Added missing tegra files.HEADmaster

16 files changed, 16404 insertions, 0 deletions

diff --git a/drivers/usb/gadget/android.c b/drivers/usb/gadget/android.c
new file mode 100644
index 00000000000..fbafe8a3bca
--- /dev/null
+++ b/drivers/usb/gadget/android.c
@@ -0,0 +1,1181 @@
+/*
+ * Gadget Driver for Android
+ *
+ * Copyright (C) 2008 Google, Inc.
+ * Author: Mike Lockwood <lockwood@android.com>
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+/* #define DEBUG */
+/* #define VERBOSE_DEBUG */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+
+#include <linux/delay.h>
+#include <linux/kernel.h>
+#include <linux/utsname.h>
+#include <linux/platform_device.h>
+
+#include <linux/usb/ch9.h>
+#include <linux/usb/composite.h>
+#include <linux/usb/gadget.h>
+
+#include "gadget_chips.h"
+
+/*
+ * Kbuild is not very cooperative with respect to linking separately
+ * compiled library objects into one module.  So for now we won't use
+ * separate compilation ... ensuring init/exit sections work to shrink
+ * the runtime footprint, and giving us at least some parts of what
+ * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
+ */
+#include "usbstring.c"
+#include "config.c"
+#include "epautoconf.c"
+#include "composite.c"
+
+#include "f_mass_storage.c"
+#include "u_serial.c"
+#include "f_acm.c"
+#include "f_adb.c"
+#include "f_mtp.c"
+#include "f_accessory.c"
+#define USB_ETH_RNDIS y
+#include "f_rndis.c"
+#include "rndis.c"
+#include "u_ether.c"
+
+MODULE_AUTHOR("Mike Lockwood");
+MODULE_DESCRIPTION("Android Composite USB Driver");
+MODULE_LICENSE("GPL");
+MODULE_VERSION("1.0");
+
+static const char longname[] = "Gadget Android";
+
+/* Default vendor and product IDs, overridden by userspace */
+#define VENDOR_ID               0x18D1
+#define PRODUCT_ID              0x0001
+
+struct android_usb_function {
+        char *name;
+        void *config;
+
+        struct device *dev;
+        char *dev_name;
+        struct device_attribute **attributes;
+
+        /* for android_dev.enabled_functions */
+        struct list_head enabled_list;
+
+        /* Optional: initialization during gadget bind */
+        int (*init)(struct android_usb_function *, struct usb_composite_dev *);
+        /* Optional: cleanup during gadget unbind */
+        void (*cleanup)(struct android_usb_function *);
+
+        int (*bind_config)(struct android_usb_function *, struct usb_configuration *);
+
+        /* Optional: called when the configuration is removed */
+        void (*unbind_config)(struct android_usb_function *, struct usb_configuration *);
+        /* Optional: handle ctrl requests before the device is configured */
+        int (*ctrlrequest)(struct android_usb_function *,
+                                        struct usb_composite_dev *,
+                                        const struct usb_ctrlrequest *);
+};
+
+struct android_dev {
+        struct android_usb_function **functions;
+        struct list_head enabled_functions;
+        struct usb_composite_dev *cdev;
+        struct device *dev;
+
+        bool enabled;
+        struct mutex mutex;
+        bool connected;
+        bool sw_connected;
+        struct work_struct work;
+};
+
+static struct class *android_class;
+static struct android_dev *_android_dev;
+static int android_bind_config(struct usb_configuration *c);
+static void android_unbind_config(struct usb_configuration *c);
+
+/* string IDs are assigned dynamically */
+#define STRING_MANUFACTURER_IDX         0
+#define STRING_PRODUCT_IDX              1
+#define STRING_SERIAL_IDX               2
+
+static char manufacturer_string[256];
+static char product_string[256];
+static char serial_string[256];
+
+/* String Table */
+static struct usb_string strings_dev[] = {
+        [STRING_MANUFACTURER_IDX].s = manufacturer_string,
+        [STRING_PRODUCT_IDX].s = product_string,
+        [STRING_SERIAL_IDX].s = serial_string,
+        {  }                    /* end of list */
+};
+
+static struct usb_gadget_strings stringtab_dev = {
+        .language       = 0x0409,       /* en-us */
+        .strings        = strings_dev,
+};
+
+static struct usb_gadget_strings *dev_strings[] = {
+        &stringtab_dev,
+        NULL,
+};
+
+static struct usb_device_descriptor device_desc = {
+        .bLength              = sizeof(device_desc),
+        .bDescriptorType      = USB_DT_DEVICE,
+        .bcdUSB               = __constant_cpu_to_le16(0x0200),
+        .bDeviceClass         = USB_CLASS_PER_INTERFACE,
+        .idVendor             = __constant_cpu_to_le16(VENDOR_ID),
+        .idProduct            = __constant_cpu_to_le16(PRODUCT_ID),
+        .bcdDevice            = __constant_cpu_to_le16(0xffff),
+        .bNumConfigurations   = 1,
+};
+
+static struct usb_configuration android_config_driver = {
+        .label          = "android",
+        .unbind         = android_unbind_config,
+        .bConfigurationValue = 1,
+};
+
+static void android_work(struct work_struct *data)
+{
+        struct android_dev *dev = container_of(data, struct android_dev, work);
+        struct usb_composite_dev *cdev = dev->cdev;
+        char *disconnected[2] = { "USB_STATE=DISCONNECTED", NULL };
+        char *connected[2]    = { "USB_STATE=CONNECTED", NULL };
+        char *configured[2]   = { "USB_STATE=CONFIGURED", NULL };
+        char **uevent_envp = NULL;
+        unsigned long flags;
+
+        spin_lock_irqsave(&cdev->lock, flags);
+        if (cdev->config)
+                uevent_envp = configured;
+        else if (dev->connected != dev->sw_connected)
+                uevent_envp = dev->connected ? connected : disconnected;
+        dev->sw_connected = dev->connected;
+        spin_unlock_irqrestore(&cdev->lock, flags);
+
+        if (uevent_envp) {
+                kobject_uevent_env(&dev->dev->kobj, KOBJ_CHANGE, uevent_envp);
+                pr_info("%s: sent uevent %s\n", __func__, uevent_envp[0]);
+        } else {
+                pr_info("%s: did not send uevent (%d %d %p)\n", __func__,
+                         dev->connected, dev->sw_connected, cdev->config);
+        }
+}
+
+
+/*-------------------------------------------------------------------------*/
+/* Supported functions initialization */
+
+static int adb_function_init(struct android_usb_function *f, struct usb_composite_dev *cdev)
+{
+        return adb_setup();
+}
+
+static void adb_function_cleanup(struct android_usb_function *f)
+{
+        adb_cleanup();
+}
+
+static int adb_function_bind_config(struct android_usb_function *f, struct usb_configuration *c)
+{
+        return adb_bind_config(c);
+}
+
+static struct android_usb_function adb_function = {
+        .name           = "adb",
+        .init           = adb_function_init,
+        .cleanup        = adb_function_cleanup,
+        .bind_config    = adb_function_bind_config,
+};
+
+
+#define MAX_ACM_INSTANCES 4
+struct acm_function_config {
+        int instances;
+};
+
+static int acm_function_init(struct android_usb_function *f, struct usb_composite_dev *cdev)
+{
+        f->config = kzalloc(sizeof(struct acm_function_config), GFP_KERNEL);
+        if (!f->config)
+                return -ENOMEM;
+
+        return gserial_setup(cdev->gadget, MAX_ACM_INSTANCES);
+}
+
+static void acm_function_cleanup(struct android_usb_function *f)
+{
+        gserial_cleanup();
+        kfree(f->config);
+        f->config = NULL;
+}
+
+static int acm_function_bind_config(struct android_usb_function *f, struct usb_configuration *c)
+{
+        int i;
+        int ret = 0;
+        struct acm_function_config *config = f->config;
+
+        for (i = 0; i < config->instances; i++) {
+                ret = acm_bind_config(c, i);
+                if (ret) {
+                        pr_err("Could not bind acm%u config\n", i);
+                        break;
+                }
+        }
+
+        return ret;
+}
+
+static ssize_t acm_instances_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct acm_function_config *config = f->config;
+        return sprintf(buf, "%d\n", config->instances);
+}
+
+static ssize_t acm_instances_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t size)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct acm_function_config *config = f->config;
+        int value;
+
+        sscanf(buf, "%d", &value);
+        if (value > MAX_ACM_INSTANCES)
+                value = MAX_ACM_INSTANCES;
+        config->instances = value;
+        return size;
+}
+
+static DEVICE_ATTR(instances, S_IRUGO | S_IWUSR, acm_instances_show, acm_instances_store);
+static struct device_attribute *acm_function_attributes[] = { &dev_attr_instances, NULL };
+
+static struct android_usb_function acm_function = {
+        .name           = "acm",
+        .init           = acm_function_init,
+        .cleanup        = acm_function_cleanup,
+        .bind_config    = acm_function_bind_config,
+        .attributes     = acm_function_attributes,
+};
+
+
+static int mtp_function_init(struct android_usb_function *f, struct usb_composite_dev *cdev)
+{
+        return mtp_setup();
+}
+
+static void mtp_function_cleanup(struct android_usb_function *f)
+{
+        mtp_cleanup();
+}
+
+static int mtp_function_bind_config(struct android_usb_function *f, struct usb_configuration *c)
+{
+        return mtp_bind_config(c, false);
+}
+
+static int ptp_function_init(struct android_usb_function *f, struct usb_composite_dev *cdev)
+{
+        /* nothing to do - initialization is handled by mtp_function_init */
+        return 0;
+}
+
+static void ptp_function_cleanup(struct android_usb_function *f)
+{
+        /* nothing to do - cleanup is handled by mtp_function_cleanup */
+}
+
+static int ptp_function_bind_config(struct android_usb_function *f, struct usb_configuration *c)
+{
+        return mtp_bind_config(c, true);
+}
+
+static int mtp_function_ctrlrequest(struct android_usb_function *f,
+                                                struct usb_composite_dev *cdev,
+                                                const struct usb_ctrlrequest *c)
+{
+        return mtp_ctrlrequest(cdev, c);
+}
+
+static struct android_usb_function mtp_function = {
+        .name           = "mtp",
+        .init           = mtp_function_init,
+        .cleanup        = mtp_function_cleanup,
+        .bind_config    = mtp_function_bind_config,
+        .ctrlrequest    = mtp_function_ctrlrequest,
+};
+
+/* PTP function is same as MTP with slightly different interface descriptor */
+static struct android_usb_function ptp_function = {
+        .name           = "ptp",
+        .init           = ptp_function_init,
+        .cleanup        = ptp_function_cleanup,
+        .bind_config    = ptp_function_bind_config,
+};
+
+
+struct rndis_function_config {
+        u8      ethaddr[ETH_ALEN];
+        u32     vendorID;
+        char    manufacturer[256];
+        bool    wceis;
+};
+
+static int rndis_function_init(struct android_usb_function *f, struct usb_composite_dev *cdev)
+{
+        f->config = kzalloc(sizeof(struct rndis_function_config), GFP_KERNEL);
+        if (!f->config)
+                return -ENOMEM;
+        return 0;
+}
+
+static void rndis_function_cleanup(struct android_usb_function *f)
+{
+        kfree(f->config);
+        f->config = NULL;
+}
+
+static int rndis_function_bind_config(struct android_usb_function *f,
+                                        struct usb_configuration *c)
+{
+        int ret;
+        struct rndis_function_config *rndis = f->config;
+
+        if (!rndis) {
+                pr_err("%s: rndis_pdata\n", __func__);
+                return -1;
+        }
+
+        pr_info("%s MAC: %02X:%02X:%02X:%02X:%02X:%02X\n", __func__,
+                rndis->ethaddr[0], rndis->ethaddr[1], rndis->ethaddr[2],
+                rndis->ethaddr[3], rndis->ethaddr[4], rndis->ethaddr[5]);
+
+        ret = gether_setup_name(c->cdev->gadget, rndis->ethaddr, "rndis");
+        if (ret) {
+                pr_err("%s: gether_setup failed\n", __func__);
+                return ret;
+        }
+
+        if (rndis->wceis) {
+                /* "Wireless" RNDIS; auto-detected by Windows */
+                rndis_iad_descriptor.bFunctionClass =
+                                                USB_CLASS_WIRELESS_CONTROLLER;
+                rndis_iad_descriptor.bFunctionSubClass = 0x01;
+                rndis_iad_descriptor.bFunctionProtocol = 0x03;
+                rndis_control_intf.bInterfaceClass =
+                                                USB_CLASS_WIRELESS_CONTROLLER;
+                rndis_control_intf.bInterfaceSubClass =  0x01;
+                rndis_control_intf.bInterfaceProtocol =  0x03;
+        }
+
+        return rndis_bind_config(c, rndis->ethaddr, rndis->vendorID,
+                                    rndis->manufacturer);
+}
+
+static void rndis_function_unbind_config(struct android_usb_function *f,
+                                                struct usb_configuration *c)
+{
+        gether_cleanup();
+}
+
+static ssize_t rndis_manufacturer_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct rndis_function_config *config = f->config;
+        return sprintf(buf, "%s\n", config->manufacturer);
+}
+
+static ssize_t rndis_manufacturer_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t size)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct rndis_function_config *config = f->config;
+
+        if (size >= sizeof(config->manufacturer))
+                return -EINVAL;
+        if (sscanf(buf, "%s", config->manufacturer) == 1)
+                return size;
+        return -1;
+}
+
+static DEVICE_ATTR(manufacturer, S_IRUGO | S_IWUSR, rndis_manufacturer_show,
+                                                    rndis_manufacturer_store);
+
+static ssize_t rndis_wceis_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct rndis_function_config *config = f->config;
+        return sprintf(buf, "%d\n", config->wceis);
+}
+
+static ssize_t rndis_wceis_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t size)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct rndis_function_config *config = f->config;
+        int value;
+
+        if (sscanf(buf, "%d", &value) == 1) {
+                config->wceis = value;
+                return size;
+        }
+        return -EINVAL;
+}
+
+static DEVICE_ATTR(wceis, S_IRUGO | S_IWUSR, rndis_wceis_show,
+                                             rndis_wceis_store);
+
+static ssize_t rndis_ethaddr_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct rndis_function_config *rndis = f->config;
+        return sprintf(buf, "%02x:%02x:%02x:%02x:%02x:%02x\n",
+                rndis->ethaddr[0], rndis->ethaddr[1], rndis->ethaddr[2],
+                rndis->ethaddr[3], rndis->ethaddr[4], rndis->ethaddr[5]);
+}
+
+static ssize_t rndis_ethaddr_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t size)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct rndis_function_config *rndis = f->config;
+
+        if (sscanf(buf, "%02x:%02x:%02x:%02x:%02x:%02x\n",
+                    (int *)&rndis->ethaddr[0], (int *)&rndis->ethaddr[1],
+                    (int *)&rndis->ethaddr[2], (int *)&rndis->ethaddr[3],
+                    (int *)&rndis->ethaddr[4], (int *)&rndis->ethaddr[5]) == 6)
+                return size;
+        return -EINVAL;
+}
+
+static DEVICE_ATTR(ethaddr, S_IRUGO | S_IWUSR, rndis_ethaddr_show,
+                                               rndis_ethaddr_store);
+
+static ssize_t rndis_vendorID_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct rndis_function_config *config = f->config;
+        return sprintf(buf, "%04x\n", config->vendorID);
+}
+
+static ssize_t rndis_vendorID_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t size)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct rndis_function_config *config = f->config;
+        int value;
+
+        if (sscanf(buf, "%04x", &value) == 1) {
+                config->vendorID = value;
+                return size;
+        }
+        return -EINVAL;
+}
+
+static DEVICE_ATTR(vendorID, S_IRUGO | S_IWUSR, rndis_vendorID_show,
+                                                rndis_vendorID_store);
+
+static struct device_attribute *rndis_function_attributes[] = {
+        &dev_attr_manufacturer,
+        &dev_attr_wceis,
+        &dev_attr_ethaddr,
+        &dev_attr_vendorID,
+        NULL
+};
+
+static struct android_usb_function rndis_function = {
+        .name           = "rndis",
+        .init           = rndis_function_init,
+        .cleanup        = rndis_function_cleanup,
+        .bind_config    = rndis_function_bind_config,
+        .unbind_config  = rndis_function_unbind_config,
+        .attributes     = rndis_function_attributes,
+};
+
+
+struct mass_storage_function_config {
+        struct fsg_config fsg;
+        struct fsg_common *common;
+};
+
+static int mass_storage_function_init(struct android_usb_function *f,
+                                        struct usb_composite_dev *cdev)
+{
+        struct mass_storage_function_config *config;
+        struct fsg_common *common;
+        int err;
+
+        config = kzalloc(sizeof(struct mass_storage_function_config),
+                                                                GFP_KERNEL);
+        if (!config)
+                return -ENOMEM;
+
+        config->fsg.nluns = 1;
+        config->fsg.luns[0].removable = 1;
+
+        common = fsg_common_init(NULL, cdev, &config->fsg);
+        if (IS_ERR(common)) {
+                kfree(config);
+                return PTR_ERR(common);
+        }
+
+        err = sysfs_create_link(&f->dev->kobj,
+                                &common->luns[0].dev.kobj,
+                                "lun");
+        if (err) {
+                kfree(config);
+                return err;
+        }
+
+        config->common = common;
+        f->config = config;
+        return 0;
+}
+
+static void mass_storage_function_cleanup(struct android_usb_function *f)
+{
+        kfree(f->config);
+        f->config = NULL;
+}
+
+static int mass_storage_function_bind_config(struct android_usb_function *f,
+                                                struct usb_configuration *c)
+{
+        struct mass_storage_function_config *config = f->config;
+        return fsg_bind_config(c->cdev, c, config->common);
+}
+
+static ssize_t mass_storage_inquiry_show(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct mass_storage_function_config *config = f->config;
+        return sprintf(buf, "%s\n", config->common->inquiry_string);
+}
+
+static ssize_t mass_storage_inquiry_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t size)
+{
+        struct android_usb_function *f = dev_get_drvdata(dev);
+        struct mass_storage_function_config *config = f->config;
+        if (size >= sizeof(config->common->inquiry_string))
+                return -EINVAL;
+        if (sscanf(buf, "%s", config->common->inquiry_string) != 1)
+                return -EINVAL;
+        return size;
+}
+
+static DEVICE_ATTR(inquiry_string, S_IRUGO | S_IWUSR,
+                                        mass_storage_inquiry_show,
+                                        mass_storage_inquiry_store);
+
+static struct device_attribute *mass_storage_function_attributes[] = {
+        &dev_attr_inquiry_string,
+        NULL
+};
+
+static struct android_usb_function mass_storage_function = {
+        .name           = "mass_storage",
+        .init           = mass_storage_function_init,
+        .cleanup        = mass_storage_function_cleanup,
+        .bind_config    = mass_storage_function_bind_config,
+        .attributes     = mass_storage_function_attributes,
+};
+
+
+static int accessory_function_init(struct android_usb_function *f,
+                                        struct usb_composite_dev *cdev)
+{
+        return acc_setup();
+}
+
+static void accessory_function_cleanup(struct android_usb_function *f)
+{
+        acc_cleanup();
+}
+
+static int accessory_function_bind_config(struct android_usb_function *f,
+                                                struct usb_configuration *c)
+{
+        return acc_bind_config(c);
+}
+
+static int accessory_function_ctrlrequest(struct android_usb_function *f,
+                                                struct usb_composite_dev *cdev,
+                                                const struct usb_ctrlrequest *c)
+{
+        return acc_ctrlrequest(cdev, c);
+}
+
+static struct android_usb_function accessory_function = {
+        .name           = "accessory",
+        .init           = accessory_function_init,
+        .cleanup        = accessory_function_cleanup,
+        .bind_config    = accessory_function_bind_config,
+        .ctrlrequest    = accessory_function_ctrlrequest,
+};
+
+
+static struct android_usb_function *supported_functions[] = {
+        &adb_function,
+        &acm_function,
+        &mtp_function,
+        &ptp_function,
+        &rndis_function,
+        &mass_storage_function,
+        &accessory_function,
+        NULL
+};
+
+
+static int android_init_functions(struct android_usb_function **functions,
+                                  struct usb_composite_dev *cdev)
+{
+        struct android_dev *dev = _android_dev;
+        struct android_usb_function *f;
+        struct device_attribute **attrs;
+        struct device_attribute *attr;
+        int err;
+        int index = 0;
+
+        for (; (f = *functions++); index++) {
+                f->dev_name = kasprintf(GFP_KERNEL, "f_%s", f->name);
+                f->dev = device_create(android_class, dev->dev,
+                                MKDEV(0, index), f, f->dev_name);
+                if (IS_ERR(f->dev)) {
+                        pr_err("%s: Failed to create dev %s", __func__,
+                                                        f->dev_name);
+                        err = PTR_ERR(f->dev);
+                        goto err_create;
+                }
+
+                if (f->init) {
+                        err = f->init(f, cdev);
+                        if (err) {
+                                pr_err("%s: Failed to init %s", __func__,
+                                                                f->name);
+                                goto err_out;
+                        }
+                }
+
+                attrs = f->attributes;
+                if (attrs) {
+                        while ((attr = *attrs++) && !err)
+                                err = device_create_file(f->dev, attr);
+                }
+                if (err) {
+                        pr_err("%s: Failed to create function %s attributes",
+                                        __func__, f->name);
+                        goto err_out;
+                }
+        }
+        return 0;
+
+err_out:
+        device_destroy(android_class, f->dev->devt);
+err_create:
+        kfree(f->dev_name);
+        return err;
+}
+
+static void android_cleanup_functions(struct android_usb_function **functions)
+{
+        struct android_usb_function *f;
+
+        while (*functions) {
+                f = *functions++;
+
+                if (f->dev) {
+                        device_destroy(android_class, f->dev->devt);
+                        kfree(f->dev_name);
+                }
+
+                if (f->cleanup)
+                        f->cleanup(f);
+        }
+}
+
+static int
+android_bind_enabled_functions(struct android_dev *dev,
+                               struct usb_configuration *c)
+{
+        struct android_usb_function *f;
+        int ret;
+
+        list_for_each_entry(f, &dev->enabled_functions, enabled_list) {
+                ret = f->bind_config(f, c);
+                if (ret) {
+                        pr_err("%s: %s failed", __func__, f->name);
+                        return ret;
+                }
+        }
+        return 0;
+}
+
+static void
+android_unbind_enabled_functions(struct android_dev *dev,
+                               struct usb_configuration *c)
+{
+        struct android_usb_function *f;
+
+        list_for_each_entry(f, &dev->enabled_functions, enabled_list) {
+                if (f->unbind_config)
+                        f->unbind_config(f, c);
+        }
+}
+
+static int android_enable_function(struct android_dev *dev, char *name)
+{
+        struct android_usb_function **functions = dev->functions;
+        struct android_usb_function *f;
+        while ((f = *functions++)) {
+                if (!strcmp(name, f->name)) {
+                        list_add_tail(&f->enabled_list, &dev->enabled_functions);
+                        return 0;
+                }
+        }
+        return -EINVAL;
+}
+
+/*-------------------------------------------------------------------------*/
+/* /sys/class/android_usb/android%d/ interface */
+
+static ssize_t
+functions_show(struct device *pdev, struct device_attribute *attr, char *buf)
+{
+        struct android_dev *dev = dev_get_drvdata(pdev);
+        struct android_usb_function *f;
+        char *buff = buf;
+
+        mutex_lock(&dev->mutex);
+
+        list_for_each_entry(f, &dev->enabled_functions, enabled_list)
+                buff += sprintf(buff, "%s,", f->name);
+
+        mutex_unlock(&dev->mutex);
+
+        if (buff != buf)
+                *(buff-1) = '\n';
+        return buff - buf;
+}
+
+static ssize_t
+functions_store(struct device *pdev, struct device_attribute *attr,
+                               const char *buff, size_t size)
+{
+        struct android_dev *dev = dev_get_drvdata(pdev);
+        char *name;
+        char buf[256], *b;
+        int err;
+
+        mutex_lock(&dev->mutex);
+
+        if (dev->enabled) {
+                mutex_unlock(&dev->mutex);
+                return -EBUSY;
+        }
+
+        INIT_LIST_HEAD(&dev->enabled_functions);
+
+        strncpy(buf, buff, sizeof(buf));
+        b = strim(buf);
+
+        while (b) {
+                name = strsep(&b, ",");
+                if (name) {
+                        err = android_enable_function(dev, name);
+                        if (err)
+                                pr_err("android_usb: Cannot enable '%s'", name);
+                }
+        }
+
+        mutex_unlock(&dev->mutex);
+
+        return size;
+}
+
+static ssize_t enable_show(struct device *pdev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct android_dev *dev = dev_get_drvdata(pdev);
+        return sprintf(buf, "%d\n", dev->enabled);
+}
+
+static ssize_t enable_store(struct device *pdev, struct device_attribute *attr,
+                            const char *buff, size_t size)
+{
+        struct android_dev *dev = dev_get_drvdata(pdev);
+        struct usb_composite_dev *cdev = dev->cdev;
+        int enabled = 0;
+
+        mutex_lock(&dev->mutex);
+
+        sscanf(buff, "%d", &enabled);
+        if (enabled && !dev->enabled) {
+                /* update values in composite driver's copy of device descriptor */
+                cdev->desc.idVendor = device_desc.idVendor;
+                cdev->desc.idProduct = device_desc.idProduct;
+                cdev->desc.bcdDevice = device_desc.bcdDevice;
+                cdev->desc.bDeviceClass = device_desc.bDeviceClass;
+                cdev->desc.bDeviceSubClass = device_desc.bDeviceSubClass;
+                cdev->desc.bDeviceProtocol = device_desc.bDeviceProtocol;
+                usb_add_config(cdev, &android_config_driver,
+                                        android_bind_config);
+                usb_gadget_connect(cdev->gadget);
+                dev->enabled = true;
+        } else if (!enabled && dev->enabled) {
+                usb_gadget_disconnect(cdev->gadget);
+                /* Cancel pending control requests */
+                usb_ep_dequeue(cdev->gadget->ep0, cdev->req);
+                usb_remove_config(cdev, &android_config_driver);
+                dev->enabled = false;
+        } else {
+                pr_err("android_usb: already %s\n",
+                                dev->enabled ? "enabled" : "disabled");
+        }
+
+        mutex_unlock(&dev->mutex);
+        return size;
+}
+
+static ssize_t state_show(struct device *pdev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct android_dev *dev = dev_get_drvdata(pdev);
+        struct usb_composite_dev *cdev = dev->cdev;
+        char *state = "DISCONNECTED";
+        unsigned long flags;
+
+        if (!cdev)
+                goto out;
+
+        spin_lock_irqsave(&cdev->lock, flags);
+        if (cdev->config)
+                state = "CONFIGURED";
+        else if (dev->connected)
+                state = "CONNECTED";
+        spin_unlock_irqrestore(&cdev->lock, flags);
+out:
+        return sprintf(buf, "%s\n", state);
+}
+
+#define DESCRIPTOR_ATTR(field, format_string)                           \
+static ssize_t                                                          \
+field ## _show(struct device *dev, struct device_attribute *attr,       \
+                char *buf)                                              \
+{                                                                       \
+        return sprintf(buf, format_string, device_desc.field);          \
+}                                                                       \
+static ssize_t                                                          \
+field ## _store(struct device *dev, struct device_attribute *attr,      \
+                const char *buf, size_t size)                           \
+{                                                                       \
+        int value;                                                      \
+        if (sscanf(buf, format_string, &value) == 1) {                  \
+                device_desc.field = value;                              \
+                return size;                                            \
+        }                                                               \
+        return -1;                                                      \
+}                                                                       \
+static DEVICE_ATTR(field, S_IRUGO | S_IWUSR, field ## _show, field ## _store);
+
+#define DESCRIPTOR_STRING_ATTR(field, buffer)                           \
+static ssize_t                                                          \
+field ## _show(struct device *dev, struct device_attribute *attr,       \
+                char *buf)                                              \
+{                                                                       \
+        return sprintf(buf, "%s", buffer);                              \
+}                                                                       \
+static ssize_t                                                          \
+field ## _store(struct device *dev, struct device_attribute *attr,      \
+                const char *buf, size_t size)                           \
+{                                                                       \
+        if (size >= sizeof(buffer)) return -EINVAL;                     \
+        if (sscanf(buf, "%s", buffer) == 1) {                           \
+                return size;                                            \
+        }                                                               \
+        return -1;                                                      \
+}                                                                       \
+static DEVICE_ATTR(field, S_IRUGO | S_IWUSR, field ## _show, field ## _store);
+
+
+DESCRIPTOR_ATTR(idVendor, "%04x\n")
+DESCRIPTOR_ATTR(idProduct, "%04x\n")
+DESCRIPTOR_ATTR(bcdDevice, "%04x\n")
+DESCRIPTOR_ATTR(bDeviceClass, "%d\n")
+DESCRIPTOR_ATTR(bDeviceSubClass, "%d\n")
+DESCRIPTOR_ATTR(bDeviceProtocol, "%d\n")
+DESCRIPTOR_STRING_ATTR(iManufacturer, manufacturer_string)
+DESCRIPTOR_STRING_ATTR(iProduct, product_string)
+DESCRIPTOR_STRING_ATTR(iSerial, serial_string)
+
+static DEVICE_ATTR(functions, S_IRUGO | S_IWUSR, functions_show, functions_store);
+static DEVICE_ATTR(enable, S_IRUGO | S_IWUSR, enable_show, enable_store);
+static DEVICE_ATTR(state, S_IRUGO, state_show, NULL);
+
+static struct device_attribute *android_usb_attributes[] = {
+        &dev_attr_idVendor,
+        &dev_attr_idProduct,
+        &dev_attr_bcdDevice,
+        &dev_attr_bDeviceClass,
+        &dev_attr_bDeviceSubClass,
+        &dev_attr_bDeviceProtocol,
+        &dev_attr_iManufacturer,
+        &dev_attr_iProduct,
+        &dev_attr_iSerial,
+        &dev_attr_functions,
+        &dev_attr_enable,
+        &dev_attr_state,
+        NULL
+};
+
+/*-------------------------------------------------------------------------*/
+/* Composite driver */
+
+static int android_bind_config(struct usb_configuration *c)
+{
+        struct android_dev *dev = _android_dev;
+        int ret = 0;
+
+        ret = android_bind_enabled_functions(dev, c);
+        if (ret)
+                return ret;
+
+        return 0;
+}
+
+static void android_unbind_config(struct usb_configuration *c)
+{
+        struct android_dev *dev = _android_dev;
+
+        android_unbind_enabled_functions(dev, c);
+}
+
+static int android_bind(struct usb_composite_dev *cdev)
+{
+        struct android_dev *dev = _android_dev;
+        struct usb_gadget       *gadget = cdev->gadget;
+        int                     gcnum, id, ret;
+
+        usb_gadget_disconnect(gadget);
+
+        ret = android_init_functions(dev->functions, cdev);
+        if (ret)
+                return ret;
+
+        /* Allocate string descriptor numbers ... note that string
+         * contents can be overridden by the composite_dev glue.
+         */
+        id = usb_string_id(cdev);
+        if (id < 0)
+                return id;
+        strings_dev[STRING_MANUFACTURER_IDX].id = id;
+        device_desc.iManufacturer = id;
+
+        id = usb_string_id(cdev);
+        if (id < 0)
+                return id;
+        strings_dev[STRING_PRODUCT_IDX].id = id;
+        device_desc.iProduct = id;
+
+        /* Default strings - should be updated by userspace */
+        strncpy(manufacturer_string, "Android", sizeof(manufacturer_string) - 1);
+        strncpy(product_string, "Android", sizeof(product_string) - 1);
+        strncpy(serial_string, "0123456789ABCDEF", sizeof(serial_string) - 1);
+
+        id = usb_string_id(cdev);
+        if (id < 0)
+                return id;
+        strings_dev[STRING_SERIAL_IDX].id = id;
+        device_desc.iSerialNumber = id;
+
+        gcnum = usb_gadget_controller_number(gadget);
+        if (gcnum >= 0)
+                device_desc.bcdDevice = cpu_to_le16(0x0200 + gcnum);
+        else {
+                /* gadget zero is so simple (for now, no altsettings) that
+                 * it SHOULD NOT have problems with bulk-capable hardware.
+                 * so just warn about unrcognized controllers -- don't panic.
+                 *
+                 * things like configuration and altsetting numbering
+                 * can need hardware-specific attention though.
+                 */
+                pr_warning("%s: controller '%s' not recognized\n",
+                        longname, gadget->name);
+                device_desc.bcdDevice = __constant_cpu_to_le16(0x9999);
+        }
+
+        dev->cdev = cdev;
+
+        return 0;
+}
+
+static int android_usb_unbind(struct usb_composite_dev *cdev)
+{
+        struct android_dev *dev = _android_dev;
+
+        cancel_work_sync(&dev->work);
+        android_cleanup_functions(dev->functions);
+        return 0;
+}
+
+static struct usb_composite_driver android_usb_driver = {
+        .name           = "android_usb",
+        .dev            = &device_desc,
+        .strings        = dev_strings,
+        .unbind         = android_usb_unbind,
+        .max_speed      = USB_SPEED_HIGH,
+};
+
+static int
+android_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *c)
+{
+        struct android_dev              *dev = _android_dev;
+        struct usb_composite_dev        *cdev = get_gadget_data(gadget);
+        struct usb_request              *req = cdev->req;
+        struct android_usb_function     *f;
+        int value = -EOPNOTSUPP;
+        unsigned long flags;
+
+        req->zero = 0;
+        req->complete = composite_setup_complete;
+        req->length = 0;
+        gadget->ep0->driver_data = cdev;
+
+        list_for_each_entry(f, &dev->enabled_functions, enabled_list) {
+                if (f->ctrlrequest) {
+                        value = f->ctrlrequest(f, cdev, c);
+                        if (value >= 0)
+                                break;
+                }
+        }
+
+        /* Special case the accessory function.
+         * It needs to handle control requests before it is enabled.
+         */
+        if (value < 0)
+                value = acc_ctrlrequest(cdev, c);
+
+        if (value < 0)
+                value = composite_setup(gadget, c);
+
+        spin_lock_irqsave(&cdev->lock, flags);
+        if (!dev->connected) {
+                dev->connected = 1;
+                schedule_work(&dev->work);
+        }
+        else if (c->bRequest == USB_REQ_SET_CONFIGURATION && cdev->config) {
+                schedule_work(&dev->work);
+        }
+        spin_unlock_irqrestore(&cdev->lock, flags);
+
+        return value;
+}
+
+static void android_disconnect(struct usb_gadget *gadget)
+{
+        struct android_dev *dev = _android_dev;
+        struct usb_composite_dev *cdev = get_gadget_data(gadget);
+        unsigned long flags;
+
+        composite_disconnect(gadget);
+
+        spin_lock_irqsave(&cdev->lock, flags);
+        dev->connected = 0;
+        schedule_work(&dev->work);
+        spin_unlock_irqrestore(&cdev->lock, flags);
+}
+
+static int android_create_device(struct android_dev *dev)
+{
+        struct device_attribute **attrs = android_usb_attributes;
+        struct device_attribute *attr;
+        int err;
+
+        dev->dev = device_create(android_class, NULL,
+                                        MKDEV(0, 0), NULL, "android0");
+        if (IS_ERR(dev->dev))
+                return PTR_ERR(dev->dev);
+
+        dev_set_drvdata(dev->dev, dev);
+
+        while ((attr = *attrs++)) {
+                err = device_create_file(dev->dev, attr);
+                if (err) {
+                        device_destroy(android_class, dev->dev->devt);
+                        return err;
+                }
+        }
+        return 0;
+}
+
+
+static int __init init(void)
+{
+        struct android_dev *dev;
+        int err;
+
+        android_class = class_create(THIS_MODULE, "android_usb");
+        if (IS_ERR(android_class))
+                return PTR_ERR(android_class);
+
+        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+        if (!dev)
+                return -ENOMEM;
+
+        dev->functions = supported_functions;
+        INIT_LIST_HEAD(&dev->enabled_functions);
+        INIT_WORK(&dev->work, android_work);
+        mutex_init(&dev->mutex);
+
+        err = android_create_device(dev);
+        if (err) {
+                class_destroy(android_class);
+                kfree(dev);
+                return err;
+        }
+
+        _android_dev = dev;
+
+        /* Override composite driver functions */
+        composite_driver.setup = android_setup;
+        composite_driver.disconnect = android_disconnect;
+
+        return usb_composite_probe(&android_usb_driver, android_bind);
+}
+module_init(init);
+
+static void __exit cleanup(void)
+{
+        usb_composite_unregister(&android_usb_driver);
+        class_destroy(android_class);
+        kfree(_android_dev);
+        _android_dev = NULL;
+}
+module_exit(cleanup);
diff --git a/drivers/usb/gadget/ci13xxx_msm.c b/drivers/usb/gadget/ci13xxx_msm.c
new file mode 100644
index 00000000000..470981ad6f7
--- /dev/null
+++ b/drivers/usb/gadget/ci13xxx_msm.c
@@ -0,0 +1,135 @@
+/* Copyright (c) 2010, Code Aurora Forum. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+#include <linux/usb/msm_hsusb_hw.h>
+#include <linux/usb/ulpi.h>
+
+#include "ci13xxx_udc.c"
+
+#define MSM_USB_BASE    (udc->regs)
+
+static irqreturn_t msm_udc_irq(int irq, void *data)
+{
+        return udc_irq();
+}
+
+static void ci13xxx_msm_notify_event(struct ci13xxx *udc, unsigned event)
+{
+        struct device *dev = udc->gadget.dev.parent;
+        int val;
+
+        switch (event) {
+        case CI13XXX_CONTROLLER_RESET_EVENT:
+                dev_dbg(dev, "CI13XXX_CONTROLLER_RESET_EVENT received\n");
+                writel(0, USB_AHBBURST);
+                writel(0, USB_AHBMODE);
+                break;
+        case CI13XXX_CONTROLLER_STOPPED_EVENT:
+                dev_dbg(dev, "CI13XXX_CONTROLLER_STOPPED_EVENT received\n");
+                /*
+                 * Put the transceiver in non-driving mode. Otherwise host
+                 * may not detect soft-disconnection.
+                 */
+                val = otg_io_read(udc->transceiver, ULPI_FUNC_CTRL);
+                val &= ~ULPI_FUNC_CTRL_OPMODE_MASK;
+                val |= ULPI_FUNC_CTRL_OPMODE_NONDRIVING;
+                otg_io_write(udc->transceiver, val, ULPI_FUNC_CTRL);
+                break;
+        default:
+                dev_dbg(dev, "unknown ci13xxx_udc event\n");
+                break;
+        }
+}
+
+static struct ci13xxx_udc_driver ci13xxx_msm_udc_driver = {
+        .name                   = "ci13xxx_msm",
+        .flags                  = CI13XXX_REGS_SHARED |
+                                  CI13XXX_REQUIRE_TRANSCEIVER |
+                                  CI13XXX_PULLUP_ON_VBUS |
+                                  CI13XXX_DISABLE_STREAMING,
+
+        .notify_event           = ci13xxx_msm_notify_event,
+};
+
+static int ci13xxx_msm_probe(struct platform_device *pdev)
+{
+        struct resource *res;
+        void __iomem *regs;
+        int irq;
+        int ret;
+
+        dev_dbg(&pdev->dev, "ci13xxx_msm_probe\n");
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_err(&pdev->dev, "failed to get platform resource mem\n");
+                return -ENXIO;
+        }
+
+        regs = ioremap(res->start, resource_size(res));
+        if (!regs) {
+                dev_err(&pdev->dev, "ioremap failed\n");
+                return -ENOMEM;
+        }
+
+        ret = udc_probe(&ci13xxx_msm_udc_driver, &pdev->dev, regs);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "udc_probe failed\n");
+                goto iounmap;
+        }
+
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                dev_err(&pdev->dev, "IRQ not found\n");
+                ret = -ENXIO;
+                goto udc_remove;
+        }
+
+        ret = request_irq(irq, msm_udc_irq, IRQF_SHARED, pdev->name, pdev);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "request_irq failed\n");
+                goto udc_remove;
+        }
+
+        pm_runtime_no_callbacks(&pdev->dev);
+        pm_runtime_enable(&pdev->dev);
+
+        return 0;
+
+udc_remove:
+        udc_remove();
+iounmap:
+        iounmap(regs);
+
+        return ret;
+}
+
+static struct platform_driver ci13xxx_msm_driver = {
+        .probe = ci13xxx_msm_probe,
+        .driver = { .name = "msm_hsusb", },
+};
+MODULE_ALIAS("platform:msm_hsusb");
+
+static int __init ci13xxx_msm_init(void)
+{
+        return platform_driver_register(&ci13xxx_msm_driver);
+}
+module_init(ci13xxx_msm_init);
diff --git a/drivers/usb/gadget/ci13xxx_pci.c b/drivers/usb/gadget/ci13xxx_pci.c
new file mode 100644
index 00000000000..883ab5e832d
--- /dev/null
+++ b/drivers/usb/gadget/ci13xxx_pci.c
@@ -0,0 +1,176 @@
+/*
+ * ci13xxx_pci.c - MIPS USB IP core family device controller
+ *
+ * Copyright (C) 2008 Chipidea - MIPS Technologies, Inc. All rights reserved.
+ *
+ * Author: David Lopo
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/pci.h>
+
+#include "ci13xxx_udc.c"
+
+/* driver name */
+#define UDC_DRIVER_NAME   "ci13xxx_pci"
+
+/******************************************************************************
+ * PCI block
+ *****************************************************************************/
+/**
+ * ci13xxx_pci_irq: interrut handler
+ * @irq:  irq number
+ * @pdev: USB Device Controller interrupt source
+ *
+ * This function returns IRQ_HANDLED if the IRQ has been handled
+ * This is an ISR don't trace, use attribute interface instead
+ */
+static irqreturn_t ci13xxx_pci_irq(int irq, void *pdev)
+{
+        if (irq == 0) {
+                dev_err(&((struct pci_dev *)pdev)->dev, "Invalid IRQ0 usage!");
+                return IRQ_HANDLED;
+        }
+        return udc_irq();
+}
+
+static struct ci13xxx_udc_driver ci13xxx_pci_udc_driver = {
+        .name           = UDC_DRIVER_NAME,
+};
+
+/**
+ * ci13xxx_pci_probe: PCI probe
+ * @pdev: USB device controller being probed
+ * @id:   PCI hotplug ID connecting controller to UDC framework
+ *
+ * This function returns an error code
+ * Allocates basic PCI resources for this USB device controller, and then
+ * invokes the udc_probe() method to start the UDC associated with it
+ */
+static int __devinit ci13xxx_pci_probe(struct pci_dev *pdev,
+                                       const struct pci_device_id *id)
+{
+        void __iomem *regs = NULL;
+        int retval = 0;
+
+        if (id == NULL)
+                return -EINVAL;
+
+        retval = pci_enable_device(pdev);
+        if (retval)
+                goto done;
+
+        if (!pdev->irq) {
+                dev_err(&pdev->dev, "No IRQ, check BIOS/PCI setup!");
+                retval = -ENODEV;
+                goto disable_device;
+        }
+
+        retval = pci_request_regions(pdev, UDC_DRIVER_NAME);
+        if (retval)
+                goto disable_device;
+
+        /* BAR 0 holds all the registers */
+        regs = pci_iomap(pdev, 0, 0);
+        if (!regs) {
+                dev_err(&pdev->dev, "Error mapping memory!");
+                retval = -EFAULT;
+                goto release_regions;
+        }
+        pci_set_drvdata(pdev, (__force void *)regs);
+
+        pci_set_master(pdev);
+        pci_try_set_mwi(pdev);
+
+        retval = udc_probe(&ci13xxx_pci_udc_driver, &pdev->dev, regs);
+        if (retval)
+                goto iounmap;
+
+        /* our device does not have MSI capability */
+
+        retval = request_irq(pdev->irq, ci13xxx_pci_irq, IRQF_SHARED,
+                             UDC_DRIVER_NAME, pdev);
+        if (retval)
+                goto gadget_remove;
+
+        return 0;
+
+ gadget_remove:
+        udc_remove();
+ iounmap:
+        pci_iounmap(pdev, regs);
+ release_regions:
+        pci_release_regions(pdev);
+ disable_device:
+        pci_disable_device(pdev);
+ done:
+        return retval;
+}
+
+/**
+ * ci13xxx_pci_remove: PCI remove
+ * @pdev: USB Device Controller being removed
+ *
+ * Reverses the effect of ci13xxx_pci_probe(),
+ * first invoking the udc_remove() and then releases
+ * all PCI resources allocated for this USB device controller
+ */
+static void __devexit ci13xxx_pci_remove(struct pci_dev *pdev)
+{
+        free_irq(pdev->irq, pdev);
+        udc_remove();
+        pci_iounmap(pdev, (__force void __iomem *)pci_get_drvdata(pdev));
+        pci_release_regions(pdev);
+        pci_disable_device(pdev);
+}
+
+/**
+ * PCI device table
+ * PCI device structure
+ *
+ * Check "pci.h" for details
+ */
+static DEFINE_PCI_DEVICE_TABLE(ci13xxx_pci_id_table) = {
+        { PCI_DEVICE(0x153F, 0x1004) },
+        { PCI_DEVICE(0x153F, 0x1006) },
+        { 0, 0, 0, 0, 0, 0, 0 /* end: all zeroes */ }
+};
+MODULE_DEVICE_TABLE(pci, ci13xxx_pci_id_table);
+
+static struct pci_driver ci13xxx_pci_driver = {
+        .name         = UDC_DRIVER_NAME,
+        .id_table     = ci13xxx_pci_id_table,
+        .probe        = ci13xxx_pci_probe,
+        .remove       = __devexit_p(ci13xxx_pci_remove),
+};
+
+/**
+ * ci13xxx_pci_init: module init
+ *
+ * Driver load
+ */
+static int __init ci13xxx_pci_init(void)
+{
+        return pci_register_driver(&ci13xxx_pci_driver);
+}
+module_init(ci13xxx_pci_init);
+
+/**
+ * ci13xxx_pci_exit: module exit
+ *
+ * Driver unload
+ */
+static void __exit ci13xxx_pci_exit(void)
+{
+        pci_unregister_driver(&ci13xxx_pci_driver);
+}
+module_exit(ci13xxx_pci_exit);
+
+MODULE_AUTHOR("MIPS - David Lopo <dlopo@chipidea.mips.com>");
+MODULE_DESCRIPTION("MIPS CI13XXX USB Peripheral Controller");
+MODULE_LICENSE("GPL");
+MODULE_VERSION("June 2008");
diff --git a/drivers/usb/gadget/ci13xxx_udc.c b/drivers/usb/gadget/ci13xxx_udc.c
new file mode 100644
index 00000000000..1265a8502ea
--- /dev/null
+++ b/drivers/usb/gadget/ci13xxx_udc.c
@@ -0,0 +1,2977 @@
+/*
+ * ci13xxx_udc.c - MIPS USB IP core family device controller
+ *
+ * Copyright (C) 2008 Chipidea - MIPS Technologies, Inc. All rights reserved.
