = NULL;
+        } else {
+                pcm_file = snd->filp->private_data;
+                snd->substream = pcm_file->substream;
+                snd->card = card;
+        }
+
+        return 0;
+}
+
+/**
+ * Close ALSA PCM and control device files
+ */
+static int gaudio_close_snd_dev(struct gaudio *gau)
+{
+        struct gaudio_snd_dev   *snd;
+
+        /* Close control device */
+        snd = &gau->control;
+        if (snd->filp)
+                filp_close(snd->filp, current->files);
+
+        /* Close PCM playback device and setup substream */
+        snd = &gau->playback;
+        if (snd->filp)
+                filp_close(snd->filp, current->files);
+
+        /* Close PCM capture device and setup substream */
+        snd = &gau->capture;
+        if (snd->filp)
+                filp_close(snd->filp, current->files);
+
+        return 0;
+}
+
+static struct gaudio *the_card;
+/**
+ * gaudio_setup - setup ALSA interface and preparing for USB transfer
+ *
+ * This sets up PCM, mixer or MIDI ALSA devices fore USB gadget using.
+ *
+ * Returns negative errno, or zero on success
+ */
+int __init gaudio_setup(struct gaudio *card)
+{
+        int     ret;
+
+        ret = gaudio_open_snd_dev(card);
+        if (ret)
+                ERROR(card, "we need at least one control device\n");
+        else if (!the_card)
+                the_card = card;
+
+        return ret;
+
+}
+
+/**
+ * gaudio_cleanup - remove ALSA device interface
+ *
+ * This is called to free all resources allocated by @gaudio_setup().
+ */
+void gaudio_cleanup(void)
+{
+        if (the_card) {
+                gaudio_close_snd_dev(the_card);
+                the_card = NULL;
+        }
+}
+
diff --git a/drivers/usb/gadget/u_audio.h b/drivers/usb/gadget/u_audio.h
new file mode 100644
index 00000000000..08ffce3298e
--- /dev/null
+++ b/drivers/usb/gadget/u_audio.h
@@ -0,0 +1,56 @@
+/*
+ * u_audio.h -- interface to USB gadget "ALSA AUDIO" utilities
+ *
+ * Copyright (C) 2008 Bryan Wu <cooloney@kernel.org>
+ * Copyright (C) 2008 Analog Devices, Inc
+ *
+ * Enter bugs at http://blackfin.uclinux.org/
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#ifndef __U_AUDIO_H
+#define __U_AUDIO_H
+
+#include <linux/device.h>
+#include <linux/err.h>
+#include <linux/usb/audio.h>
+#include <linux/usb/composite.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+
+#include "gadget_chips.h"
+
+/*
+ * This represents the USB side of an audio card device, managed by a USB
+ * function which provides control and stream interfaces.
+ */
+
+struct gaudio_snd_dev {
+        struct gaudio                   *card;
+        struct file                     *filp;
+        struct snd_pcm_substream        *substream;
+        int                             access;
+        int                             format;
+        int                             channels;
+        int                             rate;
+};
+
+struct gaudio {
+        struct usb_function             func;
+        struct usb_gadget               *gadget;
+
+        /* ALSA sound device interfaces */
+        struct gaudio_snd_dev           control;
+        struct gaudio_snd_dev           playback;
+        struct gaudio_snd_dev           capture;
+
+        /* TODO */
+};
+
+int gaudio_setup(struct gaudio *card);
+void gaudio_cleanup(void);
+
+#endif /* __U_AUDIO_H */
diff --git a/drivers/usb/host/ehci-ath79.c b/drivers/usb/host/ehci-ath79.c
new file mode 100644
index 00000000000..4d2e88d04da
--- /dev/null
+++ b/drivers/usb/host/ehci-ath79.c
@@ -0,0 +1,204 @@
+/*
+ *  Bus Glue for Atheros AR7XXX/AR9XXX built-in EHCI controller.
+ *
+ *  Copyright (C) 2008-2011 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  Parts of this file are based on Atheros' 2.6.15 BSP
+ *      Copyright (C) 2007 Atheros Communications, Inc.
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#include <linux/platform_device.h>
+
+enum {
+        EHCI_ATH79_IP_V1 = 0,
+        EHCI_ATH79_IP_V2,
+};
+
+static const struct platform_device_id ehci_ath79_id_table[] = {
+        {
+                .name           = "ar71xx-ehci",
+                .driver_data    = EHCI_ATH79_IP_V1,
+        },
+        {
+                .name           = "ar724x-ehci",
+                .driver_data    = EHCI_ATH79_IP_V2,
+        },
+        {
+                .name           = "ar913x-ehci",
+                .driver_data    = EHCI_ATH79_IP_V2,
+        },
+        {
+                /* terminating entry */
+        },
+};
+
+MODULE_DEVICE_TABLE(platform, ehci_ath79_id_table);
+
+static int ehci_ath79_init(struct usb_hcd *hcd)
+{
+        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
+        struct platform_device *pdev = to_platform_device(hcd->self.controller);
+        const struct platform_device_id *id;
+        int ret;
+
+        id = platform_get_device_id(pdev);
+        if (!id) {
+                dev_err(hcd->self.controller, "missing device id\n");
+                return -EINVAL;
+        }
+
+        switch (id->driver_data) {
+        case EHCI_ATH79_IP_V1:
+                ehci->has_synopsys_hc_bug = 1;
+
+                ehci->caps = hcd->regs;
+                ehci->regs = hcd->regs +
+                        HC_LENGTH(ehci,
+                                  ehci_readl(ehci, &ehci->caps->hc_capbase));
+                break;
+
+        case EHCI_ATH79_IP_V2:
+                hcd->has_tt = 1;
+
+                ehci->caps = hcd->regs + 0x100;
+                ehci->regs = hcd->regs + 0x100 +
+                        HC_LENGTH(ehci,
+                                  ehci_readl(ehci, &ehci->caps->hc_capbase));
+                break;
+
+        default:
+                BUG();
+        }
+
+        dbg_hcs_params(ehci, "reset");
+        dbg_hcc_params(ehci, "reset");
+        ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
+        ehci->sbrn = 0x20;
+
+        ehci_reset(ehci);
+
+        ret = ehci_init(hcd);
+        if (ret)
+                return ret;
+
+        ehci_port_power(ehci, 0);
+
+        return 0;
+}
+
+static const struct hc_driver ehci_ath79_hc_driver = {
+        .description            = hcd_name,
+        .product_desc           = "Atheros built-in EHCI controller",
+        .hcd_priv_size          = sizeof(struct ehci_hcd),
+        .irq                    = ehci_irq,
+        .flags                  = HCD_MEMORY | HCD_USB2,
+
+        .reset                  = ehci_ath79_init,
+        .start                  = ehci_run,
+        .stop                   = ehci_stop,
+        .shutdown               = ehci_shutdown,
+
+        .urb_enqueue            = ehci_urb_enqueue,
+        .urb_dequeue            = ehci_urb_dequeue,
+        .endpoint_disable       = ehci_endpoint_disable,
+        .endpoint_reset         = ehci_endpoint_reset,
+
+        .get_frame_number       = ehci_get_frame,
+
+        .hub_status_data        = ehci_hub_status_data,
+        .hub_control            = ehci_hub_control,
+
+        .relinquish_port        = ehci_relinquish_port,
+        .port_handed_over       = ehci_port_handed_over,
+
+        .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+};
+
+static int ehci_ath79_probe(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd;
+        struct resource *res;
+        int irq;
+        int ret;
+
+        if (usb_disabled())
+                return -ENODEV;
+
+        res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (!res) {
+                dev_dbg(&pdev->dev, "no IRQ specified\n");
+                return -ENODEV;
+        }
+        irq = res->start;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_dbg(&pdev->dev, "no base address specified\n");
+                return -ENODEV;
+        }
+
+        hcd = usb_create_hcd(&ehci_ath79_hc_driver, &pdev->dev,
+                             dev_name(&pdev->dev));
+        if (!hcd)
+                return -ENOMEM;
+
+        hcd->rsrc_start = res->start;
+        hcd->rsrc_len   = resource_size(res);
+
+        if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
+                dev_dbg(&pdev->dev, "controller already in use\n");
+                ret = -EBUSY;
+                goto err_put_hcd;
+        }
+
+        hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
+        if (!hcd->regs) {
+                dev_dbg(&pdev->dev, "error mapping memory\n");
+                ret = -EFAULT;
+                goto err_release_region;
+        }
+
+        ret = usb_add_hcd(hcd, irq, IRQF_DISABLED | IRQF_SHARED);
+        if (ret)
+                goto err_iounmap;
+
+        return 0;
+
+err_iounmap:
+        iounmap(hcd->regs);
+
+err_release_region:
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+err_put_hcd:
+        usb_put_hcd(hcd);
+        return ret;
+}
+
+static int ehci_ath79_remove(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+
+        usb_remove_hcd(hcd);
+        iounmap(hcd->regs);
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+        usb_put_hcd(hcd);
+
+        return 0;
+}
+
+static struct platform_driver ehci_ath79_driver = {
+        .probe          = ehci_ath79_probe,
+        .remove         = ehci_ath79_remove,
+        .id_table       = ehci_ath79_id_table,
+        .driver = {
+                .owner  = THIS_MODULE,
+                .name   = "ath79-ehci",
+        }
+};
+
+MODULE_ALIAS(PLATFORM_MODULE_PREFIX "ath79-ehci");
diff --git a/drivers/usb/host/ehci-au1xxx.c b/drivers/usb/host/ehci-au1xxx.c
new file mode 100644
index 00000000000..42ae5740990
--- /dev/null
+++ b/drivers/usb/host/ehci-au1xxx.c
@@ -0,0 +1,323 @@
+/*
+ * EHCI HCD (Host Controller Driver) for USB.
+ *
+ * Bus Glue for AMD Alchemy Au1xxx
+ *
+ * Based on "ohci-au1xxx.c" by Matt Porter <mporter@kernel.crashing.org>
+ *
+ * Modified for AMD Alchemy Au1200 EHC
+ *  by K.Boge <karsten.boge@amd.com>
+ *
+ * This file is licenced under the GPL.
+ */
+
+#include <linux/platform_device.h>
+#include <asm/mach-au1x00/au1000.h>
+
+#define USB_HOST_CONFIG   (USB_MSR_BASE + USB_MSR_MCFG)
+#define USB_MCFG_PFEN     (1<<31)
+#define USB_MCFG_RDCOMB   (1<<30)
+#define USB_MCFG_SSDEN    (1<<23)
+#define USB_MCFG_PHYPLLEN (1<<19)
+#define USB_MCFG_UCECLKEN (1<<18)
+#define USB_MCFG_EHCCLKEN (1<<17)
+#ifdef CONFIG_DMA_COHERENT
+#define USB_MCFG_UCAM     (1<<7)
+#else
+#define USB_MCFG_UCAM     (0)
+#endif
+#define USB_MCFG_EBMEN    (1<<3)
+#define USB_MCFG_EMEMEN   (1<<2)
+
+#define USBH_ENABLE_CE  (USB_MCFG_PHYPLLEN | USB_MCFG_EHCCLKEN)
+#define USBH_ENABLE_INIT (USB_MCFG_PFEN  | USB_MCFG_RDCOMB |    \
+                          USBH_ENABLE_CE | USB_MCFG_SSDEN  |    \
+                          USB_MCFG_UCAM  | USB_MCFG_EBMEN  |    \
+                          USB_MCFG_EMEMEN)
+
+#define USBH_DISABLE      (USB_MCFG_EBMEN | USB_MCFG_EMEMEN)
+
+extern int usb_disabled(void);
+
+static void au1xxx_start_ehc(void)
+{
+        /* enable clock to EHCI block and HS PHY PLL*/
+        au_writel(au_readl(USB_HOST_CONFIG) | USBH_ENABLE_CE, USB_HOST_CONFIG);
+        au_sync();
+        udelay(1000);
+
+        /* enable EHCI mmio */
+        au_writel(au_readl(USB_HOST_CONFIG) | USBH_ENABLE_INIT, USB_HOST_CONFIG);
+        au_sync();
+        udelay(1000);
+}
+
+static void au1xxx_stop_ehc(void)
+{
+        unsigned long c;
+
+        /* Disable mem */
+        au_writel(au_readl(USB_HOST_CONFIG) & ~USBH_DISABLE, USB_HOST_CONFIG);
+        au_sync();
+        udelay(1000);
+
+        /* Disable EHC clock. If the HS PHY is unused disable it too. */
+        c = au_readl(USB_HOST_CONFIG) & ~USB_MCFG_EHCCLKEN;
+        if (!(c & USB_MCFG_UCECLKEN))           /* UDC disabled? */
+                c &= ~USB_MCFG_PHYPLLEN;        /* yes: disable HS PHY PLL */
+        au_writel(c, USB_HOST_CONFIG);
+        au_sync();
+}
+
+static int au1xxx_ehci_setup(struct usb_hcd *hcd)
+{
+        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
+        int ret = ehci_init(hcd);
+
+        ehci->need_io_watchdog = 0;
+        return ret;
+}
+
+static const struct hc_driver ehci_au1xxx_hc_driver = {
+        .description            = hcd_name,
+        .product_desc           = "Au1xxx EHCI",
+        .hcd_priv_size          = sizeof(struct ehci_hcd),
+
+        /*
+         * generic hardware linkage
+         */
+        .irq                    = ehci_irq,
+        .flags                  = HCD_MEMORY | HCD_USB2,
+
+        /*
+         * basic lifecycle operations
+         *
+         * FIXME -- ehci_init() doesn't do enough here.
+         * See ehci-ppc-soc for a complete implementation.
+         */
+        .reset                  = au1xxx_ehci_setup,
+        .start                  = ehci_run,
+        .stop                   = ehci_stop,
+        .shutdown               = ehci_shutdown,
+
+        /*
+         * managing i/o requests and associated device resources
+         */
+        .urb_enqueue            = ehci_urb_enqueue,
+        .urb_dequeue            = ehci_urb_dequeue,
+        .endpoint_disable       = ehci_endpoint_disable,
+        .endpoint_reset         = ehci_endpoint_reset,
+
+        /*
+         * scheduling support
+         */
+        .get_frame_number       = ehci_get_frame,
+
+        /*
+         * root hub support
+         */
+        .hub_status_data        = ehci_hub_status_data,
+        .hub_control            = ehci_hub_control,
+        .bus_suspend            = ehci_bus_suspend,
+        .bus_resume             = ehci_bus_resume,
+        .relinquish_port        = ehci_relinquish_port,
+        .port_handed_over       = ehci_port_handed_over,
+
+        .clear_tt_buffer_complete       = ehci_clear_tt_buffer_complete,
+};
+
+static int ehci_hcd_au1xxx_drv_probe(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd;
+        struct ehci_hcd *ehci;
+        struct resource *res;
+        int ret;
+
+        if (usb_disabled())
+                return -ENODEV;
+
+#if defined(CONFIG_SOC_AU1200) && defined(CONFIG_DMA_COHERENT)
+        /* Au1200 AB USB does not support coherent memory */
+        if (!(read_c0_prid() & 0xff)) {
+                printk(KERN_INFO "%s: this is chip revision AB!\n", pdev->name);
+                printk(KERN_INFO "%s: update your board or re-configure"
+                                 " the kernel\n", pdev->name);
+                return -ENODEV;
+        }
+#endif
+
+        if (pdev->resource[1].flags != IORESOURCE_IRQ) {
+                pr_debug("resource[1] is not IORESOURCE_IRQ");
+                return -ENOMEM;
+        }
+        hcd = usb_create_hcd(&ehci_au1xxx_hc_driver, &pdev->dev, "Au1xxx");
+        if (!hcd)
+                return -ENOMEM;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        hcd->rsrc_start = res->start;
+        hcd->rsrc_len = resource_size(res);
+
+        if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
+                pr_debug("request_mem_region failed");
+                ret = -EBUSY;
+                goto err1;
+        }
+
+        hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
+        if (!hcd->regs) {
+                pr_debug("ioremap failed");
+                ret = -ENOMEM;
+                goto err2;
+        }
+
+        au1xxx_start_ehc();
+
+        ehci = hcd_to_ehci(hcd);
+        ehci->caps = hcd->regs;
+        ehci->regs = hcd->regs +
+                HC_LENGTH(ehci, readl(&ehci->caps->hc_capbase));
+        /* cache this readonly data; minimize chip reads */
+        ehci->hcs_params = readl(&ehci->caps->hcs_params);
+
+        ret = usb_add_hcd(hcd, pdev->resource[1].start,
+                          IRQF_DISABLED | IRQF_SHARED);
+        if (ret == 0) {
+                platform_set_drvdata(pdev, hcd);
+                return ret;
+        }
+
+        au1xxx_stop_ehc();
+        iounmap(hcd->regs);
+err2:
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+err1:
+        usb_put_hcd(hcd);
+        return ret;
+}
+
+static int ehci_hcd_au1xxx_drv_remove(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+
+        usb_remove_hcd(hcd);
+        iounmap(hcd->regs);
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+        usb_put_hcd(hcd);
+        au1xxx_stop_ehc();
+        platform_set_drvdata(pdev, NULL);
+
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int ehci_hcd_au1xxx_drv_suspend(struct device *dev)
+{
+        struct usb_hcd *hcd = dev_get_drvdata(dev);
+        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
+        unsigned long flags;
+        int rc = 0;
+
+        if (time_before(jiffies, ehci->next_statechange))
+                msleep(10);
+
+        /* Root hub was already suspended. Disable irq emission and
+         * mark HW unaccessible.  The PM and USB cores make sure that
+         * the root hub is either suspended or stopped.
+         */
+        ehci_prepare_ports_for_controller_suspend(ehci, device_may_wakeup(dev));
+        spin_lock_irqsave(&ehci->lock, flags);
+        ehci_writel(ehci, 0, &ehci->regs->intr_enable);
+        (void)ehci_readl(ehci, &ehci->regs->intr_enable);
+
+        clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
+        spin_unlock_irqrestore(&ehci->lock, flags);
+
+        // could save FLADJ in case of Vaux power loss
+        // ... we'd only use it to handle clock skew
+
+        au1xxx_stop_ehc();
+
+        return rc;
+}
+
+static int ehci_hcd_au1xxx_drv_resume(struct device *dev)
+{
+        struct usb_hcd *hcd = dev_get_drvdata(dev);
+        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
+
+        au1xxx_start_ehc();
+
+        // maybe restore FLADJ
+
+        if (time_before(jiffies, ehci->next_statechange))
+                msleep(100);
+
+        /* Mark hardware accessible again as we are out of D3 state by now */
+        set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
+
+        /* If CF is still set, we maintained PCI Vaux power.
+         * Just undo the effect of ehci_pci_suspend().
+         */
+        if (ehci_readl(ehci, &ehci->regs->configured_flag) == FLAG_CF) {
+                int     mask = INTR_MASK;
+
+                ehci_prepare_ports_for_controller_resume(ehci);
+                if (!hcd->self.root_hub->do_remote_wakeup)
+                        mask &= ~STS_PCD;
+                ehci_writel(ehci, mask, &ehci->regs->intr_enable);
+                ehci_readl(ehci, &ehci->regs->intr_enable);
+                return 0;
+        }
+
+        ehci_dbg(ehci, "lost power, restarting\n");
+        usb_root_hub_lost_power(hcd->self.root_hub);
+
+        /* Else reset, to cope with power loss or flush-to-storage
+         * style "resume" having let BIOS kick in during reboot.
+         */
+        (void) ehci_halt(ehci);
+        (void) ehci_reset(ehci);
+
+        /* emptying the schedule aborts any urbs */
+        spin_lock_irq(&ehci->lock);
+        if (ehci->reclaim)
+                end_unlink_async(ehci);
+        ehci_work(ehci);
+        spin_unlock_irq(&ehci->lock);
+
+        ehci_writel(ehci, ehci->command, &ehci->regs->command);
+        ehci_writel(ehci, FLAG_CF, &ehci->regs->configured_flag);
+        ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */
+
+        /* here we "know" root ports should always stay powered */
+        ehci_port_power(ehci, 1);
+
+        hcd->state = HC_STATE_SUSPENDED;
+
+        return 0;
+}
+
+static const struct dev_pm_ops au1xxx_ehci_pmops = {
+        .suspend        = ehci_hcd_au1xxx_drv_suspend,
+        .resume         = ehci_hcd_au1xxx_drv_resume,
+};
+
+#define AU1XXX_EHCI_PMOPS &au1xxx_ehci_pmops
+
+#else
+#define AU1XXX_EHCI_PMOPS NULL
+#endif
+
+static struct platform_driver ehci_hcd_au1xxx_driver = {
+        .probe          = ehci_hcd_au1xxx_drv_probe,
+        .remove         = ehci_hcd_au1xxx_drv_remove,
+        .shutdown       = usb_hcd_platform_shutdown,
+        .driver = {
+                .name   = "au1xxx-ehci",
+                .owner  = THIS_MODULE,
+                .pm     = AU1XXX_EHCI_PMOPS,
+        }
+};
+
+MODULE_ALIAS("platform:au1xxx-ehci");
diff --git a/drivers/usb/host/ehci-cns3xxx.c b/drivers/usb/host/ehci-cns3xxx.c
new file mode 100644
index 00000000000..6536abdea6e
--- /dev/null
+++ b/drivers/usb/host/ehci-cns3xxx.c
@@ -0,0 +1,171 @@
+/*
+ * Copyright 2008 Cavium Networks
+ *
+ * This file is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License, Version 2, as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/platform_device.h>
+#include <linux/atomic.h>
+#include <mach/cns3xxx.h>
+#include <mach/pm.h>
+
+static int cns3xxx_ehci_init(struct usb_hcd *hcd)
+{
+        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
+        int retval;
+
+        /*
+         * EHCI and OHCI share the same clock and power,
+         * resetting twice would cause the 1st controller been reset.
+         * Therefore only do power up  at the first up device, and
+         * power down at the last down device.
+         *
+         * Set USB AHB INCR length to 16
+         */
+        if (atomic_inc_return(&usb_pwr_ref) == 1) {
+                cns3xxx_pwr_power_up(1 << PM_PLL_HM_PD_CTRL_REG_OFFSET_PLL_USB);
+                cns3xxx_pwr_clk_en(1 << PM_CLK_GATE_REG_OFFSET_USB_HOST);
+                cns3xxx_pwr_soft_rst(1 << PM_SOFT_RST_REG_OFFST_USB_HOST);
+                __raw_writel((__raw_readl(MISC_CHIP_CONFIG_REG) | (0X2 << 24)),
+                        MISC_CHIP_CONFIG_REG);
+        }
+
+        ehci->caps = hcd->regs;
+        ehci->regs = hcd->regs
+                + HC_LENGTH(ehci, ehci_readl(ehci, &ehci->caps->hc_capbase));
+        ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
+
+        hcd->has_tt = 0;
+        ehci_reset(ehci);
+
+        retval = ehci_init(hcd);
+        if (retval)
+                return retval;
+
+        ehci_port_power(ehci, 0);
+
+        return retval;
+}
+
+static const struct hc_driver cns3xxx_ehci_hc_driver = {
+        .description            = hcd_name,
+        .product_desc           = "CNS3XXX EHCI Host Controller",
+        .hcd_priv_size          = sizeof(struct ehci_hcd),
+        .irq                    = ehci_irq,
+        .flags                  = HCD_MEMORY | HCD_USB2,
+        .reset                  = cns3xxx_ehci_init,
+        .start                  = ehci_run,
+        .stop                   = ehci_stop,
+        .shutdown               = ehci_shutdown,
+        .urb_enqueue            = ehci_urb_enqueue,
+        .urb_dequeue            = ehci_urb_dequeue,
+        .endpoint_disable       = ehci_endpoint_disable,
+        .endpoint_reset         = ehci_endpoint_reset,
+        .get_frame_number       = ehci_get_frame,
+        .hub_status_data        = ehci_hub_status_data,
+        .hub_control            = ehci_hub_control,
+#ifdef CONFIG_PM
+        .bus_suspend            = ehci_bus_suspend,
+        .bus_resume             = ehci_bus_resume,
+#endif
+        .relinquish_port        = ehci_relinquish_port,
+        .port_handed_over       = ehci_port_handed_over,
+
+        .clear_tt_buffer_complete       = ehci_clear_tt_buffer_complete,
+};
+
+static int cns3xxx_ehci_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct usb_hcd *hcd;
+        const struct hc_driver *driver = &cns3xxx_ehci_hc_driver;
+        struct resource *res;
+        int irq;
+        int retval;
+
+        if (usb_disabled())
+                return -ENODEV;
+
+        res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (!res) {
+                dev_err(dev, "Found HC with no IRQ.\n");
+                return -ENODEV;
+        }
+        irq = res->start;
+
+        hcd = usb_create_hcd(driver, &pdev->dev, dev_name(&pdev->dev));
+        if (!hcd)
+                return -ENOMEM;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_err(dev, "Found HC with no register addr.\n");
+                retval = -ENODEV;
+                goto err1;
+        }
+
+        hcd->rsrc_start = res->start;
+        hcd->rsrc_len = resource_size(res);
+
+        if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len,
+                                driver->description)) {
+                dev_dbg(dev, "controller already in use\n");
+                retval = -EBUSY;
+                goto err1;
+        }
+
+        hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
+        if (hcd->regs == NULL) {
+                dev_dbg(dev, "error mapping memory\n");
+                retval = -EFAULT;
+                goto err2;
+        }
+
+        retval = usb_add_hcd(hcd, irq, IRQF_SHARED);
+        if (retval == 0)
+                return retval;
+
+        iounmap(hcd->regs);
+err2:
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+err1:
+        usb_put_hcd(hcd);
+
+        return retval;
+}
+
+static int cns3xxx_ehci_remove(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+
+        usb_remove_hcd(hcd);
+        iounmap(hcd->regs);
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+
+        /*
+         * EHCI and OHCI share the same clock and power,
+         * resetting twice would cause the 1st controller been reset.
+         * Therefore only do power up  at the first up device, and
+         * power down at the last down device.
+         */
+        if (atomic_dec_return(&usb_pwr_ref) == 0)
+                cns3xxx_pwr_clk_dis(1 << PM_CLK_GATE_REG_OFFSET_USB_HOST);
+
+        usb_put_hcd(hcd);
+
+        platform_set_drvdata(pdev, NULL);
+
+        return 0;
+}
+
+MODULE_ALIAS("platform:cns3xxx-ehci");
+
+static struct platform_driver cns3xxx_ehci_driver = {
+        .probe = cns3xxx_ehci_probe,
+        .remove = cns3xxx_ehci_remove,
+        .driver = {
+                .name = "cns3xxx-ehci",
+        },
+};
diff --git a/drivers/usb/host/ehci-ixp4xx.c b/drivers/usb/host/ehci-ixp4xx.c
new file mode 100644
index 00000000000..c4460f3d009
--- /dev/null
+++ b/drivers/usb/host/ehci-ixp4xx.c
@@ -0,0 +1,156 @@
+/*
+ * IXP4XX EHCI Host Controller Driver
+ *
+ * Author: Vladimir Barinov <vbarinov@embeddedalley.com>
+ *
+ * Based on "ehci-fsl.c" by Randy Vinson <rvinson@mvista.com>
+ *
+ * 2007 (c) MontaVista Software, Inc. This file is licensed under
+ * the terms of the GNU General Public License version 2. This program
+ * is licensed "as is" without any warranty of any kind, whether express
+ * or implied.
+ */
+
+#include <linux/platform_device.h>
+
+static int ixp4xx_ehci_init(struct usb_hcd *hcd)
+{
+        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
+        int retval = 0;
+
+        ehci->big_endian_desc = 1;
+        ehci->big_endian_mmio = 1;
+
+        ehci->caps = hcd->regs + 0x100;
+        ehci->regs = hcd->regs + 0x100
+                + HC_LENGTH(ehci, ehci_readl(ehci, &ehci->caps->hc_capbase));
+        ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
+
+        hcd->has_tt = 1;
+        ehci_reset(ehci);
+
+        retval = ehci_init(hcd);
+        if (retval)
+                return retval;
+
+        ehci_port_power(ehci, 0);
+
+        return retval;
+}
+
+static const struct hc_driver ixp4xx_ehci_hc_driver = {
+        .description            = hcd_name,
+        .product_desc           = "IXP4XX EHCI Host Controller",
+        .hcd_priv_size          = sizeof(struct ehci_hcd),
+        .irq                    = ehci_irq,
+        .flags                  = HCD_MEMORY | HCD_USB2,
+        .reset                  = ixp4xx_ehci_init,
+        .start                  = ehci_run,
+        .stop                   = ehci_stop,
+        .shutdown               = ehci_shutdown,
+        .urb_enqueue            = ehci_urb_enqueue,
+        .urb_dequeue            = ehci_urb_dequeue,
+        .endpoint_disable       = ehci_endpoint_disable,
+        .endpoint_reset         = ehci_endpoint_reset,
+        .get_frame_number       = ehci_get_frame,
+        .hub_status_data        = ehci_hub_status_data,
+        .hub_control            = ehci_hub_control,
+#if defined(CONFIG_PM)
+        .bus_suspend            = ehci_bus_suspend,
+        .bus_resume             = ehci_bus_resume,
+#endif
+        .relinquish_port        = ehci_relinquish_port,
+        .port_handed_over       = ehci_port_handed_over,
+
+        .clear_tt_buffer_complete       = ehci_clear_tt_buffer_complete,
+};
+
+static int ixp4xx_ehci_probe(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd;
+        const struct hc_driver *driver = &ixp4xx_ehci_hc_driver;
+        struct resource *res;
+        int irq;
+        int retval;
+
+        if (usb_disabled())
+                return -ENODEV;
+
+        res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (!res) {
+                dev_err(&pdev->dev,
+                        "Found HC with no IRQ. Check %s setup!\n",
+                        dev_name(&pdev->dev));
+                return -ENODEV;
+        }
+        irq = res->start;
+
+        hcd = usb_create_hcd(driver, &pdev->dev, dev_name(&pdev->dev));
+        if (!hcd) {
+                retval = -ENOMEM;
+                goto fail_create_hcd;
+        }
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_err(&pdev->dev,
+                        "Found HC with no register addr. Check %s setup!\n",
+                        dev_name(&pdev->dev));
+                retval = -ENODEV;
+                goto fail_request_resource;
+        }
+        hcd->rsrc_start = res->start;
+        hcd->rsrc_len = resource_size(res);
+
+        if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len,
+                                driver->description)) {
+                dev_dbg(&pdev->dev, "controller already in use\n");
+                retval = -EBUSY;
+                goto fail_request_resource;
+        }
+
+        hcd->regs = ioremap_nocache(hcd->rsrc_start, hcd->rsrc_len);
+        if (hcd->regs == NULL) {
+                dev_dbg(&pdev->dev, "error mapping memory\n");
+                retval = -EFAULT;
+                goto fail_ioremap;
+        }
+
+        retval = usb_add_hcd(hcd, irq, IRQF_SHARED);
+        if (retval)
+                goto fail_add_hcd;
+
+        return retval;
+
+fail_add_hcd:
+        iounmap(hcd->regs);
+fail_ioremap:
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+fail_request_resource:
+        usb_put_hcd(hcd);
+fail_create_hcd:
+        dev_err(&pdev->dev, "init %s fail, %d\n", dev_name(&pdev->dev), retval);
+        return retval;
+}
+
+static int ixp4xx_ehci_remove(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+
+        usb_remove_hcd(hcd);
+        iounmap(hcd->regs);
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+        usb_put_hcd(hcd);
+
+        return 0;
+}
+
+MODULE_ALIAS("platform:ixp4xx-ehci");
+
+static struct platform_driver ixp4xx_ehci_driver = {
+        .probe = ixp4xx_ehci_probe,
+        .remove = ixp4xx_ehci_remove,
+        .driver = {
+                .name = "ixp4xx-ehci",
+        },
+};
diff --git a/drivers/usb/host/ehci-lpm.c b/drivers/usb/host/ehci-lpm.c
new file mode 100644
index 00000000000..2111627a19d
--- /dev/null
+++ b/drivers/usb/host/ehci-lpm.c
@@ -0,0 +1,84 @@
+/* ehci-lpm.c EHCI HCD LPM support code
+ * Copyright (c) 2008 - 2010,  Intel Corporation.
+ * Author: Jacob Pan <jacob.jun.pan@intel.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+/* this file is part of ehci-hcd.c */
+static int __maybe_unused ehci_lpm_set_da(struct ehci_hcd *ehci,
+        int dev_addr, int port_num)
+{
+        u32 __iomem portsc;
+
+        ehci_dbg(ehci, "set dev address %d for port %d\n", dev_addr, port_num);
+        if (port_num > HCS_N_PORTS(ehci->hcs_params)) {
+                ehci_dbg(ehci, "invalid port number %d\n", port_num);
+                return -ENODEV;
+        }
+        portsc = ehci_readl(ehci, &ehci->regs->port_status[port_num-1]);
+        portsc &= ~PORT_DEV_ADDR;
+        portsc |= dev_addr<<25;
+        ehci_writel(ehci, portsc, &ehci->regs->port_status[port_num-1]);
+        return 0;
+}
+
+/*
+ * this function is used to check if the device support LPM
+ * if yes, mark the PORTSC register with PORT_LPM bit
+ */
+static int __maybe_unused ehci_lpm_check(struct ehci_hcd *ehci, int port)
+{
+        u32 __iomem     *portsc ;
+        u32 val32;
+        int retval;
+
+        portsc = &ehci->regs->port_status[port-1];
+        val32 = ehci_readl(ehci, portsc);
+        if (!(val32 & PORT_DEV_ADDR)) {
+                ehci_dbg(ehci, "LPM: no device attached\n");
+                return -ENODEV;
+        }
+        val32 |= PORT_LPM;
+        ehci_writel(ehci, val32, portsc);
+        msleep(5);
+        val32 |= PORT_SUSPEND;
+        ehci_dbg(ehci, "Sending LPM 0x%08x to port %d\n", val32, port);
+        ehci_writel(ehci, val32, portsc);
+        /* wait for ACK */
+        msleep(10);
+        retval = handshake(ehci, &ehci->regs->port_status[port-1], PORT_SSTS,
+                        PORTSC_SUSPEND_STS_ACK, 125);
+        dbg_port(ehci, "LPM", port, val32);
+        if (retval != -ETIMEDOUT) {
+                ehci_dbg(ehci, "LPM: device ACK for LPM\n");
+                val32 |= PORT_LPM;
+                /*
+                 * now device should be in L1 sleep, let's wake up the device
+                 * so that we can complete enumeration.
+                 */
+                ehci_writel(ehci, val32, portsc);
+                msleep(10);
+                val32 |= PORT_RESUME;
+                ehci_writel(ehci, val32, portsc);
+        } else {
+                ehci_dbg(ehci, "LPM: device does not ACK, disable LPM %d\n",
+                        retval);
+                val32 &= ~PORT_LPM;
+                retval = -ETIMEDOUT;
+                ehci_writel(ehci, val32, portsc);
+        }
+
+        return retval;
+}
diff --git a/drivers/usb/host/ohci-ath79.c b/drivers/usb/host/ohci-ath79.c
new file mode 100644
index 00000000000..c620c50f677
--- /dev/null
+++ b/drivers/usb/host/ohci-ath79.c
@@ -0,0 +1,151 @@
+/*
+ *  OHCI HCD (Host Controller Driver) for USB.
+ *
+ *  Bus Glue for Atheros AR71XX/AR724X built-in OHCI controller.
+ *
+ *  Copyright (C) 2008-2011 Gabor Juhos <juhosg@openwrt.org>
+ *  Copyright (C) 2008 Imre Kaloz <kaloz@openwrt.org>
+ *
+ *  Parts of this file are based on Atheros' 2.6.15 BSP
+ *      Copyright (C) 2007 Atheros Communications, Inc.
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License version 2 as published
+ *  by the Free Software Foundation.
+ */
+
+#include <linux/platform_device.h>
+
+static int __devinit ohci_ath79_start(struct usb_hcd *hcd)
+{
+        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
+        int ret;
+
+        ret = ohci_init(ohci);
+        if (ret < 0)
+                return ret;
+
+        ret = ohci_run(ohci);
+        if (ret < 0)
+                goto err;
+
+        return 0;
+
+err:
+        ohci_stop(hcd);
+        return ret;
+}
+
+static const struct hc_driver ohci_ath79_hc_driver = {
+        .description            = hcd_name,
+        .product_desc           = "Atheros built-in OHCI controller",
+        .hcd_priv_size          = sizeof(struct ohci_hcd),
+
+        .irq                    = ohci_irq,
+        .flags                  = HCD_USB11 | HCD_MEMORY,
+
+        .start                  = ohci_ath79_start,
+        .stop                   = ohci_stop,
+        .shutdown               = ohci_shutdown,
+
+        .urb_enqueue            = ohci_urb_enqueue,
+        .urb_dequeue            = ohci_urb_dequeue,
+        .endpoint_disable       = ohci_endpoint_disable,
+
+        /*
+         * scheduling support
+         */
+        .get_frame_number       = ohci_get_frame,
+
+        /*
+         * root hub support
+         */
+        .hub_status_data        = ohci_hub_status_data,
+        .hub_control            = ohci_hub_control,
+        .start_port_reset       = ohci_start_port_reset,
+};
+
+static int ohci_ath79_probe(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd;
+        struct resource *res;
+        int irq;
+        int ret;
+
+        if (usb_disabled())
+                return -ENODEV;
+
+        res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (!res) {
+                dev_dbg(&pdev->dev, "no IRQ specified\n");
+                return -ENODEV;
+        }
+        irq = res->start;
+
+        hcd = usb_create_hcd(&ohci_ath79_hc_driver, &pdev->dev,
+                             dev_name(&pdev->dev));
+        if (!hcd)
+                return -ENOMEM;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_dbg(&pdev->dev, "no base address specified\n");
+                ret = -ENODEV;
+                goto err_put_hcd;
+        }
+        hcd->rsrc_start = res->start;
+        hcd->rsrc_len = resource_size(res);
+
+        if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
+                dev_dbg(&pdev->dev, "controller already in use\n");
+                ret = -EBUSY;
+                goto err_put_hcd;
+        }
+
+        hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
+        if (!hcd->regs) {
+                dev_dbg(&pdev->dev, "error mapping memory\n");
+                ret = -EFAULT;
+                goto err_release_region;
+        }
+
+        ohci_hcd_init(hcd_to_ohci(hcd));
+
+        ret = usb_add_hcd(hcd, irq, IRQF_DISABLED);
+        if (ret)
+                goto err_stop_hcd;
+
+        return 0;
+
+err_stop_hcd:
+        iounmap(hcd->regs);
+err_release_region:
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+err_put_hcd:
+        usb_put_hcd(hcd);
+        return ret;
+}
+
+static int ohci_ath79_remove(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+
+        usb_remove_hcd(hcd);
+        iounmap(hcd->regs);
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+        usb_put_hcd(hcd);
+
+        return 0;
+}
+
+static struct platform_driver ohci_hcd_ath79_driver = {
+        .probe          = ohci_ath79_probe,
+        .remove         = ohci_ath79_remove,
+        .shutdown       = usb_hcd_platform_shutdown,
+        .driver         = {
+                .name   = "ath79-ohci",
+                .owner  = THIS_MODULE,
+        },
+};
+
+MODULE_ALIAS(PLATFORM_MODULE_PREFIX "ath79-ohci");
diff --git a/drivers/usb/host/ohci-au1xxx.c b/drivers/usb/host/ohci-au1xxx.c
new file mode 100644
index 00000000000..958d985f295
--- /dev/null
+++ b/drivers/usb/host/ohci-au1xxx.c
@@ -0,0 +1,319 @@
+/*
+ * OHCI HCD (Host Controller Driver) for USB.