+ *
+ * Author: David Lopo
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/*
+ * Description: MIPS USB IP core family device controller
+ *              Currently it only supports IP part number CI13412
+ *
+ * This driver is composed of several blocks:
+ * - HW:     hardware interface
+ * - DBG:    debug facilities (optional)
+ * - UTIL:   utilities
+ * - ISR:    interrupts handling
+ * - ENDPT:  endpoint operations (Gadget API)
+ * - GADGET: gadget operations (Gadget API)
+ * - BUS:    bus glue code, bus abstraction layer
+ *
+ * Compile Options
+ * - CONFIG_USB_GADGET_DEBUG_FILES: enable debug facilities
+ * - STALL_IN:  non-empty bulk-in pipes cannot be halted
+ *              if defined mass storage compliance succeeds but with warnings
+ *              => case 4: Hi >  Dn
+ *              => case 5: Hi >  Di
+ *              => case 8: Hi <> Do
+ *              if undefined usbtest 13 fails
+ * - TRACE:     enable function tracing (depends on DEBUG)
+ *
+ * Main Features
+ * - Chapter 9 & Mass Storage Compliance with Gadget File Storage
+ * - Chapter 9 Compliance with Gadget Zero (STALL_IN undefined)
+ * - Normal & LPM support
+ *
+ * USBTEST Report
+ * - OK: 0-12, 13 (STALL_IN defined) & 14
+ * - Not Supported: 15 & 16 (ISO)
+ *
+ * TODO List
+ * - OTG
+ * - Isochronous & Interrupt Traffic
+ * - Handle requests which spawns into several TDs
+ * - GET_STATUS(device) - always reports 0
+ * - Gadget API (majority of optional features)
+ * - Suspend & Remote Wakeup
+ */
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/dmapool.h>
+#include <linux/dma-mapping.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/irq.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/pm_runtime.h>
+#include <linux/usb/ch9.h>
+#include <linux/usb/gadget.h>
+#include <linux/usb/otg.h>
+
+#include "ci13xxx_udc.h"
+
+
+/******************************************************************************
+ * DEFINE
+ *****************************************************************************/
+/* ctrl register bank access */
+static DEFINE_SPINLOCK(udc_lock);
+
+/* control endpoint description */
+static const struct usb_endpoint_descriptor
+ctrl_endpt_out_desc = {
+        .bLength         = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType = USB_DT_ENDPOINT,
+
+        .bEndpointAddress = USB_DIR_OUT,
+        .bmAttributes    = USB_ENDPOINT_XFER_CONTROL,
+        .wMaxPacketSize  = cpu_to_le16(CTRL_PAYLOAD_MAX),
+};
+
+static const struct usb_endpoint_descriptor
+ctrl_endpt_in_desc = {
+        .bLength         = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType = USB_DT_ENDPOINT,
+
+        .bEndpointAddress = USB_DIR_IN,
+        .bmAttributes    = USB_ENDPOINT_XFER_CONTROL,
+        .wMaxPacketSize  = cpu_to_le16(CTRL_PAYLOAD_MAX),
+};
+
+/* UDC descriptor */
+static struct ci13xxx *_udc;
+
+/* Interrupt statistics */
+#define ISR_MASK   0x1F
+static struct {
+        u32 test;
+        u32 ui;
+        u32 uei;
+        u32 pci;
+        u32 uri;
+        u32 sli;
+        u32 none;
+        struct {
+                u32 cnt;
+                u32 buf[ISR_MASK+1];
+                u32 idx;
+        } hndl;
+} isr_statistics;
+
+/**
+ * ffs_nr: find first (least significant) bit set
+ * @x: the word to search
+ *
+ * This function returns bit number (instead of position)
+ */
+static int ffs_nr(u32 x)
+{
+        int n = ffs(x);
+
+        return n ? n-1 : 32;
+}
+
+/******************************************************************************
+ * HW block
+ *****************************************************************************/
+/* register bank descriptor */
+static struct {
+        unsigned      lpm;    /* is LPM? */
+        void __iomem *abs;    /* bus map offset */
+        void __iomem *cap;    /* bus map offset + CAP offset + CAP data */
+        size_t        size;   /* bank size */
+} hw_bank;
+
+/* MSM specific */
+#define ABS_AHBBURST        (0x0090UL)
+#define ABS_AHBMODE         (0x0098UL)
+/* UDC register map */
+#define ABS_CAPLENGTH       (0x100UL)
+#define ABS_HCCPARAMS       (0x108UL)
+#define ABS_DCCPARAMS       (0x124UL)
+#define ABS_TESTMODE        (hw_bank.lpm ? 0x0FCUL : 0x138UL)
+/* offset to CAPLENTGH (addr + data) */
+#define CAP_USBCMD          (0x000UL)
+#define CAP_USBSTS          (0x004UL)
+#define CAP_USBINTR         (0x008UL)
+#define CAP_DEVICEADDR      (0x014UL)
+#define CAP_ENDPTLISTADDR   (0x018UL)
+#define CAP_PORTSC          (0x044UL)
+#define CAP_DEVLC           (0x084UL)
+#define CAP_USBMODE         (hw_bank.lpm ? 0x0C8UL : 0x068UL)
+#define CAP_ENDPTSETUPSTAT  (hw_bank.lpm ? 0x0D8UL : 0x06CUL)
+#define CAP_ENDPTPRIME      (hw_bank.lpm ? 0x0DCUL : 0x070UL)
+#define CAP_ENDPTFLUSH      (hw_bank.lpm ? 0x0E0UL : 0x074UL)
+#define CAP_ENDPTSTAT       (hw_bank.lpm ? 0x0E4UL : 0x078UL)
+#define CAP_ENDPTCOMPLETE   (hw_bank.lpm ? 0x0E8UL : 0x07CUL)
+#define CAP_ENDPTCTRL       (hw_bank.lpm ? 0x0ECUL : 0x080UL)
+#define CAP_LAST            (hw_bank.lpm ? 0x12CUL : 0x0C0UL)
+
+/* maximum number of enpoints: valid only after hw_device_reset() */
+static unsigned hw_ep_max;
+
+/**
+ * hw_ep_bit: calculates the bit number
+ * @num: endpoint number
+ * @dir: endpoint direction
+ *
+ * This function returns bit number
+ */
+static inline int hw_ep_bit(int num, int dir)
+{
+        return num + (dir ? 16 : 0);
+}
+
+/**
+ * hw_aread: reads from register bitfield
+ * @addr: address relative to bus map
+ * @mask: bitfield mask
+ *
+ * This function returns register bitfield data
+ */
+static u32 hw_aread(u32 addr, u32 mask)
+{
+        return ioread32(addr + hw_bank.abs) & mask;
+}
+
+/**
+ * hw_awrite: writes to register bitfield
+ * @addr: address relative to bus map
+ * @mask: bitfield mask
+ * @data: new data
+ */
+static void hw_awrite(u32 addr, u32 mask, u32 data)
+{
+        iowrite32(hw_aread(addr, ~mask) | (data & mask),
+                  addr + hw_bank.abs);
+}
+
+/**
+ * hw_cread: reads from register bitfield
+ * @addr: address relative to CAP offset plus content
+ * @mask: bitfield mask
+ *
+ * This function returns register bitfield data
+ */
+static u32 hw_cread(u32 addr, u32 mask)
+{
+        return ioread32(addr + hw_bank.cap) & mask;
+}
+
+/**
+ * hw_cwrite: writes to register bitfield
+ * @addr: address relative to CAP offset plus content
+ * @mask: bitfield mask
+ * @data: new data
+ */
+static void hw_cwrite(u32 addr, u32 mask, u32 data)
+{
+        iowrite32(hw_cread(addr, ~mask) | (data & mask),
+                  addr + hw_bank.cap);
+}
+
+/**
+ * hw_ctest_and_clear: tests & clears register bitfield
+ * @addr: address relative to CAP offset plus content
+ * @mask: bitfield mask
+ *
+ * This function returns register bitfield data
+ */
+static u32 hw_ctest_and_clear(u32 addr, u32 mask)
+{
+        u32 reg = hw_cread(addr, mask);
+
+        iowrite32(reg, addr + hw_bank.cap);
+        return reg;
+}
+
+/**
+ * hw_ctest_and_write: tests & writes register bitfield
+ * @addr: address relative to CAP offset plus content
+ * @mask: bitfield mask
+ * @data: new data
+ *
+ * This function returns register bitfield data
+ */
+static u32 hw_ctest_and_write(u32 addr, u32 mask, u32 data)
+{
+        u32 reg = hw_cread(addr, ~0);
+
+        iowrite32((reg & ~mask) | (data & mask), addr + hw_bank.cap);
+        return (reg & mask) >> ffs_nr(mask);
+}
+
+static int hw_device_init(void __iomem *base)
+{
+        u32 reg;
+
+        /* bank is a module variable */
+        hw_bank.abs = base;
+
+        hw_bank.cap = hw_bank.abs;
+        hw_bank.cap += ABS_CAPLENGTH;
+        hw_bank.cap += ioread8(hw_bank.cap);
+
+        reg = hw_aread(ABS_HCCPARAMS, HCCPARAMS_LEN) >> ffs_nr(HCCPARAMS_LEN);
+        hw_bank.lpm  = reg;
+        hw_bank.size = hw_bank.cap - hw_bank.abs;
+        hw_bank.size += CAP_LAST;
+        hw_bank.size /= sizeof(u32);
+
+        reg = hw_aread(ABS_DCCPARAMS, DCCPARAMS_DEN) >> ffs_nr(DCCPARAMS_DEN);
+        hw_ep_max = reg * 2;   /* cache hw ENDPT_MAX */
+
+        if (hw_ep_max == 0 || hw_ep_max > ENDPT_MAX)
+                return -ENODEV;
+
+        /* setup lock mode ? */
+
+        /* ENDPTSETUPSTAT is '0' by default */
+
+        /* HCSPARAMS.bf.ppc SHOULD BE zero for device */
+
+        return 0;
+}
+/**
+ * hw_device_reset: resets chip (execute without interruption)
+ * @base: register base address
+ *
+ * This function returns an error code
+ */
+static int hw_device_reset(struct ci13xxx *udc)
+{
+        /* should flush & stop before reset */
+        hw_cwrite(CAP_ENDPTFLUSH, ~0, ~0);
+        hw_cwrite(CAP_USBCMD, USBCMD_RS, 0);
+
+        hw_cwrite(CAP_USBCMD, USBCMD_RST, USBCMD_RST);
+        while (hw_cread(CAP_USBCMD, USBCMD_RST))
+                udelay(10);             /* not RTOS friendly */
+
+
+        if (udc->udc_driver->notify_event)
+                udc->udc_driver->notify_event(udc,
+                        CI13XXX_CONTROLLER_RESET_EVENT);
+
+        if (udc->udc_driver->flags & CI13XXX_DISABLE_STREAMING)
+                hw_cwrite(CAP_USBMODE, USBMODE_SDIS, USBMODE_SDIS);
+
+        /* USBMODE should be configured step by step */
+        hw_cwrite(CAP_USBMODE, USBMODE_CM, USBMODE_CM_IDLE);
+        hw_cwrite(CAP_USBMODE, USBMODE_CM, USBMODE_CM_DEVICE);
+        hw_cwrite(CAP_USBMODE, USBMODE_SLOM, USBMODE_SLOM);  /* HW >= 2.3 */
+
+        if (hw_cread(CAP_USBMODE, USBMODE_CM) != USBMODE_CM_DEVICE) {
+                pr_err("cannot enter in device mode");
+                pr_err("lpm = %i", hw_bank.lpm);
+                return -ENODEV;
+        }
+
+        return 0;
+}
+
+/**
+ * hw_device_state: enables/disables interrupts & starts/stops device (execute
+ *                  without interruption)
+ * @dma: 0 => disable, !0 => enable and set dma engine
+ *
+ * This function returns an error code
+ */
+static int hw_device_state(u32 dma)
+{
+        if (dma) {
+                hw_cwrite(CAP_ENDPTLISTADDR, ~0, dma);
+                /* interrupt, error, port change, reset, sleep/suspend */
+                hw_cwrite(CAP_USBINTR, ~0,
+                             USBi_UI|USBi_UEI|USBi_PCI|USBi_URI|USBi_SLI);
+                hw_cwrite(CAP_USBCMD, USBCMD_RS, USBCMD_RS);
+        } else {
+                hw_cwrite(CAP_USBCMD, USBCMD_RS, 0);
+                hw_cwrite(CAP_USBINTR, ~0, 0);
+        }
+        return 0;
+}
+
+/**
+ * hw_ep_flush: flush endpoint fifo (execute without interruption)
+ * @num: endpoint number
+ * @dir: endpoint direction
+ *
+ * This function returns an error code
+ */
+static int hw_ep_flush(int num, int dir)
+{
+        int n = hw_ep_bit(num, dir);
+
+        do {
+                /* flush any pending transfer */
+                hw_cwrite(CAP_ENDPTFLUSH, BIT(n), BIT(n));
+                while (hw_cread(CAP_ENDPTFLUSH, BIT(n)))
+                        cpu_relax();
+        } while (hw_cread(CAP_ENDPTSTAT, BIT(n)));
+
+        return 0;
+}
+
+/**
+ * hw_ep_disable: disables endpoint (execute without interruption)
+ * @num: endpoint number
+ * @dir: endpoint direction
+ *
+ * This function returns an error code
+ */
+static int hw_ep_disable(int num, int dir)
+{
+        hw_ep_flush(num, dir);
+        hw_cwrite(CAP_ENDPTCTRL + num * sizeof(u32),
+                  dir ? ENDPTCTRL_TXE : ENDPTCTRL_RXE, 0);
+        return 0;
+}
+
+/**
+ * hw_ep_enable: enables endpoint (execute without interruption)
+ * @num:  endpoint number
+ * @dir:  endpoint direction
+ * @type: endpoint type
+ *
+ * This function returns an error code
+ */
+static int hw_ep_enable(int num, int dir, int type)
+{
+        u32 mask, data;
+
+        if (dir) {
+                mask  = ENDPTCTRL_TXT;  /* type    */
+                data  = type << ffs_nr(mask);
+
+                mask |= ENDPTCTRL_TXS;  /* unstall */
+                mask |= ENDPTCTRL_TXR;  /* reset data toggle */
+                data |= ENDPTCTRL_TXR;
+                mask |= ENDPTCTRL_TXE;  /* enable  */
+                data |= ENDPTCTRL_TXE;
+        } else {
+                mask  = ENDPTCTRL_RXT;  /* type    */
+                data  = type << ffs_nr(mask);
+
+                mask |= ENDPTCTRL_RXS;  /* unstall */
+                mask |= ENDPTCTRL_RXR;  /* reset data toggle */
+                data |= ENDPTCTRL_RXR;
+                mask |= ENDPTCTRL_RXE;  /* enable  */
+                data |= ENDPTCTRL_RXE;
+        }
+        hw_cwrite(CAP_ENDPTCTRL + num * sizeof(u32), mask, data);
+        return 0;
+}
+
+/**
+ * hw_ep_get_halt: return endpoint halt status
+ * @num: endpoint number
+ * @dir: endpoint direction
+ *
+ * This function returns 1 if endpoint halted
+ */
+static int hw_ep_get_halt(int num, int dir)
+{
+        u32 mask = dir ? ENDPTCTRL_TXS : ENDPTCTRL_RXS;
+
+        return hw_cread(CAP_ENDPTCTRL + num * sizeof(u32), mask) ? 1 : 0;
+}
+
+/**
+ * hw_test_and_clear_setup_status: test & clear setup status (execute without
+ *                                 interruption)
+ * @n: bit number (endpoint)
+ *
+ * This function returns setup status
+ */
+static int hw_test_and_clear_setup_status(int n)
+{
+        return hw_ctest_and_clear(CAP_ENDPTSETUPSTAT, BIT(n));
+}
+
+/**
+ * hw_ep_prime: primes endpoint (execute without interruption)
+ * @num:     endpoint number
+ * @dir:     endpoint direction
+ * @is_ctrl: true if control endpoint
+ *
+ * This function returns an error code
+ */
+static int hw_ep_prime(int num, int dir, int is_ctrl)
+{
+        int n = hw_ep_bit(num, dir);
+
+        if (is_ctrl && dir == RX && hw_cread(CAP_ENDPTSETUPSTAT, BIT(num)))
+                return -EAGAIN;
+
+        hw_cwrite(CAP_ENDPTPRIME, BIT(n), BIT(n));
+
+        while (hw_cread(CAP_ENDPTPRIME, BIT(n)))
+                cpu_relax();
+        if (is_ctrl && dir == RX  && hw_cread(CAP_ENDPTSETUPSTAT, BIT(num)))
+                return -EAGAIN;
+
+        /* status shoult be tested according with manual but it doesn't work */
+        return 0;
+}
+
+/**
+ * hw_ep_set_halt: configures ep halt & resets data toggle after clear (execute
+ *                 without interruption)
+ * @num:   endpoint number
+ * @dir:   endpoint direction
+ * @value: true => stall, false => unstall
+ *
+ * This function returns an error code
+ */
+static int hw_ep_set_halt(int num, int dir, int value)
+{
+        if (value != 0 && value != 1)
+                return -EINVAL;
+
+        do {
+                u32 addr = CAP_ENDPTCTRL + num * sizeof(u32);
+                u32 mask_xs = dir ? ENDPTCTRL_TXS : ENDPTCTRL_RXS;
+                u32 mask_xr = dir ? ENDPTCTRL_TXR : ENDPTCTRL_RXR;
+
+                /* data toggle - reserved for EP0 but it's in ESS */
+                hw_cwrite(addr, mask_xs|mask_xr, value ? mask_xs : mask_xr);
+
+        } while (value != hw_ep_get_halt(num, dir));
+
+        return 0;
+}
+
+/**
+ * hw_intr_clear: disables interrupt & clears interrupt status (execute without
+ *                interruption)
+ * @n: interrupt bit
+ *
+ * This function returns an error code
+ */
+static int hw_intr_clear(int n)
+{
+        if (n >= REG_BITS)
+                return -EINVAL;
+
+        hw_cwrite(CAP_USBINTR, BIT(n), 0);
+        hw_cwrite(CAP_USBSTS,  BIT(n), BIT(n));
+        return 0;
+}
+
+/**
+ * hw_intr_force: enables interrupt & forces interrupt status (execute without
+ *                interruption)
+ * @n: interrupt bit
+ *
+ * This function returns an error code
+ */
+static int hw_intr_force(int n)
+{
+        if (n >= REG_BITS)
+                return -EINVAL;
+
+        hw_awrite(ABS_TESTMODE, TESTMODE_FORCE, TESTMODE_FORCE);
+        hw_cwrite(CAP_USBINTR,  BIT(n), BIT(n));
+        hw_cwrite(CAP_USBSTS,   BIT(n), BIT(n));
+        hw_awrite(ABS_TESTMODE, TESTMODE_FORCE, 0);
+        return 0;
+}
+
+/**
+ * hw_is_port_high_speed: test if port is high speed
+ *
+ * This function returns true if high speed port
+ */
+static int hw_port_is_high_speed(void)
+{
+        return hw_bank.lpm ? hw_cread(CAP_DEVLC, DEVLC_PSPD) :
+                hw_cread(CAP_PORTSC, PORTSC_HSP);
+}
+
+/**
+ * hw_port_test_get: reads port test mode value
+ *
+ * This function returns port test mode value
+ */
+static u8 hw_port_test_get(void)
+{
+        return hw_cread(CAP_PORTSC, PORTSC_PTC) >> ffs_nr(PORTSC_PTC);
+}
+
+/**
+ * hw_port_test_set: writes port test mode (execute without interruption)
+ * @mode: new value
+ *
+ * This function returns an error code
+ */
+static int hw_port_test_set(u8 mode)
+{
+        const u8 TEST_MODE_MAX = 7;
+
+        if (mode > TEST_MODE_MAX)
+                return -EINVAL;
+
+        hw_cwrite(CAP_PORTSC, PORTSC_PTC, mode << ffs_nr(PORTSC_PTC));
+        return 0;
+}
+
+/**
+ * hw_read_intr_enable: returns interrupt enable register
+ *
+ * This function returns register data
+ */
+static u32 hw_read_intr_enable(void)
+{
+        return hw_cread(CAP_USBINTR, ~0);
+}
+
+/**
+ * hw_read_intr_status: returns interrupt status register
+ *
+ * This function returns register data
+ */
+static u32 hw_read_intr_status(void)
+{
+        return hw_cread(CAP_USBSTS, ~0);
+}
+
+/**
+ * hw_register_read: reads all device registers (execute without interruption)
+ * @buf:  destination buffer
+ * @size: buffer size
+ *
+ * This function returns number of registers read
+ */
+static size_t hw_register_read(u32 *buf, size_t size)
+{
+        unsigned i;
+
+        if (size > hw_bank.size)
+                size = hw_bank.size;
+
+        for (i = 0; i < size; i++)
+                buf[i] = hw_aread(i * sizeof(u32), ~0);
+
+        return size;
+}
+
+/**
+ * hw_register_write: writes to register
+ * @addr: register address
+ * @data: register value
+ *
+ * This function returns an error code
+ */
+static int hw_register_write(u16 addr, u32 data)
+{
+        /* align */
+        addr /= sizeof(u32);
+
+        if (addr >= hw_bank.size)
+                return -EINVAL;
+
+        /* align */
+        addr *= sizeof(u32);
+
+        hw_awrite(addr, ~0, data);
+        return 0;
+}
+
+/**
+ * hw_test_and_clear_complete: test & clear complete status (execute without
+ *                             interruption)
+ * @n: bit number (endpoint)
+ *
+ * This function returns complete status
+ */
+static int hw_test_and_clear_complete(int n)
+{
+        return hw_ctest_and_clear(CAP_ENDPTCOMPLETE, BIT(n));
+}
+
+/**
+ * hw_test_and_clear_intr_active: test & clear active interrupts (execute
+ *                                without interruption)
+ *
+ * This function returns active interrutps
+ */
+static u32 hw_test_and_clear_intr_active(void)
+{
+        u32 reg = hw_read_intr_status() & hw_read_intr_enable();
+
+        hw_cwrite(CAP_USBSTS, ~0, reg);
+        return reg;
+}
+
+/**
+ * hw_test_and_clear_setup_guard: test & clear setup guard (execute without
+ *                                interruption)
+ *
+ * This function returns guard value
+ */
+static int hw_test_and_clear_setup_guard(void)
+{
+        return hw_ctest_and_write(CAP_USBCMD, USBCMD_SUTW, 0);
+}
+
+/**
+ * hw_test_and_set_setup_guard: test & set setup guard (execute without
+ *                              interruption)
+ *
+ * This function returns guard value
+ */
+static int hw_test_and_set_setup_guard(void)
+{
+        return hw_ctest_and_write(CAP_USBCMD, USBCMD_SUTW, USBCMD_SUTW);
+}
+
+/**
+ * hw_usb_set_address: configures USB address (execute without interruption)
+ * @value: new USB address
+ *
+ * This function returns an error code
+ */
+static int hw_usb_set_address(u8 value)
+{
+        /* advance */
+        hw_cwrite(CAP_DEVICEADDR, DEVICEADDR_USBADR | DEVICEADDR_USBADRA,
+                  value << ffs_nr(DEVICEADDR_USBADR) | DEVICEADDR_USBADRA);
+        return 0;
+}
+
+/**
+ * hw_usb_reset: restart device after a bus reset (execute without
+ *               interruption)
+ *
+ * This function returns an error code
+ */
+static int hw_usb_reset(void)
+{
+        hw_usb_set_address(0);
+
+        /* ESS flushes only at end?!? */
+        hw_cwrite(CAP_ENDPTFLUSH,    ~0, ~0);   /* flush all EPs */
+
+        /* clear setup token semaphores */
+        hw_cwrite(CAP_ENDPTSETUPSTAT, 0,  0);   /* writes its content */
+
+        /* clear complete status */
+        hw_cwrite(CAP_ENDPTCOMPLETE,  0,  0);   /* writes its content */
+
+        /* wait until all bits cleared */
+        while (hw_cread(CAP_ENDPTPRIME, ~0))
+                udelay(10);             /* not RTOS friendly */
+
+        /* reset all endpoints ? */
+
+        /* reset internal status and wait for further instructions
+           no need to verify the port reset status (ESS does it) */
+
+        return 0;
+}
+
+/******************************************************************************
+ * DBG block
+ *****************************************************************************/
+/**
+ * show_device: prints information about device capabilities and status
+ *
+ * Check "device.h" for details
+ */
+static ssize_t show_device(struct device *dev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev);
+        struct usb_gadget *gadget = &udc->gadget;
+        int n = 0;
+
+        dbg_trace("[%s] %p\n", __func__, buf);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                return 0;
+        }
+
+        n += scnprintf(buf + n, PAGE_SIZE - n, "speed             = %d\n",
+                       gadget->speed);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "is_dualspeed      = %d\n",
+                       gadget->is_dualspeed);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "is_otg            = %d\n",
+                       gadget->is_otg);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "is_a_peripheral   = %d\n",
+                       gadget->is_a_peripheral);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "b_hnp_enable      = %d\n",
+                       gadget->b_hnp_enable);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "a_hnp_support     = %d\n",
+                       gadget->a_hnp_support);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "a_alt_hnp_support = %d\n",
+                       gadget->a_alt_hnp_support);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "name              = %s\n",
+                       (gadget->name ? gadget->name : ""));
+
+        return n;
+}
+static DEVICE_ATTR(device, S_IRUSR, show_device, NULL);
+
+/**
+ * show_driver: prints information about attached gadget (if any)
+ *
+ * Check "device.h" for details
+ */
+static ssize_t show_driver(struct device *dev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev);
+        struct usb_gadget_driver *driver = udc->driver;
+        int n = 0;
+
+        dbg_trace("[%s] %p\n", __func__, buf);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                return 0;
+        }
+
+        if (driver == NULL)
+                return scnprintf(buf, PAGE_SIZE,
+                                 "There is no gadget attached!\n");
+
+        n += scnprintf(buf + n, PAGE_SIZE - n, "function  = %s\n",
+                       (driver->function ? driver->function : ""));
+        n += scnprintf(buf + n, PAGE_SIZE - n, "max speed = %d\n",
+                       driver->speed);
+
+        return n;
+}
+static DEVICE_ATTR(driver, S_IRUSR, show_driver, NULL);
+
+/* Maximum event message length */
+#define DBG_DATA_MSG   64UL
+
+/* Maximum event messages */
+#define DBG_DATA_MAX   128UL
+
+/* Event buffer descriptor */
+static struct {
+        char     (buf[DBG_DATA_MAX])[DBG_DATA_MSG];   /* buffer */
+        unsigned idx;   /* index */
+        unsigned tty;   /* print to console? */
+        rwlock_t lck;   /* lock */
+} dbg_data = {
+        .idx = 0,
+        .tty = 0,
+        .lck = __RW_LOCK_UNLOCKED(lck)
+};
+
+/**
+ * dbg_dec: decrements debug event index
+ * @idx: buffer index
+ */
+static void dbg_dec(unsigned *idx)
+{
+        *idx = (*idx - 1) & (DBG_DATA_MAX-1);
+}
+
+/**
+ * dbg_inc: increments debug event index
+ * @idx: buffer index
+ */
+static void dbg_inc(unsigned *idx)
+{
+        *idx = (*idx + 1) & (DBG_DATA_MAX-1);
+}
+
+/**
+ * dbg_print:  prints the common part of the event
+ * @addr:   endpoint address
+ * @name:   event name
+ * @status: status
+ * @extra:  extra information
+ */
+static void dbg_print(u8 addr, const char *name, int status, const char *extra)
+{
+        struct timeval tval;
+        unsigned int stamp;
+        unsigned long flags;
+
+        write_lock_irqsave(&dbg_data.lck, flags);
+
+        do_gettimeofday(&tval);
+        stamp = tval.tv_sec & 0xFFFF;   /* 2^32 = 4294967296. Limit to 4096s */
+        stamp = stamp * 1000000 + tval.tv_usec;
+
+        scnprintf(dbg_data.buf[dbg_data.idx], DBG_DATA_MSG,
+                  "%04X\t? %02X %-7.7s %4i ?\t%s\n",
+                  stamp, addr, name, status, extra);
+
+        dbg_inc(&dbg_data.idx);
+
+        write_unlock_irqrestore(&dbg_data.lck, flags);
+
+        if (dbg_data.tty != 0)
+                pr_notice("%04X\t? %02X %-7.7s %4i ?\t%s\n",
+                          stamp, addr, name, status, extra);
+}
+
+/**
+ * dbg_done: prints a DONE event
+ * @addr:   endpoint address
+ * @td:     transfer descriptor
+ * @status: status
+ */
+static void dbg_done(u8 addr, const u32 token, int status)
+{
+        char msg[DBG_DATA_MSG];
+
+        scnprintf(msg, sizeof(msg), "%d %02X",
+                  (int)(token & TD_TOTAL_BYTES) >> ffs_nr(TD_TOTAL_BYTES),
+                  (int)(token & TD_STATUS)      >> ffs_nr(TD_STATUS));
+        dbg_print(addr, "DONE", status, msg);
+}
+
+/**
+ * dbg_event: prints a generic event
+ * @addr:   endpoint address
+ * @name:   event name
+ * @status: status
+ */
+static void dbg_event(u8 addr, const char *name, int status)
+{
+        if (name != NULL)
+                dbg_print(addr, name, status, "");
+}
+
+/*
+ * dbg_queue: prints a QUEUE event
+ * @addr:   endpoint address
+ * @req:    USB request
+ * @status: status
+ */
+static void dbg_queue(u8 addr, const struct usb_request *req, int status)
+{
+        char msg[DBG_DATA_MSG];
+
+        if (req != NULL) {
+                scnprintf(msg, sizeof(msg),
+                          "%d %d", !req->no_interrupt, req->length);
+                dbg_print(addr, "QUEUE", status, msg);
+        }
+}
+
+/**
+ * dbg_setup: prints a SETUP event
+ * @addr: endpoint address
+ * @req:  setup request
+ */
+static void dbg_setup(u8 addr, const struct usb_ctrlrequest *req)
+{
+        char msg[DBG_DATA_MSG];
+
+        if (req != NULL) {
+                scnprintf(msg, sizeof(msg),
+                          "%02X %02X %04X %04X %d", req->bRequestType,
+                          req->bRequest, le16_to_cpu(req->wValue),
+                          le16_to_cpu(req->wIndex), le16_to_cpu(req->wLength));
+                dbg_print(addr, "SETUP", 0, msg);
+        }
+}
+
+/**
+ * show_events: displays the event buffer
+ *
+ * Check "device.h" for details
+ */
+static ssize_t show_events(struct device *dev, struct device_attribute *attr,
+                           char *buf)
+{
+        unsigned long flags;
+        unsigned i, j, n = 0;
+
+        dbg_trace("[%s] %p\n", __func__, buf);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                return 0;
+        }
+
+        read_lock_irqsave(&dbg_data.lck, flags);
+
+        i = dbg_data.idx;
+        for (dbg_dec(&i); i != dbg_data.idx; dbg_dec(&i)) {
+                n += strlen(dbg_data.buf[i]);
+                if (n >= PAGE_SIZE) {
+                        n -= strlen(dbg_data.buf[i]);
+                        break;
+                }
+        }
+        for (j = 0, dbg_inc(&i); j < n; dbg_inc(&i))
+                j += scnprintf(buf + j, PAGE_SIZE - j,
+                               "%s", dbg_data.buf[i]);
+
+        read_unlock_irqrestore(&dbg_data.lck, flags);
+
+        return n;
+}
+
+/**
+ * store_events: configure if events are going to be also printed to console
+ *
+ * Check "device.h" for details
+ */
+static ssize_t store_events(struct device *dev, struct device_attribute *attr,
+                            const char *buf, size_t count)
+{
+        unsigned tty;
+
+        dbg_trace("[%s] %p, %d\n", __func__, buf, count);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                goto done;
+        }
+
+        if (sscanf(buf, "%u", &tty) != 1 || tty > 1) {
+                dev_err(dev, "<1|0>: enable|disable console log\n");
+                goto done;
+        }
+
+        dbg_data.tty = tty;
+        dev_info(dev, "tty = %u", dbg_data.tty);
+
+ done:
+        return count;
+}
+static DEVICE_ATTR(events, S_IRUSR | S_IWUSR, show_events, store_events);
+
+/**
+ * show_inters: interrupt status, enable status and historic
+ *
+ * Check "device.h" for details
+ */
+static ssize_t show_inters(struct device *dev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev);
+        unsigned long flags;
+        u32 intr;
+        unsigned i, j, n = 0;
+
+        dbg_trace("[%s] %p\n", __func__, buf);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                return 0;
+        }
+
+        spin_lock_irqsave(udc->lock, flags);
+
+        n += scnprintf(buf + n, PAGE_SIZE - n,
+                       "status = %08x\n", hw_read_intr_status());
+        n += scnprintf(buf + n, PAGE_SIZE - n,
+                       "enable = %08x\n", hw_read_intr_enable());
+
+        n += scnprintf(buf + n, PAGE_SIZE - n, "*test = %d\n",
+                       isr_statistics.test);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "? ui  = %d\n",
+                       isr_statistics.ui);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "? uei = %d\n",
+                       isr_statistics.uei);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "? pci = %d\n",
+                       isr_statistics.pci);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "? uri = %d\n",
+                       isr_statistics.uri);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "? sli = %d\n",
+                       isr_statistics.sli);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "*none = %d\n",
+                       isr_statistics.none);
+        n += scnprintf(buf + n, PAGE_SIZE - n, "*hndl = %d\n",
+                       isr_statistics.hndl.cnt);
+
+        for (i = isr_statistics.hndl.idx, j = 0; j <= ISR_MASK; j++, i++) {
+                i   &= ISR_MASK;
+                intr = isr_statistics.hndl.buf[i];
+
+                if (USBi_UI  & intr)
+                        n += scnprintf(buf + n, PAGE_SIZE - n, "ui  ");
+                intr &= ~USBi_UI;
+                if (USBi_UEI & intr)
+                        n += scnprintf(buf + n, PAGE_SIZE - n, "uei ");
+                intr &= ~USBi_UEI;
+                if (USBi_PCI & intr)
+                        n += scnprintf(buf + n, PAGE_SIZE - n, "pci ");
+                intr &= ~USBi_PCI;
+                if (USBi_URI & intr)
+                        n += scnprintf(buf + n, PAGE_SIZE - n, "uri ");
+                intr &= ~USBi_URI;
+                if (USBi_SLI & intr)
+                        n += scnprintf(buf + n, PAGE_SIZE - n, "sli ");
+                intr &= ~USBi_SLI;
+                if (intr)
+                        n += scnprintf(buf + n, PAGE_SIZE - n, "??? ");
+                if (isr_statistics.hndl.buf[i])
+                        n += scnprintf(buf + n, PAGE_SIZE - n, "\n");
+        }
+
+        spin_unlock_irqrestore(udc->lock, flags);
+
+        return n;
+}
+
+/**
+ * store_inters: enable & force or disable an individual interrutps
+ *                   (to be used for test purposes only)
+ *
+ * Check "device.h" for details
+ */
+static ssize_t store_inters(struct device *dev, struct device_attribute *attr,
+                            const char *buf, size_t count)
+{
+        struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev);
+        unsigned long flags;
+        unsigned en, bit;
+
+        dbg_trace("[%s] %p, %d\n", __func__, buf, count);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                goto done;
+        }
+
+        if (sscanf(buf, "%u %u", &en, &bit) != 2 || en > 1) {
+                dev_err(dev, "<1|0> <bit>: enable|disable interrupt");
+                goto done;
+        }
+
+        spin_lock_irqsave(udc->lock, flags);
+        if (en) {
+                if (hw_intr_force(bit))
+                        dev_err(dev, "invalid bit number\n");
+                else
+                        isr_statistics.test++;
+        } else {
+                if (hw_intr_clear(bit))
+                        dev_err(dev, "invalid bit number\n");
+        }
+        spin_unlock_irqrestore(udc->lock, flags);
+
+ done:
+        return count;
+}
+static DEVICE_ATTR(inters, S_IRUSR | S_IWUSR, show_inters, store_inters);
+
+/**
+ * show_port_test: reads port test mode
+ *
+ * Check "device.h" for details
+ */
+static ssize_t show_port_test(struct device *dev,
+                              struct device_attribute *attr, char *buf)
+{
+        struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev);
+        unsigned long flags;
+        unsigned mode;
+
+        dbg_trace("[%s] %p\n", __func__, buf);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                return 0;
+        }
+
+        spin_lock_irqsave(udc->lock, flags);
+        mode = hw_port_test_get();
+        spin_unlock_irqrestore(udc->lock, flags);
+
+        return scnprintf(buf, PAGE_SIZE, "mode = %u\n", mode);
+}
+
+/**
+ * store_port_test: writes port test mode
+ *
+ * Check "device.h" for details
+ */
+static ssize_t store_port_test(struct device *dev,
+                               struct device_attribute *attr,
+                               const char *buf, size_t count)
+{
+        struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev);
+        unsigned long flags;
+        unsigned mode;
+
+        dbg_trace("[%s] %p, %d\n", __func__, buf, count);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                goto done;
+        }
+
+        if (sscanf(buf, "%u", &mode) != 1) {
+                dev_err(dev, "<mode>: set port test mode");
+                goto done;
+        }
+
+        spin_lock_irqsave(udc->lock, flags);
+        if (hw_port_test_set(mode))
+                dev_err(dev, "invalid mode\n");
+        spin_unlock_irqrestore(udc->lock, flags);
+
+ done:
+        return count;
+}
+static DEVICE_ATTR(port_test, S_IRUSR | S_IWUSR,
+                   show_port_test, store_port_test);
+
+/**
+ * show_qheads: DMA contents of all queue heads
+ *
+ * Check "device.h" for details
+ */
+static ssize_t show_qheads(struct device *dev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev);
+        unsigned long flags;
+        unsigned i, j, n = 0;
+
+        dbg_trace("[%s] %p\n", __func__, buf);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                return 0;
+        }
+
+        spin_lock_irqsave(udc->lock, flags);
+        for (i = 0; i < hw_ep_max/2; i++) {
+                struct ci13xxx_ep *mEpRx = &udc->ci13xxx_ep[i];
+                struct ci13xxx_ep *mEpTx = &udc->ci13xxx_ep[i + hw_ep_max/2];
+                n += scnprintf(buf + n, PAGE_SIZE - n,
+                               "EP=%02i: RX=%08X TX=%08X\n",
+                               i, (u32)mEpRx->qh.dma, (u32)mEpTx->qh.dma);
+                for (j = 0; j < (sizeof(struct ci13xxx_qh)/sizeof(u32)); j++) {
+                        n += scnprintf(buf + n, PAGE_SIZE - n,
+                                       " %04X:    %08X    %08X\n", j,
+                                       *((u32 *)mEpRx->qh.ptr + j),
+                                       *((u32 *)mEpTx->qh.ptr + j));
+                }
+        }
+        spin_unlock_irqrestore(udc->lock, flags);
+
+        return n;
+}
+static DEVICE_ATTR(qheads, S_IRUSR, show_qheads, NULL);
+
+/**
+ * show_registers: dumps all registers
+ *
+ * Check "device.h" for details
+ */
+#define DUMP_ENTRIES    512
+static ssize_t show_registers(struct device *dev,
+                              struct device_attribute *attr, char *buf)
+{
+        struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev);
+        unsigned long flags;
+        u32 *dump;
+        unsigned i, k, n = 0;
+
+        dbg_trace("[%s] %p\n", __func__, buf);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                return 0;
+        }
+
+        dump = kmalloc(sizeof(u32) * DUMP_ENTRIES, GFP_KERNEL);
+        if (!dump) {
+                dev_err(dev, "%s: out of memory\n", __func__);
+                return 0;
+        }
+
+        spin_lock_irqsave(udc->lock, flags);
+        k = hw_register_read(dump, DUMP_ENTRIES);
+        spin_unlock_irqrestore(udc->lock, flags);
+
+        for (i = 0; i < k; i++) {
+                n += scnprintf(buf + n, PAGE_SIZE - n,
+                               "reg[0x%04X] = 0x%08X\n",
+                               i * (unsigned)sizeof(u32), dump[i]);
+        }
+        kfree(dump);
+
+        return n;
+}
+
+/**
+ * store_registers: writes value to register address
+ *
+ * Check "device.h" for details
+ */
+static ssize_t store_registers(struct device *dev,
+                               struct device_attribute *attr,
+                               const char *buf, size_t count)
+{
+        struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev);
+        unsigned long addr, data, flags;
+
+        dbg_trace("[%s] %p, %d\n", __func__, buf, count);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                goto done;
+        }
+
+        if (sscanf(buf, "%li %li", &addr, &data) != 2) {
+                dev_err(dev, "<addr> <data>: write data to register address");
+                goto done;
+        }
+
+        spin_lock_irqsave(udc->lock, flags);
+        if (hw_register_write(addr, data))
+                dev_err(dev, "invalid address range\n");
+        spin_unlock_irqrestore(udc->lock, flags);
+
+ done:
+        return count;
+}
+static DEVICE_ATTR(registers, S_IRUSR | S_IWUSR,
+                   show_registers, store_registers);
+
+/**
+ * show_requests: DMA contents of all requests currently queued (all endpts)
+ *
+ * Check "device.h" for details
+ */
+static ssize_t show_requests(struct device *dev, struct device_attribute *attr,
+                             char *buf)
+{
+        struct ci13xxx *udc = container_of(dev, struct ci13xxx, gadget.dev);
+        unsigned long flags;
+        struct list_head   *ptr = NULL;
+        struct ci13xxx_req *req = NULL;
+        unsigned i, j, n = 0, qSize = sizeof(struct ci13xxx_td)/sizeof(u32);
+
+        dbg_trace("[%s] %p\n", __func__, buf);
+        if (attr == NULL || buf == NULL) {
+                dev_err(dev, "[%s] EINVAL\n", __func__);
+                return 0;
+        }
+
+        spin_lock_irqsave(udc->lock, flags);
+        for (i = 0; i < hw_ep_max; i++)
+                list_for_each(ptr, &udc->ci13xxx_ep[i].qh.queue)
+                {
+                        req = list_entry(ptr, struct ci13xxx_req, queue);
+
+                        n += scnprintf(buf + n, PAGE_SIZE - n,
+                                        "EP=%02i: TD=%08X %s\n",
+                                        i % hw_ep_max/2, (u32)req->dma,
+                                        ((i < hw_ep_max/2) ? "RX" : "TX"));
+
+                        for (j = 0; j < qSize; j++)
+                                n += scnprintf(buf + n, PAGE_SIZE - n,
+                                                " %04X:    %08X\n", j,
+                                                *((u32 *)req->ptr + j));
+                }
+        spin_unlock_irqrestore(udc->lock, flags);
+
+        return n;
+}
+static DEVICE_ATTR(requests, S_IRUSR, show_requests, NULL);
+
+/**
+ * dbg_create_files: initializes the attribute interface
+ * @dev: device
+ *
+ * This function returns an error code
+ */
+__maybe_unused static int dbg_create_files(struct device *dev)
+{
+        int retval = 0;
+
+        if (dev == NULL)
+                return -EINVAL;
+        retval = device_create_file(dev, &dev_attr_device);
+        if (retval)
+                goto done;
+        retval = device_create_file(dev, &dev_attr_driver);
+        if (retval)
+                goto rm_device;
+        retval = device_create_file(dev, &dev_attr_events);
+        if (retval)
+                goto rm_driver;
+        retval = device_create_file(dev, &dev_attr_inters);
+        if (retval)
+                goto rm_events;
+        retval = device_create_file(dev, &dev_attr_port_test);
+        if (retval)
+                goto rm_inters;
+        retval = device_create_file(dev, &dev_attr_qheads);
+        if (retval)
+                goto rm_port_test;
+        retval = device_create_file(dev, &dev_attr_registers);
+        if (retval)
+                goto rm_qheads;
+        retval = device_create_file(dev, &dev_attr_requests);
+        if (retval)
+                goto rm_registers;
+        return 0;
+
+ rm_registers:
+        device_remove_file(dev, &dev_attr_registers);
+ rm_qheads:
+        device_remove_file(dev, &dev_attr_qheads);
+ rm_port_test:
+        device_remove_file(dev, &dev_attr_port_test);
+ rm_inters:
+        device_remove_file(dev, &dev_attr_inters);
+ rm_events:
+        device_remove_file(dev, &dev_attr_events);
+ rm_driver:
+        device_remove_file(dev, &dev_attr_driver);
+ rm_device:
+        device_remove_file(dev, &dev_attr_device);
+ done:
+        return retval;
+}
+
+/**
+ * dbg_remove_files: destroys the attribute interface
+ * @dev: device
+ *
+ * This function returns an error code
+ */
+__maybe_unused static int dbg_remove_files(struct device *dev)
+{
+        if (dev == NULL)
+                return -EINVAL;
+        device_remove_file(dev, &dev_attr_requests);
+        device_remove_file(dev, &dev_attr_registers);
+        device_remove_file(dev, &dev_attr_qheads);
+        device_remove_file(dev, &dev_attr_port_test);
+        device_remove_file(dev, &dev_attr_inters);
+        device_remove_file(dev, &dev_attr_events);
+        device_remove_file(dev, &dev_attr_driver);
+        device_remove_file(dev, &dev_attr_device);
+        return 0;
+}
+
+/******************************************************************************
+ * UTIL block
+ *****************************************************************************/
+/**
+ * _usb_addr: calculates endpoint address from direction & number
+ * @ep:  endpoint
+ */
+static inline u8 _usb_addr(struct ci13xxx_ep *ep)
+{
+        return ((ep->dir == TX) ? USB_ENDPOINT_DIR_MASK : 0) | ep->num;
+}
+
+/**
+ * _hardware_queue: configures a request at hardware level
+ * @gadget: gadget
+ * @mEp:    endpoint
+ *
+ * This function returns an error code
+ */
+static int _hardware_enqueue(struct ci13xxx_ep *mEp, struct ci13xxx_req *mReq)
+{
+        unsigned i;
+        int ret = 0;
+        unsigned length = mReq->req.length;
+
+        trace("%p, %p", mEp, mReq);
+
+        /* don't queue twice */
+        if (mReq->req.status == -EALREADY)
+                return -EALREADY;
+
+        mReq->req.status = -EALREADY;
+        if (length && !mReq->req.dma) {
+                mReq->req.dma = \
+                        dma_map_single(mEp->device, mReq->req.buf,
+                                       length, mEp->dir ? DMA_TO_DEVICE :
+                                       DMA_FROM_DEVICE);
+                if (mReq->req.dma == 0)
+                        return -ENOMEM;
+
+                mReq->map = 1;
+        }
+
+        if (mReq->req.zero && length && (length % mEp->ep.maxpacket == 0)) {
+                mReq->zptr = dma_pool_alloc(mEp->td_pool, GFP_ATOMIC,
+                                           &mReq->zdma);
+                if (mReq->zptr == NULL) {
+                        if (mReq->map) {
+                                dma_unmap_single(mEp->device, mReq->req.dma,
+                                        length, mEp->dir ? DMA_TO_DEVICE :
+                                        DMA_FROM_DEVICE);
+                                mReq->req.dma = 0;
+                                mReq->map     = 0;
+                        }
+                        return -ENOMEM;
+                }
+                memset(mReq->zptr, 0, sizeof(*mReq->zptr));
+                mReq->zptr->next    = TD_TERMINATE;
+                mReq->zptr->token   = TD_STATUS_ACTIVE;
+                if (!mReq->req.no_interrupt)
+                        mReq->zptr->token   |= TD_IOC;
+        }
+        /*
+         * TD configuration
+         * TODO - handle requests which spawns into several TDs
+         */
+        memset(mReq->ptr, 0, sizeof(*mReq->ptr));
+        mReq->ptr->token    = length << ffs_nr(TD_TOTAL_BYTES);
+        mReq->ptr->token   &= TD_TOTAL_BYTES;
+        mReq->ptr->token   |= TD_STATUS_ACTIVE;
+        if (mReq->zptr) {
+                mReq->ptr->next    = mReq->zdma;
+        } else {
+                mReq->ptr->next    = TD_TERMINATE;
+                if (!mReq->req.no_interrupt)
+                        mReq->ptr->token  |= TD_IOC;
+        }
+        mReq->ptr->page[0]  = mReq->req.dma;
+        for (i = 1; i < 5; i++)
+                mReq->ptr->page[i] =
+                        (mReq->req.dma + i * CI13XXX_PAGE_SIZE) & ~TD_RESERVED_MASK;
+
+        if (!list_empty(&mEp->qh.queue)) {
+                struct ci13xxx_req *mReqPrev;
+                int n = hw_ep_bit(mEp->num, mEp->dir);
+                int tmp_stat;
+
+                mReqPrev = list_entry(mEp->qh.queue.prev,
+                                struct ci13xxx_req, queue);
+                if (mReqPrev->zptr)
+                        mReqPrev->zptr->next = mReq->dma & TD_ADDR_MASK;
+                else
+                        mReqPrev->ptr->next = mReq->dma & TD_ADDR_MASK;
+                wmb();
+                if (hw_cread(CAP_ENDPTPRIME, BIT(n)))
+                        goto done;
+                do {
+                        hw_cwrite(CAP_USBCMD, USBCMD_ATDTW, USBCMD_ATDTW);
+                        tmp_stat = hw_cread(CAP_ENDPTSTAT, BIT(n));
+                } while (!hw_cread(CAP_USBCMD, USBCMD_ATDTW));
+                hw_cwrite(CAP_USBCMD, USBCMD_ATDTW, 0);
+                if (tmp_stat)
+                        goto done;
+        }
+
+        /*  QH configuration */
+        mEp->qh.ptr->td.next   = mReq->dma;    /* TERMINATE = 0 */
+        mEp->qh.ptr->td.token &= ~TD_STATUS;   /* clear status */
+        mEp->qh.ptr->cap |=  QH_ZLT;
+
+        wmb();   /* synchronize before ep prime */
+
+        ret = hw_ep_prime(mEp->num, mEp->dir,
+                           mEp->type == USB_ENDPOINT_XFER_CONTROL);
+done:
+        return ret;
+}
+
+/**
+ * _hardware_dequeue: handles a request at hardware level
+ * @gadget: gadget
+ * @mEp:    endpoint
+ *
+ * This function returns an error code
+ */
+static int _hardware_dequeue(struct ci13xxx_ep *mEp, struct ci13xxx_req *mReq)
+{
+        trace("%p, %p", mEp, mReq);
+
+        if (mReq->req.status != -EALREADY)
+                return -EINVAL;
+
+        if ((TD_STATUS_ACTIVE & mReq->ptr->token) != 0)
+                return -EBUSY;
+
+        if (mReq->zptr) {
+                if ((TD_STATUS_ACTIVE & mReq->zptr->token) != 0)
+                        return -EBUSY;
+                dma_pool_free(mEp->td_pool, mReq->zptr, mReq->zdma);
+                mReq->zptr = NULL;
+        }
+
+        mReq->req.status = 0;
+
+        if (mReq->map) {
+                dma_unmap_single(mEp->device, mReq->req.dma, mReq->req.length,
+                                 mEp->dir ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+                mReq->req.dma = 0;
+                mReq->map     = 0;
+        }
+
+        mReq->req.status = mReq->ptr->token & TD_STATUS;
+        if ((TD_STATUS_HALTED & mReq->req.status) != 0)
+                mReq->req.status = -1;
+        else if ((TD_STATUS_DT_ERR & mReq->req.status) != 0)
+                mReq->req.status = -1;
+        else if ((TD_STATUS_TR_ERR & mReq->req.status) != 0)
+                mReq->req.status = -1;
+
+        mReq->req.actual   = mReq->ptr->token & TD_TOTAL_BYTES;
+        mReq->req.actual >>= ffs_nr(TD_TOTAL_BYTES);
+        mReq->req.actual   = mReq->req.length - mReq->req.actual;
+        mReq->req.actual   = mReq->req.status ? 0 : mReq->req.actual;
+
+        return mReq->req.actual;
+}
+
+/**
+ * _ep_nuke: dequeues all endpoint requests
+ * @mEp: endpoint
+ *
+ * This function returns an error code
+ * Caller must hold lock
+ */
+static int _ep_nuke(struct ci13xxx_ep *mEp)
+__releases(mEp->lock)
+__acquires(mEp->lock)
+{
+        trace("%p", mEp);
+
+        if (mEp == NULL)
+                return -EINVAL;
+
+        hw_ep_flush(mEp->num, mEp->dir);
+
+        while (!list_empty(&mEp->qh.queue)) {
+
+                /* pop oldest request */
+                struct ci13xxx_req *mReq = \
+                        list_entry(mEp->qh.queue.next,
+                                   struct ci13xxx_req, queue);
+                list_del_init(&mReq->queue);
+                mReq->req.status = -ESHUTDOWN;
+
+                if (mReq->req.complete != NULL) {
+                        spin_unlock(mEp->lock);
+                        mReq->req.complete(&mEp->ep, &mReq->req);
+                        spin_lock(mEp->lock);
+                }
+        }
+        return 0;
+}
+
+/**
+ * _gadget_stop_activity: stops all USB activity, flushes & disables all endpts
+ * @gadget: gadget
+ *
+ * This function returns an error code
+ * Caller must hold lock
+ */
+static int _gadget_stop_activity(struct usb_gadget *gadget)
+{
+        struct usb_ep *ep;
+        struct ci13xxx    *udc = container_of(gadget, struct ci13xxx, gadget);
+        unsigned long flags;
+
+        trace("%p", gadget);
+
+        if (gadget == NULL)
+                return -EINVAL;
+
+        spin_lock_irqsave(udc->lock, flags);
+        udc->gadget.speed = USB_SPEED_UNKNOWN;
+        udc->remote_wakeup = 0;
+        udc->suspended = 0;
+        spin_unlock_irqrestore(udc->lock, flags);
+
+        /* flush all endpoints */
+        gadget_for_each_ep(ep, gadget) {
+                usb_ep_fifo_flush(ep);
+        }
+        usb_ep_fifo_flush(&udc->ep0out.ep);
+        usb_ep_fifo_flush(&udc->ep0in.ep);
+
+        udc->driver->disconnect(gadget);
+
+        /* make sure to disable all endpoints */
+        gadget_for_each_ep(ep, gadget) {
+                usb_ep_disable(ep);
+        }
+
+        if (udc->status != NULL) {
+                usb_ep_free_request(&udc->ep0in.ep, udc->status);
+                udc->status = NULL;
+        }
+
+        return 0;
+}
+
+/******************************************************************************
+ * ISR block
+ *****************************************************************************/
+/**
+ * isr_reset_handler: USB reset interrupt handler
+ * @udc: UDC device
+ *
+ * This function resets USB engine after a bus reset occurred
+ */
+static void isr_reset_handler(struct ci13xxx *udc)
+__releases(udc->lock)
+__acquires(udc->lock)
+{
+        int retval;
+
+        trace("%p", udc);
+
+        if (udc == NULL) {
+                err("EINVAL");
+                return;
+        }
+
+        dbg_event(0xFF, "BUS RST", 0);
+
+        spin_unlock(udc->lock);
+        retval = _gadget_stop_activity(&udc->gadget);
+        if (retval)
+                goto done;
+
+        retval = hw_usb_reset();
+        if (retval)
+                goto done;
+
+        udc->status = usb_ep_alloc_request(&udc->ep0in.ep, GFP_ATOMIC);
+        if (udc->status == NULL)
+                retval = -ENOMEM;
+
+        spin_lock(udc->lock);
+
+ done:
+        if (retval)
+                err("error: %i", retval);
+}
+
+/**
+ * isr_get_status_complete: get_status request complete function
+ * @ep:  endpoint
+ * @req: request handled
+ *
+ * Caller must release lock
+ */
+static void isr_get_status_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        trace("%p, %p", ep, req);
+
+        if (ep == NULL || req == NULL) {
+                err("EINVAL");
+                return;
+        }
+
+        kfree(req->buf);
+        usb_ep_free_request(ep, req);
+}
+
+/**
+ * isr_get_status_response: get_status request response
+ * @udc: udc struct
+ * @setup: setup request packet
+ *
+ * This function returns an error code
+ */
+static int isr_get_status_response(struct ci13xxx *udc,
+                                   struct usb_ctrlrequest *setup)
+__releases(mEp->lock)
+__acquires(mEp->lock)
+{
+        struct ci13xxx_ep *mEp = &udc->ep0in;
+        struct usb_request *req = NULL;
+        gfp_t gfp_flags = GFP_ATOMIC;
+        int dir, num, retval;
+
+        trace("%p, %p", mEp, setup);
+
+        if (mEp == NULL || setup == NULL)
+                return -EINVAL;
+
+        spin_unlock(mEp->lock);
+        req = usb_ep_alloc_request(&mEp->ep, gfp_flags);
+        spin_lock(mEp->lock);
+        if (req == NULL)
+                return -ENOMEM;
+
+        req->complete = isr_get_status_complete;
+        req->length   = 2;
+        req->buf      = kzalloc(req->length, gfp_flags);
+        if (req->buf == NULL) {
+                retval = -ENOMEM;
+                goto err_free_req;
+        }
+
+        if ((setup->bRequestType & USB_RECIP_MASK) == USB_RECIP_DEVICE) {
+                /* Assume that device is bus powered for now. */
+                *((u16 *)req->buf) = _udc->remote_wakeup << 1;
+                retval = 0;
+        } else if ((setup->bRequestType & USB_RECIP_MASK) \
+                   == USB_RECIP_ENDPOINT) {
+                dir = (le16_to_cpu(setup->wIndex) & USB_ENDPOINT_DIR_MASK) ?
+                        TX : RX;
+                num =  le16_to_cpu(setup->wIndex) & USB_ENDPOINT_NUMBER_MASK;
+                *((u16 *)req->buf) = hw_ep_get_halt(num, dir);
+        }
+        /* else do nothing; reserved for future use */
+
+        spin_unlock(mEp->lock);
+        retval = usb_ep_queue(&mEp->ep, req, gfp_flags);
+        spin_lock(mEp->lock);
+        if (retval)
+                goto err_free_buf;
+
+        return 0;
+
+ err_free_buf:
+        kfree(req->buf);
+ err_free_req:
+        spin_unlock(mEp->lock);
+        usb_ep_free_request(&mEp->ep, req);
+        spin_lock(mEp->lock);
+        return retval;
+}
+
+/**
+ * isr_setup_status_complete: setup_status request complete function
+ * @ep:  endpoint
+ * @req: request handled
+ *
+ * Caller must release lock. Put the port in test mode if test mode
+ * feature is selected.
+ */
+static void
+isr_setup_status_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct ci13xxx *udc = req->context;
+        unsigned long flags;
+
+        trace("%p, %p", ep, req);
+
+        spin_lock_irqsave(udc->lock, flags);
+        if (udc->test_mode)
+                hw_port_test_set(udc->test_mode);
+        spin_unlock_irqrestore(udc->lock, flags);
+}
+
+/**
+ * isr_setup_status_phase: queues the status phase of a setup transation
+ * @udc: udc struct
+ *
+ * This function returns an error code
+ */
+static int isr_setup_status_phase(struct ci13xxx *udc)
+__releases(mEp->lock)
+__acquires(mEp->lock)
+{
+        int retval;
+        struct ci13xxx_ep *mEp;
+
+        trace("%p", udc);
+
+        mEp = (udc->ep0_dir == TX) ? &udc->ep0out : &udc->ep0in;
+        udc->status->context = udc;
+        udc->status->complete = isr_setup_status_complete;
+
+        spin_unlock(mEp->lock);
+        retval = usb_ep_queue(&mEp->ep, udc->status, GFP_ATOMIC);
+        spin_lock(mEp->lock);
+
+        return retval;
+}
+
+/**
+ * isr_tr_complete_low: transaction complete low level handler
+ * @mEp: endpoint
+ *
+ * This function returns an error code
+ * Caller must hold lock
+ */
+static int isr_tr_complete_low(struct ci13xxx_ep *mEp)
+__releases(mEp->lock)
+__acquires(mEp->lock)
+{
+        struct ci13xxx_req *mReq, *mReqTemp;
+        struct ci13xxx_ep *mEpTemp = mEp;
+        int uninitialized_var(retval);
+
+        trace("%p", mEp);
+
+        if (list_empty(&mEp->qh.queue))
+                return -EINVAL;
+
+        list_for_each_entry_safe(mReq, mReqTemp, &mEp->qh.queue,
+                        queue) {
+                retval = _hardware_dequeue(mEp, mReq);
+                if (retval < 0)
+                        break;
+                list_del_init(&mReq->queue);
+                dbg_done(_usb_addr(mEp), mReq->ptr->token, retval);
+                if (mReq->req.complete != NULL) {
+                        spin_unlock(mEp->lock);
+                        if ((mEp->type == USB_ENDPOINT_XFER_CONTROL) &&
+                                        mReq->req.length)
+                                mEpTemp = &_udc->ep0in;
+                        mReq->req.complete(&mEpTemp->ep, &mReq->req);
+                        spin_lock(mEp->lock);
+                }
+        }
+
+        if (retval == -EBUSY)
+                retval = 0;
+        if (retval < 0)
+                dbg_event(_usb_addr(mEp), "DONE", retval);
+
+        return retval;
+}
+
+/**
+ * isr_tr_complete_handler: transaction complete interrupt handler
+ * @udc: UDC descriptor
+ *
+ * This function handles traffic events
+ */
+static void isr_tr_complete_handler(struct ci13xxx *udc)
+__releases(udc->lock)
+__acquires(udc->lock)
+{
+        unsigned i;
+        u8 tmode = 0;
+
+        trace("%p", udc);
+
+        if (udc == NULL) {
+                err("EINVAL");
+                return;
+        }
+
+        for (i = 0; i < hw_ep_max; i++) {
+                struct ci13xxx_ep *mEp  = &udc->ci13xxx_ep[i];
+                int type, num, dir, err = -EINVAL;
+                struct usb_ctrlrequest req;
+
+                if (mEp->desc == NULL)
+                        continue;   /* not configured */
+
+                if (hw_test_and_clear_complete(i)) {
+                        err = isr_tr_complete_low(mEp);
+                        if (mEp->type == USB_ENDPOINT_XFER_CONTROL) {
+                                if (err > 0)   /* needs status phase */
+                                        err = isr_setup_status_phase(udc);
+                                if (err < 0) {
+                                        dbg_event(_usb_addr(mEp),
+                                                  "ERROR", err);
+                                        spin_unlock(udc->lock);
+                                        if (usb_ep_set_halt(&mEp->ep))
+                                                err("error: ep_set_halt");
+                                        spin_lock(udc->lock);
+                                }
+                        }
+                }
+
+                if (mEp->type != USB_ENDPOINT_XFER_CONTROL ||
+                    !hw_test_and_clear_setup_status(i))
+                        continue;
+
+                if (i != 0) {
+                        warn("ctrl traffic received at endpoint");
+                        continue;
+                }
+
+                /*
+                 * Flush data and handshake transactions of previous
+                 * setup packet.
+                 */
+                _ep_nuke(&udc->ep0out);
+                _ep_nuke(&udc->ep0in);
+
+                /* read_setup_packet */
+                do {
+                        hw_test_and_set_setup_guard();
+                        memcpy(&req, &mEp->qh.ptr->setup, sizeof(req));
+                } while (!hw_test_and_clear_setup_guard());
+
+                type = req.bRequestType;
+
+                udc->ep0_dir = (type & USB_DIR_IN) ? TX : RX;
+
+                dbg_setup(_usb_addr(mEp), &req);
+
+                switch (req.bRequest) {
+                case USB_REQ_CLEAR_FEATURE:
+                        if (type == (USB_DIR_OUT|USB_RECIP_ENDPOINT) &&
+                                        le16_to_cpu(req.wValue) ==
+                                        USB_ENDPOINT_HALT) {
+                                if (req.wLength != 0)
+                                        break;
+                                num  = le16_to_cpu(req.wIndex);
+                                dir = num & USB_ENDPOINT_DIR_MASK;
+                                num &= USB_ENDPOINT_NUMBER_MASK;
+                                if (dir) /* TX */
+                                        num += hw_ep_max/2;
+                                if (!udc->ci13xxx_ep[num].wedge) {
+                                        spin_unlock(udc->lock);
+                                        err = usb_ep_clear_halt(
+                                                &udc->ci13xxx_ep[num].ep);
+                                        spin_lock(udc->lock);
+                                        if (err)
+                                                break;
+                                }
+                                err = isr_setup_status_phase(udc);
+                        } else if (type == (USB_DIR_OUT|USB_RECIP_DEVICE) &&
+                                        le16_to_cpu(req.wValue) ==
+                                        USB_DEVICE_REMOTE_WAKEUP) {
+                                if (req.wLength != 0)
+                                        break;
+                                udc->remote_wakeup = 0;
+                                err = isr_setup_status_phase(udc);
+                        } else {
+                                goto delegate;
+                        }
+                        break;
+                case USB_REQ_GET_STATUS:
+                        if (type != (USB_DIR_IN|USB_RECIP_DEVICE)   &&
+                            type != (USB_DIR_IN|USB_RECIP_ENDPOINT) &&
+                            type != (USB_DIR_IN|USB_RECIP_INTERFACE))
+                                goto delegate;
+                        if (le16_to_cpu(req.wLength) != 2 ||
+                            le16_to_cpu(req.wValue)  != 0)
+                                break;
+                        err = isr_get_status_response(udc, &req);
+                        break;
+                case USB_REQ_SET_ADDRESS:
+                        if (type != (USB_DIR_OUT|USB_RECIP_DEVICE))
+                                goto delegate;
+                        if (le16_to_cpu(req.wLength) != 0 ||
+                            le16_to_cpu(req.wIndex)  != 0)
+                                break;
+                        err = hw_usb_set_address((u8)le16_to_cpu(req.wValue));
+                        if (err)
+                                break;
+                        err = isr_setup_status_phase(udc);
+                        break;
+                case USB_REQ_SET_FEATURE:
+                        if (type == (USB_DIR_OUT|USB_RECIP_ENDPOINT) &&
+                                        le16_to_cpu(req.wValue) ==
+                                        USB_ENDPOINT_HALT) {
+                                if (req.wLength != 0)
+                                        break;
+                                num  = le16_to_cpu(req.wIndex);
+                                dir = num & USB_ENDPOINT_DIR_MASK;
+                                num &= USB_ENDPOINT_NUMBER_MASK;
+                                if (dir) /* TX */
+                                        num += hw_ep_max/2;
+
+                                spin_unlock(udc->lock);
+                                err = usb_ep_set_halt(&udc->ci13xxx_ep[num].ep);
+                                spin_lock(udc->lock);
+                                if (!err)
+                                        isr_setup_status_phase(udc);
+                        } else if (type == (USB_DIR_OUT|USB_RECIP_DEVICE)) {
+                                if (req.wLength != 0)
+                                        break;
+                                switch (le16_to_cpu(req.wValue)) {
+                                case USB_DEVICE_REMOTE_WAKEUP:
+                                        udc->remote_wakeup = 1;
+                                        err = isr_setup_status_phase(udc);
+                                        break;
+                                case USB_DEVICE_TEST_MODE:
+                                        tmode = le16_to_cpu(req.wIndex) >> 8;
+                                        switch (tmode) {
+                                        case TEST_J:
+                                        case TEST_K:
+                                        case TEST_SE0_NAK:
+                                        case TEST_PACKET:
+                                        case TEST_FORCE_EN:
+                                                udc->test_mode = tmode;
+                                                err = isr_setup_status_phase(
+                                                                udc);
+                                                break;
+                                        default:
+                                                break;
+                                        }
+                                default:
+                                        goto delegate;
+                                }
+                        } else {
+                                goto delegate;
+                        }
+                        break;
+                default:
+delegate:
+                        if (req.wLength == 0)   /* no data phase */
+                                udc->ep0_dir = TX;
+
+                        spin_unlock(udc->lock);
+                        err = udc->driver->setup(&udc->gadget, &req);
+                        spin_lock(udc->lock);
+                        break;
+                }
+
+                if (err < 0) {
+                        dbg_event(_usb_addr(mEp), "ERROR", err);
+
+                        spin_unlock(udc->lock);
+                        if (usb_ep_set_halt(&mEp->ep))
+                                err("error: ep_set_halt");
+                        spin_lock(udc->lock);
+                }
+        }
+}
+
+/******************************************************************************
+ * ENDPT block
+ *****************************************************************************/
+/**
+ * ep_enable: configure endpoint, making it usable
+ *
+ * Check usb_ep_enable() at "usb_gadget.h" for details
+ */
+static int ep_enable(struct usb_ep *ep,
+                     const struct usb_endpoint_descriptor *desc)
+{
+        struct ci13xxx_ep *mEp = container_of(ep, struct ci13xxx_ep, ep);
+        int retval = 0;
+        unsigned long flags;
+
+        trace("%p, %p", ep, desc);
+
+        if (ep == NULL || desc == NULL)
+                return -EINVAL;
+
+        spin_lock_irqsave(mEp->lock, flags);
+
+        /* only internal SW should enable ctrl endpts */
+
+        mEp->desc = desc;
+
+        if (!list_empty(&mEp->qh.queue))
+                warn("enabling a non-empty endpoint!");
+
+        mEp->dir  = usb_endpoint_dir_in(desc) ? TX : RX;
+        mEp->num  = usb_endpoint_num(desc);
+        mEp->type = usb_endpoint_type(desc);
+
+        mEp->ep.maxpacket = __constant_le16_to_cpu(desc->wMaxPacketSize);
+
+        dbg_event(_usb_addr(mEp), "ENABLE", 0);
+
+        mEp->qh.ptr->cap = 0;
+
+        if (mEp->type == USB_ENDPOINT_XFER_CONTROL)
+                mEp->qh.ptr->cap |=  QH_IOS;
+        else if (mEp->type == USB_ENDPOINT_XFER_ISOC)
+                mEp->qh.ptr->cap &= ~QH_MULT;
+        else
+                mEp->qh.ptr->cap &= ~QH_ZLT;
+
+        mEp->qh.ptr->cap |=
+                (mEp->ep.maxpacket << ffs_nr(QH_MAX_PKT)) & QH_MAX_PKT;
+        mEp->qh.ptr->td.next |= TD_TERMINATE;   /* needed? */
+
+        /*
+         * Enable endpoints in the HW other than ep0 as ep0
+         * is always enabled
+         */
+        if (mEp->num)
+                retval |= hw_ep_enable(mEp->num, mEp->dir, mEp->type);
+
+        spin_unlock_irqrestore(mEp->lock, flags);
+        return retval;
+}
+
+/**
+ * ep_disable: endpoint is no longer usable
+ *
+ * Check usb_ep_disable() at "usb_gadget.h" for details
+ */
+static int ep_disable(struct usb_ep *ep)
+{
+        struct ci13xxx_ep *mEp = container_of(ep, struct ci13xxx_ep, ep);
+        int direction, retval = 0;
+        unsigned long flags;
+
+        trace("%p", ep);
+
+        if (ep == NULL)
+                return -EINVAL;
+        else if (mEp->desc == NULL)
+                return -EBUSY;
+
+        spin_lock_irqsave(mEp->lock, flags);
+
+        /* only internal SW should disable ctrl endpts */
+
+        direction = mEp->dir;
+        do {
+                dbg_event(_usb_addr(mEp), "DISABLE", 0);
+
+                retval |= _ep_nuke(mEp);
+                retval |= hw_ep_disable(mEp->num, mEp->dir);
+
+                if (mEp->type == USB_ENDPOINT_XFER_CONTROL)
+                        mEp->dir = (mEp->dir == TX) ? RX : TX;
+
+        } while (mEp->dir != direction);
+
+        mEp->desc = NULL;
+
+        spin_unlock_irqrestore(mEp->lock, flags);
+        return retval;
+}
+
+/**
+ * ep_alloc_request: allocate a request object to use with this endpoint
+ *
+ * Check usb_ep_alloc_request() at "usb_gadget.h" for details
+ */
+static struct usb_request *ep_alloc_request(struct usb_ep *ep, gfp_t gfp_flags)
+{
+        struct ci13xxx_ep  *mEp  = container_of(ep, struct ci13xxx_ep, ep);
+        struct ci13xxx_req *mReq = NULL;
+
+        trace("%p, %i", ep, gfp_flags);
+
+        if (ep == NULL) {
+                err("EINVAL");
+                return NULL;
+        }
+
+        mReq = kzalloc(sizeof(struct ci13xxx_req), gfp_flags);
+        if (mReq != NULL) {
+                INIT_LIST_HEAD(&mReq->queue);
+
+                mReq->ptr = dma_pool_alloc(mEp->td_pool, gfp_flags,
+                                           &mReq->dma);
+                if (mReq->ptr == NULL) {
+                        kfree(mReq);
+                        mReq = NULL;
+                }
+        }
+
+        dbg_event(_usb_addr(mEp), "ALLOC", mReq == NULL);
+
+        return (mReq == NULL) ? NULL : &mReq->req;
+}
+
+/**
+ * ep_free_request: frees a request object
+ *
+ * Check usb_ep_free_request() at "usb_gadget.h" for details
+ */
+static void ep_free_request(struct usb_ep *ep, struct usb_request *req)
+{
+        struct ci13xxx_ep  *mEp  = container_of(ep,  struct ci13xxx_ep, ep);
+        struct ci13xxx_req *mReq = container_of(req, struct ci13xxx_req, req);
+        unsigned long flags;
+
+        trace("%p, %p", ep, req);
+
+        if (ep == NULL || req == NULL) {
+                err("EINVAL");
+                return;
+        } else if (!list_empty(&mReq->queue)) {
+                err("EBUSY");
+                return;
+        }
+
+        spin_lock_irqsave(mEp->lock, flags);
+
+        if (mReq->ptr)
+                dma_pool_free(mEp->td_pool, mReq->ptr, mReq->dma);
+        kfree(mReq);
+
+        dbg_event(_usb_addr(mEp), "FREE", 0);
+
+        spin_unlock_irqrestore(mEp->lock, flags);
+}
+
+/**
+ * ep_queue: queues (submits) an I/O request to an endpoint
+ *
+ * Check usb_ep_queue()* at usb_gadget.h" for details
+ */
+static int ep_queue(struct usb_ep *ep, struct usb_request *req,
+                    gfp_t __maybe_unused gfp_flags)
+{
+        struct ci13xxx_ep  *mEp  = container_of(ep,  struct ci13xxx_ep, ep);
+        struct ci13xxx_req *mReq = container_of(req, struct ci13xxx_req, req);
+        int retval = 0;
+        unsigned long flags;
+
+        trace("%p, %p, %X", ep, req, gfp_flags);
+
+        if (ep == NULL || req == NULL || mEp->desc == NULL)
+                return -EINVAL;
+
+        spin_lock_irqsave(mEp->lock, flags);
+
+        if (mEp->type == USB_ENDPOINT_XFER_CONTROL) {
+                if (req->length)
+                        mEp = (_udc->ep0_dir == RX) ?
+                                &_udc->ep0out : &_udc->ep0in;
+                if (!list_empty(&mEp->qh.queue)) {
+                        _ep_nuke(mEp);
+                        retval = -EOVERFLOW;
+                        warn("endpoint ctrl %X nuked", _usb_addr(mEp));
+                }
+        }
+
+        /* first nuke then test link, e.g. previous status has not sent */
+        if (!list_empty(&mReq->queue)) {
+                retval = -EBUSY;
+                err("request already in queue");
+                goto done;
+        }
+
+        if (req->length > (4 * CI13XXX_PAGE_SIZE)) {
+                req->length = (4 * CI13XXX_PAGE_SIZE);
+                retval = -EMSGSIZE;
+                warn("request length truncated");
+        }
+
+        dbg_queue(_usb_addr(mEp), req, retval);
+
+        /* push request */
+        mReq->req.status = -EINPROGRESS;
+        mReq->req.actual = 0;
+
+        retval = _hardware_enqueue(mEp, mReq);
+
+        if (retval == -EALREADY) {
+                dbg_event(_usb_addr(mEp), "QUEUE", retval);
+                retval = 0;
+        }
+        if (!retval)
+                list_add_tail(&mReq->queue, &mEp->qh.queue);
+
+ done:
+        spin_unlock_irqrestore(mEp->lock, flags);
+        return retval;
+}
+
+/**
+ * ep_dequeue: dequeues (cancels, unlinks) an I/O request from an endpoint
+ *
+ * Check usb_ep_dequeue() at "usb_gadget.h" for details
+ */
+static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
+{
+        struct ci13xxx_ep  *mEp  = container_of(ep,  struct ci13xxx_ep, ep);
+        struct ci13xxx_req *mReq = container_of(req, struct ci13xxx_req, req);
+        unsigned long flags;
+
+        trace("%p, %p", ep, req);
+
+        if (ep == NULL || req == NULL || mReq->req.status != -EALREADY ||
+                mEp->desc == NULL || list_empty(&mReq->queue) ||
+                list_empty(&mEp->qh.queue))
+                return -EINVAL;
+
+        spin_lock_irqsave(mEp->lock, flags);
+
+        dbg_event(_usb_addr(mEp), "DEQUEUE", 0);
+
+        hw_ep_flush(mEp->num, mEp->dir);
+
+        /* pop request */
+        list_del_init(&mReq->queue);
+        if (mReq->map) {
+                dma_unmap_single(mEp->device, mReq->req.dma, mReq->req.length,
+                                 mEp->dir ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+                mReq->req.dma = 0;
+                mReq->map     = 0;
+        }
+        req->status = -ECONNRESET;
+
+        if (mReq->req.complete != NULL) {
+                spin_unlock(mEp->lock);
+                mReq->req.complete(&mEp->ep, &mReq->req);
+                spin_lock(mEp->lock);
+        }
+
+        spin_unlock_irqrestore(mEp->lock, flags);
+        return 0;
+}
+
+/**
+ * ep_set_halt: sets the endpoint halt feature
+ *
+ * Check usb_ep_set_halt() at "usb_gadget.h" for details
+ */
+static int ep_set_halt(struct usb_ep *ep, int value)
+{
+        struct ci13xxx_ep *mEp = container_of(ep, struct ci13xxx_ep, ep);
+        int direction, retval = 0;
+        unsigned long flags;
+
+        trace("%p, %i", ep, value);
+
+        if (ep == NULL || mEp->desc == NULL)
+                return -EINVAL;
+
+        spin_lock_irqsave(mEp->lock, flags);
+
+#ifndef STALL_IN
+        /* g_file_storage MS compliant but g_zero fails chapter 9 compliance */
+        if (value && mEp->type == USB_ENDPOINT_XFER_BULK && mEp->dir == TX &&
+            !list_empty(&mEp->qh.queue)) {
+                spin_unlock_irqrestore(mEp->lock, flags);
+                return -EAGAIN;
+        }
+#endif
+
+        direction = mEp->dir;
+        do {
+                dbg_event(_usb_addr(mEp), "HALT", value);
+                retval |= hw_ep_set_halt(mEp->num, mEp->dir, value);
+
+                if (!value)
+                        mEp->wedge = 0;
+
+                if (mEp->type == USB_ENDPOINT_XFER_CONTROL)
+                        mEp->dir = (mEp->dir == TX) ? RX : TX;
+
+        } while (mEp->dir != direction);
+
+        spin_unlock_irqrestore(mEp->lock, flags);
+        return retval;
+}
+
+/**
+ * ep_set_wedge: sets the halt feature and ignores clear requests
+ *
+ * Check usb_ep_set_wedge() at "usb_gadget.h" for details
+ */
+static int ep_set_wedge(struct usb_ep *ep)
+{
+        struct ci13xxx_ep *mEp = container_of(ep, struct ci13xxx_ep, ep);
+        unsigned long flags;
+
+        trace("%p", ep);
+
+        if (ep == NULL || mEp->desc == NULL)
+                return -EINVAL;
+
+        spin_lock_irqsave(mEp->lock, flags);
+
+        dbg_event(_usb_addr(mEp), "WEDGE", 0);
+        mEp->wedge = 1;
+
+        spin_unlock_irqrestore(mEp->lock, flags);
+
+        return usb_ep_set_halt(ep);
+}
+
+/**
+ * ep_fifo_flush: flushes contents of a fifo
+ *
+ * Check usb_ep_fifo_flush() at "usb_gadget.h" for details
+ */
+static void ep_fifo_flush(struct usb_ep *ep)
+{
+        struct ci13xxx_ep *mEp = container_of(ep, struct ci13xxx_ep, ep);
+        unsigned long flags;
+
+        trace("%p", ep);
+
+        if (ep == NULL) {
+                err("%02X: -EINVAL", _usb_addr(mEp));
+                return;
+        }
+
+        spin_lock_irqsave(mEp->lock, flags);
+
+        dbg_event(_usb_addr(mEp), "FFLUSH", 0);
+        hw_ep_flush(mEp->num, mEp->dir);
+
+        spin_unlock_irqrestore(mEp->lock, flags);
+}
+
+/**
+ * Endpoint-specific part of the API to the USB controller hardware
+ * Check "usb_gadget.h" for details
+ */
+static const struct usb_ep_ops usb_ep_ops = {
+        .enable        = ep_enable,
+        .disable       = ep_disable,
+        .alloc_request = ep_alloc_request,
+        .free_request  = ep_free_request,
+        .queue         = ep_queue,
+        .dequeue       = ep_dequeue,
+        .set_halt      = ep_set_halt,
+        .set_wedge     = ep_set_wedge,
+        .fifo_flush    = ep_fifo_flush,
+};
+
+/******************************************************************************
+ * GADGET block
+ *****************************************************************************/
+static int ci13xxx_vbus_session(struct usb_gadget *_gadget, int is_active)
+{
+        struct ci13xxx *udc = container_of(_gadget, struct ci13xxx, gadget);
+        unsigned long flags;
+        int gadget_ready = 0;
+
+        if (!(udc->udc_driver->flags & CI13XXX_PULLUP_ON_VBUS))
+                return -EOPNOTSUPP;
+
+        spin_lock_irqsave(udc->lock, flags);
+        udc->vbus_active = is_active;
+        if (udc->driver)
+                gadget_ready = 1;
+        spin_unlock_irqrestore(udc->lock, flags);
+
+        if (gadget_ready) {
+                if (is_active) {
+                        pm_runtime_get_sync(&_gadget->dev);
+                        hw_device_reset(udc);
+                        hw_device_state(udc->ep0out.qh.dma);
+                } else {
+                        hw_device_state(0);
+                        if (udc->udc_driver->notify_event)
+                                udc->udc_driver->notify_event(udc,
+                                CI13XXX_CONTROLLER_STOPPED_EVENT);
+                        _gadget_stop_activity(&udc->gadget);
+                        pm_runtime_put_sync(&_gadget->dev);
+                }
+        }
+
+        return 0;
+}
+
+static int ci13xxx_wakeup(struct usb_gadget *_gadget)
+{
+        struct ci13xxx *udc = container_of(_gadget, struct ci13xxx, gadget);
+        unsigned long flags;
+        int ret = 0;
+
+        trace();
+
+        spin_lock_irqsave(udc->lock, flags);
+        if (!udc->remote_wakeup) {
+                ret = -EOPNOTSUPP;
+                dbg_trace("remote wakeup feature is not enabled\n");
+                goto out;
+        }
+        if (!hw_cread(CAP_PORTSC, PORTSC_SUSP)) {
+                ret = -EINVAL;
+                dbg_trace("port is not suspended\n");
+                goto out;
+        }
+        hw_cwrite(CAP_PORTSC, PORTSC_FPR, PORTSC_FPR);
+out:
+        spin_unlock_irqrestore(udc->lock, flags);
+        return ret;
+}
+
+static int ci13xxx_vbus_draw(struct usb_gadget *_gadget, unsigned mA)
+{
+        struct ci13xxx *udc = container_of(_gadget, struct ci13xxx, gadget);
+
+        if (udc->transceiver)
+                return otg_set_power(udc->transceiver, mA);
+        return -ENOTSUPP;
+}
+
+static int ci13xxx_start(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *));
+static int ci13xxx_stop(struct usb_gadget_driver *driver);
+/**
+ * Device operations part of the API to the USB controller hardware,
+ * which don't involve endpoints (or i/o)
+ * Check  "usb_gadget.h" for details
+ */
+static const struct usb_gadget_ops usb_gadget_ops = {
+        .vbus_session   = ci13xxx_vbus_session,
+        .wakeup         = ci13xxx_wakeup,
+        .vbus_draw      = ci13xxx_vbus_draw,
+        .start          = ci13xxx_start,
+        .stop           = ci13xxx_stop,
+};
+
+/**
+ * ci13xxx_start: register a gadget driver
+ * @driver: the driver being registered
+ * @bind: the driver's bind callback
+ *
+ * Check ci13xxx_start() at <linux/usb/gadget.h> for details.
+ * Interrupts are enabled here.
+ */
+static int ci13xxx_start(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
+{
+        struct ci13xxx *udc = _udc;
+        unsigned long flags;
+        int i, j;
+        int retval = -ENOMEM;
+
+        trace("%p", driver);
+
+        if (driver             == NULL ||
+            bind               == NULL ||
+            driver->setup      == NULL ||
+            driver->disconnect == NULL ||
+            driver->suspend    == NULL ||
+            driver->resume     == NULL)
+                return -EINVAL;
+        else if (udc         == NULL)
+                return -ENODEV;
+        else if (udc->driver != NULL)
+                return -EBUSY;
+
+        /* alloc resources */
+        udc->qh_pool = dma_pool_create("ci13xxx_qh", &udc->gadget.dev,
+                                       sizeof(struct ci13xxx_qh),
+                                       64, CI13XXX_PAGE_SIZE);
+        if (udc->qh_pool == NULL)
+                return -ENOMEM;
+
+        udc->td_pool = dma_pool_create("ci13xxx_td", &udc->gadget.dev,
+                                       sizeof(struct ci13xxx_td),
+                                       64, CI13XXX_PAGE_SIZE);
+        if (udc->td_pool == NULL) {
+                dma_pool_destroy(udc->qh_pool);
+                udc->qh_pool = NULL;
+                return -ENOMEM;
+        }
+
+        spin_lock_irqsave(udc->lock, flags);
+
+        info("hw_ep_max = %d", hw_ep_max);
+
+        udc->gadget.dev.driver = NULL;
+
+        retval = 0;
+        for (i = 0; i < hw_ep_max/2; i++) {
+                for (j = RX; j <= TX; j++) {
+                        int k = i + j * hw_ep_max/2;
+                        struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[k];
+
+                        scnprintf(mEp->name, sizeof(mEp->name), "ep%i%s", i,
+                                        (j == TX)  ? "in" : "out");
+
+                        mEp->lock         = udc->lock;
+                        mEp->device       = &udc->gadget.dev;
+                        mEp->td_pool      = udc->td_pool;
+
+                        mEp->ep.name      = mEp->name;
+                        mEp->ep.ops       = &usb_ep_ops;
+                        mEp->ep.maxpacket = CTRL_PAYLOAD_MAX;
+
+                        INIT_LIST_HEAD(&mEp->qh.queue);
+                        spin_unlock_irqrestore(udc->lock, flags);
+                        mEp->qh.ptr = dma_pool_alloc(udc->qh_pool, GFP_KERNEL,
+                                        &mEp->qh.dma);
+                        spin_lock_irqsave(udc->lock, flags);
+                        if (mEp->qh.ptr == NULL)
+                                retval = -ENOMEM;
+                        else
+                                memset(mEp->qh.ptr, 0, sizeof(*mEp->qh.ptr));
+
+                        /* skip ep0 out and in endpoints */
+                        if (i == 0)
+                                continue;
+
+                        list_add_tail(&mEp->ep.ep_list, &udc->gadget.ep_list);
+                }
+        }
+        if (retval)
+                goto done;
+        spin_unlock_irqrestore(udc->lock, flags);
+        udc->ep0out.ep.desc = &ctrl_endpt_out_desc;
+        retval = usb_ep_enable(&udc->ep0out.ep);
+        if (retval)
+                return retval;
+
+        udc->ep0in.ep.desc = &ctrl_endpt_in_desc;
+        retval = usb_ep_enable(&udc->ep0in.ep);
+        if (retval)
+                return retval;
+        spin_lock_irqsave(udc->lock, flags);
+
+        udc->gadget.ep0 = &udc->ep0in.ep;
+        /* bind gadget */
+        driver->driver.bus     = NULL;
+        udc->gadget.dev.driver = &driver->driver;
+
+        spin_unlock_irqrestore(udc->lock, flags);
+        retval = bind(&udc->gadget);                /* MAY SLEEP */
+        spin_lock_irqsave(udc->lock, flags);
+
+        if (retval) {
+                udc->gadget.dev.driver = NULL;
+                goto done;
+        }
+
+        udc->driver = driver;
+        pm_runtime_get_sync(&udc->gadget.dev);
+        if (udc->udc_driver->flags & CI13XXX_PULLUP_ON_VBUS) {
+                if (udc->vbus_active) {
+                        if (udc->udc_driver->flags & CI13XXX_REGS_SHARED)
+                                hw_device_reset(udc);
+                } else {
+                        pm_runtime_put_sync(&udc->gadget.dev);
+                        goto done;
+                }
+        }
+
+        retval = hw_device_state(udc->ep0out.qh.dma);
+        if (retval)
+                pm_runtime_put_sync(&udc->gadget.dev);
+
+ done:
+        spin_unlock_irqrestore(udc->lock, flags);
+        return retval;
+}
+
+/**
+ * ci13xxx_stop: unregister a gadget driver
+ *
+ * Check usb_gadget_unregister_driver() at "usb_gadget.h" for details
+ */
+static int ci13xxx_stop(struct usb_gadget_driver *driver)
+{
+        struct ci13xxx *udc = _udc;
+        unsigned long i, flags;
+
+        trace("%p", driver);
+
+        if (driver             == NULL ||
+            driver->unbind     == NULL ||
+            driver->setup      == NULL ||
+            driver->disconnect == NULL ||
+            driver->suspend    == NULL ||
+            driver->resume     == NULL ||
+            driver             != udc->driver)
+                return -EINVAL;
+
+        spin_lock_irqsave(udc->lock, flags);
+
+        if (!(udc->udc_driver->flags & CI13XXX_PULLUP_ON_VBUS) ||
+                        udc->vbus_active) {
+                hw_device_state(0);
+                if (udc->udc_driver->notify_event)
+                        udc->udc_driver->notify_event(udc,
+                        CI13XXX_CONTROLLER_STOPPED_EVENT);
+                _gadget_stop_activity(&udc->gadget);
+                pm_runtime_put(&udc->gadget.dev);
+        }
+
+        /* unbind gadget */
+        spin_unlock_irqrestore(udc->lock, flags);
+        driver->unbind(&udc->gadget);               /* MAY SLEEP */
+        spin_lock_irqsave(udc->lock, flags);
+
+        udc->gadget.dev.driver = NULL;
+
+        /* free resources */
+        for (i = 0; i < hw_ep_max; i++) {
+                struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[i];
+
+                if (!list_empty(&mEp->ep.ep_list))
+                        list_del_init(&mEp->ep.ep_list);
+
+                if (mEp->qh.ptr != NULL)
+                        dma_pool_free(udc->qh_pool, mEp->qh.ptr, mEp->qh.dma);
+        }
+
+        udc->gadget.ep0 = NULL;
+        udc->driver = NULL;
+
+        spin_unlock_irqrestore(udc->lock, flags);
+
+        if (udc->td_pool != NULL) {
+                dma_pool_destroy(udc->td_pool);
+                udc->td_pool = NULL;
+        }
+        if (udc->qh_pool != NULL) {
+                dma_pool_destroy(udc->qh_pool);
+                udc->qh_pool = NULL;
+        }
+
+        return 0;
+}
+
+/******************************************************************************
+ * BUS block
+ *****************************************************************************/
+/**
+ * udc_irq: global interrupt handler
+ *
+ * This function returns IRQ_HANDLED if the IRQ has been handled
+ * It locks access to registers
+ */
+static irqreturn_t udc_irq(void)
+{
+        struct ci13xxx *udc = _udc;
+        irqreturn_t retval;
+        u32 intr;
+
+        trace();
+
+        if (udc == NULL) {
+                err("ENODEV");
+                return IRQ_HANDLED;
+        }
+
+        spin_lock(udc->lock);
+
+        if (udc->udc_driver->flags & CI13XXX_REGS_SHARED) {
+                if (hw_cread(CAP_USBMODE, USBMODE_CM) !=
+                                USBMODE_CM_DEVICE) {
+                        spin_unlock(udc->lock);
+                        return IRQ_NONE;
+                }
+        }
+        intr = hw_test_and_clear_intr_active();
+        if (intr) {
+                isr_statistics.hndl.buf[isr_statistics.hndl.idx++] = intr;
+                isr_statistics.hndl.idx &= ISR_MASK;
+                isr_statistics.hndl.cnt++;
+
+                /* order defines priority - do NOT change it */
+                if (USBi_URI & intr) {
+                        isr_statistics.uri++;
+                        isr_reset_handler(udc);
+                }
+                if (USBi_PCI & intr) {
+                        isr_statistics.pci++;
+                        udc->gadget.speed = hw_port_is_high_speed() ?
+                                USB_SPEED_HIGH : USB_SPEED_FULL;
+                        if (udc->suspended) {
+                                spin_unlock(udc->lock);
+                                udc->driver->resume(&udc->gadget);
+                                spin_lock(udc->lock);
+                                udc->suspended = 0;
+                        }
+                }
+                if (USBi_UEI & intr)
+                        isr_statistics.uei++;
+                if (USBi_UI  & intr) {
+                        isr_statistics.ui++;
+                        isr_tr_complete_handler(udc);
+                }
+                if (USBi_SLI & intr) {
+                        if (udc->gadget.speed != USB_SPEED_UNKNOWN) {
+                                udc->suspended = 1;
+                                spin_unlock(udc->lock);
+                                udc->driver->suspend(&udc->gadget);
+                                spin_lock(udc->lock);
+                        }
+                        isr_statistics.sli++;
+                }
+                retval = IRQ_HANDLED;
+        } else {
+                isr_statistics.none++;
+                retval = IRQ_NONE;
+        }
+        spin_unlock(udc->lock);
+
+        return retval;
+}
+
+/**
+ * udc_release: driver release function
+ * @dev: device
+ *
+ * Currently does nothing
+ */
+static void udc_release(struct device *dev)
+{
+        trace("%p", dev);
+
+        if (dev == NULL)
+                err("EINVAL");
+}
+
+/**
+ * udc_probe: parent probe must call this to initialize UDC
+ * @dev:  parent device
+ * @regs: registers base address
+ * @name: driver name
+ *
+ * This function returns an error code
+ * No interrupts active, the IRQ has not been requested yet
+ * Kernel assumes 32-bit DMA operations by default, no need to dma_set_mask
+ */
+static int udc_probe(struct ci13xxx_udc_driver *driver, struct device *dev,
+                void __iomem *regs)
+{
+        struct ci13xxx *udc;
+        int retval = 0;
+
+        trace("%p, %p, %p", dev, regs, name);
+
+        if (dev == NULL || regs == NULL || driver == NULL ||
+                        driver->name == NULL)
+                return -EINVAL;
+
+        udc = kzalloc(sizeof(struct ci13xxx), GFP_KERNEL);
+        if (udc == NULL)
+                return -ENOMEM;
+
+        udc->lock = &udc_lock;
+        udc->regs = regs;
+        udc->udc_driver = driver;
+
+        udc->gadget.ops          = &usb_gadget_ops;
+        udc->gadget.speed        = USB_SPEED_UNKNOWN;
+        udc->gadget.is_dualspeed = 1;
+        udc->gadget.is_otg       = 0;
+        udc->gadget.name         = driver->name;
+
+        INIT_LIST_HEAD(&udc->gadget.ep_list);
+        udc->gadget.ep0 = NULL;
+
+        dev_set_name(&udc->gadget.dev, "gadget");
+        udc->gadget.dev.dma_mask = dev->dma_mask;
+        udc->gadget.dev.coherent_dma_mask = dev->coherent_dma_mask;
+        udc->gadget.dev.parent   = dev;
+        udc->gadget.dev.release  = udc_release;
+
+        retval = hw_device_init(regs);
+        if (retval < 0)
+                goto free_udc;
+
+        udc->transceiver = otg_get_transceiver();
+
+        if (udc->udc_driver->flags & CI13XXX_REQUIRE_TRANSCEIVER) {
+                if (udc->transceiver == NULL) {
+                        retval = -ENODEV;
+                        goto free_udc;
+                }
+        }
+
+        if (!(udc->udc_driver->flags & CI13XXX_REGS_SHARED)) {
+                retval = hw_device_reset(udc);
+                if (retval)
+                        goto put_transceiver;
+        }
+
+        retval = device_register(&udc->gadget.dev);
+        if (retval) {
+                put_device(&udc->gadget.dev);
+                goto put_transceiver;
+        }
+
+#ifdef CONFIG_USB_GADGET_DEBUG_FILES
+        retval = dbg_create_files(&udc->gadget.dev);
+#endif
+        if (retval)
+                goto unreg_device;
+
+        if (udc->transceiver) {
+                retval = otg_set_peripheral(udc->transceiver, &udc->gadget);
+                if (retval)
+                        goto remove_dbg;
+        }
+
+        retval = usb_add_gadget_udc(dev, &udc->gadget);
+        if (retval)
+                goto remove_trans;
+
+        pm_runtime_no_callbacks(&udc->gadget.dev);
+        pm_runtime_enable(&udc->gadget.dev);
+
+        _udc = udc;
+        return retval;
+
+remove_trans:
+        if (udc->transceiver) {
+                otg_set_peripheral(udc->transceiver, &udc->gadget);
+                otg_put_transceiver(udc->transceiver);
+        }
+
+        err("error = %i", retval);
+remove_dbg:
+#ifdef CONFIG_USB_GADGET_DEBUG_FILES
+        dbg_remove_files(&udc->gadget.dev);
+#endif
+unreg_device:
+        device_unregister(&udc->gadget.dev);
+put_transceiver:
+        if (udc->transceiver)
+                otg_put_transceiver(udc->transceiver);
+free_udc:
+        kfree(udc);
+        _udc = NULL;
+        return retval;
+}
+
+/**
+ * udc_remove: parent remove must call this to remove UDC
+ *
+ * No interrupts active, the IRQ has been released
+ */
+static void udc_remove(void)
+{
+        struct ci13xxx *udc = _udc;
+
+        if (udc == NULL) {
+                err("EINVAL");
+                return;
+        }
+        usb_del_gadget_udc(&udc->gadget);
+
+        if (udc->transceiver) {
+                otg_set_peripheral(udc->transceiver, &udc->gadget);
+                otg_put_transceiver(udc->transceiver);
+        }
+#ifdef CONFIG_USB_GADGET_DEBUG_FILES
+        dbg_remove_files(&udc->gadget.dev);
+#endif
+        device_unregister(&udc->gadget.dev);
+
+        kfree(udc);
+        _udc = NULL;
+}
diff --git a/drivers/usb/gadget/ci13xxx_udc.h b/drivers/usb/gadget/ci13xxx_udc.h
new file mode 100644
index 00000000000..23707775cb4
--- /dev/null
+++ b/drivers/usb/gadget/ci13xxx_udc.h
@@ -0,0 +1,227 @@
+/*
+ * ci13xxx_udc.h - structures, registers, and macros MIPS USB IP core
+ *
+ * Copyright (C) 2008 Chipidea - MIPS Technologies, Inc. All rights reserved.
+ *
+ * Author: David Lopo
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Description: MIPS USB IP core family device controller
+ *              Structures, registers and logging macros
+ */
+
+#ifndef _CI13XXX_h_
+#define _CI13XXX_h_
+
+/******************************************************************************
+ * DEFINE
+ *****************************************************************************/
+#define CI13XXX_PAGE_SIZE  4096ul /* page size for TD's */
+#define ENDPT_MAX          (32)
+#define CTRL_PAYLOAD_MAX   (64)
+#define RX        (0)  /* similar to USB_DIR_OUT but can be used as an index */
+#define TX        (1)  /* similar to USB_DIR_IN  but can be used as an index */
+
+/******************************************************************************
+ * STRUCTURES
+ *****************************************************************************/
+/* DMA layout of transfer descriptors */
+struct ci13xxx_td {
+        /* 0 */
+        u32 next;
+#define TD_TERMINATE          BIT(0)
+#define TD_ADDR_MASK          (0xFFFFFFEUL << 5)
+        /* 1 */
+        u32 token;
+#define TD_STATUS             (0x00FFUL <<  0)
+#define TD_STATUS_TR_ERR      BIT(3)
+#define TD_STATUS_DT_ERR      BIT(5)
+#define TD_STATUS_HALTED      BIT(6)
+#define TD_STATUS_ACTIVE      BIT(7)
+#define TD_MULTO              (0x0003UL << 10)
+#define TD_IOC                BIT(15)
+#define TD_TOTAL_BYTES        (0x7FFFUL << 16)
+        /* 2 */
+        u32 page[5];
+#define TD_CURR_OFFSET        (0x0FFFUL <<  0)
+#define TD_FRAME_NUM          (0x07FFUL <<  0)
+#define TD_RESERVED_MASK      (0x0FFFUL <<  0)
+} __attribute__ ((packed));
+
+/* DMA layout of queue heads */
+struct ci13xxx_qh {
+        /* 0 */
+        u32 cap;
+#define QH_IOS                BIT(15)
+#define QH_MAX_PKT            (0x07FFUL << 16)
+#define QH_ZLT                BIT(29)
+#define QH_MULT               (0x0003UL << 30)
+        /* 1 */
+        u32 curr;
+        /* 2 - 8 */
+        struct ci13xxx_td        td;
+        /* 9 */
+        u32 RESERVED;
+        struct usb_ctrlrequest   setup;
+} __attribute__ ((packed));
+
+/* Extension of usb_request */
+struct ci13xxx_req {
+        struct usb_request   req;
+        unsigned             map;
+        struct list_head     queue;
+        struct ci13xxx_td   *ptr;
+        dma_addr_t           dma;
+        struct ci13xxx_td   *zptr;
+        dma_addr_t           zdma;
+};
+
+/* Extension of usb_ep */
+struct ci13xxx_ep {
+        struct usb_ep                          ep;
+        const struct usb_endpoint_descriptor  *desc;
+        u8                                     dir;
+        u8                                     num;
+        u8                                     type;
+        char                                   name[16];
+        struct {
+                struct list_head   queue;
+                struct ci13xxx_qh *ptr;
+                dma_addr_t         dma;
+        }                                      qh;
+        int                                    wedge;
+
+        /* global resources */
+        spinlock_t                            *lock;
+        struct device                         *device;
+        struct dma_pool                       *td_pool;
+};
+
+struct ci13xxx;
+struct ci13xxx_udc_driver {
+        const char      *name;
+        unsigned long    flags;
+#define CI13XXX_REGS_SHARED             BIT(0)
+#define CI13XXX_REQUIRE_TRANSCEIVER     BIT(1)
+#define CI13XXX_PULLUP_ON_VBUS          BIT(2)
+#define CI13XXX_DISABLE_STREAMING       BIT(3)
+
+#define CI13XXX_CONTROLLER_RESET_EVENT          0
+#define CI13XXX_CONTROLLER_STOPPED_EVENT        1
+        void    (*notify_event) (struct ci13xxx *udc, unsigned event);
+};
+
+/* CI13XXX UDC descriptor & global resources */
+struct ci13xxx {
+        spinlock_t                *lock;      /* ctrl register bank access */
+        void __iomem              *regs;      /* registers address space */
+
+        struct dma_pool           *qh_pool;   /* DMA pool for queue heads */
+        struct dma_pool           *td_pool;   /* DMA pool for transfer descs */
+        struct usb_request        *status;    /* ep0 status request */
+
+        struct usb_gadget          gadget;     /* USB slave device */
+        struct ci13xxx_ep          ci13xxx_ep[ENDPT_MAX]; /* extended endpts */
+        u32                        ep0_dir;    /* ep0 direction */
+#define ep0out ci13xxx_ep[0]
+#define ep0in  ci13xxx_ep[16]
+        u8                         remote_wakeup; /* Is remote wakeup feature
+                                                        enabled by the host? */
+        u8                         suspended;  /* suspended by the host */
+        u8                         test_mode;  /* the selected test mode */
+
+        struct usb_gadget_driver  *driver;     /* 3rd party gadget driver */
+        struct ci13xxx_udc_driver *udc_driver; /* device controller driver */
+        int                        vbus_active; /* is VBUS active */
+        struct otg_transceiver    *transceiver; /* Transceiver struct */
+};
+
+/******************************************************************************
+ * REGISTERS
+ *****************************************************************************/
+/* register size */
+#define REG_BITS   (32)
+
+/* HCCPARAMS */
+#define HCCPARAMS_LEN         BIT(17)
+
+/* DCCPARAMS */
+#define DCCPARAMS_DEN         (0x1F << 0)
+#define DCCPARAMS_DC          BIT(7)
+
+/* TESTMODE */
+#define TESTMODE_FORCE        BIT(0)
+
+/* USBCMD */
+#define USBCMD_RS             BIT(0)
+#define USBCMD_RST            BIT(1)
+#define USBCMD_SUTW           BIT(13)
+#define USBCMD_ATDTW          BIT(14)
+
+/* USBSTS & USBINTR */
+#define USBi_UI               BIT(0)
+#define USBi_UEI              BIT(1)
+#define USBi_PCI              BIT(2)
+#define USBi_URI              BIT(6)
+#define USBi_SLI              BIT(8)
+
+/* DEVICEADDR */
+#define DEVICEADDR_USBADRA    BIT(24)
+#define DEVICEADDR_USBADR     (0x7FUL << 25)
+
+/* PORTSC */
+#define PORTSC_FPR            BIT(6)
+#define PORTSC_SUSP           BIT(7)
+#define PORTSC_HSP            BIT(9)
+#define PORTSC_PTC            (0x0FUL << 16)
+
+/* DEVLC */
+#define DEVLC_PSPD            (0x03UL << 25)
+#define    DEVLC_PSPD_HS      (0x02UL << 25)
+
+/* USBMODE */
+#define USBMODE_CM            (0x03UL <<  0)
+#define    USBMODE_CM_IDLE    (0x00UL <<  0)
+#define    USBMODE_CM_DEVICE  (0x02UL <<  0)
+#define    USBMODE_CM_HOST    (0x03UL <<  0)
+#define USBMODE_SLOM          BIT(3)
+#define USBMODE_SDIS          BIT(4)
+
+/* ENDPTCTRL */
+#define ENDPTCTRL_RXS         BIT(0)
+#define ENDPTCTRL_RXT         (0x03UL <<  2)
+#define ENDPTCTRL_RXR         BIT(6)         /* reserved for port 0 */
+#define ENDPTCTRL_RXE         BIT(7)
+#define ENDPTCTRL_TXS         BIT(16)
+#define ENDPTCTRL_TXT         (0x03UL << 18)
+#define ENDPTCTRL_TXR         BIT(22)        /* reserved for port 0 */
+#define ENDPTCTRL_TXE         BIT(23)
+
+/******************************************************************************
+ * LOGGING
+ *****************************************************************************/
+#define ci13xxx_printk(level, format, args...) \
+do { \
+        if (_udc == NULL) \
+                printk(level "[%s] " format "\n", __func__, ## args); \
+        else \
+                dev_printk(level, _udc->gadget.dev.parent, \
+                           "[%s] " format "\n", __func__, ## args); \
+} while (0)
+
+#define err(format, args...)    ci13xxx_printk(KERN_ERR, format, ## args)
+#define warn(format, args...)   ci13xxx_printk(KERN_WARNING, format, ## args)
+#define info(format, args...)   ci13xxx_printk(KERN_INFO, format, ## args)
+
+#ifdef TRACE
+#define trace(format, args...)      ci13xxx_printk(KERN_DEBUG, format, ## args)
+#define dbg_trace(format, args...)  dev_dbg(dev, format, ##args)
+#else
+#define trace(format, args...)      do {} while (0)
+#define dbg_trace(format, args...)  do {} while (0)
+#endif
+
+#endif  /* _CI13XXX_h_ */
diff --git a/drivers/usb/gadget/f_accessory.c b/drivers/usb/gadget/f_accessory.c
new file mode 100644
index 00000000000..ae65faaf3d7
--- /dev/null
+++ b/drivers/usb/gadget/f_accessory.c
@@ -0,0 +1,788 @@
+/*
+ * Gadget Function Driver for Android USB accessories
+ *
+ * Copyright (C) 2011 Google, Inc.
+ * Author: Mike Lockwood <lockwood@android.com>
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+/* #define DEBUG */
+/* #define VERBOSE_DEBUG */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/poll.h>
+#include <linux/delay.h>
+#include <linux/wait.h>
+#include <linux/err.h>
+#include <linux/interrupt.h>
+#include <linux/kthread.h>
+#include <linux/freezer.h>
+
+#include <linux/types.h>
+#include <linux/file.h>
+#include <linux/device.h>
+#include <linux/miscdevice.h>
+
+#include <linux/usb.h>
+#include <linux/usb/ch9.h>
+#include <linux/usb/f_accessory.h>
+
+#define BULK_BUFFER_SIZE    16384
+#define ACC_STRING_SIZE     256
+
+#define PROTOCOL_VERSION    1
+
+/* String IDs */
+#define INTERFACE_STRING_INDEX  0
+
+/* number of tx and rx requests to allocate */
+#define TX_REQ_MAX 4
+#define RX_REQ_MAX 2
+
+struct acc_dev {
+        struct usb_function function;
+        struct usb_composite_dev *cdev;
+        spinlock_t lock;
+
+        struct usb_ep *ep_in;
+        struct usb_ep *ep_out;
+
+        /* set to 1 when we connect */
+        int online:1;
+        /* Set to 1 when we disconnect.
+         * Not cleared until our file is closed.
+         */
+        int disconnected:1;
+
+        /* strings sent by the host */
+        char manufacturer[ACC_STRING_SIZE];
+        char model[ACC_STRING_SIZE];
+        char description[ACC_STRING_SIZE];
+        char version[ACC_STRING_SIZE];
+        char uri[ACC_STRING_SIZE];
+        char serial[ACC_STRING_SIZE];
+
+        /* for acc_complete_set_string */
+        int string_index;
+
+        /* set to 1 if we have a pending start request */
+        int start_requested;
+
+        /* synchronize access to our device file */
+        atomic_t open_excl;
+
+        struct list_head tx_idle;
+
+        wait_queue_head_t read_wq;
+        wait_queue_head_t write_wq;
+        struct usb_request *rx_req[RX_REQ_MAX];
+        int rx_done;
+        struct delayed_work work;
+};
+
+static struct usb_interface_descriptor acc_interface_desc = {
+        .bLength                = USB_DT_INTERFACE_SIZE,
+        .bDescriptorType        = USB_DT_INTERFACE,
+        .bInterfaceNumber       = 0,
+        .bNumEndpoints          = 2,
+        .bInterfaceClass        = USB_CLASS_VENDOR_SPEC,
+        .bInterfaceSubClass     = USB_SUBCLASS_VENDOR_SPEC,
+        .bInterfaceProtocol     = 0,
+};
+
+static struct usb_endpoint_descriptor acc_highspeed_in_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_IN,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize         = __constant_cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor acc_highspeed_out_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_OUT,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize         = __constant_cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor acc_fullspeed_in_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_IN,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_endpoint_descriptor acc_fullspeed_out_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_OUT,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_descriptor_header *fs_acc_descs[] = {
+        (struct usb_descriptor_header *) &acc_interface_desc,
+        (struct usb_descriptor_header *) &acc_fullspeed_in_desc,
+        (struct usb_descriptor_header *) &acc_fullspeed_out_desc,
+        NULL,
+};
+
+static struct usb_descriptor_header *hs_acc_descs[] = {
+        (struct usb_descriptor_header *) &acc_interface_desc,
+        (struct usb_descriptor_header *) &acc_highspeed_in_desc,
+        (struct usb_descriptor_header *) &acc_highspeed_out_desc,
+        NULL,
+};
+
+static struct usb_string acc_string_defs[] = {
+        [INTERFACE_STRING_INDEX].s      = "Android Accessory Interface",
+        {  },   /* end of list */
+};
+
+static struct usb_gadget_strings acc_string_table = {
+        .language               = 0x0409,       /* en-US */
+        .strings                = acc_string_defs,
+};
+
+static struct usb_gadget_strings *acc_strings[] = {
+        &acc_string_table,
+        NULL,
+};
+
+/* temporary variable used between acc_open() and acc_gadget_bind() */
+static struct acc_dev *_acc_dev;
+
+static inline struct acc_dev *func_to_dev(struct usb_function *f)
+{
+        return container_of(f, struct acc_dev, function);
+}
+
+static struct usb_request *acc_request_new(struct usb_ep *ep, int buffer_size)
+{
+        struct usb_request *req = usb_ep_alloc_request(ep, GFP_KERNEL);
+        if (!req)
+                return NULL;
+
+        /* now allocate buffers for the requests */
+        req->buf = kmalloc(buffer_size, GFP_KERNEL);
+        if (!req->buf) {
+                usb_ep_free_request(ep, req);
+                return NULL;
+        }
+
+        return req;
+}
+
+static void acc_request_free(struct usb_request *req, struct usb_ep *ep)
+{
+        if (req) {
+                kfree(req->buf);
+                usb_ep_free_request(ep, req);
+        }
+}
+
+/* add a request to the tail of a list */
+static void req_put(struct acc_dev *dev, struct list_head *head,
+                struct usb_request *req)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&dev->lock, flags);
+        list_add_tail(&req->list, head);
+        spin_unlock_irqrestore(&dev->lock, flags);
+}
+
+/* remove a request from the head of a list */
+static struct usb_request *req_get(struct acc_dev *dev, struct list_head *head)
+{
+        unsigned long flags;
+        struct usb_request *req;
+
+        spin_lock_irqsave(&dev->lock, flags);
+        if (list_empty(head)) {
+                req = 0;
+        } else {
+                req = list_first_entry(head, struct usb_request, list);
+                list_del(&req->list);
+        }
+        spin_unlock_irqrestore(&dev->lock, flags);
+        return req;
+}
+
+static void acc_set_disconnected(struct acc_dev *dev)
+{
+        dev->online = 0;
+        dev->disconnected = 1;
+}
+
+static void acc_complete_in(struct usb_ep *ep, struct usb_request *req)
+{
+        struct acc_dev *dev = _acc_dev;
+
+        if (req->status != 0)
+                acc_set_disconnected(dev);
+
+        req_put(dev, &dev->tx_idle, req);
+
+        wake_up(&dev->write_wq);
+}
+
+static void acc_complete_out(struct usb_ep *ep, struct usb_request *req)
+{
+        struct acc_dev *dev = _acc_dev;
+
+        dev->rx_done = 1;
+        if (req->status != 0)
+                acc_set_disconnected(dev);
+
+        wake_up(&dev->read_wq);
+}
+
+static void acc_complete_set_string(struct usb_ep *ep, struct usb_request *req)
+{
+        struct acc_dev  *dev = ep->driver_data;
+        char *string_dest = NULL;
+        int length = req->actual;
+
+        if (req->status != 0) {
+                pr_err("acc_complete_set_string, err %d\n", req->status);
+                return;
+        }
+
+        switch (dev->string_index) {
+        case ACCESSORY_STRING_MANUFACTURER:
+                string_dest = dev->manufacturer;
+                break;
+        case ACCESSORY_STRING_MODEL:
+                string_dest = dev->model;
+                break;
+        case ACCESSORY_STRING_DESCRIPTION:
+                string_dest = dev->description;
+                break;
+        case ACCESSORY_STRING_VERSION:
+                string_dest = dev->version;
+                break;
+        case ACCESSORY_STRING_URI:
+                string_dest = dev->uri;
+                break;
+        case ACCESSORY_STRING_SERIAL:
+                string_dest = dev->serial;
+                break;
+        }
+        if (string_dest) {
+                unsigned long flags;
+
+                if (length >= ACC_STRING_SIZE)
+                        length = ACC_STRING_SIZE - 1;
+
+                spin_lock_irqsave(&dev->lock, flags);
+                memcpy(string_dest, req->buf, length);
+                /* ensure zero termination */
+                string_dest[length] = 0;
+                spin_unlock_irqrestore(&dev->lock, flags);
+        } else {
+                pr_err("unknown accessory string index %d\n",
+                        dev->string_index);
+        }
+}
+
+static int __init create_bulk_endpoints(struct acc_dev *dev,
+                                struct usb_endpoint_descriptor *in_desc,
+                                struct usb_endpoint_descriptor *out_desc)
+{
+        struct usb_composite_dev *cdev = dev->cdev;
+        struct usb_request *req;
+        struct usb_ep *ep;
+        int i;
+
+        DBG(cdev, "create_bulk_endpoints dev: %p\n", dev);
+
+        ep = usb_ep_autoconfig(cdev->gadget, in_desc);
+        if (!ep) {
+                DBG(cdev, "usb_ep_autoconfig for ep_in failed\n");
+                return -ENODEV;
+        }
+        DBG(cdev, "usb_ep_autoconfig for ep_in got %s\n", ep->name);
+        ep->driver_data = dev;          /* claim the endpoint */
+        dev->ep_in = ep;
+
+        ep = usb_ep_autoconfig(cdev->gadget, out_desc);
+        if (!ep) {
+                DBG(cdev, "usb_ep_autoconfig for ep_out failed\n");
+                return -ENODEV;
+        }
+        DBG(cdev, "usb_ep_autoconfig for ep_out got %s\n", ep->name);
+        ep->driver_data = dev;          /* claim the endpoint */
+        dev->ep_out = ep;
+
+        ep = usb_ep_autoconfig(cdev->gadget, out_desc);
+        if (!ep) {
+                DBG(cdev, "usb_ep_autoconfig for ep_out failed\n");
+                return -ENODEV;
+        }
+        DBG(cdev, "usb_ep_autoconfig for ep_out got %s\n", ep->name);
+        ep->driver_data = dev;          /* claim the endpoint */
+        dev->ep_out = ep;
+
+        /* now allocate requests for our endpoints */
+        for (i = 0; i < TX_REQ_MAX; i++) {
+                req = acc_request_new(dev->ep_in, BULK_BUFFER_SIZE);
+                if (!req)
+                        goto fail;
+                req->complete = acc_complete_in;
+                req_put(dev, &dev->tx_idle, req);
+        }
+        for (i = 0; i < RX_REQ_MAX; i++) {
+                req = acc_request_new(dev->ep_out, BULK_BUFFER_SIZE);
+                if (!req)
+                        goto fail;
+                req->complete = acc_complete_out;
+                dev->rx_req[i] = req;
+        }
+
+        return 0;
+
+fail:
+        printk(KERN_ERR "acc_bind() could not allocate requests\n");
+        while ((req = req_get(dev, &dev->tx_idle)))
+                acc_request_free(req, dev->ep_in);
+        for (i = 0; i < RX_REQ_MAX; i++)
+                acc_request_free(dev->rx_req[i], dev->ep_out);
+        return -1;
+}
+
+static ssize_t acc_read(struct file *fp, char __user *buf,
+        size_t count, loff_t *pos)
+{
+        struct acc_dev *dev = fp->private_data;
+        struct usb_request *req;
+        int r = count, xfer;
+        int ret = 0;
+
+        pr_debug("acc_read(%d)\n", count);
+
+        if (dev->disconnected)
+                return -ENODEV;
+
+        if (count > BULK_BUFFER_SIZE)
+                count = BULK_BUFFER_SIZE;
+
+        /* we will block until we're online */
+        pr_debug("acc_read: waiting for online\n");
+        ret = wait_event_interruptible(dev->read_wq, dev->online);
+        if (ret < 0) {
+                r = ret;
+                goto done;
+        }
+
+requeue_req:
+        /* queue a request */
+        req = dev->rx_req[0];
+        req->length = count;
+        dev->rx_done = 0;
+        ret = usb_ep_queue(dev->ep_out, req, GFP_KERNEL);
+        if (ret < 0) {
+                r = -EIO;
+                goto done;
+        } else {
+                pr_debug("rx %p queue\n", req);
+        }
+
+        /* wait for a request to complete */
+        ret = wait_event_interruptible(dev->read_wq, dev->rx_done);
+        if (ret < 0) {
+                r = ret;
+                usb_ep_dequeue(dev->ep_out, req);
+                goto done;
+        }
+        if (dev->online) {
+                /* If we got a 0-len packet, throw it back and try again. */
+                if (req->actual == 0)
+                        goto requeue_req;
+
+                pr_debug("rx %p %d\n", req, req->actual);
+                xfer = (req->actual < count) ? req->actual : count;
+                r = xfer;
+                if (copy_to_user(buf, req->buf, xfer))
+                        r = -EFAULT;
+        } else
+                r = -EIO;
+
+done:
+        pr_debug("acc_read returning %d\n", r);
+        return r;
+}
+
+static ssize_t acc_write(struct file *fp, const char __user *buf,
+        size_t count, loff_t *pos)
+{
+        struct acc_dev *dev = fp->private_data;
+        struct usb_request *req = 0;
+        int r = count, xfer;
+        int ret;
+
+        pr_debug("acc_write(%d)\n", count);
+
+        if (!dev->online || dev->disconnected)
+                return -ENODEV;
+
+        while (count > 0) {
+                if (!dev->online) {
+                        pr_debug("acc_write dev->error\n");
+                        r = -EIO;
+                        break;
+                }
+
+                /* get an idle tx request to use */
+                req = 0;
+                ret = wait_event_interruptible(dev->write_wq,
+                        ((req = req_get(dev, &dev->tx_idle)) || !dev->online));
+                if (!req) {
+                        r = ret;
+                        break;
+                }
+
+                if (count > BULK_BUFFER_SIZE)
+                        xfer = BULK_BUFFER_SIZE;
+                else
+                        xfer = count;
+                if (copy_from_user(req->buf, buf, xfer)) {
+                        r = -EFAULT;
+                        break;
+                }
+
+                req->length = xfer;
+                ret = usb_ep_queue(dev->ep_in, req, GFP_KERNEL);
+                if (ret < 0) {
+                        pr_debug("acc_write: xfer error %d\n", ret);
+                        r = -EIO;
+                        break;
+                }
+
+                buf += xfer;
+                count -= xfer;
+
+                /* zero this so we don't try to free it on error exit */
+                req = 0;
+        }
+
+        if (req)
+                req_put(dev, &dev->tx_idle, req);
+
+        pr_debug("acc_write returning %d\n", r);
+        return r;
+}
+
+static long acc_ioctl(struct file *fp, unsigned code, unsigned long value)
+{
+        struct acc_dev *dev = fp->private_data;
+        char *src = NULL;
+        int ret;
+
+        switch (code) {
+        case ACCESSORY_GET_STRING_MANUFACTURER:
+                src = dev->manufacturer;
+                break;
+        case ACCESSORY_GET_STRING_MODEL:
+                src = dev->model;
+                break;
+        case ACCESSORY_GET_STRING_DESCRIPTION:
+                src = dev->description;
+                break;
+        case ACCESSORY_GET_STRING_VERSION:
+                src = dev->version;
+                break;
+        case ACCESSORY_GET_STRING_URI:
+                src = dev->uri;
+                break;
+        case ACCESSORY_GET_STRING_SERIAL:
+                src = dev->serial;
+                break;
+        case ACCESSORY_IS_START_REQUESTED:
+                return dev->start_requested;
+        }
+        if (!src)
+                return -EINVAL;
+
+        ret = strlen(src) + 1;
+        if (copy_to_user((void __user *)value, src, ret))
+                ret = -EFAULT;
+        return ret;
+}
+
+static int acc_open(struct inode *ip, struct file *fp)
+{
+        printk(KERN_INFO "acc_open\n");
+        if (atomic_xchg(&_acc_dev->open_excl, 1))
+                return -EBUSY;
+
+        _acc_dev->disconnected = 0;
+        fp->private_data = _acc_dev;
+        return 0;
+}
+
+static int acc_release(struct inode *ip, struct file *fp)
+{
+        printk(KERN_INFO "acc_release\n");
+
+        WARN_ON(!atomic_xchg(&_acc_dev->open_excl, 0));
+        _acc_dev->disconnected = 0;
+        return 0;
+}
+
+/* file operations for /dev/acc_usb */
+static const struct file_operations acc_fops = {
+        .owner = THIS_MODULE,
+        .read = acc_read,
+        .write = acc_write,
+        .unlocked_ioctl = acc_ioctl,
+        .open = acc_open,
+        .release = acc_release,
+};
+
+static struct miscdevice acc_device = {
+        .minor = MISC_DYNAMIC_MINOR,
+        .name = "usb_accessory",
+        .fops = &acc_fops,
+};
+
+
+static int acc_ctrlrequest(struct usb_composite_dev *cdev,
+                                const struct usb_ctrlrequest *ctrl)
+{
+        struct acc_dev  *dev = _acc_dev;
+        int     value = -EOPNOTSUPP;
+        u8 b_requestType = ctrl->bRequestType;
+        u8 b_request = ctrl->bRequest;
+        u16     w_index = le16_to_cpu(ctrl->wIndex);
+        u16     w_value = le16_to_cpu(ctrl->wValue);
+        u16     w_length = le16_to_cpu(ctrl->wLength);
+
+/*
+        printk(KERN_INFO "acc_ctrlrequest "
+                        "%02x.%02x v%04x i%04x l%u\n",
+                        b_requestType, b_request,
+                        w_value, w_index, w_length);
+*/
+
+        if (b_requestType == (USB_DIR_OUT | USB_TYPE_VENDOR)) {
+                if (b_request == ACCESSORY_START) {
+                        dev->start_requested = 1;
+                        schedule_delayed_work(
+                                &dev->work, msecs_to_jiffies(10));
+                        value = 0;
+                } else if (b_request == ACCESSORY_SEND_STRING) {
+                        dev->string_index = w_index;
+                        cdev->gadget->ep0->driver_data = dev;
+                        cdev->req->complete = acc_complete_set_string;
+                        value = w_length;
+                }
+        } else if (b_requestType == (USB_DIR_IN | USB_TYPE_VENDOR)) {
+                if (b_request == ACCESSORY_GET_PROTOCOL) {
+                        *((u16 *)cdev->req->buf) = PROTOCOL_VERSION;
+                        value = sizeof(u16);
+
+                        /* clear any strings left over from a previous session */
+                        memset(dev->manufacturer, 0, sizeof(dev->manufacturer));
+                        memset(dev->model, 0, sizeof(dev->model));
+                        memset(dev->description, 0, sizeof(dev->description));
+                        memset(dev->version, 0, sizeof(dev->version));
+                        memset(dev->uri, 0, sizeof(dev->uri));
+                        memset(dev->serial, 0, sizeof(dev->serial));
+                        dev->start_requested = 0;
+                }
+        }
+
+        if (value >= 0) {
+                cdev->req->zero = 0;
+                cdev->req->length = value;
+                value = usb_ep_queue(cdev->gadget->ep0, cdev->req, GFP_ATOMIC);
+                if (value < 0)
+                        ERROR(cdev, "%s setup response queue error\n",
+                                __func__);
+        }
+
+        if (value == -EOPNOTSUPP)
+                VDBG(cdev,
+                        "unknown class-specific control req "
+                        "%02x.%02x v%04x i%04x l%u\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, w_length);
+        return value;
+}
+
+static int
+acc_function_bind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct usb_composite_dev *cdev = c->cdev;
+        struct acc_dev  *dev = func_to_dev(f);
+        int                     id;
+        int                     ret;
+
+        DBG(cdev, "acc_function_bind dev: %p\n", dev);
+
+        dev->start_requested = 0;
+
+        /* allocate interface ID(s) */
+        id = usb_interface_id(c, f);
+        if (id < 0)
+                return id;
+        acc_interface_desc.bInterfaceNumber = id;
+
+        /* allocate endpoints */
+        ret = create_bulk_endpoints(dev, &acc_fullspeed_in_desc,
+                        &acc_fullspeed_out_desc);
+        if (ret)
+                return ret;
+
+        /* support high speed hardware */
+        if (gadget_is_dualspeed(c->cdev->gadget)) {
+                acc_highspeed_in_desc.bEndpointAddress =
+                        acc_fullspeed_in_desc.bEndpointAddress;
+                acc_highspeed_out_desc.bEndpointAddress =
+                        acc_fullspeed_out_desc.bEndpointAddress;
+        }
+
+        DBG(cdev, "%s speed %s: IN/%s, OUT/%s\n",
+                        gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
+                        f->name, dev->ep_in->name, dev->ep_out->name);
+        return 0;
+}
+
+static void
+acc_function_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct acc_dev  *dev = func_to_dev(f);
+        struct usb_request *req;
+        int i;
+
+        while ((req = req_get(dev, &dev->tx_idle)))
+                acc_request_free(req, dev->ep_in);
+        for (i = 0; i < RX_REQ_MAX; i++)
+                acc_request_free(dev->rx_req[i], dev->ep_out);
+}
+
+static void acc_work(struct work_struct *data)
+{
+        char *envp[2] = { "ACCESSORY=START", NULL };
+        kobject_uevent_env(&acc_device.this_device->kobj, KOBJ_CHANGE, envp);
+}
+
+static int acc_function_set_alt(struct usb_function *f,
+                unsigned intf, unsigned alt)
+{
+        struct acc_dev  *dev = func_to_dev(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+        int ret;
+
+        DBG(cdev, "acc_function_set_alt intf: %d alt: %d\n", intf, alt);
+        config_ep_by_speed(cdev->gadget, f, dev->ep_in);
+        ret = usb_ep_enable(dev->ep_in);
+        if (ret)
+                return ret;
+        config_ep_by_speed(cdev->gadget, f, dev->ep_out);
+        ret = usb_ep_enable(dev->ep_out);
+        if (ret) {
+                usb_ep_disable(dev->ep_in);
+                return ret;
+        }
+
+        dev->online = 1;
+
+        /* readers may be blocked waiting for us to go online */
+        wake_up(&dev->read_wq);
+        return 0;
+}
+
+static void acc_function_disable(struct usb_function *f)
+{
+        struct acc_dev  *dev = func_to_dev(f);
+        struct usb_composite_dev        *cdev = dev->cdev;
+
+        DBG(cdev, "acc_function_disable\n");
+        acc_set_disconnected(dev);
+        usb_ep_disable(dev->ep_in);
+        usb_ep_disable(dev->ep_out);
+
+        /* readers may be blocked waiting for us to go online */
+        wake_up(&dev->read_wq);
+
+        VDBG(cdev, "%s disabled\n", dev->function.name);
+}
+
+static int acc_bind_config(struct usb_configuration *c)
+{
+        struct acc_dev *dev = _acc_dev;
+        int ret;
+
+        printk(KERN_INFO "acc_bind_config\n");
+
+        /* allocate a string ID for our interface */
+        if (acc_string_defs[INTERFACE_STRING_INDEX].id == 0) {
+                ret = usb_string_id(c->cdev);
+                if (ret < 0)
+                        return ret;
+                acc_string_defs[INTERFACE_STRING_INDEX].id = ret;
+                acc_interface_desc.iInterface = ret;
+        }
+
+        dev->cdev = c->cdev;
+        dev->function.name = "accessory";
+        dev->function.strings = acc_strings,
+        dev->function.descriptors = fs_acc_descs;
+        dev->function.hs_descriptors = hs_acc_descs;
+        dev->function.bind = acc_function_bind;
+        dev->function.unbind = acc_function_unbind;
+        dev->function.set_alt = acc_function_set_alt;
+        dev->function.disable = acc_function_disable;
+
+        return usb_add_function(c, &dev->function);
+}
+
+static int acc_setup(void)
+{
+        struct acc_dev *dev;
+        int ret;
+
+        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+        if (!dev)
+                return -ENOMEM;
+
+        spin_lock_init(&dev->lock);
+        init_waitqueue_head(&dev->read_wq);
+        init_waitqueue_head(&dev->write_wq);
+        atomic_set(&dev->open_excl, 0);
+        INIT_LIST_HEAD(&dev->tx_idle);
+        INIT_DELAYED_WORK(&dev->work, acc_work);
+
+        /* _acc_dev must be set before calling usb_gadget_register_driver */
+        _acc_dev = dev;
+
+        ret = misc_register(&acc_device);
+        if (ret)
+                goto err;
+
+        return 0;
+
+err:
+        kfree(dev);
+        printk(KERN_ERR "USB accessory gadget driver failed to initialize\n");
+        return ret;
+}
+
+static void acc_cleanup(void)
+{
+        misc_deregister(&acc_device);
+        kfree(_acc_dev);
+        _acc_dev = NULL;
+}
diff --git a/drivers/usb/gadget/f_adb.c b/drivers/usb/gadget/f_adb.c
new file mode 100644
index 00000000000..94a793f4390
--- /dev/null
+++ b/drivers/usb/gadget/f_adb.c
@@ -0,0 +1,635 @@
+/*
+ * Gadget Driver for Android ADB
+ *
+ * Copyright (C) 2008 Google, Inc.