+ *
+ * (C) Copyright 1999 Roman Weissgaerber <weissg@vienna.at>
+ * (C) Copyright 2000-2002 David Brownell <dbrownell@users.sourceforge.net>
+ * (C) Copyright 2002 Hewlett-Packard Company
+ *
+ * Bus Glue for AMD Alchemy Au1xxx
+ *
+ * Written by Christopher Hoover <ch@hpl.hp.com>
+ * Based on fragments of previous driver by Russell King et al.
+ *
+ * Modified for LH7A404 from ohci-sa1111.c
+ *  by Durgesh Pattamatta <pattamattad@sharpsec.com>
+ * Modified for AMD Alchemy Au1xxx
+ *  by Matt Porter <mporter@kernel.crashing.org>
+ *
+ * This file is licenced under the GPL.
+ */
+
+#include <linux/platform_device.h>
+#include <linux/signal.h>
+
+#include <asm/mach-au1x00/au1000.h>
+
+#ifndef CONFIG_SOC_AU1200
+
+#define USBH_ENABLE_BE (1<<0)
+#define USBH_ENABLE_C  (1<<1)
+#define USBH_ENABLE_E  (1<<2)
+#define USBH_ENABLE_CE (1<<3)
+#define USBH_ENABLE_RD (1<<4)
+
+#ifdef __LITTLE_ENDIAN
+#define USBH_ENABLE_INIT (USBH_ENABLE_CE | USBH_ENABLE_E | USBH_ENABLE_C)
+#elif defined(__BIG_ENDIAN)
+#define USBH_ENABLE_INIT (USBH_ENABLE_CE | USBH_ENABLE_E | USBH_ENABLE_C | \
+                          USBH_ENABLE_BE)
+#else
+#error not byte order defined
+#endif
+
+#else   /* Au1200 */
+
+#define USB_HOST_CONFIG    (USB_MSR_BASE + USB_MSR_MCFG)
+#define USB_MCFG_PFEN     (1<<31)
+#define USB_MCFG_RDCOMB   (1<<30)
+#define USB_MCFG_SSDEN    (1<<23)
+#define USB_MCFG_OHCCLKEN (1<<16)
+#ifdef CONFIG_DMA_COHERENT
+#define USB_MCFG_UCAM     (1<<7)
+#else
+#define USB_MCFG_UCAM     (0)
+#endif
+#define USB_MCFG_OBMEN    (1<<1)
+#define USB_MCFG_OMEMEN   (1<<0)
+
+#define USBH_ENABLE_CE    USB_MCFG_OHCCLKEN
+
+#define USBH_ENABLE_INIT  (USB_MCFG_PFEN  | USB_MCFG_RDCOMB     |       \
+                           USBH_ENABLE_CE | USB_MCFG_SSDEN      |       \
+                           USB_MCFG_UCAM  |                             \
+                           USB_MCFG_OBMEN | USB_MCFG_OMEMEN)
+
+#define USBH_DISABLE      (USB_MCFG_OBMEN | USB_MCFG_OMEMEN)
+
+#endif  /* Au1200 */
+
+extern int usb_disabled(void);
+
+static void au1xxx_start_ohc(void)
+{
+        /* enable host controller */
+#ifndef CONFIG_SOC_AU1200
+        au_writel(USBH_ENABLE_CE, USB_HOST_CONFIG);
+        au_sync();
+        udelay(1000);
+
+        au_writel(au_readl(USB_HOST_CONFIG) | USBH_ENABLE_INIT, USB_HOST_CONFIG);
+        au_sync();
+        udelay(1000);
+
+        /* wait for reset complete (read register twice; see au1500 errata) */
+        while (au_readl(USB_HOST_CONFIG),
+                !(au_readl(USB_HOST_CONFIG) & USBH_ENABLE_RD))
+                udelay(1000);
+
+#else   /* Au1200 */
+        au_writel(au_readl(USB_HOST_CONFIG) | USBH_ENABLE_CE, USB_HOST_CONFIG);
+        au_sync();
+        udelay(1000);
+
+        au_writel(au_readl(USB_HOST_CONFIG) | USBH_ENABLE_INIT, USB_HOST_CONFIG);
+        au_sync();
+        udelay(2000);
+#endif  /* Au1200 */
+}
+
+static void au1xxx_stop_ohc(void)
+{
+#ifdef CONFIG_SOC_AU1200
+        /* Disable mem */
+        au_writel(au_readl(USB_HOST_CONFIG) & ~USBH_DISABLE, USB_HOST_CONFIG);
+        au_sync();
+        udelay(1000);
+#endif
+        /* Disable clock */
+        au_writel(au_readl(USB_HOST_CONFIG) & ~USBH_ENABLE_CE, USB_HOST_CONFIG);
+        au_sync();
+}
+
+static int __devinit ohci_au1xxx_start(struct usb_hcd *hcd)
+{
+        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
+        int ret;
+
+        ohci_dbg(ohci, "ohci_au1xxx_start, ohci:%p", ohci);
+
+        if ((ret = ohci_init(ohci)) < 0)
+                return ret;
+
+        if ((ret = ohci_run(ohci)) < 0) {
+                err ("can't start %s", hcd->self.bus_name);
+                ohci_stop(hcd);
+                return ret;
+        }
+
+        return 0;
+}
+
+static const struct hc_driver ohci_au1xxx_hc_driver = {
+        .description =          hcd_name,
+        .product_desc =         "Au1xxx OHCI",
+        .hcd_priv_size =        sizeof(struct ohci_hcd),
+
+        /*
+         * generic hardware linkage
+         */
+        .irq =                  ohci_irq,
+        .flags =                HCD_USB11 | HCD_MEMORY,
+
+        /*
+         * basic lifecycle operations
+         */
+        .start =                ohci_au1xxx_start,
+        .stop =                 ohci_stop,
+        .shutdown =             ohci_shutdown,
+
+        /*
+         * managing i/o requests and associated device resources
+         */
+        .urb_enqueue =          ohci_urb_enqueue,
+        .urb_dequeue =          ohci_urb_dequeue,
+        .endpoint_disable =     ohci_endpoint_disable,
+
+        /*
+         * scheduling support
+         */
+        .get_frame_number =     ohci_get_frame,
+
+        /*
+         * root hub support
+         */
+        .hub_status_data =      ohci_hub_status_data,
+        .hub_control =          ohci_hub_control,
+#ifdef  CONFIG_PM
+        .bus_suspend =          ohci_bus_suspend,
+        .bus_resume =           ohci_bus_resume,
+#endif
+        .start_port_reset =     ohci_start_port_reset,
+};
+
+static int ohci_hcd_au1xxx_drv_probe(struct platform_device *pdev)
+{
+        int ret;
+        struct usb_hcd *hcd;
+
+        if (usb_disabled())
+                return -ENODEV;
+
+#if defined(CONFIG_SOC_AU1200) && defined(CONFIG_DMA_COHERENT)
+        /* Au1200 AB USB does not support coherent memory */
+        if (!(read_c0_prid() & 0xff)) {
+                printk(KERN_INFO "%s: this is chip revision AB !!\n",
+                        pdev->name);
+                printk(KERN_INFO "%s: update your board or re-configure "
+                                 "the kernel\n", pdev->name);
+                return -ENODEV;
+        }
+#endif
+
+        if (pdev->resource[1].flags != IORESOURCE_IRQ) {
+                pr_debug("resource[1] is not IORESOURCE_IRQ\n");
+                return -ENOMEM;
+        }
+
+        hcd = usb_create_hcd(&ohci_au1xxx_hc_driver, &pdev->dev, "au1xxx");
+        if (!hcd)
+                return -ENOMEM;
+
+        hcd->rsrc_start = pdev->resource[0].start;
+        hcd->rsrc_len = pdev->resource[0].end - pdev->resource[0].start + 1;
+
+        if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
+                pr_debug("request_mem_region failed\n");
+                ret = -EBUSY;
+                goto err1;
+        }
+
+        hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
+        if (!hcd->regs) {
+                pr_debug("ioremap failed\n");
+                ret = -ENOMEM;
+                goto err2;
+        }
+
+        au1xxx_start_ohc();
+        ohci_hcd_init(hcd_to_ohci(hcd));
+
+        ret = usb_add_hcd(hcd, pdev->resource[1].start,
+                          IRQF_DISABLED | IRQF_SHARED);
+        if (ret == 0) {
+                platform_set_drvdata(pdev, hcd);
+                return ret;
+        }
+
+        au1xxx_stop_ohc();
+        iounmap(hcd->regs);
+err2:
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+err1:
+        usb_put_hcd(hcd);
+        return ret;
+}
+
+static int ohci_hcd_au1xxx_drv_remove(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+
+        usb_remove_hcd(hcd);
+        au1xxx_stop_ohc();
+        iounmap(hcd->regs);
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+        usb_put_hcd(hcd);
+        platform_set_drvdata(pdev, NULL);
+
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int ohci_hcd_au1xxx_drv_suspend(struct device *dev)
+{
+        struct usb_hcd *hcd = dev_get_drvdata(dev);
+        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
+        unsigned long flags;
+        int rc;
+
+        rc = 0;
+
+        /* Root hub was already suspended. Disable irq emission and
+         * mark HW unaccessible, bail out if RH has been resumed. Use
+         * the spinlock to properly synchronize with possible pending
+         * RH suspend or resume activity.
+         *
+         * This is still racy as hcd->state is manipulated outside of
+         * any locks =P But that will be a different fix.
+         */
+        spin_lock_irqsave(&ohci->lock, flags);
+        if (hcd->state != HC_STATE_SUSPENDED) {
+                rc = -EINVAL;
+                goto bail;
+        }
+        ohci_writel(ohci, OHCI_INTR_MIE, &ohci->regs->intrdisable);
+        (void)ohci_readl(ohci, &ohci->regs->intrdisable);
+
+        clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
+
+        au1xxx_stop_ohc();
+bail:
+        spin_unlock_irqrestore(&ohci->lock, flags);
+
+        return rc;
+}
+
+static int ohci_hcd_au1xxx_drv_resume(struct device *dev)
+{
+        struct usb_hcd *hcd = dev_get_drvdata(dev);
+
+        au1xxx_start_ohc();
+
+        set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
+        ohci_finish_controller_resume(hcd);
+
+        return 0;
+}
+
+static const struct dev_pm_ops au1xxx_ohci_pmops = {
+        .suspend        = ohci_hcd_au1xxx_drv_suspend,
+        .resume         = ohci_hcd_au1xxx_drv_resume,
+};
+
+#define AU1XXX_OHCI_PMOPS &au1xxx_ohci_pmops
+
+#else
+#define AU1XXX_OHCI_PMOPS NULL
+#endif
+
+static struct platform_driver ohci_hcd_au1xxx_driver = {
+        .probe          = ohci_hcd_au1xxx_drv_probe,
+        .remove         = ohci_hcd_au1xxx_drv_remove,
+        .shutdown       = usb_hcd_platform_shutdown,
+        .driver         = {
+                .name   = "au1xxx-ohci",
+                .owner  = THIS_MODULE,
+                .pm     = AU1XXX_OHCI_PMOPS,
+        },
+};
+
+MODULE_ALIAS("platform:au1xxx-ohci");
diff --git a/drivers/usb/host/ohci-cns3xxx.c b/drivers/usb/host/ohci-cns3xxx.c
new file mode 100644
index 00000000000..5a00a1e1c6c
--- /dev/null
+++ b/drivers/usb/host/ohci-cns3xxx.c
@@ -0,0 +1,165 @@
+/*
+ * Copyright 2008 Cavium Networks
+ *
+ * This file is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License, Version 2, as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/platform_device.h>
+#include <linux/atomic.h>
+#include <mach/cns3xxx.h>
+#include <mach/pm.h>
+
+static int __devinit
+cns3xxx_ohci_start(struct usb_hcd *hcd)
+{
+        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
+        int ret;
+
+        /*
+         * EHCI and OHCI share the same clock and power,
+         * resetting twice would cause the 1st controller been reset.
+         * Therefore only do power up  at the first up device, and
+         * power down at the last down device.
+         *
+         * Set USB AHB INCR length to 16
+         */
+        if (atomic_inc_return(&usb_pwr_ref) == 1) {
+                cns3xxx_pwr_power_up(1 << PM_PLL_HM_PD_CTRL_REG_OFFSET_PLL_USB);
+                cns3xxx_pwr_clk_en(1 << PM_CLK_GATE_REG_OFFSET_USB_HOST);
+                cns3xxx_pwr_soft_rst(1 << PM_SOFT_RST_REG_OFFST_USB_HOST);
+                __raw_writel((__raw_readl(MISC_CHIP_CONFIG_REG) | (0X2 << 24)),
+                        MISC_CHIP_CONFIG_REG);
+        }
+
+        ret = ohci_init(ohci);
+        if (ret < 0)
+                return ret;
+
+        ohci->num_ports = 1;
+
+        ret = ohci_run(ohci);
+        if (ret < 0) {
+                err("can't start %s", hcd->self.bus_name);
+                ohci_stop(hcd);
+                return ret;
+        }
+        return 0;
+}
+
+static const struct hc_driver cns3xxx_ohci_hc_driver = {
+        .description            = hcd_name,
+        .product_desc           = "CNS3XXX OHCI Host controller",
+        .hcd_priv_size          = sizeof(struct ohci_hcd),
+        .irq                    = ohci_irq,
+        .flags                  = HCD_USB11 | HCD_MEMORY,
+        .start                  = cns3xxx_ohci_start,
+        .stop                   = ohci_stop,
+        .shutdown               = ohci_shutdown,
+        .urb_enqueue            = ohci_urb_enqueue,
+        .urb_dequeue            = ohci_urb_dequeue,
+        .endpoint_disable       = ohci_endpoint_disable,
+        .get_frame_number       = ohci_get_frame,
+        .hub_status_data        = ohci_hub_status_data,
+        .hub_control            = ohci_hub_control,
+#ifdef CONFIG_PM
+        .bus_suspend            = ohci_bus_suspend,
+        .bus_resume             = ohci_bus_resume,
+#endif
+        .start_port_reset       = ohci_start_port_reset,
+};
+
+static int cns3xxx_ohci_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct usb_hcd *hcd;
+        const struct hc_driver *driver = &cns3xxx_ohci_hc_driver;
+        struct resource *res;
+        int irq;
+        int retval;
+
+        if (usb_disabled())
+                return -ENODEV;
+
+        res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (!res) {
+                dev_err(dev, "Found HC with no IRQ.\n");
+                return -ENODEV;
+        }
+        irq = res->start;
+
+        hcd = usb_create_hcd(driver, dev, dev_name(dev));
+        if (!hcd)
+                return -ENOMEM;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_err(dev, "Found HC with no register addr.\n");
+                retval = -ENODEV;
+                goto err1;
+        }
+        hcd->rsrc_start = res->start;
+        hcd->rsrc_len = resource_size(res);
+
+        if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len,
+                        driver->description)) {
+                dev_dbg(dev, "controller already in use\n");
+                retval = -EBUSY;
+                goto err1;
+        }
+
+        hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
+        if (!hcd->regs) {
+                dev_dbg(dev, "error mapping memory\n");
+                retval = -EFAULT;
+                goto err2;
+        }
+
+        ohci_hcd_init(hcd_to_ohci(hcd));
+
+        retval = usb_add_hcd(hcd, irq, IRQF_SHARED);
+        if (retval == 0)
+                return retval;
+
+        iounmap(hcd->regs);
+err2:
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+err1:
+        usb_put_hcd(hcd);
+        return retval;
+}
+
+static int cns3xxx_ohci_remove(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+
+        usb_remove_hcd(hcd);
+        iounmap(hcd->regs);
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+
+        /*
+         * EHCI and OHCI share the same clock and power,
+         * resetting twice would cause the 1st controller been reset.
+         * Therefore only do power up  at the first up device, and
+         * power down at the last down device.
+         */
+        if (atomic_dec_return(&usb_pwr_ref) == 0)
+                cns3xxx_pwr_clk_dis(1 << PM_CLK_GATE_REG_OFFSET_USB_HOST);
+
+        usb_put_hcd(hcd);
+
+        platform_set_drvdata(pdev, NULL);
+
+        return 0;
+}
+
+MODULE_ALIAS("platform:cns3xxx-ohci");
+
+static struct platform_driver ohci_hcd_cns3xxx_driver = {
+        .probe = cns3xxx_ohci_probe,
+        .remove = cns3xxx_ohci_remove,
+        .driver = {
+                .name = "cns3xxx-ohci",
+        },
+};
diff --git a/drivers/usb/host/ohci-pnx4008.c b/drivers/usb/host/ohci-pnx4008.c
new file mode 100644
index 00000000000..653d6a60edb
--- /dev/null
+++ b/drivers/usb/host/ohci-pnx4008.c
@@ -0,0 +1,453 @@
+/*
+ * drivers/usb/host/ohci-pnx4008.c
+ *
+ * driver for Philips PNX4008 USB Host
+ *
+ * Authors: Dmitry Chigirev <source@mvista.com>
+ *          Vitaly Wool <vitalywool@gmail.com>
+ *
+ * register initialization is based on code examples provided by Philips
+ * Copyright (c) 2005 Koninklijke Philips Electronics N.V.
+ *
+ * NOTE: This driver does not have suspend/resume functionality
+ * This driver is intended for engineering development purposes only
+ *
+ * 2005-2006 (c) MontaVista Software, Inc. This file is licensed under
+ * the terms of the GNU General Public License version 2. This program
+ * is licensed "as is" without any warranty of any kind, whether express
+ * or implied.
+ */
+#include <linux/clk.h>
+#include <linux/platform_device.h>
+#include <linux/i2c.h>
+
+#include <mach/hardware.h>
+#include <asm/io.h>
+
+#include <mach/platform.h>
+#include <mach/irqs.h>
+#include <mach/gpio.h>
+
+#define USB_CTRL        IO_ADDRESS(PNX4008_PWRMAN_BASE + 0x64)
+
+/* USB_CTRL bit defines */
+#define USB_SLAVE_HCLK_EN       (1 << 24)
+#define USB_HOST_NEED_CLK_EN    (1 << 21)
+
+#define USB_OTG_CLK_CTRL        IO_ADDRESS(PNX4008_USB_CONFIG_BASE + 0xFF4)
+#define USB_OTG_CLK_STAT        IO_ADDRESS(PNX4008_USB_CONFIG_BASE + 0xFF8)
+
+/* USB_OTG_CLK_CTRL bit defines */
+#define AHB_M_CLOCK_ON          (1 << 4)
+#define OTG_CLOCK_ON            (1 << 3)
+#define I2C_CLOCK_ON            (1 << 2)
+#define DEV_CLOCK_ON            (1 << 1)
+#define HOST_CLOCK_ON           (1 << 0)
+
+#define USB_OTG_STAT_CONTROL    IO_ADDRESS(PNX4008_USB_CONFIG_BASE + 0x110)
+
+/* USB_OTG_STAT_CONTROL bit defines */
+#define TRANSPARENT_I2C_EN      (1 << 7)
+#define HOST_EN                 (1 << 0)
+
+/* ISP1301 USB transceiver I2C registers */
+#define ISP1301_MODE_CONTROL_1          0x04    /* u8 read, set, +1 clear */
+
+#define MC1_SPEED_REG           (1 << 0)
+#define MC1_SUSPEND_REG         (1 << 1)
+#define MC1_DAT_SE0             (1 << 2)
+#define MC1_TRANSPARENT         (1 << 3)
+#define MC1_BDIS_ACON_EN        (1 << 4)
+#define MC1_OE_INT_EN           (1 << 5)
+#define MC1_UART_EN             (1 << 6)
+#define MC1_MASK                0x7f
+
+#define ISP1301_MODE_CONTROL_2          0x12    /* u8 read, set, +1 clear */
+
+#define MC2_GLOBAL_PWR_DN       (1 << 0)
+#define MC2_SPD_SUSP_CTRL       (1 << 1)
+#define MC2_BI_DI               (1 << 2)
+#define MC2_TRANSP_BDIR0        (1 << 3)
+#define MC2_TRANSP_BDIR1        (1 << 4)
+#define MC2_AUDIO_EN            (1 << 5)
+#define MC2_PSW_EN              (1 << 6)
+#define MC2_EN2V7               (1 << 7)
+
+#define ISP1301_OTG_CONTROL_1           0x06    /* u8 read, set, +1 clear */
+#       define  OTG1_DP_PULLUP          (1 << 0)
+#       define  OTG1_DM_PULLUP          (1 << 1)
+#       define  OTG1_DP_PULLDOWN        (1 << 2)
+#       define  OTG1_DM_PULLDOWN        (1 << 3)
+#       define  OTG1_ID_PULLDOWN        (1 << 4)
+#       define  OTG1_VBUS_DRV           (1 << 5)
+#       define  OTG1_VBUS_DISCHRG       (1 << 6)
+#       define  OTG1_VBUS_CHRG          (1 << 7)
+#define ISP1301_OTG_STATUS              0x10    /* u8 readonly */
+#       define  OTG_B_SESS_END          (1 << 6)
+#       define  OTG_B_SESS_VLD          (1 << 7)
+
+#define ISP1301_I2C_ADDR 0x2C
+
+#define ISP1301_I2C_MODE_CONTROL_1 0x4
+#define ISP1301_I2C_MODE_CONTROL_2 0x12
+#define ISP1301_I2C_OTG_CONTROL_1 0x6
+#define ISP1301_I2C_OTG_CONTROL_2 0x10
+#define ISP1301_I2C_INTERRUPT_SOURCE 0x8
+#define ISP1301_I2C_INTERRUPT_LATCH 0xA
+#define ISP1301_I2C_INTERRUPT_FALLING 0xC
+#define ISP1301_I2C_INTERRUPT_RISING 0xE
+#define ISP1301_I2C_REG_CLEAR_ADDR 1
+
+static struct i2c_driver isp1301_driver;
+static struct i2c_client *isp1301_i2c_client;
+
+extern int usb_disabled(void);
+extern int ocpi_enable(void);
+
+static struct clk *usb_clk;
+
+static const unsigned short normal_i2c[] =
+    { ISP1301_I2C_ADDR, ISP1301_I2C_ADDR + 1, I2C_CLIENT_END };
+
+static int isp1301_probe(struct i2c_client *client,
+                         const struct i2c_device_id *id)
+{
+        return 0;
+}
+
+static int isp1301_remove(struct i2c_client *client)
+{
+        return 0;
+}
+
+static const struct i2c_device_id isp1301_id[] = {
+        { "isp1301_pnx", 0 },
+        { }
+};
+
+static struct i2c_driver isp1301_driver = {
+        .driver = {
+                .name = "isp1301_pnx",
+        },
+        .probe = isp1301_probe,
+        .remove = isp1301_remove,
+        .id_table = isp1301_id,
+};
+
+static void i2c_write(u8 buf, u8 subaddr)
+{
+        char tmpbuf[2];
+
+        tmpbuf[0] = subaddr;    /*register number */
+        tmpbuf[1] = buf;        /*register data */
+        i2c_master_send(isp1301_i2c_client, &tmpbuf[0], 2);
+}
+
+static void isp1301_configure(void)
+{
+        /* PNX4008 only supports DAT_SE0 USB mode */
+        /* PNX4008 R2A requires setting the MAX603 to output 3.6V */
+        /* Power up externel charge-pump */
+
+        i2c_write(MC1_DAT_SE0 | MC1_SPEED_REG, ISP1301_I2C_MODE_CONTROL_1);
+        i2c_write(~(MC1_DAT_SE0 | MC1_SPEED_REG),
+                  ISP1301_I2C_MODE_CONTROL_1 | ISP1301_I2C_REG_CLEAR_ADDR);
+        i2c_write(MC2_BI_DI | MC2_PSW_EN | MC2_SPD_SUSP_CTRL,
+                  ISP1301_I2C_MODE_CONTROL_2);
+        i2c_write(~(MC2_BI_DI | MC2_PSW_EN | MC2_SPD_SUSP_CTRL),
+                  ISP1301_I2C_MODE_CONTROL_2 | ISP1301_I2C_REG_CLEAR_ADDR);
+        i2c_write(OTG1_DM_PULLDOWN | OTG1_DP_PULLDOWN,
+                  ISP1301_I2C_OTG_CONTROL_1);
+        i2c_write(~(OTG1_DM_PULLDOWN | OTG1_DP_PULLDOWN),
+                  ISP1301_I2C_OTG_CONTROL_1 | ISP1301_I2C_REG_CLEAR_ADDR);
+        i2c_write(0xFF,
+                  ISP1301_I2C_INTERRUPT_LATCH | ISP1301_I2C_REG_CLEAR_ADDR);
+        i2c_write(0xFF,
+                  ISP1301_I2C_INTERRUPT_FALLING | ISP1301_I2C_REG_CLEAR_ADDR);
+        i2c_write(0xFF,
+                  ISP1301_I2C_INTERRUPT_RISING | ISP1301_I2C_REG_CLEAR_ADDR);
+
+}
+
+static inline void isp1301_vbus_on(void)
+{
+        i2c_write(OTG1_VBUS_DRV, ISP1301_I2C_OTG_CONTROL_1);
+}
+
+static inline void isp1301_vbus_off(void)
+{
+        i2c_write(OTG1_VBUS_DRV,
+                  ISP1301_I2C_OTG_CONTROL_1 | ISP1301_I2C_REG_CLEAR_ADDR);
+}
+
+static void pnx4008_start_hc(void)
+{
+        unsigned long tmp = __raw_readl(USB_OTG_STAT_CONTROL) | HOST_EN;
+        __raw_writel(tmp, USB_OTG_STAT_CONTROL);
+        isp1301_vbus_on();
+}
+
+static void pnx4008_stop_hc(void)
+{
+        unsigned long tmp;
+        isp1301_vbus_off();
+        tmp = __raw_readl(USB_OTG_STAT_CONTROL) & ~HOST_EN;
+        __raw_writel(tmp, USB_OTG_STAT_CONTROL);
+}
+
+static int __devinit ohci_pnx4008_start(struct usb_hcd *hcd)
+{
+        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
+        int ret;
+
+        if ((ret = ohci_init(ohci)) < 0)
+                return ret;
+
+        if ((ret = ohci_run(ohci)) < 0) {
+                dev_err(hcd->self.controller, "can't start\n");
+                ohci_stop(hcd);
+                return ret;
+        }
+        return 0;
+}
+
+static const struct hc_driver ohci_pnx4008_hc_driver = {
+        .description = hcd_name,
+        .product_desc =         "pnx4008 OHCI",
+
+        /*
+         * generic hardware linkage
+         */
+        .irq = ohci_irq,
+        .flags = HCD_USB11 | HCD_MEMORY,
+
+        .hcd_priv_size =        sizeof(struct ohci_hcd),
+        /*
+         * basic lifecycle operations
+         */
+        .start = ohci_pnx4008_start,
+        .stop = ohci_stop,
+        .shutdown = ohci_shutdown,
+
+        /*
+         * managing i/o requests and associated device resources
+         */
+        .urb_enqueue = ohci_urb_enqueue,
+        .urb_dequeue = ohci_urb_dequeue,
+        .endpoint_disable = ohci_endpoint_disable,
+
+        /*
+         * scheduling support
+         */
+        .get_frame_number = ohci_get_frame,
+
+        /*
+         * root hub support
+         */
+        .hub_status_data = ohci_hub_status_data,
+        .hub_control = ohci_hub_control,
+#ifdef  CONFIG_PM
+        .bus_suspend = ohci_bus_suspend,
+        .bus_resume = ohci_bus_resume,
+#endif
+        .start_port_reset = ohci_start_port_reset,
+};
+
+#define USB_CLOCK_MASK (AHB_M_CLOCK_ON| OTG_CLOCK_ON | HOST_CLOCK_ON | I2C_CLOCK_ON)
+
+static void pnx4008_set_usb_bits(void)
+{
+        start_int_set_falling_edge(SE_USB_OTG_ATX_INT_N);
+        start_int_ack(SE_USB_OTG_ATX_INT_N);
+        start_int_umask(SE_USB_OTG_ATX_INT_N);
+
+        start_int_set_rising_edge(SE_USB_OTG_TIMER_INT);
+        start_int_ack(SE_USB_OTG_TIMER_INT);
+        start_int_umask(SE_USB_OTG_TIMER_INT);
+
+        start_int_set_rising_edge(SE_USB_I2C_INT);
+        start_int_ack(SE_USB_I2C_INT);
+        start_int_umask(SE_USB_I2C_INT);
+
+        start_int_set_rising_edge(SE_USB_INT);
+        start_int_ack(SE_USB_INT);
+        start_int_umask(SE_USB_INT);
+
+        start_int_set_rising_edge(SE_USB_NEED_CLK_INT);
+        start_int_ack(SE_USB_NEED_CLK_INT);
+        start_int_umask(SE_USB_NEED_CLK_INT);
+
+        start_int_set_rising_edge(SE_USB_AHB_NEED_CLK_INT);
+        start_int_ack(SE_USB_AHB_NEED_CLK_INT);
+        start_int_umask(SE_USB_AHB_NEED_CLK_INT);
+}
+
+static void pnx4008_unset_usb_bits(void)
+{
+        start_int_mask(SE_USB_OTG_ATX_INT_N);
+        start_int_mask(SE_USB_OTG_TIMER_INT);
+        start_int_mask(SE_USB_I2C_INT);
+        start_int_mask(SE_USB_INT);
+        start_int_mask(SE_USB_NEED_CLK_INT);
+        start_int_mask(SE_USB_AHB_NEED_CLK_INT);
+}
+
+static int __devinit usb_hcd_pnx4008_probe(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = 0;
+        struct ohci_hcd *ohci;
+        const struct hc_driver *driver = &ohci_pnx4008_hc_driver;
+        struct i2c_adapter *i2c_adap;
+        struct i2c_board_info i2c_info;
+
+        int ret = 0, irq;
+
+        dev_dbg(&pdev->dev, "%s: " DRIVER_DESC " (pnx4008)\n", hcd_name);
+        if (usb_disabled()) {
+                err("USB is disabled");
+                ret = -ENODEV;
+                goto out;
+        }
+
+        if (pdev->num_resources != 2
+            || pdev->resource[0].flags != IORESOURCE_MEM
+            || pdev->resource[1].flags != IORESOURCE_IRQ) {
+                err("Invalid resource configuration");
+                ret = -ENODEV;
+                goto out;
+        }
+
+        /* Enable AHB slave USB clock, needed for further USB clock control */
+        __raw_writel(USB_SLAVE_HCLK_EN | (1 << 19), USB_CTRL);
+
+        ret = i2c_add_driver(&isp1301_driver);
+        if (ret < 0) {
+                err("failed to add ISP1301 driver");
+                goto out;
+        }
+        i2c_adap = i2c_get_adapter(2);
+        memset(&i2c_info, 0, sizeof(struct i2c_board_info));
+        strlcpy(i2c_info.type, "isp1301_pnx", I2C_NAME_SIZE);
+        isp1301_i2c_client = i2c_new_probed_device(i2c_adap, &i2c_info,
+                                                   normal_i2c, NULL);
+        i2c_put_adapter(i2c_adap);
+        if (!isp1301_i2c_client) {
+                err("failed to connect I2C to ISP1301 USB Transceiver");
+                ret = -ENODEV;
+                goto out_i2c_driver;
+        }
+
+        isp1301_configure();
+
+        /* Enable USB PLL */
+        usb_clk = clk_get(&pdev->dev, "ck_pll5");
+        if (IS_ERR(usb_clk)) {
+                err("failed to acquire USB PLL");
+                ret = PTR_ERR(usb_clk);
+                goto out1;
+        }
+
+        ret = clk_enable(usb_clk);
+        if (ret < 0) {
+                err("failed to start USB PLL");
+                goto out2;
+        }
+
+        ret = clk_set_rate(usb_clk, 48000);
+        if (ret < 0) {
+                err("failed to set USB clock rate");
+                goto out3;
+        }
+
+        __raw_writel(__raw_readl(USB_CTRL) | USB_HOST_NEED_CLK_EN, USB_CTRL);
+
+        /* Set to enable all needed USB clocks */
+        __raw_writel(USB_CLOCK_MASK, USB_OTG_CLK_CTRL);
+
+        while ((__raw_readl(USB_OTG_CLK_STAT) & USB_CLOCK_MASK) !=
+               USB_CLOCK_MASK) ;
+
+        hcd = usb_create_hcd (driver, &pdev->dev, dev_name(&pdev->dev));
+        if (!hcd) {
+                err("Failed to allocate HC buffer");
+                ret = -ENOMEM;
+                goto out3;
+        }
+
+        /* Set all USB bits in the Start Enable register */
+        pnx4008_set_usb_bits();
+
+        hcd->rsrc_start = pdev->resource[0].start;
+        hcd->rsrc_len = pdev->resource[0].end - pdev->resource[0].start + 1;
+        if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
+                dev_dbg(&pdev->dev, "request_mem_region failed\n");
+                ret =  -ENOMEM;
+                goto out4;
+        }
+        hcd->regs = (void __iomem *)pdev->resource[0].start;
+
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                ret = -ENXIO;
+                goto out4;
+        }
+
+        pnx4008_start_hc();
+        platform_set_drvdata(pdev, hcd);
+        ohci = hcd_to_ohci(hcd);
+        ohci_hcd_init(ohci);
+
+        dev_info(&pdev->dev, "at 0x%p, irq %d\n", hcd->regs, hcd->irq);
+        ret = usb_add_hcd(hcd, irq, IRQF_DISABLED);
+        if (ret == 0)
+                return ret;
+
+        pnx4008_stop_hc();
+out4:
+        pnx4008_unset_usb_bits();
+        usb_put_hcd(hcd);
+out3:
+        clk_disable(usb_clk);
+out2:
+        clk_put(usb_clk);
+out1:
+        i2c_unregister_device(isp1301_i2c_client);
+        isp1301_i2c_client = NULL;
+out_i2c_driver:
+        i2c_del_driver(&isp1301_driver);
+out:
+        return ret;
+}
+
+static int usb_hcd_pnx4008_remove(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+
+        usb_remove_hcd(hcd);
+        pnx4008_stop_hc();
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+        usb_put_hcd(hcd);
+        pnx4008_unset_usb_bits();
+        clk_disable(usb_clk);
+        clk_put(usb_clk);
+        i2c_unregister_device(isp1301_i2c_client);
+        isp1301_i2c_client = NULL;
+        i2c_del_driver(&isp1301_driver);
+
+        platform_set_drvdata(pdev, NULL);
+
+        return 0;
+}
+
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:usb-ohci");
+
+static struct platform_driver usb_hcd_pnx4008_driver = {
+        .driver = {
+                .name = "usb-ohci",
+                .owner  = THIS_MODULE,
+        },
+        .probe = usb_hcd_pnx4008_probe,
+        .remove = usb_hcd_pnx4008_remove,
+};
+
diff --git a/drivers/usb/host/ohci-pnx8550.c b/drivers/usb/host/ohci-pnx8550.c
new file mode 100644
index 00000000000..28467e288a9
--- /dev/null
+++ b/drivers/usb/host/ohci-pnx8550.c
@@ -0,0 +1,242 @@
+/*
+ * OHCI HCD (Host Controller Driver) for USB.
+ *
+ * (C) Copyright 1999 Roman Weissgaerber <weissg@vienna.at>
+ * (C) Copyright 2000-2002 David Brownell <dbrownell@users.sourceforge.net>
+ * (C) Copyright 2002 Hewlett-Packard Company
+ * (C) Copyright 2005 Embedded Alley Solutions, Inc.
+ *
+ * Bus Glue for PNX8550
+ *
+ * Written by Christopher Hoover <ch@hpl.hp.com>
+ * Based on fragments of previous driver by Russell King et al.
+ *
+ * Modified for LH7A404 from ohci-sa1111.c
+ *  by Durgesh Pattamatta <pattamattad@sharpsec.com>
+ *
+ * Modified for PNX8550 from ohci-sa1111.c and sa-omap.c
+ *  by Vitaly Wool <vitalywool@gmail.com>
+ *
+ * This file is licenced under the GPL.
+ */
+
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <asm/mach-pnx8550/usb.h>
+#include <asm/mach-pnx8550/int.h>
+#include <asm/mach-pnx8550/pci.h>
+
+#ifndef CONFIG_PNX8550
+#error "This file is PNX8550 bus glue.  CONFIG_PNX8550 must be defined."
+#endif
+
+extern int usb_disabled(void);
+
+/*-------------------------------------------------------------------------*/
+
+static void pnx8550_start_hc(struct platform_device *dev)
+{
+        /*
+         * Set register CLK48CTL to enable and 48MHz
+         */
+        outl(0x00000003, PCI_BASE | 0x0004770c);
+
+        /*
+         * Set register CLK12CTL to enable and 48MHz
+         */
+        outl(0x00000003, PCI_BASE | 0x00047710);
+
+        udelay(100);
+}
+
+static void pnx8550_stop_hc(struct platform_device *dev)
+{
+        udelay(10);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* configure so an HC device and id are always provided */
+/* always called with process context; sleeping is OK */
+
+
+/**
+ * usb_hcd_pnx8550_probe - initialize pnx8550-based HCDs
+ * Context: !in_interrupt()
+ *
+ * Allocates basic resources for this USB host controller, and
+ * then invokes the start() method for the HCD associated with it
+ * through the hotplug entry's driver_data.