+ * Author: Mike Lockwood <lockwood@android.com>
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/poll.h>
+#include <linux/delay.h>
+#include <linux/wait.h>
+#include <linux/err.h>
+#include <linux/interrupt.h>
+#include <linux/sched.h>
+#include <linux/types.h>
+#include <linux/device.h>
+#include <linux/miscdevice.h>
+
+#define ADB_BULK_BUFFER_SIZE           4096
+
+/* number of tx requests to allocate */
+#define TX_REQ_MAX 4
+
+static const char adb_shortname[] = "android_adb";
+
+struct adb_dev {
+        struct usb_function function;
+        struct usb_composite_dev *cdev;
+        spinlock_t lock;
+
+        struct usb_ep *ep_in;
+        struct usb_ep *ep_out;
+
+        int online;
+        int error;
+
+        atomic_t read_excl;
+        atomic_t write_excl;
+        atomic_t open_excl;
+
+        struct list_head tx_idle;
+
+        wait_queue_head_t read_wq;
+        wait_queue_head_t write_wq;
+        struct usb_request *rx_req;
+        int rx_done;
+};
+
+static struct usb_interface_descriptor adb_interface_desc = {
+        .bLength                = USB_DT_INTERFACE_SIZE,
+        .bDescriptorType        = USB_DT_INTERFACE,
+        .bInterfaceNumber       = 0,
+        .bNumEndpoints          = 2,
+        .bInterfaceClass        = 0xFF,
+        .bInterfaceSubClass     = 0x42,
+        .bInterfaceProtocol     = 1,
+};
+
+static struct usb_endpoint_descriptor adb_highspeed_in_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_IN,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize         = __constant_cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor adb_highspeed_out_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_OUT,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize         = __constant_cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor adb_fullspeed_in_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_IN,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_endpoint_descriptor adb_fullspeed_out_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_OUT,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_descriptor_header *fs_adb_descs[] = {
+        (struct usb_descriptor_header *) &adb_interface_desc,
+        (struct usb_descriptor_header *) &adb_fullspeed_in_desc,
+        (struct usb_descriptor_header *) &adb_fullspeed_out_desc,
+        NULL,
+};
+
+static struct usb_descriptor_header *hs_adb_descs[] = {
+        (struct usb_descriptor_header *) &adb_interface_desc,
+        (struct usb_descriptor_header *) &adb_highspeed_in_desc,
+        (struct usb_descriptor_header *) &adb_highspeed_out_desc,
+        NULL,
+};
+
+
+/* temporary variable used between adb_open() and adb_gadget_bind() */
+static struct adb_dev *_adb_dev;
+
+static inline struct adb_dev *func_to_adb(struct usb_function *f)
+{
+        return container_of(f, struct adb_dev, function);
+}
+
+
+static struct usb_request *adb_request_new(struct usb_ep *ep, int buffer_size)
+{
+        struct usb_request *req = usb_ep_alloc_request(ep, GFP_KERNEL);
+        if (!req)
+                return NULL;
+
+        /* now allocate buffers for the requests */
+        req->buf = kmalloc(buffer_size, GFP_KERNEL);
+        if (!req->buf) {
+                usb_ep_free_request(ep, req);
+                return NULL;
+        }
+
+        return req;
+}
+
+static void adb_request_free(struct usb_request *req, struct usb_ep *ep)
+{
+        if (req) {
+                kfree(req->buf);
+                usb_ep_free_request(ep, req);
+        }
+}
+
+static inline int adb_lock(atomic_t *excl)
+{
+        int ret = -1;
+
+        preempt_disable();
+        if (atomic_inc_return(excl) == 1) {
+                ret = 0;
+        } else
+                atomic_dec(excl);
+
+        preempt_enable();
+        return ret;
+}
+
+static inline void adb_unlock(atomic_t *excl)
+{
+        atomic_dec(excl);
+}
+
+/* add a request to the tail of a list */
+void adb_req_put(struct adb_dev *dev, struct list_head *head,
+                struct usb_request *req)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&dev->lock, flags);
+        list_add_tail(&req->list, head);
+        spin_unlock_irqrestore(&dev->lock, flags);
+}
+
+/* remove a request from the head of a list */
+struct usb_request *adb_req_get(struct adb_dev *dev, struct list_head *head)
+{
+        unsigned long flags;
+        struct usb_request *req;
+
+        spin_lock_irqsave(&dev->lock, flags);
+        if (list_empty(head)) {
+                req = 0;
+        } else {
+                req = list_first_entry(head, struct usb_request, list);
+                list_del(&req->list);
+        }
+        spin_unlock_irqrestore(&dev->lock, flags);
+        return req;
+}
+
+static void adb_complete_in(struct usb_ep *ep, struct usb_request *req)
+{
+        struct adb_dev *dev = _adb_dev;
+
+        if (req->status != 0)
+                dev->error = 1;
+
+        adb_req_put(dev, &dev->tx_idle, req);
+
+        wake_up(&dev->write_wq);
+}
+
+static void adb_complete_out(struct usb_ep *ep, struct usb_request *req)
+{
+        struct adb_dev *dev = _adb_dev;
+
+        dev->rx_done = 1;
+        if (req->status != 0)
+                dev->error = 1;
+
+        wake_up(&dev->read_wq);
+}
+
+static int adb_create_bulk_endpoints(struct adb_dev *dev,
+                                struct usb_endpoint_descriptor *in_desc,
+                                struct usb_endpoint_descriptor *out_desc)
+{
+        struct usb_composite_dev *cdev = dev->cdev;
+        struct usb_request *req;
+        struct usb_ep *ep;
+        int i;
+
+        DBG(cdev, "create_bulk_endpoints dev: %p\n", dev);
+
+        ep = usb_ep_autoconfig(cdev->gadget, in_desc);
+        if (!ep) {
+                DBG(cdev, "usb_ep_autoconfig for ep_in failed\n");
+                return -ENODEV;
+        }
+        DBG(cdev, "usb_ep_autoconfig for ep_in got %s\n", ep->name);
+        ep->driver_data = dev;          /* claim the endpoint */
+        dev->ep_in = ep;
+
+        ep = usb_ep_autoconfig(cdev->gadget, out_desc);
+        if (!ep) {
+                DBG(cdev, "usb_ep_autoconfig for ep_out failed\n");
+                return -ENODEV;
+        }
+        DBG(cdev, "usb_ep_autoconfig for adb ep_out got %s\n", ep->name);
+        ep->driver_data = dev;          /* claim the endpoint */
+        dev->ep_out = ep;
+
+        /* now allocate requests for our endpoints */
+        req = adb_request_new(dev->ep_out, ADB_BULK_BUFFER_SIZE);
+        if (!req)
+                goto fail;
+        req->complete = adb_complete_out;
+        dev->rx_req = req;
+
+        for (i = 0; i < TX_REQ_MAX; i++) {
+                req = adb_request_new(dev->ep_in, ADB_BULK_BUFFER_SIZE);
+                if (!req)
+                        goto fail;
+                req->complete = adb_complete_in;
+                adb_req_put(dev, &dev->tx_idle, req);
+        }
+
+        return 0;
+
+fail:
+        printk(KERN_ERR "adb_bind() could not allocate requests\n");
+        return -1;
+}
+
+static ssize_t adb_read(struct file *fp, char __user *buf,
+                                size_t count, loff_t *pos)
+{
+        struct adb_dev *dev = fp->private_data;
+        struct usb_request *req;
+        int r = count, xfer;
+        int ret;
+
+        pr_debug("adb_read(%d)\n", count);
+        if (!_adb_dev)
+                return -ENODEV;
+
+        if (count > ADB_BULK_BUFFER_SIZE)
+                return -EINVAL;
+
+        if (adb_lock(&dev->read_excl))
+                return -EBUSY;
+
+        /* we will block until we're online */
+        while (!(dev->online || dev->error)) {
+                pr_debug("adb_read: waiting for online state\n");
+                ret = wait_event_interruptible(dev->read_wq,
+                                (dev->online || dev->error));
+                if (ret < 0) {
+                        adb_unlock(&dev->read_excl);
+                        return ret;
+                }
+        }
+        if (dev->error) {
+                r = -EIO;
+                goto done;
+        }
+
+requeue_req:
+        /* queue a request */
+        req = dev->rx_req;
+        req->length = count;
+        dev->rx_done = 0;
+        ret = usb_ep_queue(dev->ep_out, req, GFP_ATOMIC);
+        if (ret < 0) {
+                pr_debug("adb_read: failed to queue req %p (%d)\n", req, ret);
+                r = -EIO;
+                dev->error = 1;
+                goto done;
+        } else {
+                pr_debug("rx %p queue\n", req);
+        }
+
+        /* wait for a request to complete */
+        ret = wait_event_interruptible(dev->read_wq, dev->rx_done);
+        if (ret < 0) {
+                dev->error = 1;
+                r = ret;
+                usb_ep_dequeue(dev->ep_out, req);
+                goto done;
+        }
+        if (!dev->error) {
+                /* If we got a 0-len packet, throw it back and try again. */
+                if (req->actual == 0)
+                        goto requeue_req;
+
+                pr_debug("rx %p %d\n", req, req->actual);
+                xfer = (req->actual < count) ? req->actual : count;
+                if (copy_to_user(buf, req->buf, xfer))
+                        r = -EFAULT;
+
+        } else
+                r = -EIO;
+
+done:
+        adb_unlock(&dev->read_excl);
+        pr_debug("adb_read returning %d\n", r);
+        return r;
+}
+
+static ssize_t adb_write(struct file *fp, const char __user *buf,
+                                 size_t count, loff_t *pos)
+{
+        struct adb_dev *dev = fp->private_data;
+        struct usb_request *req = 0;
+        int r = count, xfer;
+        int ret;
+
+        if (!_adb_dev)
+                return -ENODEV;
+        pr_debug("adb_write(%d)\n", count);
+
+        if (adb_lock(&dev->write_excl))
+                return -EBUSY;
+
+        while (count > 0) {
+                if (dev->error) {
+                        pr_debug("adb_write dev->error\n");
+                        r = -EIO;
+                        break;
+                }
+
+                /* get an idle tx request to use */
+                req = 0;
+                ret = wait_event_interruptible(dev->write_wq,
+                        (req = adb_req_get(dev, &dev->tx_idle)) || dev->error);
+
+                if (ret < 0) {
+                        r = ret;
+                        break;
+                }
+
+                if (req != 0) {
+                        if (count > ADB_BULK_BUFFER_SIZE)
+                                xfer = ADB_BULK_BUFFER_SIZE;
+                        else
+                                xfer = count;
+                        if (copy_from_user(req->buf, buf, xfer)) {
+                                r = -EFAULT;
+                                break;
+                        }
+
+                        req->length = xfer;
+                        ret = usb_ep_queue(dev->ep_in, req, GFP_ATOMIC);
+                        if (ret < 0) {
+                                pr_debug("adb_write: xfer error %d\n", ret);
+                                dev->error = 1;
+                                r = -EIO;
+                                break;
+                        }
+
+                        buf += xfer;
+                        count -= xfer;
+
+                        /* zero this so we don't try to free it on error exit */
+                        req = 0;
+                }
+        }
+
+        if (req)
+                adb_req_put(dev, &dev->tx_idle, req);
+
+        adb_unlock(&dev->write_excl);
+        pr_debug("adb_write returning %d\n", r);
+        return r;
+}
+
+static int adb_open(struct inode *ip, struct file *fp)
+{
+        static unsigned long last_print;
+        static unsigned long count = 0;
+
+        if (!_adb_dev)
+                return -ENODEV;
+
+        if (++count == 1)
+                last_print = jiffies;
+        else {
+                if (!time_before(jiffies, last_print + HZ/2))
+                        count = 0;
+                last_print = jiffies;
+        }
+
+        if (adb_lock(&_adb_dev->open_excl)) {
+                cpu_relax();
+                return -EBUSY;
+        }
+
+        if (count < 5)
+                printk(KERN_INFO "adb_open(%s)\n", current->comm);
+
+
+        fp->private_data = _adb_dev;
+
+        /* clear the error latch */
+        _adb_dev->error = 0;
+
+        return 0;
+}
+
+static int adb_release(struct inode *ip, struct file *fp)
+{
+        static unsigned long last_print;
+        static unsigned long count = 0;
+
+        if (++count == 1)
+                last_print = jiffies;
+        else {
+                if (!time_before(jiffies, last_print + HZ/2))
+                        count = 0;
+                last_print = jiffies;
+        }
+
+        if (count < 5)
+                printk(KERN_INFO "adb_release\n");
+        adb_unlock(&_adb_dev->open_excl);
+        return 0;
+}
+
+/* file operations for ADB device /dev/android_adb */
+static struct file_operations adb_fops = {
+        .owner = THIS_MODULE,
+        .read = adb_read,
+        .write = adb_write,
+        .open = adb_open,
+        .release = adb_release,
+};
+
+static struct miscdevice adb_device = {
+        .minor = MISC_DYNAMIC_MINOR,
+        .name = adb_shortname,
+        .fops = &adb_fops,
+};
+
+
+
+
+static int
+adb_function_bind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct usb_composite_dev *cdev = c->cdev;
+        struct adb_dev  *dev = func_to_adb(f);
+        int                     id;
+        int                     ret;
+
+        dev->cdev = cdev;
+        DBG(cdev, "adb_function_bind dev: %p\n", dev);
+
+        /* allocate interface ID(s) */
+        id = usb_interface_id(c, f);
+        if (id < 0)
+                return id;
+        adb_interface_desc.bInterfaceNumber = id;
+
+        /* allocate endpoints */
+        ret = adb_create_bulk_endpoints(dev, &adb_fullspeed_in_desc,
+                        &adb_fullspeed_out_desc);
+        if (ret)
+                return ret;
+
+        /* support high speed hardware */
+        if (gadget_is_dualspeed(c->cdev->gadget)) {
+                adb_highspeed_in_desc.bEndpointAddress =
+                        adb_fullspeed_in_desc.bEndpointAddress;
+                adb_highspeed_out_desc.bEndpointAddress =
+                        adb_fullspeed_out_desc.bEndpointAddress;
+        }
+
+        DBG(cdev, "%s speed %s: IN/%s, OUT/%s\n",
+                        gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
+                        f->name, dev->ep_in->name, dev->ep_out->name);
+        return 0;
+}
+
+static void
+adb_function_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct adb_dev  *dev = func_to_adb(f);
+        struct usb_request *req;
+
+
+        dev->online = 0;
+        dev->error = 1;
+
+        wake_up(&dev->read_wq);
+
+        adb_request_free(dev->rx_req, dev->ep_out);
+        while ((req = adb_req_get(dev, &dev->tx_idle)))
+                adb_request_free(req, dev->ep_in);
+}
+
+static int adb_function_set_alt(struct usb_function *f,
+                unsigned intf, unsigned alt)
+{
+        struct adb_dev  *dev = func_to_adb(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+        int ret;
+
+        DBG(cdev, "adb_function_set_alt intf: %d alt: %d\n", intf, alt);
+        config_ep_by_speed(cdev->gadget, f, dev->ep_in);
+        ret = usb_ep_enable(dev->ep_in);
+        if (ret)
+                return ret;
+        config_ep_by_speed(cdev->gadget, f, dev->ep_out);
+        ret = usb_ep_enable(dev->ep_out);
+        if (ret) {
+                usb_ep_disable(dev->ep_in);
+                return ret;
+        }
+        dev->online = 1;
+
+        /* readers may be blocked waiting for us to go online */
+        wake_up(&dev->read_wq);
+        return 0;
+}
+
+static void adb_function_disable(struct usb_function *f)
+{
+        struct adb_dev  *dev = func_to_adb(f);
+        struct usb_composite_dev        *cdev = dev->cdev;
+
+        DBG(cdev, "adb_function_disable cdev %p\n", cdev);
+        dev->online = 0;
+        dev->error = 1;
+        usb_ep_disable(dev->ep_in);
+        usb_ep_disable(dev->ep_out);
+
+        /* readers may be blocked waiting for us to go online */
+        wake_up(&dev->read_wq);
+
+        VDBG(cdev, "%s disabled\n", dev->function.name);
+}
+
+static int adb_bind_config(struct usb_configuration *c)
+{
+        struct adb_dev *dev = _adb_dev;
+
+        printk(KERN_INFO "adb_bind_config\n");
+
+        dev->cdev = c->cdev;
+        dev->function.name = "adb";
+        dev->function.descriptors = fs_adb_descs;
+        dev->function.hs_descriptors = hs_adb_descs;
+        dev->function.bind = adb_function_bind;
+        dev->function.unbind = adb_function_unbind;
+        dev->function.set_alt = adb_function_set_alt;
+        dev->function.disable = adb_function_disable;
+
+        return usb_add_function(c, &dev->function);
+}
+
+static int adb_setup(void)
+{
+        struct adb_dev *dev;
+        int ret;
+
+        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+        if (!dev)
+                return -ENOMEM;
+
+        spin_lock_init(&dev->lock);
+
+        init_waitqueue_head(&dev->read_wq);
+        init_waitqueue_head(&dev->write_wq);
+
+        atomic_set(&dev->open_excl, 0);
+        atomic_set(&dev->read_excl, 0);
+        atomic_set(&dev->write_excl, 0);
+
+        INIT_LIST_HEAD(&dev->tx_idle);
+
+        _adb_dev = dev;
+
+        ret = misc_register(&adb_device);
+        if (ret)
+                goto err;
+
+        return 0;
+
+err:
+        kfree(dev);
+        printk(KERN_ERR "adb gadget driver failed to initialize\n");
+        return ret;
+}
+
+static void adb_cleanup(void)
+{
+        misc_deregister(&adb_device);
+
+        kfree(_adb_dev);
+        _adb_dev = NULL;
+}
diff --git a/drivers/usb/gadget/f_audio.c b/drivers/usb/gadget/f_audio.c
new file mode 100644
index 00000000000..a9a4eade7e8
--- /dev/null
+++ b/drivers/usb/gadget/f_audio.c
@@ -0,0 +1,798 @@
+/*
+ * f_audio.c -- USB Audio class function driver
+  *
+ * Copyright (C) 2008 Bryan Wu <cooloney@kernel.org>
+ * Copyright (C) 2008 Analog Devices, Inc
+ *
+ * Enter bugs at http://blackfin.uclinux.org/
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#include <linux/slab.h>
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/atomic.h>
+
+#include "u_audio.h"
+
+#define OUT_EP_MAX_PACKET_SIZE  200
+static int req_buf_size = OUT_EP_MAX_PACKET_SIZE;
+module_param(req_buf_size, int, S_IRUGO);
+MODULE_PARM_DESC(req_buf_size, "ISO OUT endpoint request buffer size");
+
+static int req_count = 256;
+module_param(req_count, int, S_IRUGO);
+MODULE_PARM_DESC(req_count, "ISO OUT endpoint request count");
+
+static int audio_buf_size = 48000;
+module_param(audio_buf_size, int, S_IRUGO);
+MODULE_PARM_DESC(audio_buf_size, "Audio buffer size");
+
+static int generic_set_cmd(struct usb_audio_control *con, u8 cmd, int value);
+static int generic_get_cmd(struct usb_audio_control *con, u8 cmd);
+
+/*
+ * DESCRIPTORS ... most are static, but strings and full
+ * configuration descriptors are built on demand.
+ */
+
+/*
+ * We have two interfaces- AudioControl and AudioStreaming
+ * TODO: only supcard playback currently
+ */
+#define F_AUDIO_AC_INTERFACE    0
+#define F_AUDIO_AS_INTERFACE    1
+#define F_AUDIO_NUM_INTERFACES  2
+
+/* B.3.1  Standard AC Interface Descriptor */
+static struct usb_interface_descriptor ac_interface_desc __initdata = {
+        .bLength =              USB_DT_INTERFACE_SIZE,
+        .bDescriptorType =      USB_DT_INTERFACE,
+        .bNumEndpoints =        0,
+        .bInterfaceClass =      USB_CLASS_AUDIO,
+        .bInterfaceSubClass =   USB_SUBCLASS_AUDIOCONTROL,
+};
+
+DECLARE_UAC_AC_HEADER_DESCRIPTOR(2);
+
+#define UAC_DT_AC_HEADER_LENGTH UAC_DT_AC_HEADER_SIZE(F_AUDIO_NUM_INTERFACES)
+/* 1 input terminal, 1 output terminal and 1 feature unit */
+#define UAC_DT_TOTAL_LENGTH (UAC_DT_AC_HEADER_LENGTH + UAC_DT_INPUT_TERMINAL_SIZE \
+        + UAC_DT_OUTPUT_TERMINAL_SIZE + UAC_DT_FEATURE_UNIT_SIZE(0))
+/* B.3.2  Class-Specific AC Interface Descriptor */
+static struct uac1_ac_header_descriptor_2 ac_header_desc = {
+        .bLength =              UAC_DT_AC_HEADER_LENGTH,
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubtype =   UAC_HEADER,
+        .bcdADC =               __constant_cpu_to_le16(0x0100),
+        .wTotalLength =         __constant_cpu_to_le16(UAC_DT_TOTAL_LENGTH),
+        .bInCollection =        F_AUDIO_NUM_INTERFACES,
+        .baInterfaceNr = {
+                [0] =           F_AUDIO_AC_INTERFACE,
+                [1] =           F_AUDIO_AS_INTERFACE,
+        }
+};
+
+#define INPUT_TERMINAL_ID       1
+static struct uac_input_terminal_descriptor input_terminal_desc = {
+        .bLength =              UAC_DT_INPUT_TERMINAL_SIZE,
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubtype =   UAC_INPUT_TERMINAL,
+        .bTerminalID =          INPUT_TERMINAL_ID,
+        .wTerminalType =        UAC_TERMINAL_STREAMING,
+        .bAssocTerminal =       0,
+        .wChannelConfig =       0x3,
+};
+
+DECLARE_UAC_FEATURE_UNIT_DESCRIPTOR(0);
+
+#define FEATURE_UNIT_ID         2
+static struct uac_feature_unit_descriptor_0 feature_unit_desc = {
+        .bLength                = UAC_DT_FEATURE_UNIT_SIZE(0),
+        .bDescriptorType        = USB_DT_CS_INTERFACE,
+        .bDescriptorSubtype     = UAC_FEATURE_UNIT,
+        .bUnitID                = FEATURE_UNIT_ID,
+        .bSourceID              = INPUT_TERMINAL_ID,
+        .bControlSize           = 2,
+        .bmaControls[0]         = (UAC_FU_MUTE | UAC_FU_VOLUME),
+};
+
+static struct usb_audio_control mute_control = {
+        .list = LIST_HEAD_INIT(mute_control.list),
+        .name = "Mute Control",
+        .type = UAC_FU_MUTE,
+        /* Todo: add real Mute control code */
+        .set = generic_set_cmd,
+        .get = generic_get_cmd,
+};
+
+static struct usb_audio_control volume_control = {
+        .list = LIST_HEAD_INIT(volume_control.list),
+        .name = "Volume Control",
+        .type = UAC_FU_VOLUME,
+        /* Todo: add real Volume control code */
+        .set = generic_set_cmd,
+        .get = generic_get_cmd,
+};
+
+static struct usb_audio_control_selector feature_unit = {
+        .list = LIST_HEAD_INIT(feature_unit.list),
+        .id = FEATURE_UNIT_ID,
+        .name = "Mute & Volume Control",
+        .type = UAC_FEATURE_UNIT,
+        .desc = (struct usb_descriptor_header *)&feature_unit_desc,
+};
+
+#define OUTPUT_TERMINAL_ID      3
+static struct uac1_output_terminal_descriptor output_terminal_desc = {
+        .bLength                = UAC_DT_OUTPUT_TERMINAL_SIZE,
+        .bDescriptorType        = USB_DT_CS_INTERFACE,
+        .bDescriptorSubtype     = UAC_OUTPUT_TERMINAL,
+        .bTerminalID            = OUTPUT_TERMINAL_ID,
+        .wTerminalType          = UAC_OUTPUT_TERMINAL_SPEAKER,
+        .bAssocTerminal         = FEATURE_UNIT_ID,
+        .bSourceID              = FEATURE_UNIT_ID,
+};
+
+/* B.4.1  Standard AS Interface Descriptor */
+static struct usb_interface_descriptor as_interface_alt_0_desc = {
+        .bLength =              USB_DT_INTERFACE_SIZE,
+        .bDescriptorType =      USB_DT_INTERFACE,
+        .bAlternateSetting =    0,
+        .bNumEndpoints =        0,
+        .bInterfaceClass =      USB_CLASS_AUDIO,
+        .bInterfaceSubClass =   USB_SUBCLASS_AUDIOSTREAMING,
+};
+
+static struct usb_interface_descriptor as_interface_alt_1_desc = {
+        .bLength =              USB_DT_INTERFACE_SIZE,
+        .bDescriptorType =      USB_DT_INTERFACE,
+        .bAlternateSetting =    1,
+        .bNumEndpoints =        1,
+        .bInterfaceClass =      USB_CLASS_AUDIO,
+        .bInterfaceSubClass =   USB_SUBCLASS_AUDIOSTREAMING,
+};
+
+/* B.4.2  Class-Specific AS Interface Descriptor */
+static struct uac1_as_header_descriptor as_header_desc = {
+        .bLength =              UAC_DT_AS_HEADER_SIZE,
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubtype =   UAC_AS_GENERAL,
+        .bTerminalLink =        INPUT_TERMINAL_ID,
+        .bDelay =               1,
+        .wFormatTag =           UAC_FORMAT_TYPE_I_PCM,
+};
+
+DECLARE_UAC_FORMAT_TYPE_I_DISCRETE_DESC(1);
+
+static struct uac_format_type_i_discrete_descriptor_1 as_type_i_desc = {
+        .bLength =              UAC_FORMAT_TYPE_I_DISCRETE_DESC_SIZE(1),
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubtype =   UAC_FORMAT_TYPE,
+        .bFormatType =          UAC_FORMAT_TYPE_I,
+        .bSubframeSize =        2,
+        .bBitResolution =       16,
+        .bSamFreqType =         1,
+};
+
+/* Standard ISO OUT Endpoint Descriptor */
+static struct usb_endpoint_descriptor as_out_ep_desc  = {
+        .bLength =              USB_DT_ENDPOINT_AUDIO_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+        .bEndpointAddress =     USB_DIR_OUT,
+        .bmAttributes =         USB_ENDPOINT_SYNC_ADAPTIVE
+                                | USB_ENDPOINT_XFER_ISOC,
+        .wMaxPacketSize =       __constant_cpu_to_le16(OUT_EP_MAX_PACKET_SIZE),
+        .bInterval =            4,
+};
+
+/* Class-specific AS ISO OUT Endpoint Descriptor */
+static struct uac_iso_endpoint_descriptor as_iso_out_desc __initdata = {
+        .bLength =              UAC_ISO_ENDPOINT_DESC_SIZE,
+        .bDescriptorType =      USB_DT_CS_ENDPOINT,
+        .bDescriptorSubtype =   UAC_EP_GENERAL,
+        .bmAttributes =         1,
+        .bLockDelayUnits =      1,
+        .wLockDelay =           __constant_cpu_to_le16(1),
+};
+
+static struct usb_descriptor_header *f_audio_desc[] __initdata = {
+        (struct usb_descriptor_header *)&ac_interface_desc,
+        (struct usb_descriptor_header *)&ac_header_desc,
+
+        (struct usb_descriptor_header *)&input_terminal_desc,
+        (struct usb_descriptor_header *)&output_terminal_desc,
+        (struct usb_descriptor_header *)&feature_unit_desc,
+
+        (struct usb_descriptor_header *)&as_interface_alt_0_desc,
+        (struct usb_descriptor_header *)&as_interface_alt_1_desc,
+        (struct usb_descriptor_header *)&as_header_desc,
+
+        (struct usb_descriptor_header *)&as_type_i_desc,
+
+        (struct usb_descriptor_header *)&as_out_ep_desc,
+        (struct usb_descriptor_header *)&as_iso_out_desc,
+        NULL,
+};
+
+/* string IDs are assigned dynamically */
+
+#define STRING_MANUFACTURER_IDX         0
+#define STRING_PRODUCT_IDX              1
+
+static char manufacturer[50];
+
+static struct usb_string strings_dev[] = {
+        [STRING_MANUFACTURER_IDX].s = manufacturer,
+        [STRING_PRODUCT_IDX].s = DRIVER_DESC,
+        {  } /* end of list */
+};
+
+static struct usb_gadget_strings stringtab_dev = {
+        .language       = 0x0409,       /* en-us */
+        .strings        = strings_dev,
+};
+
+static struct usb_gadget_strings *audio_strings[] = {
+        &stringtab_dev,
+        NULL,
+};
+
+/*
+ * This function is an ALSA sound card following USB Audio Class Spec 1.0.
+ */
+
+/*-------------------------------------------------------------------------*/
+struct f_audio_buf {
+        u8 *buf;
+        int actual;
+        struct list_head list;
+};
+
+static struct f_audio_buf *f_audio_buffer_alloc(int buf_size)
+{
+        struct f_audio_buf *copy_buf;
+
+        copy_buf = kzalloc(sizeof *copy_buf, GFP_ATOMIC);
+        if (!copy_buf)
+                return ERR_PTR(-ENOMEM);
+
+        copy_buf->buf = kzalloc(buf_size, GFP_ATOMIC);
+        if (!copy_buf->buf) {
+                kfree(copy_buf);
+                return ERR_PTR(-ENOMEM);
+        }
+
+        return copy_buf;
+}
+
+static void f_audio_buffer_free(struct f_audio_buf *audio_buf)
+{
+        kfree(audio_buf->buf);
+        kfree(audio_buf);
+}
+/*-------------------------------------------------------------------------*/
+
+struct f_audio {
+        struct gaudio                   card;
+
+        /* endpoints handle full and/or high speeds */
+        struct usb_ep                   *out_ep;
+
+        spinlock_t                      lock;
+        struct f_audio_buf *copy_buf;
+        struct work_struct playback_work;
+        struct list_head play_queue;
+
+        /* Control Set command */
+        struct list_head cs;
+        u8 set_cmd;
+        struct usb_audio_control *set_con;
+};
+
+static inline struct f_audio *func_to_audio(struct usb_function *f)
+{
+        return container_of(f, struct f_audio, card.func);
+}
+
+/*-------------------------------------------------------------------------*/
+
+static void f_audio_playback_work(struct work_struct *data)
+{
+        struct f_audio *audio = container_of(data, struct f_audio,
+                                        playback_work);
+        struct f_audio_buf *play_buf;
+
+        spin_lock_irq(&audio->lock);
+        if (list_empty(&audio->play_queue)) {
+                spin_unlock_irq(&audio->lock);
+                return;
+        }
+        play_buf = list_first_entry(&audio->play_queue,
+                        struct f_audio_buf, list);
+        list_del(&play_buf->list);
+        spin_unlock_irq(&audio->lock);
+
+        u_audio_playback(&audio->card, play_buf->buf, play_buf->actual);
+        f_audio_buffer_free(play_buf);
+}
+
+static int f_audio_out_ep_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct f_audio *audio = req->context;
+        struct usb_composite_dev *cdev = audio->card.func.config->cdev;
+        struct f_audio_buf *copy_buf = audio->copy_buf;
+        int err;
+
+        if (!copy_buf)
+                return -EINVAL;
+
+        /* Copy buffer is full, add it to the play_queue */
+        if (audio_buf_size - copy_buf->actual < req->actual) {
+                list_add_tail(&copy_buf->list, &audio->play_queue);
+                schedule_work(&audio->playback_work);
+                copy_buf = f_audio_buffer_alloc(audio_buf_size);
+                if (IS_ERR(copy_buf))
+                        return -ENOMEM;
+        }
+
+        memcpy(copy_buf->buf + copy_buf->actual, req->buf, req->actual);
+        copy_buf->actual += req->actual;
+        audio->copy_buf = copy_buf;
+
+        err = usb_ep_queue(ep, req, GFP_ATOMIC);
+        if (err)
+                ERROR(cdev, "%s queue req: %d\n", ep->name, err);
+
+        return 0;
+
+}
+
+static void f_audio_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct f_audio *audio = req->context;
+        int status = req->status;
+        u32 data = 0;
+        struct usb_ep *out_ep = audio->out_ep;
+
+        switch (status) {
+
+        case 0:                         /* normal completion? */
+                if (ep == out_ep)
+                        f_audio_out_ep_complete(ep, req);
+                else if (audio->set_con) {
+                        memcpy(&data, req->buf, req->length);
+                        audio->set_con->set(audio->set_con, audio->set_cmd,
+                                        le16_to_cpu(data));
+                        audio->set_con = NULL;
+                }
+                break;
+        default:
+                break;
+        }
+}
+
+static int audio_set_intf_req(struct usb_function *f,
+                const struct usb_ctrlrequest *ctrl)
+{
+        struct f_audio          *audio = func_to_audio(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+        struct usb_request      *req = cdev->req;
+        u8                      id = ((le16_to_cpu(ctrl->wIndex) >> 8) & 0xFF);
+        u16                     len = le16_to_cpu(ctrl->wLength);
+        u16                     w_value = le16_to_cpu(ctrl->wValue);
+        u8                      con_sel = (w_value >> 8) & 0xFF;
+        u8                      cmd = (ctrl->bRequest & 0x0F);
+        struct usb_audio_control_selector *cs;
+        struct usb_audio_control *con;
+
+        DBG(cdev, "bRequest 0x%x, w_value 0x%04x, len %d, entity %d\n",
+                        ctrl->bRequest, w_value, len, id);
+
+        list_for_each_entry(cs, &audio->cs, list) {
+                if (cs->id == id) {
+                        list_for_each_entry(con, &cs->control, list) {
+                                if (con->type == con_sel) {
+                                        audio->set_con = con;
+                                        break;
+                                }
+                        }
+                        break;
+                }
+        }
+
+        audio->set_cmd = cmd;
+        req->context = audio;
+        req->complete = f_audio_complete;
+
+        return len;
+}
+
+static int audio_get_intf_req(struct usb_function *f,
+                const struct usb_ctrlrequest *ctrl)
+{
+        struct f_audio          *audio = func_to_audio(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+        struct usb_request      *req = cdev->req;
+        int                     value = -EOPNOTSUPP;
+        u8                      id = ((le16_to_cpu(ctrl->wIndex) >> 8) & 0xFF);
+        u16                     len = le16_to_cpu(ctrl->wLength);
+        u16                     w_value = le16_to_cpu(ctrl->wValue);
+        u8                      con_sel = (w_value >> 8) & 0xFF;
+        u8                      cmd = (ctrl->bRequest & 0x0F);
+        struct usb_audio_control_selector *cs;
+        struct usb_audio_control *con;
+
+        DBG(cdev, "bRequest 0x%x, w_value 0x%04x, len %d, entity %d\n",
+                        ctrl->bRequest, w_value, len, id);
+
+        list_for_each_entry(cs, &audio->cs, list) {
+                if (cs->id == id) {
+                        list_for_each_entry(con, &cs->control, list) {
+                                if (con->type == con_sel && con->get) {
+                                        value = con->get(con, cmd);
+                                        break;
+                                }
+                        }
+                        break;
+                }
+        }
+
+        req->context = audio;
+        req->complete = f_audio_complete;
+        memcpy(req->buf, &value, len);
+
+        return len;
+}
+
+static int audio_set_endpoint_req(struct usb_function *f,
+                const struct usb_ctrlrequest *ctrl)
+{
+        struct usb_composite_dev *cdev = f->config->cdev;
+        int                     value = -EOPNOTSUPP;
+        u16                     ep = le16_to_cpu(ctrl->wIndex);
+        u16                     len = le16_to_cpu(ctrl->wLength);
+        u16                     w_value = le16_to_cpu(ctrl->wValue);
+
+        DBG(cdev, "bRequest 0x%x, w_value 0x%04x, len %d, endpoint %d\n",
+                        ctrl->bRequest, w_value, len, ep);
+
+        switch (ctrl->bRequest) {
+        case UAC_SET_CUR:
+                value = 0;
+                break;
+
+        case UAC_SET_MIN:
+                break;
+
+        case UAC_SET_MAX:
+                break;
+
+        case UAC_SET_RES:
+                break;
+
+        case UAC_SET_MEM:
+                break;
+
+        default:
+                break;
+        }
+
+        return value;
+}
+
+static int audio_get_endpoint_req(struct usb_function *f,
+                const struct usb_ctrlrequest *ctrl)
+{
+        struct usb_composite_dev *cdev = f->config->cdev;
+        int value = -EOPNOTSUPP;
+        u8 ep = ((le16_to_cpu(ctrl->wIndex) >> 8) & 0xFF);
+        u16 len = le16_to_cpu(ctrl->wLength);
+        u16 w_value = le16_to_cpu(ctrl->wValue);
+
+        DBG(cdev, "bRequest 0x%x, w_value 0x%04x, len %d, endpoint %d\n",
+                        ctrl->bRequest, w_value, len, ep);
+
+        switch (ctrl->bRequest) {
+        case UAC_GET_CUR:
+        case UAC_GET_MIN:
+        case UAC_GET_MAX:
+        case UAC_GET_RES:
+                value = 3;
+                break;
+        case UAC_GET_MEM:
+                break;
+        default:
+                break;
+        }
+
+        return value;
+}
+
+static int
+f_audio_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
+{
+        struct usb_composite_dev *cdev = f->config->cdev;
+        struct usb_request      *req = cdev->req;
+        int                     value = -EOPNOTSUPP;
+        u16                     w_index = le16_to_cpu(ctrl->wIndex);
+        u16                     w_value = le16_to_cpu(ctrl->wValue);
+        u16                     w_length = le16_to_cpu(ctrl->wLength);
+
+        /* composite driver infrastructure handles everything; interface
+         * activation uses set_alt().
+         */
+        switch (ctrl->bRequestType) {
+        case USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE:
+                value = audio_set_intf_req(f, ctrl);
+                break;
+
+        case USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE:
+                value = audio_get_intf_req(f, ctrl);
+                break;
+
+        case USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_ENDPOINT:
+                value = audio_set_endpoint_req(f, ctrl);
+                break;
+
+        case USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_ENDPOINT:
+                value = audio_get_endpoint_req(f, ctrl);
+                break;
+
+        default:
+                ERROR(cdev, "invalid control req%02x.%02x v%04x i%04x l%d\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, w_length);
+        }
+
+        /* respond with data transfer or status phase? */
+        if (value >= 0) {
+                DBG(cdev, "audio req%02x.%02x v%04x i%04x l%d\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, w_length);
+                req->zero = 0;
+                req->length = value;
+                value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
+                if (value < 0)
+                        ERROR(cdev, "audio response on err %d\n", value);
+        }
+
+        /* device either stalls (value < 0) or reports success */
+        return value;
+}
+
+static int f_audio_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
+{
+        struct f_audio          *audio = func_to_audio(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+        struct usb_ep *out_ep = audio->out_ep;
+        struct usb_request *req;
+        int i = 0, err = 0;
+
+        DBG(cdev, "intf %d, alt %d\n", intf, alt);
+
+        if (intf == 1) {
+                if (alt == 1) {
+                        usb_ep_enable(out_ep);
+                        out_ep->driver_data = audio;
+                        audio->copy_buf = f_audio_buffer_alloc(audio_buf_size);
+                        if (IS_ERR(audio->copy_buf))
+                                return -ENOMEM;
+
+                        /*
+                         * allocate a bunch of read buffers
+                         * and queue them all at once.
+                         */
+                        for (i = 0; i < req_count && err == 0; i++) {
+                                req = usb_ep_alloc_request(out_ep, GFP_ATOMIC);
+                                if (req) {
+                                        req->buf = kzalloc(req_buf_size,
+                                                        GFP_ATOMIC);
+                                        if (req->buf) {
+                                                req->length = req_buf_size;
+                                                req->context = audio;
+                                                req->complete =
+                                                        f_audio_complete;
+                                                err = usb_ep_queue(out_ep,
+                                                        req, GFP_ATOMIC);
+                                                if (err)
+                                                        ERROR(cdev,
+                                                        "%s queue req: %d\n",
+                                                        out_ep->name, err);
+                                        } else
+                                                err = -ENOMEM;
+                                } else
+                                        err = -ENOMEM;
+                        }
+
+                } else {
+                        struct f_audio_buf *copy_buf = audio->copy_buf;
+                        if (copy_buf) {
+                                list_add_tail(&copy_buf->list,
+                                                &audio->play_queue);
+                                schedule_work(&audio->playback_work);
+                        }
+                }
+        }
+
+        return err;
+}
+
+static void f_audio_disable(struct usb_function *f)
+{
+        return;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static void f_audio_build_desc(struct f_audio *audio)
+{
+        struct gaudio *card = &audio->card;
+        u8 *sam_freq;
+        int rate;
+
+        /* Set channel numbers */
+        input_terminal_desc.bNrChannels = u_audio_get_playback_channels(card);
+        as_type_i_desc.bNrChannels = u_audio_get_playback_channels(card);
+
+        /* Set sample rates */
+        rate = u_audio_get_playback_rate(card);
+        sam_freq = as_type_i_desc.tSamFreq[0];
+        memcpy(sam_freq, &rate, 3);
+
+        /* Todo: Set Sample bits and other parameters */
+
+        return;
+}
+
+/* audio function driver setup/binding */
+static int __init
+f_audio_bind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct usb_composite_dev *cdev = c->cdev;
+        struct f_audio          *audio = func_to_audio(f);
+        int                     status;
+        struct usb_ep           *ep;
+
+        f_audio_build_desc(audio);
+
+        /* allocate instance-specific interface IDs, and patch descriptors */
+        status = usb_interface_id(c, f);
+        if (status < 0)
+                goto fail;
+        ac_interface_desc.bInterfaceNumber = status;
+
+        status = usb_interface_id(c, f);
+        if (status < 0)
+                goto fail;
+        as_interface_alt_0_desc.bInterfaceNumber = status;
+        as_interface_alt_1_desc.bInterfaceNumber = status;
+
+        status = -ENODEV;
+
+        /* allocate instance-specific endpoints */
+        ep = usb_ep_autoconfig(cdev->gadget, &as_out_ep_desc);
+        if (!ep)
+                goto fail;
+        audio->out_ep = ep;
+        audio->out_ep->desc = &as_out_ep_desc;
+        ep->driver_data = cdev; /* claim */
+
+        status = -ENOMEM;
+
+        /* supcard all relevant hardware speeds... we expect that when
+         * hardware is dual speed, all bulk-capable endpoints work at
+         * both speeds
+         */
+
+        /* copy descriptors, and track endpoint copies */
+        if (gadget_is_dualspeed(c->cdev->gadget)) {
+                c->highspeed = true;
+                f->hs_descriptors = usb_copy_descriptors(f_audio_desc);
+        } else
+                f->descriptors = usb_copy_descriptors(f_audio_desc);
+
+        return 0;
+
+fail:
+
+        return status;
+}
+
+static void
+f_audio_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct f_audio          *audio = func_to_audio(f);
+
+        usb_free_descriptors(f->descriptors);
+        usb_free_descriptors(f->hs_descriptors);
+        kfree(audio);
+}
+
+/*-------------------------------------------------------------------------*/
+
+static int generic_set_cmd(struct usb_audio_control *con, u8 cmd, int value)
+{
+        con->data[cmd] = value;
+
+        return 0;
+}
+
+static int generic_get_cmd(struct usb_audio_control *con, u8 cmd)
+{
+        return con->data[cmd];
+}
+
+/* Todo: add more control selecotor dynamically */
+int __init control_selector_init(struct f_audio *audio)
+{
+        INIT_LIST_HEAD(&audio->cs);
+        list_add(&feature_unit.list, &audio->cs);
+
+        INIT_LIST_HEAD(&feature_unit.control);
+        list_add(&mute_control.list, &feature_unit.control);
+        list_add(&volume_control.list, &feature_unit.control);
+
+        volume_control.data[UAC__CUR] = 0xffc0;
+        volume_control.data[UAC__MIN] = 0xe3a0;
+        volume_control.data[UAC__MAX] = 0xfff0;
+        volume_control.data[UAC__RES] = 0x0030;
+
+        return 0;
+}
+
+/**
+ * audio_bind_config - add USB audio function to a configuration
+ * @c: the configuration to supcard the USB audio function
+ * Context: single threaded during gadget setup
+ *
+ * Returns zero on success, else negative errno.
+ */
+int __init audio_bind_config(struct usb_configuration *c)
+{
+        struct f_audio *audio;
+        int status;
+
+        /* allocate and initialize one new instance */
+        audio = kzalloc(sizeof *audio, GFP_KERNEL);
+        if (!audio)
+                return -ENOMEM;
+
+        audio->card.func.name = "g_audio";
+        audio->card.gadget = c->cdev->gadget;
+
+        INIT_LIST_HEAD(&audio->play_queue);
+        spin_lock_init(&audio->lock);
+
+        /* set up ASLA audio devices */
+        status = gaudio_setup(&audio->card);
+        if (status < 0)
+                goto setup_fail;
+
+        audio->card.func.strings = audio_strings;
+        audio->card.func.bind = f_audio_bind;
+        audio->card.func.unbind = f_audio_unbind;
+        audio->card.func.set_alt = f_audio_set_alt;
+        audio->card.func.setup = f_audio_setup;
+        audio->card.func.disable = f_audio_disable;
+
+        control_selector_init(audio);
+
+        INIT_WORK(&audio->playback_work, f_audio_playback_work);
+
+        status = usb_add_function(c, &audio->card.func);
+        if (status)
+                goto add_fail;
+
+        INFO(c->cdev, "audio_buf_size %d, req_buf_size %d, req_count %d\n",
+                audio_buf_size, req_buf_size, req_count);
+
+        return status;
+
+add_fail:
+        gaudio_cleanup();
+setup_fail:
+        kfree(audio);
+        return status;
+}
diff --git a/drivers/usb/gadget/f_mtp.c b/drivers/usb/gadget/f_mtp.c
new file mode 100644
index 00000000000..5aa5214297d
--- /dev/null
+++ b/drivers/usb/gadget/f_mtp.c
@@ -0,0 +1,1264 @@
+/*
+ * Gadget Function Driver for MTP
+ *
+ * Copyright (C) 2010 Google, Inc.
+ * Author: Mike Lockwood <lockwood@android.com>
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+/* #define DEBUG */
+/* #define VERBOSE_DEBUG */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/poll.h>
+#include <linux/delay.h>
+#include <linux/wait.h>
+#include <linux/err.h>
+#include <linux/interrupt.h>
+
+#include <linux/types.h>
+#include <linux/file.h>
+#include <linux/device.h>
+#include <linux/miscdevice.h>
+
+#include <linux/usb.h>
+#include <linux/usb_usual.h>
+#include <linux/usb/ch9.h>
+#include <linux/usb/f_mtp.h>
+
+#define MTP_BULK_BUFFER_SIZE       16384
+#define INTR_BUFFER_SIZE           28
+
+/* String IDs */
+#define INTERFACE_STRING_INDEX  0
+
+/* values for mtp_dev.state */
+#define STATE_OFFLINE               0   /* initial state, disconnected */
+#define STATE_READY                 1   /* ready for userspace calls */
+#define STATE_BUSY                  2   /* processing userspace calls */
+#define STATE_CANCELED              3   /* transaction canceled by host */
+#define STATE_ERROR                 4   /* error from completion routine */
+
+/* number of tx and rx requests to allocate */
+#define TX_REQ_MAX 4
+#define RX_REQ_MAX 2
+#define INTR_REQ_MAX 5
+
+/* ID for Microsoft MTP OS String */
+#define MTP_OS_STRING_ID   0xEE
+
+/* MTP class reqeusts */
+#define MTP_REQ_CANCEL              0x64
+#define MTP_REQ_GET_EXT_EVENT_DATA  0x65
+#define MTP_REQ_RESET               0x66
+#define MTP_REQ_GET_DEVICE_STATUS   0x67
+
+/* constants for device status */
+#define MTP_RESPONSE_OK             0x2001
+#define MTP_RESPONSE_DEVICE_BUSY    0x2019
+
+static const char mtp_shortname[] = "mtp_usb";
+
+struct mtp_dev {
+        struct usb_function function;
+        struct usb_composite_dev *cdev;
+        spinlock_t lock;
+
+        struct usb_ep *ep_in;
+        struct usb_ep *ep_out;
+        struct usb_ep *ep_intr;
+
+        int state;
+
+        /* synchronize access to our device file */
+        atomic_t open_excl;
+        /* to enforce only one ioctl at a time */
+        atomic_t ioctl_excl;
+
+        struct list_head tx_idle;
+        struct list_head intr_idle;
+
+        wait_queue_head_t read_wq;
+        wait_queue_head_t write_wq;
+        wait_queue_head_t intr_wq;
+        struct usb_request *rx_req[RX_REQ_MAX];
+        int rx_done;
+
+        /* for processing MTP_SEND_FILE, MTP_RECEIVE_FILE and
+         * MTP_SEND_FILE_WITH_HEADER ioctls on a work queue
+         */
+        struct workqueue_struct *wq;
+        struct work_struct send_file_work;
+        struct work_struct receive_file_work;
+        struct file *xfer_file;
+        loff_t xfer_file_offset;
+        int64_t xfer_file_length;
+        unsigned xfer_send_header;
+        uint16_t xfer_command;
+        uint32_t xfer_transaction_id;
+        int xfer_result;
+};
+
+static struct usb_interface_descriptor mtp_interface_desc = {
+        .bLength                = USB_DT_INTERFACE_SIZE,
+        .bDescriptorType        = USB_DT_INTERFACE,
+        .bInterfaceNumber       = 0,
+        .bNumEndpoints          = 3,
+        .bInterfaceClass        = USB_CLASS_VENDOR_SPEC,
+        .bInterfaceSubClass     = USB_SUBCLASS_VENDOR_SPEC,
+        .bInterfaceProtocol     = 0,
+};
+
+static struct usb_interface_descriptor ptp_interface_desc = {
+        .bLength                = USB_DT_INTERFACE_SIZE,
+        .bDescriptorType        = USB_DT_INTERFACE,
+        .bInterfaceNumber       = 0,
+        .bNumEndpoints          = 3,
+        .bInterfaceClass        = USB_CLASS_STILL_IMAGE,
+        .bInterfaceSubClass     = 1,
+        .bInterfaceProtocol     = 1,
+};
+
+static struct usb_endpoint_descriptor mtp_highspeed_in_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_IN,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize         = __constant_cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor mtp_highspeed_out_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_OUT,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize         = __constant_cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor mtp_fullspeed_in_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_IN,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_endpoint_descriptor mtp_fullspeed_out_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_OUT,
+        .bmAttributes           = USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_endpoint_descriptor mtp_intr_desc = {
+        .bLength                = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType        = USB_DT_ENDPOINT,
+        .bEndpointAddress       = USB_DIR_IN,
+        .bmAttributes           = USB_ENDPOINT_XFER_INT,
+        .wMaxPacketSize         = __constant_cpu_to_le16(INTR_BUFFER_SIZE),
+        .bInterval              = 6,
+};
+
+static struct usb_descriptor_header *fs_mtp_descs[] = {
+        (struct usb_descriptor_header *) &mtp_interface_desc,
+        (struct usb_descriptor_header *) &mtp_fullspeed_in_desc,
+        (struct usb_descriptor_header *) &mtp_fullspeed_out_desc,
+        (struct usb_descriptor_header *) &mtp_intr_desc,
+        NULL,
+};
+
+static struct usb_descriptor_header *hs_mtp_descs[] = {
+        (struct usb_descriptor_header *) &mtp_interface_desc,
+        (struct usb_descriptor_header *) &mtp_highspeed_in_desc,
+        (struct usb_descriptor_header *) &mtp_highspeed_out_desc,
+        (struct usb_descriptor_header *) &mtp_intr_desc,
+        NULL,
+};
+
+static struct usb_descriptor_header *fs_ptp_descs[] = {
+        (struct usb_descriptor_header *) &ptp_interface_desc,
+        (struct usb_descriptor_header *) &mtp_fullspeed_in_desc,
+        (struct usb_descriptor_header *) &mtp_fullspeed_out_desc,
+        (struct usb_descriptor_header *) &mtp_intr_desc,
+        NULL,
+};
+
+static struct usb_descriptor_header *hs_ptp_descs[] = {
+        (struct usb_descriptor_header *) &ptp_interface_desc,
+        (struct usb_descriptor_header *) &mtp_highspeed_in_desc,
+        (struct usb_descriptor_header *) &mtp_highspeed_out_desc,
+        (struct usb_descriptor_header *) &mtp_intr_desc,
+        NULL,
+};
+
+static struct usb_string mtp_string_defs[] = {
+        /* Naming interface "MTP" so libmtp will recognize us */
+        [INTERFACE_STRING_INDEX].s      = "MTP",
+        {  },   /* end of list */
+};
+
+static struct usb_gadget_strings mtp_string_table = {
+        .language               = 0x0409,       /* en-US */
+        .strings                = mtp_string_defs,
+};
+
+static struct usb_gadget_strings *mtp_strings[] = {
+        &mtp_string_table,
+        NULL,
+};
+
+/* Microsoft MTP OS String */
+static u8 mtp_os_string[] = {
+        18, /* sizeof(mtp_os_string) */
+        USB_DT_STRING,
+        /* Signature field: "MSFT100" */
+        'M', 0, 'S', 0, 'F', 0, 'T', 0, '1', 0, '0', 0, '0', 0,
+        /* vendor code */
+        1,
+        /* padding */
+        0
+};
+
+/* Microsoft Extended Configuration Descriptor Header Section */
+struct mtp_ext_config_desc_header {
+        __le32  dwLength;
+        __u16   bcdVersion;
+        __le16  wIndex;
+        __u8    bCount;
+        __u8    reserved[7];
+};
+
+/* Microsoft Extended Configuration Descriptor Function Section */
+struct mtp_ext_config_desc_function {
+        __u8    bFirstInterfaceNumber;
+        __u8    bInterfaceCount;
+        __u8    compatibleID[8];
+        __u8    subCompatibleID[8];
+        __u8    reserved[6];
+};
+
+/* MTP Extended Configuration Descriptor */
+struct {
+        struct mtp_ext_config_desc_header       header;
+        struct mtp_ext_config_desc_function    function;
+} mtp_ext_config_desc = {
+        .header = {
+                .dwLength = __constant_cpu_to_le32(sizeof(mtp_ext_config_desc)),
+                .bcdVersion = __constant_cpu_to_le16(0x0100),
+                .wIndex = __constant_cpu_to_le16(4),
+                .bCount = __constant_cpu_to_le16(1),
+        },
+        .function = {
+                .bFirstInterfaceNumber = 0,
+                .bInterfaceCount = 1,
+                .compatibleID = { 'M', 'T', 'P' },
+        },
+};
+
+struct mtp_device_status {
+        __le16  wLength;
+        __le16  wCode;
+};
+
+/* temporary variable used between mtp_open() and mtp_gadget_bind() */
+static struct mtp_dev *_mtp_dev;
+
+static inline struct mtp_dev *func_to_mtp(struct usb_function *f)
+{
+        return container_of(f, struct mtp_dev, function);
+}
+
+static struct usb_request *mtp_request_new(struct usb_ep *ep, int buffer_size)
+{
+        struct usb_request *req = usb_ep_alloc_request(ep, GFP_KERNEL);
+        if (!req)
+                return NULL;
+
+        /* now allocate buffers for the requests */
+        req->buf = kmalloc(buffer_size, GFP_KERNEL);
+        if (!req->buf) {
+                usb_ep_free_request(ep, req);
+                return NULL;
+        }
+
+        return req;
+}
+
+static void mtp_request_free(struct usb_request *req, struct usb_ep *ep)
+{
+        if (req) {
+                kfree(req->buf);
+                usb_ep_free_request(ep, req);
+        }
+}
+
+static inline int mtp_lock(atomic_t *excl)
+{
+        if (atomic_inc_return(excl) == 1) {
+                return 0;
+        } else {
+                atomic_dec(excl);
+                return -1;
+        }
+}
+
+static inline void mtp_unlock(atomic_t *excl)
+{
+        atomic_dec(excl);
+}
+
+/* add a request to the tail of a list */
+static void mtp_req_put(struct mtp_dev *dev, struct list_head *head,
+                struct usb_request *req)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&dev->lock, flags);
+        list_add_tail(&req->list, head);
+        spin_unlock_irqrestore(&dev->lock, flags);
+}
+
+/* remove a request from the head of a list */
+static struct usb_request
+*mtp_req_get(struct mtp_dev *dev, struct list_head *head)
+{
+        unsigned long flags;
+        struct usb_request *req;
+
+        spin_lock_irqsave(&dev->lock, flags);
+        if (list_empty(head)) {
+                req = 0;
+        } else {
+                req = list_first_entry(head, struct usb_request, list);
+                list_del(&req->list);
+        }
+        spin_unlock_irqrestore(&dev->lock, flags);
+        return req;
+}
+
+static void mtp_complete_in(struct usb_ep *ep, struct usb_request *req)
+{
+        struct mtp_dev *dev = _mtp_dev;
+
+        if (req->status != 0)
+                dev->state = STATE_ERROR;
+
+        mtp_req_put(dev, &dev->tx_idle, req);
+
+        wake_up(&dev->write_wq);
+}
+
+static void mtp_complete_out(struct usb_ep *ep, struct usb_request *req)
+{
+        struct mtp_dev *dev = _mtp_dev;
+
+        dev->rx_done = 1;
+        if (req->status != 0)
+                dev->state = STATE_ERROR;
+
+        wake_up(&dev->read_wq);
+}
+
+static void mtp_complete_intr(struct usb_ep *ep, struct usb_request *req)
+{
+        struct mtp_dev *dev = _mtp_dev;
+
+        if (req->status != 0)
+                dev->state = STATE_ERROR;
+
+        mtp_req_put(dev, &dev->intr_idle, req);
+
+        wake_up(&dev->intr_wq);
+}
+
+static int mtp_create_bulk_endpoints(struct mtp_dev *dev,
+                                struct usb_endpoint_descriptor *in_desc,
+                                struct usb_endpoint_descriptor *out_desc,
+                                struct usb_endpoint_descriptor *intr_desc)
+{
+        struct usb_composite_dev *cdev = dev->cdev;
+        struct usb_request *req;
+        struct usb_ep *ep;
+        int i;
+
+        DBG(cdev, "create_bulk_endpoints dev: %p\n", dev);
+
+        ep = usb_ep_autoconfig(cdev->gadget, in_desc);
+        if (!ep) {
+                DBG(cdev, "usb_ep_autoconfig for ep_in failed\n");
+                return -ENODEV;
+        }
+        DBG(cdev, "usb_ep_autoconfig for ep_in got %s\n", ep->name);
+        ep->driver_data = dev;          /* claim the endpoint */
+        dev->ep_in = ep;
+
+        ep = usb_ep_autoconfig(cdev->gadget, out_desc);
+        if (!ep) {
+                DBG(cdev, "usb_ep_autoconfig for ep_out failed\n");
+                return -ENODEV;
+        }
+        DBG(cdev, "usb_ep_autoconfig for mtp ep_out got %s\n", ep->name);
+        ep->driver_data = dev;          /* claim the endpoint */
+        dev->ep_out = ep;
+
+        ep = usb_ep_autoconfig(cdev->gadget, out_desc);
+        if (!ep) {
+                DBG(cdev, "usb_ep_autoconfig for ep_out failed\n");
+                return -ENODEV;
+        }
+        DBG(cdev, "usb_ep_autoconfig for mtp ep_out got %s\n", ep->name);
+        ep->driver_data = dev;          /* claim the endpoint */
+        dev->ep_out = ep;
+
+        ep = usb_ep_autoconfig(cdev->gadget, intr_desc);
+        if (!ep) {
+                DBG(cdev, "usb_ep_autoconfig for ep_intr failed\n");
+                return -ENODEV;
+        }
+        DBG(cdev, "usb_ep_autoconfig for mtp ep_intr got %s\n", ep->name);
+        ep->driver_data = dev;          /* claim the endpoint */
+        dev->ep_intr = ep;
+
+        /* now allocate requests for our endpoints */
+        for (i = 0; i < TX_REQ_MAX; i++) {
+                req = mtp_request_new(dev->ep_in, MTP_BULK_BUFFER_SIZE);
+                if (!req)
+                        goto fail;
+                req->complete = mtp_complete_in;
+                mtp_req_put(dev, &dev->tx_idle, req);
+        }
+        for (i = 0; i < RX_REQ_MAX; i++) {
+                req = mtp_request_new(dev->ep_out, MTP_BULK_BUFFER_SIZE);
+                if (!req)
+                        goto fail;
+                req->complete = mtp_complete_out;
+                dev->rx_req[i] = req;
+        }
+        for (i = 0; i < INTR_REQ_MAX; i++) {
+                req = mtp_request_new(dev->ep_intr, INTR_BUFFER_SIZE);
+                if (!req)
+                        goto fail;
+                req->complete = mtp_complete_intr;
+                mtp_req_put(dev, &dev->intr_idle, req);
+        }
+
+        return 0;
+
+fail:
+        printk(KERN_ERR "mtp_bind() could not allocate requests\n");
+        return -1;
+}
+
+static ssize_t mtp_read(struct file *fp, char __user *buf,
+        size_t count, loff_t *pos)
+{
+        struct mtp_dev *dev = fp->private_data;
+        struct usb_composite_dev *cdev = dev->cdev;
+        struct usb_request *req;
+        int r = count, xfer;
+        int ret = 0;
+
+        DBG(cdev, "mtp_read(%d)\n", count);
+
+        if (count > MTP_BULK_BUFFER_SIZE)
+                return -EINVAL;
+
+        /* we will block until we're online */
+        DBG(cdev, "mtp_read: waiting for online state\n");
+        ret = wait_event_interruptible(dev->read_wq,
+                dev->state != STATE_OFFLINE);
+        if (ret < 0) {
+                r = ret;
+                goto done;
+        }
+        spin_lock_irq(&dev->lock);
+        if (dev->state == STATE_CANCELED) {
+                /* report cancelation to userspace */
+                dev->state = STATE_READY;
+                spin_unlock_irq(&dev->lock);
+                return -ECANCELED;
+        }
+        dev->state = STATE_BUSY;
+        spin_unlock_irq(&dev->lock);
+
+requeue_req:
+        /* queue a request */
+        req = dev->rx_req[0];
+        req->length = count;
+        dev->rx_done = 0;
+        ret = usb_ep_queue(dev->ep_out, req, GFP_KERNEL);
+        if (ret < 0) {
+                r = -EIO;
+                goto done;
+        } else {
+                DBG(cdev, "rx %p queue\n", req);
+        }
+
+        /* wait for a request to complete */
+        ret = wait_event_interruptible(dev->read_wq, dev->rx_done);
+        if (ret < 0) {
+                r = ret;
+                usb_ep_dequeue(dev->ep_out, req);
+                goto done;
+        }
+        if (dev->state == STATE_BUSY) {
+                /* If we got a 0-len packet, throw it back and try again. */
+                if (req->actual == 0)
+                        goto requeue_req;
+
+                DBG(cdev, "rx %p %d\n", req, req->actual);
+                xfer = (req->actual < count) ? req->actual : count;
+                r = xfer;
+                if (copy_to_user(buf, req->buf, xfer))
+                        r = -EFAULT;
+        } else
+                r = -EIO;
+
+done:
+        spin_lock_irq(&dev->lock);
+        if (dev->state == STATE_CANCELED)
+                r = -ECANCELED;
+        else if (dev->state != STATE_OFFLINE)
+                dev->state = STATE_READY;
+        spin_unlock_irq(&dev->lock);
+
+        DBG(cdev, "mtp_read returning %d\n", r);
+        return r;
+}
+
+static ssize_t mtp_write(struct file *fp, const char __user *buf,
+        size_t count, loff_t *pos)
+{
+        struct mtp_dev *dev = fp->private_data;
+        struct usb_composite_dev *cdev = dev->cdev;
+        struct usb_request *req = 0;
+        int r = count, xfer;
+        int sendZLP = 0;
+        int ret;
+
+        DBG(cdev, "mtp_write(%d)\n", count);
+
+        spin_lock_irq(&dev->lock);
+        if (dev->state == STATE_CANCELED) {
+                /* report cancelation to userspace */
+                dev->state = STATE_READY;
+                spin_unlock_irq(&dev->lock);
+                return -ECANCELED;
+        }
+        if (dev->state == STATE_OFFLINE) {
+                spin_unlock_irq(&dev->lock);
+                return -ENODEV;
+        }
+        dev->state = STATE_BUSY;
+        spin_unlock_irq(&dev->lock);
+
+        /* we need to send a zero length packet to signal the end of transfer
+         * if the transfer size is aligned to a packet boundary.
+         */
+        if ((count & (dev->ep_in->maxpacket - 1)) == 0) {
+                sendZLP = 1;
+        }
+
+        while (count > 0 || sendZLP) {
+                /* so we exit after sending ZLP */
+                if (count == 0)
+                        sendZLP = 0;
+
+                if (dev->state != STATE_BUSY) {
+                        DBG(cdev, "mtp_write dev->error\n");
+                        r = -EIO;
+                        break;
+                }
+
+                /* get an idle tx request to use */
+                req = 0;
+                ret = wait_event_interruptible(dev->write_wq,
+                        ((req = mtp_req_get(dev, &dev->tx_idle))
+                                || dev->state != STATE_BUSY));
+                if (!req) {
+                        r = ret;
+                        break;
+                }
+
+                if (count > MTP_BULK_BUFFER_SIZE)
+                        xfer = MTP_BULK_BUFFER_SIZE;
+                else
+                        xfer = count;
+                if (xfer && copy_from_user(req->buf, buf, xfer)) {
+                        r = -EFAULT;
+                        break;
+                }
+
+                req->length = xfer;
+                ret = usb_ep_queue(dev->ep_in, req, GFP_KERNEL);
+                if (ret < 0) {
+                        DBG(cdev, "mtp_write: xfer error %d\n", ret);
+                        r = -EIO;
+                        break;
+                }
+
+                buf += xfer;
+                count -= xfer;
+
+                /* zero this so we don't try to free it on error exit */
+                req = 0;
+        }
+
+        if (req)
+                mtp_req_put(dev, &dev->tx_idle, req);
+
+        spin_lock_irq(&dev->lock);
+        if (dev->state == STATE_CANCELED)
+                r = -ECANCELED;
+        else if (dev->state != STATE_OFFLINE)
+                dev->state = STATE_READY;
+        spin_unlock_irq(&dev->lock);
+
+        DBG(cdev, "mtp_write returning %d\n", r);
+        return r;
+}
+
+/* read from a local file and write to USB */
+static void send_file_work(struct work_struct *data) {
+        struct mtp_dev  *dev = container_of(data, struct mtp_dev, send_file_work);
+        struct usb_composite_dev *cdev = dev->cdev;
+        struct usb_request *req = 0;
+        struct mtp_data_header *header;
+        struct file *filp;
+        loff_t offset;
+        int64_t count;
+        int xfer, ret, hdr_size;
+        int r = 0;
+        int sendZLP = 0;
+
+        /* read our parameters */
+        smp_rmb();
+        filp = dev->xfer_file;
+        offset = dev->xfer_file_offset;
+        count = dev->xfer_file_length;
+
+        DBG(cdev, "send_file_work(%lld %lld)\n", offset, count);
+
+        if (dev->xfer_send_header) {
+                hdr_size = sizeof(struct mtp_data_header);
+                count += hdr_size;
+        } else {
+                hdr_size = 0;
+        }
+
+        /* we need to send a zero length packet to signal the end of transfer
+         * if the transfer size is aligned to a packet boundary.