+ *
+ */
+int usb_hcd_pnx8550_probe (const struct hc_driver *driver,
+                          struct platform_device *dev)
+{
+        int retval;
+        struct usb_hcd *hcd;
+
+        if (dev->resource[0].flags != IORESOURCE_MEM ||
+                        dev->resource[1].flags != IORESOURCE_IRQ) {
+                dev_err (&dev->dev,"invalid resource type\n");
+                return -ENOMEM;
+        }
+
+        hcd = usb_create_hcd (driver, &dev->dev, "pnx8550");
+        if (!hcd)
+                return -ENOMEM;
+        hcd->rsrc_start = dev->resource[0].start;
+        hcd->rsrc_len = dev->resource[0].end - dev->resource[0].start + 1;
+
+        if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
+                dev_err(&dev->dev, "request_mem_region [0x%08llx, 0x%08llx] "
+                                "failed\n", hcd->rsrc_start, hcd->rsrc_len);
+                retval = -EBUSY;
+                goto err1;
+        }
+
+        hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
+        if (!hcd->regs) {
+                dev_err(&dev->dev, "ioremap [[0x%08llx, 0x%08llx] failed\n",
+                                hcd->rsrc_start, hcd->rsrc_len);
+                retval = -ENOMEM;
+                goto err2;
+        }
+
+        pnx8550_start_hc(dev);
+
+        ohci_hcd_init(hcd_to_ohci(hcd));
+
+        retval = usb_add_hcd(hcd, dev->resource[1].start, IRQF_DISABLED);
+        if (retval == 0)
+                return retval;
+
+        pnx8550_stop_hc(dev);
+        iounmap(hcd->regs);
+ err2:
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+ err1:
+        usb_put_hcd(hcd);
+        return retval;
+}
+
+
+/* may be called without controller electrically present */
+/* may be called with controller, bus, and devices active */
+
+/**
+ * usb_hcd_pnx8550_remove - shutdown processing for pnx8550-based HCDs
+ * @dev: USB Host Controller being removed
+ * Context: !in_interrupt()
+ *
+ * Reverses the effect of usb_hcd_pnx8550_probe(), first invoking
+ * the HCD's stop() method.  It is always called from a thread
+ * context, normally "rmmod", "apmd", or something similar.
+ *
+ */
+void usb_hcd_pnx8550_remove (struct usb_hcd *hcd, struct platform_device *dev)
+{
+        usb_remove_hcd(hcd);
+        pnx8550_stop_hc(dev);
+        iounmap(hcd->regs);
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+        usb_put_hcd(hcd);
+}
+
+/*-------------------------------------------------------------------------*/
+
+static int __devinit
+ohci_pnx8550_start (struct usb_hcd *hcd)
+{
+        struct ohci_hcd *ohci = hcd_to_ohci (hcd);
+        int             ret;
+
+        ohci_dbg (ohci, "ohci_pnx8550_start, ohci:%p", ohci);
+
+        if ((ret = ohci_init(ohci)) < 0)
+                return ret;
+
+        if ((ret = ohci_run (ohci)) < 0) {
+                err ("can't start %s", hcd->self.bus_name);
+                ohci_stop (hcd);
+                return ret;
+        }
+
+        return 0;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static const struct hc_driver ohci_pnx8550_hc_driver = {
+        .description =          hcd_name,
+        .product_desc =         "PNX8550 OHCI",
+        .hcd_priv_size =        sizeof(struct ohci_hcd),
+
+        /*
+         * generic hardware linkage
+         */
+        .irq =                  ohci_irq,
+        .flags =                HCD_USB11 | HCD_MEMORY,
+
+        /*
+         * basic lifecycle operations
+         */
+        .start =                ohci_pnx8550_start,
+        .stop =                 ohci_stop,
+
+        /*
+         * managing i/o requests and associated device resources
+         */
+        .urb_enqueue =          ohci_urb_enqueue,
+        .urb_dequeue =          ohci_urb_dequeue,
+        .endpoint_disable =     ohci_endpoint_disable,
+
+        /*
+         * scheduling support
+         */
+        .get_frame_number =     ohci_get_frame,
+
+        /*
+         * root hub support
+         */
+        .hub_status_data =      ohci_hub_status_data,
+        .hub_control =          ohci_hub_control,
+#ifdef  CONFIG_PM
+        .bus_suspend =          ohci_bus_suspend,
+        .bus_resume =           ohci_bus_resume,
+#endif
+        .start_port_reset =     ohci_start_port_reset,
+};
+
+/*-------------------------------------------------------------------------*/
+
+static int ohci_hcd_pnx8550_drv_probe(struct platform_device *pdev)
+{
+        int ret;
+
+        if (usb_disabled())
+                return -ENODEV;
+
+        ret = usb_hcd_pnx8550_probe(&ohci_pnx8550_hc_driver, pdev);
+        return ret;
+}
+
+static int ohci_hcd_pnx8550_drv_remove(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+
+        usb_hcd_pnx8550_remove(hcd, pdev);
+        return 0;
+}
+
+MODULE_ALIAS("platform:pnx8550-ohci");
+
+static struct platform_driver ohci_hcd_pnx8550_driver = {
+        .driver = {
+                .name   = "pnx8550-ohci",
+                .owner  = THIS_MODULE,
+        },
+        .probe          = ohci_hcd_pnx8550_drv_probe,
+        .remove         = ohci_hcd_pnx8550_drv_remove,
+};
+
diff --git a/drivers/usb/host/ohci-ppc-soc.c b/drivers/usb/host/ohci-ppc-soc.c
new file mode 100644
index 00000000000..c0f595c4448
--- /dev/null
+++ b/drivers/usb/host/ohci-ppc-soc.c
@@ -0,0 +1,215 @@
+/*
+ * OHCI HCD (Host Controller Driver) for USB.
+ *
+ * (C) Copyright 1999 Roman Weissgaerber <weissg@vienna.at>
+ * (C) Copyright 2000-2002 David Brownell <dbrownell@users.sourceforge.net>
+ * (C) Copyright 2002 Hewlett-Packard Company
+ * (C) Copyright 2003-2005 MontaVista Software Inc.
+ *
+ * Bus Glue for PPC On-Chip OHCI driver
+ * Tested on Freescale MPC5200 and IBM STB04xxx
+ *
+ * Modified by Dale Farnsworth <dale@farnsworth.org> from ohci-sa1111.c
+ *
+ * This file is licenced under the GPL.
+ */
+
+#include <linux/platform_device.h>
+#include <linux/signal.h>
+
+/* configure so an HC device and id are always provided */
+/* always called with process context; sleeping is OK */
+
+/**
+ * usb_hcd_ppc_soc_probe - initialize On-Chip HCDs
+ * Context: !in_interrupt()
+ *
+ * Allocates basic resources for this USB host controller.
+ *
+ * Store this function in the HCD's struct pci_driver as probe().
+ */
+static int usb_hcd_ppc_soc_probe(const struct hc_driver *driver,
+                          struct platform_device *pdev)
+{
+        int retval;
+        struct usb_hcd *hcd;
+        struct ohci_hcd *ohci;
+        struct resource *res;
+        int irq;
+
+        pr_debug("initializing PPC-SOC USB Controller\n");
+
+        res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (!res) {
+                pr_debug("%s: no irq\n", __FILE__);
+                return -ENODEV;
+        }
+        irq = res->start;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                pr_debug("%s: no reg addr\n", __FILE__);
+                return -ENODEV;
+        }
+
+        hcd = usb_create_hcd(driver, &pdev->dev, "PPC-SOC USB");
+        if (!hcd)
+                return -ENOMEM;
+        hcd->rsrc_start = res->start;
+        hcd->rsrc_len = resource_size(res);
+
+        if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
+                pr_debug("%s: request_mem_region failed\n", __FILE__);
+                retval = -EBUSY;
+                goto err1;
+        }
+
+        hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
+        if (!hcd->regs) {
+                pr_debug("%s: ioremap failed\n", __FILE__);
+                retval = -ENOMEM;
+                goto err2;
+        }
+
+        ohci = hcd_to_ohci(hcd);
+        ohci->flags |= OHCI_QUIRK_BE_MMIO | OHCI_QUIRK_BE_DESC;
+
+#ifdef CONFIG_PPC_MPC52xx
+        /* MPC52xx doesn't need frame_no shift */
+        ohci->flags |= OHCI_QUIRK_FRAME_NO;
+#endif
+        ohci_hcd_init(ohci);
+
+        retval = usb_add_hcd(hcd, irq, IRQF_DISABLED);
+        if (retval == 0)
+                return retval;
+
+        pr_debug("Removing PPC-SOC USB Controller\n");
+
+        iounmap(hcd->regs);
+ err2:
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+ err1:
+        usb_put_hcd(hcd);
+        return retval;
+}
+
+
+/* may be called without controller electrically present */
+/* may be called with controller, bus, and devices active */
+
+/**
+ * usb_hcd_ppc_soc_remove - shutdown processing for On-Chip HCDs
+ * @pdev: USB Host Controller being removed
+ * Context: !in_interrupt()
+ *
+ * Reverses the effect of usb_hcd_ppc_soc_probe().
+ * It is always called from a thread
+ * context, normally "rmmod", "apmd", or something similar.
+ *
+ */
+static void usb_hcd_ppc_soc_remove(struct usb_hcd *hcd,
+                struct platform_device *pdev)
+{
+        usb_remove_hcd(hcd);
+
+        pr_debug("stopping PPC-SOC USB Controller\n");
+
+        iounmap(hcd->regs);
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+        usb_put_hcd(hcd);
+}
+
+static int __devinit
+ohci_ppc_soc_start(struct usb_hcd *hcd)
+{
+        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
+        int             ret;
+
+        if ((ret = ohci_init(ohci)) < 0)
+                return ret;
+
+        if ((ret = ohci_run(ohci)) < 0) {
+                err("can't start %s", ohci_to_hcd(ohci)->self.bus_name);
+                ohci_stop(hcd);
+                return ret;
+        }
+
+        return 0;
+}
+
+static const struct hc_driver ohci_ppc_soc_hc_driver = {
+        .description =          hcd_name,
+        .hcd_priv_size =        sizeof(struct ohci_hcd),
+
+        /*
+         * generic hardware linkage
+         */
+        .irq =                  ohci_irq,
+        .flags =                HCD_USB11 | HCD_MEMORY,
+
+        /*
+         * basic lifecycle operations
+         */
+        .start =                ohci_ppc_soc_start,
+        .stop =                 ohci_stop,
+        .shutdown =             ohci_shutdown,
+
+        /*
+         * managing i/o requests and associated device resources
+         */
+        .urb_enqueue =          ohci_urb_enqueue,
+        .urb_dequeue =          ohci_urb_dequeue,
+        .endpoint_disable =     ohci_endpoint_disable,
+
+        /*
+         * scheduling support
+         */
+        .get_frame_number =     ohci_get_frame,
+
+        /*
+         * root hub support
+         */
+        .hub_status_data =      ohci_hub_status_data,
+        .hub_control =          ohci_hub_control,
+#ifdef  CONFIG_PM
+        .bus_suspend =          ohci_bus_suspend,
+        .bus_resume =           ohci_bus_resume,
+#endif
+        .start_port_reset =     ohci_start_port_reset,
+};
+
+static int ohci_hcd_ppc_soc_drv_probe(struct platform_device *pdev)
+{
+        int ret;
+
+        if (usb_disabled())
+                return -ENODEV;
+
+        ret = usb_hcd_ppc_soc_probe(&ohci_ppc_soc_hc_driver, pdev);
+        return ret;
+}
+
+static int ohci_hcd_ppc_soc_drv_remove(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+
+        usb_hcd_ppc_soc_remove(hcd, pdev);
+        return 0;
+}
+
+static struct platform_driver ohci_hcd_ppc_soc_driver = {
+        .probe          = ohci_hcd_ppc_soc_drv_probe,
+        .remove         = ohci_hcd_ppc_soc_drv_remove,
+        .shutdown       = usb_hcd_platform_shutdown,
+#ifdef  CONFIG_PM
+        /*.suspend      = ohci_hcd_ppc_soc_drv_suspend,*/
+        /*.resume       = ohci_hcd_ppc_soc_drv_resume,*/
+#endif
+        .driver         = {
+                .name   = "ppc-soc-ohci",
+                .owner  = THIS_MODULE,
+        },
+};
+
+MODULE_ALIAS("platform:ppc-soc-ohci");
diff --git a/drivers/usb/host/ohci-sh.c b/drivers/usb/host/ohci-sh.c
new file mode 100644
index 00000000000..14cecb52a9f
--- /dev/null
+++ b/drivers/usb/host/ohci-sh.c
@@ -0,0 +1,142 @@
+/*
+ * OHCI HCD (Host Controller Driver) for USB.
+ *
+ * Copyright (C) 2008 Renesas Solutions Corp.
+ *
+ * Author : Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include <linux/platform_device.h>
+
+static int ohci_sh_start(struct usb_hcd *hcd)
+{
+        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
+
+        ohci_hcd_init(ohci);
+        ohci_init(ohci);
+        ohci_run(ohci);
+        hcd->state = HC_STATE_RUNNING;
+        return 0;
+}
+
+static const struct hc_driver ohci_sh_hc_driver = {
+        .description =          hcd_name,
+        .product_desc =         "SuperH OHCI",
+        .hcd_priv_size =        sizeof(struct ohci_hcd),
+
+        /*
+         * generic hardware linkage
+         */
+        .irq =                  ohci_irq,
+        .flags =                HCD_USB11 | HCD_MEMORY,
+
+        /*
+         * basic lifecycle operations
+         */
+        .start =                ohci_sh_start,
+        .stop =                 ohci_stop,
+        .shutdown =             ohci_shutdown,
+
+        /*
+         * managing i/o requests and associated device resources
+         */
+        .urb_enqueue =          ohci_urb_enqueue,
+        .urb_dequeue =          ohci_urb_dequeue,
+        .endpoint_disable =     ohci_endpoint_disable,
+
+        /*
+         * scheduling support
+         */
+        .get_frame_number =     ohci_get_frame,
+
+        /*
+         * root hub support
+         */
+        .hub_status_data =      ohci_hub_status_data,
+        .hub_control =          ohci_hub_control,
+#ifdef  CONFIG_PM
+        .bus_suspend =          ohci_bus_suspend,
+        .bus_resume =           ohci_bus_resume,
+#endif
+        .start_port_reset =     ohci_start_port_reset,
+};
+
+/*-------------------------------------------------------------------------*/
+
+static int ohci_hcd_sh_probe(struct platform_device *pdev)
+{
+        struct resource *res = NULL;
+        struct usb_hcd *hcd = NULL;
+        int irq = -1;
+        int ret;
+
+        if (usb_disabled())
+                return -ENODEV;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                err("platform_get_resource error.");
+                return -ENODEV;
+        }
+
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                err("platform_get_irq error.");
+                return -ENODEV;
+        }
+
+        /* initialize hcd */
+        hcd = usb_create_hcd(&ohci_sh_hc_driver, &pdev->dev, (char *)hcd_name);
+        if (!hcd) {
+                err("Failed to create hcd");
+                return -ENOMEM;
+        }
+
+        hcd->regs = (void __iomem *)res->start;
+        hcd->rsrc_start = res->start;
+        hcd->rsrc_len = resource_size(res);
+        ret = usb_add_hcd(hcd, irq, IRQF_DISABLED | IRQF_SHARED);
+        if (ret != 0) {
+                err("Failed to add hcd");
+                usb_put_hcd(hcd);
+                return ret;
+        }
+
+        return ret;
+}
+
+static int ohci_hcd_sh_remove(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+
+        usb_remove_hcd(hcd);
+        usb_put_hcd(hcd);
+
+        return 0;
+}
+
+static struct platform_driver ohci_hcd_sh_driver = {
+        .probe          = ohci_hcd_sh_probe,
+        .remove         = ohci_hcd_sh_remove,
+        .shutdown       = usb_hcd_platform_shutdown,
+        .driver         = {
+                .name   = "sh_ohci",
+                .owner  = THIS_MODULE,
+        },
+};
+
+MODULE_ALIAS("platform:sh_ohci");
diff --git a/drivers/usb/host/ohci-ssb.c b/drivers/usb/host/ohci-ssb.c
new file mode 100644
index 00000000000..c4aea3b8315
--- /dev/null
+++ b/drivers/usb/host/ohci-ssb.c
@@ -0,0 +1,260 @@
+/*
+ * Sonics Silicon Backplane
+ * Broadcom USB-core OHCI driver
+ *
+ * Copyright 2007 Michael Buesch <m@bues.ch>
+ *
+ * Derived from the OHCI-PCI driver
+ * Copyright 1999 Roman Weissgaerber
+ * Copyright 2000-2002 David Brownell
+ * Copyright 1999 Linus Torvalds
+ * Copyright 1999 Gregory P. Smith
+ *
+ * Derived from the USBcore related parts of Broadcom-SB
+ * Copyright 2005 Broadcom Corporation
+ *
+ * Licensed under the GNU/GPL. See COPYING for details.
+ */
+#include <linux/ssb/ssb.h>
+
+
+#define SSB_OHCI_TMSLOW_HOSTMODE        (1 << 29)
+
+struct ssb_ohci_device {
+        struct ohci_hcd ohci; /* _must_ be at the beginning. */
+
+        u32 enable_flags;
+};
+
+static inline
+struct ssb_ohci_device *hcd_to_ssb_ohci(struct usb_hcd *hcd)
+{
+        return (struct ssb_ohci_device *)(hcd->hcd_priv);
+}
+
+
+static int ssb_ohci_reset(struct usb_hcd *hcd)
+{
+        struct ssb_ohci_device *ohcidev = hcd_to_ssb_ohci(hcd);
+        struct ohci_hcd *ohci = &ohcidev->ohci;
+        int err;
+
+        ohci_hcd_init(ohci);
+        err = ohci_init(ohci);
+
+        return err;
+}
+
+static int ssb_ohci_start(struct usb_hcd *hcd)
+{
+        struct ssb_ohci_device *ohcidev = hcd_to_ssb_ohci(hcd);
+        struct ohci_hcd *ohci = &ohcidev->ohci;
+        int err;
+
+        err = ohci_run(ohci);
+        if (err < 0) {
+                ohci_err(ohci, "can't start\n");
+                ohci_stop(hcd);
+        }
+
+        return err;
+}
+
+static const struct hc_driver ssb_ohci_hc_driver = {
+        .description            = "ssb-usb-ohci",
+        .product_desc           = "SSB OHCI Controller",
+        .hcd_priv_size          = sizeof(struct ssb_ohci_device),
+
+        .irq                    = ohci_irq,
+        .flags                  = HCD_MEMORY | HCD_USB11,
+
+        .reset                  = ssb_ohci_reset,
+        .start                  = ssb_ohci_start,
+        .stop                   = ohci_stop,
+        .shutdown               = ohci_shutdown,
+
+        .urb_enqueue            = ohci_urb_enqueue,
+        .urb_dequeue            = ohci_urb_dequeue,
+        .endpoint_disable       = ohci_endpoint_disable,
+
+        .get_frame_number       = ohci_get_frame,
+
+        .hub_status_data        = ohci_hub_status_data,
+        .hub_control            = ohci_hub_control,
+#ifdef  CONFIG_PM
+        .bus_suspend            = ohci_bus_suspend,
+        .bus_resume             = ohci_bus_resume,
+#endif
+
+        .start_port_reset       = ohci_start_port_reset,
+};
+
+static void ssb_ohci_detach(struct ssb_device *dev)
+{
+        struct usb_hcd *hcd = ssb_get_drvdata(dev);
+
+        if (hcd->driver->shutdown)
+                hcd->driver->shutdown(hcd);
+        usb_remove_hcd(hcd);
+        iounmap(hcd->regs);
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+        usb_put_hcd(hcd);
+        ssb_device_disable(dev, 0);
+}
+
+static int ssb_ohci_attach(struct ssb_device *dev)
+{
+        struct ssb_ohci_device *ohcidev;
+        struct usb_hcd *hcd;
+        int err = -ENOMEM;
+        u32 tmp, flags = 0;
+
+        if (dma_set_mask(dev->dma_dev, DMA_BIT_MASK(32)) ||
+            dma_set_coherent_mask(dev->dma_dev, DMA_BIT_MASK(32)))
+                return -EOPNOTSUPP;
+
+        if (dev->id.coreid == SSB_DEV_USB11_HOSTDEV) {
+                /* Put the device into host-mode. */
+                flags |= SSB_OHCI_TMSLOW_HOSTMODE;
+                ssb_device_enable(dev, flags);
+        } else if (dev->id.coreid == SSB_DEV_USB20_HOST) {
+                /*
+                 * USB 2.0 special considerations:
+                 *
+                 * In addition to the standard SSB reset sequence, the Host
+                 * Control Register must be programmed to bring the USB core
+                 * and various phy components out of reset.
+                 */
+                ssb_device_enable(dev, 0);
+                ssb_write32(dev, 0x200, 0x7ff);
+
+                /* Change Flush control reg */
+                tmp = ssb_read32(dev, 0x400);
+                tmp &= ~8;
+                ssb_write32(dev, 0x400, tmp);
+                tmp = ssb_read32(dev, 0x400);
+
+                /* Change Shim control reg */
+                tmp = ssb_read32(dev, 0x304);
+                tmp &= ~0x100;
+                ssb_write32(dev, 0x304, tmp);
+                tmp = ssb_read32(dev, 0x304);
+
+                udelay(1);
+
+                /* Work around for 5354 failures */
+                if (dev->id.revision == 2 && dev->bus->chip_id == 0x5354) {
+                        /* Change syn01 reg */
+                        tmp = 0x00fe00fe;
+                        ssb_write32(dev, 0x894, tmp);
+
+                        /* Change syn03 reg */
+                        tmp = ssb_read32(dev, 0x89c);
+                        tmp |= 0x1;
+                        ssb_write32(dev, 0x89c, tmp);
+                }
+        } else
+                ssb_device_enable(dev, 0);
+
+        hcd = usb_create_hcd(&ssb_ohci_hc_driver, dev->dev,
+                        dev_name(dev->dev));
+        if (!hcd)
+                goto err_dev_disable;
+        ohcidev = hcd_to_ssb_ohci(hcd);
+        ohcidev->enable_flags = flags;
+
+        tmp = ssb_read32(dev, SSB_ADMATCH0);
+        hcd->rsrc_start = ssb_admatch_base(tmp);
+        hcd->rsrc_len = ssb_admatch_size(tmp);
+        hcd->regs = ioremap_nocache(hcd->rsrc_start, hcd->rsrc_len);
+        if (!hcd->regs)
+                goto err_put_hcd;
+        err = usb_add_hcd(hcd, dev->irq, IRQF_DISABLED | IRQF_SHARED);
+        if (err)
+                goto err_iounmap;
+
+        ssb_set_drvdata(dev, hcd);
+
+        return err;
+
+err_iounmap:
+        iounmap(hcd->regs);
+err_put_hcd:
+        usb_put_hcd(hcd);
+err_dev_disable:
+        ssb_device_disable(dev, flags);
+        return err;
+}
+
+static int ssb_ohci_probe(struct ssb_device *dev,
+                const struct ssb_device_id *id)
+{
+        int err;
+        u16 chipid_top;
+
+        /* USBcores are only connected on embedded devices. */
+        chipid_top = (dev->bus->chip_id & 0xFF00);
+        if (chipid_top != 0x4700 && chipid_top != 0x5300)
+                return -ENODEV;
+
+        /* TODO: Probably need checks here; is the core connected? */
+
+        if (usb_disabled())
+                return -ENODEV;
+
+        /* We currently always attach SSB_DEV_USB11_HOSTDEV
+         * as HOST OHCI. If we want to attach it as Client device,
+         * we must branch here and call into the (yet to
+         * be written) Client mode driver. Same for remove(). */
+
+        err = ssb_ohci_attach(dev);
+
+        return err;
+}
+
+static void ssb_ohci_remove(struct ssb_device *dev)
+{
+        ssb_ohci_detach(dev);
+}
+
+#ifdef CONFIG_PM
+
+static int ssb_ohci_suspend(struct ssb_device *dev, pm_message_t state)
+{
+        ssb_device_disable(dev, 0);
+
+        return 0;
+}
+
+static int ssb_ohci_resume(struct ssb_device *dev)
+{
+        struct usb_hcd *hcd = ssb_get_drvdata(dev);
+        struct ssb_ohci_device *ohcidev = hcd_to_ssb_ohci(hcd);
+
+        ssb_device_enable(dev, ohcidev->enable_flags);
+
+        ohci_finish_controller_resume(hcd);
+        return 0;
+}
+
+#else /* !CONFIG_PM */
+#define ssb_ohci_suspend        NULL
+#define ssb_ohci_resume NULL
+#endif /* CONFIG_PM */
+
+static const struct ssb_device_id ssb_ohci_table[] = {
+        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_USB11_HOSTDEV, SSB_ANY_REV),
+        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_USB11_HOST, SSB_ANY_REV),
+        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_USB20_HOST, SSB_ANY_REV),
+        SSB_DEVTABLE_END
+};
+MODULE_DEVICE_TABLE(ssb, ssb_ohci_table);
+
+static struct ssb_driver ssb_ohci_driver = {
+        .name           = KBUILD_MODNAME,
+        .id_table       = ssb_ohci_table,
+        .probe          = ssb_ohci_probe,
+        .remove         = ssb_ohci_remove,
+        .suspend        = ssb_ohci_suspend,
+        .resume         = ssb_ohci_resume,
+};
diff --git a/drivers/usb/otg/langwell_otg.c b/drivers/usb/otg/langwell_otg.c
new file mode 100644
index 00000000000..f08f784086f
--- /dev/null
+++ b/drivers/usb/otg/langwell_otg.c
@@ -0,0 +1,2347 @@
+/*
+ * Intel Langwell USB OTG transceiver driver
+ * Copyright (C) 2008 - 2010, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+/* This driver helps to switch Langwell OTG controller function between host
+ * and peripheral. It works with EHCI driver and Langwell client controller
+ * driver together.
+ */
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/pci.h>
+#include <linux/errno.h>
+#include <linux/interrupt.h>
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/moduleparam.h>
+#include <linux/usb/ch9.h>
+#include <linux/usb/gadget.h>
+#include <linux/usb.h>
+#include <linux/usb/otg.h>
+#include <linux/usb/hcd.h>
+#include <linux/notifier.h>
+#include <linux/delay.h>
+#include <asm/intel_scu_ipc.h>
+
+#include <linux/usb/langwell_otg.h>
+
+#define DRIVER_DESC             "Intel Langwell USB OTG transceiver driver"
+#define DRIVER_VERSION          "July 10, 2010"
+
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_AUTHOR("Henry Yuan <hang.yuan@intel.com>, Hao Wu <hao.wu@intel.com>");
+MODULE_VERSION(DRIVER_VERSION);
+MODULE_LICENSE("GPL");
+
+static const char driver_name[] = "langwell_otg";
+
+static int langwell_otg_probe(struct pci_dev *pdev,
+                        const struct pci_device_id *id);
+static void langwell_otg_remove(struct pci_dev *pdev);
+static int langwell_otg_suspend(struct pci_dev *pdev, pm_message_t message);
+static int langwell_otg_resume(struct pci_dev *pdev);
+
+static int langwell_otg_set_host(struct otg_transceiver *otg,
+                                struct usb_bus *host);
+static int langwell_otg_set_peripheral(struct otg_transceiver *otg,
+                                struct usb_gadget *gadget);
+static int langwell_otg_start_srp(struct otg_transceiver *otg);
+
+static const struct pci_device_id pci_ids[] = {{
+        .class =        ((PCI_CLASS_SERIAL_USB << 8) | 0xfe),
+        .class_mask =   ~0,
+        .vendor =       0x8086,
+        .device =       0x0811,
+        .subvendor =    PCI_ANY_ID,
+        .subdevice =    PCI_ANY_ID,
+}, { /* end: all zeroes */ }
+};
+
+static struct pci_driver otg_pci_driver = {
+        .name =         (char *) driver_name,
+        .id_table =     pci_ids,
+
+        .probe =        langwell_otg_probe,
+        .remove =       langwell_otg_remove,
+
+        .suspend =      langwell_otg_suspend,
+        .resume =       langwell_otg_resume,
+};
+
+/* HSM timers */
+static inline struct langwell_otg_timer *otg_timer_initializer
+(void (*function)(unsigned long), unsigned long expires, unsigned long data)
+{
+        struct langwell_otg_timer *timer;
+        timer = kmalloc(sizeof(struct langwell_otg_timer), GFP_KERNEL);
+        if (timer == NULL)
+                return timer;
+
+        timer->function = function;
+        timer->expires = expires;
+        timer->data = data;
+        return timer;
+}
+
+static struct langwell_otg_timer *a_wait_vrise_tmr, *a_aidl_bdis_tmr,
+        *b_se0_srp_tmr, *b_srp_init_tmr;
+
+static struct list_head active_timers;
+
+static struct langwell_otg *the_transceiver;
+
+/* host/client notify transceiver when event affects HNP state */
+void langwell_update_transceiver(void)
+{
+        struct langwell_otg *lnw = the_transceiver;
+
+        dev_dbg(lnw->dev, "transceiver is updated\n");
+
+        if (!lnw->qwork)
+                return ;
+
+        queue_work(lnw->qwork, &lnw->work);
+}
+EXPORT_SYMBOL(langwell_update_transceiver);
+
+static int langwell_otg_set_host(struct otg_transceiver *otg,
+                                        struct usb_bus *host)
+{
+        otg->host = host;
+
+        return 0;
+}
+
+static int langwell_otg_set_peripheral(struct otg_transceiver *otg,
+                                        struct usb_gadget *gadget)
+{
+        otg->gadget = gadget;
+
+        return 0;
+}
+
+static int langwell_otg_set_power(struct otg_transceiver *otg,
+                                unsigned mA)
+{
+        return 0;
+}
+
+/* A-device drives vbus, controlled through IPC commands */
+static int langwell_otg_set_vbus(struct otg_transceiver *otg, bool enabled)
+{
+        struct langwell_otg             *lnw = the_transceiver;
+        u8                              sub_id;
+
+        dev_dbg(lnw->dev, "%s <--- %s\n", __func__, enabled ? "on" : "off");
+
+        if (enabled)
+                sub_id = 0x8; /* Turn on the VBus */
+        else
+                sub_id = 0x9; /* Turn off the VBus */
+
+        if (intel_scu_ipc_simple_command(0xef, sub_id)) {
+                dev_dbg(lnw->dev, "Failed to set Vbus via IPC commands\n");
+                return -EBUSY;
+        }
+
+        dev_dbg(lnw->dev, "%s --->\n", __func__);
+
+        return 0;
+}
+
+/* charge vbus or discharge vbus through a resistor to ground */
+static void langwell_otg_chrg_vbus(int on)
+{
+        struct langwell_otg     *lnw = the_transceiver;
+        u32     val;
+
+        val = readl(lnw->iotg.base + CI_OTGSC);
+
+        if (on)
+                writel((val & ~OTGSC_INTSTS_MASK) | OTGSC_VC,
+                                lnw->iotg.base + CI_OTGSC);
+        else
+                writel((val & ~OTGSC_INTSTS_MASK) | OTGSC_VD,
+                                lnw->iotg.base + CI_OTGSC);
+}
+
+/* Start SRP */
+static int langwell_otg_start_srp(struct otg_transceiver *otg)
+{
+        struct langwell_otg             *lnw = the_transceiver;
+        struct intel_mid_otg_xceiv      *iotg = &lnw->iotg;
+        u32                             val;
+
+        dev_dbg(lnw->dev, "%s --->\n", __func__);
+
+        val = readl(iotg->base + CI_OTGSC);
+
+        writel((val & ~OTGSC_INTSTS_MASK) | OTGSC_HADP,
+                                iotg->base + CI_OTGSC);
+
+        /* Check if the data plus is finished or not */
+        msleep(8);
+        val = readl(iotg->base + CI_OTGSC);
+        if (val & (OTGSC_HADP | OTGSC_DP))
+                dev_dbg(lnw->dev, "DataLine SRP Error\n");
+
+        /* Disable interrupt - b_sess_vld */
+        val = readl(iotg->base + CI_OTGSC);
+        val &= (~(OTGSC_BSVIE | OTGSC_BSEIE));
+        writel(val, iotg->base + CI_OTGSC);
+
+        /* Start VBus SRP, drive vbus to generate VBus pulse */
+        iotg->otg.set_vbus(&iotg->otg, true);
+        msleep(15);
+        iotg->otg.set_vbus(&iotg->otg, false);
+
+        /* Enable interrupt - b_sess_vld*/
+        val = readl(iotg->base + CI_OTGSC);
+        dev_dbg(lnw->dev, "after VBUS pulse otgsc = %x\n", val);
+
+        val |= (OTGSC_BSVIE | OTGSC_BSEIE);
+        writel(val, iotg->base + CI_OTGSC);
+
+        /* If Vbus is valid, then update the hsm */
+        if (val & OTGSC_BSV) {
+                dev_dbg(lnw->dev, "no b_sess_vld interrupt\n");
+
+                lnw->iotg.hsm.b_sess_vld = 1;
+                langwell_update_transceiver();
+        }
+
+        dev_dbg(lnw->dev, "%s <---\n", __func__);
+        return 0;
+}
+
+/* stop SOF via bus_suspend */
+static void langwell_otg_loc_sof(int on)
+{
+        struct langwell_otg     *lnw = the_transceiver;
+        struct usb_hcd          *hcd;
+        int                     err;
+
+        dev_dbg(lnw->dev, "%s ---> %s\n", __func__, on ? "suspend" : "resume");
+
+        hcd = bus_to_hcd(lnw->iotg.otg.host);
+        if (on)
+                err = hcd->driver->bus_resume(hcd);
+        else
+                err = hcd->driver->bus_suspend(hcd);
+
+        if (err)
+                dev_dbg(lnw->dev, "Fail to resume/suspend USB bus - %d\n", err);
+
+        dev_dbg(lnw->dev, "%s <---\n", __func__);
+}
+
+static int langwell_otg_check_otgsc(void)
+{
+        struct langwell_otg             *lnw = the_transceiver;
+        u32                             otgsc, usbcfg;
+
+        dev_dbg(lnw->dev, "check sync OTGSC and USBCFG registers\n");
+
+        otgsc = readl(lnw->iotg.base + CI_OTGSC);
+        usbcfg = readl(lnw->usbcfg);
+
+        dev_dbg(lnw->dev, "OTGSC = %08x, USBCFG = %08x\n",
+                                        otgsc, usbcfg);
+        dev_dbg(lnw->dev, "OTGSC_AVV = %d\n", !!(otgsc & OTGSC_AVV));
+        dev_dbg(lnw->dev, "USBCFG.VBUSVAL = %d\n",
+                                        !!(usbcfg & USBCFG_VBUSVAL));
+        dev_dbg(lnw->dev, "OTGSC_ASV = %d\n", !!(otgsc & OTGSC_ASV));
+        dev_dbg(lnw->dev, "USBCFG.AVALID = %d\n",
+                                        !!(usbcfg & USBCFG_AVALID));
+        dev_dbg(lnw->dev, "OTGSC_BSV = %d\n", !!(otgsc & OTGSC_BSV));
+        dev_dbg(lnw->dev, "USBCFG.BVALID = %d\n",
+                                        !!(usbcfg & USBCFG_BVALID));
+        dev_dbg(lnw->dev, "OTGSC_BSE = %d\n", !!(otgsc & OTGSC_BSE));
+        dev_dbg(lnw->dev, "USBCFG.SESEND = %d\n",
+                                        !!(usbcfg & USBCFG_SESEND));
+
+        /* Check USBCFG VBusValid/AValid/BValid/SessEnd */
+        if (!!(otgsc & OTGSC_AVV) ^ !!(usbcfg & USBCFG_VBUSVAL)) {
+                dev_dbg(lnw->dev, "OTGSC.AVV != USBCFG.VBUSVAL\n");
+                goto err;
+        }
+        if (!!(otgsc & OTGSC_ASV) ^ !!(usbcfg & USBCFG_AVALID)) {
+                dev_dbg(lnw->dev, "OTGSC.ASV != USBCFG.AVALID\n");
+                goto err;
+        }
+        if (!!(otgsc & OTGSC_BSV) ^ !!(usbcfg & USBCFG_BVALID)) {
+                dev_dbg(lnw->dev, "OTGSC.BSV != USBCFG.BVALID\n");
+                goto err;
+        }
+        if (!!(otgsc & OTGSC_BSE) ^ !!(usbcfg & USBCFG_SESEND)) {
+                dev_dbg(lnw->dev, "OTGSC.BSE != USBCFG.SESSEN\n");
+                goto err;
+        }
+
+        dev_dbg(lnw->dev, "OTGSC and USBCFG are synced\n");
+
+        return 0;
+
+err:
+        dev_warn(lnw->dev, "OTGSC isn't equal to USBCFG\n");
+        return -EPIPE;
+}
+
+
+static void langwell_otg_phy_low_power(int on)
+{
+        struct langwell_otg             *lnw = the_transceiver;
+        struct intel_mid_otg_xceiv      *iotg = &lnw->iotg;
+        u8                              val, phcd;
+        int                             retval;
+
+        dev_dbg(lnw->dev, "%s ---> %s mode\n",
+                        __func__, on ? "Low power" : "Normal");
+
+        phcd = 0x40;
+
+        val = readb(iotg->base + CI_HOSTPC1 + 2);
+
+        if (on) {
+                /* Due to hardware issue, after set PHCD, sync will failed
+                 * between USBCFG and OTGSC, so before set PHCD, check if
+                 * sync is in process now. If the answer is "yes", then do
+                 * not touch PHCD bit */
+                retval = langwell_otg_check_otgsc();
+                if (retval) {
+                        dev_dbg(lnw->dev, "Skip PHCD programming..\n");
+                        return ;
+                }
+
+                writeb(val | phcd, iotg->base + CI_HOSTPC1 + 2);
+        } else
+                writeb(val & ~phcd, iotg->base + CI_HOSTPC1 + 2);
+
+        dev_dbg(lnw->dev, "%s <--- done\n", __func__);
+}
+
+/* After drv vbus, add 5 ms delay to set PHCD */
+static void langwell_otg_phy_low_power_wait(int on)
+{
+        struct langwell_otg     *lnw = the_transceiver;
+
+        dev_dbg(lnw->dev, "add 5ms delay before programing PHCD\n");
+
+        mdelay(5);
+        langwell_otg_phy_low_power(on);
+}
+
+/* Enable/Disable OTG interrupt */
+static void langwell_otg_intr(int on)
+{
+        struct langwell_otg             *lnw = the_transceiver;
+        struct intel_mid_otg_xceiv      *iotg = &lnw->iotg;
+        u32                             val;
+
+        dev_dbg(lnw->dev, "%s ---> %s\n", __func__, on ? "on" : "off");
+
+        val = readl(iotg->base + CI_OTGSC);
+
+        /* OTGSC_INT_MASK doesn't contains 1msInt */
+        if (on) {
+                val = val | (OTGSC_INT_MASK);
+                writel(val, iotg->base + CI_OTGSC);
+        } else {
+                val = val & ~(OTGSC_INT_MASK);
+                writel(val, iotg->base + CI_OTGSC);
+        }
+
+        dev_dbg(lnw->dev, "%s <---\n", __func__);
+}
+
+/* set HAAR: Hardware Assist Auto-Reset */
+static void langwell_otg_HAAR(int on)
+{
+        struct langwell_otg             *lnw = the_transceiver;
+        struct intel_mid_otg_xceiv      *iotg = &lnw->iotg;
+        u32                             val;
+
+        dev_dbg(lnw->dev, "%s ---> %s\n", __func__, on ? "on" : "off");
+
+        val = readl(iotg->base + CI_OTGSC);
+        if (on)
+                writel((val & ~OTGSC_INTSTS_MASK) | OTGSC_HAAR,
+                                        iotg->base + CI_OTGSC);
+        else
+                writel((val & ~OTGSC_INTSTS_MASK) & ~OTGSC_HAAR,
+                                        iotg->base + CI_OTGSC);
+
+        dev_dbg(lnw->dev, "%s <---\n", __func__);
+}
+
+/* set HABA: Hardware Assist B-Disconnect to A-Connect */
+static void langwell_otg_HABA(int on)
+{
+        struct langwell_otg             *lnw = the_transceiver;
+        struct intel_mid_otg_xceiv      *iotg = &lnw->iotg;
+        u32                             val;
+
+        dev_dbg(lnw->dev, "%s ---> %s\n", __func__, on ? "on" : "off");
+
+        val = readl(iotg->base + CI_OTGSC);
+        if (on)
+                writel((val & ~OTGSC_INTSTS_MASK) | OTGSC_HABA,
+                                        iotg->base + CI_OTGSC);
+        else
+                writel((val & ~OTGSC_INTSTS_MASK) & ~OTGSC_HABA,
+                                        iotg->base + CI_OTGSC);
+
+        dev_dbg(lnw->dev, "%s <---\n", __func__);
+}
+
+static int langwell_otg_check_se0_srp(int on)
+{
+        struct langwell_otg     *lnw = the_transceiver;
+        int                     delay_time = TB_SE0_SRP * 10;
+        u32                     val;
+
+        dev_dbg(lnw->dev, "%s --->\n", __func__);
+
+        do {
+                udelay(100);
+                if (!delay_time--)
+                        break;
+                val = readl(lnw->iotg.base + CI_PORTSC1);
+                val &= PORTSC_LS;
+        } while (!val);
+
+        dev_dbg(lnw->dev, "%s <---\n", __func__);
+        return val;
+}
+
+/* The timeout callback function to set time out bit */
+static void set_tmout(unsigned long indicator)
+{
+        *(int *)indicator = 1;
+}
+
+void langwell_otg_nsf_msg(unsigned long indicator)
+{
+        struct langwell_otg     *lnw = the_transceiver;
+
+        switch (indicator) {
+        case 2:
+        case 4:
+        case 6:
+        case 7:
+                dev_warn(lnw->dev,
+                        "OTG:NSF-%lu - deivce not responding\n", indicator);
+                break;
+        case 3:
+                dev_warn(lnw->dev,
+                        "OTG:NSF-%lu - deivce not supported\n", indicator);
+                break;
+        default:
+                dev_warn(lnw->dev, "Do not have this kind of NSF\n");
+                break;
+        }
+}
+
+/* Initialize timers */
+static int langwell_otg_init_timers(struct otg_hsm *hsm)
+{
+        /* HSM used timers */
+        a_wait_vrise_tmr = otg_timer_initializer(&set_tmout, TA_WAIT_VRISE,
+                                (unsigned long)&hsm->a_wait_vrise_tmout);
+        if (a_wait_vrise_tmr == NULL)
+                return -ENOMEM;
+        a_aidl_bdis_tmr = otg_timer_initializer(&set_tmout, TA_AIDL_BDIS,
+                                (unsigned long)&hsm->a_aidl_bdis_tmout);
+        if (a_aidl_bdis_tmr == NULL)
+                return -ENOMEM;
+        b_se0_srp_tmr = otg_timer_initializer(&set_tmout, TB_SE0_SRP,
+                                (unsigned long)&hsm->b_se0_srp);
+        if (b_se0_srp_tmr == NULL)
+                return -ENOMEM;
+        b_srp_init_tmr = otg_timer_initializer(&set_tmout, TB_SRP_INIT,