+         */
+        if ((count & (dev->ep_in->maxpacket - 1)) == 0) {
+                sendZLP = 1;
+        }
+
+        while (count > 0 || sendZLP) {
+                /* so we exit after sending ZLP */
+                if (count == 0)
+                        sendZLP = 0;
+
+                /* get an idle tx request to use */
+                req = 0;
+                ret = wait_event_interruptible(dev->write_wq,
+                        (req = mtp_req_get(dev, &dev->tx_idle))
+                        || dev->state != STATE_BUSY);
+                if (dev->state == STATE_CANCELED) {
+                        r = -ECANCELED;
+                        break;
+                }
+                if (!req) {
+                        r = ret;
+                        break;
+                }
+
+                if (count > MTP_BULK_BUFFER_SIZE)
+                        xfer = MTP_BULK_BUFFER_SIZE;
+                else
+                        xfer = count;
+
+                if (hdr_size) {
+                        /* prepend MTP data header */
+                        header = (struct mtp_data_header *)req->buf;
+                        header->length = __cpu_to_le32(count);
+                        header->type = __cpu_to_le16(2); /* data packet */
+                        header->command = __cpu_to_le16(dev->xfer_command);
+                        header->transaction_id = __cpu_to_le32(dev->xfer_transaction_id);
+                }
+
+                ret = vfs_read(filp, req->buf + hdr_size, xfer - hdr_size, &offset);
+                if (ret < 0) {
+                        r = ret;
+                        break;
+                }
+                xfer = ret + hdr_size;
+                hdr_size = 0;
+
+                req->length = xfer;
+                ret = usb_ep_queue(dev->ep_in, req, GFP_KERNEL);
+                if (ret < 0) {
+                        DBG(cdev, "send_file_work: xfer error %d\n", ret);
+                        dev->state = STATE_ERROR;
+                        r = -EIO;
+                        break;
+                }
+
+                count -= xfer;
+
+                /* zero this so we don't try to free it on error exit */
+                req = 0;
+        }
+
+        if (req)
+                mtp_req_put(dev, &dev->tx_idle, req);
+
+        DBG(cdev, "send_file_work returning %d\n", r);
+        /* write the result */
+        dev->xfer_result = r;
+        smp_wmb();
+}
+
+/* read from USB and write to a local file */
+static void receive_file_work(struct work_struct *data)
+{
+        struct mtp_dev  *dev = container_of(data, struct mtp_dev, receive_file_work);
+        struct usb_composite_dev *cdev = dev->cdev;
+        struct usb_request *read_req = NULL, *write_req = NULL;
+        struct file *filp;
+        loff_t offset;
+        int64_t count;
+        int ret, cur_buf = 0;
+        int r = 0;
+
+        /* read our parameters */
+        smp_rmb();
+        filp = dev->xfer_file;
+        offset = dev->xfer_file_offset;
+        count = dev->xfer_file_length;
+
+        DBG(cdev, "receive_file_work(%lld)\n", count);
+
+        while (count > 0 || write_req) {
+                if (count > 0) {
+                        /* queue a request */
+                        read_req = dev->rx_req[cur_buf];
+                        cur_buf = (cur_buf + 1) % RX_REQ_MAX;
+
+                        read_req->length = (count > MTP_BULK_BUFFER_SIZE
+                                        ? MTP_BULK_BUFFER_SIZE : count);
+                        dev->rx_done = 0;
+                        ret = usb_ep_queue(dev->ep_out, read_req, GFP_KERNEL);
+                        if (ret < 0) {
+                                r = -EIO;
+                                dev->state = STATE_ERROR;
+                                break;
+                        }
+                }
+
+                if (write_req) {
+                        DBG(cdev, "rx %p %d\n", write_req, write_req->actual);
+                        ret = vfs_write(filp, write_req->buf, write_req->actual,
+                                &offset);
+                        DBG(cdev, "vfs_write %d\n", ret);
+                        if (ret != write_req->actual) {
+                                r = -EIO;
+                                dev->state = STATE_ERROR;
+                                break;
+                        }
+                        write_req = NULL;
+                }
+
+                if (read_req) {
+                        /* wait for our last read to complete */
+                        ret = wait_event_interruptible(dev->read_wq,
+                                dev->rx_done || dev->state != STATE_BUSY);
+                        if (dev->state == STATE_CANCELED) {
+                                r = -ECANCELED;
+                                if (!dev->rx_done)
+                                        usb_ep_dequeue(dev->ep_out, read_req);
+                                break;
+                        }
+                        /* if xfer_file_length is 0xFFFFFFFF, then we read until
+                         * we get a zero length packet
+                         */
+                        if (count != 0xFFFFFFFF)
+                                count -= read_req->actual;
+                        if (read_req->actual < read_req->length) {
+                                /* short packet is used to signal EOF for sizes > 4 gig */
+                                DBG(cdev, "got short packet\n");
+                                count = 0;
+                        }
+
+                        write_req = read_req;
+                        read_req = NULL;
+                }
+        }
+
+        DBG(cdev, "receive_file_work returning %d\n", r);
+        /* write the result */
+        dev->xfer_result = r;
+        smp_wmb();
+}
+
+static int mtp_send_event(struct mtp_dev *dev, struct mtp_event *event)
+{
+        struct usb_request *req= NULL;
+        int ret;
+        int length = event->length;
+
+        DBG(dev->cdev, "mtp_send_event(%d)\n", event->length);
+
+        if (length < 0 || length > INTR_BUFFER_SIZE)
+                return -EINVAL;
+        if (dev->state == STATE_OFFLINE)
+                return -ENODEV;
+
+        ret = wait_event_interruptible_timeout(dev->intr_wq,
+                (req = mtp_req_get(dev, &dev->intr_idle)), msecs_to_jiffies(1000));
+        if (!req)
+            return -ETIME;
+
+        if (copy_from_user(req->buf, (void __user *)event->data, length)) {
+                mtp_req_put(dev, &dev->intr_idle, req);
+                return -EFAULT;
+        }
+        req->length = length;
+        ret = usb_ep_queue(dev->ep_intr, req, GFP_KERNEL);
+        if (ret)
+                mtp_req_put(dev, &dev->intr_idle, req);
+
+        return ret;
+}
+
+static long mtp_ioctl(struct file *fp, unsigned code, unsigned long value)
+{
+        struct mtp_dev *dev = fp->private_data;
+        struct file *filp = NULL;
+        int ret = -EINVAL;
+
+        if (mtp_lock(&dev->ioctl_excl))
+                return -EBUSY;
+
+        switch (code) {
+        case MTP_SEND_FILE:
+        case MTP_RECEIVE_FILE:
+        case MTP_SEND_FILE_WITH_HEADER:
+        {
+                struct mtp_file_range   mfr;
+                struct work_struct *work;
+
+                spin_lock_irq(&dev->lock);
+                if (dev->state == STATE_CANCELED) {
+                        /* report cancelation to userspace */
+                        dev->state = STATE_READY;
+                        spin_unlock_irq(&dev->lock);
+                        ret = -ECANCELED;
+                        goto out;
+                }
+                if (dev->state == STATE_OFFLINE) {
+                        spin_unlock_irq(&dev->lock);
+                        ret = -ENODEV;
+                        goto out;
+                }
+                dev->state = STATE_BUSY;
+                spin_unlock_irq(&dev->lock);
+
+                if (copy_from_user(&mfr, (void __user *)value, sizeof(mfr))) {
+                        ret = -EFAULT;
+                        goto fail;
+                }
+                /* hold a reference to the file while we are working with it */
+                filp = fget(mfr.fd);
+                if (!filp) {
+                        ret = -EBADF;
+                        goto fail;
+                }
+
+                /* write the parameters */
+                dev->xfer_file = filp;
+                dev->xfer_file_offset = mfr.offset;
+                dev->xfer_file_length = mfr.length;
+                smp_wmb();
+
+                if (code == MTP_SEND_FILE_WITH_HEADER) {
+                        work = &dev->send_file_work;
+                        dev->xfer_send_header = 1;
+                        dev->xfer_command = mfr.command;
+                        dev->xfer_transaction_id = mfr.transaction_id;
+                } else if (code == MTP_SEND_FILE) {
+                        work = &dev->send_file_work;
+                        dev->xfer_send_header = 0;
+                } else {
+                        work = &dev->receive_file_work;
+                }
+
+                /* We do the file transfer on a work queue so it will run
+                 * in kernel context, which is necessary for vfs_read and
+                 * vfs_write to use our buffers in the kernel address space.
+                 */
+                queue_work(dev->wq, work);
+                /* wait for operation to complete */
+                flush_workqueue(dev->wq);
+                fput(filp);
+
+                /* read the result */
+                smp_rmb();
+                ret = dev->xfer_result;
+                break;
+        }
+        case MTP_SEND_EVENT:
+        {
+                struct mtp_event        event;
+                /* return here so we don't change dev->state below,
+                 * which would interfere with bulk transfer state.
+                 */
+                if (copy_from_user(&event, (void __user *)value, sizeof(event)))
+                        ret = -EFAULT;
+                else
+                        ret = mtp_send_event(dev, &event);
+                goto out;
+        }
+        }
+
+fail:
+        spin_lock_irq(&dev->lock);
+        if (dev->state == STATE_CANCELED)
+                ret = -ECANCELED;
+        else if (dev->state != STATE_OFFLINE)
+                dev->state = STATE_READY;
+        spin_unlock_irq(&dev->lock);
+out:
+        mtp_unlock(&dev->ioctl_excl);
+        DBG(dev->cdev, "ioctl returning %d\n", ret);
+        return ret;
+}
+
+static int mtp_open(struct inode *ip, struct file *fp)
+{
+        printk(KERN_INFO "mtp_open\n");
+        if (mtp_lock(&_mtp_dev->open_excl))
+                return -EBUSY;
+
+        /* clear any error condition */
+        if (_mtp_dev->state != STATE_OFFLINE)
+                _mtp_dev->state = STATE_READY;
+
+        fp->private_data = _mtp_dev;
+        return 0;
+}
+
+static int mtp_release(struct inode *ip, struct file *fp)
+{
+        printk(KERN_INFO "mtp_release\n");
+
+        mtp_unlock(&_mtp_dev->open_excl);
+        return 0;
+}
+
+/* file operations for /dev/mtp_usb */
+static const struct file_operations mtp_fops = {
+        .owner = THIS_MODULE,
+        .read = mtp_read,
+        .write = mtp_write,
+        .unlocked_ioctl = mtp_ioctl,
+        .open = mtp_open,
+        .release = mtp_release,
+};
+
+static struct miscdevice mtp_device = {
+        .minor = MISC_DYNAMIC_MINOR,
+        .name = mtp_shortname,
+        .fops = &mtp_fops,
+};
+
+static int mtp_ctrlrequest(struct usb_composite_dev *cdev,
+                                const struct usb_ctrlrequest *ctrl)
+{
+        struct mtp_dev *dev = _mtp_dev;
+        int     value = -EOPNOTSUPP;
+        u16     w_index = le16_to_cpu(ctrl->wIndex);
+        u16     w_value = le16_to_cpu(ctrl->wValue);
+        u16     w_length = le16_to_cpu(ctrl->wLength);
+        unsigned long   flags;
+
+        VDBG(cdev, "mtp_ctrlrequest "
+                        "%02x.%02x v%04x i%04x l%u\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, w_length);
+
+        /* Handle MTP OS string */
+        if (ctrl->bRequestType ==
+                        (USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_DEVICE)
+                        && ctrl->bRequest == USB_REQ_GET_DESCRIPTOR
+                        && (w_value >> 8) == USB_DT_STRING
+                        && (w_value & 0xFF) == MTP_OS_STRING_ID) {
+                value = (w_length < sizeof(mtp_os_string)
+                                ? w_length : sizeof(mtp_os_string));
+                memcpy(cdev->req->buf, mtp_os_string, value);
+        } else if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_VENDOR) {
+                /* Handle MTP OS descriptor */
+                DBG(cdev, "vendor request: %d index: %d value: %d length: %d\n",
+                        ctrl->bRequest, w_index, w_value, w_length);
+
+                if (ctrl->bRequest == 1
+                                && (ctrl->bRequestType & USB_DIR_IN)
+                                && (w_index == 4 || w_index == 5)) {
+                        value = (w_length < sizeof(mtp_ext_config_desc) ?
+                                        w_length : sizeof(mtp_ext_config_desc));
+                        memcpy(cdev->req->buf, &mtp_ext_config_desc, value);
+                }
+        } else if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS) {
+                DBG(cdev, "class request: %d index: %d value: %d length: %d\n",
+                        ctrl->bRequest, w_index, w_value, w_length);
+
+                if (ctrl->bRequest == MTP_REQ_CANCEL && w_index == 0
+                                && w_value == 0) {
+                        DBG(cdev, "MTP_REQ_CANCEL\n");
+
+                        spin_lock_irqsave(&dev->lock, flags);
+                        if (dev->state == STATE_BUSY) {
+                                dev->state = STATE_CANCELED;
+                                wake_up(&dev->read_wq);
+                                wake_up(&dev->write_wq);
+                        }
+                        spin_unlock_irqrestore(&dev->lock, flags);
+
+                        /* We need to queue a request to read the remaining
+                         *  bytes, but we don't actually need to look at
+                         * the contents.
+                         */
+                        value = w_length;
+                } else if (ctrl->bRequest == MTP_REQ_GET_DEVICE_STATUS
+                                && w_index == 0 && w_value == 0) {
+                        struct mtp_device_status *status = cdev->req->buf;
+                        status->wLength =
+                                __constant_cpu_to_le16(sizeof(*status));
+
+                        DBG(cdev, "MTP_REQ_GET_DEVICE_STATUS\n");
+                        spin_lock_irqsave(&dev->lock, flags);
+                        /* device status is "busy" until we report
+                         * the cancelation to userspace
+                         */
+                        if (dev->state == STATE_CANCELED)
+                                status->wCode =
+                                        __cpu_to_le16(MTP_RESPONSE_DEVICE_BUSY);
+                        else
+                                status->wCode =
+                                        __cpu_to_le16(MTP_RESPONSE_OK);
+                        spin_unlock_irqrestore(&dev->lock, flags);
+                        value = sizeof(*status);
+                }
+        }
+
+        /* respond with data transfer or status phase? */
+        if (value >= 0) {
+                int rc;
+                cdev->req->zero = value < w_length;
+                cdev->req->length = value;
+                rc = usb_ep_queue(cdev->gadget->ep0, cdev->req, GFP_ATOMIC);
+                if (rc < 0)
+                        ERROR(cdev, "%s setup response queue error\n", __func__);
+        }
+        return value;
+}
+
+static int
+mtp_function_bind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct usb_composite_dev *cdev = c->cdev;
+        struct mtp_dev  *dev = func_to_mtp(f);
+        int                     id;
+        int                     ret;
+
+        dev->cdev = cdev;
+        DBG(cdev, "mtp_function_bind dev: %p\n", dev);
+
+        /* allocate interface ID(s) */
+        id = usb_interface_id(c, f);
+        if (id < 0)
+                return id;
+        mtp_interface_desc.bInterfaceNumber = id;
+
+        /* allocate endpoints */
+        ret = mtp_create_bulk_endpoints(dev, &mtp_fullspeed_in_desc,
+                        &mtp_fullspeed_out_desc, &mtp_intr_desc);
+        if (ret)
+                return ret;
+
+        /* support high speed hardware */
+        if (gadget_is_dualspeed(c->cdev->gadget)) {
+                mtp_highspeed_in_desc.bEndpointAddress =
+                        mtp_fullspeed_in_desc.bEndpointAddress;
+                mtp_highspeed_out_desc.bEndpointAddress =
+                        mtp_fullspeed_out_desc.bEndpointAddress;
+        }
+
+        DBG(cdev, "%s speed %s: IN/%s, OUT/%s\n",
+                        gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
+                        f->name, dev->ep_in->name, dev->ep_out->name);
+        return 0;
+}
+
+static void
+mtp_function_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct mtp_dev  *dev = func_to_mtp(f);
+        struct usb_request *req;
+        int i;
+
+        while ((req = mtp_req_get(dev, &dev->tx_idle)))
+                mtp_request_free(req, dev->ep_in);
+        for (i = 0; i < RX_REQ_MAX; i++)
+                mtp_request_free(dev->rx_req[i], dev->ep_out);
+        while ((req = mtp_req_get(dev, &dev->intr_idle)))
+                mtp_request_free(req, dev->ep_intr);
+        dev->state = STATE_OFFLINE;
+}
+
+static int mtp_function_set_alt(struct usb_function *f,
+                unsigned intf, unsigned alt)
+{
+        struct mtp_dev  *dev = func_to_mtp(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+        int ret;
+
+        DBG(cdev, "mtp_function_set_alt intf: %d alt: %d\n", intf, alt);
+        config_ep_by_speed(cdev->gadget, f, dev->ep_in);
+        ret = usb_ep_enable(dev->ep_in);
+        if (ret)
+                return ret;
+        config_ep_by_speed(cdev->gadget, f, dev->ep_out);
+        ret = usb_ep_enable(dev->ep_out);
+        if (ret) {
+                usb_ep_disable(dev->ep_in);
+                return ret;
+        }
+        dev->ep_intr->desc = &mtp_intr_desc;
+        ret = usb_ep_enable(dev->ep_intr);
+        if (ret) {
+                usb_ep_disable(dev->ep_out);
+                usb_ep_disable(dev->ep_in);
+                return ret;
+        }
+        dev->state = STATE_READY;
+
+        /* readers may be blocked waiting for us to go online */
+        wake_up(&dev->read_wq);
+        return 0;
+}
+
+static void mtp_function_disable(struct usb_function *f)
+{
+        struct mtp_dev  *dev = func_to_mtp(f);
+        struct usb_composite_dev        *cdev = dev->cdev;
+
+        DBG(cdev, "mtp_function_disable\n");
+        dev->state = STATE_OFFLINE;
+        usb_ep_disable(dev->ep_in);
+        usb_ep_disable(dev->ep_out);
+        usb_ep_disable(dev->ep_intr);
+
+        /* readers may be blocked waiting for us to go online */
+        wake_up(&dev->read_wq);
+
+        VDBG(cdev, "%s disabled\n", dev->function.name);
+}
+
+static int mtp_bind_config(struct usb_configuration *c, bool ptp_config)
+{
+        struct mtp_dev *dev = _mtp_dev;
+        int ret = 0;
+
+        printk(KERN_INFO "mtp_bind_config\n");
+
+        /* allocate a string ID for our interface */
+        if (mtp_string_defs[INTERFACE_STRING_INDEX].id == 0) {
+                ret = usb_string_id(c->cdev);
+                if (ret < 0)
+                        return ret;
+                mtp_string_defs[INTERFACE_STRING_INDEX].id = ret;
+                mtp_interface_desc.iInterface = ret;
+        }
+
+        dev->cdev = c->cdev;
+        dev->function.name = "mtp";
+        dev->function.strings = mtp_strings;
+        if (ptp_config) {
+                dev->function.descriptors = fs_ptp_descs;
+                dev->function.hs_descriptors = hs_ptp_descs;
+        } else {
+                dev->function.descriptors = fs_mtp_descs;
+                dev->function.hs_descriptors = hs_mtp_descs;
+        }
+        dev->function.bind = mtp_function_bind;
+        dev->function.unbind = mtp_function_unbind;
+        dev->function.set_alt = mtp_function_set_alt;
+        dev->function.disable = mtp_function_disable;
+
+        return usb_add_function(c, &dev->function);
+}
+
+static int mtp_setup(void)
+{
+        struct mtp_dev *dev;
+        int ret;
+
+        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+        if (!dev)
+                return -ENOMEM;
+
+        spin_lock_init(&dev->lock);
+        init_waitqueue_head(&dev->read_wq);
+        init_waitqueue_head(&dev->write_wq);
+        init_waitqueue_head(&dev->intr_wq);
+        atomic_set(&dev->open_excl, 0);
+        atomic_set(&dev->ioctl_excl, 0);
+        INIT_LIST_HEAD(&dev->tx_idle);
+        INIT_LIST_HEAD(&dev->intr_idle);
+
+        dev->wq = create_singlethread_workqueue("f_mtp");
+        if (!dev->wq) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+        INIT_WORK(&dev->send_file_work, send_file_work);
+        INIT_WORK(&dev->receive_file_work, receive_file_work);
+
+        _mtp_dev = dev;
+
+        ret = misc_register(&mtp_device);
+        if (ret)
+                goto err2;
+
+        return 0;
+
+err2:
+        destroy_workqueue(dev->wq);
+err1:
+        _mtp_dev = NULL;
+        kfree(dev);
+        printk(KERN_ERR "mtp gadget driver failed to initialize\n");
+        return ret;
+}
+
+static void mtp_cleanup(void)
+{
+        struct mtp_dev *dev = _mtp_dev;
+
+        if (!dev)
+                return;
+
+        misc_deregister(&mtp_device);
+        destroy_workqueue(dev->wq);
+        _mtp_dev = NULL;
+        kfree(dev);
+}
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
new file mode 100644
index 00000000000..639e14a2fd1
--- /dev/null
+++ b/drivers/usb/gadget/file_storage.c
@@ -0,0 +1,3631 @@
+/*
+ * file_storage.c -- File-backed USB Storage Gadget, for USB development
+ *
+ * Copyright (C) 2003-2008 Alan Stern
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+/*
+ * The File-backed Storage Gadget acts as a USB Mass Storage device,
+ * appearing to the host as a disk drive or as a CD-ROM drive.  In addition
+ * to providing an example of a genuinely useful gadget driver for a USB
+ * device, it also illustrates a technique of double-buffering for increased
+ * throughput.  Last but not least, it gives an easy way to probe the
+ * behavior of the Mass Storage drivers in a USB host.
+ *
+ * Backing storage is provided by a regular file or a block device, specified
+ * by the "file" module parameter.  Access can be limited to read-only by
+ * setting the optional "ro" module parameter.  (For CD-ROM emulation,
+ * access is always read-only.)  The gadget will indicate that it has
+ * removable media if the optional "removable" module parameter is set.
+ *
+ * The gadget supports the Control-Bulk (CB), Control-Bulk-Interrupt (CBI),
+ * and Bulk-Only (also known as Bulk-Bulk-Bulk or BBB) transports, selected
+ * by the optional "transport" module parameter.  It also supports the
+ * following protocols: RBC (0x01), ATAPI or SFF-8020i (0x02), QIC-157 (0c03),
+ * UFI (0x04), SFF-8070i (0x05), and transparent SCSI (0x06), selected by
+ * the optional "protocol" module parameter.  In addition, the default
+ * Vendor ID, Product ID, release number and serial number can be overridden.
+ *
+ * There is support for multiple logical units (LUNs), each of which has
+ * its own backing file.  The number of LUNs can be set using the optional
+ * "luns" module parameter (anywhere from 1 to 8), and the corresponding
+ * files are specified using comma-separated lists for "file" and "ro".
+ * The default number of LUNs is taken from the number of "file" elements;
+ * it is 1 if "file" is not given.  If "removable" is not set then a backing
+ * file must be specified for each LUN.  If it is set, then an unspecified
+ * or empty backing filename means the LUN's medium is not loaded.  Ideally
+ * each LUN would be settable independently as a disk drive or a CD-ROM
+ * drive, but currently all LUNs have to be the same type.  The CD-ROM
+ * emulation includes a single data track and no audio tracks; hence there
+ * need be only one backing file per LUN.  Note also that the CD-ROM block
+ * length is set to 512 rather than the more common value 2048.
+ *
+ * Requirements are modest; only a bulk-in and a bulk-out endpoint are
+ * needed (an interrupt-out endpoint is also needed for CBI).  The memory
+ * requirement amounts to two 16K buffers, size configurable by a parameter.
+ * Support is included for both full-speed and high-speed operation.
+ *
+ * Note that the driver is slightly non-portable in that it assumes a
+ * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
+ * interrupt-in endpoints.  With most device controllers this isn't an
+ * issue, but there may be some with hardware restrictions that prevent
+ * a buffer from being used by more than one endpoint.
+ *
+ * Module options:
+ *
+ *      file=filename[,filename...]
+ *                              Required if "removable" is not set, names of
+ *                                      the files or block devices used for
+ *                                      backing storage
+ *      serial=HHHH...          Required serial number (string of hex chars)
+ *      ro=b[,b...]             Default false, booleans for read-only access
+ *      removable               Default false, boolean for removable media
+ *      luns=N                  Default N = number of filenames, number of
+ *                                      LUNs to support
+ *      nofua=b[,b...]          Default false, booleans for ignore FUA flag
+ *                                      in SCSI WRITE(10,12) commands
+ *      stall                   Default determined according to the type of
+ *                                      USB device controller (usually true),
+ *                                      boolean to permit the driver to halt
+ *                                      bulk endpoints
+ *      cdrom                   Default false, boolean for whether to emulate
+ *                                      a CD-ROM drive
+ *      transport=XXX           Default BBB, transport name (CB, CBI, or BBB)
+ *      protocol=YYY            Default SCSI, protocol name (RBC, 8020 or
+ *                                      ATAPI, QIC, UFI, 8070, or SCSI;
+ *                                      also 1 - 6)
+ *      vendor=0xVVVV           Default 0x0525 (NetChip), USB Vendor ID
+ *      product=0xPPPP          Default 0xa4a5 (FSG), USB Product ID
+ *      release=0xRRRR          Override the USB release number (bcdDevice)
+ *      buflen=N                Default N=16384, buffer size used (will be
+ *                                      rounded down to a multiple of
+ *                                      PAGE_CACHE_SIZE)
+ *
+ * If CONFIG_USB_FILE_STORAGE_TEST is not set, only the "file", "serial", "ro",
+ * "removable", "luns", "nofua", "stall", and "cdrom" options are available;
+ * default values are used for everything else.
+ *
+ * The pathnames of the backing files and the ro settings are available in
+ * the attribute files "file", "nofua", and "ro" in the lun<n> subdirectory of
+ * the gadget's sysfs directory.  If the "removable" option is set, writing to
+ * these files will simulate ejecting/loading the medium (writing an empty
+ * line means eject) and adjusting a write-enable tab.  Changes to the ro
+ * setting are not allowed when the medium is loaded or if CD-ROM emulation
+ * is being used.
+ *
+ * This gadget driver is heavily based on "Gadget Zero" by David Brownell.
+ * The driver's SCSI command interface was based on the "Information
+ * technology - Small Computer System Interface - 2" document from
+ * X3T9.2 Project 375D, Revision 10L, 7-SEP-93, available at
+ * <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>.  The single exception
+ * is opcode 0x23 (READ FORMAT CAPACITIES), which was based on the
+ * "Universal Serial Bus Mass Storage Class UFI Command Specification"
+ * document, Revision 1.0, December 14, 1998, available at
+ * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
+ */
+
+
+/*
+ *                              Driver Design
+ *
+ * The FSG driver is fairly straightforward.  There is a main kernel
+ * thread that handles most of the work.  Interrupt routines field
+ * callbacks from the controller driver: bulk- and interrupt-request
+ * completion notifications, endpoint-0 events, and disconnect events.
+ * Completion events are passed to the main thread by wakeup calls.  Many
+ * ep0 requests are handled at interrupt time, but SetInterface,
+ * SetConfiguration, and device reset requests are forwarded to the
+ * thread in the form of "exceptions" using SIGUSR1 signals (since they
+ * should interrupt any ongoing file I/O operations).
+ *
+ * The thread's main routine implements the standard command/data/status
+ * parts of a SCSI interaction.  It and its subroutines are full of tests
+ * for pending signals/exceptions -- all this polling is necessary since
+ * the kernel has no setjmp/longjmp equivalents.  (Maybe this is an
+ * indication that the driver really wants to be running in userspace.)
+ * An important point is that so long as the thread is alive it keeps an
+ * open reference to the backing file.  This will prevent unmounting
+ * the backing file's underlying filesystem and could cause problems
+ * during system shutdown, for example.  To prevent such problems, the
+ * thread catches INT, TERM, and KILL signals and converts them into
+ * an EXIT exception.
+ *
+ * In normal operation the main thread is started during the gadget's
+ * fsg_bind() callback and stopped during fsg_unbind().  But it can also
+ * exit when it receives a signal, and there's no point leaving the
+ * gadget running when the thread is dead.  So just before the thread
+ * exits, it deregisters the gadget driver.  This makes things a little
+ * tricky: The driver is deregistered at two places, and the exiting
+ * thread can indirectly call fsg_unbind() which in turn can tell the
+ * thread to exit.  The first problem is resolved through the use of the
+ * REGISTERED atomic bitflag; the driver will only be deregistered once.
+ * The second problem is resolved by having fsg_unbind() check
+ * fsg->state; it won't try to stop the thread if the state is already
+ * FSG_STATE_TERMINATED.
+ *
+ * To provide maximum throughput, the driver uses a circular pipeline of
+ * buffer heads (struct fsg_buffhd).  In principle the pipeline can be
+ * arbitrarily long; in practice the benefits don't justify having more
+ * than 2 stages (i.e., double buffering).  But it helps to think of the
+ * pipeline as being a long one.  Each buffer head contains a bulk-in and
+ * a bulk-out request pointer (since the buffer can be used for both
+ * output and input -- directions always are given from the host's
+ * point of view) as well as a pointer to the buffer and various state
+ * variables.
+ *
+ * Use of the pipeline follows a simple protocol.  There is a variable
+ * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
+ * At any time that buffer head may still be in use from an earlier
+ * request, so each buffer head has a state variable indicating whether
+ * it is EMPTY, FULL, or BUSY.  Typical use involves waiting for the
+ * buffer head to be EMPTY, filling the buffer either by file I/O or by
+ * USB I/O (during which the buffer head is BUSY), and marking the buffer
+ * head FULL when the I/O is complete.  Then the buffer will be emptied
+ * (again possibly by USB I/O, during which it is marked BUSY) and
+ * finally marked EMPTY again (possibly by a completion routine).
+ *
+ * A module parameter tells the driver to avoid stalling the bulk
+ * endpoints wherever the transport specification allows.  This is
+ * necessary for some UDCs like the SuperH, which cannot reliably clear a
+ * halt on a bulk endpoint.  However, under certain circumstances the
+ * Bulk-only specification requires a stall.  In such cases the driver
+ * will halt the endpoint and set a flag indicating that it should clear
+ * the halt in software during the next device reset.  Hopefully this
+ * will permit everything to work correctly.  Furthermore, although the
+ * specification allows the bulk-out endpoint to halt when the host sends
+ * too much data, implementing this would cause an unavoidable race.
+ * The driver will always use the "no-stall" approach for OUT transfers.
+ *
+ * One subtle point concerns sending status-stage responses for ep0
+ * requests.  Some of these requests, such as device reset, can involve
+ * interrupting an ongoing file I/O operation, which might take an
+ * arbitrarily long time.  During that delay the host might give up on
+ * the original ep0 request and issue a new one.  When that happens the
+ * driver should not notify the host about completion of the original
+ * request, as the host will no longer be waiting for it.  So the driver
+ * assigns to each ep0 request a unique tag, and it keeps track of the
+ * tag value of the request associated with a long-running exception
+ * (device-reset, interface-change, or configuration-change).  When the
+ * exception handler is finished, the status-stage response is submitted
+ * only if the current ep0 request tag is equal to the exception request
+ * tag.  Thus only the most recently received ep0 request will get a
+ * status-stage response.
+ *
+ * Warning: This driver source file is too long.  It ought to be split up
+ * into a header file plus about 3 separate .c files, to handle the details
+ * of the Gadget, USB Mass Storage, and SCSI protocols.
+ */
+
+
+/* #define VERBOSE_DEBUG */
+/* #define DUMP_MSGS */
+
+
+#include <linux/blkdev.h>
+#include <linux/completion.h>
+#include <linux/dcache.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/fcntl.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/kref.h>
+#include <linux/kthread.h>
+#include <linux/limits.h>
+#include <linux/rwsem.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/string.h>
+#include <linux/freezer.h>
+#include <linux/utsname.h>
+
+#include <linux/usb/ch9.h>
+#include <linux/usb/gadget.h>
+
+#include "gadget_chips.h"
+
+
+
+/*
+ * Kbuild is not very cooperative with respect to linking separately
+ * compiled library objects into one module.  So for now we won't use
+ * separate compilation ... ensuring init/exit sections work to shrink
+ * the runtime footprint, and giving us at least some parts of what
+ * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
+ */
+#include "usbstring.c"
+#include "config.c"
+#include "epautoconf.c"
+
+/*-------------------------------------------------------------------------*/
+
+#define DRIVER_DESC             "File-backed Storage Gadget"
+#define DRIVER_NAME             "g_file_storage"
+#define DRIVER_VERSION          "1 September 2010"
+
+static       char fsg_string_manufacturer[64];
+static const char fsg_string_product[] = DRIVER_DESC;
+static const char fsg_string_config[] = "Self-powered";
+static const char fsg_string_interface[] = "Mass Storage";
+
+
+#include "storage_common.c"
+
+
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_AUTHOR("Alan Stern");
+MODULE_LICENSE("Dual BSD/GPL");
+
+/*
+ * This driver assumes self-powered hardware and has no way for users to
+ * trigger remote wakeup.  It uses autoconfiguration to select endpoints
+ * and endpoint addresses.
+ */
+
+
+/*-------------------------------------------------------------------------*/
+
+
+/* Encapsulate the module parameter settings */
+
+static struct {
+        char            *file[FSG_MAX_LUNS];
+        char            *serial;
+        int             ro[FSG_MAX_LUNS];
+        int             nofua[FSG_MAX_LUNS];
+        unsigned int    num_filenames;
+        unsigned int    num_ros;
+        unsigned int    num_nofuas;
+        unsigned int    nluns;
+
+        int             removable;
+        int             can_stall;
+        int             cdrom;
+
+        char            *transport_parm;
+        char            *protocol_parm;
+        unsigned short  vendor;
+        unsigned short  product;
+        unsigned short  release;
+        unsigned int    buflen;
+
+        int             transport_type;
+        char            *transport_name;
+        int             protocol_type;
+        char            *protocol_name;
+
+} mod_data = {                                  // Default values
+        .transport_parm         = "BBB",
+        .protocol_parm          = "SCSI",
+        .removable              = 0,
+        .can_stall              = 1,
+        .cdrom                  = 0,
+        .vendor                 = FSG_VENDOR_ID,
+        .product                = FSG_PRODUCT_ID,
+        .release                = 0xffff,       // Use controller chip type
+        .buflen                 = 16384,
+        };
+
+
+module_param_array_named(file, mod_data.file, charp, &mod_data.num_filenames,
+                S_IRUGO);
+MODULE_PARM_DESC(file, "names of backing files or devices");
+
+module_param_named(serial, mod_data.serial, charp, S_IRUGO);
+MODULE_PARM_DESC(serial, "USB serial number");
+
+module_param_array_named(ro, mod_data.ro, bool, &mod_data.num_ros, S_IRUGO);
+MODULE_PARM_DESC(ro, "true to force read-only");
+
+module_param_array_named(nofua, mod_data.nofua, bool, &mod_data.num_nofuas,
+                S_IRUGO);
+MODULE_PARM_DESC(nofua, "true to ignore SCSI WRITE(10,12) FUA bit");
+
+module_param_named(luns, mod_data.nluns, uint, S_IRUGO);
+MODULE_PARM_DESC(luns, "number of LUNs");
+
+module_param_named(removable, mod_data.removable, bool, S_IRUGO);
+MODULE_PARM_DESC(removable, "true to simulate removable media");
+
+module_param_named(stall, mod_data.can_stall, bool, S_IRUGO);
+MODULE_PARM_DESC(stall, "false to prevent bulk stalls");
+
+module_param_named(cdrom, mod_data.cdrom, bool, S_IRUGO);
+MODULE_PARM_DESC(cdrom, "true to emulate cdrom instead of disk");
+
+/* In the non-TEST version, only the module parameters listed above
+ * are available. */
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+
+module_param_named(transport, mod_data.transport_parm, charp, S_IRUGO);
+MODULE_PARM_DESC(transport, "type of transport (BBB, CBI, or CB)");
+
+module_param_named(protocol, mod_data.protocol_parm, charp, S_IRUGO);
+MODULE_PARM_DESC(protocol, "type of protocol (RBC, 8020, QIC, UFI, "
+                "8070, or SCSI)");
+
+module_param_named(vendor, mod_data.vendor, ushort, S_IRUGO);
+MODULE_PARM_DESC(vendor, "USB Vendor ID");
+
+module_param_named(product, mod_data.product, ushort, S_IRUGO);
+MODULE_PARM_DESC(product, "USB Product ID");
+
+module_param_named(release, mod_data.release, ushort, S_IRUGO);
+MODULE_PARM_DESC(release, "USB release number");
+
+module_param_named(buflen, mod_data.buflen, uint, S_IRUGO);
+MODULE_PARM_DESC(buflen, "I/O buffer size");
+
+#endif /* CONFIG_USB_FILE_STORAGE_TEST */
+
+
+/*
+ * These definitions will permit the compiler to avoid generating code for
+ * parts of the driver that aren't used in the non-TEST version.  Even gcc
+ * can recognize when a test of a constant expression yields a dead code
+ * path.
+ */
+
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+
+#define transport_is_bbb()      (mod_data.transport_type == USB_PR_BULK)
+#define transport_is_cbi()      (mod_data.transport_type == USB_PR_CBI)
+#define protocol_is_scsi()      (mod_data.protocol_type == USB_SC_SCSI)
+
+#else
+
+#define transport_is_bbb()      1
+#define transport_is_cbi()      0
+#define protocol_is_scsi()      1
+
+#endif /* CONFIG_USB_FILE_STORAGE_TEST */
+
+
+/*-------------------------------------------------------------------------*/
+
+
+struct fsg_dev {
+        /* lock protects: state, all the req_busy's, and cbbuf_cmnd */
+        spinlock_t              lock;
+        struct usb_gadget       *gadget;
+
+        /* filesem protects: backing files in use */
+        struct rw_semaphore     filesem;
+
+        /* reference counting: wait until all LUNs are released */
+        struct kref             ref;
+
+        struct usb_ep           *ep0;           // Handy copy of gadget->ep0
+        struct usb_request      *ep0req;        // For control responses
+        unsigned int            ep0_req_tag;
+        const char              *ep0req_name;
+
+        struct usb_request      *intreq;        // For interrupt responses
+        int                     intreq_busy;
+        struct fsg_buffhd       *intr_buffhd;
+
+        unsigned int            bulk_out_maxpacket;
+        enum fsg_state          state;          // For exception handling
+        unsigned int            exception_req_tag;
+
+        u8                      config, new_config;
+
+        unsigned int            running : 1;
+        unsigned int            bulk_in_enabled : 1;
+        unsigned int            bulk_out_enabled : 1;
+        unsigned int            intr_in_enabled : 1;
+        unsigned int            phase_error : 1;
+        unsigned int            short_packet_received : 1;
+        unsigned int            bad_lun_okay : 1;
+
+        unsigned long           atomic_bitflags;
+#define REGISTERED              0
+#define IGNORE_BULK_OUT         1
+#define SUSPENDED               2
+
+        struct usb_ep           *bulk_in;
+        struct usb_ep           *bulk_out;
+        struct usb_ep           *intr_in;
+
+        struct fsg_buffhd       *next_buffhd_to_fill;
+        struct fsg_buffhd       *next_buffhd_to_drain;
+        struct fsg_buffhd       buffhds[FSG_NUM_BUFFERS];
+
+        int                     thread_wakeup_needed;
+        struct completion       thread_notifier;
+        struct task_struct      *thread_task;
+
+        int                     cmnd_size;
+        u8                      cmnd[MAX_COMMAND_SIZE];
+        enum data_direction     data_dir;
+        u32                     data_size;
+        u32                     data_size_from_cmnd;
+        u32                     tag;
+        unsigned int            lun;
+        u32                     residue;
+        u32                     usb_amount_left;
+
+        /* The CB protocol offers no way for a host to know when a command
+         * has completed.  As a result the next command may arrive early,
+         * and we will still have to handle it.  For that reason we need
+         * a buffer to store new commands when using CB (or CBI, which
+         * does not oblige a host to wait for command completion either). */
+        int                     cbbuf_cmnd_size;
+        u8                      cbbuf_cmnd[MAX_COMMAND_SIZE];
+
+        unsigned int            nluns;
+        struct fsg_lun          *luns;
+        struct fsg_lun          *curlun;
+};
+
+typedef void (*fsg_routine_t)(struct fsg_dev *);
+
+static int exception_in_progress(struct fsg_dev *fsg)
+{
+        return (fsg->state > FSG_STATE_IDLE);
+}
+
+/* Make bulk-out requests be divisible by the maxpacket size */
+static void set_bulk_out_req_length(struct fsg_dev *fsg,
+                struct fsg_buffhd *bh, unsigned int length)
+{
+        unsigned int    rem;
+
+        bh->bulk_out_intended_length = length;
+        rem = length % fsg->bulk_out_maxpacket;
+        if (rem > 0)
+                length += fsg->bulk_out_maxpacket - rem;
+        bh->outreq->length = length;
+}
+
+static struct fsg_dev                   *the_fsg;
+static struct usb_gadget_driver         fsg_driver;
+
+
+/*-------------------------------------------------------------------------*/
+
+static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
+{
+        const char      *name;
+
+        if (ep == fsg->bulk_in)
+                name = "bulk-in";
+        else if (ep == fsg->bulk_out)
+                name = "bulk-out";
+        else
+                name = ep->name;
+        DBG(fsg, "%s set halt\n", name);
+        return usb_ep_set_halt(ep);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * DESCRIPTORS ... most are static, but strings and (full) configuration
+ * descriptors are built on demand.  Also the (static) config and interface
+ * descriptors are adjusted during fsg_bind().
+ */
+
+/* There is only one configuration. */
+#define CONFIG_VALUE            1
+
+static struct usb_device_descriptor
+device_desc = {
+        .bLength =              sizeof device_desc,
+        .bDescriptorType =      USB_DT_DEVICE,
+
+        .bcdUSB =               cpu_to_le16(0x0200),
+        .bDeviceClass =         USB_CLASS_PER_INTERFACE,
+
+        /* The next three values can be overridden by module parameters */
+        .idVendor =             cpu_to_le16(FSG_VENDOR_ID),
+        .idProduct =            cpu_to_le16(FSG_PRODUCT_ID),
+        .bcdDevice =            cpu_to_le16(0xffff),
+
+        .iManufacturer =        FSG_STRING_MANUFACTURER,
+        .iProduct =             FSG_STRING_PRODUCT,
+        .iSerialNumber =        FSG_STRING_SERIAL,
+        .bNumConfigurations =   1,
+};
+
+static struct usb_config_descriptor
+config_desc = {
+        .bLength =              sizeof config_desc,
+        .bDescriptorType =      USB_DT_CONFIG,
+
+        /* wTotalLength computed by usb_gadget_config_buf() */
+        .bNumInterfaces =       1,
+        .bConfigurationValue =  CONFIG_VALUE,
+        .iConfiguration =       FSG_STRING_CONFIG,
+        .bmAttributes =         USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
+        .bMaxPower =            CONFIG_USB_GADGET_VBUS_DRAW / 2,
+};
+
+
+static struct usb_qualifier_descriptor
+dev_qualifier = {
+        .bLength =              sizeof dev_qualifier,
+        .bDescriptorType =      USB_DT_DEVICE_QUALIFIER,
+
+        .bcdUSB =               cpu_to_le16(0x0200),
+        .bDeviceClass =         USB_CLASS_PER_INTERFACE,
+
+        .bNumConfigurations =   1,
+};
+
+
+
+/*
+ * Config descriptors must agree with the code that sets configurations
+ * and with code managing interfaces and their altsettings.  They must
+ * also handle different speeds and other-speed requests.
+ */
+static int populate_config_buf(struct usb_gadget *gadget,
+                u8 *buf, u8 type, unsigned index)
+{
+        enum usb_device_speed                   speed = gadget->speed;
+        int                                     len;
+        const struct usb_descriptor_header      **function;
+
+        if (index > 0)
+                return -EINVAL;
+
+        if (gadget_is_dualspeed(gadget) && type == USB_DT_OTHER_SPEED_CONFIG)
+                speed = (USB_SPEED_FULL + USB_SPEED_HIGH) - speed;
+        function = gadget_is_dualspeed(gadget) && speed == USB_SPEED_HIGH
+                ? (const struct usb_descriptor_header **)fsg_hs_function
+                : (const struct usb_descriptor_header **)fsg_fs_function;
+
+        /* for now, don't advertise srp-only devices */
+        if (!gadget_is_otg(gadget))
+                function++;
+
+        len = usb_gadget_config_buf(&config_desc, buf, EP0_BUFSIZE, function);
+        ((struct usb_config_descriptor *) buf)->bDescriptorType = type;
+        return len;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* These routines may be called in process context or in_irq */
+
+/* Caller must hold fsg->lock */
+static void wakeup_thread(struct fsg_dev *fsg)
+{
+        /* Tell the main thread that something has happened */
+        fsg->thread_wakeup_needed = 1;
+        if (fsg->thread_task)
+                wake_up_process(fsg->thread_task);
+}
+
+
+static void raise_exception(struct fsg_dev *fsg, enum fsg_state new_state)
+{
+        unsigned long           flags;
+
+        /* Do nothing if a higher-priority exception is already in progress.
+         * If a lower-or-equal priority exception is in progress, preempt it
+         * and notify the main thread by sending it a signal. */
+        spin_lock_irqsave(&fsg->lock, flags);
+        if (fsg->state <= new_state) {
+                fsg->exception_req_tag = fsg->ep0_req_tag;
+                fsg->state = new_state;
+                if (fsg->thread_task)
+                        send_sig_info(SIGUSR1, SEND_SIG_FORCED,
+                                        fsg->thread_task);
+        }
+        spin_unlock_irqrestore(&fsg->lock, flags);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* The disconnect callback and ep0 routines.  These always run in_irq,
+ * except that ep0_queue() is called in the main thread to acknowledge
+ * completion of various requests: set config, set interface, and
+ * Bulk-only device reset. */
+
+static void fsg_disconnect(struct usb_gadget *gadget)
+{
+        struct fsg_dev          *fsg = get_gadget_data(gadget);
+
+        DBG(fsg, "disconnect or port reset\n");
+        raise_exception(fsg, FSG_STATE_DISCONNECT);
+}
+
+
+static int ep0_queue(struct fsg_dev *fsg)
+{
+        int     rc;
+
+        rc = usb_ep_queue(fsg->ep0, fsg->ep0req, GFP_ATOMIC);
+        if (rc != 0 && rc != -ESHUTDOWN) {
+
+                /* We can't do much more than wait for a reset */
+                WARNING(fsg, "error in submission: %s --> %d\n",
+                                fsg->ep0->name, rc);
+        }
+        return rc;
+}
+
+static void ep0_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct fsg_dev          *fsg = ep->driver_data;
+
+        if (req->actual > 0)
+                dump_msg(fsg, fsg->ep0req_name, req->buf, req->actual);
+        if (req->status || req->actual != req->length)
+                DBG(fsg, "%s --> %d, %u/%u\n", __func__,
+                                req->status, req->actual, req->length);
+        if (req->status == -ECONNRESET)         // Request was cancelled
+                usb_ep_fifo_flush(ep);
+
+        if (req->status == 0 && req->context)
+                ((fsg_routine_t) (req->context))(fsg);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* Bulk and interrupt endpoint completion handlers.
+ * These always run in_irq. */
+
+static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct fsg_dev          *fsg = ep->driver_data;
+        struct fsg_buffhd       *bh = req->context;
+
+        if (req->status || req->actual != req->length)
+                DBG(fsg, "%s --> %d, %u/%u\n", __func__,
+                                req->status, req->actual, req->length);
+        if (req->status == -ECONNRESET)         // Request was cancelled
+                usb_ep_fifo_flush(ep);
+
+        /* Hold the lock while we update the request and buffer states */
+        smp_wmb();
+        spin_lock(&fsg->lock);
+        bh->inreq_busy = 0;
+        bh->state = BUF_STATE_EMPTY;
+        wakeup_thread(fsg);
+        spin_unlock(&fsg->lock);
+}
+
+static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct fsg_dev          *fsg = ep->driver_data;
+        struct fsg_buffhd       *bh = req->context;
+
+        dump_msg(fsg, "bulk-out", req->buf, req->actual);
+        if (req->status || req->actual != bh->bulk_out_intended_length)
+                DBG(fsg, "%s --> %d, %u/%u\n", __func__,
+                                req->status, req->actual,
+                                bh->bulk_out_intended_length);
+        if (req->status == -ECONNRESET)         // Request was cancelled
+                usb_ep_fifo_flush(ep);
+
+        /* Hold the lock while we update the request and buffer states */
+        smp_wmb();
+        spin_lock(&fsg->lock);
+        bh->outreq_busy = 0;
+        bh->state = BUF_STATE_FULL;
+        wakeup_thread(fsg);
+        spin_unlock(&fsg->lock);
+}
+
+
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct fsg_dev          *fsg = ep->driver_data;
+        struct fsg_buffhd       *bh = req->context;
+
+        if (req->status || req->actual != req->length)
+                DBG(fsg, "%s --> %d, %u/%u\n", __func__,
+                                req->status, req->actual, req->length);
+        if (req->status == -ECONNRESET)         // Request was cancelled
+                usb_ep_fifo_flush(ep);
+
+        /* Hold the lock while we update the request and buffer states */
+        smp_wmb();
+        spin_lock(&fsg->lock);
+        fsg->intreq_busy = 0;
+        bh->state = BUF_STATE_EMPTY;
+        wakeup_thread(fsg);
+        spin_unlock(&fsg->lock);
+}
+
+#else
+static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
+{}
+#endif /* CONFIG_USB_FILE_STORAGE_TEST */
+
+
+/*-------------------------------------------------------------------------*/
+
+/* Ep0 class-specific handlers.  These always run in_irq. */
+
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+        struct usb_request      *req = fsg->ep0req;
+        static u8               cbi_reset_cmnd[6] = {
+                        SEND_DIAGNOSTIC, 4, 0xff, 0xff, 0xff, 0xff};
+
+        /* Error in command transfer? */
+        if (req->status || req->length != req->actual ||
+                        req->actual < 6 || req->actual > MAX_COMMAND_SIZE) {
+
+                /* Not all controllers allow a protocol stall after
+                 * receiving control-out data, but we'll try anyway. */
+                fsg_set_halt(fsg, fsg->ep0);
+                return;                 // Wait for reset
+        }
+
+        /* Is it the special reset command? */
+        if (req->actual >= sizeof cbi_reset_cmnd &&
+                        memcmp(req->buf, cbi_reset_cmnd,
+                                sizeof cbi_reset_cmnd) == 0) {
+
+                /* Raise an exception to stop the current operation
+                 * and reinitialize our state. */
+                DBG(fsg, "cbi reset request\n");
+                raise_exception(fsg, FSG_STATE_RESET);
+                return;
+        }
+
+        VDBG(fsg, "CB[I] accept device-specific command\n");
+        spin_lock(&fsg->lock);
+
+        /* Save the command for later */
+        if (fsg->cbbuf_cmnd_size)
+                WARNING(fsg, "CB[I] overwriting previous command\n");
+        fsg->cbbuf_cmnd_size = req->actual;
+        memcpy(fsg->cbbuf_cmnd, req->buf, fsg->cbbuf_cmnd_size);
+
+        wakeup_thread(fsg);
+        spin_unlock(&fsg->lock);
+}
+
+#else
+static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{}
+#endif /* CONFIG_USB_FILE_STORAGE_TEST */
+
+
+static int class_setup_req(struct fsg_dev *fsg,
+                const struct usb_ctrlrequest *ctrl)
+{
+        struct usb_request      *req = fsg->ep0req;
+        int                     value = -EOPNOTSUPP;
+        u16                     w_index = le16_to_cpu(ctrl->wIndex);
+        u16                     w_value = le16_to_cpu(ctrl->wValue);
+        u16                     w_length = le16_to_cpu(ctrl->wLength);
+
+        if (!fsg->config)
+                return value;
+
+        /* Handle Bulk-only class-specific requests */
+        if (transport_is_bbb()) {
+                switch (ctrl->bRequest) {
+
+                case USB_BULK_RESET_REQUEST:
+                        if (ctrl->bRequestType != (USB_DIR_OUT |
+                                        USB_TYPE_CLASS | USB_RECIP_INTERFACE))
+                                break;
+                        if (w_index != 0 || w_value != 0) {
+                                value = -EDOM;
+                                break;
+                        }
+
+                        /* Raise an exception to stop the current operation
+                         * and reinitialize our state. */
+                        DBG(fsg, "bulk reset request\n");
+                        raise_exception(fsg, FSG_STATE_RESET);
+                        value = DELAYED_STATUS;
+                        break;
+
+                case USB_BULK_GET_MAX_LUN_REQUEST:
+                        if (ctrl->bRequestType != (USB_DIR_IN |
+                                        USB_TYPE_CLASS | USB_RECIP_INTERFACE))
+                                break;
+                        if (w_index != 0 || w_value != 0) {
+                                value = -EDOM;
+                                break;
+                        }
+                        VDBG(fsg, "get max LUN\n");
+                        *(u8 *) req->buf = fsg->nluns - 1;
+                        value = 1;
+                        break;
+                }
+        }
+
+        /* Handle CBI class-specific requests */
+        else {
+                switch (ctrl->bRequest) {
+
+                case USB_CBI_ADSC_REQUEST:
+                        if (ctrl->bRequestType != (USB_DIR_OUT |
+                                        USB_TYPE_CLASS | USB_RECIP_INTERFACE))
+                                break;
+                        if (w_index != 0 || w_value != 0) {
+                                value = -EDOM;
+                                break;
+                        }
+                        if (w_length > MAX_COMMAND_SIZE) {
+                                value = -EOVERFLOW;
+                                break;
+                        }
+                        value = w_length;
+                        fsg->ep0req->context = received_cbi_adsc;
+                        break;
+                }
+        }
+
+        if (value == -EOPNOTSUPP)
+                VDBG(fsg,
+                        "unknown class-specific control req "
+                        "%02x.%02x v%04x i%04x l%u\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        le16_to_cpu(ctrl->wValue), w_index, w_length);
+        return value;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* Ep0 standard request handlers.  These always run in_irq. */
+
+static int standard_setup_req(struct fsg_dev *fsg,
+                const struct usb_ctrlrequest *ctrl)
+{
+        struct usb_request      *req = fsg->ep0req;
+        int                     value = -EOPNOTSUPP;
+        u16                     w_index = le16_to_cpu(ctrl->wIndex);
+        u16                     w_value = le16_to_cpu(ctrl->wValue);
+
+        /* Usually this just stores reply data in the pre-allocated ep0 buffer,
+         * but config change events will also reconfigure hardware. */
+        switch (ctrl->bRequest) {
+
+        case USB_REQ_GET_DESCRIPTOR:
+                if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
+                                USB_RECIP_DEVICE))
+                        break;
+                switch (w_value >> 8) {
+
+                case USB_DT_DEVICE:
+                        VDBG(fsg, "get device descriptor\n");
+                        device_desc.bMaxPacketSize0 = fsg->ep0->maxpacket;
+                        value = sizeof device_desc;
+                        memcpy(req->buf, &device_desc, value);
+                        break;
+                case USB_DT_DEVICE_QUALIFIER:
+                        VDBG(fsg, "get device qualifier\n");
+                        if (!gadget_is_dualspeed(fsg->gadget))
+                                break;
+                        /*
+                         * Assume ep0 uses the same maxpacket value for both
+                         * speeds
+                         */
+                        dev_qualifier.bMaxPacketSize0 = fsg->ep0->maxpacket;
+                        value = sizeof dev_qualifier;
+                        memcpy(req->buf, &dev_qualifier, value);
+                        break;
+
+                case USB_DT_OTHER_SPEED_CONFIG:
+                        VDBG(fsg, "get other-speed config descriptor\n");
+                        if (!gadget_is_dualspeed(fsg->gadget))
+                                break;
+                        goto get_config;
+                case USB_DT_CONFIG:
+                        VDBG(fsg, "get configuration descriptor\n");
+get_config:
+                        value = populate_config_buf(fsg->gadget,
+                                        req->buf,
+                                        w_value >> 8,
+                                        w_value & 0xff);
+                        break;
+
+                case USB_DT_STRING:
+                        VDBG(fsg, "get string descriptor\n");
+
+                        /* wIndex == language code */
+                        value = usb_gadget_get_string(&fsg_stringtab,
+                                        w_value & 0xff, req->buf);
+                        break;
+                }
+                break;
+
+        /* One config, two speeds */
+        case USB_REQ_SET_CONFIGURATION:
+                if (ctrl->bRequestType != (USB_DIR_OUT | USB_TYPE_STANDARD |
+                                USB_RECIP_DEVICE))
+                        break;
+                VDBG(fsg, "set configuration\n");
+                if (w_value == CONFIG_VALUE || w_value == 0) {
+                        fsg->new_config = w_value;
+
+                        /* Raise an exception to wipe out previous transaction
+                         * state (queued bufs, etc) and set the new config. */
+                        raise_exception(fsg, FSG_STATE_CONFIG_CHANGE);
+                        value = DELAYED_STATUS;
+                }
+                break;
+        case USB_REQ_GET_CONFIGURATION:
+                if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
+                                USB_RECIP_DEVICE))
+                        break;
+                VDBG(fsg, "get configuration\n");
+                *(u8 *) req->buf = fsg->config;
+                value = 1;
+                break;
+
+        case USB_REQ_SET_INTERFACE:
+                if (ctrl->bRequestType != (USB_DIR_OUT| USB_TYPE_STANDARD |
+                                USB_RECIP_INTERFACE))
+                        break;
+                if (fsg->config && w_index == 0) {
+
+                        /* Raise an exception to wipe out previous transaction
+                         * state (queued bufs, etc) and install the new
+                         * interface altsetting. */
+                        raise_exception(fsg, FSG_STATE_INTERFACE_CHANGE);
+                        value = DELAYED_STATUS;
+                }
+                break;
+        case USB_REQ_GET_INTERFACE:
+                if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
+                                USB_RECIP_INTERFACE))
+                        break;
+                if (!fsg->config)
+                        break;
+                if (w_index != 0) {
+                        value = -EDOM;
+                        break;
+                }
+                VDBG(fsg, "get interface\n");
+                *(u8 *) req->buf = 0;
+                value = 1;
+                break;
+
+        default:
+                VDBG(fsg,
+                        "unknown control req %02x.%02x v%04x i%04x l%u\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, le16_to_cpu(ctrl->wLength));
+        }
+
+        return value;
+}
+
+
+static int fsg_setup(struct usb_gadget *gadget,
+                const struct usb_ctrlrequest *ctrl)
+{
+        struct fsg_dev          *fsg = get_gadget_data(gadget);
+        int                     rc;
+        int                     w_length = le16_to_cpu(ctrl->wLength);
+
+        ++fsg->ep0_req_tag;             // Record arrival of a new request
+        fsg->ep0req->context = NULL;
+        fsg->ep0req->length = 0;
+        dump_msg(fsg, "ep0-setup", (u8 *) ctrl, sizeof(*ctrl));
+
+        if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS)
+                rc = class_setup_req(fsg, ctrl);
+        else
+                rc = standard_setup_req(fsg, ctrl);
+
+        /* Respond with data/status or defer until later? */
+        if (rc >= 0 && rc != DELAYED_STATUS) {
+                rc = min(rc, w_length);
+                fsg->ep0req->length = rc;
+                fsg->ep0req->zero = rc < w_length;
+                fsg->ep0req_name = (ctrl->bRequestType & USB_DIR_IN ?
+                                "ep0-in" : "ep0-out");
+                rc = ep0_queue(fsg);
+        }
+
+        /* Device either stalls (rc < 0) or reports success */
+        return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* All the following routines run in process context */
+
+
+/* Use this for bulk or interrupt transfers, not ep0 */
+static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
+                struct usb_request *req, int *pbusy,
+                enum fsg_buffer_state *state)
+{
+        int     rc;
+
+        if (ep == fsg->bulk_in)
+                dump_msg(fsg, "bulk-in", req->buf, req->length);
+        else if (ep == fsg->intr_in)
+                dump_msg(fsg, "intr-in", req->buf, req->length);
+
+        spin_lock_irq(&fsg->lock);
+        *pbusy = 1;
+        *state = BUF_STATE_BUSY;
+        spin_unlock_irq(&fsg->lock);
+        rc = usb_ep_queue(ep, req, GFP_KERNEL);
+        if (rc != 0) {
+                *pbusy = 0;
+                *state = BUF_STATE_EMPTY;
+
+                /* We can't do much more than wait for a reset */
+
+                /* Note: currently the net2280 driver fails zero-length
+                 * submissions if DMA is enabled. */
+                if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
+                                                req->length == 0))
+                        WARNING(fsg, "error in submission: %s --> %d\n",
+                                        ep->name, rc);
+        }
+}
+
+
+static int sleep_thread(struct fsg_dev *fsg)
+{
+        int     rc = 0;
+
+        /* Wait until a signal arrives or we are woken up */
+        for (;;) {
+                try_to_freeze();
+                set_current_state(TASK_INTERRUPTIBLE);
+                if (signal_pending(current)) {
+                        rc = -EINTR;
+                        break;
+                }
+                if (fsg->thread_wakeup_needed)
+                        break;
+                schedule();
+        }
+        __set_current_state(TASK_RUNNING);
+        fsg->thread_wakeup_needed = 0;
+        return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int do_read(struct fsg_dev *fsg)
+{
+        struct fsg_lun          *curlun = fsg->curlun;
+        u32                     lba;
+        struct fsg_buffhd       *bh;
+        int                     rc;
+        u32                     amount_left;
+        loff_t                  file_offset, file_offset_tmp;
+        unsigned int            amount;
+        unsigned int            partial_page;
+        ssize_t                 nread;
+
+        /* Get the starting Logical Block Address and check that it's
+         * not too big */
+        if (fsg->cmnd[0] == READ_6)
+                lba = get_unaligned_be24(&fsg->cmnd[1]);
+        else {
+                lba = get_unaligned_be32(&fsg->cmnd[2]);
+
+                /* We allow DPO (Disable Page Out = don't save data in the
+                 * cache) and FUA (Force Unit Access = don't read from the
+                 * cache), but we don't implement them. */
+                if ((fsg->cmnd[1] & ~0x18) != 0) {
+                        curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                        return -EINVAL;
+                }
+        }
+        if (lba >= curlun->num_sectors) {
+                curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+                return -EINVAL;
+        }
+        file_offset = ((loff_t) lba) << 9;
+
+        /* Carry out the file reads */
+        amount_left = fsg->data_size_from_cmnd;
+        if (unlikely(amount_left == 0))
+                return -EIO;            // No default reply
+
+        for (;;) {
+
+                /* Figure out how much we need to read:
+                 * Try to read the remaining amount.
+                 * But don't read more than the buffer size.
+                 * And don't try to read past the end of the file.
+                 * Finally, if we're not at a page boundary, don't read past
+                 *      the next page.
+                 * If this means reading 0 then we were asked to read past
+                 *      the end of file. */
+                amount = min((unsigned int) amount_left, mod_data.buflen);
+                amount = min((loff_t) amount,
+                                curlun->file_length - file_offset);
+                partial_page = file_offset & (PAGE_CACHE_SIZE - 1);
+                if (partial_page > 0)
+                        amount = min(amount, (unsigned int) PAGE_CACHE_SIZE -
+                                        partial_page);
+
+                /* Wait for the next buffer to become available */
+                bh = fsg->next_buffhd_to_fill;
+                while (bh->state != BUF_STATE_EMPTY) {
+                        rc = sleep_thread(fsg);
+                        if (rc)
+                                return rc;
+                }
+
+                /* If we were asked to read past the end of file,
+                 * end with an empty buffer. */
+                if (amount == 0) {
+                        curlun->sense_data =
+                                        SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+                        curlun->sense_data_info = file_offset >> 9;
+                        curlun->info_valid = 1;
+                        bh->inreq->length = 0;
+                        bh->state = BUF_STATE_FULL;
+                        break;
+                }
+
+                /* Perform the read */
+                file_offset_tmp = file_offset;
+                nread = vfs_read(curlun->filp,
+                                (char __user *) bh->buf,
+                                amount, &file_offset_tmp);
+                VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
+                                (unsigned long long) file_offset,
+                                (int) nread);
+                if (signal_pending(current))
+                        return -EINTR;
+
+                if (nread < 0) {
+                        LDBG(curlun, "error in file read: %d\n",
+                                        (int) nread);
+                        nread = 0;
+                } else if (nread < amount) {
+                        LDBG(curlun, "partial file read: %d/%u\n",
+                                        (int) nread, amount);
+                        nread -= (nread & 511); // Round down to a block
+                }
+                file_offset  += nread;
+                amount_left  -= nread;
+                fsg->residue -= nread;
+                bh->inreq->length = nread;
+                bh->state = BUF_STATE_FULL;
+
+                /* If an error occurred, report it and its position */
+                if (nread < amount) {
+                        curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
+                        curlun->sense_data_info = file_offset >> 9;
+                        curlun->info_valid = 1;
+                        break;
+                }
+
+                if (amount_left == 0)
+                        break;          // No more left to read
+
+                /* Send this buffer and go read some more */
+                bh->inreq->zero = 0;
+                start_transfer(fsg, fsg->bulk_in, bh->inreq,
+                                &bh->inreq_busy, &bh->state);
+                fsg->next_buffhd_to_fill = bh->next;
+        }
+
+        return -EIO;            // No default reply
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int do_write(struct fsg_dev *fsg)
+{
+        struct fsg_lun          *curlun = fsg->curlun;
+        u32                     lba;
+        struct fsg_buffhd       *bh;
+        int                     get_some_more;
+        u32                     amount_left_to_req, amount_left_to_write;
+        loff_t                  usb_offset, file_offset, file_offset_tmp;
+        unsigned int            amount;
+        unsigned int            partial_page;
+        ssize_t                 nwritten;
+        int                     rc;
+
+        if (curlun->ro) {
+                curlun->sense_data = SS_WRITE_PROTECTED;
+                return -EINVAL;
+        }
+        spin_lock(&curlun->filp->f_lock);
+        curlun->filp->f_flags &= ~O_SYNC;       // Default is not to wait
+        spin_unlock(&curlun->filp->f_lock);
+
+        /* Get the starting Logical Block Address and check that it's
+         * not too big */
+        if (fsg->cmnd[0] == WRITE_6)
+                lba = get_unaligned_be24(&fsg->cmnd[1]);
+        else {
+                lba = get_unaligned_be32(&fsg->cmnd[2]);
+
+                /* We allow DPO (Disable Page Out = don't save data in the
+                 * cache) and FUA (Force Unit Access = write directly to the
+                 * medium).  We don't implement DPO; we implement FUA by
+                 * performing synchronous output. */
+                if ((fsg->cmnd[1] & ~0x18) != 0) {
+                        curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                        return -EINVAL;
+                }
+                /* FUA */
+                if (!curlun->nofua && (fsg->cmnd[1] & 0x08)) {
+                        spin_lock(&curlun->filp->f_lock);
+                        curlun->filp->f_flags |= O_DSYNC;
+                        spin_unlock(&curlun->filp->f_lock);
+                }
+        }
+        if (lba >= curlun->num_sectors) {
+                curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+                return -EINVAL;
+        }
+
+        /* Carry out the file writes */
+        get_some_more = 1;
+        file_offset = usb_offset = ((loff_t) lba) << 9;
+        amount_left_to_req = amount_left_to_write = fsg->data_size_from_cmnd;
+
+        while (amount_left_to_write > 0) {
+
+                /* Queue a request for more data from the host */
+                bh = fsg->next_buffhd_to_fill;
+                if (bh->state == BUF_STATE_EMPTY && get_some_more) {
+
+                        /* Figure out how much we want to get:
+                         * Try to get the remaining amount.