+                                (unsigned long)&hsm->b_srp_init_tmout);
+        if (b_srp_init_tmr == NULL)
+                return -ENOMEM;
+
+        return 0;
+}
+
+/* Free timers */
+static void langwell_otg_free_timers(void)
+{
+        kfree(a_wait_vrise_tmr);
+        kfree(a_aidl_bdis_tmr);
+        kfree(b_se0_srp_tmr);
+        kfree(b_srp_init_tmr);
+}
+
+/* The timeout callback function to set time out bit */
+static void langwell_otg_timer_fn(unsigned long indicator)
+{
+        struct langwell_otg *lnw = the_transceiver;
+
+        *(int *)indicator = 1;
+
+        dev_dbg(lnw->dev, "kernel timer - timeout\n");
+
+        langwell_update_transceiver();
+}
+
+/* kernel timer used instead of HW based interrupt */
+static void langwell_otg_add_ktimer(enum langwell_otg_timer_type timers)
+{
+        struct langwell_otg             *lnw = the_transceiver;
+        struct intel_mid_otg_xceiv      *iotg = &lnw->iotg;
+        unsigned long           j = jiffies;
+        unsigned long           data, time;
+
+        switch (timers) {
+        case TA_WAIT_VRISE_TMR:
+                iotg->hsm.a_wait_vrise_tmout = 0;
+                data = (unsigned long)&iotg->hsm.a_wait_vrise_tmout;
+                time = TA_WAIT_VRISE;
+                break;
+        case TA_WAIT_BCON_TMR:
+                iotg->hsm.a_wait_bcon_tmout = 0;
+                data = (unsigned long)&iotg->hsm.a_wait_bcon_tmout;
+                time = TA_WAIT_BCON;
+                break;
+        case TA_AIDL_BDIS_TMR:
+                iotg->hsm.a_aidl_bdis_tmout = 0;
+                data = (unsigned long)&iotg->hsm.a_aidl_bdis_tmout;
+                time = TA_AIDL_BDIS;
+                break;
+        case TB_ASE0_BRST_TMR:
+                iotg->hsm.b_ase0_brst_tmout = 0;
+                data = (unsigned long)&iotg->hsm.b_ase0_brst_tmout;
+                time = TB_ASE0_BRST;
+                break;
+        case TB_SRP_INIT_TMR:
+                iotg->hsm.b_srp_init_tmout = 0;
+                data = (unsigned long)&iotg->hsm.b_srp_init_tmout;
+                time = TB_SRP_INIT;
+                break;
+        case TB_SRP_FAIL_TMR:
+                iotg->hsm.b_srp_fail_tmout = 0;
+                data = (unsigned long)&iotg->hsm.b_srp_fail_tmout;
+                time = TB_SRP_FAIL;
+                break;
+        case TB_BUS_SUSPEND_TMR:
+                iotg->hsm.b_bus_suspend_tmout = 0;
+                data = (unsigned long)&iotg->hsm.b_bus_suspend_tmout;
+                time = TB_BUS_SUSPEND;
+                break;
+        default:
+                dev_dbg(lnw->dev, "unknown timer, cannot enable it\n");
+                return;
+        }
+
+        lnw->hsm_timer.data = data;
+        lnw->hsm_timer.function = langwell_otg_timer_fn;
+        lnw->hsm_timer.expires = j + time * HZ / 1000; /* milliseconds */
+
+        add_timer(&lnw->hsm_timer);
+
+        dev_dbg(lnw->dev, "add timer successfully\n");
+}
+
+/* Add timer to timer list */
+static void langwell_otg_add_timer(void *gtimer)
+{
+        struct langwell_otg_timer *timer = (struct langwell_otg_timer *)gtimer;
+        struct langwell_otg_timer *tmp_timer;
+        struct intel_mid_otg_xceiv *iotg = &the_transceiver->iotg;
+        u32     val32;
+
+        /* Check if the timer is already in the active list,
+         * if so update timer count
+         */
+        list_for_each_entry(tmp_timer, &active_timers, list)
+                if (tmp_timer == timer) {
+                        timer->count = timer->expires;
+                        return;
+                }
+        timer->count = timer->expires;
+
+        if (list_empty(&active_timers)) {
+                val32 = readl(iotg->base + CI_OTGSC);
+                writel(val32 | OTGSC_1MSE, iotg->base + CI_OTGSC);
+        }
+
+        list_add_tail(&timer->list, &active_timers);
+}
+
+/* Remove timer from the timer list; clear timeout status */
+static void langwell_otg_del_timer(void *gtimer)
+{
+        struct langwell_otg *lnw = the_transceiver;
+        struct langwell_otg_timer *timer = (struct langwell_otg_timer *)gtimer;
+        struct langwell_otg_timer *tmp_timer, *del_tmp;
+        u32 val32;
+
+        list_for_each_entry_safe(tmp_timer, del_tmp, &active_timers, list)
+                if (tmp_timer == timer)
+                        list_del(&timer->list);
+
+        if (list_empty(&active_timers)) {
+                val32 = readl(lnw->iotg.base + CI_OTGSC);
+                writel(val32 & ~OTGSC_1MSE, lnw->iotg.base + CI_OTGSC);
+        }
+}
+
+/* Reduce timer count by 1, and find timeout conditions.*/
+static int langwell_otg_tick_timer(u32 *int_sts)
+{
+        struct langwell_otg     *lnw = the_transceiver;
+        struct langwell_otg_timer *tmp_timer, *del_tmp;
+        int expired = 0;
+
+        list_for_each_entry_safe(tmp_timer, del_tmp, &active_timers, list) {
+                tmp_timer->count--;
+                /* check if timer expires */
+                if (!tmp_timer->count) {
+                        list_del(&tmp_timer->list);
+                        tmp_timer->function(tmp_timer->data);
+                        expired = 1;
+                }
+        }
+
+        if (list_empty(&active_timers)) {
+                dev_dbg(lnw->dev, "tick timer: disable 1ms int\n");
+                *int_sts = *int_sts & ~OTGSC_1MSE;
+        }
+        return expired;
+}
+
+static void reset_otg(void)
+{
+        struct langwell_otg     *lnw = the_transceiver;
+        int                     delay_time = 1000;
+        u32                     val;
+
+        dev_dbg(lnw->dev, "reseting OTG controller ...\n");
+        val = readl(lnw->iotg.base + CI_USBCMD);
+        writel(val | USBCMD_RST, lnw->iotg.base + CI_USBCMD);
+        do {
+                udelay(100);
+                if (!delay_time--)
+                        dev_dbg(lnw->dev, "reset timeout\n");
+                val = readl(lnw->iotg.base + CI_USBCMD);
+                val &= USBCMD_RST;
+        } while (val != 0);
+        dev_dbg(lnw->dev, "reset done.\n");
+}
+
+static void set_host_mode(void)
+{
+        struct langwell_otg     *lnw = the_transceiver;
+        u32                     val;
+
+        reset_otg();
+        val = readl(lnw->iotg.base + CI_USBMODE);
+        val = (val & (~USBMODE_CM)) | USBMODE_HOST;
+        writel(val, lnw->iotg.base + CI_USBMODE);
+}
+
+static void set_client_mode(void)
+{
+        struct langwell_otg     *lnw = the_transceiver;
+        u32                     val;
+
+        reset_otg();
+        val = readl(lnw->iotg.base + CI_USBMODE);
+        val = (val & (~USBMODE_CM)) | USBMODE_DEVICE;
+        writel(val, lnw->iotg.base + CI_USBMODE);
+}
+
+static void init_hsm(void)
+{
+        struct langwell_otg             *lnw = the_transceiver;
+        struct intel_mid_otg_xceiv      *iotg = &lnw->iotg;
+        u32                             val32;
+
+        /* read OTGSC after reset */
+        val32 = readl(lnw->iotg.base + CI_OTGSC);
+        dev_dbg(lnw->dev, "%s: OTGSC init value = 0x%x\n", __func__, val32);
+
+        /* set init state */
+        if (val32 & OTGSC_ID) {
+                iotg->hsm.id = 1;
+                iotg->otg.default_a = 0;
+                set_client_mode();
+                iotg->otg.state = OTG_STATE_B_IDLE;
+        } else {
+                iotg->hsm.id = 0;
+                iotg->otg.default_a = 1;
+                set_host_mode();
+                iotg->otg.state = OTG_STATE_A_IDLE;
+        }
+
+        /* set session indicator */
+        if (val32 & OTGSC_BSE)
+                iotg->hsm.b_sess_end = 1;
+        if (val32 & OTGSC_BSV)
+                iotg->hsm.b_sess_vld = 1;
+        if (val32 & OTGSC_ASV)
+                iotg->hsm.a_sess_vld = 1;
+        if (val32 & OTGSC_AVV)
+                iotg->hsm.a_vbus_vld = 1;
+
+        /* defautly power the bus */
+        iotg->hsm.a_bus_req = 1;
+        iotg->hsm.a_bus_drop = 0;
+        /* defautly don't request bus as B device */
+        iotg->hsm.b_bus_req = 0;
+        /* no system error */
+        iotg->hsm.a_clr_err = 0;
+
+        langwell_otg_phy_low_power_wait(1);
+}
+
+static void update_hsm(void)
+{
+        struct langwell_otg             *lnw = the_transceiver;
+        struct intel_mid_otg_xceiv      *iotg = &lnw->iotg;
+        u32                             val32;
+
+        /* read OTGSC */
+        val32 = readl(lnw->iotg.base + CI_OTGSC);
+        dev_dbg(lnw->dev, "%s: OTGSC value = 0x%x\n", __func__, val32);
+
+        iotg->hsm.id = !!(val32 & OTGSC_ID);
+        iotg->hsm.b_sess_end = !!(val32 & OTGSC_BSE);
+        iotg->hsm.b_sess_vld = !!(val32 & OTGSC_BSV);
+        iotg->hsm.a_sess_vld = !!(val32 & OTGSC_ASV);
+        iotg->hsm.a_vbus_vld = !!(val32 & OTGSC_AVV);
+}
+
+static irqreturn_t otg_dummy_irq(int irq, void *_dev)
+{
+        struct langwell_otg     *lnw = the_transceiver;
+        void __iomem            *reg_base = _dev;
+        u32                     val;
+        u32                     int_mask = 0;
+
+        val = readl(reg_base + CI_USBMODE);
+        if ((val & USBMODE_CM) != USBMODE_DEVICE)
+                return IRQ_NONE;
+
+        val = readl(reg_base + CI_USBSTS);
+        int_mask = val & INTR_DUMMY_MASK;
+
+        if (int_mask == 0)
+                return IRQ_NONE;
+
+        /* clear hsm.b_conn here since host driver can't detect it
+        *  otg_dummy_irq called means B-disconnect happened.
+        */
+        if (lnw->iotg.hsm.b_conn) {
+                lnw->iotg.hsm.b_conn = 0;
+                if (spin_trylock(&lnw->wq_lock)) {
+                        langwell_update_transceiver();
+                        spin_unlock(&lnw->wq_lock);
+                }
+        }
+
+        /* Clear interrupts */
+        writel(int_mask, reg_base + CI_USBSTS);
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t otg_irq(int irq, void *_dev)
+{
+        struct langwell_otg             *lnw = _dev;
+        struct intel_mid_otg_xceiv      *iotg = &lnw->iotg;
+        u32                             int_sts, int_en;
+        u32                             int_mask = 0;
+        int                             flag = 0;
+
+        int_sts = readl(lnw->iotg.base + CI_OTGSC);
+        int_en = (int_sts & OTGSC_INTEN_MASK) >> 8;
+        int_mask = int_sts & int_en;
+        if (int_mask == 0)
+                return IRQ_NONE;
+
+        if (int_mask & OTGSC_IDIS) {
+                dev_dbg(lnw->dev, "%s: id change int\n", __func__);
+                iotg->hsm.id = (int_sts & OTGSC_ID) ? 1 : 0;
+                dev_dbg(lnw->dev, "id = %d\n", iotg->hsm.id);
+                flag = 1;
+        }
+        if (int_mask & OTGSC_DPIS) {
+                dev_dbg(lnw->dev, "%s: data pulse int\n", __func__);
+                iotg->hsm.a_srp_det = (int_sts & OTGSC_DPS) ? 1 : 0;
+                dev_dbg(lnw->dev, "data pulse = %d\n", iotg->hsm.a_srp_det);
+                flag = 1;
+        }
+        if (int_mask & OTGSC_BSEIS) {
+                dev_dbg(lnw->dev, "%s: b session end int\n", __func__);
+                iotg->hsm.b_sess_end = (int_sts & OTGSC_BSE) ? 1 : 0;
+                dev_dbg(lnw->dev, "b_sess_end = %d\n", iotg->hsm.b_sess_end);
+                flag = 1;
+        }
+        if (int_mask & OTGSC_BSVIS) {
+                dev_dbg(lnw->dev, "%s: b session valid int\n", __func__);
+                iotg->hsm.b_sess_vld = (int_sts & OTGSC_BSV) ? 1 : 0;
+                dev_dbg(lnw->dev, "b_sess_vld = %d\n", iotg->hsm.b_sess_end);
+                flag = 1;
+        }
+        if (int_mask & OTGSC_ASVIS) {
+                dev_dbg(lnw->dev, "%s: a session valid int\n", __func__);
+                iotg->hsm.a_sess_vld = (int_sts & OTGSC_ASV) ? 1 : 0;
+                dev_dbg(lnw->dev, "a_sess_vld = %d\n", iotg->hsm.a_sess_vld);
+                flag = 1;
+        }
+        if (int_mask & OTGSC_AVVIS) {
+                dev_dbg(lnw->dev, "%s: a vbus valid int\n", __func__);
+                iotg->hsm.a_vbus_vld = (int_sts & OTGSC_AVV) ? 1 : 0;
+                dev_dbg(lnw->dev, "a_vbus_vld = %d\n", iotg->hsm.a_vbus_vld);
+                flag = 1;
+        }
+
+        if (int_mask & OTGSC_1MSS) {
+                /* need to schedule otg_work if any timer is expired */
+                if (langwell_otg_tick_timer(&int_sts))
+                        flag = 1;
+        }
+
+        writel((int_sts & ~OTGSC_INTSTS_MASK) | int_mask,
+                                        lnw->iotg.base + CI_OTGSC);
+        if (flag)
+                langwell_update_transceiver();
+
+        return IRQ_HANDLED;
+}
+
+static int langwell_otg_iotg_notify(struct notifier_block *nb,
+                                unsigned long action, void *data)
+{
+        struct langwell_otg             *lnw = the_transceiver;
+        struct intel_mid_otg_xceiv      *iotg = data;
+        int                             flag = 0;
+
+        if (iotg == NULL)
+                return NOTIFY_BAD;
+
+        if (lnw == NULL)
+                return NOTIFY_BAD;
+
+        switch (action) {
+        case MID_OTG_NOTIFY_CONNECT:
+                dev_dbg(lnw->dev, "Lnw OTG Notify Connect Event\n");
+                if (iotg->otg.default_a == 1)
+                        iotg->hsm.b_conn = 1;
+                else
+                        iotg->hsm.a_conn = 1;
+                flag = 1;
+                break;
+        case MID_OTG_NOTIFY_DISCONN:
+                dev_dbg(lnw->dev, "Lnw OTG Notify Disconnect Event\n");
+                if (iotg->otg.default_a == 1)
+                        iotg->hsm.b_conn = 0;
+                else
+                        iotg->hsm.a_conn = 0;
+                flag = 1;
+                break;
+        case MID_OTG_NOTIFY_HSUSPEND:
+                dev_dbg(lnw->dev, "Lnw OTG Notify Host Bus suspend Event\n");
+                if (iotg->otg.default_a == 1)
+                        iotg->hsm.a_suspend_req = 1;
+                else
+                        iotg->hsm.b_bus_req = 0;
+                flag = 1;
+                break;
+        case MID_OTG_NOTIFY_HRESUME:
+                dev_dbg(lnw->dev, "Lnw OTG Notify Host Bus resume Event\n");
+                if (iotg->otg.default_a == 1)
+                        iotg->hsm.b_bus_resume = 1;
+                flag = 1;
+                break;
+        case MID_OTG_NOTIFY_CSUSPEND:
+                dev_dbg(lnw->dev, "Lnw OTG Notify Client Bus suspend Event\n");
+                if (iotg->otg.default_a == 1) {
+                        if (iotg->hsm.b_bus_suspend_vld == 2) {
+                                iotg->hsm.b_bus_suspend = 1;
+                                iotg->hsm.b_bus_suspend_vld = 0;
+                                flag = 1;
+                        } else {
+                                iotg->hsm.b_bus_suspend_vld++;
+                                flag = 0;
+                        }
+                } else {
+                        if (iotg->hsm.a_bus_suspend == 0) {
+                                iotg->hsm.a_bus_suspend = 1;
+                                flag = 1;
+                        }
+                }
+                break;
+        case MID_OTG_NOTIFY_CRESUME:
+                dev_dbg(lnw->dev, "Lnw OTG Notify Client Bus resume Event\n");
+                if (iotg->otg.default_a == 0)
+                        iotg->hsm.a_bus_suspend = 0;
+                flag = 0;
+                break;
+        case MID_OTG_NOTIFY_HOSTADD:
+                dev_dbg(lnw->dev, "Lnw OTG Nofity Host Driver Add\n");
+                flag = 1;
+                break;
+        case MID_OTG_NOTIFY_HOSTREMOVE:
+                dev_dbg(lnw->dev, "Lnw OTG Nofity Host Driver remove\n");
+                flag = 1;
+                break;
+        case MID_OTG_NOTIFY_CLIENTADD:
+                dev_dbg(lnw->dev, "Lnw OTG Nofity Client Driver Add\n");
+                flag = 1;
+                break;
+        case MID_OTG_NOTIFY_CLIENTREMOVE:
+                dev_dbg(lnw->dev, "Lnw OTG Nofity Client Driver remove\n");
+                flag = 1;
+                break;
+        default:
+                dev_dbg(lnw->dev, "Lnw OTG Nofity unknown notify message\n");
+                return NOTIFY_DONE;
+        }
+
+        if (flag)
+                langwell_update_transceiver();
+
+        return NOTIFY_OK;
+}
+
+static void langwell_otg_work(struct work_struct *work)
+{
+        struct langwell_otg             *lnw;
+        struct intel_mid_otg_xceiv      *iotg;
+        int                             retval;
+        struct pci_dev                  *pdev;
+
+        lnw = container_of(work, struct langwell_otg, work);
+        iotg = &lnw->iotg;
+        pdev = to_pci_dev(lnw->dev);
+
+        dev_dbg(lnw->dev, "%s: old state = %s\n", __func__,
+                        otg_state_string(iotg->otg.state));
+
+        switch (iotg->otg.state) {
+        case OTG_STATE_UNDEFINED:
+        case OTG_STATE_B_IDLE:
+                if (!iotg->hsm.id) {
+                        langwell_otg_del_timer(b_srp_init_tmr);
+                        del_timer_sync(&lnw->hsm_timer);
+
+                        iotg->otg.default_a = 1;
+                        iotg->hsm.a_srp_det = 0;
+
+                        langwell_otg_chrg_vbus(0);
+                        set_host_mode();
+                        langwell_otg_phy_low_power(1);
+
+                        iotg->otg.state = OTG_STATE_A_IDLE;
+                        langwell_update_transceiver();
+                } else if (iotg->hsm.b_sess_vld) {
+                        langwell_otg_del_timer(b_srp_init_tmr);
+                        del_timer_sync(&lnw->hsm_timer);
+                        iotg->hsm.b_sess_end = 0;
+                        iotg->hsm.a_bus_suspend = 0;
+                        langwell_otg_chrg_vbus(0);
+
+                        if (lnw->iotg.start_peripheral) {
+                                lnw->iotg.start_peripheral(&lnw->iotg);
+                                iotg->otg.state = OTG_STATE_B_PERIPHERAL;
+                        } else
+                                dev_dbg(lnw->dev, "client driver not loaded\n");
+
+                } else if (iotg->hsm.b_srp_init_tmout) {
+                        iotg->hsm.b_srp_init_tmout = 0;
+                        dev_warn(lnw->dev, "SRP init timeout\n");
+                } else if (iotg->hsm.b_srp_fail_tmout) {
+                        iotg->hsm.b_srp_fail_tmout = 0;
+                        iotg->hsm.b_bus_req = 0;
+
+                        /* No silence failure */
+                        langwell_otg_nsf_msg(6);
+                } else if (iotg->hsm.b_bus_req && iotg->hsm.b_sess_end) {
+                        del_timer_sync(&lnw->hsm_timer);
+                        /* workaround for b_se0_srp detection */
+                        retval = langwell_otg_check_se0_srp(0);
+                        if (retval) {
+                                iotg->hsm.b_bus_req = 0;
+                                dev_dbg(lnw->dev, "LS isn't SE0, try later\n");
+                        } else {
+                                /* clear the PHCD before start srp */
+                                langwell_otg_phy_low_power(0);
+
+                                /* Start SRP */
+                                langwell_otg_add_timer(b_srp_init_tmr);
+                                iotg->otg.start_srp(&iotg->otg);
+                                langwell_otg_del_timer(b_srp_init_tmr);
+                                langwell_otg_add_ktimer(TB_SRP_FAIL_TMR);
+
+                                /* reset PHY low power mode here */
+                                langwell_otg_phy_low_power_wait(1);
+                        }
+                }
+                break;
+        case OTG_STATE_B_SRP_INIT:
+                if (!iotg->hsm.id) {
+                        iotg->otg.default_a = 1;
+                        iotg->hsm.a_srp_det = 0;
+
+                        /* Turn off VBus */
+                        iotg->otg.set_vbus(&iotg->otg, false);
+                        langwell_otg_chrg_vbus(0);
+                        set_host_mode();
+                        langwell_otg_phy_low_power(1);
+                        iotg->otg.state = OTG_STATE_A_IDLE;
+                        langwell_update_transceiver();
+                } else if (iotg->hsm.b_sess_vld) {
+                        langwell_otg_chrg_vbus(0);
+                        if (lnw->iotg.start_peripheral) {
+                                lnw->iotg.start_peripheral(&lnw->iotg);
+                                iotg->otg.state = OTG_STATE_B_PERIPHERAL;
+                        } else
+                                dev_dbg(lnw->dev, "client driver not loaded\n");
+                }
+                break;
+        case OTG_STATE_B_PERIPHERAL:
+                if (!iotg->hsm.id) {
+                        iotg->otg.default_a = 1;
+                        iotg->hsm.a_srp_det = 0;
+
+                        langwell_otg_chrg_vbus(0);
+
+                        if (lnw->iotg.stop_peripheral)
+                                lnw->iotg.stop_peripheral(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "client driver has been removed.\n");
+
+                        set_host_mode();
+                        langwell_otg_phy_low_power(1);
+                        iotg->otg.state = OTG_STATE_A_IDLE;
+                        langwell_update_transceiver();
+                } else if (!iotg->hsm.b_sess_vld) {
+                        iotg->hsm.b_hnp_enable = 0;
+
+                        if (lnw->iotg.stop_peripheral)
+                                lnw->iotg.stop_peripheral(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "client driver has been removed.\n");
+
+                        iotg->otg.state = OTG_STATE_B_IDLE;
+                } else if (iotg->hsm.b_bus_req && iotg->otg.gadget &&
+                                        iotg->otg.gadget->b_hnp_enable &&
+                                        iotg->hsm.a_bus_suspend) {
+
+                        if (lnw->iotg.stop_peripheral)
+                                lnw->iotg.stop_peripheral(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "client driver has been removed.\n");
+
+                        langwell_otg_HAAR(1);
+                        iotg->hsm.a_conn = 0;
+
+                        if (lnw->iotg.start_host) {
+                                lnw->iotg.start_host(&lnw->iotg);
+                                iotg->otg.state = OTG_STATE_B_WAIT_ACON;
+                        } else
+                                dev_dbg(lnw->dev,
+                                                "host driver not loaded.\n");
+
+                        iotg->hsm.a_bus_resume = 0;
+                        langwell_otg_add_ktimer(TB_ASE0_BRST_TMR);
+                }
+                break;
+
+        case OTG_STATE_B_WAIT_ACON:
+                if (!iotg->hsm.id) {
+                        /* delete hsm timer for b_ase0_brst_tmr */
+                        del_timer_sync(&lnw->hsm_timer);
+
+                        iotg->otg.default_a = 1;
+                        iotg->hsm.a_srp_det = 0;
+
+                        langwell_otg_chrg_vbus(0);
+
+                        langwell_otg_HAAR(0);
+                        if (lnw->iotg.stop_host)
+                                lnw->iotg.stop_host(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "host driver has been removed.\n");
+
+                        set_host_mode();
+                        langwell_otg_phy_low_power(1);
+                        iotg->otg.state = OTG_STATE_A_IDLE;
+                        langwell_update_transceiver();
+                } else if (!iotg->hsm.b_sess_vld) {
+                        /* delete hsm timer for b_ase0_brst_tmr */
+                        del_timer_sync(&lnw->hsm_timer);
+
+                        iotg->hsm.b_hnp_enable = 0;
+                        iotg->hsm.b_bus_req = 0;
+
+                        langwell_otg_chrg_vbus(0);
+                        langwell_otg_HAAR(0);
+
+                        if (lnw->iotg.stop_host)
+                                lnw->iotg.stop_host(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "host driver has been removed.\n");
+
+                        set_client_mode();
+                        langwell_otg_phy_low_power(1);
+                        iotg->otg.state = OTG_STATE_B_IDLE;
+                } else if (iotg->hsm.a_conn) {
+                        /* delete hsm timer for b_ase0_brst_tmr */
+                        del_timer_sync(&lnw->hsm_timer);
+
+                        langwell_otg_HAAR(0);
+                        iotg->otg.state = OTG_STATE_B_HOST;
+                        langwell_update_transceiver();
+                } else if (iotg->hsm.a_bus_resume ||
+                                iotg->hsm.b_ase0_brst_tmout) {
+                        /* delete hsm timer for b_ase0_brst_tmr */
+                        del_timer_sync(&lnw->hsm_timer);
+
+                        langwell_otg_HAAR(0);
+                        langwell_otg_nsf_msg(7);
+
+                        if (lnw->iotg.stop_host)
+                                lnw->iotg.stop_host(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "host driver has been removed.\n");
+
+                        iotg->hsm.a_bus_suspend = 0;
+                        iotg->hsm.b_bus_req = 0;
+
+                        if (lnw->iotg.start_peripheral)
+                                lnw->iotg.start_peripheral(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "client driver not loaded.\n");
+
+                        iotg->otg.state = OTG_STATE_B_PERIPHERAL;
+                }
+                break;
+
+        case OTG_STATE_B_HOST:
+                if (!iotg->hsm.id) {
+                        iotg->otg.default_a = 1;
+                        iotg->hsm.a_srp_det = 0;
+
+                        langwell_otg_chrg_vbus(0);
+
+                        if (lnw->iotg.stop_host)
+                                lnw->iotg.stop_host(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "host driver has been removed.\n");
+
+                        set_host_mode();
+                        langwell_otg_phy_low_power(1);
+                        iotg->otg.state = OTG_STATE_A_IDLE;
+                        langwell_update_transceiver();
+                } else if (!iotg->hsm.b_sess_vld) {
+                        iotg->hsm.b_hnp_enable = 0;
+                        iotg->hsm.b_bus_req = 0;
+
+                        langwell_otg_chrg_vbus(0);
+                        if (lnw->iotg.stop_host)
+                                lnw->iotg.stop_host(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "host driver has been removed.\n");
+
+                        set_client_mode();
+                        langwell_otg_phy_low_power(1);
+                        iotg->otg.state = OTG_STATE_B_IDLE;
+                } else if ((!iotg->hsm.b_bus_req) ||
+                                (!iotg->hsm.a_conn)) {
+                        iotg->hsm.b_bus_req = 0;
+                        langwell_otg_loc_sof(0);
+
+                        if (lnw->iotg.stop_host)
+                                lnw->iotg.stop_host(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "host driver has been removed.\n");
+
+                        iotg->hsm.a_bus_suspend = 0;
+
+                        if (lnw->iotg.start_peripheral)
+                                lnw->iotg.start_peripheral(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                                "client driver not loaded.\n");
+
+                        iotg->otg.state = OTG_STATE_B_PERIPHERAL;
+                }
+                break;
+
+        case OTG_STATE_A_IDLE:
+                iotg->otg.default_a = 1;
+                if (iotg->hsm.id) {
+                        iotg->otg.default_a = 0;
+                        iotg->hsm.b_bus_req = 0;
+                        iotg->hsm.vbus_srp_up = 0;
+
+                        langwell_otg_chrg_vbus(0);
+                        set_client_mode();
+                        langwell_otg_phy_low_power(1);
+                        iotg->otg.state = OTG_STATE_B_IDLE;
+                        langwell_update_transceiver();
+                } else if (!iotg->hsm.a_bus_drop &&
+                        (iotg->hsm.a_srp_det || iotg->hsm.a_bus_req)) {
+                        langwell_otg_phy_low_power(0);
+
+                        /* Turn on VBus */
+                        iotg->otg.set_vbus(&iotg->otg, true);
+
+                        iotg->hsm.vbus_srp_up = 0;
+                        iotg->hsm.a_wait_vrise_tmout = 0;
+                        langwell_otg_add_timer(a_wait_vrise_tmr);
+                        iotg->otg.state = OTG_STATE_A_WAIT_VRISE;
+                        langwell_update_transceiver();
+                } else if (!iotg->hsm.a_bus_drop && iotg->hsm.a_sess_vld) {
+                        iotg->hsm.vbus_srp_up = 1;
+                } else if (!iotg->hsm.a_sess_vld && iotg->hsm.vbus_srp_up) {
+                        msleep(10);
+                        langwell_otg_phy_low_power(0);
+
+                        /* Turn on VBus */
+                        iotg->otg.set_vbus(&iotg->otg, true);
+                        iotg->hsm.a_srp_det = 1;
+                        iotg->hsm.vbus_srp_up = 0;
+                        iotg->hsm.a_wait_vrise_tmout = 0;
+                        langwell_otg_add_timer(a_wait_vrise_tmr);
+                        iotg->otg.state = OTG_STATE_A_WAIT_VRISE;
+                        langwell_update_transceiver();
+                } else if (!iotg->hsm.a_sess_vld &&
+                                !iotg->hsm.vbus_srp_up) {
+                        langwell_otg_phy_low_power(1);
+                }
+                break;
+        case OTG_STATE_A_WAIT_VRISE:
+                if (iotg->hsm.id) {
+                        langwell_otg_del_timer(a_wait_vrise_tmr);
+                        iotg->hsm.b_bus_req = 0;
+                        iotg->otg.default_a = 0;
+
+                        /* Turn off VBus */
+                        iotg->otg.set_vbus(&iotg->otg, false);
+                        set_client_mode();
+                        langwell_otg_phy_low_power_wait(1);
+                        iotg->otg.state = OTG_STATE_B_IDLE;
+                } else if (iotg->hsm.a_vbus_vld) {
+                        langwell_otg_del_timer(a_wait_vrise_tmr);
+                        iotg->hsm.b_conn = 0;
+                        if (lnw->iotg.start_host)
+                                lnw->iotg.start_host(&lnw->iotg);
+                        else {
+                                dev_dbg(lnw->dev, "host driver not loaded.\n");
+                                break;
+                        }
+
+                        langwell_otg_add_ktimer(TA_WAIT_BCON_TMR);
+                        iotg->otg.state = OTG_STATE_A_WAIT_BCON;
+                } else if (iotg->hsm.a_wait_vrise_tmout) {
+                        iotg->hsm.b_conn = 0;
+                        if (iotg->hsm.a_vbus_vld) {
+                                if (lnw->iotg.start_host)
+                                        lnw->iotg.start_host(&lnw->iotg);
+                                else {
+                                        dev_dbg(lnw->dev,
+                                                "host driver not loaded.\n");
+                                        break;
+                                }
+                                langwell_otg_add_ktimer(TA_WAIT_BCON_TMR);
+                                iotg->otg.state = OTG_STATE_A_WAIT_BCON;
+                        } else {
+
+                                /* Turn off VBus */
+                                iotg->otg.set_vbus(&iotg->otg, false);
+                                langwell_otg_phy_low_power_wait(1);
+                                iotg->otg.state = OTG_STATE_A_VBUS_ERR;
+                        }
+                }
+                break;
+        case OTG_STATE_A_WAIT_BCON:
+                if (iotg->hsm.id) {
+                        /* delete hsm timer for a_wait_bcon_tmr */
+                        del_timer_sync(&lnw->hsm_timer);
+
+                        iotg->otg.default_a = 0;
+                        iotg->hsm.b_bus_req = 0;
+
+                        if (lnw->iotg.stop_host)
+                                lnw->iotg.stop_host(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "host driver has been removed.\n");
+
+                        /* Turn off VBus */
+                        iotg->otg.set_vbus(&iotg->otg, false);
+                        set_client_mode();
+                        langwell_otg_phy_low_power_wait(1);
+                        iotg->otg.state = OTG_STATE_B_IDLE;
+                        langwell_update_transceiver();
+                } else if (!iotg->hsm.a_vbus_vld) {
+                        /* delete hsm timer for a_wait_bcon_tmr */
+                        del_timer_sync(&lnw->hsm_timer);
+
+                        if (lnw->iotg.stop_host)
+                                lnw->iotg.stop_host(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "host driver has been removed.\n");
+
+                        /* Turn off VBus */
+                        iotg->otg.set_vbus(&iotg->otg, false);
+                        langwell_otg_phy_low_power_wait(1);
+                        iotg->otg.state = OTG_STATE_A_VBUS_ERR;
+                } else if (iotg->hsm.a_bus_drop ||
+                                (iotg->hsm.a_wait_bcon_tmout &&
+                                !iotg->hsm.a_bus_req)) {
+                        /* delete hsm timer for a_wait_bcon_tmr */
+                        del_timer_sync(&lnw->hsm_timer);
+
+                        if (lnw->iotg.stop_host)
+                                lnw->iotg.stop_host(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "host driver has been removed.\n");
+
+                        /* Turn off VBus */
+                        iotg->otg.set_vbus(&iotg->otg, false);
+                        iotg->otg.state = OTG_STATE_A_WAIT_VFALL;
+                } else if (iotg->hsm.b_conn) {
+                        /* delete hsm timer for a_wait_bcon_tmr */
+                        del_timer_sync(&lnw->hsm_timer);
+
+                        iotg->hsm.a_suspend_req = 0;
+                        iotg->otg.state = OTG_STATE_A_HOST;
+                        if (iotg->hsm.a_srp_det && iotg->otg.host &&
+                                        !iotg->otg.host->b_hnp_enable) {
+                                /* SRP capable peripheral-only device */
+                                iotg->hsm.a_bus_req = 1;
+                                iotg->hsm.a_srp_det = 0;
+                        } else if (!iotg->hsm.a_bus_req && iotg->otg.host &&
+                                        iotg->otg.host->b_hnp_enable) {
+                                /* It is not safe enough to do a fast
+                                 * transition from A_WAIT_BCON to
+                                 * A_SUSPEND */
+                                msleep(10000);
+                                if (iotg->hsm.a_bus_req)
+                                        break;
+
+                                if (request_irq(pdev->irq,
+                                        otg_dummy_irq, IRQF_SHARED,
+                                        driver_name, iotg->base) != 0) {
+                                        dev_dbg(lnw->dev,
+                                                "request interrupt %d fail\n",
+                                                pdev->irq);
+                                }
+
+                                langwell_otg_HABA(1);
+                                iotg->hsm.b_bus_resume = 0;
+                                iotg->hsm.a_aidl_bdis_tmout = 0;
+
+                                langwell_otg_loc_sof(0);
+                                /* clear PHCD to enable HW timer */
+                                langwell_otg_phy_low_power(0);
+                                langwell_otg_add_timer(a_aidl_bdis_tmr);
+                                iotg->otg.state = OTG_STATE_A_SUSPEND;
+                        } else if (!iotg->hsm.a_bus_req && iotg->otg.host &&
+                                !iotg->otg.host->b_hnp_enable) {
+                                if (lnw->iotg.stop_host)
+                                        lnw->iotg.stop_host(&lnw->iotg);
+                                else
+                                        dev_dbg(lnw->dev,
+                                                "host driver removed.\n");
+
+                                /* Turn off VBus */
+                                iotg->otg.set_vbus(&iotg->otg, false);
+                                iotg->otg.state = OTG_STATE_A_WAIT_VFALL;
+                        }
+                }
+                break;
+        case OTG_STATE_A_HOST:
+                if (iotg->hsm.id) {
+                        iotg->otg.default_a = 0;
+                        iotg->hsm.b_bus_req = 0;
+
+                        if (lnw->iotg.stop_host)
+                                lnw->iotg.stop_host(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "host driver has been removed.\n");
+
+                        /* Turn off VBus */
+                        iotg->otg.set_vbus(&iotg->otg, false);
+                        set_client_mode();
+                        langwell_otg_phy_low_power_wait(1);
+                        iotg->otg.state = OTG_STATE_B_IDLE;
+                        langwell_update_transceiver();
+                } else if (iotg->hsm.a_bus_drop ||
+                                (iotg->otg.host &&
+                                !iotg->otg.host->b_hnp_enable &&
+                                        !iotg->hsm.a_bus_req)) {
+                        if (lnw->iotg.stop_host)
+                                lnw->iotg.stop_host(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "host driver has been removed.\n");
+
+                        /* Turn off VBus */
+                        iotg->otg.set_vbus(&iotg->otg, false);
+                        iotg->otg.state = OTG_STATE_A_WAIT_VFALL;
+                } else if (!iotg->hsm.a_vbus_vld) {
+                        if (lnw->iotg.stop_host)
+                                lnw->iotg.stop_host(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "host driver has been removed.\n");
+
+                        /* Turn off VBus */
+                        iotg->otg.set_vbus(&iotg->otg, false);
+                        langwell_otg_phy_low_power_wait(1);
+                        iotg->otg.state = OTG_STATE_A_VBUS_ERR;
+                } else if (iotg->otg.host &&
+                                iotg->otg.host->b_hnp_enable &&
+                                !iotg->hsm.a_bus_req) {
+                        /* Set HABA to enable hardware assistance to signal
+                         *  A-connect after receiver B-disconnect. Hardware
+                         *  will then set client mode and enable URE, SLE and
+                         *  PCE after the assistance. otg_dummy_irq is used to
+                         *  clean these ints when client driver is not resumed.