+                         * But don't get more than the buffer size.
+                         * And don't try to go past the end of the file.
+                         * If we're not at a page boundary,
+                         *      don't go past the next page.
+                         * If this means getting 0, then we were asked
+                         *      to write past the end of file.
+                         * Finally, round down to a block boundary. */
+                        amount = min(amount_left_to_req, mod_data.buflen);
+                        amount = min((loff_t) amount, curlun->file_length -
+                                        usb_offset);
+                        partial_page = usb_offset & (PAGE_CACHE_SIZE - 1);
+                        if (partial_page > 0)
+                                amount = min(amount,
+        (unsigned int) PAGE_CACHE_SIZE - partial_page);
+
+                        if (amount == 0) {
+                                get_some_more = 0;
+                                curlun->sense_data =
+                                        SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+                                curlun->sense_data_info = usb_offset >> 9;
+                                curlun->info_valid = 1;
+                                continue;
+                        }
+                        amount -= (amount & 511);
+                        if (amount == 0) {
+
+                                /* Why were we were asked to transfer a
+                                 * partial block? */
+                                get_some_more = 0;
+                                continue;
+                        }
+
+                        /* Get the next buffer */
+                        usb_offset += amount;
+                        fsg->usb_amount_left -= amount;
+                        amount_left_to_req -= amount;
+                        if (amount_left_to_req == 0)
+                                get_some_more = 0;
+
+                        /* amount is always divisible by 512, hence by
+                         * the bulk-out maxpacket size */
+                        bh->outreq->length = bh->bulk_out_intended_length =
+                                        amount;
+                        bh->outreq->short_not_ok = 1;
+                        start_transfer(fsg, fsg->bulk_out, bh->outreq,
+                                        &bh->outreq_busy, &bh->state);
+                        fsg->next_buffhd_to_fill = bh->next;
+                        continue;
+                }
+
+                /* Write the received data to the backing file */
+                bh = fsg->next_buffhd_to_drain;
+                if (bh->state == BUF_STATE_EMPTY && !get_some_more)
+                        break;                  // We stopped early
+                if (bh->state == BUF_STATE_FULL) {
+                        smp_rmb();
+                        fsg->next_buffhd_to_drain = bh->next;
+                        bh->state = BUF_STATE_EMPTY;
+
+                        /* Did something go wrong with the transfer? */
+                        if (bh->outreq->status != 0) {
+                                curlun->sense_data = SS_COMMUNICATION_FAILURE;
+                                curlun->sense_data_info = file_offset >> 9;
+                                curlun->info_valid = 1;
+                                break;
+                        }
+
+                        amount = bh->outreq->actual;
+                        if (curlun->file_length - file_offset < amount) {
+                                LERROR(curlun,
+        "write %u @ %llu beyond end %llu\n",
+        amount, (unsigned long long) file_offset,
+        (unsigned long long) curlun->file_length);
+                                amount = curlun->file_length - file_offset;
+                        }
+
+                        /* Perform the write */
+                        file_offset_tmp = file_offset;
+                        nwritten = vfs_write(curlun->filp,
+                                        (char __user *) bh->buf,
+                                        amount, &file_offset_tmp);
+                        VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
+                                        (unsigned long long) file_offset,
+                                        (int) nwritten);
+                        if (signal_pending(current))
+                                return -EINTR;          // Interrupted!
+
+                        if (nwritten < 0) {
+                                LDBG(curlun, "error in file write: %d\n",
+                                                (int) nwritten);
+                                nwritten = 0;
+                        } else if (nwritten < amount) {
+                                LDBG(curlun, "partial file write: %d/%u\n",
+                                                (int) nwritten, amount);
+                                nwritten -= (nwritten & 511);
+                                                // Round down to a block
+                        }
+                        file_offset += nwritten;
+                        amount_left_to_write -= nwritten;
+                        fsg->residue -= nwritten;
+
+                        /* If an error occurred, report it and its position */
+                        if (nwritten < amount) {
+                                curlun->sense_data = SS_WRITE_ERROR;
+                                curlun->sense_data_info = file_offset >> 9;
+                                curlun->info_valid = 1;
+                                break;
+                        }
+
+                        /* Did the host decide to stop early? */
+                        if (bh->outreq->actual != bh->outreq->length) {
+                                fsg->short_packet_received = 1;
+                                break;
+                        }
+                        continue;
+                }
+
+                /* Wait for something to happen */
+                rc = sleep_thread(fsg);
+                if (rc)
+                        return rc;
+        }
+
+        return -EIO;            // No default reply
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int do_synchronize_cache(struct fsg_dev *fsg)
+{
+        struct fsg_lun  *curlun = fsg->curlun;
+        int             rc;
+
+        /* We ignore the requested LBA and write out all file's
+         * dirty data buffers. */
+        rc = fsg_lun_fsync_sub(curlun);
+        if (rc)
+                curlun->sense_data = SS_WRITE_ERROR;
+        return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static void invalidate_sub(struct fsg_lun *curlun)
+{
+        struct file     *filp = curlun->filp;
+        struct inode    *inode = filp->f_path.dentry->d_inode;
+        unsigned long   rc;
+
+        rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
+        VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc);
+}
+
+static int do_verify(struct fsg_dev *fsg)
+{
+        struct fsg_lun          *curlun = fsg->curlun;
+        u32                     lba;
+        u32                     verification_length;
+        struct fsg_buffhd       *bh = fsg->next_buffhd_to_fill;
+        loff_t                  file_offset, file_offset_tmp;
+        u32                     amount_left;
+        unsigned int            amount;
+        ssize_t                 nread;
+
+        /* Get the starting Logical Block Address and check that it's
+         * not too big */
+        lba = get_unaligned_be32(&fsg->cmnd[2]);
+        if (lba >= curlun->num_sectors) {
+                curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+                return -EINVAL;
+        }
+
+        /* We allow DPO (Disable Page Out = don't save data in the
+         * cache) but we don't implement it. */
+        if ((fsg->cmnd[1] & ~0x10) != 0) {
+                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                return -EINVAL;
+        }
+
+        verification_length = get_unaligned_be16(&fsg->cmnd[7]);
+        if (unlikely(verification_length == 0))
+                return -EIO;            // No default reply
+
+        /* Prepare to carry out the file verify */
+        amount_left = verification_length << 9;
+        file_offset = ((loff_t) lba) << 9;
+
+        /* Write out all the dirty buffers before invalidating them */
+        fsg_lun_fsync_sub(curlun);
+        if (signal_pending(current))
+                return -EINTR;
+
+        invalidate_sub(curlun);
+        if (signal_pending(current))
+                return -EINTR;
+
+        /* Just try to read the requested blocks */
+        while (amount_left > 0) {
+
+                /* Figure out how much we need to read:
+                 * Try to read the remaining amount, but not more than
+                 * the buffer size.
+                 * And don't try to read past the end of the file.
+                 * If this means reading 0 then we were asked to read
+                 * past the end of file. */
+                amount = min((unsigned int) amount_left, mod_data.buflen);
+                amount = min((loff_t) amount,
+                                curlun->file_length - file_offset);
+                if (amount == 0) {
+                        curlun->sense_data =
+                                        SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+                        curlun->sense_data_info = file_offset >> 9;
+                        curlun->info_valid = 1;
+                        break;
+                }
+
+                /* Perform the read */
+                file_offset_tmp = file_offset;
+                nread = vfs_read(curlun->filp,
+                                (char __user *) bh->buf,
+                                amount, &file_offset_tmp);
+                VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
+                                (unsigned long long) file_offset,
+                                (int) nread);
+                if (signal_pending(current))
+                        return -EINTR;
+
+                if (nread < 0) {
+                        LDBG(curlun, "error in file verify: %d\n",
+                                        (int) nread);
+                        nread = 0;
+                } else if (nread < amount) {
+                        LDBG(curlun, "partial file verify: %d/%u\n",
+                                        (int) nread, amount);
+                        nread -= (nread & 511); // Round down to a sector
+                }
+                if (nread == 0) {
+                        curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
+                        curlun->sense_data_info = file_offset >> 9;
+                        curlun->info_valid = 1;
+                        break;
+                }
+                file_offset += nread;
+                amount_left -= nread;
+        }
+        return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int do_inquiry(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+        u8      *buf = (u8 *) bh->buf;
+
+        static char vendor_id[] = "Linux   ";
+        static char product_disk_id[] = "File-Stor Gadget";
+        static char product_cdrom_id[] = "File-CD Gadget  ";
+
+        if (!fsg->curlun) {             // Unsupported LUNs are okay
+                fsg->bad_lun_okay = 1;
+                memset(buf, 0, 36);
+                buf[0] = 0x7f;          // Unsupported, no device-type
+                buf[4] = 31;            // Additional length
+                return 36;
+        }
+
+        memset(buf, 0, 8);
+        buf[0] = (mod_data.cdrom ? TYPE_ROM : TYPE_DISK);
+        if (mod_data.removable)
+                buf[1] = 0x80;
+        buf[2] = 2;             // ANSI SCSI level 2
+        buf[3] = 2;             // SCSI-2 INQUIRY data format
+        buf[4] = 31;            // Additional length
+                                // No special options
+        sprintf(buf + 8, "%-8s%-16s%04x", vendor_id,
+                        (mod_data.cdrom ? product_cdrom_id :
+                                product_disk_id),
+                        mod_data.release);
+        return 36;
+}
+
+
+static int do_request_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+        struct fsg_lun  *curlun = fsg->curlun;
+        u8              *buf = (u8 *) bh->buf;
+        u32             sd, sdinfo;
+        int             valid;
+
+        /*
+         * From the SCSI-2 spec., section 7.9 (Unit attention condition):
+         *
+         * If a REQUEST SENSE command is received from an initiator
+         * with a pending unit attention condition (before the target
+         * generates the contingent allegiance condition), then the
+         * target shall either:
+         *   a) report any pending sense data and preserve the unit
+         *      attention condition on the logical unit, or,
+         *   b) report the unit attention condition, may discard any
+         *      pending sense data, and clear the unit attention
+         *      condition on the logical unit for that initiator.
+         *
+         * FSG normally uses option a); enable this code to use option b).
+         */
+#if 0
+        if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
+                curlun->sense_data = curlun->unit_attention_data;
+                curlun->unit_attention_data = SS_NO_SENSE;
+        }
+#endif
+
+        if (!curlun) {          // Unsupported LUNs are okay
+                fsg->bad_lun_okay = 1;
+                sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
+                sdinfo = 0;
+                valid = 0;
+        } else {
+                sd = curlun->sense_data;
+                sdinfo = curlun->sense_data_info;
+                valid = curlun->info_valid << 7;
+                curlun->sense_data = SS_NO_SENSE;
+                curlun->sense_data_info = 0;
+                curlun->info_valid = 0;
+        }
+
+        memset(buf, 0, 18);
+        buf[0] = valid | 0x70;                  // Valid, current error
+        buf[2] = SK(sd);
+        put_unaligned_be32(sdinfo, &buf[3]);    /* Sense information */
+        buf[7] = 18 - 8;                        // Additional sense length
+        buf[12] = ASC(sd);
+        buf[13] = ASCQ(sd);
+        return 18;
+}
+
+
+static int do_read_capacity(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+        struct fsg_lun  *curlun = fsg->curlun;
+        u32             lba = get_unaligned_be32(&fsg->cmnd[2]);
+        int             pmi = fsg->cmnd[8];
+        u8              *buf = (u8 *) bh->buf;
+
+        /* Check the PMI and LBA fields */
+        if (pmi > 1 || (pmi == 0 && lba != 0)) {
+                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                return -EINVAL;
+        }
+
+        put_unaligned_be32(curlun->num_sectors - 1, &buf[0]);
+                                                /* Max logical block */
+        put_unaligned_be32(512, &buf[4]);       /* Block length */
+        return 8;
+}
+
+
+static int do_read_header(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+        struct fsg_lun  *curlun = fsg->curlun;
+        int             msf = fsg->cmnd[1] & 0x02;
+        u32             lba = get_unaligned_be32(&fsg->cmnd[2]);
+        u8              *buf = (u8 *) bh->buf;
+
+        if ((fsg->cmnd[1] & ~0x02) != 0) {              /* Mask away MSF */
+                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                return -EINVAL;
+        }
+        if (lba >= curlun->num_sectors) {
+                curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+                return -EINVAL;
+        }
+
+        memset(buf, 0, 8);
+        buf[0] = 0x01;          /* 2048 bytes of user data, rest is EC */
+        store_cdrom_address(&buf[4], msf, lba);
+        return 8;
+}
+
+
+static int do_read_toc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+        struct fsg_lun  *curlun = fsg->curlun;
+        int             msf = fsg->cmnd[1] & 0x02;
+        int             start_track = fsg->cmnd[6];
+        u8              *buf = (u8 *) bh->buf;
+
+        if ((fsg->cmnd[1] & ~0x02) != 0 ||              /* Mask away MSF */
+                        start_track > 1) {
+                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                return -EINVAL;
+        }
+
+        memset(buf, 0, 20);
+        buf[1] = (20-2);                /* TOC data length */
+        buf[2] = 1;                     /* First track number */
+        buf[3] = 1;                     /* Last track number */
+        buf[5] = 0x16;                  /* Data track, copying allowed */
+        buf[6] = 0x01;                  /* Only track is number 1 */
+        store_cdrom_address(&buf[8], msf, 0);
+
+        buf[13] = 0x16;                 /* Lead-out track is data */
+        buf[14] = 0xAA;                 /* Lead-out track number */
+        store_cdrom_address(&buf[16], msf, curlun->num_sectors);
+        return 20;
+}
+
+
+static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+        struct fsg_lun  *curlun = fsg->curlun;
+        int             mscmnd = fsg->cmnd[0];
+        u8              *buf = (u8 *) bh->buf;
+        u8              *buf0 = buf;
+        int             pc, page_code;
+        int             changeable_values, all_pages;
+        int             valid_page = 0;
+        int             len, limit;
+
+        if ((fsg->cmnd[1] & ~0x08) != 0) {              // Mask away DBD
+                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                return -EINVAL;
+        }
+        pc = fsg->cmnd[2] >> 6;
+        page_code = fsg->cmnd[2] & 0x3f;
+        if (pc == 3) {
+                curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
+                return -EINVAL;
+        }
+        changeable_values = (pc == 1);
+        all_pages = (page_code == 0x3f);
+
+        /* Write the mode parameter header.  Fixed values are: default
+         * medium type, no cache control (DPOFUA), and no block descriptors.
+         * The only variable value is the WriteProtect bit.  We will fill in
+         * the mode data length later. */
+        memset(buf, 0, 8);
+        if (mscmnd == MODE_SENSE) {
+                buf[2] = (curlun->ro ? 0x80 : 0x00);            // WP, DPOFUA
+                buf += 4;
+                limit = 255;
+        } else {                        // MODE_SENSE_10
+                buf[3] = (curlun->ro ? 0x80 : 0x00);            // WP, DPOFUA
+                buf += 8;
+                limit = 65535;          // Should really be mod_data.buflen
+        }
+
+        /* No block descriptors */
+
+        /* The mode pages, in numerical order.  The only page we support
+         * is the Caching page. */
+        if (page_code == 0x08 || all_pages) {
+                valid_page = 1;
+                buf[0] = 0x08;          // Page code
+                buf[1] = 10;            // Page length
+                memset(buf+2, 0, 10);   // None of the fields are changeable
+
+                if (!changeable_values) {
+                        buf[2] = 0x04;  // Write cache enable,
+                                        // Read cache not disabled
+                                        // No cache retention priorities
+                        put_unaligned_be16(0xffff, &buf[4]);
+                                        /* Don't disable prefetch */
+                                        /* Minimum prefetch = 0 */
+                        put_unaligned_be16(0xffff, &buf[8]);
+                                        /* Maximum prefetch */
+                        put_unaligned_be16(0xffff, &buf[10]);
+                                        /* Maximum prefetch ceiling */
+                }
+                buf += 12;
+        }
+
+        /* Check that a valid page was requested and the mode data length
+         * isn't too long. */
+        len = buf - buf0;
+        if (!valid_page || len > limit) {
+                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                return -EINVAL;
+        }
+
+        /*  Store the mode data length */
+        if (mscmnd == MODE_SENSE)
+                buf0[0] = len - 1;
+        else
+                put_unaligned_be16(len - 2, buf0);
+        return len;
+}
+
+
+static int do_start_stop(struct fsg_dev *fsg)
+{
+        struct fsg_lun  *curlun = fsg->curlun;
+        int             loej, start;
+
+        if (!mod_data.removable) {
+                curlun->sense_data = SS_INVALID_COMMAND;
+                return -EINVAL;
+        }
+
+        // int immed = fsg->cmnd[1] & 0x01;
+        loej = fsg->cmnd[4] & 0x02;
+        start = fsg->cmnd[4] & 0x01;
+
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+        if ((fsg->cmnd[1] & ~0x01) != 0 ||              // Mask away Immed
+                        (fsg->cmnd[4] & ~0x03) != 0) {  // Mask LoEj, Start
+                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                return -EINVAL;
+        }
+
+        if (!start) {
+
+                /* Are we allowed to unload the media? */
+                if (curlun->prevent_medium_removal) {
+                        LDBG(curlun, "unload attempt prevented\n");
+                        curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
+                        return -EINVAL;
+                }
+                if (loej) {             // Simulate an unload/eject
+                        up_read(&fsg->filesem);
+                        down_write(&fsg->filesem);
+                        fsg_lun_close(curlun);
+                        up_write(&fsg->filesem);
+                        down_read(&fsg->filesem);
+                }
+        } else {
+
+                /* Our emulation doesn't support mounting; the medium is
+                 * available for use as soon as it is loaded. */
+                if (!fsg_lun_is_open(curlun)) {
+                        curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
+                        return -EINVAL;
+                }
+        }
+#endif
+        return 0;
+}
+
+
+static int do_prevent_allow(struct fsg_dev *fsg)
+{
+        struct fsg_lun  *curlun = fsg->curlun;
+        int             prevent;
+
+        if (!mod_data.removable) {
+                curlun->sense_data = SS_INVALID_COMMAND;
+                return -EINVAL;
+        }
+
+        prevent = fsg->cmnd[4] & 0x01;
+        if ((fsg->cmnd[4] & ~0x01) != 0) {              // Mask away Prevent
+                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                return -EINVAL;
+        }
+
+        if (curlun->prevent_medium_removal && !prevent)
+                fsg_lun_fsync_sub(curlun);
+        curlun->prevent_medium_removal = prevent;
+        return 0;
+}
+
+
+static int do_read_format_capacities(struct fsg_dev *fsg,
+                        struct fsg_buffhd *bh)
+{
+        struct fsg_lun  *curlun = fsg->curlun;
+        u8              *buf = (u8 *) bh->buf;
+
+        buf[0] = buf[1] = buf[2] = 0;
+        buf[3] = 8;             // Only the Current/Maximum Capacity Descriptor
+        buf += 4;
+
+        put_unaligned_be32(curlun->num_sectors, &buf[0]);
+                                                /* Number of blocks */
+        put_unaligned_be32(512, &buf[4]);       /* Block length */
+        buf[4] = 0x02;                          /* Current capacity */
+        return 12;
+}
+
+
+static int do_mode_select(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+        struct fsg_lun  *curlun = fsg->curlun;
+
+        /* We don't support MODE SELECT */
+        curlun->sense_data = SS_INVALID_COMMAND;
+        return -EINVAL;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
+{
+        int     rc;
+
+        rc = fsg_set_halt(fsg, fsg->bulk_in);
+        if (rc == -EAGAIN)
+                VDBG(fsg, "delayed bulk-in endpoint halt\n");
+        while (rc != 0) {
+                if (rc != -EAGAIN) {
+                        WARNING(fsg, "usb_ep_set_halt -> %d\n", rc);
+                        rc = 0;
+                        break;
+                }
+
+                /* Wait for a short time and then try again */
+                if (msleep_interruptible(100) != 0)
+                        return -EINTR;
+                rc = usb_ep_set_halt(fsg->bulk_in);
+        }
+        return rc;
+}
+
+static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
+{
+        int     rc;
+
+        DBG(fsg, "bulk-in set wedge\n");
+        rc = usb_ep_set_wedge(fsg->bulk_in);
+        if (rc == -EAGAIN)
+                VDBG(fsg, "delayed bulk-in endpoint wedge\n");
+        while (rc != 0) {
+                if (rc != -EAGAIN) {
+                        WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc);
+                        rc = 0;
+                        break;
+                }
+
+                /* Wait for a short time and then try again */
+                if (msleep_interruptible(100) != 0)
+                        return -EINTR;
+                rc = usb_ep_set_wedge(fsg->bulk_in);
+        }
+        return rc;
+}
+
+static int throw_away_data(struct fsg_dev *fsg)
+{
+        struct fsg_buffhd       *bh;
+        u32                     amount;
+        int                     rc;
+
+        while ((bh = fsg->next_buffhd_to_drain)->state != BUF_STATE_EMPTY ||
+                        fsg->usb_amount_left > 0) {
+
+                /* Throw away the data in a filled buffer */
+                if (bh->state == BUF_STATE_FULL) {
+                        smp_rmb();
+                        bh->state = BUF_STATE_EMPTY;
+                        fsg->next_buffhd_to_drain = bh->next;
+
+                        /* A short packet or an error ends everything */
+                        if (bh->outreq->actual != bh->outreq->length ||
+                                        bh->outreq->status != 0) {
+                                raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
+                                return -EINTR;
+                        }
+                        continue;
+                }
+
+                /* Try to submit another request if we need one */
+                bh = fsg->next_buffhd_to_fill;
+                if (bh->state == BUF_STATE_EMPTY && fsg->usb_amount_left > 0) {
+                        amount = min(fsg->usb_amount_left,
+                                        (u32) mod_data.buflen);
+
+                        /* amount is always divisible by 512, hence by
+                         * the bulk-out maxpacket size */
+                        bh->outreq->length = bh->bulk_out_intended_length =
+                                        amount;
+                        bh->outreq->short_not_ok = 1;
+                        start_transfer(fsg, fsg->bulk_out, bh->outreq,
+                                        &bh->outreq_busy, &bh->state);
+                        fsg->next_buffhd_to_fill = bh->next;
+                        fsg->usb_amount_left -= amount;
+                        continue;
+                }
+
+                /* Otherwise wait for something to happen */
+                rc = sleep_thread(fsg);
+                if (rc)
+                        return rc;
+        }
+        return 0;
+}
+
+
+static int finish_reply(struct fsg_dev *fsg)
+{
+        struct fsg_buffhd       *bh = fsg->next_buffhd_to_fill;
+        int                     rc = 0;
+
+        switch (fsg->data_dir) {
+        case DATA_DIR_NONE:
+                break;                  // Nothing to send
+
+        /* If we don't know whether the host wants to read or write,
+         * this must be CB or CBI with an unknown command.  We mustn't
+         * try to send or receive any data.  So stall both bulk pipes
+         * if we can and wait for a reset. */
+        case DATA_DIR_UNKNOWN:
+                if (mod_data.can_stall) {
+                        fsg_set_halt(fsg, fsg->bulk_out);
+                        rc = halt_bulk_in_endpoint(fsg);
+                }
+                break;
+
+        /* All but the last buffer of data must have already been sent */
+        case DATA_DIR_TO_HOST:
+                if (fsg->data_size == 0)
+                        ;               // Nothing to send
+
+                /* If there's no residue, simply send the last buffer */
+                else if (fsg->residue == 0) {
+                        bh->inreq->zero = 0;
+                        start_transfer(fsg, fsg->bulk_in, bh->inreq,
+                                        &bh->inreq_busy, &bh->state);
+                        fsg->next_buffhd_to_fill = bh->next;
+                }
+
+                /* There is a residue.  For CB and CBI, simply mark the end
+                 * of the data with a short packet.  However, if we are
+                 * allowed to stall, there was no data at all (residue ==
+                 * data_size), and the command failed (invalid LUN or
+                 * sense data is set), then halt the bulk-in endpoint
+                 * instead. */
+                else if (!transport_is_bbb()) {
+                        if (mod_data.can_stall &&
+                                        fsg->residue == fsg->data_size &&
+        (!fsg->curlun || fsg->curlun->sense_data != SS_NO_SENSE)) {
+                                bh->state = BUF_STATE_EMPTY;
+                                rc = halt_bulk_in_endpoint(fsg);
+                        } else {
+                                bh->inreq->zero = 1;
+                                start_transfer(fsg, fsg->bulk_in, bh->inreq,
+                                                &bh->inreq_busy, &bh->state);
+                                fsg->next_buffhd_to_fill = bh->next;
+                        }
+                }
+
+                /*
+                 * For Bulk-only, mark the end of the data with a short
+                 * packet.  If we are allowed to stall, halt the bulk-in
+                 * endpoint.  (Note: This violates the Bulk-Only Transport
+                 * specification, which requires us to pad the data if we
+                 * don't halt the endpoint.  Presumably nobody will mind.)
+                 */
+                else {
+                        bh->inreq->zero = 1;
+                        start_transfer(fsg, fsg->bulk_in, bh->inreq,
+                                        &bh->inreq_busy, &bh->state);
+                        fsg->next_buffhd_to_fill = bh->next;
+                        if (mod_data.can_stall)
+                                rc = halt_bulk_in_endpoint(fsg);
+                }
+                break;
+
+        /* We have processed all we want from the data the host has sent.
+         * There may still be outstanding bulk-out requests. */
+        case DATA_DIR_FROM_HOST:
+                if (fsg->residue == 0)
+                        ;               // Nothing to receive
+
+                /* Did the host stop sending unexpectedly early? */
+                else if (fsg->short_packet_received) {
+                        raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
+                        rc = -EINTR;
+                }
+
+                /* We haven't processed all the incoming data.  Even though
+                 * we may be allowed to stall, doing so would cause a race.
+                 * The controller may already have ACK'ed all the remaining
+                 * bulk-out packets, in which case the host wouldn't see a
+                 * STALL.  Not realizing the endpoint was halted, it wouldn't
+                 * clear the halt -- leading to problems later on. */
+#if 0
+                else if (mod_data.can_stall) {
+                        fsg_set_halt(fsg, fsg->bulk_out);
+                        raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
+                        rc = -EINTR;
+                }
+#endif
+
+                /* We can't stall.  Read in the excess data and throw it
+                 * all away. */
+                else
+                        rc = throw_away_data(fsg);
+                break;
+        }
+        return rc;
+}
+
+
+static int send_status(struct fsg_dev *fsg)
+{
+        struct fsg_lun          *curlun = fsg->curlun;
+        struct fsg_buffhd       *bh;
+        int                     rc;
+        u8                      status = USB_STATUS_PASS;
+        u32                     sd, sdinfo = 0;
+
+        /* Wait for the next buffer to become available */
+        bh = fsg->next_buffhd_to_fill;
+        while (bh->state != BUF_STATE_EMPTY) {
+                rc = sleep_thread(fsg);
+                if (rc)
+                        return rc;
+        }
+
+        if (curlun) {
+                sd = curlun->sense_data;
+                sdinfo = curlun->sense_data_info;
+        } else if (fsg->bad_lun_okay)
+                sd = SS_NO_SENSE;
+        else
+                sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
+
+        if (fsg->phase_error) {
+                DBG(fsg, "sending phase-error status\n");
+                status = USB_STATUS_PHASE_ERROR;
+                sd = SS_INVALID_COMMAND;
+        } else if (sd != SS_NO_SENSE) {
+                DBG(fsg, "sending command-failure status\n");
+                status = USB_STATUS_FAIL;
+                VDBG(fsg, "  sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
+                                "  info x%x\n",
+                                SK(sd), ASC(sd), ASCQ(sd), sdinfo);
+        }
+
+        if (transport_is_bbb()) {
+                struct bulk_cs_wrap     *csw = bh->buf;
+
+                /* Store and send the Bulk-only CSW */
+                csw->Signature = cpu_to_le32(USB_BULK_CS_SIG);
+                csw->Tag = fsg->tag;
+                csw->Residue = cpu_to_le32(fsg->residue);
+                csw->Status = status;
+
+                bh->inreq->length = USB_BULK_CS_WRAP_LEN;
+                bh->inreq->zero = 0;
+                start_transfer(fsg, fsg->bulk_in, bh->inreq,
+                                &bh->inreq_busy, &bh->state);
+
+        } else if (mod_data.transport_type == USB_PR_CB) {
+
+                /* Control-Bulk transport has no status phase! */
+                return 0;
+
+        } else {                        // USB_PR_CBI
+                struct interrupt_data   *buf = bh->buf;
+
+                /* Store and send the Interrupt data.  UFI sends the ASC
+                 * and ASCQ bytes.  Everything else sends a Type (which
+                 * is always 0) and the status Value. */
+                if (mod_data.protocol_type == USB_SC_UFI) {
+                        buf->bType = ASC(sd);
+                        buf->bValue = ASCQ(sd);
+                } else {
+                        buf->bType = 0;
+                        buf->bValue = status;
+                }
+                fsg->intreq->length = CBI_INTERRUPT_DATA_LEN;
+
+                fsg->intr_buffhd = bh;          // Point to the right buffhd
+                fsg->intreq->buf = bh->inreq->buf;
+                fsg->intreq->context = bh;
+                start_transfer(fsg, fsg->intr_in, fsg->intreq,
+                                &fsg->intreq_busy, &bh->state);
+        }
+
+        fsg->next_buffhd_to_fill = bh->next;
+        return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* Check whether the command is properly formed and whether its data size
+ * and direction agree with the values we already have. */
+static int check_command(struct fsg_dev *fsg, int cmnd_size,
+                enum data_direction data_dir, unsigned int mask,
+                int needs_medium, const char *name)
+{
+        int                     i;
+        int                     lun = fsg->cmnd[1] >> 5;
+        static const char       dirletter[4] = {'u', 'o', 'i', 'n'};
+        char                    hdlen[20];
+        struct fsg_lun          *curlun;
+
+        /* Adjust the expected cmnd_size for protocol encapsulation padding.
+         * Transparent SCSI doesn't pad. */
+        if (protocol_is_scsi())
+                ;
+
+        /* There's some disagreement as to whether RBC pads commands or not.
+         * We'll play it safe and accept either form. */
+        else if (mod_data.protocol_type == USB_SC_RBC) {
+                if (fsg->cmnd_size == 12)
+                        cmnd_size = 12;
+
+        /* All the other protocols pad to 12 bytes */
+        } else
+                cmnd_size = 12;
+
+        hdlen[0] = 0;
+        if (fsg->data_dir != DATA_DIR_UNKNOWN)
+                sprintf(hdlen, ", H%c=%u", dirletter[(int) fsg->data_dir],
+                                fsg->data_size);
+        VDBG(fsg, "SCSI command: %s;  Dc=%d, D%c=%u;  Hc=%d%s\n",
+                        name, cmnd_size, dirletter[(int) data_dir],
+                        fsg->data_size_from_cmnd, fsg->cmnd_size, hdlen);
+
+        /* We can't reply at all until we know the correct data direction
+         * and size. */
+        if (fsg->data_size_from_cmnd == 0)
+                data_dir = DATA_DIR_NONE;
+        if (fsg->data_dir == DATA_DIR_UNKNOWN) {        // CB or CBI
+                fsg->data_dir = data_dir;
+                fsg->data_size = fsg->data_size_from_cmnd;
+
+        } else {                                        // Bulk-only
+                if (fsg->data_size < fsg->data_size_from_cmnd) {
+
+                        /* Host data size < Device data size is a phase error.
+                         * Carry out the command, but only transfer as much
+                         * as we are allowed. */
+                        fsg->data_size_from_cmnd = fsg->data_size;
+                        fsg->phase_error = 1;
+                }
+        }
+        fsg->residue = fsg->usb_amount_left = fsg->data_size;
+
+        /* Conflicting data directions is a phase error */
+        if (fsg->data_dir != data_dir && fsg->data_size_from_cmnd > 0) {
+                fsg->phase_error = 1;
+                return -EINVAL;
+        }
+
+        /* Verify the length of the command itself */
+        if (cmnd_size != fsg->cmnd_size) {
+
+                /* Special case workaround: There are plenty of buggy SCSI
+                 * implementations. Many have issues with cbw->Length
+                 * field passing a wrong command size. For those cases we
+                 * always try to work around the problem by using the length
+                 * sent by the host side provided it is at least as large
+                 * as the correct command length.
+                 * Examples of such cases would be MS-Windows, which issues
+                 * REQUEST SENSE with cbw->Length == 12 where it should
+                 * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
+                 * REQUEST SENSE with cbw->Length == 10 where it should
+                 * be 6 as well.
+                 */
+                if (cmnd_size <= fsg->cmnd_size) {
+                        DBG(fsg, "%s is buggy! Expected length %d "
+                                        "but we got %d\n", name,
+                                        cmnd_size, fsg->cmnd_size);
+                        cmnd_size = fsg->cmnd_size;
+                } else {
+                        fsg->phase_error = 1;
+                        return -EINVAL;
+                }
+        }
+
+        /* Check that the LUN values are consistent */
+        if (transport_is_bbb()) {
+                if (fsg->lun != lun)
+                        DBG(fsg, "using LUN %d from CBW, "
+                                        "not LUN %d from CDB\n",
+                                        fsg->lun, lun);
+        } else
+                fsg->lun = lun;         // Use LUN from the command
+
+        /* Check the LUN */
+        if (fsg->lun < fsg->nluns) {
+                fsg->curlun = curlun = &fsg->luns[fsg->lun];
+                if (fsg->cmnd[0] != REQUEST_SENSE) {
+                        curlun->sense_data = SS_NO_SENSE;
+                        curlun->sense_data_info = 0;
+                        curlun->info_valid = 0;
+                }
+        } else {
+                fsg->curlun = curlun = NULL;
+                fsg->bad_lun_okay = 0;
+
+                /* INQUIRY and REQUEST SENSE commands are explicitly allowed
+                 * to use unsupported LUNs; all others may not. */
+                if (fsg->cmnd[0] != INQUIRY &&
+                                fsg->cmnd[0] != REQUEST_SENSE) {
+                        DBG(fsg, "unsupported LUN %d\n", fsg->lun);
+                        return -EINVAL;
+                }
+        }
+
+        /* If a unit attention condition exists, only INQUIRY and
+         * REQUEST SENSE commands are allowed; anything else must fail. */
+        if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
+                        fsg->cmnd[0] != INQUIRY &&
+                        fsg->cmnd[0] != REQUEST_SENSE) {
+                curlun->sense_data = curlun->unit_attention_data;
+                curlun->unit_attention_data = SS_NO_SENSE;
+                return -EINVAL;
+        }
+
+        /* Check that only command bytes listed in the mask are non-zero */
+        fsg->cmnd[1] &= 0x1f;                   // Mask away the LUN
+        for (i = 1; i < cmnd_size; ++i) {
+                if (fsg->cmnd[i] && !(mask & (1 << i))) {
+                        if (curlun)
+                                curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+                        return -EINVAL;
+                }
+        }
+
+        /* If the medium isn't mounted and the command needs to access
+         * it, return an error. */
+        if (curlun && !fsg_lun_is_open(curlun) && needs_medium) {
+                curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+
+static int do_scsi_command(struct fsg_dev *fsg)
+{
+        struct fsg_buffhd       *bh;
+        int                     rc;
+        int                     reply = -EINVAL;
+        int                     i;
+        static char             unknown[16];
+
+        dump_cdb(fsg);
+
+        /* Wait for the next buffer to become available for data or status */
+        bh = fsg->next_buffhd_to_drain = fsg->next_buffhd_to_fill;
+        while (bh->state != BUF_STATE_EMPTY) {
+                rc = sleep_thread(fsg);
+                if (rc)
+                        return rc;
+        }
+        fsg->phase_error = 0;
+        fsg->short_packet_received = 0;
+
+        down_read(&fsg->filesem);       // We're using the backing file
+        switch (fsg->cmnd[0]) {
+
+        case INQUIRY:
+                fsg->data_size_from_cmnd = fsg->cmnd[4];
+                if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
+                                (1<<4), 0,
+                                "INQUIRY")) == 0)
+                        reply = do_inquiry(fsg, bh);
+                break;
+
+        case MODE_SELECT:
+                fsg->data_size_from_cmnd = fsg->cmnd[4];
+                if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
+                                (1<<1) | (1<<4), 0,
+                                "MODE SELECT(6)")) == 0)
+                        reply = do_mode_select(fsg, bh);
+                break;
+
+        case MODE_SELECT_10:
+                fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+                if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
+                                (1<<1) | (3<<7), 0,
+                                "MODE SELECT(10)")) == 0)
+                        reply = do_mode_select(fsg, bh);
+                break;
+
+        case MODE_SENSE:
+                fsg->data_size_from_cmnd = fsg->cmnd[4];
+                if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
+                                (1<<1) | (1<<2) | (1<<4), 0,
+                                "MODE SENSE(6)")) == 0)
+                        reply = do_mode_sense(fsg, bh);
+                break;
+
+        case MODE_SENSE_10:
+                fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+                if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+                                (1<<1) | (1<<2) | (3<<7), 0,
+                                "MODE SENSE(10)")) == 0)
+                        reply = do_mode_sense(fsg, bh);
+                break;
+
+        case ALLOW_MEDIUM_REMOVAL:
+                fsg->data_size_from_cmnd = 0;
+                if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
+                                (1<<4), 0,
+                                "PREVENT-ALLOW MEDIUM REMOVAL")) == 0)
+                        reply = do_prevent_allow(fsg);
+                break;
+
+        case READ_6:
+                i = fsg->cmnd[4];
+                fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
+                if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
+                                (7<<1) | (1<<4), 1,
+                                "READ(6)")) == 0)
+                        reply = do_read(fsg);
+                break;
+
+        case READ_10:
+                fsg->data_size_from_cmnd =
+                                get_unaligned_be16(&fsg->cmnd[7]) << 9;
+                if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+                                (1<<1) | (0xf<<2) | (3<<7), 1,
+                                "READ(10)")) == 0)
+                        reply = do_read(fsg);
+                break;
+
+        case READ_12:
+                fsg->data_size_from_cmnd =
+                                get_unaligned_be32(&fsg->cmnd[6]) << 9;
+                if ((reply = check_command(fsg, 12, DATA_DIR_TO_HOST,
+                                (1<<1) | (0xf<<2) | (0xf<<6), 1,
+                                "READ(12)")) == 0)
+                        reply = do_read(fsg);
+                break;
+
+        case READ_CAPACITY:
+                fsg->data_size_from_cmnd = 8;
+                if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+                                (0xf<<2) | (1<<8), 1,
+                                "READ CAPACITY")) == 0)
+                        reply = do_read_capacity(fsg, bh);
+                break;
+
+        case READ_HEADER:
+                if (!mod_data.cdrom)
+                        goto unknown_cmnd;
+                fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+                if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+                                (3<<7) | (0x1f<<1), 1,
+                                "READ HEADER")) == 0)
+                        reply = do_read_header(fsg, bh);
+                break;
+
+        case READ_TOC:
+                if (!mod_data.cdrom)
+                        goto unknown_cmnd;
+                fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+                if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+                                (7<<6) | (1<<1), 1,
+                                "READ TOC")) == 0)
+                        reply = do_read_toc(fsg, bh);
+                break;
+
+        case READ_FORMAT_CAPACITIES:
+                fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+                if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+                                (3<<7), 1,
+                                "READ FORMAT CAPACITIES")) == 0)
+                        reply = do_read_format_capacities(fsg, bh);
+                break;
+
+        case REQUEST_SENSE:
+                fsg->data_size_from_cmnd = fsg->cmnd[4];
+                if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
+                                (1<<4), 0,
+                                "REQUEST SENSE")) == 0)
+                        reply = do_request_sense(fsg, bh);
+                break;
+
+        case START_STOP:
+                fsg->data_size_from_cmnd = 0;
+                if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
+                                (1<<1) | (1<<4), 0,
+                                "START-STOP UNIT")) == 0)
+                        reply = do_start_stop(fsg);
+                break;
+
+        case SYNCHRONIZE_CACHE:
+                fsg->data_size_from_cmnd = 0;
+                if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
+                                (0xf<<2) | (3<<7), 1,
+                                "SYNCHRONIZE CACHE")) == 0)
+                        reply = do_synchronize_cache(fsg);
+                break;
+
+        case TEST_UNIT_READY:
+                fsg->data_size_from_cmnd = 0;
+                reply = check_command(fsg, 6, DATA_DIR_NONE,
+                                0, 1,
+                                "TEST UNIT READY");
+                break;
+
+        /* Although optional, this command is used by MS-Windows.  We
+         * support a minimal version: BytChk must be 0. */
+        case VERIFY:
+                fsg->data_size_from_cmnd = 0;
+                if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
+                                (1<<1) | (0xf<<2) | (3<<7), 1,
+                                "VERIFY")) == 0)
+                        reply = do_verify(fsg);
+                break;
+
+        case WRITE_6:
+                i = fsg->cmnd[4];
+                fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
+                if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
+                                (7<<1) | (1<<4), 1,
+                                "WRITE(6)")) == 0)
+                        reply = do_write(fsg);
+                break;
+
+        case WRITE_10:
+                fsg->data_size_from_cmnd =
+                                get_unaligned_be16(&fsg->cmnd[7]) << 9;
+                if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
+                                (1<<1) | (0xf<<2) | (3<<7), 1,
+                                "WRITE(10)")) == 0)
+                        reply = do_write(fsg);
+                break;
+
+        case WRITE_12:
+                fsg->data_size_from_cmnd =
+                                get_unaligned_be32(&fsg->cmnd[6]) << 9;
+                if ((reply = check_command(fsg, 12, DATA_DIR_FROM_HOST,
+                                (1<<1) | (0xf<<2) | (0xf<<6), 1,
+                                "WRITE(12)")) == 0)
+                        reply = do_write(fsg);
+                break;
+
+        /* Some mandatory commands that we recognize but don't implement.
+         * They don't mean much in this setting.  It's left as an exercise
+         * for anyone interested to implement RESERVE and RELEASE in terms
+         * of Posix locks. */
+        case FORMAT_UNIT:
+        case RELEASE:
+        case RESERVE:
+        case SEND_DIAGNOSTIC:
+                // Fall through
+
+        default:
+ unknown_cmnd:
+                fsg->data_size_from_cmnd = 0;
+                sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]);
+                if ((reply = check_command(fsg, fsg->cmnd_size,
+                                DATA_DIR_UNKNOWN, 0xff, 0, unknown)) == 0) {
+                        fsg->curlun->sense_data = SS_INVALID_COMMAND;
+                        reply = -EINVAL;
+                }
+                break;
+        }
+        up_read(&fsg->filesem);
+
+        if (reply == -EINTR || signal_pending(current))
+                return -EINTR;
+
+        /* Set up the single reply buffer for finish_reply() */
+        if (reply == -EINVAL)
+                reply = 0;              // Error reply length
+        if (reply >= 0 && fsg->data_dir == DATA_DIR_TO_HOST) {
+                reply = min((u32) reply, fsg->data_size_from_cmnd);
+                bh->inreq->length = reply;
+                bh->state = BUF_STATE_FULL;
+                fsg->residue -= reply;
+        }                               // Otherwise it's already set
+
+        return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+        struct usb_request              *req = bh->outreq;
+        struct fsg_bulk_cb_wrap *cbw = req->buf;
+
+        /* Was this a real packet?  Should it be ignored? */
+        if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
+                return -EINVAL;
+
+        /* Is the CBW valid? */
+        if (req->actual != USB_BULK_CB_WRAP_LEN ||
+                        cbw->Signature != cpu_to_le32(
+                                USB_BULK_CB_SIG)) {
+                DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
+                                req->actual,
+                                le32_to_cpu(cbw->Signature));
+
+                /* The Bulk-only spec says we MUST stall the IN endpoint
+                 * (6.6.1), so it's unavoidable.  It also says we must
+                 * retain this state until the next reset, but there's
+                 * no way to tell the controller driver it should ignore
+                 * Clear-Feature(HALT) requests.
+                 *
+                 * We aren't required to halt the OUT endpoint; instead
+                 * we can simply accept and discard any data received
+                 * until the next reset. */
+                wedge_bulk_in_endpoint(fsg);
+                set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
+                return -EINVAL;
+        }
+
+        /* Is the CBW meaningful? */
+        if (cbw->Lun >= FSG_MAX_LUNS || cbw->Flags & ~USB_BULK_IN_FLAG ||
+                        cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) {
+                DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
+                                "cmdlen %u\n",
+                                cbw->Lun, cbw->Flags, cbw->Length);
+
+                /* We can do anything we want here, so let's stall the
+                 * bulk pipes if we are allowed to. */
+                if (mod_data.can_stall) {
+                        fsg_set_halt(fsg, fsg->bulk_out);
+                        halt_bulk_in_endpoint(fsg);
+                }
+                return -EINVAL;
+        }
+
+        /* Save the command for later */
+        fsg->cmnd_size = cbw->Length;
+        memcpy(fsg->cmnd, cbw->CDB, fsg->cmnd_size);
+        if (cbw->Flags & USB_BULK_IN_FLAG)
+                fsg->data_dir = DATA_DIR_TO_HOST;
+        else
+                fsg->data_dir = DATA_DIR_FROM_HOST;
+        fsg->data_size = le32_to_cpu(cbw->DataTransferLength);
+        if (fsg->data_size == 0)
+                fsg->data_dir = DATA_DIR_NONE;
+        fsg->lun = cbw->Lun;
+        fsg->tag = cbw->Tag;
+        return 0;
+}
+
+
+static int get_next_command(struct fsg_dev *fsg)
+{
+        struct fsg_buffhd       *bh;
+        int                     rc = 0;
+
+        if (transport_is_bbb()) {
+
+                /* Wait for the next buffer to become available */
+                bh = fsg->next_buffhd_to_fill;
+                while (bh->state != BUF_STATE_EMPTY) {
+                        rc = sleep_thread(fsg);
+                        if (rc)
+                                return rc;
+                }
+
+                /* Queue a request to read a Bulk-only CBW */
+                set_bulk_out_req_length(fsg, bh, USB_BULK_CB_WRAP_LEN);
+                bh->outreq->short_not_ok = 1;
+                start_transfer(fsg, fsg->bulk_out, bh->outreq,
+                                &bh->outreq_busy, &bh->state);
+
+                /* We will drain the buffer in software, which means we
+                 * can reuse it for the next filling.  No need to advance
+                 * next_buffhd_to_fill. */
+
+                /* Wait for the CBW to arrive */
+                while (bh->state != BUF_STATE_FULL) {
+                        rc = sleep_thread(fsg);
+                        if (rc)
+                                return rc;
+                }
+                smp_rmb();
+                rc = received_cbw(fsg, bh);
+                bh->state = BUF_STATE_EMPTY;
+
+        } else {                // USB_PR_CB or USB_PR_CBI
+
+                /* Wait for the next command to arrive */
+                while (fsg->cbbuf_cmnd_size == 0) {
+                        rc = sleep_thread(fsg);
+                        if (rc)
+                                return rc;
+                }
+
+                /* Is the previous status interrupt request still busy?
+                 * The host is allowed to skip reading the status,
+                 * so we must cancel it. */
+                if (fsg->intreq_busy)
+                        usb_ep_dequeue(fsg->intr_in, fsg->intreq);
+
+                /* Copy the command and mark the buffer empty */
+                fsg->data_dir = DATA_DIR_UNKNOWN;
+                spin_lock_irq(&fsg->lock);
+                fsg->cmnd_size = fsg->cbbuf_cmnd_size;
+                memcpy(fsg->cmnd, fsg->cbbuf_cmnd, fsg->cmnd_size);
+                fsg->cbbuf_cmnd_size = 0;
+                spin_unlock_irq(&fsg->lock);
+        }
+        return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int enable_endpoint(struct fsg_dev *fsg, struct usb_ep *ep,
+                const struct usb_endpoint_descriptor *d)
+{
+        int     rc;
+
+        ep->driver_data = fsg;
+        ep->desc = d;
+        rc = usb_ep_enable(ep);
+        if (rc)
+                ERROR(fsg, "can't enable %s, result %d\n", ep->name, rc);
+        return rc;
+}
+
+static int alloc_request(struct fsg_dev *fsg, struct usb_ep *ep,
+                struct usb_request **preq)
+{
+        *preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
+        if (*preq)
+                return 0;
+        ERROR(fsg, "can't allocate request for %s\n", ep->name);
+        return -ENOMEM;
+}
+
+/*
+ * Reset interface setting and re-init endpoint state (toggle etc).
+ * Call with altsetting < 0 to disable the interface.  The only other
+ * available altsetting is 0, which enables the interface.
+ */
+static int do_set_interface(struct fsg_dev *fsg, int altsetting)
+{
+        int     rc = 0;
+        int     i;
+        const struct usb_endpoint_descriptor    *d;
+
+        if (fsg->running)
+                DBG(fsg, "reset interface\n");
+
+reset:
+        /* Deallocate the requests */
+        for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+                struct fsg_buffhd *bh = &fsg->buffhds[i];
+
+                if (bh->inreq) {
+                        usb_ep_free_request(fsg->bulk_in, bh->inreq);
+                        bh->inreq = NULL;
+                }
+                if (bh->outreq) {
+                        usb_ep_free_request(fsg->bulk_out, bh->outreq);
+                        bh->outreq = NULL;
+                }
+        }
+        if (fsg->intreq) {
+                usb_ep_free_request(fsg->intr_in, fsg->intreq);
+                fsg->intreq = NULL;
+        }
+
+        /* Disable the endpoints */
+        if (fsg->bulk_in_enabled) {
+                usb_ep_disable(fsg->bulk_in);
+                fsg->bulk_in_enabled = 0;
+        }
+        if (fsg->bulk_out_enabled) {
+                usb_ep_disable(fsg->bulk_out);
+                fsg->bulk_out_enabled = 0;
+        }
+        if (fsg->intr_in_enabled) {
+                usb_ep_disable(fsg->intr_in);
+                fsg->intr_in_enabled = 0;
+        }
+
+        fsg->running = 0;
+        if (altsetting < 0 || rc != 0)
+                return rc;
+
+        DBG(fsg, "set interface %d\n", altsetting);
+
+        /* Enable the endpoints */
+        d = fsg_ep_desc(fsg->gadget,
+                        &fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc);
+        if ((rc = enable_endpoint(fsg, fsg->bulk_in, d)) != 0)
+                goto reset;
+        fsg->bulk_in_enabled = 1;
+
+        d = fsg_ep_desc(fsg->gadget,
+                        &fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc);
+        if ((rc = enable_endpoint(fsg, fsg->bulk_out, d)) != 0)
+                goto reset;
+        fsg->bulk_out_enabled = 1;
+        fsg->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
+        clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
+
+        if (transport_is_cbi()) {
+                d = fsg_ep_desc(fsg->gadget,
+                                &fsg_fs_intr_in_desc, &fsg_hs_intr_in_desc);
+                if ((rc = enable_endpoint(fsg, fsg->intr_in, d)) != 0)
+                        goto reset;
+                fsg->intr_in_enabled = 1;
+        }
+
+        /* Allocate the requests */
+        for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+                struct fsg_buffhd       *bh = &fsg->buffhds[i];
+
+                if ((rc = alloc_request(fsg, fsg->bulk_in, &bh->inreq)) != 0)
+                        goto reset;
+                if ((rc = alloc_request(fsg, fsg->bulk_out, &bh->outreq)) != 0)
+                        goto reset;
+                bh->inreq->buf = bh->outreq->buf = bh->buf;
+                bh->inreq->context = bh->outreq->context = bh;
+                bh->inreq->complete = bulk_in_complete;
+                bh->outreq->complete = bulk_out_complete;
+        }
+        if (transport_is_cbi()) {
+                if ((rc = alloc_request(fsg, fsg->intr_in, &fsg->intreq)) != 0)
+                        goto reset;
+                fsg->intreq->complete = intr_in_complete;
+        }
+
+        fsg->running = 1;
+        for (i = 0; i < fsg->nluns; ++i)
+                fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
+        return rc;
+}
+
+
+/*
+ * Change our operational configuration.  This code must agree with the code
+ * that returns config descriptors, and with interface altsetting code.
+ *
+ * It's also responsible for power management interactions.  Some
+ * configurations might not work with our current power sources.
+ * For now we just assume the gadget is always self-powered.
+ */
+static int do_set_config(struct fsg_dev *fsg, u8 new_config)
+{
+        int     rc = 0;
+
+        /* Disable the single interface */
+        if (fsg->config != 0) {
+                DBG(fsg, "reset config\n");
+                fsg->config = 0;
+                rc = do_set_interface(fsg, -1);
+        }
+
+        /* Enable the interface */
+        if (new_config != 0) {
+                fsg->config = new_config;
+                if ((rc = do_set_interface(fsg, 0)) != 0)
+                        fsg->config = 0;        // Reset on errors
+                else {
+                        char *speed;
+
+                        switch (fsg->gadget->speed) {
+                        case USB_SPEED_LOW:     speed = "low";  break;
+                        case USB_SPEED_FULL:    speed = "full"; break;
+                        case USB_SPEED_HIGH:    speed = "high"; break;
+                        default:                speed = "?";    break;
+                        }
+                        INFO(fsg, "%s speed config #%d\n", speed, fsg->config);
+                }
+        }
+        return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static void handle_exception(struct fsg_dev *fsg)
+{
+        siginfo_t               info;
+        int                     sig;
+        int                     i;
+        int                     num_active;
+        struct fsg_buffhd       *bh;
+        enum fsg_state          old_state;
+        u8                      new_config;
+        struct fsg_lun          *curlun;
+        unsigned int            exception_req_tag;
+        int                     rc;
+
+        /* Clear the existing signals.  Anything but SIGUSR1 is converted
+         * into a high-priority EXIT exception. */
+        for (;;) {
+                sig = dequeue_signal_lock(current, &current->blocked, &info);
+                if (!sig)
+                        break;
+                if (sig != SIGUSR1) {
+                        if (fsg->state < FSG_STATE_EXIT)
+                                DBG(fsg, "Main thread exiting on signal\n");
+                        raise_exception(fsg, FSG_STATE_EXIT);
+                }
+        }
+
+        /* Cancel all the pending transfers */
+        if (fsg->intreq_busy)
+                usb_ep_dequeue(fsg->intr_in, fsg->intreq);
+        for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+                bh = &fsg->buffhds[i];
+                if (bh->inreq_busy)
+                        usb_ep_dequeue(fsg->bulk_in, bh->inreq);
+                if (bh->outreq_busy)
+                        usb_ep_dequeue(fsg->bulk_out, bh->outreq);
+        }
+
+        /* Wait until everything is idle */
+        for (;;) {
+                num_active = fsg->intreq_busy;
+                for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+                        bh = &fsg->buffhds[i];
+                        num_active += bh->inreq_busy + bh->outreq_busy;
+                }
+                if (num_active == 0)
+                        break;
+                if (sleep_thread(fsg))
+                        return;
+        }
+
+        /* Clear out the controller's fifos */
+        if (fsg->bulk_in_enabled)
+                usb_ep_fifo_flush(fsg->bulk_in);
+        if (fsg->bulk_out_enabled)
+                usb_ep_fifo_flush(fsg->bulk_out);
+        if (fsg->intr_in_enabled)
+                usb_ep_fifo_flush(fsg->intr_in);
+
+        /* Reset the I/O buffer states and pointers, the SCSI
+         * state, and the exception.  Then invoke the handler. */
+        spin_lock_irq(&fsg->lock);
+
+        for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+                bh = &fsg->buffhds[i];
+                bh->state = BUF_STATE_EMPTY;
+        }
+        fsg->next_buffhd_to_fill = fsg->next_buffhd_to_drain =
+                        &fsg->buffhds[0];
+
+        exception_req_tag = fsg->exception_req_tag;
+        new_config = fsg->new_config;
+        old_state = fsg->state;
+
+        if (old_state == FSG_STATE_ABORT_BULK_OUT)
+                fsg->state = FSG_STATE_STATUS_PHASE;
+        else {
+                for (i = 0; i < fsg->nluns; ++i) {
+                        curlun = &fsg->luns[i];
+                        curlun->prevent_medium_removal = 0;
+                        curlun->sense_data = curlun->unit_attention_data =
+                                        SS_NO_SENSE;
+                        curlun->sense_data_info = 0;
+                        curlun->info_valid = 0;
+                }
+                fsg->state = FSG_STATE_IDLE;
+        }
+        spin_unlock_irq(&fsg->lock);
+
+        /* Carry out any extra actions required for the exception */
+        switch (old_state) {
+        default:
+                break;
+
+        case FSG_STATE_ABORT_BULK_OUT:
+                send_status(fsg);
+                spin_lock_irq(&fsg->lock);
+                if (fsg->state == FSG_STATE_STATUS_PHASE)
+                        fsg->state = FSG_STATE_IDLE;
+                spin_unlock_irq(&fsg->lock);
+                break;
+
+        case FSG_STATE_RESET:
+                /* In case we were forced against our will to halt a
+                 * bulk endpoint, clear the halt now.  (The SuperH UDC
+                 * requires this.) */
+                if (test_and_clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
+                        usb_ep_clear_halt(fsg->bulk_in);
+
+                if (transport_is_bbb()) {
+                        if (fsg->ep0_req_tag == exception_req_tag)
+                                ep0_queue(fsg); // Complete the status stage
+
+                } else if (transport_is_cbi())
+                        send_status(fsg);       // Status by interrupt pipe
+
+                /* Technically this should go here, but it would only be
+                 * a waste of time.  Ditto for the INTERFACE_CHANGE and
+                 * CONFIG_CHANGE cases. */
+                // for (i = 0; i < fsg->nluns; ++i)
+                //      fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
+                break;
+
+        case FSG_STATE_INTERFACE_CHANGE:
+                rc = do_set_interface(fsg, 0);
+                if (fsg->ep0_req_tag != exception_req_tag)
+                        break;
+                if (rc != 0)                    // STALL on errors
+                        fsg_set_halt(fsg, fsg->ep0);
+                else                            // Complete the status stage
+                        ep0_queue(fsg);
+                break;
+
+        case FSG_STATE_CONFIG_CHANGE:
+                rc = do_set_config(fsg, new_config);
+                if (fsg->ep0_req_tag != exception_req_tag)
+                        break;
+                if (rc != 0)                    // STALL on errors
+                        fsg_set_halt(fsg, fsg->ep0);
+                else                            // Complete the status stage
+                        ep0_queue(fsg);
+                break;
+
+        case FSG_STATE_DISCONNECT:
+                for (i = 0; i < fsg->nluns; ++i)
+                        fsg_lun_fsync_sub(fsg->luns + i);
+                do_set_config(fsg, 0);          // Unconfigured state
+                break;
+
+        case FSG_STATE_EXIT:
+        case FSG_STATE_TERMINATED:
+                do_set_config(fsg, 0);                  // Free resources
+                spin_lock_irq(&fsg->lock);
+                fsg->state = FSG_STATE_TERMINATED;      // Stop the thread
+                spin_unlock_irq(&fsg->lock);
+                break;
+        }
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int fsg_main_thread(void *fsg_)
+{
+        struct fsg_dev          *fsg = fsg_;
+
+        /* Allow the thread to be killed by a signal, but set the signal mask
+         * to block everything but INT, TERM, KILL, and USR1. */
+        allow_signal(SIGINT);
+        allow_signal(SIGTERM);
+        allow_signal(SIGKILL);
+        allow_signal(SIGUSR1);
+
+        /* Allow the thread to be frozen */
+        set_freezable();
+
+        /* Arrange for userspace references to be interpreted as kernel
+         * pointers.  That way we can pass a kernel pointer to a routine
+         * that expects a __user pointer and it will work okay. */
+        set_fs(get_ds());
+
+        /* The main loop */
+        while (fsg->state != FSG_STATE_TERMINATED) {
+                if (exception_in_progress(fsg) || signal_pending(current)) {
+                        handle_exception(fsg);
+                        continue;
+                }
+
+                if (!fsg->running) {
+                        sleep_thread(fsg);
+                        continue;
+                }
+
+                if (get_next_command(fsg))
+                        continue;
+
+                spin_lock_irq(&fsg->lock);
+                if (!exception_in_progress(fsg))
+                        fsg->state = FSG_STATE_DATA_PHASE;
+                spin_unlock_irq(&fsg->lock);
+
+                if (do_scsi_command(fsg) || finish_reply(fsg))
+                        continue;
+
+                spin_lock_irq(&fsg->lock);
+                if (!exception_in_progress(fsg))
+                        fsg->state = FSG_STATE_STATUS_PHASE;
+                spin_unlock_irq(&fsg->lock);
+
+                if (send_status(fsg))
+                        continue;
+
+                spin_lock_irq(&fsg->lock);
+                if (!exception_in_progress(fsg))
+                        fsg->state = FSG_STATE_IDLE;
+                spin_unlock_irq(&fsg->lock);
+                }
+
+        spin_lock_irq(&fsg->lock);
+        fsg->thread_task = NULL;
+        spin_unlock_irq(&fsg->lock);
+
+        /* If we are exiting because of a signal, unregister the
+         * gadget driver. */
+        if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
+                usb_gadget_unregister_driver(&fsg_driver);
+
+        /* Let the unbind and cleanup routines know the thread has exited */
+        complete_and_exit(&fsg->thread_notifier, 0);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+
+/* The write permissions and store_xxx pointers are set in fsg_bind() */
+static DEVICE_ATTR(ro, 0444, fsg_show_ro, NULL);
+static DEVICE_ATTR(nofua, 0644, fsg_show_nofua, NULL);
+static DEVICE_ATTR(file, 0444, fsg_show_file, NULL);
+
+
+/*-------------------------------------------------------------------------*/
+
+static void fsg_release(struct kref *ref)
+{
+        struct fsg_dev  *fsg = container_of(ref, struct fsg_dev, ref);
+
+        kfree(fsg->luns);
+        kfree(fsg);
+}
+
+static void lun_release(struct device *dev)
+{
+        struct rw_semaphore     *filesem = dev_get_drvdata(dev);
+        struct fsg_dev          *fsg =
+                container_of(filesem, struct fsg_dev, filesem);
+
+        kref_put(&fsg->ref, fsg_release);
+}
+
+static void /* __init_or_exit */ fsg_unbind(struct usb_gadget *gadget)
+{
+        struct fsg_dev          *fsg = get_gadget_data(gadget);
+        int                     i;
+        struct fsg_lun          *curlun;
+        struct usb_request      *req = fsg->ep0req;
+
+        DBG(fsg, "unbind\n");
+        clear_bit(REGISTERED, &fsg->atomic_bitflags);
+
+        /* Unregister the sysfs attribute files and the LUNs */
+        for (i = 0; i < fsg->nluns; ++i) {
+                curlun = &fsg->luns[i];
+                if (curlun->registered) {
+                        device_remove_file(&curlun->dev, &dev_attr_nofua);
+                        device_remove_file(&curlun->dev, &dev_attr_ro);
+                        device_remove_file(&curlun->dev, &dev_attr_file);
+                        fsg_lun_close(curlun);
+                        device_unregister(&curlun->dev);
+                        curlun->registered = 0;
+                }
+        }
+
+        /* If the thread isn't already dead, tell it to exit now */
+        if (fsg->state != FSG_STATE_TERMINATED) {
+                raise_exception(fsg, FSG_STATE_EXIT);
+                wait_for_completion(&fsg->thread_notifier);
+
+                /* The cleanup routine waits for this completion also */
+                complete(&fsg->thread_notifier);
+        }
+
+        /* Free the data buffers */
+        for (i = 0; i < FSG_NUM_BUFFERS; ++i)
+                kfree(fsg->buffhds[i].buf);
+
+        /* Free the request and buffer for endpoint 0 */
+        if (req) {
+                kfree(req->buf);
+                usb_ep_free_request(fsg->ep0, req);
+        }
+
+        set_gadget_data(gadget, NULL);
+}
+
+
+static int __init check_parameters(struct fsg_dev *fsg)
+{
+        int     prot;
+        int     gcnum;
+
+        /* Store the default values */
+        mod_data.transport_type = USB_PR_BULK;
+        mod_data.transport_name = "Bulk-only";
+        mod_data.protocol_type = USB_SC_SCSI;
+        mod_data.protocol_name = "Transparent SCSI";
+
+        /* Some peripheral controllers are known not to be able to
+         * halt bulk endpoints correctly.  If one of them is present,
+         * disable stalls.