+                         */
+                        if (request_irq(pdev->irq, otg_dummy_irq, IRQF_SHARED,
+                                        driver_name, iotg->base) != 0) {
+                                dev_dbg(lnw->dev,
+                                        "request interrupt %d failed\n",
+                                                pdev->irq);
+                        }
+
+                        /* set HABA */
+                        langwell_otg_HABA(1);
+                        iotg->hsm.b_bus_resume = 0;
+                        iotg->hsm.a_aidl_bdis_tmout = 0;
+                        langwell_otg_loc_sof(0);
+                        /* clear PHCD to enable HW timer */
+                        langwell_otg_phy_low_power(0);
+                        langwell_otg_add_timer(a_aidl_bdis_tmr);
+                        iotg->otg.state = OTG_STATE_A_SUSPEND;
+                } else if (!iotg->hsm.b_conn || !iotg->hsm.a_bus_req) {
+                        langwell_otg_add_ktimer(TA_WAIT_BCON_TMR);
+                        iotg->otg.state = OTG_STATE_A_WAIT_BCON;
+                }
+                break;
+        case OTG_STATE_A_SUSPEND:
+                if (iotg->hsm.id) {
+                        langwell_otg_del_timer(a_aidl_bdis_tmr);
+                        langwell_otg_HABA(0);
+                        free_irq(pdev->irq, iotg->base);
+                        iotg->otg.default_a = 0;
+                        iotg->hsm.b_bus_req = 0;
+
+                        if (lnw->iotg.stop_host)
+                                lnw->iotg.stop_host(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "host driver has been removed.\n");
+
+                        /* Turn off VBus */
+                        iotg->otg.set_vbus(&iotg->otg, false);
+                        set_client_mode();
+                        langwell_otg_phy_low_power(1);
+                        iotg->otg.state = OTG_STATE_B_IDLE;
+                        langwell_update_transceiver();
+                } else if (iotg->hsm.a_bus_req ||
+                                iotg->hsm.b_bus_resume) {
+                        langwell_otg_del_timer(a_aidl_bdis_tmr);
+                        langwell_otg_HABA(0);
+                        free_irq(pdev->irq, iotg->base);
+                        iotg->hsm.a_suspend_req = 0;
+                        langwell_otg_loc_sof(1);
+                        iotg->otg.state = OTG_STATE_A_HOST;
+                } else if (iotg->hsm.a_aidl_bdis_tmout ||
+                                iotg->hsm.a_bus_drop) {
+                        langwell_otg_del_timer(a_aidl_bdis_tmr);
+                        langwell_otg_HABA(0);
+                        free_irq(pdev->irq, iotg->base);
+                        if (lnw->iotg.stop_host)
+                                lnw->iotg.stop_host(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "host driver has been removed.\n");
+
+                        /* Turn off VBus */
+                        iotg->otg.set_vbus(&iotg->otg, false);
+                        iotg->otg.state = OTG_STATE_A_WAIT_VFALL;
+                } else if (!iotg->hsm.b_conn && iotg->otg.host &&
+                                iotg->otg.host->b_hnp_enable) {
+                        langwell_otg_del_timer(a_aidl_bdis_tmr);
+                        langwell_otg_HABA(0);
+                        free_irq(pdev->irq, iotg->base);
+
+                        if (lnw->iotg.stop_host)
+                                lnw->iotg.stop_host(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "host driver has been removed.\n");
+
+                        iotg->hsm.b_bus_suspend = 0;
+                        iotg->hsm.b_bus_suspend_vld = 0;
+
+                        /* msleep(200); */
+                        if (lnw->iotg.start_peripheral)
+                                lnw->iotg.start_peripheral(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "client driver not loaded.\n");
+
+                        langwell_otg_add_ktimer(TB_BUS_SUSPEND_TMR);
+                        iotg->otg.state = OTG_STATE_A_PERIPHERAL;
+                        break;
+                } else if (!iotg->hsm.a_vbus_vld) {
+                        langwell_otg_del_timer(a_aidl_bdis_tmr);
+                        langwell_otg_HABA(0);
+                        free_irq(pdev->irq, iotg->base);
+                        if (lnw->iotg.stop_host)
+                                lnw->iotg.stop_host(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "host driver has been removed.\n");
+
+                        /* Turn off VBus */
+                        iotg->otg.set_vbus(&iotg->otg, false);
+                        langwell_otg_phy_low_power_wait(1);
+                        iotg->otg.state = OTG_STATE_A_VBUS_ERR;
+                }
+                break;
+        case OTG_STATE_A_PERIPHERAL:
+                if (iotg->hsm.id) {
+                        /* delete hsm timer for b_bus_suspend_tmr */
+                        del_timer_sync(&lnw->hsm_timer);
+                        iotg->otg.default_a = 0;
+                        iotg->hsm.b_bus_req = 0;
+                        if (lnw->iotg.stop_peripheral)
+                                lnw->iotg.stop_peripheral(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "client driver has been removed.\n");
+
+                        /* Turn off VBus */
+                        iotg->otg.set_vbus(&iotg->otg, false);
+                        set_client_mode();
+                        langwell_otg_phy_low_power_wait(1);
+                        iotg->otg.state = OTG_STATE_B_IDLE;
+                        langwell_update_transceiver();
+                } else if (!iotg->hsm.a_vbus_vld) {
+                        /* delete hsm timer for b_bus_suspend_tmr */
+                        del_timer_sync(&lnw->hsm_timer);
+
+                        if (lnw->iotg.stop_peripheral)
+                                lnw->iotg.stop_peripheral(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "client driver has been removed.\n");
+
+                        /* Turn off VBus */
+                        iotg->otg.set_vbus(&iotg->otg, false);
+                        langwell_otg_phy_low_power_wait(1);
+                        iotg->otg.state = OTG_STATE_A_VBUS_ERR;
+                } else if (iotg->hsm.a_bus_drop) {
+                        /* delete hsm timer for b_bus_suspend_tmr */
+                        del_timer_sync(&lnw->hsm_timer);
+
+                        if (lnw->iotg.stop_peripheral)
+                                lnw->iotg.stop_peripheral(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "client driver has been removed.\n");
+
+                        /* Turn off VBus */
+                        iotg->otg.set_vbus(&iotg->otg, false);
+                        iotg->otg.state = OTG_STATE_A_WAIT_VFALL;
+                } else if (iotg->hsm.b_bus_suspend) {
+                        /* delete hsm timer for b_bus_suspend_tmr */
+                        del_timer_sync(&lnw->hsm_timer);
+
+                        if (lnw->iotg.stop_peripheral)
+                                lnw->iotg.stop_peripheral(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "client driver has been removed.\n");
+
+                        if (lnw->iotg.start_host)
+                                lnw->iotg.start_host(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                                "host driver not loaded.\n");
+                        langwell_otg_add_ktimer(TA_WAIT_BCON_TMR);
+                        iotg->otg.state = OTG_STATE_A_WAIT_BCON;
+                } else if (iotg->hsm.b_bus_suspend_tmout) {
+                        u32     val;
+                        val = readl(lnw->iotg.base + CI_PORTSC1);
+                        if (!(val & PORTSC_SUSP))
+                                break;
+
+                        if (lnw->iotg.stop_peripheral)
+                                lnw->iotg.stop_peripheral(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                        "client driver has been removed.\n");
+
+                        if (lnw->iotg.start_host)
+                                lnw->iotg.start_host(&lnw->iotg);
+                        else
+                                dev_dbg(lnw->dev,
+                                                "host driver not loaded.\n");
+                        langwell_otg_add_ktimer(TA_WAIT_BCON_TMR);
+                        iotg->otg.state = OTG_STATE_A_WAIT_BCON;
+                }
+                break;
+        case OTG_STATE_A_VBUS_ERR:
+                if (iotg->hsm.id) {
+                        iotg->otg.default_a = 0;
+                        iotg->hsm.a_clr_err = 0;
+                        iotg->hsm.a_srp_det = 0;
+                        set_client_mode();
+                        langwell_otg_phy_low_power(1);
+                        iotg->otg.state = OTG_STATE_B_IDLE;
+                        langwell_update_transceiver();
+                } else if (iotg->hsm.a_clr_err) {
+                        iotg->hsm.a_clr_err = 0;
+                        iotg->hsm.a_srp_det = 0;
+                        reset_otg();
+                        init_hsm();
+                        if (iotg->otg.state == OTG_STATE_A_IDLE)
+                                langwell_update_transceiver();
+                } else {
+                        /* FW will clear PHCD bit when any VBus
+                         * event detected. Reset PHCD to 1 again */
+                        langwell_otg_phy_low_power(1);
+                }
+                break;
+        case OTG_STATE_A_WAIT_VFALL:
+                if (iotg->hsm.id) {
+                        iotg->otg.default_a = 0;
+                        set_client_mode();
+                        langwell_otg_phy_low_power(1);
+                        iotg->otg.state = OTG_STATE_B_IDLE;
+                        langwell_update_transceiver();
+                } else if (iotg->hsm.a_bus_req) {
+
+                        /* Turn on VBus */
+                        iotg->otg.set_vbus(&iotg->otg, true);
+                        iotg->hsm.a_wait_vrise_tmout = 0;
+                        langwell_otg_add_timer(a_wait_vrise_tmr);
+                        iotg->otg.state = OTG_STATE_A_WAIT_VRISE;
+                } else if (!iotg->hsm.a_sess_vld) {
+                        iotg->hsm.a_srp_det = 0;
+                        set_host_mode();
+                        langwell_otg_phy_low_power(1);
+                        iotg->otg.state = OTG_STATE_A_IDLE;
+                }
+                break;
+        default:
+                ;
+        }
+
+        dev_dbg(lnw->dev, "%s: new state = %s\n", __func__,
+                        otg_state_string(iotg->otg.state));
+}
+
+static ssize_t
+show_registers(struct device *_dev, struct device_attribute *attr, char *buf)
+{
+        struct langwell_otg     *lnw = the_transceiver;
+        char                    *next;
+        unsigned                size, t;
+
+        next = buf;
+        size = PAGE_SIZE;
+
+        t = scnprintf(next, size,
+                "\n"
+                "USBCMD = 0x%08x\n"
+                "USBSTS = 0x%08x\n"
+                "USBINTR = 0x%08x\n"
+                "ASYNCLISTADDR = 0x%08x\n"
+                "PORTSC1 = 0x%08x\n"
+                "HOSTPC1 = 0x%08x\n"
+                "OTGSC = 0x%08x\n"
+                "USBMODE = 0x%08x\n",
+                readl(lnw->iotg.base + 0x30),
+                readl(lnw->iotg.base + 0x34),
+                readl(lnw->iotg.base + 0x38),
+                readl(lnw->iotg.base + 0x48),
+                readl(lnw->iotg.base + 0x74),
+                readl(lnw->iotg.base + 0xb4),
+                readl(lnw->iotg.base + 0xf4),
+                readl(lnw->iotg.base + 0xf8)
+             );
+        size -= t;
+        next += t;
+
+        return PAGE_SIZE - size;
+}
+static DEVICE_ATTR(registers, S_IRUGO, show_registers, NULL);
+
+static ssize_t
+show_hsm(struct device *_dev, struct device_attribute *attr, char *buf)
+{
+        struct langwell_otg             *lnw = the_transceiver;
+        struct intel_mid_otg_xceiv      *iotg = &lnw->iotg;
+        char                            *next;
+        unsigned                        size, t;
+
+        next = buf;
+        size = PAGE_SIZE;
+
+        if (iotg->otg.host)
+                iotg->hsm.a_set_b_hnp_en = iotg->otg.host->b_hnp_enable;
+
+        if (iotg->otg.gadget)
+                iotg->hsm.b_hnp_enable = iotg->otg.gadget->b_hnp_enable;
+
+        t = scnprintf(next, size,
+                "\n"
+                "current state = %s\n"
+                "a_bus_resume = \t%d\n"
+                "a_bus_suspend = \t%d\n"
+                "a_conn = \t%d\n"
+                "a_sess_vld = \t%d\n"
+                "a_srp_det = \t%d\n"
+                "a_vbus_vld = \t%d\n"
+                "b_bus_resume = \t%d\n"
+                "b_bus_suspend = \t%d\n"
+                "b_conn = \t%d\n"
+                "b_se0_srp = \t%d\n"
+                "b_sess_end = \t%d\n"
+                "b_sess_vld = \t%d\n"
+                "id = \t%d\n"
+                "a_set_b_hnp_en = \t%d\n"
+                "b_srp_done = \t%d\n"
+                "b_hnp_enable = \t%d\n"
+                "a_wait_vrise_tmout = \t%d\n"
+                "a_wait_bcon_tmout = \t%d\n"
+                "a_aidl_bdis_tmout = \t%d\n"
+                "b_ase0_brst_tmout = \t%d\n"
+                "a_bus_drop = \t%d\n"
+                "a_bus_req = \t%d\n"
+                "a_clr_err = \t%d\n"
+                "a_suspend_req = \t%d\n"
+                "b_bus_req = \t%d\n"
+                "b_bus_suspend_tmout = \t%d\n"
+                "b_bus_suspend_vld = \t%d\n",
+                otg_state_string(iotg->otg.state),
+                iotg->hsm.a_bus_resume,
+                iotg->hsm.a_bus_suspend,
+                iotg->hsm.a_conn,
+                iotg->hsm.a_sess_vld,
+                iotg->hsm.a_srp_det,
+                iotg->hsm.a_vbus_vld,
+                iotg->hsm.b_bus_resume,
+                iotg->hsm.b_bus_suspend,
+                iotg->hsm.b_conn,
+                iotg->hsm.b_se0_srp,
+                iotg->hsm.b_sess_end,
+                iotg->hsm.b_sess_vld,
+                iotg->hsm.id,
+                iotg->hsm.a_set_b_hnp_en,
+                iotg->hsm.b_srp_done,
+                iotg->hsm.b_hnp_enable,
+                iotg->hsm.a_wait_vrise_tmout,
+                iotg->hsm.a_wait_bcon_tmout,
+                iotg->hsm.a_aidl_bdis_tmout,
+                iotg->hsm.b_ase0_brst_tmout,
+                iotg->hsm.a_bus_drop,
+                iotg->hsm.a_bus_req,
+                iotg->hsm.a_clr_err,
+                iotg->hsm.a_suspend_req,
+                iotg->hsm.b_bus_req,
+                iotg->hsm.b_bus_suspend_tmout,
+                iotg->hsm.b_bus_suspend_vld
+                );
+        size -= t;
+        next += t;
+
+        return PAGE_SIZE - size;
+}
+static DEVICE_ATTR(hsm, S_IRUGO, show_hsm, NULL);
+
+static ssize_t
+get_a_bus_req(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct langwell_otg     *lnw = the_transceiver;
+        char                    *next;
+        unsigned                size, t;
+
+        next = buf;
+        size = PAGE_SIZE;
+
+        t = scnprintf(next, size, "%d", lnw->iotg.hsm.a_bus_req);
+        size -= t;
+        next += t;
+
+        return PAGE_SIZE - size;
+}
+
+static ssize_t
+set_a_bus_req(struct device *dev, struct device_attribute *attr,
+                const char *buf, size_t count)
+{
+        struct langwell_otg             *lnw = the_transceiver;
+        struct intel_mid_otg_xceiv      *iotg = &lnw->iotg;
+
+        if (!iotg->otg.default_a)
+                return -1;
+        if (count > 2)
+                return -1;
+
+        if (buf[0] == '0') {
+                iotg->hsm.a_bus_req = 0;
+                dev_dbg(lnw->dev, "User request: a_bus_req = 0\n");
+        } else if (buf[0] == '1') {
+                /* If a_bus_drop is TRUE, a_bus_req can't be set */
+                if (iotg->hsm.a_bus_drop)
+                        return -1;
+                iotg->hsm.a_bus_req = 1;
+                dev_dbg(lnw->dev, "User request: a_bus_req = 1\n");
+        }
+        if (spin_trylock(&lnw->wq_lock)) {
+                langwell_update_transceiver();
+                spin_unlock(&lnw->wq_lock);
+        }
+        return count;
+}
+static DEVICE_ATTR(a_bus_req, S_IRUGO | S_IWUSR, get_a_bus_req, set_a_bus_req);
+
+static ssize_t
+get_a_bus_drop(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct langwell_otg     *lnw = the_transceiver;
+        char                    *next;
+        unsigned                size, t;
+
+        next = buf;
+        size = PAGE_SIZE;
+
+        t = scnprintf(next, size, "%d", lnw->iotg.hsm.a_bus_drop);
+        size -= t;
+        next += t;
+
+        return PAGE_SIZE - size;
+}
+
+static ssize_t
+set_a_bus_drop(struct device *dev, struct device_attribute *attr,
+                const char *buf, size_t count)
+{
+        struct langwell_otg             *lnw = the_transceiver;
+        struct intel_mid_otg_xceiv      *iotg = &lnw->iotg;
+
+        if (!iotg->otg.default_a)
+                return -1;
+        if (count > 2)
+                return -1;
+
+        if (buf[0] == '0') {
+                iotg->hsm.a_bus_drop = 0;
+                dev_dbg(lnw->dev, "User request: a_bus_drop = 0\n");
+        } else if (buf[0] == '1') {
+                iotg->hsm.a_bus_drop = 1;
+                iotg->hsm.a_bus_req = 0;
+                dev_dbg(lnw->dev, "User request: a_bus_drop = 1\n");
+                dev_dbg(lnw->dev, "User request: and a_bus_req = 0\n");
+        }
+        if (spin_trylock(&lnw->wq_lock)) {
+                langwell_update_transceiver();
+                spin_unlock(&lnw->wq_lock);
+        }
+        return count;
+}
+static DEVICE_ATTR(a_bus_drop, S_IRUGO | S_IWUSR, get_a_bus_drop, set_a_bus_drop);
+
+static ssize_t
+get_b_bus_req(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct langwell_otg     *lnw = the_transceiver;
+        char                    *next;
+        unsigned                size, t;
+
+        next = buf;
+        size = PAGE_SIZE;
+
+        t = scnprintf(next, size, "%d", lnw->iotg.hsm.b_bus_req);
+        size -= t;
+        next += t;
+
+        return PAGE_SIZE - size;
+}
+
+static ssize_t
+set_b_bus_req(struct device *dev, struct device_attribute *attr,
+                const char *buf, size_t count)
+{
+        struct langwell_otg             *lnw = the_transceiver;
+        struct intel_mid_otg_xceiv      *iotg = &lnw->iotg;
+
+        if (iotg->otg.default_a)
+                return -1;
+
+        if (count > 2)
+                return -1;
+
+        if (buf[0] == '0') {
+                iotg->hsm.b_bus_req = 0;
+                dev_dbg(lnw->dev, "User request: b_bus_req = 0\n");
+        } else if (buf[0] == '1') {
+                iotg->hsm.b_bus_req = 1;
+                dev_dbg(lnw->dev, "User request: b_bus_req = 1\n");
+        }
+        if (spin_trylock(&lnw->wq_lock)) {
+                langwell_update_transceiver();
+                spin_unlock(&lnw->wq_lock);
+        }
+        return count;
+}
+static DEVICE_ATTR(b_bus_req, S_IRUGO | S_IWUSR, get_b_bus_req, set_b_bus_req);
+
+static ssize_t
+set_a_clr_err(struct device *dev, struct device_attribute *attr,
+                const char *buf, size_t count)
+{
+        struct langwell_otg             *lnw = the_transceiver;
+        struct intel_mid_otg_xceiv      *iotg = &lnw->iotg;
+
+        if (!iotg->otg.default_a)
+                return -1;
+        if (count > 2)
+                return -1;
+
+        if (buf[0] == '1') {
+                iotg->hsm.a_clr_err = 1;
+                dev_dbg(lnw->dev, "User request: a_clr_err = 1\n");
+        }
+        if (spin_trylock(&lnw->wq_lock)) {
+                langwell_update_transceiver();
+                spin_unlock(&lnw->wq_lock);
+        }
+        return count;
+}
+static DEVICE_ATTR(a_clr_err, S_IWUSR, NULL, set_a_clr_err);
+
+static struct attribute *inputs_attrs[] = {
+        &dev_attr_a_bus_req.attr,
+        &dev_attr_a_bus_drop.attr,
+        &dev_attr_b_bus_req.attr,
+        &dev_attr_a_clr_err.attr,
+        NULL,
+};
+
+static struct attribute_group debug_dev_attr_group = {
+        .name = "inputs",
+        .attrs = inputs_attrs,
+};
+
+static int langwell_otg_probe(struct pci_dev *pdev,
+                const struct pci_device_id *id)
+{
+        unsigned long           resource, len;
+        void __iomem            *base = NULL;
+        int                     retval;
+        u32                     val32;
+        struct langwell_otg     *lnw;
+        char                    qname[] = "langwell_otg_queue";
+
+        retval = 0;
+        dev_dbg(&pdev->dev, "\notg controller is detected.\n");
+        if (pci_enable_device(pdev) < 0) {
+                retval = -ENODEV;
+                goto done;
+        }
+
+        lnw = kzalloc(sizeof *lnw, GFP_KERNEL);
+        if (lnw == NULL) {
+                retval = -ENOMEM;
+                goto done;
+        }
+        the_transceiver = lnw;
+
+        /* control register: BAR 0 */
+        resource = pci_resource_start(pdev, 0);
+        len = pci_resource_len(pdev, 0);
+        if (!request_mem_region(resource, len, driver_name)) {
+                retval = -EBUSY;
+                goto err;
+        }
+        lnw->region = 1;
+
+        base = ioremap_nocache(resource, len);
+        if (base == NULL) {
+                retval = -EFAULT;
+                goto err;
+        }
+        lnw->iotg.base = base;
+
+        if (!request_mem_region(USBCFG_ADDR, USBCFG_LEN, driver_name)) {
+                retval = -EBUSY;
+                goto err;
+        }
+        lnw->cfg_region = 1;
+
+        /* For the SCCB.USBCFG register */
+        base = ioremap_nocache(USBCFG_ADDR, USBCFG_LEN);
+        if (base == NULL) {
+                retval = -EFAULT;
+                goto err;
+        }
+        lnw->usbcfg = base;
+
+        if (!pdev->irq) {
+                dev_dbg(&pdev->dev, "No IRQ.\n");
+                retval = -ENODEV;
+                goto err;
+        }
+
+        lnw->qwork = create_singlethread_workqueue(qname);
+        if (!lnw->qwork) {
+                dev_dbg(&pdev->dev, "cannot create workqueue %s\n", qname);
+                retval = -ENOMEM;
+                goto err;
+        }
+        INIT_WORK(&lnw->work, langwell_otg_work);
+
+        /* OTG common part */
+        lnw->dev = &pdev->dev;
+        lnw->iotg.otg.dev = lnw->dev;
+        lnw->iotg.otg.label = driver_name;
+        lnw->iotg.otg.set_host = langwell_otg_set_host;
+        lnw->iotg.otg.set_peripheral = langwell_otg_set_peripheral;
+        lnw->iotg.otg.set_power = langwell_otg_set_power;
+        lnw->iotg.otg.set_vbus = langwell_otg_set_vbus;
+        lnw->iotg.otg.start_srp = langwell_otg_start_srp;
+        lnw->iotg.otg.state = OTG_STATE_UNDEFINED;
+
+        if (otg_set_transceiver(&lnw->iotg.otg)) {
+                dev_dbg(lnw->dev, "can't set transceiver\n");
+                retval = -EBUSY;
+                goto err;
+        }
+
+        reset_otg();
+        init_hsm();
+
+        spin_lock_init(&lnw->lock);
+        spin_lock_init(&lnw->wq_lock);
+        INIT_LIST_HEAD(&active_timers);
+        retval = langwell_otg_init_timers(&lnw->iotg.hsm);
+        if (retval) {
+                dev_dbg(&pdev->dev, "Failed to init timers\n");
+                goto err;
+        }
+
+        init_timer(&lnw->hsm_timer);
+        ATOMIC_INIT_NOTIFIER_HEAD(&lnw->iotg.iotg_notifier);
+
+        lnw->iotg_notifier.notifier_call = langwell_otg_iotg_notify;
+
+        retval = intel_mid_otg_register_notifier(&lnw->iotg,
+                                                &lnw->iotg_notifier);
+        if (retval) {
+                dev_dbg(lnw->dev, "Failed to register notifier\n");
+                goto err;
+        }
+
+        if (request_irq(pdev->irq, otg_irq, IRQF_SHARED,
+                                driver_name, lnw) != 0) {
+                dev_dbg(lnw->dev, "request interrupt %d failed\n", pdev->irq);
+                retval = -EBUSY;
+                goto err;
+        }
+
+        /* enable OTGSC int */
+        val32 = OTGSC_DPIE | OTGSC_BSEIE | OTGSC_BSVIE |
+                OTGSC_ASVIE | OTGSC_AVVIE | OTGSC_IDIE | OTGSC_IDPU;
+        writel(val32, lnw->iotg.base + CI_OTGSC);
+
+        retval = device_create_file(&pdev->dev, &dev_attr_registers);
+        if (retval < 0) {
+                dev_dbg(lnw->dev,
+                        "Can't register sysfs attribute: %d\n", retval);
+                goto err;
+        }
+
+        retval = device_create_file(&pdev->dev, &dev_attr_hsm);
+        if (retval < 0) {
+                dev_dbg(lnw->dev, "Can't hsm sysfs attribute: %d\n", retval);
+                goto err;
+        }
+
+        retval = sysfs_create_group(&pdev->dev.kobj, &debug_dev_attr_group);
+        if (retval < 0) {
+                dev_dbg(lnw->dev,
+                        "Can't register sysfs attr group: %d\n", retval);
+                goto err;
+        }
+
+        if (lnw->iotg.otg.state == OTG_STATE_A_IDLE)
+                langwell_update_transceiver();
+
+        return 0;
+
+err:
+        if (the_transceiver)
+                langwell_otg_remove(pdev);
+done:
+        return retval;
+}
+
+static void langwell_otg_remove(struct pci_dev *pdev)
+{
+        struct langwell_otg *lnw = the_transceiver;
+
+        if (lnw->qwork) {
+                flush_workqueue(lnw->qwork);
+                destroy_workqueue(lnw->qwork);
+        }
+        intel_mid_otg_unregister_notifier(&lnw->iotg, &lnw->iotg_notifier);
+        langwell_otg_free_timers();
+
+        /* disable OTGSC interrupt as OTGSC doesn't change in reset */
+        writel(0, lnw->iotg.base + CI_OTGSC);
+
+        if (pdev->irq)
+                free_irq(pdev->irq, lnw);
+        if (lnw->usbcfg)
+                iounmap(lnw->usbcfg);
+        if (lnw->cfg_region)
+                release_mem_region(USBCFG_ADDR, USBCFG_LEN);
+        if (lnw->iotg.base)
+                iounmap(lnw->iotg.base);
+        if (lnw->region)
+                release_mem_region(pci_resource_start(pdev, 0),
+                                pci_resource_len(pdev, 0));
+
+        otg_set_transceiver(NULL);
+        pci_disable_device(pdev);
+        sysfs_remove_group(&pdev->dev.kobj, &debug_dev_attr_group);
+        device_remove_file(&pdev->dev, &dev_attr_hsm);
+        device_remove_file(&pdev->dev, &dev_attr_registers);
+        kfree(lnw);
+        lnw = NULL;
+}
+
+static void transceiver_suspend(struct pci_dev *pdev)
+{
+        pci_save_state(pdev);
+        pci_set_power_state(pdev, PCI_D3hot);
+        langwell_otg_phy_low_power(1);
+}
+
+static int langwell_otg_suspend(struct pci_dev *pdev, pm_message_t message)
+{
+        struct langwell_otg             *lnw = the_transceiver;
+        struct intel_mid_otg_xceiv      *iotg = &lnw->iotg;
+        int                             ret = 0;
+
+        /* Disbale OTG interrupts */
+        langwell_otg_intr(0);
+
+        if (pdev->irq)
+                free_irq(pdev->irq, lnw);
+
+        /* Prevent more otg_work */
+        flush_workqueue(lnw->qwork);
+        destroy_workqueue(lnw->qwork);
+        lnw->qwork = NULL;
+
+        /* start actions */
+        switch (iotg->otg.state) {
+        case OTG_STATE_A_WAIT_VFALL:
+                iotg->otg.state = OTG_STATE_A_IDLE;
+        case OTG_STATE_A_IDLE:
+        case OTG_STATE_B_IDLE:
+        case OTG_STATE_A_VBUS_ERR:
+                transceiver_suspend(pdev);
+                break;
+        case OTG_STATE_A_WAIT_VRISE:
+                langwell_otg_del_timer(a_wait_vrise_tmr);
+                iotg->hsm.a_srp_det = 0;
+
+                /* Turn off VBus */
+                iotg->otg.set_vbus(&iotg->otg, false);
+                iotg->otg.state = OTG_STATE_A_IDLE;
+                transceiver_suspend(pdev);
+                break;
+        case OTG_STATE_A_WAIT_BCON:
+                del_timer_sync(&lnw->hsm_timer);
+                if (lnw->iotg.stop_host)
+                        lnw->iotg.stop_host(&lnw->iotg);
+                else
+                        dev_dbg(&pdev->dev, "host driver has been removed.\n");
+
+                iotg->hsm.a_srp_det = 0;
+
+                /* Turn off VBus */
+                iotg->otg.set_vbus(&iotg->otg, false);
+                iotg->otg.state = OTG_STATE_A_IDLE;
+                transceiver_suspend(pdev);
+                break;
+        case OTG_STATE_A_HOST:
+                if (lnw->iotg.stop_host)
+                        lnw->iotg.stop_host(&lnw->iotg);
+                else
+                        dev_dbg(&pdev->dev, "host driver has been removed.\n");
+
+                iotg->hsm.a_srp_det = 0;
+
+                /* Turn off VBus */
+                iotg->otg.set_vbus(&iotg->otg, false);
+
+                iotg->otg.state = OTG_STATE_A_IDLE;
+                transceiver_suspend(pdev);
+                break;
+        case OTG_STATE_A_SUSPEND:
+                langwell_otg_del_timer(a_aidl_bdis_tmr);
+                langwell_otg_HABA(0);
+                if (lnw->iotg.stop_host)
+                        lnw->iotg.stop_host(&lnw->iotg);
+                else
+                        dev_dbg(lnw->dev, "host driver has been removed.\n");
+                iotg->hsm.a_srp_det = 0;
+
+                /* Turn off VBus */
+                iotg->otg.set_vbus(&iotg->otg, false);
+                iotg->otg.state = OTG_STATE_A_IDLE;
+                transceiver_suspend(pdev);
+                break;
+        case OTG_STATE_A_PERIPHERAL:
+                del_timer_sync(&lnw->hsm_timer);
+
+                if (lnw->iotg.stop_peripheral)
+                        lnw->iotg.stop_peripheral(&lnw->iotg);
+                else
+                        dev_dbg(&pdev->dev,
+                                "client driver has been removed.\n");
+                iotg->hsm.a_srp_det = 0;
+
+                /* Turn off VBus */
+                iotg->otg.set_vbus(&iotg->otg, false);
+                iotg->otg.state = OTG_STATE_A_IDLE;
+                transceiver_suspend(pdev);
+                break;
+        case OTG_STATE_B_HOST:
+                if (lnw->iotg.stop_host)
+                        lnw->iotg.stop_host(&lnw->iotg);
+                else
+                        dev_dbg(&pdev->dev, "host driver has been removed.\n");
+                iotg->hsm.b_bus_req = 0;
+                iotg->otg.state = OTG_STATE_B_IDLE;
+                transceiver_suspend(pdev);
+                break;
+        case OTG_STATE_B_PERIPHERAL:
+                if (lnw->iotg.stop_peripheral)
+                        lnw->iotg.stop_peripheral(&lnw->iotg);
+                else
+                        dev_dbg(&pdev->dev,
+                                "client driver has been removed.\n");
+                iotg->otg.state = OTG_STATE_B_IDLE;
+                transceiver_suspend(pdev);
+                break;
+        case OTG_STATE_B_WAIT_ACON:
+                /* delete hsm timer for b_ase0_brst_tmr */
+                del_timer_sync(&lnw->hsm_timer);
+
+                langwell_otg_HAAR(0);
+
+                if (lnw->iotg.stop_host)
+                        lnw->iotg.stop_host(&lnw->iotg);
+                else
+                        dev_dbg(&pdev->dev, "host driver has been removed.\n");
+                iotg->hsm.b_bus_req = 0;
+                iotg->otg.state = OTG_STATE_B_IDLE;
+                transceiver_suspend(pdev);
+                break;
+        default:
+                dev_dbg(lnw->dev, "error state before suspend\n");
+                break;
+        }
+
+        return ret;
+}
+
+static void transceiver_resume(struct pci_dev *pdev)
+{
+        pci_restore_state(pdev);
+        pci_set_power_state(pdev, PCI_D0);
+}
+
+static int langwell_otg_resume(struct pci_dev *pdev)
+{
+        struct langwell_otg     *lnw = the_transceiver;
+        int                     ret = 0;
+
+        transceiver_resume(pdev);
+
+        lnw->qwork = create_singlethread_workqueue("langwell_otg_queue");
+        if (!lnw->qwork) {
+                dev_dbg(&pdev->dev, "cannot create langwell otg workqueuen");
+                ret = -ENOMEM;
+                goto error;
+        }
+
+        if (request_irq(pdev->irq, otg_irq, IRQF_SHARED,
+                                driver_name, lnw) != 0) {
+                dev_dbg(&pdev->dev, "request interrupt %d failed\n", pdev->irq);
+                ret = -EBUSY;
+                goto error;
+        }
+
+        /* enable OTG interrupts */
+        langwell_otg_intr(1);
+
+        update_hsm();
+
+        langwell_update_transceiver();
+
+        return ret;
+error:
+        langwell_otg_intr(0);
+        transceiver_suspend(pdev);
+        return ret;
+}
+
+static int __init langwell_otg_init(void)
+{
+        return pci_register_driver(&otg_pci_driver);
+}
+module_init(langwell_otg_init);
+
+static void __exit langwell_otg_cleanup(void)
+{
+        pci_unregister_driver(&otg_pci_driver);
+}
+module_exit(langwell_otg_cleanup);
diff --git a/drivers/usb/otg/otg-wakelock.c b/drivers/usb/otg/otg-wakelock.c
new file mode 100644
index 00000000000..2f11472dd2b
--- /dev/null
+++ b/drivers/usb/otg/otg-wakelock.c
@@ -0,0 +1,169 @@
+/*
+ * otg-wakelock.c
+ *
+ * Copyright (C) 2011 Google, Inc.
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/notifier.h>
+#include <linux/wakelock.h>
+#include <linux/spinlock.h>
+#include <linux/usb/otg.h>
+
+#define TEMPORARY_HOLD_TIME     2000
+
+static bool enabled = true;
+static struct otg_transceiver *otgwl_xceiv;
+static struct notifier_block otgwl_nb;
+
+/*
+ * otgwl_spinlock is held while the VBUS lock is grabbed or dropped and the
+ * held field is updated to match.
+ */
+
+static DEFINE_SPINLOCK(otgwl_spinlock);
+
+/*
+ * Only one lock, but since these 3 fields are associated with each other...
+ */
+
+struct otgwl_lock {
+        char name[40];
+        struct wake_lock wakelock;
+        bool held;
+};
+
+/*
+ * VBUS present lock.  Also used as a timed lock on charger
+ * connect/disconnect and USB host disconnect, to allow the system
+ * to react to the change in power.
+ */
+
+static struct otgwl_lock vbus_lock;
+
+static void otgwl_hold(struct otgwl_lock *lock)
+{
+        if (!lock->held) {
+                wake_lock(&lock->wakelock);
+                lock->held = true;
+        }
+}
+
+static void otgwl_temporary_hold(struct otgwl_lock *lock)
+{
+        wake_lock_timeout(&lock->wakelock,
+                          msecs_to_jiffies(TEMPORARY_HOLD_TIME));
+        lock->held = false;
+}
+
+static void otgwl_drop(struct otgwl_lock *lock)
+{
+        if (lock->held) {
+                wake_unlock(&lock->wakelock);
+                lock->held = false;
+        }
+}
+
+static void otgwl_handle_event(unsigned long event)
+{
+        unsigned long irqflags;
+
+        spin_lock_irqsave(&otgwl_spinlock, irqflags);
+
+        if (!enabled) {
+                otgwl_drop(&vbus_lock);
+                spin_unlock_irqrestore(&otgwl_spinlock, irqflags);
+                return;
+        }
+
+        switch (event) {
+        case USB_EVENT_VBUS:
+        case USB_EVENT_ENUMERATED:
+                otgwl_hold(&vbus_lock);
+                break;
+
+        case USB_EVENT_NONE:
+        case USB_EVENT_ID:
+        case USB_EVENT_CHARGER:
+                otgwl_temporary_hold(&vbus_lock);
+                break;
+
+        default:
+                break;
+        }
+
+        spin_unlock_irqrestore(&otgwl_spinlock, irqflags);
+}
+
+static int otgwl_otg_notifications(struct notifier_block *nb,
+                                   unsigned long event, void *unused)
+{
+        otgwl_handle_event(event);
+        return NOTIFY_OK;
+}
+
+static int set_enabled(const char *val, const struct kernel_param *kp)
+{
+        int rv = param_set_bool(val, kp);
+
+        if (rv)
+                return rv;
+
+        if (otgwl_xceiv)
+                otgwl_handle_event(otgwl_xceiv->last_event);
+
+        return 0;
+}
+
+static struct kernel_param_ops enabled_param_ops = {
+        .set = set_enabled,
+        .get = param_get_bool,
+};
+
+module_param_cb(enabled, &enabled_param_ops, &enabled, 0644);
+MODULE_PARM_DESC(enabled, "enable wakelock when VBUS present");
+
+static int __init otg_wakelock_init(void)
+{
+        int ret;
+
+        otgwl_xceiv = otg_get_transceiver();
+
+        if (!otgwl_xceiv) {
+                pr_err("%s: No OTG transceiver found\n", __func__);
+                return -ENODEV;
+        }
+
+        snprintf(vbus_lock.name, sizeof(vbus_lock.name), "vbus-%s",
+                 dev_name(otgwl_xceiv->dev));
+        wake_lock_init(&vbus_lock.wakelock, WAKE_LOCK_SUSPEND,
+                       vbus_lock.name);
+
+        otgwl_nb.notifier_call = otgwl_otg_notifications;
+        ret = otg_register_notifier(otgwl_xceiv, &otgwl_nb);
+
+        if (ret) {
+                pr_err("%s: otg_register_notifier on transceiver %s"
+                       " failed\n", __func__,
+                       dev_name(otgwl_xceiv->dev));
+                otgwl_xceiv = NULL;
+                wake_lock_destroy(&vbus_lock.wakelock);
+                return ret;
+        }
+
+        otgwl_handle_event(otgwl_xceiv->last_event);
+        return ret;
+}
+
+late_initcall(otg_wakelock_init);
diff --git a/drivers/usb/otg/otg_id.c b/drivers/usb/otg/otg_id.c
new file mode 100644
index 00000000000..8037edbf314
--- /dev/null
+++ b/drivers/usb/otg/otg_id.c
@@ -0,0 +1,205 @@
+/*
+ * Copyright (C) 2011 Google, Inc.
+ *
+ * Author:
+ *      Colin Cross <ccross@android.com>
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/mutex.h>
+#include <linux/notifier.h>
+#include <linux/usb/otg_id.h>
+
+static DEFINE_MUTEX(otg_id_lock);
+static struct plist_head otg_id_plist =
+        PLIST_HEAD_INIT(otg_id_plist);
+static struct otg_id_notifier_block *otg_id_active;
+static bool otg_id_cancelling;
+static bool otg_id_inited;
+static int otg_id_suspended;
+static bool otg_id_pending;
+
+static void otg_id_cancel(void)
+{
+        if (otg_id_active) {
+                otg_id_cancelling = true;
+                mutex_unlock(&otg_id_lock);
+
+                otg_id_active->cancel(otg_id_active);
+
+                mutex_lock(&otg_id_lock);
+                otg_id_cancelling = false;
+        }
+}
+
+static void __otg_id_notify(void)
+{
+        int ret;
+        struct otg_id_notifier_block *otg_id_nb;
+        bool proxy_wait = false;
+        if (plist_head_empty(&otg_id_plist))
+                return;
+
+        plist_for_each_entry(otg_id_nb, &otg_id_plist, p) {
+                if (proxy_wait) {
+                        if (otg_id_nb->proxy_wait)
+                                ret = otg_id_nb->proxy_wait(otg_id_nb);
+                } else {
+                        ret = otg_id_nb->detect(otg_id_nb);
+                }
+                if (ret == OTG_ID_HANDLED) {
+                        otg_id_active = otg_id_nb;
+                        return;
+                }
+                if (ret == OTG_ID_PROXY_WAIT)
+                        proxy_wait = true;
+
+        }
+
+        WARN(1, "otg id event not handled");
+        otg_id_active = NULL;
+}
+
+int otg_id_init(void)
+{
+        mutex_lock(&otg_id_lock);
+
+        otg_id_inited = true;
+        __otg_id_notify();
+
+        mutex_unlock(&otg_id_lock);
+        return 0;
+}
+late_initcall(otg_id_init);
+
+/**
+ * otg_id_register_notifier
+ * @otg_id_nb: notifier block containing priority and callback function
+ *
+ * Register a notifier that will be called on any USB cable state change.
+ * The priority determines the order the callback will be called in, a higher
+ * number will be called first.  A callback function needs to determine the
+ * type of USB cable that is connected.  If it can determine the type, it
+ * should notify the appropriate drivers (for example, call an otg notifier
+ * with USB_EVENT_VBUS), and return OTG_ID_HANDLED.  Once a callback has
+ * returned OTG_ID_HANDLED, it is responsible for calling otg_id_notify() when
+ * the detected USB cable is disconnected.
+ */
+int otg_id_register_notifier(struct otg_id_notifier_block *otg_id_nb)
+{
+        plist_node_init(&otg_id_nb->p, otg_id_nb->priority);
+
+        mutex_lock(&otg_id_lock);
+        plist_add(&otg_id_nb->p, &otg_id_plist);
+
+        if (otg_id_inited) {
+                otg_id_cancel();
+                __otg_id_notify();
+        }
+
+        mutex_unlock(&otg_id_lock);
+
+        return 0;
+}
+
+void otg_id_unregister_notifier(struct otg_id_notifier_block *otg_id_nb)
+{
+        mutex_lock(&otg_id_lock);
+
+        plist_del(&otg_id_nb->p, &otg_id_plist);
+
+        if (otg_id_inited && (otg_id_active == otg_id_nb)) {
+                otg_id_cancel();
+                __otg_id_notify();
+        }
+
+        mutex_unlock(&otg_id_lock);
+}
+
+/**
+ * otg_id_notify
+ *
+ * Notify listeners on any USB cable state change.
+ *
+ * A driver may only call otg_id_notify if it returned OTG_ID_HANDLED the last
+ * time it's notifier was called, and it's cancel function has not been called.
+ */
+void otg_id_notify(void)
+{
+        mutex_lock(&otg_id_lock);
+
+        if (otg_id_cancelling)
+                goto out;
+
+        if (otg_id_suspended != 0) {
+                otg_id_pending = true;
+                goto out;
+        }
+
+        __otg_id_notify();
+out:
+        mutex_unlock(&otg_id_lock);
+}
+
+/**
+ * otg_id_suspend
+ *
+ * Mark the otg_id subsystem as going into suspend. From here on out,
+ * any notifications will be deferred until the last otg_id client resumes.
+ * If there is a pending notification when calling this function, it will
+ * return a negative errno and expects that the caller will abort suspend.
+ * Returs 0 on success.
+ */
+int otg_id_suspend(void)
+{
+        int ret = 0;
+
+        mutex_lock(&otg_id_lock);
+
+        /*
+         * if there's a pending notification, tell the caller to abort suspend
+         */
+        if (otg_id_suspended != 0 && otg_id_pending) {
+                pr_info("otg_id: pending notification, should abort suspend\n");
+                ret = -EBUSY;
+                goto out;
+        }
+
+        otg_id_suspended++;
+out:
+        mutex_unlock(&otg_id_lock);
+        return ret;
+}
+
+/**
+ * otg_id_resume
+ *
+ * Inform the otg_id subsystem that a client is resuming. If this is the
+ * last client to be resumed and there's a pending notification,
+ * otg_id_notify() is called.
+ */
+void otg_id_resume(void)
+{
+        mutex_lock(&otg_id_lock);
+        if (WARN(!otg_id_suspended, "unbalanced otg_id_resume\n"))
+                goto out;
+        if (--otg_id_suspended == 0) {
+                if (otg_id_pending) {
+                        pr_info("otg_id: had pending notification\n");
+                        otg_id_pending = false;
+                        __otg_id_notify();
+                }
+        }
+out:
+        mutex_unlock(&otg_id_lock);
+}
diff --git a/drivers/usb/otg/tegra-otg.c b/drivers/usb/otg/tegra-otg.c
new file mode 100644
index 00000000000..4c04e6e183f
--- /dev/null
+++ b/drivers/usb/otg/tegra-otg.c
@@ -0,0 +1,540 @@
+/*
+ * drivers/usb/otg/tegra-otg.c
+ *
+ * OTG transceiver driver for Tegra UTMI phy
+ *
+ * Copyright (C) 2010 NVIDIA Corp.
+ * Copyright (C) 2010 Google, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include <linux/usb.h>
+#include <linux/usb/otg.h>
+#include <linux/usb/gadget.h>
+#include <linux/usb/hcd.h>
+#include <linux/platform_device.h>
+#include <linux/platform_data/tegra_usb.h>
+#include <linux/clk.h>
+#include <linux/io.h>
+#include <linux/delay.h>
+#include <linux/err.h>
+
+#define USB_PHY_WAKEUP          0x408
+#define  USB_ID_INT_EN          (1 << 0)
+#define  USB_ID_INT_STATUS      (1 << 1)
+#define  USB_ID_STATUS          (1 << 2)
+#define  USB_ID_PIN_WAKEUP_EN   (1 << 6)
+#define  USB_VBUS_WAKEUP_EN     (1 << 30)
+#define  USB_VBUS_INT_EN        (1 << 8)
+#define  USB_VBUS_INT_STATUS    (1 << 9)
+#define  USB_VBUS_STATUS        (1 << 10)
+#define  USB_INTS               (USB_VBUS_INT_STATUS | USB_ID_INT_STATUS)
+
+typedef void (*callback_t)(enum usb_otg_state to,
+                                enum usb_otg_state from, void *args);
+
+struct tegra_otg_data {
+        struct otg_transceiver otg;
+        unsigned long int_status;
+        spinlock_t lock;
+        void __iomem *regs;
+        struct clk *clk;
+        int irq;
+        struct platform_device *pdev;
+        struct work_struct work;
+        unsigned int intr_reg_data;
+        bool detect_vbus;
+        bool clk_enabled;
+        callback_t      charger_cb;
+        void    *charger_cb_data;
+
+};
+static struct tegra_otg_data *tegra_clone;
+
+static inline unsigned long otg_readl(struct tegra_otg_data *tegra,
+                                      unsigned int offset)
+{
+        return readl(tegra->regs + offset);
+}
+
+static inline void otg_writel(struct tegra_otg_data *tegra, unsigned long val,
+                              unsigned int offset)
+{
+        writel(val, tegra->regs + offset);
+}
+
+static void tegra_otg_enable_clk(void)
+{
+        if (!tegra_clone->clk_enabled)
+                clk_enable(tegra_clone->clk);
+        tegra_clone->clk_enabled = true;
+}
+
+static void tegra_otg_disable_clk(void)
+{
+        if (tegra_clone->clk_enabled)
+                clk_disable(tegra_clone->clk);
+        tegra_clone->clk_enabled = false;
+}
+
+static const char *tegra_state_name(enum usb_otg_state state)
+{
+        switch (state) {
+                case OTG_STATE_A_HOST:
+                        return "HOST";
+                case OTG_STATE_B_PERIPHERAL:
+                        return "PERIPHERAL";
+                case OTG_STATE_A_SUSPEND:
+                        return "SUSPEND";
+                case OTG_STATE_UNDEFINED:
+                        return "UNDEFINED";
+                default:
+                        return "INVALID";
+        }
+}
+
+static struct platform_device *
+tegra_usb_otg_host_register(struct platform_device *ehci_device,
+                            struct tegra_ehci_platform_data *pdata)
+{
+        struct platform_device *pdev;
+        void *platform_data;
+        int val;
+
+        pdev = platform_device_alloc(ehci_device->name, ehci_device->id);
+        if (!pdev)
+                return NULL;
+
+        val = platform_device_add_resources(pdev, ehci_device->resource,
+                                            ehci_device->num_resources);
+        if (val)
+                goto error;
+
+        pdev->dev.dma_mask =  ehci_device->dev.dma_mask;
+        pdev->dev.coherent_dma_mask = ehci_device->dev.coherent_dma_mask;
+
+        platform_data = kmalloc(sizeof(struct tegra_ehci_platform_data),
+                GFP_KERNEL);
+        if (!platform_data)
+                goto error;
+
+        memcpy(platform_data, pdata, sizeof(struct tegra_ehci_platform_data));
+        pdev->dev.platform_data = platform_data;
+
+        val = platform_device_add(pdev);
+        if (val)
+                goto error_add;
+
+        return pdev;
+
+error_add:
+        kfree(platform_data);
+error:
+        pr_err("%s: failed to add the host controller device\n", __func__);
+        platform_device_put(pdev);
+        return NULL;
+}
+
+static void tegra_usb_otg_host_unregister(struct platform_device *pdev)
+{
+        kfree(pdev->dev.platform_data);
+        pdev->dev.platform_data = NULL;
+        platform_device_unregister(pdev);
+}
+
+void tegra_start_host(struct tegra_otg_data *tegra)
+{
+        struct tegra_otg_platform_data *pdata = tegra->otg.dev->platform_data;
+        if (!tegra->pdev) {
+                tegra->pdev = tegra_usb_otg_host_register(pdata->ehci_device,
+                                                          pdata->ehci_pdata);
+        }
+}
+
+void tegra_stop_host(struct tegra_otg_data *tegra)
+{
+        if (tegra->pdev) {
+                tegra_usb_otg_host_unregister(tegra->pdev);
+                tegra->pdev = NULL;
+        }
+}
+
+int register_otg_callback(callback_t cb, void *args)
+{
+        if (!tegra_clone)
+                return -ENODEV;
+        tegra_clone->charger_cb = cb;
+        tegra_clone->charger_cb_data = args;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(register_otg_callback);
+
+static void irq_work(struct work_struct *work)
+{
+        struct tegra_otg_data *tegra =
+                container_of(work, struct tegra_otg_data, work);
+        struct otg_transceiver *otg = &tegra->otg;
+        enum usb_otg_state from = otg->state;
+        enum usb_otg_state to = OTG_STATE_UNDEFINED;
+        unsigned long flags;
+        unsigned long status;
+
+        if (tegra->detect_vbus) {
+                tegra->detect_vbus = false;
+                tegra_otg_enable_clk();
+                return;
+        }
+
+        clk_enable(tegra->clk);
+
+        spin_lock_irqsave(&tegra->lock, flags);
+
+        status = tegra->int_status;
+
+        if (tegra->int_status & USB_ID_INT_STATUS) {
+                if (status & USB_ID_STATUS) {
+                        if ((status & USB_VBUS_STATUS) && (from != OTG_STATE_A_HOST))
+                                to = OTG_STATE_B_PERIPHERAL;
+                        else
+                                to = OTG_STATE_A_SUSPEND;
+                }
+                else
+                        to = OTG_STATE_A_HOST;
+        }
+        if (from != OTG_STATE_A_HOST) {
+                if (tegra->int_status & USB_VBUS_INT_STATUS) {
+                        if (status & USB_VBUS_STATUS)
+                                to = OTG_STATE_B_PERIPHERAL;
+                        else
+                                to = OTG_STATE_A_SUSPEND;
+                }
+        }
+        spin_unlock_irqrestore(&tegra->lock, flags);
+
+        if (to != OTG_STATE_UNDEFINED) {
+                otg->state = to;
+
+                dev_info(tegra->otg.dev, "%s --> %s\n", tegra_state_name(from),
+                                              tegra_state_name(to));
+
+                if (tegra->charger_cb)
+                        tegra->charger_cb(to, from, tegra->charger_cb_data);
+
+                if (to == OTG_STATE_A_SUSPEND) {
+                        if (from == OTG_STATE_A_HOST)
+                                tegra_stop_host(tegra);
+                        else if (from == OTG_STATE_B_PERIPHERAL && otg->gadget)
+                                usb_gadget_vbus_disconnect(otg->gadget);
+                } else if (to == OTG_STATE_B_PERIPHERAL && otg->gadget) {
+                        if (from == OTG_STATE_A_SUSPEND)
+                                usb_gadget_vbus_connect(otg->gadget);
+                } else if (to == OTG_STATE_A_HOST) {
+                        if (from == OTG_STATE_A_SUSPEND)
+                        tegra_start_host(tegra);
+                }
+        }
+
+
+        clk_disable(tegra->clk);
+        tegra_otg_disable_clk();
+}
+
+static irqreturn_t tegra_otg_irq(int irq, void *data)
+{
+        struct tegra_otg_data *tegra = data;
+        unsigned long flags;
+        unsigned long val;
+
+        spin_lock_irqsave(&tegra->lock, flags);
+
+        val = otg_readl(tegra, USB_PHY_WAKEUP);
+        if (val & (USB_VBUS_INT_EN | USB_ID_INT_EN)) {
+                otg_writel(tegra, val, USB_PHY_WAKEUP);
+                if ((val & USB_ID_INT_STATUS) || (val & USB_VBUS_INT_STATUS)) {
+                        tegra->int_status = val;
+                        tegra->detect_vbus = false;
+                        schedule_work(&tegra->work);
+                }
+        }
+
+        spin_unlock_irqrestore(&tegra->lock, flags);
+
+        return IRQ_HANDLED;
+}
+
+void tegra_otg_check_vbus_detection(void)
+{
+        tegra_clone->detect_vbus = true;
+        schedule_work(&tegra_clone->work);
+}
+EXPORT_SYMBOL(tegra_otg_check_vbus_detection);
+
+static int tegra_otg_set_peripheral(struct otg_transceiver *otg,
+                                struct usb_gadget *gadget)
+{
+        struct tegra_otg_data *tegra;
+        unsigned long val;
+
+        tegra = container_of(otg, struct tegra_otg_data, otg);
+        otg->gadget = gadget;
+
+        clk_enable(tegra->clk);
+        val = otg_readl(tegra, USB_PHY_WAKEUP);
+        val |= (USB_VBUS_INT_EN | USB_VBUS_WAKEUP_EN);
+        val |= (USB_ID_INT_EN | USB_ID_PIN_WAKEUP_EN);
+        otg_writel(tegra, val, USB_PHY_WAKEUP);
+        /* Add delay to make sure register is updated */
+        udelay(1);
+        clk_disable(tegra->clk);
+
+        if ((val & USB_ID_STATUS) && (val & USB_VBUS_STATUS)) {
+                val |= USB_VBUS_INT_STATUS;
+        } else if (!(val & USB_ID_STATUS)) {
+                val |= USB_ID_INT_STATUS;
+        } else {
+                val &= ~(USB_ID_INT_STATUS | USB_VBUS_INT_STATUS);
+        }
+
+        if ((val & USB_ID_INT_STATUS) || (val & USB_VBUS_INT_STATUS)) {
+                tegra->int_status = val;
+                tegra->detect_vbus = false;
+                schedule_work (&tegra->work);
+        }
+
+        return 0;
+}
+
+static int tegra_otg_set_host(struct otg_transceiver *otg,
+                                struct usb_bus *host)
+{
+        struct tegra_otg_data *tegra;
+        unsigned long val;
+
+        tegra = container_of(otg, struct tegra_otg_data, otg);
+        otg->host = host;
+
+        clk_enable(tegra->clk);
+        val = otg_readl(tegra, USB_PHY_WAKEUP);
+        val &= ~(USB_VBUS_INT_STATUS | USB_ID_INT_STATUS);
+
+        val |= (USB_ID_INT_EN | USB_ID_PIN_WAKEUP_EN);
+        otg_writel(tegra, val, USB_PHY_WAKEUP);
+        clk_disable(tegra->clk);
+
+        return 0;
+}
+
+static int tegra_otg_set_power(struct otg_transceiver *otg, unsigned mA)
+{
+        return 0;
+}
+
+static int tegra_otg_set_suspend(struct otg_transceiver *otg, int suspend)
+{
+        return 0;
+}
+
+static int tegra_otg_probe(struct platform_device *pdev)
+{
+        struct tegra_otg_data *tegra;
+        struct tegra_otg_platform_data *otg_pdata;
+        struct tegra_ehci_platform_data *ehci_pdata;
+        struct resource *res;
+        int err;
+
+        tegra = kzalloc(sizeof(struct tegra_otg_data), GFP_KERNEL);
+        if (!tegra)
+                return -ENOMEM;
+
+        tegra->otg.dev = &pdev->dev;
+        otg_pdata = tegra->otg.dev->platform_data;
+        ehci_pdata = otg_pdata->ehci_pdata;
+        tegra->otg.label = "tegra-otg";
+        tegra->otg.state = OTG_STATE_UNDEFINED;
+        tegra->otg.set_host = tegra_otg_set_host;
+        tegra->otg.set_peripheral = tegra_otg_set_peripheral;
+        tegra->otg.set_suspend = tegra_otg_set_suspend;
+        tegra->otg.set_power = tegra_otg_set_power;
+        spin_lock_init(&tegra->lock);
+
+        platform_set_drvdata(pdev, tegra);
+        tegra_clone = tegra;
+        tegra->clk_enabled = false;
+
+        tegra->clk = clk_get(&pdev->dev, NULL);
+        if (IS_ERR(tegra->clk)) {
+                dev_err(&pdev->dev, "Can't get otg clock\n");
+                err = PTR_ERR(tegra->clk);
+                goto err_clk;
+        }
+
+        err = clk_enable(tegra->clk);
+        if (err)
+                goto err_clken;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_err(&pdev->dev, "Failed to get I/O memory\n");
+                err = -ENXIO;
+                goto err_io;
+        }
+        tegra->regs = ioremap(res->start, resource_size(res));
+        if (!tegra->regs) {
+                err = -ENOMEM;
+                goto err_io;
+        }
+
+        tegra->otg.state = OTG_STATE_A_SUSPEND;
+
+        err = otg_set_transceiver(&tegra->otg);
+        if (err) {
+                dev_err(&pdev->dev, "can't register transceiver (%d)\n", err);
+                goto err_otg;
+        }
+
+        res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (!res) {
+                dev_err(&pdev->dev, "Failed to get IRQ\n");
+                err = -ENXIO;
+                goto err_irq;
+        }
+        tegra->irq = res->start;
+        err = request_threaded_irq(tegra->irq, tegra_otg_irq,
+                                   NULL,
+                                   IRQF_SHARED, "tegra-otg", tegra);
+        if (err) {
+                dev_err(&pdev->dev, "Failed to register IRQ\n");
+                goto err_irq;
+        }
+        INIT_WORK (&tegra->work, irq_work);
+
+        if (!ehci_pdata->default_enable)
+                clk_disable(tegra->clk);
+        dev_info(&pdev->dev, "otg transceiver registered\n");
+        return 0;
+
+err_irq:
+        otg_set_transceiver(NULL);
+err_otg:
+        iounmap(tegra->regs);
+err_io:
+        clk_disable(tegra->clk);
+err_clken:
+        clk_put(tegra->clk);
+err_clk:
+        platform_set_drvdata(pdev, NULL);
+        kfree(tegra);
+        return err;
+}
+
+static int __exit tegra_otg_remove(struct platform_device *pdev)
+{
+        struct tegra_otg_data *tegra = platform_get_drvdata(pdev);
+
+        free_irq(tegra->irq, tegra);
+        otg_set_transceiver(NULL);
+        iounmap(tegra->regs);
+        clk_disable(tegra->clk);
+        clk_put(tegra->clk);
+        platform_set_drvdata(pdev, NULL);
+        kfree(tegra);
+
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int tegra_otg_suspend(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct tegra_otg_data *tegra_otg = platform_get_drvdata(pdev);
+        struct otg_transceiver *otg = &tegra_otg->otg;
+        enum usb_otg_state from = otg->state;
+        /* store the interupt enable for cable ID and VBUS */
+        clk_enable(tegra_otg->clk);
+        tegra_otg->intr_reg_data = readl(tegra_otg->regs + USB_PHY_WAKEUP);
+        writel(0, (tegra_otg->regs + USB_PHY_WAKEUP));
+        clk_disable(tegra_otg->clk);
+
+        if (from == OTG_STATE_B_PERIPHERAL && otg->gadget) {
+                usb_gadget_vbus_disconnect(otg->gadget);
+                otg->state = OTG_STATE_A_SUSPEND;
+        }
+        tegra_otg_disable_clk();
+        return 0;
+}
+
+static void tegra_otg_resume(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct tegra_otg_data *tegra_otg = platform_get_drvdata(pdev);
+        int val;
+        unsigned long flags;
+
+        tegra_otg_enable_clk();
+
+        /* Following delay is intentional.
+         * It is placed here after observing system hang.
+         * Root cause is not confirmed.
+         */
+        msleep(1);
+        /* restore the interupt enable for cable ID and VBUS */
+        clk_enable(tegra_otg->clk);
+        writel(tegra_otg->intr_reg_data, (tegra_otg->regs + USB_PHY_WAKEUP));
+        val = readl(tegra_otg->regs + USB_PHY_WAKEUP);
+        clk_disable(tegra_otg->clk);
+
+        /* A device might be connected while CPU is in sleep mode. In this case no interrupt
+         * will be triggered
+         * force irq_work to recheck connected devices
+         */
+        if (!(val & USB_ID_STATUS)) {
+                spin_lock_irqsave(&tegra_otg->lock, flags);
+                tegra_otg->int_status = (val | USB_ID_INT_STATUS );
+                schedule_work(&tegra_otg->work);
+                spin_unlock_irqrestore(&tegra_otg->lock, flags);
+        }
+
+        return;
+}
+
+static const struct dev_pm_ops tegra_otg_pm_ops = {
+        .complete = tegra_otg_resume,
+        .suspend = tegra_otg_suspend,
+};
+#endif
+
+static struct platform_driver tegra_otg_driver = {
+        .driver = {
+                .name  = "tegra-otg",
+#ifdef CONFIG_PM
+                .pm    = &tegra_otg_pm_ops,
+#endif
+        },
+        .remove  = __exit_p(tegra_otg_remove),
+        .probe   = tegra_otg_probe,
+};
+
+static int __init tegra_otg_init(void)
+{
+        return platform_driver_register(&tegra_otg_driver);
+}
+subsys_initcall(tegra_otg_init);
+
+static void __exit tegra_otg_exit(void)
+{
+        platform_driver_unregister(&tegra_otg_driver);
+}
+module_exit(tegra_otg_exit);
diff --git a/drivers/usb/serial/ChangeLog.history b/drivers/usb/serial/ChangeLog.history
new file mode 100644
index 00000000000..f13fd488ebe
--- /dev/null
+++ b/drivers/usb/serial/ChangeLog.history
@@ -0,0 +1,730 @@
+This is the contents of some of the drivers/usb/serial/ files that had  old
+changelog comments.  They were quite old, and out of date, and we don't keep
+them anymore, so I've put them here, away from the source files, in case
+people still care to see them.
+
+- Greg Kroah-Hartman <greg@kroah.com> October 20, 2005
+
+-----------------------------------------------------------------------
+usb-serial.h Change Log comments:
+
+ (03/26/2002) gkh
+        removed the port->tty check from port_paranoia_check() due to serial
+        consoles not having a tty device assigned to them.
+
+ (12/03/2001) gkh
+        removed active from the port structure.
+        added documentation to the usb_serial_device_type structure
+
+ (10/10/2001) gkh
+        added vendor and product to serial structure.  Needed to determine device
+        owner when the device is disconnected.
+
+ (05/30/2001) gkh
+        added sem to port structure and removed port_lock
+
+ (10/05/2000) gkh
+        Added interrupt_in_endpointAddress and bulk_in_endpointAddress to help
+        fix bug with urb->dev not being set properly, now that the usb core
+        needs it.
+
+ (09/11/2000) gkh
+        Added usb_serial_debug_data function to help get rid of #DEBUG in the
+        drivers.
+
+ (08/28/2000) gkh
+        Added port_lock to port structure.
+
+ (08/08/2000) gkh
+        Added open_count to port structure.
+
+ (07/23/2000) gkh
+        Added bulk_out_endpointAddress to port structure.
+
+ (07/19/2000) gkh, pberger, and borchers
+        Modifications to allow usb-serial drivers to be modules.
+
+-----------------------------------------------------------------------
+usb-serial.c Change Log comments:
+
+ (12/10/2002) gkh
+        Split the ports off into their own struct device, and added a
+        usb-serial bus driver.
+
+ (11/19/2002) gkh
+        removed a few #ifdefs for the generic code and cleaned up the failure
+        logic in initialization.
+
+ (10/02/2002) gkh
+        moved the console code to console.c and out of this file.
+
+ (06/05/2002) gkh
+        moved location of startup() call in serial_probe() until after all
+        of the port information and endpoints are initialized.  This makes
+        things easier for some drivers.
+
+ (04/10/2002) gkh
+        added serial_read_proc function which creates a
+        /proc/tty/driver/usb-serial file.
+
+ (03/27/2002) gkh
+        Got USB serial console code working properly and merged into the main
+        version of the tree.  Thanks to Randy Dunlap for the initial version
+        of this code, and for pushing me to finish it up.
+        The USB serial console works with any usb serial driver device.
+
+ (03/21/2002) gkh
+        Moved all manipulation of port->open_count into the core.  Now the
+        individual driver's open and close functions are called only when the
+        first open() and last close() is called.  Making the drivers a bit
+        smaller and simpler.
+        Fixed a bug if a driver didn't have the owner field set.
+
+ (02/26/2002) gkh
+        Moved all locking into the main serial_* functions, instead of having
+        the individual drivers have to grab the port semaphore.  This should
+        reduce races.
+        Reworked the MOD_INC logic a bit to always increment and decrement, even
+        if the generic driver is being used.
+
+ (10/10/2001) gkh
+        usb_serial_disconnect() now sets the serial->dev pointer is to NULL to
+        help prevent child drivers from accessing the device since it is now
+        gone.
+
+ (09/13/2001) gkh
+        Moved generic driver initialize after we have registered with the USB
+        core.  Thanks to Randy Dunlap for pointing this problem out.
+
+ (07/03/2001) gkh
+        Fixed module paramater size.  Thanks to John Brockmeyer for the pointer.
+        Fixed vendor and product getting defined through the MODULE_PARM macro
+        if the Generic driver wasn't compiled in.
+        Fixed problem with generic_shutdown() not being called for drivers that
+        don't have a shutdown() function.
+
+ (06/06/2001) gkh
+        added evil hack that is needed for the prolific pl2303 device due to the
+        crazy way its endpoints are set up.
+
+ (05/30/2001) gkh
+        switched from using spinlock to a semaphore, which fixes lots of problems.
+
+ (04/08/2001) gb
+        Identify version on module load.
+
+ 2001_02_05 gkh
+        Fixed buffer overflows bug with the generic serial driver.  Thanks to
+        Todd Squires <squirest@ct0.com> for fixing this.
+
+ (01/10/2001) gkh
+        Fixed bug where the generic serial adaptor grabbed _any_ device that was
+        offered to it.
+
+ (12/12/2000) gkh
+        Removed MOD_INC and MOD_DEC from poll and disconnect functions, and
+        moved them to the serial_open and serial_close functions.
+        Also fixed bug with there not being a MOD_DEC for the generic driver
+        (thanks to Gary Brubaker for finding this.)
+
+ (11/29/2000) gkh
+        Small NULL pointer initialization cleanup which saves a bit of disk image
+
+ (11/01/2000) Adam J. Richter
+        instead of using idVendor/idProduct pairs, usb serial drivers
+        now identify their hardware interest with usb_device_id tables,
+        which they usually have anyhow for use with MODULE_DEVICE_TABLE.
+
+ (10/05/2000) gkh
+        Fixed bug with urb->dev not being set properly, now that the usb
+        core needs it.
+
+ (09/11/2000) gkh
+        Removed DEBUG #ifdefs with call to usb_serial_debug_data
+
+ (08/28/2000) gkh
+        Added port_lock to port structure.
+        Added locks for SMP safeness to generic driver
+        Fixed the ability to open a generic device's port more than once.
+
+ (07/23/2000) gkh
+        Added bulk_out_endpointAddress to port structure.
+
+ (07/19/2000) gkh, pberger, and borchers
+        Modifications to allow usb-serial drivers to be modules.
+
+ (07/03/2000) gkh
+        Added more debugging to serial_ioctl call
+
+ (06/25/2000) gkh
+        Changed generic_write_bulk_callback to not call wake_up_interruptible
+        directly, but to have port_softint do it at a safer time.
+
+ (06/23/2000) gkh
+        Cleaned up debugging statements in a quest to find UHCI timeout bug.
+
+ (05/22/2000) gkh
+        Changed the makefile, enabling the big CONFIG_USB_SERIAL_SOMTHING to be
+        removed from the individual device source files.
+
+ (05/03/2000) gkh
+        Added the Digi Acceleport driver from Al Borchers and Peter Berger.
+
+ (05/02/2000) gkh
+        Changed devfs and tty register code to work properly now. This was based on
+        the ACM driver changes by Vojtech Pavlik.
+
+ (04/27/2000) Ryan VanderBijl
+        Put calls to *_paranoia_checks into one function.
+
+ (04/23/2000) gkh
+        Fixed bug that Randy Dunlap found for Generic devices with no bulk out ports.
+        Moved when the startup code printed out the devices that are supported.
+
+ (04/19/2000) gkh
+        Added driver for ZyXEL omni.net lcd plus ISDN TA
+        Made startup info message specify which drivers were compiled in.
+
+ (04/03/2000) gkh
+        Changed the probe process to remove the module unload races.
+        Changed where the tty layer gets initialized to have devfs work nicer.
+        Added initial devfs support.
+
+ (03/26/2000) gkh
+        Split driver up into device specific pieces.
+
+ (03/19/2000) gkh
+        Fixed oops that could happen when device was removed while a program
+        was talking to the device.
+        Removed the static urbs and now all urbs are created and destroyed
+        dynamically.
+        Reworked the internal interface. Now everything is based on the
+        usb_serial_port structure instead of the larger usb_serial structure.
+        This fixes the bug that a multiport device could not have more than
+        one port open at one time.
+
+ (03/17/2000) gkh
+        Added config option for debugging messages.
+        Added patch for keyspan pda from Brian Warner.
+
+ (03/06/2000) gkh
+        Added the keyspan pda code from Brian Warner <warner@lothar.com>
+        Moved a bunch of the port specific stuff into its own structure. This
+        is in anticipation of the true multiport devices (there's a bug if you
+        try to access more than one port of any multiport device right now)
+
+ (02/21/2000) gkh
+        Made it so that any serial devices only have to specify which functions
+        they want to overload from the generic function calls (great,
+        inheritance in C, in a driver, just what I wanted...)