+         */
+        if (gadget_is_at91(fsg->gadget))
+                mod_data.can_stall = 0;
+
+        if (mod_data.release == 0xffff) {       // Parameter wasn't set
+                gcnum = usb_gadget_controller_number(fsg->gadget);
+                if (gcnum >= 0)
+                        mod_data.release = 0x0300 + gcnum;
+                else {
+                        WARNING(fsg, "controller '%s' not recognized\n",
+                                fsg->gadget->name);
+                        mod_data.release = 0x0399;
+                }
+        }
+
+        prot = simple_strtol(mod_data.protocol_parm, NULL, 0);
+
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+        if (strnicmp(mod_data.transport_parm, "BBB", 10) == 0) {
+                ;               // Use default setting
+        } else if (strnicmp(mod_data.transport_parm, "CB", 10) == 0) {
+                mod_data.transport_type = USB_PR_CB;
+                mod_data.transport_name = "Control-Bulk";
+        } else if (strnicmp(mod_data.transport_parm, "CBI", 10) == 0) {
+                mod_data.transport_type = USB_PR_CBI;
+                mod_data.transport_name = "Control-Bulk-Interrupt";
+        } else {
+                ERROR(fsg, "invalid transport: %s\n", mod_data.transport_parm);
+                return -EINVAL;
+        }
+
+        if (strnicmp(mod_data.protocol_parm, "SCSI", 10) == 0 ||
+                        prot == USB_SC_SCSI) {
+                ;               // Use default setting
+        } else if (strnicmp(mod_data.protocol_parm, "RBC", 10) == 0 ||
+                        prot == USB_SC_RBC) {
+                mod_data.protocol_type = USB_SC_RBC;
+                mod_data.protocol_name = "RBC";
+        } else if (strnicmp(mod_data.protocol_parm, "8020", 4) == 0 ||
+                        strnicmp(mod_data.protocol_parm, "ATAPI", 10) == 0 ||
+                        prot == USB_SC_8020) {
+                mod_data.protocol_type = USB_SC_8020;
+                mod_data.protocol_name = "8020i (ATAPI)";
+        } else if (strnicmp(mod_data.protocol_parm, "QIC", 3) == 0 ||
+                        prot == USB_SC_QIC) {
+                mod_data.protocol_type = USB_SC_QIC;
+                mod_data.protocol_name = "QIC-157";
+        } else if (strnicmp(mod_data.protocol_parm, "UFI", 10) == 0 ||
+                        prot == USB_SC_UFI) {
+                mod_data.protocol_type = USB_SC_UFI;
+                mod_data.protocol_name = "UFI";
+        } else if (strnicmp(mod_data.protocol_parm, "8070", 4) == 0 ||
+                        prot == USB_SC_8070) {
+                mod_data.protocol_type = USB_SC_8070;
+                mod_data.protocol_name = "8070i";
+        } else {
+                ERROR(fsg, "invalid protocol: %s\n", mod_data.protocol_parm);
+                return -EINVAL;
+        }
+
+        mod_data.buflen &= PAGE_CACHE_MASK;
+        if (mod_data.buflen <= 0) {
+                ERROR(fsg, "invalid buflen\n");
+                return -ETOOSMALL;
+        }
+
+#endif /* CONFIG_USB_FILE_STORAGE_TEST */
+
+        /* Serial string handling.
+         * On a real device, the serial string would be loaded
+         * from permanent storage. */
+        if (mod_data.serial) {
+                const char *ch;
+                unsigned len = 0;
+
+                /* Sanity check :
+                 * The CB[I] specification limits the serial string to
+                 * 12 uppercase hexadecimal characters.
+                 * BBB need at least 12 uppercase hexadecimal characters,
+                 * with a maximum of 126. */
+                for (ch = mod_data.serial; *ch; ++ch) {
+                        ++len;
+                        if ((*ch < '0' || *ch > '9') &&
+                            (*ch < 'A' || *ch > 'F')) { /* not uppercase hex */
+                                WARNING(fsg,
+                                        "Invalid serial string character: %c\n",
+                                        *ch);
+                                goto no_serial;
+                        }
+                }
+                if (len > 126 ||
+                    (mod_data.transport_type == USB_PR_BULK && len < 12) ||
+                    (mod_data.transport_type != USB_PR_BULK && len > 12)) {
+                        WARNING(fsg, "Invalid serial string length!\n");
+                        goto no_serial;
+                }
+                fsg_strings[FSG_STRING_SERIAL - 1].s = mod_data.serial;
+        } else {
+                WARNING(fsg, "No serial-number string provided!\n");
+ no_serial:
+                device_desc.iSerialNumber = 0;
+        }
+
+        return 0;
+}
+
+
+static int __init fsg_bind(struct usb_gadget *gadget)
+{
+        struct fsg_dev          *fsg = the_fsg;
+        int                     rc;
+        int                     i;
+        struct fsg_lun          *curlun;
+        struct usb_ep           *ep;
+        struct usb_request      *req;
+        char                    *pathbuf, *p;
+
+        fsg->gadget = gadget;
+        set_gadget_data(gadget, fsg);
+        fsg->ep0 = gadget->ep0;
+        fsg->ep0->driver_data = fsg;
+
+        if ((rc = check_parameters(fsg)) != 0)
+                goto out;
+
+        if (mod_data.removable) {       // Enable the store_xxx attributes
+                dev_attr_file.attr.mode = 0644;
+                dev_attr_file.store = fsg_store_file;
+                if (!mod_data.cdrom) {
+                        dev_attr_ro.attr.mode = 0644;
+                        dev_attr_ro.store = fsg_store_ro;
+                }
+        }
+
+        /* Only for removable media? */
+        dev_attr_nofua.attr.mode = 0644;
+        dev_attr_nofua.store = fsg_store_nofua;
+
+        /* Find out how many LUNs there should be */
+        i = mod_data.nluns;
+        if (i == 0)
+                i = max(mod_data.num_filenames, 1u);
+        if (i > FSG_MAX_LUNS) {
+                ERROR(fsg, "invalid number of LUNs: %d\n", i);
+                rc = -EINVAL;
+                goto out;
+        }
+
+        /* Create the LUNs, open their backing files, and register the
+         * LUN devices in sysfs. */
+        fsg->luns = kzalloc(i * sizeof(struct fsg_lun), GFP_KERNEL);
+        if (!fsg->luns) {
+                rc = -ENOMEM;
+                goto out;
+        }
+        fsg->nluns = i;
+
+        for (i = 0; i < fsg->nluns; ++i) {
+                curlun = &fsg->luns[i];
+                curlun->cdrom = !!mod_data.cdrom;
+                curlun->ro = mod_data.cdrom || mod_data.ro[i];
+                curlun->initially_ro = curlun->ro;
+                curlun->removable = mod_data.removable;
+                curlun->nofua = mod_data.nofua[i];
+                curlun->dev.release = lun_release;
+                curlun->dev.parent = &gadget->dev;
+                curlun->dev.driver = &fsg_driver.driver;
+                dev_set_drvdata(&curlun->dev, &fsg->filesem);
+                dev_set_name(&curlun->dev,"%s-lun%d",
+                             dev_name(&gadget->dev), i);
+
+                kref_get(&fsg->ref);
+                rc = device_register(&curlun->dev);
+                if (rc) {
+                        INFO(fsg, "failed to register LUN%d: %d\n", i, rc);
+                        put_device(&curlun->dev);
+                        goto out;
+                }
+                curlun->registered = 1;
+
+                rc = device_create_file(&curlun->dev, &dev_attr_ro);
+                if (rc)
+                        goto out;
+                rc = device_create_file(&curlun->dev, &dev_attr_nofua);
+                if (rc)
+                        goto out;
+                rc = device_create_file(&curlun->dev, &dev_attr_file);
+                if (rc)
+                        goto out;
+
+                if (mod_data.file[i] && *mod_data.file[i]) {
+                        rc = fsg_lun_open(curlun, mod_data.file[i]);
+                        if (rc)
+                                goto out;
+                } else if (!mod_data.removable) {
+                        ERROR(fsg, "no file given for LUN%d\n", i);
+                        rc = -EINVAL;
+                        goto out;
+                }
+        }
+
+        /* Find all the endpoints we will use */
+        usb_ep_autoconfig_reset(gadget);
+        ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc);
+        if (!ep)
+                goto autoconf_fail;
+        ep->driver_data = fsg;          // claim the endpoint
+        fsg->bulk_in = ep;
+
+        ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc);
+        if (!ep)
+                goto autoconf_fail;
+        ep->driver_data = fsg;          // claim the endpoint
+        fsg->bulk_out = ep;
+
+        if (transport_is_cbi()) {
+                ep = usb_ep_autoconfig(gadget, &fsg_fs_intr_in_desc);
+                if (!ep)
+                        goto autoconf_fail;
+                ep->driver_data = fsg;          // claim the endpoint
+                fsg->intr_in = ep;
+        }
+
+        /* Fix up the descriptors */
+        device_desc.idVendor = cpu_to_le16(mod_data.vendor);
+        device_desc.idProduct = cpu_to_le16(mod_data.product);
+        device_desc.bcdDevice = cpu_to_le16(mod_data.release);
+
+        i = (transport_is_cbi() ? 3 : 2);       // Number of endpoints
+        fsg_intf_desc.bNumEndpoints = i;
+        fsg_intf_desc.bInterfaceSubClass = mod_data.protocol_type;
+        fsg_intf_desc.bInterfaceProtocol = mod_data.transport_type;
+        fsg_fs_function[i + FSG_FS_FUNCTION_PRE_EP_ENTRIES] = NULL;
+
+        if (gadget_is_dualspeed(gadget)) {
+                fsg_hs_function[i + FSG_HS_FUNCTION_PRE_EP_ENTRIES] = NULL;
+
+                /* Assume endpoint addresses are the same for both speeds */
+                fsg_hs_bulk_in_desc.bEndpointAddress =
+                        fsg_fs_bulk_in_desc.bEndpointAddress;
+                fsg_hs_bulk_out_desc.bEndpointAddress =
+                        fsg_fs_bulk_out_desc.bEndpointAddress;
+                fsg_hs_intr_in_desc.bEndpointAddress =
+                        fsg_fs_intr_in_desc.bEndpointAddress;
+        }
+
+        if (gadget_is_otg(gadget))
+                fsg_otg_desc.bmAttributes |= USB_OTG_HNP;
+
+        rc = -ENOMEM;
+
+        /* Allocate the request and buffer for endpoint 0 */
+        fsg->ep0req = req = usb_ep_alloc_request(fsg->ep0, GFP_KERNEL);
+        if (!req)
+                goto out;
+        req->buf = kmalloc(EP0_BUFSIZE, GFP_KERNEL);
+        if (!req->buf)
+                goto out;
+        req->complete = ep0_complete;
+
+        /* Allocate the data buffers */
+        for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+                struct fsg_buffhd       *bh = &fsg->buffhds[i];
+
+                /* Allocate for the bulk-in endpoint.  We assume that
+                 * the buffer will also work with the bulk-out (and
+                 * interrupt-in) endpoint. */
+                bh->buf = kmalloc(mod_data.buflen, GFP_KERNEL);
+                if (!bh->buf)
+                        goto out;
+                bh->next = bh + 1;
+        }
+        fsg->buffhds[FSG_NUM_BUFFERS - 1].next = &fsg->buffhds[0];
+
+        /* This should reflect the actual gadget power source */
+        usb_gadget_set_selfpowered(gadget);
+
+        snprintf(fsg_string_manufacturer, sizeof fsg_string_manufacturer,
+                        "%s %s with %s",
+                        init_utsname()->sysname, init_utsname()->release,
+                        gadget->name);
+
+        fsg->thread_task = kthread_create(fsg_main_thread, fsg,
+                        "file-storage-gadget");
+        if (IS_ERR(fsg->thread_task)) {
+                rc = PTR_ERR(fsg->thread_task);
+                goto out;
+        }
+
+        INFO(fsg, DRIVER_DESC ", version: " DRIVER_VERSION "\n");
+        INFO(fsg, "NOTE: This driver is deprecated.  "
+                        "Consider using g_mass_storage instead.\n");
+        INFO(fsg, "Number of LUNs=%d\n", fsg->nluns);
+
+        pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
+        for (i = 0; i < fsg->nluns; ++i) {
+                curlun = &fsg->luns[i];
+                if (fsg_lun_is_open(curlun)) {
+                        p = NULL;
+                        if (pathbuf) {
+                                p = d_path(&curlun->filp->f_path,
+                                           pathbuf, PATH_MAX);
+                                if (IS_ERR(p))
+                                        p = NULL;
+                        }
+                        LINFO(curlun, "ro=%d, nofua=%d, file: %s\n",
+                              curlun->ro, curlun->nofua, (p ? p : "(error)"));
+                }
+        }
+        kfree(pathbuf);
+
+        DBG(fsg, "transport=%s (x%02x)\n",
+                        mod_data.transport_name, mod_data.transport_type);
+        DBG(fsg, "protocol=%s (x%02x)\n",
+                        mod_data.protocol_name, mod_data.protocol_type);
+        DBG(fsg, "VendorID=x%04x, ProductID=x%04x, Release=x%04x\n",
+                        mod_data.vendor, mod_data.product, mod_data.release);
+        DBG(fsg, "removable=%d, stall=%d, cdrom=%d, buflen=%u\n",
+                        mod_data.removable, mod_data.can_stall,
+                        mod_data.cdrom, mod_data.buflen);
+        DBG(fsg, "I/O thread pid: %d\n", task_pid_nr(fsg->thread_task));
+
+        set_bit(REGISTERED, &fsg->atomic_bitflags);
+
+        /* Tell the thread to start working */
+        wake_up_process(fsg->thread_task);
+        return 0;
+
+autoconf_fail:
+        ERROR(fsg, "unable to autoconfigure all endpoints\n");
+        rc = -ENOTSUPP;
+
+out:
+        fsg->state = FSG_STATE_TERMINATED;      // The thread is dead
+        fsg_unbind(gadget);
+        complete(&fsg->thread_notifier);
+        return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static void fsg_suspend(struct usb_gadget *gadget)
+{
+        struct fsg_dev          *fsg = get_gadget_data(gadget);
+
+        DBG(fsg, "suspend\n");
+        set_bit(SUSPENDED, &fsg->atomic_bitflags);
+}
+
+static void fsg_resume(struct usb_gadget *gadget)
+{
+        struct fsg_dev          *fsg = get_gadget_data(gadget);
+
+        DBG(fsg, "resume\n");
+        clear_bit(SUSPENDED, &fsg->atomic_bitflags);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static struct usb_gadget_driver         fsg_driver = {
+#ifdef CONFIG_USB_GADGET_DUALSPEED
+        .speed          = USB_SPEED_HIGH,
+#else
+        .speed          = USB_SPEED_FULL,
+#endif
+        .function       = (char *) fsg_string_product,
+        .unbind         = fsg_unbind,
+        .disconnect     = fsg_disconnect,
+        .setup          = fsg_setup,
+        .suspend        = fsg_suspend,
+        .resume         = fsg_resume,
+
+        .driver         = {
+                .name           = DRIVER_NAME,
+                .owner          = THIS_MODULE,
+                // .release = ...
+                // .suspend = ...
+                // .resume = ...
+        },
+};
+
+
+static int __init fsg_alloc(void)
+{
+        struct fsg_dev          *fsg;
+
+        fsg = kzalloc(sizeof *fsg, GFP_KERNEL);
+        if (!fsg)
+                return -ENOMEM;
+        spin_lock_init(&fsg->lock);
+        init_rwsem(&fsg->filesem);
+        kref_init(&fsg->ref);
+        init_completion(&fsg->thread_notifier);
+
+        the_fsg = fsg;
+        return 0;
+}
+
+
+static int __init fsg_init(void)
+{
+        int             rc;
+        struct fsg_dev  *fsg;
+
+        if ((rc = fsg_alloc()) != 0)
+                return rc;
+        fsg = the_fsg;
+        if ((rc = usb_gadget_probe_driver(&fsg_driver, fsg_bind)) != 0)
+                kref_put(&fsg->ref, fsg_release);
+        return rc;
+}
+module_init(fsg_init);
+
+
+static void __exit fsg_cleanup(void)
+{
+        struct fsg_dev  *fsg = the_fsg;
+
+        /* Unregister the driver iff the thread hasn't already done so */
+        if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
+                usb_gadget_unregister_driver(&fsg_driver);
+
+        /* Wait for the thread to finish up */
+        wait_for_completion(&fsg->thread_notifier);
+
+        kref_put(&fsg->ref, fsg_release);
+}
+module_exit(fsg_cleanup);
diff --git a/drivers/usb/gadget/fsl_tegra_udc.c b/drivers/usb/gadget/fsl_tegra_udc.c
new file mode 100644
index 00000000000..b254258726f
--- /dev/null
+++ b/drivers/usb/gadget/fsl_tegra_udc.c
@@ -0,0 +1,155 @@
+/*
+ * Description:
+ * Helper functions to support the tegra USB controller
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#include <linux/fsl_devices.h>
+#include <linux/platform_device.h>
+#include <linux/err.h>
+#include <linux/io.h>
+#include <mach/usb_phy.h>
+
+static struct tegra_usb_phy *phy;
+static struct clk *udc_clk;
+static struct clk *emc_clk;
+static struct clk *sclk_clk;
+static void *udc_base;
+
+int fsl_udc_clk_init(struct platform_device *pdev)
+{
+        struct resource *res;
+        int err;
+        int instance;
+        struct fsl_usb2_platform_data *pdata = pdev->dev.platform_data;
+
+
+        udc_clk = clk_get(&pdev->dev, NULL);
+        if (IS_ERR(udc_clk)) {
+                dev_err(&pdev->dev, "Can't get udc clock\n");
+                return PTR_ERR(udc_clk);
+        }
+
+        clk_enable(udc_clk);
+
+        sclk_clk = clk_get(&pdev->dev, "sclk");
+        if (IS_ERR(sclk_clk)) {
+                dev_err(&pdev->dev, "Can't get sclk clock\n");
+                err = PTR_ERR(sclk_clk);
+                goto err_sclk;
+        }
+
+        clk_set_rate(sclk_clk, 80000000);
+        clk_enable(sclk_clk);
+
+        emc_clk = clk_get(&pdev->dev, "emc");
+        if (IS_ERR(emc_clk)) {
+                dev_err(&pdev->dev, "Can't get emc clock\n");
+                err = PTR_ERR(emc_clk);
+                goto err_emc;
+        }
+
+        clk_enable(emc_clk);
+#ifdef CONFIG_ARCH_TEGRA_2x_SOC
+        /* Set DDR busy hints to 150MHz. For Tegra 2x SOC, DDR rate is half of EMC rate */
+        clk_set_rate(emc_clk, 300000000);
+#else
+        /* Set DDR busy hints to 100MHz. For Tegra 3x SOC DDR rate equals to EMC rate */
+        clk_set_rate(emc_clk, 100000000);
+#endif
+
+        /* we have to remap the registers ourselves as fsl_udc does not
+         * export them for us.
+         */
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                err = -ENXIO;
+                goto err0;
+        }
+        udc_base = ioremap(res->start, resource_size(res));
+        if (!udc_base) {
+                err = -ENOMEM;
+                goto err0;
+        }
+
+        instance = pdev->id;
+        if (instance == -1)
+                instance = 0;
+
+        phy = tegra_usb_phy_open(instance, udc_base, pdata->phy_config,
+                                        TEGRA_USB_PHY_MODE_DEVICE, pdata->usb_phy_type);
+        if (IS_ERR(phy)) {
+                dev_err(&pdev->dev, "Can't open phy\n");
+                err = PTR_ERR(phy);
+                goto err1;
+        }
+        tegra_usb_phy_power_on(phy, true);
+
+        return 0;
+err1:
+        iounmap(udc_base);
+err0:
+        clk_disable(emc_clk);
+        clk_put(emc_clk);
+err_emc:
+        clk_disable(sclk_clk);
+        clk_put(sclk_clk);
+err_sclk:
+        clk_disable(udc_clk);
+        clk_put(udc_clk);
+        return err;
+}
+
+void fsl_udc_clk_finalize(struct platform_device *pdev)
+{
+}
+
+void fsl_udc_clk_release(void)
+{
+        tegra_usb_phy_close(phy);
+
+        iounmap(udc_base);
+
+        clk_disable(udc_clk);
+        clk_put(udc_clk);
+
+        clk_disable(sclk_clk);
+        clk_put(sclk_clk);
+
+        clk_disable(emc_clk);
+        clk_put(emc_clk);
+}
+
+void fsl_udc_clk_suspend(bool is_dpd)
+{
+        tegra_usb_phy_power_off(phy, is_dpd);
+        clk_disable(udc_clk);
+        clk_disable(sclk_clk);
+        clk_disable(emc_clk);
+}
+
+void fsl_udc_clk_resume(bool is_dpd)
+{
+        clk_enable(emc_clk);
+        clk_enable(sclk_clk);
+        clk_enable(udc_clk);
+        tegra_usb_phy_power_on(phy,  is_dpd);
+}
+
+void fsl_udc_clk_enable(void)
+{
+        clk_enable(udc_clk);
+}
+
+void fsl_udc_clk_disable(void)
+{
+        clk_disable(udc_clk);
+}
+
+bool fsl_udc_charger_detect(void)
+{
+        return tegra_usb_phy_charger_detect(phy);
+}
diff --git a/drivers/usb/gadget/langwell_udc.c b/drivers/usb/gadget/langwell_udc.c
new file mode 100644
index 00000000000..a06e2c27b43
--- /dev/null
+++ b/drivers/usb/gadget/langwell_udc.c
@@ -0,0 +1,3607 @@
+/*
+ * Intel Langwell USB Device Controller driver
+ * Copyright (C) 2008-2009, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+
+/* #undef       DEBUG */
+/* #undef       VERBOSE_DEBUG */
+
+#if defined(CONFIG_USB_LANGWELL_OTG)
+#define OTG_TRANSCEIVER
+#endif
+
+
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/dma-mapping.h>
+#include <linux/kernel.h>
+#include <linux/delay.h>
+#include <linux/ioport.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/timer.h>
+#include <linux/list.h>
+#include <linux/interrupt.h>
+#include <linux/moduleparam.h>
+#include <linux/device.h>
+#include <linux/usb/ch9.h>
+#include <linux/usb/gadget.h>
+#include <linux/usb/otg.h>
+#include <linux/pm.h>
+#include <linux/io.h>
+#include <linux/irq.h>
+#include <asm/system.h>
+#include <asm/unaligned.h>
+
+#include "langwell_udc.h"
+
+
+#define DRIVER_DESC             "Intel Langwell USB Device Controller driver"
+#define DRIVER_VERSION          "16 May 2009"
+
+static const char driver_name[] = "langwell_udc";
+static const char driver_desc[] = DRIVER_DESC;
+
+
+/* controller device global variable */
+static struct langwell_udc      *the_controller;
+
+/* for endpoint 0 operations */
+static const struct usb_endpoint_descriptor
+langwell_ep0_desc = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+        .bEndpointAddress =     0,
+        .bmAttributes =         USB_ENDPOINT_XFER_CONTROL,
+        .wMaxPacketSize =       EP0_MAX_PKT_SIZE,
+};
+
+
+/*-------------------------------------------------------------------------*/
+/* debugging */
+
+#ifdef  VERBOSE_DEBUG
+static inline void print_all_registers(struct langwell_udc *dev)
+{
+        int     i;
+
+        /* Capability Registers */
+        dev_dbg(&dev->pdev->dev,
+                "Capability Registers (offset: 0x%04x, length: 0x%08x)\n",
+                CAP_REG_OFFSET, (u32)sizeof(struct langwell_cap_regs));
+        dev_dbg(&dev->pdev->dev, "caplength=0x%02x\n",
+                        readb(&dev->cap_regs->caplength));
+        dev_dbg(&dev->pdev->dev, "hciversion=0x%04x\n",
+                        readw(&dev->cap_regs->hciversion));
+        dev_dbg(&dev->pdev->dev, "hcsparams=0x%08x\n",
+                        readl(&dev->cap_regs->hcsparams));
+        dev_dbg(&dev->pdev->dev, "hccparams=0x%08x\n",
+                        readl(&dev->cap_regs->hccparams));
+        dev_dbg(&dev->pdev->dev, "dciversion=0x%04x\n",
+                        readw(&dev->cap_regs->dciversion));
+        dev_dbg(&dev->pdev->dev, "dccparams=0x%08x\n",
+                        readl(&dev->cap_regs->dccparams));
+
+        /* Operational Registers */
+        dev_dbg(&dev->pdev->dev,
+                "Operational Registers (offset: 0x%04x, length: 0x%08x)\n",
+                OP_REG_OFFSET, (u32)sizeof(struct langwell_op_regs));
+        dev_dbg(&dev->pdev->dev, "extsts=0x%08x\n",
+                        readl(&dev->op_regs->extsts));
+        dev_dbg(&dev->pdev->dev, "extintr=0x%08x\n",
+                        readl(&dev->op_regs->extintr));
+        dev_dbg(&dev->pdev->dev, "usbcmd=0x%08x\n",
+                        readl(&dev->op_regs->usbcmd));
+        dev_dbg(&dev->pdev->dev, "usbsts=0x%08x\n",
+                        readl(&dev->op_regs->usbsts));
+        dev_dbg(&dev->pdev->dev, "usbintr=0x%08x\n",
+                        readl(&dev->op_regs->usbintr));
+        dev_dbg(&dev->pdev->dev, "frindex=0x%08x\n",
+                        readl(&dev->op_regs->frindex));
+        dev_dbg(&dev->pdev->dev, "ctrldssegment=0x%08x\n",
+                        readl(&dev->op_regs->ctrldssegment));
+        dev_dbg(&dev->pdev->dev, "deviceaddr=0x%08x\n",
+                        readl(&dev->op_regs->deviceaddr));
+        dev_dbg(&dev->pdev->dev, "endpointlistaddr=0x%08x\n",
+                        readl(&dev->op_regs->endpointlistaddr));
+        dev_dbg(&dev->pdev->dev, "ttctrl=0x%08x\n",
+                        readl(&dev->op_regs->ttctrl));
+        dev_dbg(&dev->pdev->dev, "burstsize=0x%08x\n",
+                        readl(&dev->op_regs->burstsize));
+        dev_dbg(&dev->pdev->dev, "txfilltuning=0x%08x\n",
+                        readl(&dev->op_regs->txfilltuning));
+        dev_dbg(&dev->pdev->dev, "txttfilltuning=0x%08x\n",
+                        readl(&dev->op_regs->txttfilltuning));
+        dev_dbg(&dev->pdev->dev, "ic_usb=0x%08x\n",
+                        readl(&dev->op_regs->ic_usb));
+        dev_dbg(&dev->pdev->dev, "ulpi_viewport=0x%08x\n",
+                        readl(&dev->op_regs->ulpi_viewport));
+        dev_dbg(&dev->pdev->dev, "configflag=0x%08x\n",
+                        readl(&dev->op_regs->configflag));
+        dev_dbg(&dev->pdev->dev, "portsc1=0x%08x\n",
+                        readl(&dev->op_regs->portsc1));
+        dev_dbg(&dev->pdev->dev, "devlc=0x%08x\n",
+                        readl(&dev->op_regs->devlc));
+        dev_dbg(&dev->pdev->dev, "otgsc=0x%08x\n",
+                        readl(&dev->op_regs->otgsc));
+        dev_dbg(&dev->pdev->dev, "usbmode=0x%08x\n",
+                        readl(&dev->op_regs->usbmode));
+        dev_dbg(&dev->pdev->dev, "endptnak=0x%08x\n",
+                        readl(&dev->op_regs->endptnak));
+        dev_dbg(&dev->pdev->dev, "endptnaken=0x%08x\n",
+                        readl(&dev->op_regs->endptnaken));
+        dev_dbg(&dev->pdev->dev, "endptsetupstat=0x%08x\n",
+                        readl(&dev->op_regs->endptsetupstat));
+        dev_dbg(&dev->pdev->dev, "endptprime=0x%08x\n",
+                        readl(&dev->op_regs->endptprime));
+        dev_dbg(&dev->pdev->dev, "endptflush=0x%08x\n",
+                        readl(&dev->op_regs->endptflush));
+        dev_dbg(&dev->pdev->dev, "endptstat=0x%08x\n",
+                        readl(&dev->op_regs->endptstat));
+        dev_dbg(&dev->pdev->dev, "endptcomplete=0x%08x\n",
+                        readl(&dev->op_regs->endptcomplete));
+
+        for (i = 0; i < dev->ep_max / 2; i++) {
+                dev_dbg(&dev->pdev->dev, "endptctrl[%d]=0x%08x\n",
+                                i, readl(&dev->op_regs->endptctrl[i]));
+        }
+}
+#else
+
+#define print_all_registers(dev)        do { } while (0)
+
+#endif /* VERBOSE_DEBUG */
+
+
+/*-------------------------------------------------------------------------*/
+
+#define is_in(ep)       (((ep)->ep_num == 0) ? ((ep)->dev->ep0_dir ==   \
+                        USB_DIR_IN) : (usb_endpoint_dir_in((ep)->desc)))
+
+#define DIR_STRING(ep)  (is_in(ep) ? "in" : "out")
+
+
+static char *type_string(const struct usb_endpoint_descriptor *desc)
+{
+        switch (usb_endpoint_type(desc)) {
+        case USB_ENDPOINT_XFER_BULK:
+                return "bulk";
+        case USB_ENDPOINT_XFER_ISOC:
+                return "iso";
+        case USB_ENDPOINT_XFER_INT:
+                return "int";
+        };
+
+        return "control";
+}
+
+
+/* configure endpoint control registers */
+static void ep_reset(struct langwell_ep *ep, unsigned char ep_num,
+                unsigned char is_in, unsigned char ep_type)
+{
+        struct langwell_udc     *dev;
+        u32                     endptctrl;
+
+        dev = ep->dev;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        endptctrl = readl(&dev->op_regs->endptctrl[ep_num]);
+        if (is_in) {    /* TX */
+                if (ep_num)
+                        endptctrl |= EPCTRL_TXR;
+                endptctrl |= EPCTRL_TXE;
+                endptctrl |= ep_type << EPCTRL_TXT_SHIFT;
+        } else {        /* RX */
+                if (ep_num)
+                        endptctrl |= EPCTRL_RXR;
+                endptctrl |= EPCTRL_RXE;
+                endptctrl |= ep_type << EPCTRL_RXT_SHIFT;
+        }
+
+        writel(endptctrl, &dev->op_regs->endptctrl[ep_num]);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* reset ep0 dQH and endptctrl */
+static void ep0_reset(struct langwell_udc *dev)
+{
+        struct langwell_ep      *ep;
+        int                     i;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* ep0 in and out */
+        for (i = 0; i < 2; i++) {
+                ep = &dev->ep[i];
+                ep->dev = dev;
+
+                /* ep0 dQH */
+                ep->dqh = &dev->ep_dqh[i];
+
+                /* configure ep0 endpoint capabilities in dQH */
+                ep->dqh->dqh_ios = 1;
+                ep->dqh->dqh_mpl = EP0_MAX_PKT_SIZE;
+
+                /* enable ep0-in HW zero length termination select */
+                if (is_in(ep))
+                        ep->dqh->dqh_zlt = 0;
+                ep->dqh->dqh_mult = 0;
+
+                ep->dqh->dtd_next = DTD_TERM;
+
+                /* configure ep0 control registers */
+                ep_reset(&dev->ep[0], 0, i, USB_ENDPOINT_XFER_CONTROL);
+        }
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* endpoints operations */
+
+/* configure endpoint, making it usable */
+static int langwell_ep_enable(struct usb_ep *_ep,
+                const struct usb_endpoint_descriptor *desc)
+{
+        struct langwell_udc     *dev;
+        struct langwell_ep      *ep;
+        u16                     max = 0;
+        unsigned long           flags;
+        int                     i, retval = 0;
+        unsigned char           zlt, ios = 0, mult = 0;
+
+        ep = container_of(_ep, struct langwell_ep, ep);
+        dev = ep->dev;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (!_ep || !desc || ep->desc
+                        || desc->bDescriptorType != USB_DT_ENDPOINT)
+                return -EINVAL;
+
+        if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
+                return -ESHUTDOWN;
+
+        max = le16_to_cpu(desc->wMaxPacketSize);
+
+        /*
+         * disable HW zero length termination select
+         * driver handles zero length packet through req->req.zero
+         */
+        zlt = 1;
+
+        /*
+         * sanity check type, direction, address, and then
+         * initialize the endpoint capabilities fields in dQH
+         */
+        switch (usb_endpoint_type(desc)) {
+        case USB_ENDPOINT_XFER_CONTROL:
+                ios = 1;
+                break;
+        case USB_ENDPOINT_XFER_BULK:
+                if ((dev->gadget.speed == USB_SPEED_HIGH
+                                        && max != 512)
+                                || (dev->gadget.speed == USB_SPEED_FULL
+                                        && max > 64)) {
+                        goto done;
+                }
+                break;
+        case USB_ENDPOINT_XFER_INT:
+                if (strstr(ep->ep.name, "-iso")) /* bulk is ok */
+                        goto done;
+
+                switch (dev->gadget.speed) {
+                case USB_SPEED_HIGH:
+                        if (max <= 1024)
+                                break;
+                case USB_SPEED_FULL:
+                        if (max <= 64)
+                                break;
+                default:
+                        if (max <= 8)
+                                break;
+                        goto done;
+                }
+                break;
+        case USB_ENDPOINT_XFER_ISOC:
+                if (strstr(ep->ep.name, "-bulk")
+                                || strstr(ep->ep.name, "-int"))
+                        goto done;
+
+                switch (dev->gadget.speed) {
+                case USB_SPEED_HIGH:
+                        if (max <= 1024)
+                                break;
+                case USB_SPEED_FULL:
+                        if (max <= 1023)
+                                break;
+                default:
+                        goto done;
+                }
+                /*
+                 * FIXME:
+                 * calculate transactions needed for high bandwidth iso
+                 */
+                mult = (unsigned char)(1 + ((max >> 11) & 0x03));
+                max = max & 0x8ff;      /* bit 0~10 */
+                /* 3 transactions at most */
+                if (mult > 3)
+                        goto done;
+                break;
+        default:
+                goto done;
+        }
+
+        spin_lock_irqsave(&dev->lock, flags);
+
+        ep->ep.maxpacket = max;
+        ep->desc = desc;
+        ep->stopped = 0;
+        ep->ep_num = usb_endpoint_num(desc);
+
+        /* ep_type */
+        ep->ep_type = usb_endpoint_type(desc);
+
+        /* configure endpoint control registers */
+        ep_reset(ep, ep->ep_num, is_in(ep), ep->ep_type);
+
+        /* configure endpoint capabilities in dQH */
+        i = ep->ep_num * 2 + is_in(ep);
+        ep->dqh = &dev->ep_dqh[i];
+        ep->dqh->dqh_ios = ios;
+        ep->dqh->dqh_mpl = cpu_to_le16(max);
+        ep->dqh->dqh_zlt = zlt;
+        ep->dqh->dqh_mult = mult;
+        ep->dqh->dtd_next = DTD_TERM;
+
+        dev_dbg(&dev->pdev->dev, "enabled %s (ep%d%s-%s), max %04x\n",
+                        _ep->name,
+                        ep->ep_num,
+                        DIR_STRING(ep),
+                        type_string(desc),
+                        max);
+
+        spin_unlock_irqrestore(&dev->lock, flags);
+done:
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return retval;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* retire a request */
+static void done(struct langwell_ep *ep, struct langwell_request *req,
+                int status)
+{
+        struct langwell_udc     *dev = ep->dev;
+        unsigned                stopped = ep->stopped;
+        struct langwell_dtd     *curr_dtd, *next_dtd;
+        int                     i;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* remove the req from ep->queue */
+        list_del_init(&req->queue);
+
+        if (req->req.status == -EINPROGRESS)
+                req->req.status = status;
+        else
+                status = req->req.status;
+
+        /* free dTD for the request */
+        next_dtd = req->head;
+        for (i = 0; i < req->dtd_count; i++) {
+                curr_dtd = next_dtd;
+                if (i != req->dtd_count - 1)
+                        next_dtd = curr_dtd->next_dtd_virt;
+                dma_pool_free(dev->dtd_pool, curr_dtd, curr_dtd->dtd_dma);
+        }
+
+        if (req->mapped) {
+                dma_unmap_single(&dev->pdev->dev,
+                        req->req.dma, req->req.length,
+                        is_in(ep) ? PCI_DMA_TODEVICE : PCI_DMA_FROMDEVICE);
+                req->req.dma = DMA_ADDR_INVALID;
+                req->mapped = 0;
+        } else
+                dma_sync_single_for_cpu(&dev->pdev->dev, req->req.dma,
+                                req->req.length,
+                                is_in(ep) ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+
+        if (status != -ESHUTDOWN)
+                dev_dbg(&dev->pdev->dev,
+                                "complete %s, req %p, stat %d, len %u/%u\n",
+                                ep->ep.name, &req->req, status,
+                                req->req.actual, req->req.length);
+
+        /* don't modify queue heads during completion callback */
+        ep->stopped = 1;
+
+        spin_unlock(&dev->lock);
+        /* complete routine from gadget driver */
+        if (req->req.complete)
+                req->req.complete(&ep->ep, &req->req);
+
+        spin_lock(&dev->lock);
+        ep->stopped = stopped;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+static void langwell_ep_fifo_flush(struct usb_ep *_ep);
+
+/* delete all endpoint requests, called with spinlock held */
+static void nuke(struct langwell_ep *ep, int status)
+{
+        /* called with spinlock held */
+        ep->stopped = 1;
+
+        /* endpoint fifo flush */
+        if (&ep->ep && ep->desc)
+                langwell_ep_fifo_flush(&ep->ep);
+
+        while (!list_empty(&ep->queue)) {
+                struct langwell_request *req = NULL;
+                req = list_entry(ep->queue.next, struct langwell_request,
+                                queue);
+                done(ep, req, status);
+        }
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* endpoint is no longer usable */
+static int langwell_ep_disable(struct usb_ep *_ep)
+{
+        struct langwell_ep      *ep;
+        unsigned long           flags;
+        struct langwell_udc     *dev;
+        int                     ep_num;
+        u32                     endptctrl;
+
+        ep = container_of(_ep, struct langwell_ep, ep);
+        dev = ep->dev;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (!_ep || !ep->desc)
+                return -EINVAL;
+
+        spin_lock_irqsave(&dev->lock, flags);
+
+        /* disable endpoint control register */
+        ep_num = ep->ep_num;
+        endptctrl = readl(&dev->op_regs->endptctrl[ep_num]);
+        if (is_in(ep))
+                endptctrl &= ~EPCTRL_TXE;
+        else
+                endptctrl &= ~EPCTRL_RXE;
+        writel(endptctrl, &dev->op_regs->endptctrl[ep_num]);
+
+        /* nuke all pending requests (does flush) */
+        nuke(ep, -ESHUTDOWN);
+
+        ep->desc = NULL;
+        ep->stopped = 1;
+
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        dev_dbg(&dev->pdev->dev, "disabled %s\n", _ep->name);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+
+        return 0;
+}
+
+
+/* allocate a request object to use with this endpoint */
+static struct usb_request *langwell_alloc_request(struct usb_ep *_ep,
+                gfp_t gfp_flags)
+{
+        struct langwell_ep      *ep;
+        struct langwell_udc     *dev;
+        struct langwell_request *req = NULL;
+
+        if (!_ep)
+                return NULL;
+
+        ep = container_of(_ep, struct langwell_ep, ep);
+        dev = ep->dev;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        req = kzalloc(sizeof(*req), gfp_flags);
+        if (!req)
+                return NULL;
+
+        req->req.dma = DMA_ADDR_INVALID;
+        INIT_LIST_HEAD(&req->queue);
+
+        dev_vdbg(&dev->pdev->dev, "alloc request for %s\n", _ep->name);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return &req->req;
+}
+
+
+/* free a request object */
+static void langwell_free_request(struct usb_ep *_ep,
+                struct usb_request *_req)
+{
+        struct langwell_ep      *ep;
+        struct langwell_udc     *dev;
+        struct langwell_request *req = NULL;
+
+        ep = container_of(_ep, struct langwell_ep, ep);
+        dev = ep->dev;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (!_ep || !_req)
+                return;
+
+        req = container_of(_req, struct langwell_request, req);
+        WARN_ON(!list_empty(&req->queue));
+
+        if (_req)
+                kfree(req);
+
+        dev_vdbg(&dev->pdev->dev, "free request for %s\n", _ep->name);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* queue dTD and PRIME endpoint */
+static int queue_dtd(struct langwell_ep *ep, struct langwell_request *req)
+{
+        u32                     bit_mask, usbcmd, endptstat, dtd_dma;
+        u8                      dtd_status;
+        int                     i;
+        struct langwell_dqh     *dqh;
+        struct langwell_udc     *dev;
+
+        dev = ep->dev;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        i = ep->ep_num * 2 + is_in(ep);
+        dqh = &dev->ep_dqh[i];
+
+        if (ep->ep_num)
+                dev_vdbg(&dev->pdev->dev, "%s\n", ep->name);
+        else
+                /* ep0 */
+                dev_vdbg(&dev->pdev->dev, "%s-%s\n", ep->name, DIR_STRING(ep));
+
+        dev_vdbg(&dev->pdev->dev, "ep_dqh[%d] addr: 0x%p\n",
+                        i, &(dev->ep_dqh[i]));
+
+        bit_mask = is_in(ep) ?
+                (1 << (ep->ep_num + 16)) : (1 << (ep->ep_num));
+
+        dev_vdbg(&dev->pdev->dev, "bit_mask = 0x%08x\n", bit_mask);
+
+        /* check if the pipe is empty */
+        if (!(list_empty(&ep->queue))) {
+                /* add dTD to the end of linked list */
+                struct langwell_request *lastreq;
+                lastreq = list_entry(ep->queue.prev,
+                                struct langwell_request, queue);
+
+                lastreq->tail->dtd_next =
+                        cpu_to_le32(req->head->dtd_dma & DTD_NEXT_MASK);
+
+                /* read prime bit, if 1 goto out */
+                if (readl(&dev->op_regs->endptprime) & bit_mask)
+                        goto out;
+
+                do {
+                        /* set ATDTW bit in USBCMD */
+                        usbcmd = readl(&dev->op_regs->usbcmd);
+                        writel(usbcmd | CMD_ATDTW, &dev->op_regs->usbcmd);
+
+                        /* read correct status bit */
+                        endptstat = readl(&dev->op_regs->endptstat) & bit_mask;
+
+                } while (!(readl(&dev->op_regs->usbcmd) & CMD_ATDTW));
+
+                /* write ATDTW bit to 0 */
+                usbcmd = readl(&dev->op_regs->usbcmd);
+                writel(usbcmd & ~CMD_ATDTW, &dev->op_regs->usbcmd);
+
+                if (endptstat)
+                        goto out;
+        }
+
+        /* write dQH next pointer and terminate bit to 0 */
+        dtd_dma = req->head->dtd_dma & DTD_NEXT_MASK;
+        dqh->dtd_next = cpu_to_le32(dtd_dma);
+
+        /* clear active and halt bit */
+        dtd_status = (u8) ~(DTD_STS_ACTIVE | DTD_STS_HALTED);
+        dqh->dtd_status &= dtd_status;
+        dev_vdbg(&dev->pdev->dev, "dqh->dtd_status = 0x%x\n", dqh->dtd_status);
+
+        /* ensure that updates to the dQH will occur before priming */
+        wmb();
+
+        /* write 1 to endptprime register to PRIME endpoint */
+        bit_mask = is_in(ep) ? (1 << (ep->ep_num + 16)) : (1 << ep->ep_num);
+        dev_vdbg(&dev->pdev->dev, "endprime bit_mask = 0x%08x\n", bit_mask);
+        writel(bit_mask, &dev->op_regs->endptprime);
+out:
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+
+/* fill in the dTD structure to build a transfer descriptor */
+static struct langwell_dtd *build_dtd(struct langwell_request *req,
+                unsigned *length, dma_addr_t *dma, int *is_last)
+{
+        u32                      buf_ptr;
+        struct langwell_dtd     *dtd;
+        struct langwell_udc     *dev;
+        int                     i;
+
+        dev = req->ep->dev;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* the maximum transfer length, up to 16k bytes */
+        *length = min(req->req.length - req->req.actual,
+                        (unsigned)DTD_MAX_TRANSFER_LENGTH);
+
+        /* create dTD dma_pool resource */
+        dtd = dma_pool_alloc(dev->dtd_pool, GFP_KERNEL, dma);
+        if (dtd == NULL)
+                return dtd;
+        dtd->dtd_dma = *dma;
+
+        /* initialize buffer page pointers */
+        buf_ptr = (u32)(req->req.dma + req->req.actual);
+        for (i = 0; i < 5; i++)
+                dtd->dtd_buf[i] = cpu_to_le32(buf_ptr + i * PAGE_SIZE);
+
+        req->req.actual += *length;
+
+        /* fill in total bytes with transfer size */
+        dtd->dtd_total = cpu_to_le16(*length);
+        dev_vdbg(&dev->pdev->dev, "dtd->dtd_total = %d\n", dtd->dtd_total);
+
+        /* set is_last flag if req->req.zero is set or not */
+        if (req->req.zero) {
+                if (*length == 0 || (*length % req->ep->ep.maxpacket) != 0)
+                        *is_last = 1;
+                else
+                        *is_last = 0;
+        } else if (req->req.length == req->req.actual) {
+                *is_last = 1;
+        } else
+                *is_last = 0;
+
+        if (*is_last == 0)
+                dev_vdbg(&dev->pdev->dev, "multi-dtd request!\n");
+
+        /* set interrupt on complete bit for the last dTD */
+        if (*is_last && !req->req.no_interrupt)
+                dtd->dtd_ioc = 1;
+
+        /* set multiplier override 0 for non-ISO and non-TX endpoint */
+        dtd->dtd_multo = 0;
+
+        /* set the active bit of status field to 1 */
+        dtd->dtd_status = DTD_STS_ACTIVE;
+        dev_vdbg(&dev->pdev->dev, "dtd->dtd_status = 0x%02x\n",
+                        dtd->dtd_status);
+
+        dev_vdbg(&dev->pdev->dev, "length = %d, dma addr= 0x%08x\n",
+                        *length, (int)*dma);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return dtd;
+}
+
+
+/* generate dTD linked list for a request */
+static int req_to_dtd(struct langwell_request *req)
+{
+        unsigned                count;
+        int                     is_last, is_first = 1;
+        struct langwell_dtd     *dtd, *last_dtd = NULL;
+        struct langwell_udc     *dev;
+        dma_addr_t              dma;
+
+        dev = req->ep->dev;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+        do {
+                dtd = build_dtd(req, &count, &dma, &is_last);
+                if (dtd == NULL)
+                        return -ENOMEM;
+
+                if (is_first) {
+                        is_first = 0;
+                        req->head = dtd;
+                } else {
+                        last_dtd->dtd_next = cpu_to_le32(dma);
+                        last_dtd->next_dtd_virt = dtd;
+                }
+                last_dtd = dtd;
+                req->dtd_count++;
+        } while (!is_last);
+
+        /* set terminate bit to 1 for the last dTD */
+        dtd->dtd_next = DTD_TERM;
+
+        req->tail = dtd;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* queue (submits) an I/O requests to an endpoint */
+static int langwell_ep_queue(struct usb_ep *_ep, struct usb_request *_req,
+                gfp_t gfp_flags)
+{
+        struct langwell_request *req;
+        struct langwell_ep      *ep;
+        struct langwell_udc     *dev;
+        unsigned long           flags;
+        int                     is_iso = 0, zlflag = 0;
+
+        /* always require a cpu-view buffer */
+        req = container_of(_req, struct langwell_request, req);
+        ep = container_of(_ep, struct langwell_ep, ep);
+
+        if (!_req || !_req->complete || !_req->buf
+                        || !list_empty(&req->queue)) {
+                return -EINVAL;
+        }
+
+        if (unlikely(!_ep || !ep->desc))
+                return -EINVAL;
+
+        dev = ep->dev;
+        req->ep = ep;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (usb_endpoint_xfer_isoc(ep->desc)) {
+                if (req->req.length > ep->ep.maxpacket)
+                        return -EMSGSIZE;
+                is_iso = 1;
+        }
+
+        if (unlikely(!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN))
+                return -ESHUTDOWN;
+
+        /* set up dma mapping in case the caller didn't */
+        if (_req->dma == DMA_ADDR_INVALID) {
+                /* WORKAROUND: WARN_ON(size == 0) */
+                if (_req->length == 0) {
+                        dev_vdbg(&dev->pdev->dev, "req->length: 0->1\n");
+                        zlflag = 1;
+                        _req->length++;
+                }
+
+                _req->dma = dma_map_single(&dev->pdev->dev,
+                                _req->buf, _req->length,
+                                is_in(ep) ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+                if (zlflag && (_req->length == 1)) {
+                        dev_vdbg(&dev->pdev->dev, "req->length: 1->0\n");
+                        zlflag = 0;
+                        _req->length = 0;
+                }
+
+                req->mapped = 1;
+                dev_vdbg(&dev->pdev->dev, "req->mapped = 1\n");
+        } else {
+                dma_sync_single_for_device(&dev->pdev->dev,
+                                _req->dma, _req->length,
+                                is_in(ep) ?  DMA_TO_DEVICE : DMA_FROM_DEVICE);
+                req->mapped = 0;
+                dev_vdbg(&dev->pdev->dev, "req->mapped = 0\n");
+        }
+
+        dev_dbg(&dev->pdev->dev,
+                        "%s queue req %p, len %u, buf %p, dma 0x%08x\n",
+                        _ep->name,
+                        _req, _req->length, _req->buf, (int)_req->dma);
+
+        _req->status = -EINPROGRESS;
+        _req->actual = 0;
+        req->dtd_count = 0;
+
+        spin_lock_irqsave(&dev->lock, flags);
+
+        /* build and put dTDs to endpoint queue */
+        if (!req_to_dtd(req)) {
+                queue_dtd(ep, req);
+        } else {
+                spin_unlock_irqrestore(&dev->lock, flags);
+                return -ENOMEM;
+        }
+
+        /* update ep0 state */
+        if (ep->ep_num == 0)
+                dev->ep0_state = DATA_STATE_XMIT;
+
+        if (likely(req != NULL)) {
+                list_add_tail(&req->queue, &ep->queue);
+                dev_vdbg(&dev->pdev->dev, "list_add_tail()\n");
+        }
+
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+
+/* dequeue (cancels, unlinks) an I/O request from an endpoint */
+static int langwell_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
+{
+        struct langwell_ep      *ep;
+        struct langwell_udc     *dev;
+        struct langwell_request *req;
+        unsigned long           flags;
+        int                     stopped, ep_num, retval = 0;
+        u32                     endptctrl;
+
+        ep = container_of(_ep, struct langwell_ep, ep);
+        dev = ep->dev;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (!_ep || !ep->desc || !_req)
+                return -EINVAL;
+
+        if (!dev->driver)
+                return -ESHUTDOWN;
+
+        spin_lock_irqsave(&dev->lock, flags);
+        stopped = ep->stopped;
+
+        /* quiesce dma while we patch the queue */
+        ep->stopped = 1;
+        ep_num = ep->ep_num;
+
+        /* disable endpoint control register */
+        endptctrl = readl(&dev->op_regs->endptctrl[ep_num]);
+        if (is_in(ep))
+                endptctrl &= ~EPCTRL_TXE;
+        else
+                endptctrl &= ~EPCTRL_RXE;
+        writel(endptctrl, &dev->op_regs->endptctrl[ep_num]);
+
+        /* make sure it's still queued on this endpoint */
+        list_for_each_entry(req, &ep->queue, queue) {
+                if (&req->req == _req)
+                        break;
+        }
+
+        if (&req->req != _req) {
+                retval = -EINVAL;
+                goto done;
+        }
+
+        /* queue head may be partially complete. */
+        if (ep->queue.next == &req->queue) {
+                dev_dbg(&dev->pdev->dev, "unlink (%s) dma\n", _ep->name);
+                _req->status = -ECONNRESET;
+                langwell_ep_fifo_flush(&ep->ep);
+
+                /* not the last request in endpoint queue */
+                if (likely(ep->queue.next == &req->queue)) {
+                        struct langwell_dqh     *dqh;
+                        struct langwell_request *next_req;
+
+                        dqh = ep->dqh;
+                        next_req = list_entry(req->queue.next,
+                                        struct langwell_request, queue);
+
+                        /* point the dQH to the first dTD of next request */
+                        writel((u32) next_req->head, &dqh->dqh_current);
+                }
+        } else {
+                struct langwell_request *prev_req;
+
+                prev_req = list_entry(req->queue.prev,
+                                struct langwell_request, queue);
+                writel(readl(&req->tail->dtd_next),
+                                &prev_req->tail->dtd_next);
+        }
+
+        done(ep, req, -ECONNRESET);
+
+done:
+        /* enable endpoint again */
+        endptctrl = readl(&dev->op_regs->endptctrl[ep_num]);
+        if (is_in(ep))
+                endptctrl |= EPCTRL_TXE;
+        else
+                endptctrl |= EPCTRL_RXE;
+        writel(endptctrl, &dev->op_regs->endptctrl[ep_num]);
+
+        ep->stopped = stopped;
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return retval;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* endpoint set/clear halt */
+static void ep_set_halt(struct langwell_ep *ep, int value)
+{
+        u32                     endptctrl = 0;
+        int                     ep_num;
+        struct langwell_udc     *dev = ep->dev;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        ep_num = ep->ep_num;
+        endptctrl = readl(&dev->op_regs->endptctrl[ep_num]);
+
+        /* value: 1 - set halt, 0 - clear halt */
+        if (value) {
+                /* set the stall bit */
+                if (is_in(ep))
+                        endptctrl |= EPCTRL_TXS;
+                else
+                        endptctrl |= EPCTRL_RXS;
+        } else {
+                /* clear the stall bit and reset data toggle */
+                if (is_in(ep)) {
+                        endptctrl &= ~EPCTRL_TXS;
+                        endptctrl |= EPCTRL_TXR;
+                } else {
+                        endptctrl &= ~EPCTRL_RXS;
+                        endptctrl |= EPCTRL_RXR;
+                }
+        }
+
+        writel(endptctrl, &dev->op_regs->endptctrl[ep_num]);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* set the endpoint halt feature */
+static int langwell_ep_set_halt(struct usb_ep *_ep, int value)
+{
+        struct langwell_ep      *ep;
+        struct langwell_udc     *dev;
+        unsigned long           flags;
+        int                     retval = 0;
+
+        ep = container_of(_ep, struct langwell_ep, ep);
+        dev = ep->dev;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (!_ep || !ep->desc)
+                return -EINVAL;
+
+        if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
+                return -ESHUTDOWN;
+
+        if (usb_endpoint_xfer_isoc(ep->desc))
+                return  -EOPNOTSUPP;
+
+        spin_lock_irqsave(&dev->lock, flags);
+
+        /*
+         * attempt to halt IN ep will fail if any transfer requests
+         * are still queue
+         */
+        if (!list_empty(&ep->queue) && is_in(ep) && value) {
+                /* IN endpoint FIFO holds bytes */
+                dev_dbg(&dev->pdev->dev, "%s FIFO holds bytes\n", _ep->name);
+                retval = -EAGAIN;
+                goto done;
+        }
+
+        /* endpoint set/clear halt */
+        if (ep->ep_num) {
+                ep_set_halt(ep, value);
+        } else { /* endpoint 0 */
+                dev->ep0_state = WAIT_FOR_SETUP;
+                dev->ep0_dir = USB_DIR_OUT;
+        }
+done:
+        spin_unlock_irqrestore(&dev->lock, flags);
+        dev_dbg(&dev->pdev->dev, "%s %s halt\n",
+                        _ep->name, value ? "set" : "clear");
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return retval;
+}
+
+
+/* set the halt feature and ignores clear requests */
+static int langwell_ep_set_wedge(struct usb_ep *_ep)
+{
+        struct langwell_ep      *ep;
+        struct langwell_udc     *dev;
+
+        ep = container_of(_ep, struct langwell_ep, ep);
+        dev = ep->dev;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (!_ep || !ep->desc)
+                return -EINVAL;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return usb_ep_set_halt(_ep);
+}
+
+
+/* flush contents of a fifo */
+static void langwell_ep_fifo_flush(struct usb_ep *_ep)
+{
+        struct langwell_ep      *ep;
+        struct langwell_udc     *dev;
+        u32                     flush_bit;
+        unsigned long           timeout;
+
+        ep = container_of(_ep, struct langwell_ep, ep);
+        dev = ep->dev;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (!_ep || !ep->desc) {
+                dev_vdbg(&dev->pdev->dev, "ep or ep->desc is NULL\n");
+                dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+                return;
+        }
+
+        dev_vdbg(&dev->pdev->dev, "%s-%s fifo flush\n",
+                        _ep->name, DIR_STRING(ep));
+
+        /* flush endpoint buffer */
+        if (ep->ep_num == 0)
+                flush_bit = (1 << 16) | 1;
+        else if (is_in(ep))
+                flush_bit = 1 << (ep->ep_num + 16);     /* TX */
+        else
+                flush_bit = 1 << ep->ep_num;            /* RX */
+
+        /* wait until flush complete */
+        timeout = jiffies + FLUSH_TIMEOUT;
+        do {
+                writel(flush_bit, &dev->op_regs->endptflush);
+                while (readl(&dev->op_regs->endptflush)) {
+                        if (time_after(jiffies, timeout)) {
+                                dev_err(&dev->pdev->dev, "ep flush timeout\n");
+                                goto done;
+                        }
+                        cpu_relax();
+                }
+        } while (readl(&dev->op_regs->endptstat) & flush_bit);
+done:
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* endpoints operations structure */
+static const struct usb_ep_ops langwell_ep_ops = {
+
+        /* configure endpoint, making it usable */
+        .enable         = langwell_ep_enable,
+
+        /* endpoint is no longer usable */
+        .disable        = langwell_ep_disable,
+
+        /* allocate a request object to use with this endpoint */
+        .alloc_request  = langwell_alloc_request,
+
+        /* free a request object */
+        .free_request   = langwell_free_request,
+
+        /* queue (submits) an I/O requests to an endpoint */
+        .queue          = langwell_ep_queue,
+
+        /* dequeue (cancels, unlinks) an I/O request from an endpoint */
+        .dequeue        = langwell_ep_dequeue,
+
+        /* set the endpoint halt feature */
+        .set_halt       = langwell_ep_set_halt,
+
+        /* set the halt feature and ignores clear requests */
+        .set_wedge      = langwell_ep_set_wedge,
+
+        /* flush contents of a fifo */
+        .fifo_flush     = langwell_ep_fifo_flush,
+};
+
+
+/*-------------------------------------------------------------------------*/
+
+/* device controller usb_gadget_ops structure */
+
+/* returns the current frame number */
+static int langwell_get_frame(struct usb_gadget *_gadget)
+{
+        struct langwell_udc     *dev;
+        u16                     retval;
+
+        if (!_gadget)
+                return -ENODEV;
+
+        dev = container_of(_gadget, struct langwell_udc, gadget);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        retval = readl(&dev->op_regs->frindex) & FRINDEX_MASK;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return retval;
+}
+
+
+/* enter or exit PHY low power state */
+static void langwell_phy_low_power(struct langwell_udc *dev, bool flag)
+{
+        u32             devlc;
+        u8              devlc_byte2;
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        devlc = readl(&dev->op_regs->devlc);
+        dev_vdbg(&dev->pdev->dev, "devlc = 0x%08x\n", devlc);
+
+        if (flag)
+                devlc |= LPM_PHCD;
+        else
+                devlc &= ~LPM_PHCD;
+
+        /* FIXME: workaround for Langwell A1/A2/A3 sighting */
+        devlc_byte2 = (devlc >> 16) & 0xff;
+        writeb(devlc_byte2, (u8 *)&dev->op_regs->devlc + 2);
+
+        devlc = readl(&dev->op_regs->devlc);
+        dev_vdbg(&dev->pdev->dev,
+                        "%s PHY low power suspend, devlc = 0x%08x\n",
+                        flag ? "enter" : "exit", devlc);
+}
+
+
+/* tries to wake up the host connected to this gadget */
+static int langwell_wakeup(struct usb_gadget *_gadget)
+{
+        struct langwell_udc     *dev;
+        u32                     portsc1;
+        unsigned long           flags;
+
+        if (!_gadget)
+                return 0;
+
+        dev = container_of(_gadget, struct langwell_udc, gadget);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* remote wakeup feature not enabled by host */
+        if (!dev->remote_wakeup) {
+                dev_info(&dev->pdev->dev, "remote wakeup is disabled\n");
+                return -ENOTSUPP;
+        }
+
+        spin_lock_irqsave(&dev->lock, flags);
+
+        portsc1 = readl(&dev->op_regs->portsc1);
+        if (!(portsc1 & PORTS_SUSP)) {
+                spin_unlock_irqrestore(&dev->lock, flags);
+                return 0;
+        }
+
+        /* LPM L1 to L0 or legacy remote wakeup */
+        if (dev->lpm && dev->lpm_state == LPM_L1)
+                dev_info(&dev->pdev->dev, "LPM L1 to L0 remote wakeup\n");
+        else
+                dev_info(&dev->pdev->dev, "device remote wakeup\n");
+
+        /* exit PHY low power suspend */
+        if (dev->pdev->device != 0x0829)
+                langwell_phy_low_power(dev, 0);
+
+        /* force port resume */
+        portsc1 |= PORTS_FPR;
+        writel(portsc1, &dev->op_regs->portsc1);
+
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+
+/* notify controller that VBUS is powered or not */
+static int langwell_vbus_session(struct usb_gadget *_gadget, int is_active)
+{
+        struct langwell_udc     *dev;
+        unsigned long           flags;
+        u32                     usbcmd;
+
+        if (!_gadget)
+                return -ENODEV;
+
+        dev = container_of(_gadget, struct langwell_udc, gadget);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        spin_lock_irqsave(&dev->lock, flags);
+        dev_vdbg(&dev->pdev->dev, "VBUS status: %s\n",
+                        is_active ? "on" : "off");
+
+        dev->vbus_active = (is_active != 0);
+        if (dev->driver && dev->softconnected && dev->vbus_active) {
+                usbcmd = readl(&dev->op_regs->usbcmd);
+                usbcmd |= CMD_RUNSTOP;
+                writel(usbcmd, &dev->op_regs->usbcmd);
+        } else {
+                usbcmd = readl(&dev->op_regs->usbcmd);
+                usbcmd &= ~CMD_RUNSTOP;
+                writel(usbcmd, &dev->op_regs->usbcmd);
+        }
+
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+
+/* constrain controller's VBUS power usage */
+static int langwell_vbus_draw(struct usb_gadget *_gadget, unsigned mA)
+{
+        struct langwell_udc     *dev;
+
+        if (!_gadget)
+                return -ENODEV;
+
+        dev = container_of(_gadget, struct langwell_udc, gadget);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (dev->transceiver) {
+                dev_vdbg(&dev->pdev->dev, "otg_set_power\n");
+                dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+                return otg_set_power(dev->transceiver, mA);
+        }
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return -ENOTSUPP;
+}
+
+
+/* D+ pullup, software-controlled connect/disconnect to USB host */
+static int langwell_pullup(struct usb_gadget *_gadget, int is_on)
+{
+        struct langwell_udc     *dev;
+        u32                     usbcmd;
+        unsigned long           flags;
+
+        if (!_gadget)
+                return -ENODEV;
+
+        dev = container_of(_gadget, struct langwell_udc, gadget);
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        spin_lock_irqsave(&dev->lock, flags);
+        dev->softconnected = (is_on != 0);
+
+        if (dev->driver && dev->softconnected && dev->vbus_active) {
+                usbcmd = readl(&dev->op_regs->usbcmd);
+                usbcmd |= CMD_RUNSTOP;
+                writel(usbcmd, &dev->op_regs->usbcmd);
+        } else {
+                usbcmd = readl(&dev->op_regs->usbcmd);
+                usbcmd &= ~CMD_RUNSTOP;
+                writel(usbcmd, &dev->op_regs->usbcmd);
+        }
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+static int langwell_start(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *));