+        Added support for set_termios and ioctl function calls. No drivers take
+        advantage of this yet.
+        Removed the #ifdef MODULE, now there is no module specific code.
+        Cleaned up a few comments in usb-serial.h that were wrong (thanks again
+        to Miles Lott).
+        Small fix to get_free_serial.
+
+ (02/14/2000) gkh
+        Removed the Belkin and Peracom functionality from the driver due to
+        the lack of support from the vendor, and me not wanting people to
+        accidenatly buy the device, expecting it to work with Linux.
+        Added read_bulk_callback and write_bulk_callback to the type structure
+        for the needs of the FTDI and WhiteHEAT driver.
+        Changed all reverences to FTDI to FTDI_SIO at the request of Bill
+        Ryder.
+        Changed the output urb size back to the max endpoint size to make
+        the ftdi_sio driver have it easier, and due to the fact that it didn't
+        really increase the speed any.
+
+ (02/11/2000) gkh
+        Added VISOR_FUNCTION_CONSOLE to the visor startup function. This was a
+        patch from Miles Lott (milos@insync.net).
+        Fixed bug with not restoring the minor range that a device grabs, if
+        the startup function fails (thanks Miles for finding this).
+
+ (02/05/2000) gkh
+        Added initial framework for the Keyspan PDA serial converter so that
+        Brian Warner has a place to put his code.
+        Made the ezusb specific functions generic enough that different
+        devices can use them (whiteheat and keyspan_pda both need them).
+        Split out a whole bunch of structure and other stuff to a separate
+        usb-serial.h file.
+        Made the Visor connection messages a little more understandable, now
+        that Miles Lott (milos@insync.net) has gotten the Generic channel to
+        work. Also made them always show up in the log file.
+
+ (01/25/2000) gkh
+        Added initial framework for FTDI serial converter so that Bill Ryder
+        has a place to put his code.
+        Added the vendor specific info from Handspring. Now we can print out
+        informational debug messages as well as understand what is happening.
+
+ (01/23/2000) gkh
+        Fixed problem of crash when trying to open a port that didn't have a
+        device assigned to it. Made the minor node finding a little smarter,
+        now it looks to find a continuous space for the new device.
+
+ (01/21/2000) gkh
+        Fixed bug in visor_startup with patch from Miles Lott (milos@insync.net)
+        Fixed get_serial_by_minor which was all messed up for multi port
+        devices. Fixed multi port problem for generic devices. Now the number
+        of ports is determined by the number of bulk out endpoints for the
+        generic device.
+
+ (01/19/2000) gkh
+        Removed lots of cruft that was around from the old (pre urb) driver
+        interface.
+        Made the serial_table dynamic. This should save lots of memory when
+        the number of minor nodes goes up to 256.
+        Added initial support for devices that have more than one port.
+        Added more debugging comments for the Visor, and added a needed
+        set_configuration call.
+
+ (01/17/2000) gkh
+        Fixed the WhiteHEAT firmware (my processing tool had a bug)
+        and added new debug loader firmware for it.
+        Removed the put_char function as it isn't really needed.
+        Added visor startup commands as found by the Win98 dump.
+
+ (01/13/2000) gkh
+        Fixed the vendor id for the generic driver to the one I meant it to be.
+
+ (01/12/2000) gkh
+        Forget the version numbering...that's pretty useless...
+        Made the driver able to be compiled so that the user can select which
+        converter they want to use. This allows people who only want the Visor
+        support to not pay the memory size price of the WhiteHEAT.
+        Fixed bug where the generic driver (idVendor=0000 and idProduct=0000)
+        grabbed the root hub. Not good.
+
+ version 0.4.0 (01/10/2000) gkh
+        Added whiteheat.h containing the firmware for the ConnectTech WhiteHEAT
+        device. Added startup function to allow firmware to be downloaded to
+        a device if it needs to be.
+        Added firmware download logic to the WhiteHEAT device.
+        Started to add #defines to split up the different drivers for potential
+        configuration option.
+
+ version 0.3.1 (12/30/99) gkh
+      Fixed problems with urb for bulk out.
+      Added initial support for multiple sets of endpoints. This enables
+      the Handspring Visor to be attached successfully. Only the first
+      bulk in / bulk out endpoint pair is being used right now.
+
+ version 0.3.0 (12/27/99) gkh
+        Added initial support for the Handspring Visor based on a patch from
+        Miles Lott (milos@sneety.insync.net)
+        Cleaned up the code a bunch and converted over to using urbs only.
+
+ version 0.2.3 (12/21/99) gkh
+        Added initial support for the Connect Tech WhiteHEAT converter.
+        Incremented the number of ports in expectation of getting the
+        WhiteHEAT to work properly (4 ports per connection).
+        Added notification on insertion and removal of what port the
+        device is/was connected to (and what kind of device it was).
+
+ version 0.2.2 (12/16/99) gkh
+        Changed major number to the new allocated number. We're legal now!
+
+ version 0.2.1 (12/14/99) gkh
+        Fixed bug that happens when device node is opened when there isn't a
+        device attached to it. Thanks to marek@webdesign.no for noticing this.
+
+ version 0.2.0 (11/10/99) gkh
+        Split up internals to make it easier to add different types of serial
+        converters to the code.
+        Added a "generic" driver that gets it's vendor and product id
+        from when the module is loaded. Thanks to David E. Nelson (dnelson@jump.net)
+        for the idea and sample code (from the usb scanner driver.)
+        Cleared up any licensing questions by releasing it under the GNU GPL.
+
+ version 0.1.2 (10/25/99) gkh
+        Fixed bug in detecting device.
+
+ version 0.1.1 (10/05/99) gkh
+        Changed the major number to not conflict with anything else.
+
+ version 0.1 (09/28/99) gkh
+        Can recognize the two different devices and start up a read from
+        device when asked to. Writes also work. No control signals yet, this
+        all is vendor specific data (i.e. no spec), also no control for
+        different baud rates or other bit settings.
+        Currently we are using the same devid as the acm driver. This needs
+        to change.
+
+-----------------------------------------------------------------------
+visor.c Change Log comments:
+
+ (06/03/2003) Judd Montgomery <judd at jpilot.org>
+     Added support for module parameter options for untested/unknown
+     devices.
+
+ (03/09/2003) gkh
+        Added support for the Sony Clie NZ90V device.  Thanks to Martin Brachtl
+        <brachtl@redgrep.cz> for the information.
+
+ (03/05/2003) gkh
+        Think Treo support is now working.
+
+ (04/03/2002) gkh
+        Added support for the Sony OS 4.1 devices.  Thanks to Hiroyuki ARAKI
+        <hiro@zob.ne.jp> for the information.
+
+ (03/27/2002) gkh
+        Removed assumptions that port->tty was always valid (is not true
+        for usb serial console devices.)
+
+ (03/23/2002) gkh
+        Added support for the Palm i705 device, thanks to Thomas Riemer
+        <tom@netmech.com> for the information.
+
+ (03/21/2002) gkh
+        Added support for the Palm m130 device, thanks to Udo Eisenbarth
+        <udo.eisenbarth@web.de> for the information.
+
+ (02/27/2002) gkh
+        Reworked the urb handling logic.  We have no more pool, but dynamically
+        allocate the urb and the transfer buffer on the fly.  In testing this
+        does not incure any measurable overhead.  This also relies on the fact
+        that we have proper reference counting logic for urbs.
+
+ (02/21/2002) SilaS
+  Added initial support for the Palm m515 devices.
+
+ (02/14/2002) gkh
+        Added support for the Clie S-360 device.
+
+ (12/18/2001) gkh
+        Added better Clie support for 3.5 devices.  Thanks to Geoffrey Levand
+        for the patch.
+
+ (11/11/2001) gkh
+        Added support for the m125 devices, and added check to prevent oopses
+        for Clié devices that lie about the number of ports they have.
+
+ (08/30/2001) gkh
+        Added support for the Clie devices, both the 3.5 and 4.0 os versions.
+        Many thanks to Daniel Burke, and Bryan Payne for helping with this.
+
+ (08/23/2001) gkh
+        fixed a few potential bugs pointed out by Oliver Neukum.
+
+ (05/30/2001) gkh
+        switched from using spinlock to a semaphore, which fixes lots of problems.
+
+ (05/28/2000) gkh
+        Added initial support for the Palm m500 and Palm m505 devices.
+
+ (04/08/2001) gb
+        Identify version on module load.
+
+ (01/21/2000) gkh
+        Added write_room and chars_in_buffer, as they were previously using the
+        generic driver versions which is all wrong now that we are using an urb
+        pool.  Thanks to Wolfgang Grandegger for pointing this out to me.
+        Removed count assignment in the write function, which was not needed anymore
+        either.  Thanks to Al Borchers for pointing this out.
+
+ (12/12/2000) gkh
+        Moved MOD_DEC to end of visor_close to be nicer, as the final write
+        message can sleep.
+
+ (11/12/2000) gkh
+        Fixed bug with data being dropped on the floor by forcing tty->low_latency
+        to be on.  Hopefully this fixes the OHCI issue!
+
+ (11/01/2000) Adam J. Richter
+        usb_device_id table support
+
+ (10/05/2000) gkh
+        Fixed bug with urb->dev not being set properly, now that the usb
+        core needs it.
+
+ (09/11/2000) gkh
+        Got rid of always calling kmalloc for every urb we wrote out to the
+        device.
+        Added visor_read_callback so we can keep track of bytes in and out for
+        those people who like to know the speed of their device.
+        Removed DEBUG #ifdefs with call to usb_serial_debug_data
+
+ (09/06/2000) gkh
+        Fixed oops in visor_exit.  Need to uncomment usb_unlink_urb call _after_
+        the host controller drivers set urb->dev = NULL when the urb is finished.
+
+ (08/28/2000) gkh
+        Added locks for SMP safeness.
+
+ (08/08/2000) gkh
+        Fixed endian problem in visor_startup.
+        Fixed MOD_INC and MOD_DEC logic and the ability to open a port more
+        than once.
+
+ (07/23/2000) gkh
+        Added pool of write urbs to speed up transfers to the visor.
+
+ (07/19/2000) gkh
+        Added module_init and module_exit functions to handle the fact that this
+        driver is a loadable module now.
+
+ (07/03/2000) gkh
+        Added visor_set_ioctl and visor_set_termios functions (they don't do much
+        of anything, but are good for debugging.)
+
+ (06/25/2000) gkh
+        Fixed bug in visor_unthrottle that should help with the disconnect in PPP
+        bug that people have been reporting.
+
+ (06/23/2000) gkh
+        Cleaned up debugging statements in a quest to find UHCI timeout bug.
+
+ (04/27/2000) Ryan VanderBijl
+        Fixed memory leak in visor_close
+
+ (03/26/2000) gkh
+        Split driver up into device specific pieces.
+
+-----------------------------------------------------------------------
+pl2303.c Change Log comments:
+
+ 2002_Mar_26 gkh
+        allowed driver to work properly if there is no tty assigned to a port
+        (this happens for serial console devices.)
+
+ 2001_Oct_06 gkh
+        Added RTS and DTR line control.  Thanks to joe@bndlg.de for parts of it.
+
+ 2001_Sep_19 gkh
+        Added break support.
+
+ 2001_Aug_30 gkh
+        fixed oops in write_bulk_callback.
+
+ 2001_Aug_28 gkh
+        reworked buffer logic to be like other usb-serial drivers.  Hopefully
+        removing some reported problems.
+
+ 2001_Jun_06 gkh
+        finished porting to 2.4 format.
+
+
+-----------------------------------------------------------------------
+io_edgeport.c Change Log comments:
+
+ 2003_04_03 al borchers
+  - fixed a bug (that shows up with dosemu) where the tty struct is
+    used in a callback after it has been freed
+
+ 2.3 2002_03_08 greg kroah-hartman
+        - fixed bug when multiple devices were attached at the same time.
+
+ 2.2 2001_11_14 greg kroah-hartman
+        - fixed bug in edge_close that kept the port from being used more
+          than once.
+        - fixed memory leak on device removal.
+        - fixed potential double free of memory when command urb submitting
+          failed.
+        - other small cleanups when the device is removed
+
+ 2.1 2001_07_09 greg kroah-hartman
+        - added support for TIOCMBIS and TIOCMBIC.
+
+     (04/08/2001) gb
+        - Identify version on module load.
+
+ 2.0 2001_03_05 greg kroah-hartman
+        - reworked entire driver to fit properly in with the other usb-serial
+          drivers.  Occasional oopses still happen, but it's a good start.
+
+ 1.2.3 (02/23/2001) greg kroah-hartman
+        - changed device table to work properly for 2.4.x final format.
+        - fixed problem with dropping data at high data rates.
+
+ 1.2.2 (11/27/2000) greg kroah-hartman
+        - cleaned up more NTisms.
+        - Added device table for 2.4.0-test11
+
+ 1.2.1 (11/08/2000) greg kroah-hartman
+        - Started to clean up NTisms.
+        - Fixed problem with dev field of urb for kernels >= 2.4.0-test9
+
+ 1.2 (10/17/2000) David Iacovelli
+        Remove all EPIC code and GPL source
+  Fix RELEVANT_IFLAG macro to include flow control
+  changes port configuration changes.
+  Fix redefinition of SERIAL_MAGIC
+  Change all timeout values to 5 seconds
+  Tried to fix the UHCI multiple urb submission, but failed miserably.
+  it seems to work fine with OHCI.
+  ( Greg take a look at the #if 0 at end of WriteCmdUsb() we must
+    find a way to work arount this UHCI bug )
+
+ 1.1 (10/11/2000) David Iacovelli
+  Fix XON/XOFF flow control to support both IXON and IXOFF
+
+ 0.9.27 (06/30/2000) David Iacovelli
+  Added transmit queue and now allocate urb for command writes.
+
+ 0.9.26 (06/29/2000) David Iacovelli
+  Add support for 80251 based edgeport
+
+ 0.9.25 (06/27/2000) David Iacovelli
+  Do not close the port if it has multiple opens.
+
+ 0.9.24 (05/26/2000) David Iacovelli
+  Add IOCTLs to support RXTX and JAVA POS
+  and first cut at running BlackBox Demo
+
+ 0.9.23 (05/24/2000) David Iacovelli
+  Add IOCTLs to support RXTX and JAVA POS
+
+ 0.9.22 (05/23/2000) David Iacovelli
+  fixed bug in enumeration.  If epconfig turns on mapping by
+  path after a device is already plugged in, we now update
+  the mapping correctly
+
+ 0.9.21 (05/16/2000) David Iacovelli
+  Added BlockUntilChaseResp() to also wait for txcredits
+  Updated the way we allocate and handle write URBs
+        Add debug code to dump buffers
+
+ 0.9.20 (05/01/2000) David Iacovelli
+        change driver to use usb/tts/
+
+ 0.9.19 (05/01/2000) David Iacovelli
+  Update code to compile if DEBUG is off
+
+ 0.9.18 (04/28/2000) David Iacovelli
+  cleanup and test tty_register with devfs
+
+ 0.9.17 (04/27/2000) greg kroah-hartman
+        changed tty_register around to be like the way it
+        was before, but now it works properly with devfs.
+
+ 0.9.16 (04/26/2000) david iacovelli
+  Fixed bug in GetProductInfo()
+
+ 0.9.15 (04/25/2000) david iacovelli
+        Updated enumeration
+
+ 0.9.14 (04/24/2000) david iacovelli
+  Removed all config/status IOCTLS and
+  converted to using /proc/edgeport
+  still playing with devfs
+
+ 0.9.13 (04/24/2000) david iacovelli
+  Removed configuration based on ttyUSB0
+  Added support for configuration using /prod/edgeport
+  first attempt at using devfs (not working yet!)
+  Added IOCTL to GetProductInfo()
+  Added support for custom baud rates
+        Add support for random port numbers
+
+ 0.9.12 (04/18/2000) david iacovelli
+        added additional configuration IOCTLs
+  use ttyUSB0 for configuration
+
+ 0.9.11 (04/17/2000) greg kroah-hartman
+        fixed module initialization race conditions.
+        made all urbs dynamically allocated.
+        made driver devfs compatible. now it only registers the tty device
+        when the device is actually plugged in.
+
+ 0.9.10 (04/13/2000) greg kroah-hartman
+        added proc interface framework.
+
+ 0.9.9 (04/13/2000) david iacovelli
+        added enumeration code and ioctls to configure the device
+
+ 0.9.8 (04/12/2000) david iacovelli
+  Change interrupt read start when device is plugged in
+  and stop when device is removed
+        process interrupt reads when all ports are closed
+  (keep value of rxBytesAvail consistent with the edgeport)
+  set the USB_BULK_QUEUE flag so that we can shove a bunch
+  of urbs at once down the pipe
+
+ 0.9.7 (04/10/2000) david iacovelli
+        start to add enumeration code.
+  generate serial number for epic devices
+  add support for kdb
+
+ 0.9.6 (03/30/2000) david iacovelli
+  add IOCTL to get string, manufacture, and boot descriptors
+
+ 0.9.5 (03/14/2000) greg kroah-hartman
+        more error checking added to SerialOpen to try to fix UHCI open problem
+
+ 0.9.4 (03/09/2000) greg kroah-hartman
+        added more error checking to handle oops when data is hanging
+        around and tty is abruptly closed.
+
+ 0.9.3 (03/09/2000) david iacovelli
+        Add epic support for xon/xoff chars
+        play with performance
+
+ 0.9.2 (03/08/2000) greg kroah-hartman
+        changed most "info" calls to "dbg"
+        implemented flow control properly in the termios call
+
+ 0.9.1 (03/08/2000) david iacovelli
+        added EPIC support
+        enabled bootloader update
+
+ 0.9 (03/08/2000) greg kroah-hartman
+        Release to IO networks.
+        Integrated changes that David made
+  made getting urbs for writing SMP safe
+
+ 0.8 (03/07/2000) greg kroah-hartman
+        Release to IO networks.
+        Fixed problems that were seen in code by David.
+  Now both Edgeport/4 and Edgeport/2 works properly.
+  Changed most of the functions to use port instead of serial.
+
+ 0.7 (02/27/2000) greg kroah-hartman
+        Milestone 3 release.
+        Release to IO Networks
+        ioctl for waiting on line change implemented.
+        ioctl for getting statistics implemented.
+        multiport support working.
+        lsr and msr registers are now handled properly.
+        change break now hooked up and working.
+        support for all known Edgeport devices.
+
+ 0.6 (02/22/2000) greg kroah-hartman
+        Release to IO networks.
+        CHASE is implemented correctly when port is closed.
+        SerialOpen now blocks correctly until port is fully opened.
+
+ 0.5 (02/20/2000) greg kroah-hartman
+        Release to IO networks.
+        Known problems:
+                modem status register changes are not sent on to the user
+                CHASE is not implemented when the port is closed.
+
+ 0.4 (02/16/2000) greg kroah-hartman
+        Second cut at the CeBit demo.
+        Doesn't leak memory on every write to the port
+        Still small leaks on startup.
+        Added support for Edgeport/2 and Edgeport/8
+
+ 0.3 (02/15/2000) greg kroah-hartman
+        CeBit demo release.
+        Force the line settings to 4800, 8, 1, e for the demo.
+        Warning! This version leaks memory like crazy!
+
+ 0.2 (01/30/2000) greg kroah-hartman
+        Milestone 1 release.
+        Device is found by USB subsystem, enumerated, firmware is downloaded
+        and the descriptors are printed to the debug log, config is set, and
+        green light starts to blink. Open port works, and data can be sent
+        and received at the default settings of the UART. Loopback connector
+        and debug log confirms this.
+
+ 0.1 (01/23/2000) greg kroah-hartman
+        Initial release to help IO Networks try to set up their test system.
+        Edgeport4 is recognized, firmware is downloaded, config is set so
+        device blinks green light every 3 sec. Port is bound, but opening,
+        closing, and sending data do not work properly.
+
+
diff --git a/drivers/usb/serial/baseband_usb_chr.c b/drivers/usb/serial/baseband_usb_chr.c
new file mode 100644
index 00000000000..6d691a40312
--- /dev/null
+++ b/drivers/usb/serial/baseband_usb_chr.c
@@ -0,0 +1,1124 @@
+/*
+ * baseband_usb_chr.c
+ *
+ * USB character driver to communicate with baseband modems.
+ *
+ * Copyright (c) 2011, NVIDIA Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include <linux/types.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/kernel.h>
+#include <linux/cdev.h>
+#include <linux/fs.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/list.h>
+#include <linux/errno.h>
+#include <linux/usb.h>
+#include <linux/workqueue.h>
+#include <asm/ioctls.h>
+#include <linux/uaccess.h>
+#include "baseband_usb_chr.h"
+
+MODULE_LICENSE("GPL");
+
+unsigned long baseband_usb_chr_vid = 0x058b;
+unsigned long baseband_usb_chr_pid = 0x0041;
+unsigned long baseband_usb_chr_intf = 0x01;
+
+module_param(baseband_usb_chr_vid, ulong, 0644);
+MODULE_PARM_DESC(baseband_usb_chr_vid, "baseband (usb chr) - USB VID");
+module_param(baseband_usb_chr_pid, ulong, 0644);
+MODULE_PARM_DESC(baseband_usb_chr_pid, "baseband (usb chr) - USB PID");
+module_param(baseband_usb_chr_intf, ulong, 0644);
+MODULE_PARM_DESC(baseband_usb_chr_intf, "baseband (usb chr) - USB interface");
+
+static struct baseband_usb *baseband_usb_chr;
+static bool usb_device_connection;
+
+static atomic_t g_rx_count = ATOMIC_INIT(0);
+
+/* baseband ipc functions */
+
+static void baseband_ipc_dump(const char *prefix, unsigned long int offset,
+        const void *buf, size_t bufsiz)
+{
+        size_t i;
+
+        for (i = 0; i < bufsiz; i += 16) {
+                pr_debug("%s"
+                        "[%lx+%x] %p "
+                        "%02x %02x %02x %02x "
+                        "%02x %02x %02x %02x "
+                        "%02x %02x %02x %02x "
+                        "%02x %02x %02x %02x\n",
+                        prefix,
+                        offset,
+                        i,
+                        ((const unsigned char *) buf) + i,
+                        (i + 0 < bufsiz) ? ((const unsigned char *) buf)[i+0]
+                                : 0xff,
+                        (i + 1 < bufsiz) ? ((const unsigned char *) buf)[i+1]
+                                : 0xff,
+                        (i + 2 < bufsiz) ? ((const unsigned char *) buf)[i+2]
+                                : 0xff,
+                        (i + 3 < bufsiz) ? ((const unsigned char *) buf)[i+3]
+                                : 0xff,
+                        (i + 4 < bufsiz) ? ((const unsigned char *) buf)[i+4]
+                                : 0xff,
+                        (i + 5 < bufsiz) ? ((const unsigned char *) buf)[i+5]
+                                : 0xff,
+                        (i + 6 < bufsiz) ? ((const unsigned char *) buf)[i+6]
+                                : 0xff,
+                        (i + 7 < bufsiz) ? ((const unsigned char *) buf)[i+7]
+                                : 0xff,
+                        (i + 8 < bufsiz) ? ((const unsigned char *) buf)[i+8]
+                                : 0xff,
+                        (i + 9 < bufsiz) ? ((const unsigned char *) buf)[i+9]
+                                : 0xff,
+                        (i + 10 < bufsiz) ? ((const unsigned char *) buf)[i+10]
+                                : 0xff,
+                        (i + 11 < bufsiz) ? ((const unsigned char *) buf)[i+11]
+                                : 0xff,
+                        (i + 12 < bufsiz) ? ((const unsigned char *) buf)[i+12]
+                                : 0xff,
+                        (i + 13 < bufsiz) ? ((const unsigned char *) buf)[i+13]
+                                : 0xff,
+                        (i + 14 < bufsiz) ? ((const unsigned char *) buf)[i+14]
+                                : 0xff,
+                        (i + 15 < bufsiz) ? ((const unsigned char *) buf)[i+15]
+                                : 0xff);
+        }
+
+}
+
+static size_t peek_ipc_tx_bufsiz(struct baseband_ipc *ipc,
+        size_t bufsiz)
+{
+        struct baseband_ipc_buf *ipc_buf, *ipc_buf_next;
+        size_t tx_bufsiz;
+
+        pr_debug("peek_ipc_tx_bufsiz\n");
+
+        /* check input */
+        if (!ipc) {
+                pr_err("!ipc\n");
+                return 0;
+        }
+
+        /* acquire tx buffer semaphores */
+        if (down_interruptible(&ipc->buf_sem)) {
+                pr_err("peek_ipc_tx_bufsiz - "
+                        "cannot acquire buffer semaphore\n");
+                return -ERESTARTSYS;
+        }
+
+        /* calculate maximum number of tx buffers which can be sent */
+        tx_bufsiz = 0;
+        list_for_each_entry_safe(ipc_buf, ipc_buf_next, &ipc->tx.buf, list)
+        {
+                pr_debug("peek_ipc_tx_bufsiz - "
+                        "ipc_buf %p ipc_buf->offset %x ipc_buf->count %x\n",
+                        ipc_buf, ipc_buf->offset, ipc_buf->count);
+                if (ipc_buf->count > bufsiz - tx_bufsiz)
+                        break;
+                else
+                        tx_bufsiz += ipc_buf->count;
+        }
+
+        /* release tx buffer semaphores */
+        up(&ipc->buf_sem);
+
+        return tx_bufsiz;
+}
+
+static size_t get_ipc_tx_buf(struct baseband_ipc *ipc,
+        void *buf, size_t bufsiz)
+{
+        struct baseband_ipc_buf *ipc_buf, *ipc_buf_next;
+        size_t tx_bufsiz;
+
+        pr_debug("get_ipc_tx_buf\n");
+
+        /* check input */
+        if (!ipc || !buf) {
+                pr_err("!ipc || !buf\n");
+                return 0;
+        }
+        if (!bufsiz)
+                return 0;
+
+        /* acquire tx buffer semaphores */
+        if (down_interruptible(&ipc->buf_sem)) {
+                pr_err("get_ipc_tx_buf - "
+                        "cannot acquire buffer semaphore\n");
+                return -ERESTARTSYS;
+        }
+
+        /* get tx data from tx linked list */
+        tx_bufsiz = 0;
+        list_for_each_entry_safe(ipc_buf, ipc_buf_next, &ipc->tx.buf, list)
+        {
+                pr_debug("get_ipc_tx_buf - "
+                        "ipc_buf %p ipc_buf->offset %x ipc_buf->count %x\n",
+                        ipc_buf, ipc_buf->offset, ipc_buf->count);
+                pr_debug("get_ipc_tx_buf - "
+                        "ipc_buf->data [0] %x [1] %x [2] %x [3] %x\n",
+                        ipc_buf->data[0],
+                        ipc_buf->data[1],
+                        ipc_buf->data[2],
+                        ipc_buf->data[3]);
+                if (ipc_buf->count > bufsiz - tx_bufsiz) {
+                        /* copy part of tx buffer */
+                        memcpy(buf + tx_bufsiz,
+                                ipc_buf->data + ipc_buf->offset,
+                                bufsiz - tx_bufsiz);
+                        ipc_buf->offset += bufsiz - tx_bufsiz;
+                        ipc_buf->count -= bufsiz - tx_bufsiz;
+                        tx_bufsiz = bufsiz;
+                } else {
+                        /* copy all data from tx buffer */
+                        memcpy(buf + tx_bufsiz,
+                                ipc_buf->data + ipc_buf->offset,
+                                ipc_buf->count);
+                        tx_bufsiz += ipc_buf->count;
+                        ipc_buf->offset = 0;
+                        ipc_buf->count = 0;
+                        /* add tx buffer to tx free list */
+                        list_move_tail(&ipc_buf->list, &ipc->tx_free.buf);
+                        wake_up(&ipc->tx_free.wait);
+                }
+                /* check if done */
+                if (tx_bufsiz == bufsiz)
+                        break;
+        }
+
+        /* release tx buffer semaphores */
+        up(&ipc->buf_sem);
+
+        return tx_bufsiz;
+}
+
+static size_t put_ipc_rx_buf(struct baseband_ipc *ipc,
+        const void *buf, size_t bufsiz)
+{
+        struct baseband_ipc_buf *ipc_buf, *ipc_buf_next;
+        size_t rx_bufsiz;
+
+        pr_debug("put_ipc_rx_buf\n");
+
+        /* check input */
+        if (!ipc || !buf) {
+                pr_err("!ipc || !buf\n");
+                return 0;
+        }
+        if (!bufsiz)
+                return 0;
+
+        /* acquire rx buffer semaphores */
+retry:
+        if (down_interruptible(&ipc->buf_sem)) {
+                pr_err("put_ipc_rx_buf - "
+                        "cannot acquire buffer semaphore\n");
+                return -ERESTARTSYS;
+        }
+
+        /* put rx data in rx linked list */
+        rx_bufsiz = 0;
+        list_for_each_entry_safe(ipc_buf, ipc_buf_next, &ipc->rx_free.buf, list)
+        {
+                pr_debug("put_ipc_rx_buf - "
+                        "ipc_buf %p ipc_buf->offset %x ipc_buf->count %x\n",
+                        ipc_buf, ipc_buf->offset, ipc_buf->count);
+                if (sizeof(ipc_buf->data) > bufsiz - rx_bufsiz) {
+                        /* partially fill rx free buffer */
+                        memcpy(ipc_buf->data,
+                                buf + rx_bufsiz,
+                                bufsiz - rx_bufsiz);
+                        ipc_buf->offset = 0;
+                        ipc_buf->count = bufsiz - rx_bufsiz;
+                        rx_bufsiz = bufsiz;
+                } else {
+                        /* fill entire rx free buffer */
+                        memcpy(ipc_buf->data,
+                                buf + rx_bufsiz,
+                                sizeof(ipc_buf->data));
+                        ipc_buf->offset = 0;
+                        ipc_buf->count = sizeof(ipc_buf->data);
+                        rx_bufsiz += sizeof(ipc_buf->data);
+                }
+                /* add filled rx free buffer to rx linked list */
+                list_move_tail(&ipc_buf->list, &ipc->rx.buf);
+                wake_up(&ipc->rx.wait);
+                /* check if done */
+                if (rx_bufsiz == bufsiz)
+                        break;
+        }
+
+        /* release rx buffer semaphores */
+        up(&ipc->buf_sem);
+
+        /* wait for rx free buffer available */
+        if (!rx_bufsiz) {
+                if (wait_event_interruptible(ipc->rx_free.wait,
+                        !list_empty(&ipc->rx_free.buf))) {
+                        pr_err("put_ipc_rx_buf - "
+                                "interrupted wait\n");
+                        return -ERESTARTSYS;
+                }
+                goto retry;
+        }
+
+        return rx_bufsiz;
+
+}
+
+static ssize_t baseband_ipc_file_read(struct baseband_ipc *ipc,
+        struct file *file, char *buf, size_t count, loff_t *pos)
+{
+        struct baseband_ipc_buf *ipc_buf, *ipc_buf_next;
+        size_t read_count;
+
+        pr_debug("baseband_ipc_file_read\n");
+
+        /* check input */
+        if (!ipc) {
+                pr_err("!ipc\n");
+                return -EIO;
+        }
+
+        /* acquire rx buffer semaphores */
+retry:
+        if (down_interruptible(&ipc->buf_sem)) {
+                pr_err("baseband_ipc_file_read - "
+                        "cannot acquire buffer semaphore\n");
+                return -ERESTARTSYS;
+        }
+
+        /* get read data from rx linked list */
+        read_count = 0;
+        list_for_each_entry_safe(ipc_buf, ipc_buf_next, &ipc->rx.buf, list)
+        {
+                pr_debug("baseband_ipc_file_read - "
+                        "ipc_buf %p ipc_buf->offset %x ipc_buf->count %x\n",
+                        ipc_buf, ipc_buf->offset, ipc_buf->count);
+                pr_debug("baseband_ipc_file_read - "
+                        "ipc_buf->data [0] %x [1] %x [2] %x [3] %x\n",
+                        ipc_buf->data[0],
+                        ipc_buf->data[1],
+                        ipc_buf->data[2],
+                        ipc_buf->data[3]);
+                if (ipc_buf->count > count - read_count) {
+                        /* copy part of rx buffer */
+                        if (copy_to_user(buf + read_count,
+                                ipc_buf->data + ipc_buf->offset,
+                                count - read_count)) {
+                                pr_err("copy_to_user failed\n");
+                                up(&ipc->buf_sem);
+                                return -EFAULT;
+                        }
+                        ipc_buf->offset += count - read_count;
+                        ipc_buf->count -= count - read_count;
+                        read_count = count;
+                } else {
+                        /* copy all data from rx buffer */
+                        if (copy_to_user(buf + read_count,
+                                ipc_buf->data + ipc_buf->offset,
+                                ipc_buf->count)) {
+                                pr_err("copy_to_user failed\n");
+                                up(&ipc->buf_sem);
+                                return -EFAULT;
+                        }
+                        read_count += ipc_buf->count;
+                        ipc_buf->offset = 0;
+                        ipc_buf->count = 0;
+                        /* add rx buffer to rx free list */
+                        list_move_tail(&ipc_buf->list, &ipc->rx_free.buf);
+                        wake_up(&ipc->rx_free.wait);
+                }
+                /* check if done */
+                if (read_count == count)
+                        break;
+        }
+
+        /* release rx buffer semaphores */
+        up(&ipc->buf_sem);
+
+        /* wait for rx buffer available */
+        if (!read_count) {
+                if (wait_event_interruptible(ipc->rx.wait,
+                        !list_empty(&ipc->rx.buf))) {
+                        pr_err("baseband_ipc_file_read - "
+                                "interrupted wait\n");
+                        return -ERESTARTSYS;
+                }
+                goto retry;
+        }
+
+        return read_count;
+}
+
+static ssize_t baseband_ipc_file_write(struct baseband_ipc *ipc,
+        struct file *file, const char *buf, size_t count, loff_t *pos)
+{
+        struct baseband_ipc_buf *ipc_buf, *ipc_buf_next;
+        size_t write_count;
+
+        pr_debug("baseband_ipc_file_write\n");
+
+        /* check input */
+        if (!ipc) {
+                pr_err("!ipc\n");
+                return -EIO;
+        }
+
+        /* acquire tx buffer semaphores */
+retry:
+        if (down_interruptible(&ipc->buf_sem)) {
+                pr_err("baseband_ipc_file_write - "
+                        "cannot acquire buffer semaphore\n");
+                return -ERESTARTSYS;
+        }
+
+        /* put write data in tx linked list */
+        write_count = 0;
+        list_for_each_entry_safe(ipc_buf, ipc_buf_next, &ipc->tx_free.buf, list)
+        {
+                pr_debug("baseband_ipc_file_write - "
+                        "ipc_buf %p ipc_buf->offset %x ipc_buf->count %x\n",
+                        ipc_buf, ipc_buf->offset, ipc_buf->count);
+                if (sizeof(ipc_buf->data) > count - write_count) {
+                        /* partially fill tx free buffer */
+                        if (copy_from_user(ipc_buf->data,
+                                buf + write_count,
+                                count - write_count)) {
+                                pr_err("copy_from_user failed\n");
+                                up(&ipc->buf_sem);
+                                return -EFAULT;
+                        }
+                        ipc_buf->offset = 0;
+                        ipc_buf->count = count - write_count;
+                        write_count = count;
+                } else {
+                        /* fill entire tx free buffer */
+                        if (copy_from_user(ipc_buf->data,
+                                buf + write_count,
+                                sizeof(ipc_buf->data))) {
+                                pr_err("copy_from_user failed\n");
+                                up(&ipc->buf_sem);
+                                return -EFAULT;
+                        }
+                        ipc_buf->offset = 0;
+                        ipc_buf->count = sizeof(ipc_buf->data);
+                        write_count += sizeof(ipc_buf->data);
+                }
+                /* add filled tx free buffer to tx linked list */
+                pr_debug("baseband_ipc_file_write - "
+                        "ipc_buf->data [0] %x [1] %x [2] %x [3] %x\n",
+                        ipc_buf->data[0],
+                        ipc_buf->data[1],
+                        ipc_buf->data[2],
+                        ipc_buf->data[3]);
+                list_move_tail(&ipc_buf->list, &ipc->tx.buf);
+                wake_up(&ipc->tx.wait);
+                /* check if done */
+                if (write_count == count)
+                        break;
+        }
+
+        /* release tx buffer semaphores */
+        up(&ipc->buf_sem);
+
+        /* wait for tx buffer available */
+        if (!write_count) {
+                if (wait_event_interruptible(ipc->tx_free.wait,
+                        !list_empty(&ipc->tx_free.buf))) {
+                        pr_err("baseband_ipc_file_write - "
+                                "interrupted wait\n");
+                        return -ERESTARTSYS;
+                }
+                goto retry;
+        }
+
+        /* queue ipc transaction work */
+        queue_work(ipc->workqueue, &ipc->work);
+
+        return write_count;
+}
+
+static void baseband_ipc_close(struct baseband_ipc *ipc)
+{
+        struct baseband_ipc_buf *ipc_buf, *ipc_buf_next;
+
+        pr_debug("baseband_ipc_close {\n");
+
+        /* check input */
+        if (!ipc)
+                return;
+
+        /* destroy work queue */
+        if (ipc->workqueue) {
+                pr_debug("destroy workqueue {\n");
+                cancel_work_sync(&ipc->work);
+                destroy_workqueue(ipc->workqueue);
+                ipc->workqueue = (struct workqueue_struct *) 0;
+                pr_debug("destroy workqueue }\n");
+        }
+        memset(&ipc->work, 0, sizeof(ipc->work));
+
+        /* destroy wait queues */
+        memset(&ipc->tx_free.wait, 0, sizeof(ipc->tx_free.wait));
+        memset(&ipc->rx_free.wait, 0, sizeof(ipc->rx_free.wait));
+        memset(&ipc->tx.wait, 0, sizeof(ipc->tx.wait));
+        memset(&ipc->rx.wait, 0, sizeof(ipc->rx.wait));
+
+        /* destroy data buffers */
+        kfree(ipc->ipc_tx);
+        ipc->ipc_tx = (unsigned char *) 0;
+        kfree(ipc->ipc_rx);
+        ipc->ipc_rx = (unsigned char *) 0;
+        list_for_each_entry_safe(ipc_buf, ipc_buf_next, &ipc->tx_free.buf, list)
+        {
+                kfree(ipc_buf);
+        }
+        list_for_each_entry_safe(ipc_buf, ipc_buf_next, &ipc->rx_free.buf, list)
+        {
+                kfree(ipc_buf);
+        }
+        list_for_each_entry_safe(ipc_buf, ipc_buf_next, &ipc->tx.buf, list)
+        {
+                kfree(ipc_buf);
+        }
+        list_for_each_entry_safe(ipc_buf, ipc_buf_next, &ipc->rx.buf, list)
+        {
+                kfree(ipc_buf);
+        }
+
+        /* destroy semaphores */
+        memset(&ipc->buf_sem, 0, sizeof(ipc->buf_sem));
+
+        /* free baseband ipc structure */
+        kfree(ipc);
+
+        pr_debug("baseband_ipc_close }\n");
+}
+
+static struct baseband_ipc *baseband_ipc_open(work_func_t work_func,
+        work_func_t rx_work_func,
+        work_func_t tx_work_func)
+{
+        struct baseband_ipc *ipc;
+        struct baseband_ipc_buf *ipc_buf;
+        int i;
+
+        pr_debug("baseband_ipc_open {\n");
+
+        /* allocate baseband ipc structure */
+        ipc = kzalloc(sizeof(struct baseband_ipc), GFP_KERNEL);
+        if (!ipc)
+                return (struct baseband_ipc *) 0;
+
+        /* create semaphores */
+        sema_init(&ipc->buf_sem, 1);
+
+        /* create data buffers */
+        INIT_LIST_HEAD(&ipc->rx.buf);
+        INIT_LIST_HEAD(&ipc->tx.buf);
+        INIT_LIST_HEAD(&ipc->rx_free.buf);
+        INIT_LIST_HEAD(&ipc->tx_free.buf);
+        for (i = 0; i < BASEBAND_IPC_NUM_RX_BUF; i++) {
+                ipc_buf = (struct baseband_ipc_buf *)
+                        kzalloc(sizeof(struct baseband_ipc_buf), GFP_KERNEL);
+                if (!ipc_buf) {
+                        pr_err("cannot allocate baseband ipc rx buffer #%d\n",
+                                i);
+                        goto error_exit;
+                }
+                pr_debug("baseband_ipc_open - "
+                        "rx_free: ipc_buf %p\n",
+                        ipc_buf);
+                list_add_tail(&ipc_buf->list, &ipc->rx_free.buf);
+        }
+        for (i = 0; i < BASEBAND_IPC_NUM_TX_BUF; i++) {
+                ipc_buf = (struct baseband_ipc_buf *)
+                        kzalloc(sizeof(struct baseband_ipc_buf), GFP_KERNEL);
+                if (!ipc_buf) {
+                        pr_err("cannot allocate baseband ipc tx buffer #%d\n",
+                                i);
+                        goto error_exit;
+                }
+                pr_debug("baseband_ipc_open - "
+                        "tx_free: ipc_buf %p\n",
+                        ipc_buf);
+                list_add_tail(&ipc_buf->list, &ipc->tx_free.buf);
+        }
+        ipc->ipc_rx = (unsigned char *) 0;
+        ipc->ipc_tx = (unsigned char *) 0;
+
+        /* create wait queues */
+        init_waitqueue_head(&ipc->rx.wait);
+        init_waitqueue_head(&ipc->tx.wait);
+        init_waitqueue_head(&ipc->rx_free.wait);
+        init_waitqueue_head(&ipc->tx_free.wait);
+
+        /* create work queue */
+        ipc->workqueue = create_singlethread_workqueue
+                ("baseband_usb_chr_ipc_workqueue");
+        if (!ipc->workqueue) {
+                pr_err("cannot create workqueue\n");
+                goto error_exit;
+        }
+        if (work_func)
+                INIT_WORK(&ipc->work, work_func);
+        if (rx_work_func)
+                INIT_WORK(&ipc->rx_work, rx_work_func);
+        if (tx_work_func)
+                INIT_WORK(&ipc->tx_work, tx_work_func);
+
+        pr_debug("baseband_ipc_open }\n");
+        return ipc;
+
+error_exit:
+        baseband_ipc_close(ipc);
+        return (struct baseband_ipc *) 0;
+}
+
+/* usb rx */
+
+static void baseband_usb_chr_rx_urb_comp(struct urb *urb)
+{
+        struct baseband_usb *usb = (struct baseband_usb *) urb->context;
+
+        pr_debug("baseband_usb_chr_rx_urb_comp { urb %p\n", urb);
+
+        /* queue rx urb completion work */
+        queue_work(usb->ipc->workqueue, &usb->ipc->rx_work);
+
+        pr_debug("baseband_usb_chr_rx_urb_comp }\n");
+}
+
+static int baseband_usb_chr_rx_urb_submit(struct baseband_usb *usb)
+{
+        struct urb *urb;
+        void *buf;
+        int err;
+
+        pr_debug("baseband_usb_chr_rx_urb_submit { usb %p\n", usb);
+
+        if (!usb_device_connection) {
+                pr_err("!!no usb device conenction!!!!!\n");
+                return -1;
+        }
+
+        /* check input */
+        if (usb->usb.rx_urb) {
+                pr_err("previous urb still active\n");
+                return -1;
+        }
+
+        /* allocate rx urb */
+        urb = usb_alloc_urb(0, GFP_ATOMIC);
+        if (!urb) {
+                pr_err("usb_alloc_urb() failed\n");
+                return -ENOMEM;
+        }
+        buf = kzalloc(USB_CHR_RX_BUFSIZ, GFP_ATOMIC);
+        if (!buf) {
+                pr_err("usb buffer kzalloc() failed\n");
+                usb_free_urb(urb);
+                return -ENOMEM;
+        }
+        usb_fill_bulk_urb(urb, usb->usb.device, usb->usb.pipe.bulk.in,
+                buf, USB_CHR_RX_BUFSIZ,
+                baseband_usb_chr_rx_urb_comp,
+                usb);
+        urb->transfer_flags = 0;
+
+        /* submit rx urb */
+        usb->usb.rx_urb = urb;
+        err = usb_submit_urb(urb, GFP_ATOMIC);
+        if (err < 0) {
+                pr_err("usb_submit_urb() failed - err %d\n", err);
+                usb->usb.rx_urb = (struct urb *) 0;
+                kfree(urb->transfer_buffer);
+                usb_free_urb(urb);
+                return err;
+        }
+
+        pr_debug("baseband_usb_chr_rx_urb_submit }\n");
+        return err;
+}
+
+static void baseband_usb_chr_rx_urb_comp_work(struct work_struct *work)
+{
+        struct baseband_usb *usb = baseband_usb_chr;
+        struct urb *urb = usb->usb.rx_urb;
+        size_t len;
+
+        pr_debug("baseband_usb_chr_rx_urb_comp_work { work %p\n", work);
+
+        /* put rx urb data in rx buffer */
+        if (urb->actual_length) {
+                pr_debug("baseband_usb_chr_rx_urb_comp_work - "
+                        "urb->actual_length %d\n", urb->actual_length);
+                len = put_ipc_rx_buf(usb->ipc,
+                        urb->transfer_buffer, urb->actual_length);
+                baseband_ipc_dump("baseband_usb_chr_rx_urb_comp_work"
+                        " - rx buf ", 0,
+                        urb->transfer_buffer, len > 16 ? 16 : len);
+                if (len != urb->actual_length) {
+                        pr_err("baseband_usb_chr_rx_urb_comp_work - "
+                                "put_ipx_rx_buf() only put %d/%d bytes\n",
+                                len, urb->actual_length);
+                }
+                /* increment count of available rx bytes */
+                atomic_add(len, &g_rx_count);
+        }
+
+        /* free rx urb */
+        kfree(urb->transfer_buffer);
+        urb->transfer_buffer = (void *) 0;
+        usb_free_urb(urb);
+        usb->usb.rx_urb = (struct urb *) 0;
+
+        /* submit next rx urb */
+        baseband_usb_chr_rx_urb_submit(usb);
+
+        pr_debug("baseband_usb_chr_rx_urb_comp_work }\n");
+}
+
+/* usb functions */
+
+static void find_usb_pipe(struct baseband_usb *usb)
+{
+        struct usb_device *usbdev = usb->usb.device;
+        struct usb_interface *intf = usb->usb.interface;
+        unsigned char numendpoint = intf->cur_altsetting->desc.bNumEndpoints;
+        struct usb_host_endpoint *endpoint = intf->cur_altsetting->endpoint;
+        unsigned char n;
+
+        for (n = 0; n < numendpoint; n++) {
+                if (usb_endpoint_is_isoc_in(&endpoint[n].desc)) {
+                        pr_debug("endpoint[%d] isochronous in\n", n);
+                        usb->usb.pipe.isoch.in = usb_rcvisocpipe(usbdev,
+                                endpoint[n].desc.bEndpointAddress);
+                } else if (usb_endpoint_is_isoc_out(&endpoint[n].desc)) {
+                        pr_debug("endpoint[%d] isochronous out\n", n);
+                        usb->usb.pipe.isoch.out = usb_sndisocpipe(usbdev,
+                                endpoint[n].desc.bEndpointAddress);
+                } else if (usb_endpoint_is_bulk_in(&endpoint[n].desc)) {
+                        pr_debug("endpoint[%d] bulk in\n", n);
+                        usb->usb.pipe.bulk.in = usb_rcvbulkpipe(usbdev,
+                                endpoint[n].desc.bEndpointAddress);
+                } else if (usb_endpoint_is_bulk_out(&endpoint[n].desc)) {
+                        pr_debug("endpoint[%d] bulk out\n", n);
+                        usb->usb.pipe.bulk.out = usb_sndbulkpipe(usbdev,
+                                endpoint[n].desc.bEndpointAddress);
+                } else if (usb_endpoint_is_int_in(&endpoint[n].desc)) {
+                        pr_debug("endpoint[%d] interrupt in\n", n);
+                        usb->usb.pipe.interrupt.in = usb_rcvintpipe(usbdev,
+                                endpoint[n].desc.bEndpointAddress);
+                } else if (usb_endpoint_is_int_out(&endpoint[n].desc)) {
+                        pr_debug("endpoint[%d] interrupt out\n", n);
+                        usb->usb.pipe.interrupt.out = usb_sndintpipe(usbdev,
+                                endpoint[n].desc.bEndpointAddress);
+                } else {
+                        pr_debug("endpoint[%d] skipped\n", n);
+                }
+        }
+}
+
+static int baseband_usb_driver_probe(struct usb_interface *intf,
+        const struct usb_device_id *id)
+{
+        int err;
+
+        pr_debug("%s(%d) { intf %p id %p\n", __func__, __LINE__, intf, id);
+
+        pr_debug("intf->cur_altsetting->desc.bInterfaceNumber %02x\n",
+                intf->cur_altsetting->desc.bInterfaceNumber);
+        pr_debug("intf->cur_altsetting->desc.bAlternateSetting %02x\n",
+                intf->cur_altsetting->desc.bAlternateSetting);
+        pr_debug("intf->cur_altsetting->desc.bNumEndpoints %02x\n",
+                intf->cur_altsetting->desc.bNumEndpoints);
+        pr_debug("intf->cur_altsetting->desc.bInterfaceClass %02x\n",
+                intf->cur_altsetting->desc.bInterfaceClass);
+        pr_debug("intf->cur_altsetting->desc.bInterfaceSubClass %02x\n",
+                intf->cur_altsetting->desc.bInterfaceSubClass);
+        pr_debug("intf->cur_altsetting->desc.bInterfaceProtocol %02x\n",
+                intf->cur_altsetting->desc.bInterfaceProtocol);
+        pr_debug("intf->cur_altsetting->desc.iInterface %02x\n",
+                intf->cur_altsetting->desc.iInterface);
+
+        /* usb interface mismatch */
+        if (baseband_usb_chr_intf !=
+                intf->cur_altsetting->desc.bInterfaceNumber) {
+                pr_debug("%s(%d) } -ENODEV\n", __func__, __LINE__);
+                return -ENODEV;
+        }
+
+        /* usb interface match */
+        baseband_usb_chr->usb.device = interface_to_usbdev(intf);
+        baseband_usb_chr->usb.interface = intf;
+        find_usb_pipe(baseband_usb_chr);
+        baseband_usb_chr->usb.rx_urb = (struct urb *) 0;
+        baseband_usb_chr->usb.tx_urb = (struct urb *) 0;
+        pr_debug("baseband_usb_chr->usb.driver->name %s\n",
+                baseband_usb_chr->usb.driver->name);
+        pr_debug("baseband_usb_chr->usb.device %p\n",
+                baseband_usb_chr->usb.device);
+        pr_debug("baseband_usb_chr->usb.interface %p\n",
+                baseband_usb_chr->usb.interface);
+        pr_debug("baseband_usb_chr->usb.pipe.isoch.in %x\n",
+                baseband_usb_chr->usb.pipe.isoch.in);
+        pr_debug("baseband_usb_chr->usb.pipe.isoch.out %x\n",
+                baseband_usb_chr->usb.pipe.isoch.out);
+        pr_debug("baseband_usb_chr->usb.pipe.bulk.in %x\n",
+                baseband_usb_chr->usb.pipe.bulk.in);
+        pr_debug("baseband_usb_chr->usb.pipe.bulk.out %x\n",
+                baseband_usb_chr->usb.pipe.bulk.out);
+        pr_debug("baseband_usb_chr->usb.pipe.interrupt.in %x\n",
+                baseband_usb_chr->usb.pipe.interrupt.in);
+        pr_debug("baseband_usb_chr->usb.pipe.interrupt.out %x\n",
+                baseband_usb_chr->usb.pipe.interrupt.out);
+        usb_device_connection = true;
+
+        /* start usb rx */
+        err = baseband_usb_chr_rx_urb_submit(baseband_usb_chr);
+        if (err < 0) {
+                pr_err("submit rx failed - err %d\n", err);
+                return -ENODEV;
+        }
+
+        pr_debug("%s(%d) }\n", __func__, __LINE__);
+        return 0;
+}
+
+static void baseband_usb_driver_disconnect(struct usb_interface *intf)
+{
+        struct usb_device *usb_dev = interface_to_usbdev(intf);
+        pr_debug("%s(%d) { intf %p\n", __func__, __LINE__, intf);
+        pr_debug("%s(%d) }\n", __func__, __LINE__);
+        if (baseband_usb_chr->usb.interface != intf) {
+                pr_info("%s(%d) -ENODEV\n", __func__, __LINE__);
+                return;
+        }
+        if (baseband_usb_chr->usb.device == usb_dev) {
+                pr_info("%s: Matching usb device: Flush workqueue\n", __func__);
+                flush_workqueue(baseband_usb_chr->ipc->workqueue);
+                usb_device_connection = false;
+        }
+
+}
+
+static char baseband_usb_driver_name[32];
+
+static struct usb_device_id baseband_usb_driver_id_table[2];
+
+static struct usb_driver baseband_usb_driver = {
+        .name = baseband_usb_driver_name,
+        .probe = baseband_usb_driver_probe,
+        .disconnect = baseband_usb_driver_disconnect,
+        .id_table = baseband_usb_driver_id_table,
+};
+
+static void baseband_usb_chr_work(struct work_struct *work)
+{
+        struct baseband_usb *usb = baseband_usb_chr;
+        struct {
+                unsigned char *buf;
+                unsigned int bufsiz_byte;
+        } rx, tx;
+        int ipc_tx_byte;
+        int err;
+
+        pr_debug("baseband_usb_chr_work {\n");
+
+        /* check input */
+        if (!usb || !usb->ipc) {
+                pr_err("baseband_usb_chr_work - "
+                        "usb not open\n");
+                return;
+        }
+        if (!usb->usb.device) {
+                pr_err("baseband_usb_chr_work - "
+                        "usb device not probed yet\n");
+                mdelay(10);
+                queue_work(usb->ipc->workqueue, &usb->ipc->work);
+                return;
+        }
+
+        /* allocate buffers on first transaction (will be freed on close) */
+        if (!usb->ipc->ipc_rx) {
+                usb->ipc->ipc_rx = kzalloc(USB_CHR_RX_BUFSIZ, GFP_KERNEL);
+                if (!usb->ipc->ipc_rx) {
+                        pr_err("baseband_usb_chr_work - "
+                                "cannot allocate usb->ipc->ipc_rx\n");
+                        return;
+                }
+        }
+        if (!usb->ipc->ipc_tx) {
+                usb->ipc->ipc_tx = kzalloc(USB_CHR_TX_BUFSIZ, GFP_KERNEL);
+                if (!usb->ipc->ipc_tx) {
+                        pr_err("baseband_usb_chr_work - "
+                                "cannot allocate usb->ipc->ipc_tx\n");
+                        return;
+                }
+        }
+
+        /* usb transaction loop */
+        rx.buf = usb->ipc->ipc_rx;
+        tx.buf = usb->ipc->ipc_tx;
+        while ((tx.bufsiz_byte = peek_ipc_tx_bufsiz(usb->ipc,
+                USB_CHR_TX_BUFSIZ)) != 0) {
+                get_ipc_tx_buf(usb->ipc, tx.buf, tx.bufsiz_byte);
+                err = usb_bulk_msg(usb->usb.device, usb->usb.pipe.bulk.out,
+                        tx.buf, tx.bufsiz_byte, &ipc_tx_byte, USB_CHR_TIMEOUT);
+                if (err < 0) {
+                        pr_err("baseband_usb_chr_work - "
+                                "usb_bulk_msg err %d\n", err);
+                        continue;
+                }
+                if (tx.bufsiz_byte != ipc_tx_byte) {
+                        pr_err("tx.bufsiz_byte %d != ipc_tx_byte %d\n",
+                                tx.bufsiz_byte, ipc_tx_byte);
+                        continue;
+                }
+        }
+
+        pr_debug("baseband_usb_chr_work }\n");
+}
+
+/* usb character file operations */
+
+static int baseband_usb_chr_open(struct inode *inode, struct file *file)
+{
+        pr_debug("baseband_usb_chr_open\n");
+        return 0;
+}
+
+static int baseband_usb_chr_release(struct inode *inode, struct file *file)
+{
+        pr_debug("baseband_usb_chr_release\n");
+        return 0;
+}
+
+static ssize_t baseband_usb_chr_read(struct file *file, char *buf,
+        size_t count, loff_t *pos)
+{
+        ssize_t ret;
+
+        pr_debug("baseband_usb_chr_read\n");
+
+        ret = baseband_ipc_file_read(baseband_usb_chr->ipc,
+                file, buf, count, pos);
+        if (ret > 0) {
+                /* decrement count of available rx bytes */
+                int val = atomic_read(&g_rx_count);
+                pr_debug("baseband_usb_chr_read - read %d unread %d\n",
+                        ret, val - ret);
+                atomic_sub(ret, &g_rx_count);
+        }
+        return ret;
+}
+
+static ssize_t baseband_usb_chr_write(struct file *file, const char *buf,
+        size_t count, loff_t *pos)
+{
+        pr_debug("baseband_usb_chr_write\n");
+        return baseband_ipc_file_write(baseband_usb_chr->ipc,
+                file, buf, count, pos);
+}
+
+static long baseband_usb_chr_ioctl(struct file *file, unsigned int cmd,
+        unsigned long arg)
+{
+        pr_debug("baseband_usb_chr_ioctl\n");
+        switch (cmd) {
+        case TCFLSH:
+                pr_debug("TCFLSH\n");
+                /* flush queued ipc transaction work */
+                flush_workqueue(baseband_usb_chr->ipc->workqueue);
+                return 0;
+        case FIONREAD:
+                pr_debug("FIONREAD\n");
+                /* return count of available rx bytes */
+                {
+                        int __user *p = (int __user *) arg;
+                        int val = atomic_read(&g_rx_count);
+                        if (put_user(val, p))
+                                break;
+                }
+                return 0;
+        default:
+                pr_err("unsupported ioctl cmd %x\n", cmd);
+        }
+        return -ENODEV;
+}
+
+static const struct file_operations baseband_usb_chr_fops = {
+        .open = baseband_usb_chr_open,
+        .release = baseband_usb_chr_release,
+        .read = baseband_usb_chr_read,
+        .write = baseband_usb_chr_write,
+        .unlocked_ioctl = baseband_usb_chr_ioctl,
+};
+
+/* usb device driver functions */
+
+static void baseband_usb_close(struct baseband_usb *usb)
+{
+        pr_debug("baseband_usb_close {\n");
+
+        /* check input */
+        if (!usb)
+                return;
+
+        /* close usb driver */
+        if (usb->usb.driver) {
+                pr_debug("close usb driver {\n");
+                usb_deregister(usb->usb.driver);
+                usb->usb.driver = (struct usb_driver *) 0;
+                pr_debug("close usb driver }\n");
+        }
+
+        /* close baseband ipc */
+        if (usb->ipc) {
+                baseband_ipc_close(usb->ipc);
+                usb->ipc = (struct baseband_ipc *) 0;
+        }
+
+        /* free baseband usb structure */
+        kfree(usb);
+
+        pr_debug("baseband_usb_close }\n");
+}
+
+static struct baseband_usb *baseband_usb_open(unsigned int vid,
+        unsigned int pid,
+        unsigned int intf,
+        work_func_t work_func,
+        work_func_t rx_work_func,
+        work_func_t tx_work_func)
+{
+        struct baseband_usb *usb;
+        int err;
+
+        pr_debug("baseband_usb_open {\n");
+
+        /* allocate baseband usb structure */
+        usb = kzalloc(sizeof(struct baseband_usb), GFP_KERNEL);
+        if (!usb)
+                return (struct baseband_usb *) 0;
+        baseband_usb_chr = usb;
+
+        /* open baseband ipc */
+        usb->ipc = baseband_ipc_open(work_func,
+                rx_work_func,
+                tx_work_func);
+        if (!usb->ipc) {
+                pr_err("open baseband ipc failed\n");
+                goto error_exit;
+        }
+
+        /* open usb driver */
+        sprintf(baseband_usb_driver_name,
+                "baseband_usb_%x_%x_%x",
+                vid, pid, intf);
+        baseband_usb_driver_id_table[0].match_flags
+                = USB_DEVICE_ID_MATCH_DEVICE;
+        baseband_usb_driver_id_table[0].idVendor = vid;
+        baseband_usb_driver_id_table[0].idProduct = pid;
+        usb->usb.driver = &baseband_usb_driver;
+        err = usb_register(&baseband_usb_driver);
+        if (err < 0) {
+                pr_err("cannot open usb driver - err %d\n", err);
+                goto error_exit;
+        }
+
+        pr_debug("baseband_usb_open }\n");
+        return usb;
+
+error_exit:
+        baseband_usb_close(usb);
+        baseband_usb_chr = (struct baseband_usb *) 0;
+        return (struct baseband_usb *) 0;
+}
+
+/* module init / exit functions */
+
+static int baseband_usb_chr_init(void)
+{
+        int err;
+
+        pr_debug("baseband_usb_chr_init {\n");
+
+        /* open baseband usb */
+        baseband_usb_chr = baseband_usb_open
+                (baseband_usb_chr_vid,
+                        baseband_usb_chr_pid,
+                        baseband_usb_chr_intf,
+                        baseband_usb_chr_work,
+                        baseband_usb_chr_rx_urb_comp_work,
+                        (work_func_t) 0);
+        if (!baseband_usb_chr) {
+                pr_err("cannot open baseband usb chr\n");
+                err = -1;
+                goto err1;
+        }
+
+        /* register character device */
+        err = register_chrdev(BASEBAND_USB_CHR_DEV_MAJOR,
+                BASEBAND_USB_CHR_DEV_NAME,
+                &baseband_usb_chr_fops);
+        if (err < 0) {
+                pr_err("cannot register character device - %d\n", err);
+                goto err2;
+        }
+        pr_debug("registered baseband usb character device - major %d\n",
+                BASEBAND_USB_CHR_DEV_MAJOR);
+
+        pr_debug("baseband_usb_chr_init }\n");
+        return 0;
+err2:   baseband_usb_close(baseband_usb_chr);
+        baseband_usb_chr = (struct baseband_usb *) 0;
+err1:   return err;
+}
+
+static void baseband_usb_chr_exit(void)
+{
+        pr_debug("baseband_usb_chr_exit {\n");
+
+        /* unregister character device */
+        unregister_chrdev(BASEBAND_USB_CHR_DEV_MAJOR,
+                BASEBAND_USB_CHR_DEV_NAME);
+
+        /* close baseband usb */
+        if (baseband_usb_chr) {
+                baseband_usb_close(baseband_usb_chr);
+                baseband_usb_chr = (struct baseband_usb *) 0;
+        }
+
+        pr_debug("baseband_usb_chr_exit }\n");
+}
+
+module_init(baseband_usb_chr_init)
+module_exit(baseband_usb_chr_exit)
+
diff --git a/drivers/usb/serial/baseband_usb_chr.h b/drivers/usb/serial/baseband_usb_chr.h
new file mode 100644
index 00000000000..7935e795a54
--- /dev/null
+++ b/drivers/usb/serial/baseband_usb_chr.h
@@ -0,0 +1,106 @@
+/*
+ * baseband_usb_chr.h
+ *
+ * USB character driver to communicate with baseband modems.
+ *
+ * Copyright (c) 2011, NVIDIA Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __BASEBAND_USB_CHR_H__
+#define __BASEBAND_USB_CHR_H__
+
+#define BASEBAND_USB_CHR_DEV_NAME               "baseband_usb_chr"
+#define BASEBAND_USB_CHR_DEV_MAJOR              66
+
+#ifndef USB_CHR_RX_BUFSIZ
+#define USB_CHR_RX_BUFSIZ                       (128*1024)
+#endif  /* USB_CHR_RX_BUFSIZ */
+
+#ifndef USB_CHR_TX_BUFSIZ
+#define USB_CHR_TX_BUFSIZ                       (128*1024)
+#endif  /* USB_CHR_TX_BUFSIZ */
+
+#ifndef USB_CHR_TIMEOUT
+#define USB_CHR_TIMEOUT                         5000 /* ms */
+#endif  /* USB_CHR_TIMEOUT */
+
+#ifndef BASEBAND_IPC_NUM_RX_BUF
+#define BASEBAND_IPC_NUM_RX_BUF                 32
+#endif  /* BASEBAND_IPC_NUM_RX_BUF */
+
+#ifndef BASEBAND_IPC_NUM_TX_BUF
+#define BASEBAND_IPC_NUM_TX_BUF                 16
+#endif  /* BASEBAND_IPC_NUM_TX_BUF */
+
+#ifndef BASEBAND_IPC_BUFSIZ
+#define BASEBAND_IPC_BUFSIZ                     65536
+#endif  /* BASEBAND_IPC_BUFSIZ */
+
+struct baseband_ipc {
+        /* rx / tx data */
+        struct semaphore buf_sem;
+        struct {
+                /* linked list of data buffers */
+                struct list_head buf;
+                /* wait queue of processes trying to access data buffers */
+                wait_queue_head_t wait;
+        } rx, tx, rx_free, tx_free;
+        unsigned char *ipc_rx;
+        unsigned char *ipc_tx;
+        /* work queue
+         * - queued per ipc transaction
+         * - initiated by either:
+         *   = interrupt on gpio line (rx data available)
+         *   = tx data packet being added to tx linked list
+         */
+        struct workqueue_struct *workqueue;
+        struct work_struct work;
+        struct work_struct rx_work;
+        struct work_struct tx_work;
+};
+
+struct baseband_ipc_buf {
+        struct list_head list;
+        /* data buffer */
+        unsigned char data[BASEBAND_IPC_BUFSIZ];
+        /* offset of first data byte */
+        size_t offset;
+        /* number of valid data bytes */
+        size_t count;
+};
+
+struct baseband_usb {
+        struct baseband_ipc *ipc;
+        struct {
+                struct usb_driver *driver;
+                struct usb_device *device;
+                struct usb_interface *interface;
+                struct {
+                        struct {
+                                unsigned int in;
+                                unsigned int out;
+                        } isoch, bulk, interrupt;
+                } pipe;
+                /* currently active rx urb */
+                struct urb *rx_urb;
+                /* currently active tx urb */
+                struct urb *tx_urb;
+        } usb;
+};
+
+#endif  /* __BASEBAND_USB_CHR_H__ */
+
diff --git a/drivers/usb/serial/ezusb.c b/drivers/usb/serial/ezusb.c
new file mode 100644
index 00000000000..3cfc762f505
--- /dev/null
+++ b/drivers/usb/serial/ezusb.c
@@ -0,0 +1,61 @@
+/*
+ * EZ-USB specific functions used by some of the USB to Serial drivers.
+ *
+ * Copyright (C) 1999 - 2002 Greg Kroah-Hartman (greg@kroah.com)
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License version
+ *      2 as published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/tty.h>
+#include <linux/module.h>
+#include <linux/usb.h>
+#include <linux/usb/serial.h>
+
+/* EZ-USB Control and Status Register.  Bit 0 controls 8051 reset */
+#define CPUCS_REG    0x7F92
+
+int ezusb_writememory(struct usb_serial *serial, int address,
+                                unsigned char *data, int length, __u8 request)
+{
+        int result;
+        unsigned char *transfer_buffer;
+
+        /* dbg("ezusb_writememory %x, %d", address, length); */
+        if (!serial->dev) {
+                printk(KERN_ERR "ezusb: %s - no physical device present, "
+                       "failing.\n", __func__);
+                return -ENODEV;
+        }
+
+        transfer_buffer = kmemdup(data, length, GFP_KERNEL);
+        if (!transfer_buffer) {
+                dev_err(&serial->dev->dev, "%s - kmalloc(%d) failed.\n",
+                                                        __func__, length);
+                return -ENOMEM;
+        }
+        result = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
+                     request, 0x40, address, 0, transfer_buffer, length, 3000);
+        kfree(transfer_buffer);
+        return result;
+}
+EXPORT_SYMBOL_GPL(ezusb_writememory);
+
+int ezusb_set_reset(struct usb_serial *serial, unsigned char reset_bit)
+{
+        int response;
+
+        /* dbg("%s - %d", __func__, reset_bit); */
+        response = ezusb_writememory(serial, CPUCS_REG, &reset_bit, 1, 0xa0);
+        if (response < 0)
+                dev_err(&serial->dev->dev, "%s- %d failed\n",
+                                                __func__, reset_bit);
+        return response;
+}
+EXPORT_SYMBOL_GPL(ezusb_set_reset);
+
diff --git a/drivers/usb/storage/libusual.c b/drivers/usb/storage/libusual.c
new file mode 100644
index 00000000000..fe3ffe1459b
--- /dev/null
+++ b/drivers/usb/storage/libusual.c
@@ -0,0 +1,243 @@
+/*
+ * libusual
+ *
+ * The libusual contains the table of devices common for ub and usb-storage.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/usb.h>
+#include <linux/usb_usual.h>
+#include <linux/vmalloc.h>
+#include <linux/kthread.h>
+#include <linux/mutex.h>
+
+/*
+ */
+#define USU_MOD_FL_THREAD   1   /* Thread is running */
+#define USU_MOD_FL_PRESENT  2   /* The module is loaded */
+
+struct mod_status {
+        unsigned long fls;
+};
+
+static struct mod_status stat[3];
+static DEFINE_SPINLOCK(usu_lock);
+
+/*
+ */
+#define USB_US_DEFAULT_BIAS     USB_US_TYPE_STOR
+static atomic_t usu_bias = ATOMIC_INIT(USB_US_DEFAULT_BIAS);
+
+#define BIAS_NAME_SIZE  (sizeof("usb-storage"))
+static const char *bias_names[3] = { "none", "usb-storage", "ub" };
+
+static DEFINE_MUTEX(usu_probe_mutex);
+static DECLARE_COMPLETION(usu_end_notify);
+static atomic_t total_threads = ATOMIC_INIT(0);
+
+static int usu_probe_thread(void *arg);
+
+/*
+ * @type: the module type as an integer
+ */
+void usb_usual_set_present(int type)
+{
+        struct mod_status *st;
+        unsigned long flags;
+
+        if (type <= 0 || type >= 3)
+                return;
+        st = &stat[type];
+        spin_lock_irqsave(&usu_lock, flags);
+        st->fls |= USU_MOD_FL_PRESENT;
+        spin_unlock_irqrestore(&usu_lock, flags);
+}
+EXPORT_SYMBOL_GPL(usb_usual_set_present);
+
+void usb_usual_clear_present(int type)
+{
+        struct mod_status *st;
+        unsigned long flags;
+
+        if (type <= 0 || type >= 3)
+                return;
+        st = &stat[type];
+        spin_lock_irqsave(&usu_lock, flags);
+        st->fls &= ~USU_MOD_FL_PRESENT;
+        spin_unlock_irqrestore(&usu_lock, flags);
+}
+EXPORT_SYMBOL_GPL(usb_usual_clear_present);
+
+/*
+ * Match the calling driver type against the table.
+ * Returns: 0 if the device matches.
+ */
+int usb_usual_check_type(const struct usb_device_id *id, int caller_type)
+{
+        int id_type = USB_US_TYPE(id->driver_info);
+
+        if (caller_type <= 0 || caller_type >= 3)
+                return -EINVAL;
+
+        /* Drivers grab fixed assignment devices */
+        if (id_type == caller_type)
+                return 0;
+        /* Drivers grab devices biased to them */
+        if (id_type == USB_US_TYPE_NONE && caller_type == atomic_read(&usu_bias))
+                return 0;
+        return -ENODEV;
+}
+EXPORT_SYMBOL_GPL(usb_usual_check_type);
+
+/*
+ */
+static int usu_probe(struct usb_interface *intf,
+                         const struct usb_device_id *id)
+{
+        int rc;
+        unsigned long type;
+        struct task_struct* task;
+        unsigned long flags;
+
+        type = USB_US_TYPE(id->driver_info);
+        if (type == 0)
+                type = atomic_read(&usu_bias);
+
+        spin_lock_irqsave(&usu_lock, flags);
+        if ((stat[type].fls & (USU_MOD_FL_THREAD|USU_MOD_FL_PRESENT)) != 0) {
+                spin_unlock_irqrestore(&usu_lock, flags);
+                return -ENXIO;
+        }
+        stat[type].fls |= USU_MOD_FL_THREAD;
+        spin_unlock_irqrestore(&usu_lock, flags);
+
+        task = kthread_run(usu_probe_thread, (void*)type, "libusual_%ld", type);
+        if (IS_ERR(task)) {
+                rc = PTR_ERR(task);
+                printk(KERN_WARNING "libusual: "
+                    "Unable to start the thread for %s: %d\n",
+                    bias_names[type], rc);
+                spin_lock_irqsave(&usu_lock, flags);
+                stat[type].fls &= ~USU_MOD_FL_THREAD;
+                spin_unlock_irqrestore(&usu_lock, flags);
+                return rc;      /* Not being -ENXIO causes a message printed */
+        }
+        atomic_inc(&total_threads);
+
+        return -ENXIO;
+}
+
+static void usu_disconnect(struct usb_interface *intf)
+{
+        ;       /* We should not be here. */
+}
+
+static struct usb_driver usu_driver = {
+        .name =         "libusual",
+        .probe =        usu_probe,
+        .disconnect =   usu_disconnect,
+        .id_table =     usb_storage_usb_ids,
+};
+
+/*
+ * A whole new thread for a purpose of request_module seems quite stupid.
+ * The request_module forks once inside again. However, if we attempt
+ * to load a storage module from our own modprobe thread, that module
+ * references our symbols, which cannot be resolved until our module is
+ * initialized. I wish there was a way to wait for the end of initialization.
+ * The module notifier reports MODULE_STATE_COMING only.
+ * So, we wait until module->init ends as the next best thing.
+ */
+static int usu_probe_thread(void *arg)
+{
+        int type = (unsigned long) arg;
+        struct mod_status *st = &stat[type];
+        int rc;
+        unsigned long flags;
+
+        mutex_lock(&usu_probe_mutex);
+        rc = request_module(bias_names[type]);
+        spin_lock_irqsave(&usu_lock, flags);
+        if (rc == 0 && (st->fls & USU_MOD_FL_PRESENT) == 0) {
+                /*
+                 * This should not happen, but let us keep tabs on it.
+                 */
+                printk(KERN_NOTICE "libusual: "
+                    "modprobe for %s succeeded, but module is not present\n",
+                    bias_names[type]);
+        }
+        st->fls &= ~USU_MOD_FL_THREAD;
+        spin_unlock_irqrestore(&usu_lock, flags);
+        mutex_unlock(&usu_probe_mutex);
+
+        complete_and_exit(&usu_end_notify, 0);
+}
+
+/*
+ */
+static int __init usb_usual_init(void)
+{
+        int rc;
+
+        mutex_lock(&usu_probe_mutex);
+        rc = usb_register(&usu_driver);
+        mutex_unlock(&usu_probe_mutex);
+        return rc;
+}
+
+static void __exit usb_usual_exit(void)
+{
+        /*
+         * We do not check for any drivers present, because
+         * they keep us pinned with symbol references.
+         */
+
+        usb_deregister(&usu_driver);
+
+        while (atomic_read(&total_threads) > 0) {
+                wait_for_completion(&usu_end_notify);
+                atomic_dec(&total_threads);
+        }
+}
+
+/*
+ * Validate and accept the bias parameter.
+ */
+static int usu_set_bias(const char *bias_s, struct kernel_param *kp)
+{
+        int i;
+        int len;
+        int bias_n = 0;
+
+        len = strlen(bias_s);
+        if (len == 0)
+                return -EDOM;
+        if (bias_s[len-1] == '\n')
+                --len;
+
+        for (i = 1; i < 3; i++) {
+                if (strncmp(bias_s, bias_names[i], len) == 0) {
+                        bias_n = i;
+                        break;
+                }
+        }
+        if (bias_n == 0)
+                return -EINVAL;
+
+        atomic_set(&usu_bias, bias_n);
+        return 0;
+}
+
+static int usu_get_bias(char *buffer, struct kernel_param *kp)
+{
+        return strlen(strcpy(buffer, bias_names[atomic_read(&usu_bias)]));
+}
+
+module_init(usb_usual_init);
+module_exit(usb_usual_exit);
+
+module_param_call(bias, usu_set_bias, usu_get_bias, NULL, S_IRUGO|S_IWUSR);
+__MODULE_PARM_TYPE(bias, "string");
+MODULE_PARM_DESC(bias, "Bias to usb-storage or ub");
+
+MODULE_LICENSE("GPL");