+static int langwell_stop(struct usb_gadget_driver *driver);
+/* device controller usb_gadget_ops structure */
+static const struct usb_gadget_ops langwell_ops = {
+
+        /* returns the current frame number */
+        .get_frame      = langwell_get_frame,
+
+        /* tries to wake up the host connected to this gadget */
+        .wakeup         = langwell_wakeup,
+
+        /* set the device selfpowered feature, always selfpowered */
+        /* .set_selfpowered = langwell_set_selfpowered, */
+
+        /* notify controller that VBUS is powered or not */
+        .vbus_session   = langwell_vbus_session,
+
+        /* constrain controller's VBUS power usage */
+        .vbus_draw      = langwell_vbus_draw,
+
+        /* D+ pullup, software-controlled connect/disconnect to USB host */
+        .pullup         = langwell_pullup,
+
+        .start          = langwell_start,
+        .stop           = langwell_stop,
+};
+
+
+/*-------------------------------------------------------------------------*/
+
+/* device controller operations */
+
+/* reset device controller */
+static int langwell_udc_reset(struct langwell_udc *dev)
+{
+        u32             usbcmd, usbmode, devlc, endpointlistaddr;
+        u8              devlc_byte0, devlc_byte2;
+        unsigned long   timeout;
+
+        if (!dev)
+                return -EINVAL;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* set controller to stop state */
+        usbcmd = readl(&dev->op_regs->usbcmd);
+        usbcmd &= ~CMD_RUNSTOP;
+        writel(usbcmd, &dev->op_regs->usbcmd);
+
+        /* reset device controller */
+        usbcmd = readl(&dev->op_regs->usbcmd);
+        usbcmd |= CMD_RST;
+        writel(usbcmd, &dev->op_regs->usbcmd);
+
+        /* wait for reset to complete */
+        timeout = jiffies + RESET_TIMEOUT;
+        while (readl(&dev->op_regs->usbcmd) & CMD_RST) {
+                if (time_after(jiffies, timeout)) {
+                        dev_err(&dev->pdev->dev, "device reset timeout\n");
+                        return -ETIMEDOUT;
+                }
+                cpu_relax();
+        }
+
+        /* set controller to device mode */
+        usbmode = readl(&dev->op_regs->usbmode);
+        usbmode |= MODE_DEVICE;
+
+        /* turn setup lockout off, require setup tripwire in usbcmd */
+        usbmode |= MODE_SLOM;
+
+        writel(usbmode, &dev->op_regs->usbmode);
+        usbmode = readl(&dev->op_regs->usbmode);
+        dev_vdbg(&dev->pdev->dev, "usbmode=0x%08x\n", usbmode);
+
+        /* Write-Clear setup status */
+        writel(0, &dev->op_regs->usbsts);
+
+        /* if support USB LPM, ACK all LPM token */
+        if (dev->lpm) {
+                devlc = readl(&dev->op_regs->devlc);
+                dev_vdbg(&dev->pdev->dev, "devlc = 0x%08x\n", devlc);
+                /* FIXME: workaround for Langwell A1/A2/A3 sighting */
+                devlc &= ~LPM_STL;      /* don't STALL LPM token */
+                devlc &= ~LPM_NYT_ACK;  /* ACK LPM token */
+                devlc_byte0 = devlc & 0xff;
+                devlc_byte2 = (devlc >> 16) & 0xff;
+                writeb(devlc_byte0, (u8 *)&dev->op_regs->devlc);
+                writeb(devlc_byte2, (u8 *)&dev->op_regs->devlc + 2);
+                devlc = readl(&dev->op_regs->devlc);
+                dev_vdbg(&dev->pdev->dev,
+                                "ACK LPM token, devlc = 0x%08x\n", devlc);
+        }
+
+        /* fill endpointlistaddr register */
+        endpointlistaddr = dev->ep_dqh_dma;
+        endpointlistaddr &= ENDPOINTLISTADDR_MASK;
+        writel(endpointlistaddr, &dev->op_regs->endpointlistaddr);
+
+        dev_vdbg(&dev->pdev->dev,
+                "dQH base (vir: %p, phy: 0x%08x), endpointlistaddr=0x%08x\n",
+                dev->ep_dqh, endpointlistaddr,
+                readl(&dev->op_regs->endpointlistaddr));
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+
+/* reinitialize device controller endpoints */
+static int eps_reinit(struct langwell_udc *dev)
+{
+        struct langwell_ep      *ep;
+        char                    name[14];
+        int                     i;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* initialize ep0 */
+        ep = &dev->ep[0];
+        ep->dev = dev;
+        strncpy(ep->name, "ep0", sizeof(ep->name));
+        ep->ep.name = ep->name;
+        ep->ep.ops = &langwell_ep_ops;
+        ep->stopped = 0;
+        ep->ep.maxpacket = EP0_MAX_PKT_SIZE;
+        ep->ep_num = 0;
+        ep->desc = &langwell_ep0_desc;
+        INIT_LIST_HEAD(&ep->queue);
+
+        ep->ep_type = USB_ENDPOINT_XFER_CONTROL;
+
+        /* initialize other endpoints */
+        for (i = 2; i < dev->ep_max; i++) {
+                ep = &dev->ep[i];
+                if (i % 2)
+                        snprintf(name, sizeof(name), "ep%din", i / 2);
+                else
+                        snprintf(name, sizeof(name), "ep%dout", i / 2);
+                ep->dev = dev;
+                strncpy(ep->name, name, sizeof(ep->name));
+                ep->ep.name = ep->name;
+
+                ep->ep.ops = &langwell_ep_ops;
+                ep->stopped = 0;
+                ep->ep.maxpacket = (unsigned short) ~0;
+                ep->ep_num = i / 2;
+
+                INIT_LIST_HEAD(&ep->queue);
+                list_add_tail(&ep->ep.ep_list, &dev->gadget.ep_list);
+        }
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+
+/* enable interrupt and set controller to run state */
+static void langwell_udc_start(struct langwell_udc *dev)
+{
+        u32     usbintr, usbcmd;
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* enable interrupts */
+        usbintr = INTR_ULPIE    /* ULPI */
+                | INTR_SLE      /* suspend */
+                /* | INTR_SRE   SOF received */
+                | INTR_URE      /* USB reset */
+                | INTR_AAE      /* async advance */
+                | INTR_SEE      /* system error */
+                | INTR_FRE      /* frame list rollover */
+                | INTR_PCE      /* port change detect */
+                | INTR_UEE      /* USB error interrupt */
+                | INTR_UE;      /* USB interrupt */
+        writel(usbintr, &dev->op_regs->usbintr);
+
+        /* clear stopped bit */
+        dev->stopped = 0;
+
+        /* set controller to run */
+        usbcmd = readl(&dev->op_regs->usbcmd);
+        usbcmd |= CMD_RUNSTOP;
+        writel(usbcmd, &dev->op_regs->usbcmd);
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* disable interrupt and set controller to stop state */
+static void langwell_udc_stop(struct langwell_udc *dev)
+{
+        u32     usbcmd;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* disable all interrupts */
+        writel(0, &dev->op_regs->usbintr);
+
+        /* set stopped bit */
+        dev->stopped = 1;
+
+        /* set controller to stop state */
+        usbcmd = readl(&dev->op_regs->usbcmd);
+        usbcmd &= ~CMD_RUNSTOP;
+        writel(usbcmd, &dev->op_regs->usbcmd);
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* stop all USB activities */
+static void stop_activity(struct langwell_udc *dev,
+                struct usb_gadget_driver *driver)
+{
+        struct langwell_ep      *ep;
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        nuke(&dev->ep[0], -ESHUTDOWN);
+
+        list_for_each_entry(ep, &dev->gadget.ep_list, ep.ep_list) {
+                nuke(ep, -ESHUTDOWN);
+        }
+
+        /* report disconnect; the driver is already quiesced */
+        if (driver) {
+                spin_unlock(&dev->lock);
+                driver->disconnect(&dev->gadget);
+                spin_lock(&dev->lock);
+        }
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* device "function" sysfs attribute file */
+static ssize_t show_function(struct device *_dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct langwell_udc     *dev = the_controller;
+
+        if (!dev->driver || !dev->driver->function
+                        || strlen(dev->driver->function) > PAGE_SIZE)
+                return 0;
+
+        return scnprintf(buf, PAGE_SIZE, "%s\n", dev->driver->function);
+}
+static DEVICE_ATTR(function, S_IRUGO, show_function, NULL);
+
+
+/* device "langwell_udc" sysfs attribute file */
+static ssize_t show_langwell_udc(struct device *_dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct langwell_udc     *dev = the_controller;
+        struct langwell_request *req;
+        struct langwell_ep      *ep = NULL;
+        char                    *next;
+        unsigned                size;
+        unsigned                t;
+        unsigned                i;
+        unsigned long           flags;
+        u32                     tmp_reg;
+
+        next = buf;
+        size = PAGE_SIZE;
+        spin_lock_irqsave(&dev->lock, flags);
+
+        /* driver basic information */
+        t = scnprintf(next, size,
+                        DRIVER_DESC "\n"
+                        "%s version: %s\n"
+                        "Gadget driver: %s\n\n",
+                        driver_name, DRIVER_VERSION,
+                        dev->driver ? dev->driver->driver.name : "(none)");
+        size -= t;
+        next += t;
+
+        /* device registers */
+        tmp_reg = readl(&dev->op_regs->usbcmd);
+        t = scnprintf(next, size,
+                        "USBCMD reg:\n"
+                        "SetupTW: %d\n"
+                        "Run/Stop: %s\n\n",
+                        (tmp_reg & CMD_SUTW) ? 1 : 0,
+                        (tmp_reg & CMD_RUNSTOP) ? "Run" : "Stop");
+        size -= t;
+        next += t;
+
+        tmp_reg = readl(&dev->op_regs->usbsts);
+        t = scnprintf(next, size,
+                        "USB Status Reg:\n"
+                        "Device Suspend: %d\n"
+                        "Reset Received: %d\n"
+                        "System Error: %s\n"
+                        "USB Error Interrupt: %s\n\n",
+                        (tmp_reg & STS_SLI) ? 1 : 0,
+                        (tmp_reg & STS_URI) ? 1 : 0,
+                        (tmp_reg & STS_SEI) ? "Error" : "No error",
+                        (tmp_reg & STS_UEI) ? "Error detected" : "No error");
+        size -= t;
+        next += t;
+
+        tmp_reg = readl(&dev->op_regs->usbintr);
+        t = scnprintf(next, size,
+                        "USB Intrrupt Enable Reg:\n"
+                        "Sleep Enable: %d\n"
+                        "SOF Received Enable: %d\n"
+                        "Reset Enable: %d\n"
+                        "System Error Enable: %d\n"
+                        "Port Change Dectected Enable: %d\n"
+                        "USB Error Intr Enable: %d\n"
+                        "USB Intr Enable: %d\n\n",
+                        (tmp_reg & INTR_SLE) ? 1 : 0,
+                        (tmp_reg & INTR_SRE) ? 1 : 0,
+                        (tmp_reg & INTR_URE) ? 1 : 0,
+                        (tmp_reg & INTR_SEE) ? 1 : 0,
+                        (tmp_reg & INTR_PCE) ? 1 : 0,
+                        (tmp_reg & INTR_UEE) ? 1 : 0,
+                        (tmp_reg & INTR_UE) ? 1 : 0);
+        size -= t;
+        next += t;
+
+        tmp_reg = readl(&dev->op_regs->frindex);
+        t = scnprintf(next, size,
+                        "USB Frame Index Reg:\n"
+                        "Frame Number is 0x%08x\n\n",
+                        (tmp_reg & FRINDEX_MASK));
+        size -= t;
+        next += t;
+
+        tmp_reg = readl(&dev->op_regs->deviceaddr);
+        t = scnprintf(next, size,
+                        "USB Device Address Reg:\n"
+                        "Device Addr is 0x%x\n\n",
+                        USBADR(tmp_reg));
+        size -= t;
+        next += t;
+
+        tmp_reg = readl(&dev->op_regs->endpointlistaddr);
+        t = scnprintf(next, size,
+                        "USB Endpoint List Address Reg:\n"
+                        "Endpoint List Pointer is 0x%x\n\n",
+                        EPBASE(tmp_reg));
+        size -= t;
+        next += t;
+
+        tmp_reg = readl(&dev->op_regs->portsc1);
+        t = scnprintf(next, size,
+                "USB Port Status & Control Reg:\n"
+                "Port Reset: %s\n"
+                "Port Suspend Mode: %s\n"
+                "Over-current Change: %s\n"
+                "Port Enable/Disable Change: %s\n"
+                "Port Enabled/Disabled: %s\n"
+                "Current Connect Status: %s\n"
+                "LPM Suspend Status: %s\n\n",
+                (tmp_reg & PORTS_PR) ? "Reset" : "Not Reset",
+                (tmp_reg & PORTS_SUSP) ? "Suspend " : "Not Suspend",
+                (tmp_reg & PORTS_OCC) ? "Detected" : "No",
+                (tmp_reg & PORTS_PEC) ? "Changed" : "Not Changed",
+                (tmp_reg & PORTS_PE) ? "Enable" : "Not Correct",
+                (tmp_reg & PORTS_CCS) ?  "Attached" : "Not Attached",
+                (tmp_reg & PORTS_SLP) ? "LPM L1" : "LPM L0");
+        size -= t;
+        next += t;
+
+        tmp_reg = readl(&dev->op_regs->devlc);
+        t = scnprintf(next, size,
+                "Device LPM Control Reg:\n"
+                "Parallel Transceiver : %d\n"
+                "Serial Transceiver : %d\n"
+                "Port Speed: %s\n"
+                "Port Force Full Speed Connenct: %s\n"
+                "PHY Low Power Suspend Clock: %s\n"
+                "BmAttributes: %d\n\n",
+                LPM_PTS(tmp_reg),
+                (tmp_reg & LPM_STS) ? 1 : 0,
+                ({
+                        char    *s;
+                        switch (LPM_PSPD(tmp_reg)) {
+                        case LPM_SPEED_FULL:
+                                s = "Full Speed"; break;
+                        case LPM_SPEED_LOW:
+                                s = "Low Speed"; break;
+                        case LPM_SPEED_HIGH:
+                                s = "High Speed"; break;
+                        default:
+                                s = "Unknown Speed"; break;
+                        }
+                        s;
+                }),
+                (tmp_reg & LPM_PFSC) ? "Force Full Speed" : "Not Force",
+                (tmp_reg & LPM_PHCD) ? "Disabled" : "Enabled",
+                LPM_BA(tmp_reg));
+        size -= t;
+        next += t;
+
+        tmp_reg = readl(&dev->op_regs->usbmode);
+        t = scnprintf(next, size,
+                        "USB Mode Reg:\n"
+                        "Controller Mode is : %s\n\n", ({
+                                char *s;
+                                switch (MODE_CM(tmp_reg)) {
+                                case MODE_IDLE:
+                                        s = "Idle"; break;
+                                case MODE_DEVICE:
+                                        s = "Device Controller"; break;
+                                case MODE_HOST:
+                                        s = "Host Controller"; break;
+                                default:
+                                        s = "None"; break;
+                                }
+                                s;
+                        }));
+        size -= t;
+        next += t;
+
+        tmp_reg = readl(&dev->op_regs->endptsetupstat);
+        t = scnprintf(next, size,
+                        "Endpoint Setup Status Reg:\n"
+                        "SETUP on ep 0x%04x\n\n",
+                        tmp_reg & SETUPSTAT_MASK);
+        size -= t;
+        next += t;
+
+        for (i = 0; i < dev->ep_max / 2; i++) {
+                tmp_reg = readl(&dev->op_regs->endptctrl[i]);
+                t = scnprintf(next, size, "EP Ctrl Reg [%d]: 0x%08x\n",
+                                i, tmp_reg);
+                size -= t;
+                next += t;
+        }
+        tmp_reg = readl(&dev->op_regs->endptprime);
+        t = scnprintf(next, size, "EP Prime Reg: 0x%08x\n\n", tmp_reg);
+        size -= t;
+        next += t;
+
+        /* langwell_udc, langwell_ep, langwell_request structure information */
+        ep = &dev->ep[0];
+        t = scnprintf(next, size, "%s MaxPacketSize: 0x%x, ep_num: %d\n",
+                        ep->ep.name, ep->ep.maxpacket, ep->ep_num);
+        size -= t;
+        next += t;
+
+        if (list_empty(&ep->queue)) {
+                t = scnprintf(next, size, "its req queue is empty\n\n");
+                size -= t;
+                next += t;
+        } else {
+                list_for_each_entry(req, &ep->queue, queue) {
+                        t = scnprintf(next, size,
+                                "req %p actual 0x%x length 0x%x  buf %p\n",
+                                &req->req, req->req.actual,
+                                req->req.length, req->req.buf);
+                        size -= t;
+                        next += t;
+                }
+        }
+        /* other gadget->eplist ep */
+        list_for_each_entry(ep, &dev->gadget.ep_list, ep.ep_list) {
+                if (ep->desc) {
+                        t = scnprintf(next, size,
+                                        "\n%s MaxPacketSize: 0x%x, "
+                                        "ep_num: %d\n",
+                                        ep->ep.name, ep->ep.maxpacket,
+                                        ep->ep_num);
+                        size -= t;
+                        next += t;
+
+                        if (list_empty(&ep->queue)) {
+                                t = scnprintf(next, size,
+                                                "its req queue is empty\n\n");
+                                size -= t;
+                                next += t;
+                        } else {
+                                list_for_each_entry(req, &ep->queue, queue) {
+                                        t = scnprintf(next, size,
+                                                "req %p actual 0x%x length "
+                                                "0x%x  buf %p\n",
+                                                &req->req, req->req.actual,
+                                                req->req.length, req->req.buf);
+                                        size -= t;
+                                        next += t;
+                                }
+                        }
+                }
+        }
+
+        spin_unlock_irqrestore(&dev->lock, flags);
+        return PAGE_SIZE - size;
+}
+static DEVICE_ATTR(langwell_udc, S_IRUGO, show_langwell_udc, NULL);
+
+
+/* device "remote_wakeup" sysfs attribute file */
+static ssize_t store_remote_wakeup(struct device *_dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct langwell_udc     *dev = the_controller;
+        unsigned long           flags;
+        ssize_t                 rc = count;
+
+        if (count > 2)
+                return -EINVAL;
+
+        if (count > 0 && buf[count-1] == '\n')
+                ((char *) buf)[count-1] = 0;
+
+        if (buf[0] != '1')
+                return -EINVAL;
+
+        /* force remote wakeup enabled in case gadget driver doesn't support */
+        spin_lock_irqsave(&dev->lock, flags);
+        dev->remote_wakeup = 1;
+        dev->dev_status |= (1 << USB_DEVICE_REMOTE_WAKEUP);
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        langwell_wakeup(&dev->gadget);
+
+        return rc;
+}
+static DEVICE_ATTR(remote_wakeup, S_IWUSR, NULL, store_remote_wakeup);
+
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * when a driver is successfully registered, it will receive
+ * control requests including set_configuration(), which enables
+ * non-control requests.  then usb traffic follows until a
+ * disconnect is reported.  then a host may connect again, or
+ * the driver might get unbound.
+ */
+
+static int langwell_start(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
+{
+        struct langwell_udc     *dev = the_controller;
+        unsigned long           flags;
+        int                     retval;
+
+        if (!dev)
+                return -ENODEV;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (dev->driver)
+                return -EBUSY;
+
+        spin_lock_irqsave(&dev->lock, flags);
+
+        /* hook up the driver ... */
+        driver->driver.bus = NULL;
+        dev->driver = driver;
+        dev->gadget.dev.driver = &driver->driver;
+
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        retval = bind(&dev->gadget);
+        if (retval) {
+                dev_dbg(&dev->pdev->dev, "bind to driver %s --> %d\n",
+                                driver->driver.name, retval);
+                dev->driver = NULL;
+                dev->gadget.dev.driver = NULL;
+                return retval;
+        }
+
+        retval = device_create_file(&dev->pdev->dev, &dev_attr_function);
+        if (retval)
+                goto err_unbind;
+
+        dev->usb_state = USB_STATE_ATTACHED;
+        dev->ep0_state = WAIT_FOR_SETUP;
+        dev->ep0_dir = USB_DIR_OUT;
+
+        /* enable interrupt and set controller to run state */
+        if (dev->got_irq)
+                langwell_udc_start(dev);
+
+        dev_vdbg(&dev->pdev->dev,
+                        "After langwell_udc_start(), print all registers:\n");
+        print_all_registers(dev);
+
+        dev_info(&dev->pdev->dev, "register driver: %s\n",
+                        driver->driver.name);
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+
+err_unbind:
+        driver->unbind(&dev->gadget);
+        dev->gadget.dev.driver = NULL;
+        dev->driver = NULL;
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return retval;
+}
+
+/* unregister gadget driver */
+static int langwell_stop(struct usb_gadget_driver *driver)
+{
+        struct langwell_udc     *dev = the_controller;
+        unsigned long           flags;
+
+        if (!dev)
+                return -ENODEV;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (unlikely(!driver || !driver->unbind))
+                return -EINVAL;
+
+        /* exit PHY low power suspend */
+        if (dev->pdev->device != 0x0829)
+                langwell_phy_low_power(dev, 0);
+
+        /* unbind OTG transceiver */
+        if (dev->transceiver)
+                (void)otg_set_peripheral(dev->transceiver, 0);
+
+        /* disable interrupt and set controller to stop state */
+        langwell_udc_stop(dev);
+
+        dev->usb_state = USB_STATE_ATTACHED;
+        dev->ep0_state = WAIT_FOR_SETUP;
+        dev->ep0_dir = USB_DIR_OUT;
+
+        spin_lock_irqsave(&dev->lock, flags);
+
+        /* stop all usb activities */
+        dev->gadget.speed = USB_SPEED_UNKNOWN;
+        stop_activity(dev, driver);
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        /* unbind gadget driver */
+        driver->unbind(&dev->gadget);
+        dev->gadget.dev.driver = NULL;
+        dev->driver = NULL;
+
+        device_remove_file(&dev->pdev->dev, &dev_attr_function);
+
+        dev_info(&dev->pdev->dev, "unregistered driver '%s'\n",
+                        driver->driver.name);
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * setup tripwire is used as a semaphore to ensure that the setup data
+ * payload is extracted from a dQH without being corrupted
+ */
+static void setup_tripwire(struct langwell_udc *dev)
+{
+        u32                     usbcmd,
+                                endptsetupstat;
+        unsigned long           timeout;
+        struct langwell_dqh     *dqh;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* ep0 OUT dQH */
+        dqh = &dev->ep_dqh[EP_DIR_OUT];
+
+        /* Write-Clear endptsetupstat */
+        endptsetupstat = readl(&dev->op_regs->endptsetupstat);
+        writel(endptsetupstat, &dev->op_regs->endptsetupstat);
+
+        /* wait until endptsetupstat is cleared */
+        timeout = jiffies + SETUPSTAT_TIMEOUT;
+        while (readl(&dev->op_regs->endptsetupstat)) {
+                if (time_after(jiffies, timeout)) {
+                        dev_err(&dev->pdev->dev, "setup_tripwire timeout\n");
+                        break;
+                }
+                cpu_relax();
+        }
+
+        /* while a hazard exists when setup packet arrives */
+        do {
+                /* set setup tripwire bit */
+                usbcmd = readl(&dev->op_regs->usbcmd);
+                writel(usbcmd | CMD_SUTW, &dev->op_regs->usbcmd);
+
+                /* copy the setup packet to local buffer */
+                memcpy(&dev->local_setup_buff, &dqh->dqh_setup, 8);
+        } while (!(readl(&dev->op_regs->usbcmd) & CMD_SUTW));
+
+        /* Write-Clear setup tripwire bit */
+        usbcmd = readl(&dev->op_regs->usbcmd);
+        writel(usbcmd & ~CMD_SUTW, &dev->op_regs->usbcmd);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* protocol ep0 stall, will automatically be cleared on new transaction */
+static void ep0_stall(struct langwell_udc *dev)
+{
+        u32     endptctrl;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* set TX and RX to stall */
+        endptctrl = readl(&dev->op_regs->endptctrl[0]);
+        endptctrl |= EPCTRL_TXS | EPCTRL_RXS;
+        writel(endptctrl, &dev->op_regs->endptctrl[0]);
+
+        /* update ep0 state */
+        dev->ep0_state = WAIT_FOR_SETUP;
+        dev->ep0_dir = USB_DIR_OUT;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* PRIME a status phase for ep0 */
+static int prime_status_phase(struct langwell_udc *dev, int dir)
+{
+        struct langwell_request *req;
+        struct langwell_ep      *ep;
+        int                     status = 0;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (dir == EP_DIR_IN)
+                dev->ep0_dir = USB_DIR_IN;
+        else
+                dev->ep0_dir = USB_DIR_OUT;
+
+        ep = &dev->ep[0];
+        dev->ep0_state = WAIT_FOR_OUT_STATUS;
+
+        req = dev->status_req;
+
+        req->ep = ep;
+        req->req.length = 0;
+        req->req.status = -EINPROGRESS;
+        req->req.actual = 0;
+        req->req.complete = NULL;
+        req->dtd_count = 0;
+
+        if (!req_to_dtd(req))
+                status = queue_dtd(ep, req);
+        else
+                return -ENOMEM;
+
+        if (status)
+                dev_err(&dev->pdev->dev, "can't queue ep0 status request\n");
+
+        list_add_tail(&req->queue, &ep->queue);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return status;
+}
+
+
+/* SET_ADDRESS request routine */
+static void set_address(struct langwell_udc *dev, u16 value,
+                u16 index, u16 length)
+{
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* save the new address to device struct */
+        dev->dev_addr = (u8) value;
+        dev_vdbg(&dev->pdev->dev, "dev->dev_addr = %d\n", dev->dev_addr);
+
+        /* update usb state */
+        dev->usb_state = USB_STATE_ADDRESS;
+
+        /* STATUS phase */
+        if (prime_status_phase(dev, EP_DIR_IN))
+                ep0_stall(dev);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* return endpoint by windex */
+static struct langwell_ep *get_ep_by_windex(struct langwell_udc *dev,
+                u16 wIndex)
+{
+        struct langwell_ep              *ep;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if ((wIndex & USB_ENDPOINT_NUMBER_MASK) == 0)
+                return &dev->ep[0];
+
+        list_for_each_entry(ep, &dev->gadget.ep_list, ep.ep_list) {
+                u8      bEndpointAddress;
+                if (!ep->desc)
+                        continue;
+
+                bEndpointAddress = ep->desc->bEndpointAddress;
+                if ((wIndex ^ bEndpointAddress) & USB_DIR_IN)
+                        continue;
+
+                if ((wIndex & USB_ENDPOINT_NUMBER_MASK)
+                        == (bEndpointAddress & USB_ENDPOINT_NUMBER_MASK))
+                        return ep;
+        }
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return NULL;
+}
+
+
+/* return whether endpoint is stalled, 0: not stalled; 1: stalled */
+static int ep_is_stall(struct langwell_ep *ep)
+{
+        struct langwell_udc     *dev = ep->dev;
+        u32                     endptctrl;
+        int                     retval;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        endptctrl = readl(&dev->op_regs->endptctrl[ep->ep_num]);
+        if (is_in(ep))
+                retval = endptctrl & EPCTRL_TXS ? 1 : 0;
+        else
+                retval = endptctrl & EPCTRL_RXS ? 1 : 0;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return retval;
+}
+
+
+/* GET_STATUS request routine */
+static void get_status(struct langwell_udc *dev, u8 request_type, u16 value,
+                u16 index, u16 length)
+{
+        struct langwell_request *req;
+        struct langwell_ep      *ep;
+        u16     status_data = 0;        /* 16 bits cpu view status data */
+        int     status = 0;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        ep = &dev->ep[0];
+
+        if ((request_type & USB_RECIP_MASK) == USB_RECIP_DEVICE) {
+                /* get device status */
+                status_data = dev->dev_status;
+        } else if ((request_type & USB_RECIP_MASK) == USB_RECIP_INTERFACE) {
+                /* get interface status */
+                status_data = 0;
+        } else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) {
+                /* get endpoint status */
+                struct langwell_ep      *epn;
+                epn = get_ep_by_windex(dev, index);
+                /* stall if endpoint doesn't exist */
+                if (!epn)
+                        goto stall;
+
+                status_data = ep_is_stall(epn) << USB_ENDPOINT_HALT;
+        }
+
+        dev_dbg(&dev->pdev->dev, "get status data: 0x%04x\n", status_data);
+
+        dev->ep0_dir = USB_DIR_IN;
+
+        /* borrow the per device status_req */
+        req = dev->status_req;
+
+        /* fill in the reqest structure */
+        *((u16 *) req->req.buf) = cpu_to_le16(status_data);
+        req->ep = ep;
+        req->req.length = 2;
+        req->req.status = -EINPROGRESS;
+        req->req.actual = 0;
+        req->req.complete = NULL;
+        req->dtd_count = 0;
+
+        /* prime the data phase */
+        if (!req_to_dtd(req))
+                status = queue_dtd(ep, req);
+        else                    /* no mem */
+                goto stall;
+
+        if (status) {
+                dev_err(&dev->pdev->dev,
+                                "response error on GET_STATUS request\n");
+                goto stall;
+        }
+
+        list_add_tail(&req->queue, &ep->queue);
+        dev->ep0_state = DATA_STATE_XMIT;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return;
+stall:
+        ep0_stall(dev);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* setup packet interrupt handler */
+static void handle_setup_packet(struct langwell_udc *dev,
+                struct usb_ctrlrequest *setup)
+{
+        u16     wValue = le16_to_cpu(setup->wValue);
+        u16     wIndex = le16_to_cpu(setup->wIndex);
+        u16     wLength = le16_to_cpu(setup->wLength);
+        u32     portsc1;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* ep0 fifo flush */
+        nuke(&dev->ep[0], -ESHUTDOWN);
+
+        dev_dbg(&dev->pdev->dev, "SETUP %02x.%02x v%04x i%04x l%04x\n",
+                        setup->bRequestType, setup->bRequest,
+                        wValue, wIndex, wLength);
+
+        /* RNDIS gadget delegate */
+        if ((setup->bRequestType == 0x21) && (setup->bRequest == 0x00)) {
+                /* USB_CDC_SEND_ENCAPSULATED_COMMAND */
+                goto delegate;
+        }
+
+        /* USB_CDC_GET_ENCAPSULATED_RESPONSE */
+        if ((setup->bRequestType == 0xa1) && (setup->bRequest == 0x01)) {
+                /* USB_CDC_GET_ENCAPSULATED_RESPONSE */
+                goto delegate;
+        }
+
+        /* We process some stardard setup requests here */
+        switch (setup->bRequest) {
+        case USB_REQ_GET_STATUS:
+                dev_dbg(&dev->pdev->dev, "SETUP: USB_REQ_GET_STATUS\n");
+                /* get status, DATA and STATUS phase */
+                if ((setup->bRequestType & (USB_DIR_IN | USB_TYPE_MASK))
+                                        != (USB_DIR_IN | USB_TYPE_STANDARD))
+                        break;
+                get_status(dev, setup->bRequestType, wValue, wIndex, wLength);
+                goto end;
+
+        case USB_REQ_SET_ADDRESS:
+                dev_dbg(&dev->pdev->dev, "SETUP: USB_REQ_SET_ADDRESS\n");
+                /* STATUS phase */
+                if (setup->bRequestType != (USB_DIR_OUT | USB_TYPE_STANDARD
+                                                | USB_RECIP_DEVICE))
+                        break;
+                set_address(dev, wValue, wIndex, wLength);
+                goto end;
+
+        case USB_REQ_CLEAR_FEATURE:
+        case USB_REQ_SET_FEATURE:
+                /* STATUS phase */
+        {
+                int rc = -EOPNOTSUPP;
+                if (setup->bRequest == USB_REQ_SET_FEATURE)
+                        dev_dbg(&dev->pdev->dev,
+                                        "SETUP: USB_REQ_SET_FEATURE\n");
+                else if (setup->bRequest == USB_REQ_CLEAR_FEATURE)
+                        dev_dbg(&dev->pdev->dev,
+                                        "SETUP: USB_REQ_CLEAR_FEATURE\n");
+
+                if ((setup->bRequestType & (USB_RECIP_MASK | USB_TYPE_MASK))
+                                == (USB_RECIP_ENDPOINT | USB_TYPE_STANDARD)) {
+                        struct langwell_ep      *epn;
+                        epn = get_ep_by_windex(dev, wIndex);
+                        /* stall if endpoint doesn't exist */
+                        if (!epn) {
+                                ep0_stall(dev);
+                                goto end;
+                        }
+
+                        if (wValue != 0 || wLength != 0
+                                        || epn->ep_num > dev->ep_max)
+                                break;
+
+                        spin_unlock(&dev->lock);
+                        rc = langwell_ep_set_halt(&epn->ep,
+                                (setup->bRequest == USB_REQ_SET_FEATURE)
+                                ? 1 : 0);
+                        spin_lock(&dev->lock);
+
+                } else if ((setup->bRequestType & (USB_RECIP_MASK
+                                | USB_TYPE_MASK)) == (USB_RECIP_DEVICE
+                                | USB_TYPE_STANDARD)) {
+                        rc = 0;
+                        switch (wValue) {
+                        case USB_DEVICE_REMOTE_WAKEUP:
+                                if (setup->bRequest == USB_REQ_SET_FEATURE) {
+                                        dev->remote_wakeup = 1;
+                                        dev->dev_status |= (1 << wValue);
+                                } else {
+                                        dev->remote_wakeup = 0;
+                                        dev->dev_status &= ~(1 << wValue);
+                                }
+                                break;
+                        case USB_DEVICE_TEST_MODE:
+                                dev_dbg(&dev->pdev->dev, "SETUP: TEST MODE\n");
+                                if ((wIndex & 0xff) ||
+                                        (dev->gadget.speed != USB_SPEED_HIGH))
+                                        ep0_stall(dev);
+
+                                switch (wIndex >> 8) {
+                                case TEST_J:
+                                case TEST_K:
+                                case TEST_SE0_NAK:
+                                case TEST_PACKET:
+                                case TEST_FORCE_EN:
+                                        if (prime_status_phase(dev, EP_DIR_IN))
+                                                ep0_stall(dev);
+                                        portsc1 = readl(&dev->op_regs->portsc1);
+                                        portsc1 |= (wIndex & 0xf00) << 8;
+                                        writel(portsc1, &dev->op_regs->portsc1);
+                                        goto end;
+                                default:
+                                        rc = -EOPNOTSUPP;
+                                }
+                                break;
+                        default:
+                                rc = -EOPNOTSUPP;
+                                break;
+                        }
+
+                        if (!gadget_is_otg(&dev->gadget))
+                                break;
+                        else if (setup->bRequest == USB_DEVICE_B_HNP_ENABLE) {
+                                dev->gadget.b_hnp_enable = 1;
+#ifdef  OTG_TRANSCEIVER
+                                if (!dev->lotg->otg.default_a)
+                                        dev->lotg->hsm.b_hnp_enable = 1;
+#endif
+                        } else if (setup->bRequest == USB_DEVICE_A_HNP_SUPPORT)
+                                dev->gadget.a_hnp_support = 1;
+                        else if (setup->bRequest ==
+                                        USB_DEVICE_A_ALT_HNP_SUPPORT)
+                                dev->gadget.a_alt_hnp_support = 1;
+                        else
+                                break;
+                } else
+                        break;
+
+                if (rc == 0) {
+                        if (prime_status_phase(dev, EP_DIR_IN))
+                                ep0_stall(dev);
+                }
+                goto end;
+        }
+
+        case USB_REQ_GET_DESCRIPTOR:
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_GET_DESCRIPTOR\n");
+                goto delegate;
+
+        case USB_REQ_SET_DESCRIPTOR:
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_SET_DESCRIPTOR unsupported\n");
+                goto delegate;
+
+        case USB_REQ_GET_CONFIGURATION:
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_GET_CONFIGURATION\n");
+                goto delegate;
+
+        case USB_REQ_SET_CONFIGURATION:
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_SET_CONFIGURATION\n");
+                goto delegate;
+
+        case USB_REQ_GET_INTERFACE:
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_GET_INTERFACE\n");
+                goto delegate;
+
+        case USB_REQ_SET_INTERFACE:
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_SET_INTERFACE\n");
+                goto delegate;
+
+        case USB_REQ_SYNCH_FRAME:
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_SYNCH_FRAME unsupported\n");
+                goto delegate;
+
+        default:
+                /* delegate USB standard requests to the gadget driver */
+                goto delegate;
+delegate:
+                /* USB requests handled by gadget */
+                if (wLength) {
+                        /* DATA phase from gadget, STATUS phase from udc */
+                        dev->ep0_dir = (setup->bRequestType & USB_DIR_IN)
+                                        ?  USB_DIR_IN : USB_DIR_OUT;
+                        dev_vdbg(&dev->pdev->dev,
+                                        "dev->ep0_dir = 0x%x, wLength = %d\n",
+                                        dev->ep0_dir, wLength);
+                        spin_unlock(&dev->lock);
+                        if (dev->driver->setup(&dev->gadget,
+                                        &dev->local_setup_buff) < 0)
+                                ep0_stall(dev);
+                        spin_lock(&dev->lock);
+                        dev->ep0_state = (setup->bRequestType & USB_DIR_IN)
+                                        ?  DATA_STATE_XMIT : DATA_STATE_RECV;
+                } else {
+                        /* no DATA phase, IN STATUS phase from gadget */
+                        dev->ep0_dir = USB_DIR_IN;
+                        dev_vdbg(&dev->pdev->dev,
+                                        "dev->ep0_dir = 0x%x, wLength = %d\n",
+                                        dev->ep0_dir, wLength);
+                        spin_unlock(&dev->lock);
+                        if (dev->driver->setup(&dev->gadget,
+                                        &dev->local_setup_buff) < 0)
+                                ep0_stall(dev);
+                        spin_lock(&dev->lock);
+                        dev->ep0_state = WAIT_FOR_OUT_STATUS;
+                }
+                break;
+        }
+end:
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* transfer completion, process endpoint request and free the completed dTDs
+ * for this request
+ */
+static int process_ep_req(struct langwell_udc *dev, int index,
+                struct langwell_request *curr_req)
+{
+        struct langwell_dtd     *curr_dtd;
+        struct langwell_dqh     *curr_dqh;
+        int                     td_complete, actual, remaining_length;
+        int                     i, dir;
+        u8                      dtd_status = 0;
+        int                     retval = 0;
+
+        curr_dqh = &dev->ep_dqh[index];
+        dir = index % 2;
+
+        curr_dtd = curr_req->head;
+        td_complete = 0;
+        actual = curr_req->req.length;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        for (i = 0; i < curr_req->dtd_count; i++) {
+
+                /* command execution states by dTD */
+                dtd_status = curr_dtd->dtd_status;
+
+                barrier();
+                remaining_length = le16_to_cpu(curr_dtd->dtd_total);
+                actual -= remaining_length;
+
+                if (!dtd_status) {
+                        /* transfers completed successfully */
+                        if (!remaining_length) {
+                                td_complete++;
+                                dev_vdbg(&dev->pdev->dev,
+                                        "dTD transmitted successfully\n");
+                        } else {
+                                if (dir) {
+                                        dev_vdbg(&dev->pdev->dev,
+                                                "TX dTD remains data\n");
+                                        retval = -EPROTO;
+                                        break;
+
+                                } else {
+                                        td_complete++;
+                                        break;
+                                }
+                        }
+                } else {
+                        /* transfers completed with errors */
+                        if (dtd_status & DTD_STS_ACTIVE) {
+                                dev_dbg(&dev->pdev->dev,
+                                        "dTD status ACTIVE dQH[%d]\n", index);
+                                retval = 1;
+                                return retval;
+                        } else if (dtd_status & DTD_STS_HALTED) {
+                                dev_err(&dev->pdev->dev,
+                                        "dTD error %08x dQH[%d]\n",
+                                        dtd_status, index);
+                                /* clear the errors and halt condition */
+                                curr_dqh->dtd_status = 0;
+                                retval = -EPIPE;
+                                break;
+                        } else if (dtd_status & DTD_STS_DBE) {
+                                dev_dbg(&dev->pdev->dev,
+                                        "data buffer (overflow) error\n");
+                                retval = -EPROTO;
+                                break;
+                        } else if (dtd_status & DTD_STS_TRE) {
+                                dev_dbg(&dev->pdev->dev,
+                                        "transaction(ISO) error\n");
+                                retval = -EILSEQ;
+                                break;
+                        } else
+                                dev_err(&dev->pdev->dev,
+                                        "unknown error (0x%x)!\n",
+                                        dtd_status);
+                }
+
+                if (i != curr_req->dtd_count - 1)
+                        curr_dtd = (struct langwell_dtd *)
+                                curr_dtd->next_dtd_virt;
+        }
+
+        if (retval)
+                return retval;
+
+        curr_req->req.actual = actual;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+
+/* complete DATA or STATUS phase of ep0 prime status phase if needed */
+static void ep0_req_complete(struct langwell_udc *dev,
+                struct langwell_ep *ep0, struct langwell_request *req)
+{
+        u32     new_addr;
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (dev->usb_state == USB_STATE_ADDRESS) {
+                /* set the new address */
+                new_addr = (u32)dev->dev_addr;
+                writel(new_addr << USBADR_SHIFT, &dev->op_regs->deviceaddr);
+
+                new_addr = USBADR(readl(&dev->op_regs->deviceaddr));
+                dev_vdbg(&dev->pdev->dev, "new_addr = %d\n", new_addr);
+        }
+
+        done(ep0, req, 0);
+
+        switch (dev->ep0_state) {
+        case DATA_STATE_XMIT:
+                /* receive status phase */
+                if (prime_status_phase(dev, EP_DIR_OUT))
+                        ep0_stall(dev);
+                break;
+        case DATA_STATE_RECV:
+                /* send status phase */
+                if (prime_status_phase(dev, EP_DIR_IN))
+                        ep0_stall(dev);
+                break;
+        case WAIT_FOR_OUT_STATUS:
+                dev->ep0_state = WAIT_FOR_SETUP;
+                break;
+        case WAIT_FOR_SETUP:
+                dev_err(&dev->pdev->dev, "unexpect ep0 packets\n");
+                break;
+        default:
+                ep0_stall(dev);
+                break;
+        }
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* USB transfer completion interrupt */
+static void handle_trans_complete(struct langwell_udc *dev)
+{
+        u32                     complete_bits;
+        int                     i, ep_num, dir, bit_mask, status;
+        struct langwell_ep      *epn;
+        struct langwell_request *curr_req, *temp_req;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        complete_bits = readl(&dev->op_regs->endptcomplete);
+        dev_vdbg(&dev->pdev->dev, "endptcomplete register: 0x%08x\n",
+                        complete_bits);
+
+        /* Write-Clear the bits in endptcomplete register */
+        writel(complete_bits, &dev->op_regs->endptcomplete);
+
+        if (!complete_bits) {
+                dev_dbg(&dev->pdev->dev, "complete_bits = 0\n");
+                goto done;
+        }
+
+        for (i = 0; i < dev->ep_max; i++) {
+                ep_num = i / 2;
+                dir = i % 2;
+
+                bit_mask = 1 << (ep_num + 16 * dir);
+
+                if (!(complete_bits & bit_mask))
+                        continue;
+
+                /* ep0 */
+                if (i == 1)
+                        epn = &dev->ep[0];
+                else
+                        epn = &dev->ep[i];
+
+                if (epn->name == NULL) {
+                        dev_warn(&dev->pdev->dev, "invalid endpoint\n");
+                        continue;
+                }
+
+                if (i < 2)
+                        /* ep0 in and out */
+                        dev_dbg(&dev->pdev->dev, "%s-%s transfer completed\n",
+                                        epn->name,
+                                        is_in(epn) ? "in" : "out");
+                else
+                        dev_dbg(&dev->pdev->dev, "%s transfer completed\n",
+                                        epn->name);
+
+                /* process the req queue until an uncomplete request */
+                list_for_each_entry_safe(curr_req, temp_req,
+                                &epn->queue, queue) {
+                        status = process_ep_req(dev, i, curr_req);
+                        dev_vdbg(&dev->pdev->dev, "%s req status: %d\n",
+                                        epn->name, status);
+
+                        if (status)
+                                break;
+
+                        /* write back status to req */
+                        curr_req->req.status = status;
+
+                        /* ep0 request completion */
+                        if (ep_num == 0) {
+                                ep0_req_complete(dev, epn, curr_req);
+                                break;
+                        } else {
+                                done(epn, curr_req, status);
+                        }
+                }
+        }
+done:
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* port change detect interrupt handler */
+static void handle_port_change(struct langwell_udc *dev)
+{
+        u32     portsc1, devlc;
+        u32     speed;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (dev->bus_reset)
+                dev->bus_reset = 0;
+
+        portsc1 = readl(&dev->op_regs->portsc1);
+        devlc = readl(&dev->op_regs->devlc);
+        dev_vdbg(&dev->pdev->dev, "portsc1 = 0x%08x, devlc = 0x%08x\n",
+                        portsc1, devlc);
+
+        /* bus reset is finished */
+        if (!(portsc1 & PORTS_PR)) {
+                /* get the speed */
+                speed = LPM_PSPD(devlc);
+                switch (speed) {
+                case LPM_SPEED_HIGH:
+                        dev->gadget.speed = USB_SPEED_HIGH;
+                        break;
+                case LPM_SPEED_FULL:
+                        dev->gadget.speed = USB_SPEED_FULL;
+                        break;
+                case LPM_SPEED_LOW:
+                        dev->gadget.speed = USB_SPEED_LOW;
+                        break;
+                default:
+                        dev->gadget.speed = USB_SPEED_UNKNOWN;
+                        break;
+                }
+                dev_vdbg(&dev->pdev->dev,
+                                "speed = %d, dev->gadget.speed = %d\n",
+                                speed, dev->gadget.speed);
+        }
+
+        /* LPM L0 to L1 */
+        if (dev->lpm && dev->lpm_state == LPM_L0)
+                if (portsc1 & PORTS_SUSP && portsc1 & PORTS_SLP) {
+                        dev_info(&dev->pdev->dev, "LPM L0 to L1\n");
+                        dev->lpm_state = LPM_L1;
+                }
+
+        /* LPM L1 to L0, force resume or remote wakeup finished */
+        if (dev->lpm && dev->lpm_state == LPM_L1)
+                if (!(portsc1 & PORTS_SUSP)) {
+                        dev_info(&dev->pdev->dev, "LPM L1 to L0\n");
+                        dev->lpm_state = LPM_L0;
+                }
+
+        /* update USB state */
+        if (!dev->resume_state)
+                dev->usb_state = USB_STATE_DEFAULT;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* USB reset interrupt handler */
+static void handle_usb_reset(struct langwell_udc *dev)
+{
+        u32             deviceaddr,
+                        endptsetupstat,
+                        endptcomplete;
+        unsigned long   timeout;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* Write-Clear the device address */
+        deviceaddr = readl(&dev->op_regs->deviceaddr);
+        writel(deviceaddr & ~USBADR_MASK, &dev->op_regs->deviceaddr);
+
+        dev->dev_addr = 0;
+
+        /* clear usb state */
+        dev->resume_state = 0;
+
+        /* LPM L1 to L0, reset */
+        if (dev->lpm)
+                dev->lpm_state = LPM_L0;
+
+        dev->ep0_dir = USB_DIR_OUT;
+        dev->ep0_state = WAIT_FOR_SETUP;
+
+        /* remote wakeup reset to 0 when the device is reset */
+        dev->remote_wakeup = 0;
+        dev->dev_status = 1 << USB_DEVICE_SELF_POWERED;
+        dev->gadget.b_hnp_enable = 0;
+        dev->gadget.a_hnp_support = 0;
+        dev->gadget.a_alt_hnp_support = 0;
+
+        /* Write-Clear all the setup token semaphores */
+        endptsetupstat = readl(&dev->op_regs->endptsetupstat);
+        writel(endptsetupstat, &dev->op_regs->endptsetupstat);
+
+        /* Write-Clear all the endpoint complete status bits */
+        endptcomplete = readl(&dev->op_regs->endptcomplete);
+        writel(endptcomplete, &dev->op_regs->endptcomplete);
+
+        /* wait until all endptprime bits cleared */
+        timeout = jiffies + PRIME_TIMEOUT;
+        while (readl(&dev->op_regs->endptprime)) {
+                if (time_after(jiffies, timeout)) {
+                        dev_err(&dev->pdev->dev, "USB reset timeout\n");
+                        break;
+                }
+                cpu_relax();
+        }
+
+        /* write 1s to endptflush register to clear any primed buffers */
+        writel((u32) ~0, &dev->op_regs->endptflush);
+
+        if (readl(&dev->op_regs->portsc1) & PORTS_PR) {
+                dev_vdbg(&dev->pdev->dev, "USB bus reset\n");
+                /* bus is reseting */
+                dev->bus_reset = 1;
+
+                /* reset all the queues, stop all USB activities */
+                stop_activity(dev, dev->driver);
+                dev->usb_state = USB_STATE_DEFAULT;
+        } else {
+                dev_vdbg(&dev->pdev->dev, "device controller reset\n");
+                /* controller reset */
+                langwell_udc_reset(dev);
+
+                /* reset all the queues, stop all USB activities */
+                stop_activity(dev, dev->driver);
+
+                /* reset ep0 dQH and endptctrl */
+                ep0_reset(dev);
+
+                /* enable interrupt and set controller to run state */
+                langwell_udc_start(dev);
+
+                dev->usb_state = USB_STATE_ATTACHED;
+        }
+
+#ifdef  OTG_TRANSCEIVER
+        /* refer to USB OTG 6.6.2.3 b_hnp_en is cleared */
+        if (!dev->lotg->otg.default_a)
+                dev->lotg->hsm.b_hnp_enable = 0;
+#endif
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* USB bus suspend/resume interrupt */
+static void handle_bus_suspend(struct langwell_udc *dev)
+{
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        dev->resume_state = dev->usb_state;
+        dev->usb_state = USB_STATE_SUSPENDED;
+
+#ifdef  OTG_TRANSCEIVER
+        if (dev->lotg->otg.default_a) {
+                if (dev->lotg->hsm.b_bus_suspend_vld == 1) {
+                        dev->lotg->hsm.b_bus_suspend = 1;
+                        /* notify transceiver the state changes */
+                        if (spin_trylock(&dev->lotg->wq_lock)) {
+                                langwell_update_transceiver();
+                                spin_unlock(&dev->lotg->wq_lock);
+                        }
+                }
+                dev->lotg->hsm.b_bus_suspend_vld++;
+        } else {
+                if (!dev->lotg->hsm.a_bus_suspend) {
+                        dev->lotg->hsm.a_bus_suspend = 1;
+                        /* notify transceiver the state changes */
+                        if (spin_trylock(&dev->lotg->wq_lock)) {
+                                langwell_update_transceiver();
+                                spin_unlock(&dev->lotg->wq_lock);
+                        }
+                }
+        }
+#endif
+
+        /* report suspend to the driver */
+        if (dev->driver) {
+                if (dev->driver->suspend) {
+                        spin_unlock(&dev->lock);
+                        dev->driver->suspend(&dev->gadget);
+                        spin_lock(&dev->lock);
+                        dev_dbg(&dev->pdev->dev, "suspend %s\n",
+                                        dev->driver->driver.name);
+                }
+        }
+
+        /* enter PHY low power suspend */
+        if (dev->pdev->device != 0x0829)
+                langwell_phy_low_power(dev, 0);
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+static void handle_bus_resume(struct langwell_udc *dev)
+{
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        dev->usb_state = dev->resume_state;
+        dev->resume_state = 0;
+
+        /* exit PHY low power suspend */
+        if (dev->pdev->device != 0x0829)
+                langwell_phy_low_power(dev, 0);
+
+#ifdef  OTG_TRANSCEIVER
+        if (dev->lotg->otg.default_a == 0)
+                dev->lotg->hsm.a_bus_suspend = 0;
+#endif
+
+        /* report resume to the driver */
+        if (dev->driver) {
+                if (dev->driver->resume) {
+                        spin_unlock(&dev->lock);
+                        dev->driver->resume(&dev->gadget);
+                        spin_lock(&dev->lock);
+                        dev_dbg(&dev->pdev->dev, "resume %s\n",
+                                        dev->driver->driver.name);
+                }
+        }
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* USB device controller interrupt handler */
+static irqreturn_t langwell_irq(int irq, void *_dev)
+{
+        struct langwell_udc     *dev = _dev;
+        u32                     usbsts,
+                                usbintr,
+                                irq_sts,
+                                portsc1;
+
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        if (dev->stopped) {
+                dev_vdbg(&dev->pdev->dev, "handle IRQ_NONE\n");
+                dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+                return IRQ_NONE;
+        }
+
+        spin_lock(&dev->lock);
+
+        /* USB status */
+        usbsts = readl(&dev->op_regs->usbsts);
+
+        /* USB interrupt enable */
+        usbintr = readl(&dev->op_regs->usbintr);
+
+        irq_sts = usbsts & usbintr;
+        dev_vdbg(&dev->pdev->dev,
+                        "usbsts = 0x%08x, usbintr = 0x%08x, irq_sts = 0x%08x\n",
+                        usbsts, usbintr, irq_sts);
+
+        if (!irq_sts) {
+                dev_vdbg(&dev->pdev->dev, "handle IRQ_NONE\n");
+                dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+                spin_unlock(&dev->lock);
+                return IRQ_NONE;
+        }
+
+        /* Write-Clear interrupt status bits */
+        writel(irq_sts, &dev->op_regs->usbsts);
+
+        /* resume from suspend */
+        portsc1 = readl(&dev->op_regs->portsc1);
+        if (dev->usb_state == USB_STATE_SUSPENDED)
+                if (!(portsc1 & PORTS_SUSP))
+                        handle_bus_resume(dev);
+
+        /* USB interrupt */
+        if (irq_sts & STS_UI) {
+                dev_vdbg(&dev->pdev->dev, "USB interrupt\n");
+
+                /* setup packet received from ep0 */
+                if (readl(&dev->op_regs->endptsetupstat)
+                                & EP0SETUPSTAT_MASK) {
+                        dev_vdbg(&dev->pdev->dev,
+                                "USB SETUP packet received interrupt\n");
+                        /* setup tripwire semaphone */
+                        setup_tripwire(dev);
+                        handle_setup_packet(dev, &dev->local_setup_buff);
+                }
+
+                /* USB transfer completion */
+                if (readl(&dev->op_regs->endptcomplete)) {
+                        dev_vdbg(&dev->pdev->dev,
+                                "USB transfer completion interrupt\n");
+                        handle_trans_complete(dev);
+                }
+        }
+
+        /* SOF received interrupt (for ISO transfer) */
+        if (irq_sts & STS_SRI) {
+                /* FIXME */
+                /* dev_vdbg(&dev->pdev->dev, "SOF received interrupt\n"); */
+        }
+
+        /* port change detect interrupt */
+        if (irq_sts & STS_PCI) {
+                dev_vdbg(&dev->pdev->dev, "port change detect interrupt\n");
+                handle_port_change(dev);
+        }
+
+        /* suspend interrrupt */
+        if (irq_sts & STS_SLI) {
+                dev_vdbg(&dev->pdev->dev, "suspend interrupt\n");
+                handle_bus_suspend(dev);
+        }
+
+        /* USB reset interrupt */
+        if (irq_sts & STS_URI) {
+                dev_vdbg(&dev->pdev->dev, "USB reset interrupt\n");
+                handle_usb_reset(dev);
+        }
+
+        /* USB error or system error interrupt */
+        if (irq_sts & (STS_UEI | STS_SEI)) {
+                /* FIXME */
+                dev_warn(&dev->pdev->dev, "error IRQ, irq_sts: %x\n", irq_sts);
+        }
+
+        spin_unlock(&dev->lock);
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return IRQ_HANDLED;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* release device structure */
+static void gadget_release(struct device *_dev)
+{
+        struct langwell_udc     *dev = the_controller;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        complete(dev->done);
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        kfree(dev);
+}
+
+
+/* enable SRAM caching if SRAM detected */
+static void sram_init(struct langwell_udc *dev)
+{
+        struct pci_dev          *pdev = dev->pdev;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        dev->sram_addr = pci_resource_start(pdev, 1);
+        dev->sram_size = pci_resource_len(pdev, 1);
+        dev_info(&dev->pdev->dev, "Found private SRAM at %x size:%x\n",
+                        dev->sram_addr, dev->sram_size);
+        dev->got_sram = 1;
+
+        if (pci_request_region(pdev, 1, kobject_name(&pdev->dev.kobj))) {
+                dev_warn(&dev->pdev->dev, "SRAM request failed\n");
+                dev->got_sram = 0;
+        } else if (!dma_declare_coherent_memory(&pdev->dev, dev->sram_addr,
+                        dev->sram_addr, dev->sram_size, DMA_MEMORY_MAP)) {
+                dev_warn(&dev->pdev->dev, "SRAM DMA declare failed\n");
+                pci_release_region(pdev, 1);
+                dev->got_sram = 0;
+        }
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* release SRAM caching */
+static void sram_deinit(struct langwell_udc *dev)
+{
+        struct pci_dev *pdev = dev->pdev;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        dma_release_declared_memory(&pdev->dev);
+        pci_release_region(pdev, 1);
+
+        dev->got_sram = 0;
+
+        dev_info(&dev->pdev->dev, "release SRAM caching\n");
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* tear down the binding between this driver and the pci device */
+static void langwell_udc_remove(struct pci_dev *pdev)
+{
+        struct langwell_udc     *dev = the_controller;
+
+        DECLARE_COMPLETION(done);
+
+        BUG_ON(dev->driver);
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        dev->done = &done;
+
+#ifndef OTG_TRANSCEIVER
+        /* free dTD dma_pool and dQH */
+        if (dev->dtd_pool)
+                dma_pool_destroy(dev->dtd_pool);
+
+        if (dev->ep_dqh)
+                dma_free_coherent(&pdev->dev, dev->ep_dqh_size,
+                        dev->ep_dqh, dev->ep_dqh_dma);
+
+        /* release SRAM caching */
+        if (dev->has_sram && dev->got_sram)
+                sram_deinit(dev);
+#endif
+
+        if (dev->status_req) {
+                kfree(dev->status_req->req.buf);
+                kfree(dev->status_req);
+        }
+
+        kfree(dev->ep);
+
+        /* disable IRQ handler */
+        if (dev->got_irq)
+                free_irq(pdev->irq, dev);
+
+#ifndef OTG_TRANSCEIVER
+        if (dev->cap_regs)
+                iounmap(dev->cap_regs);
+
+        if (dev->region)
+                release_mem_region(pci_resource_start(pdev, 0),
+                                pci_resource_len(pdev, 0));
+
+        if (dev->enabled)
+                pci_disable_device(pdev);
+#else
+        if (dev->transceiver) {
+                otg_put_transceiver(dev->transceiver);
+                dev->transceiver = NULL;
+                dev->lotg = NULL;
+        }
+#endif
+
+        dev->cap_regs = NULL;
+
+        dev_info(&dev->pdev->dev, "unbind\n");
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+
+        device_unregister(&dev->gadget.dev);
+        device_remove_file(&pdev->dev, &dev_attr_langwell_udc);
+        device_remove_file(&pdev->dev, &dev_attr_remote_wakeup);
+
+#ifndef OTG_TRANSCEIVER
+        pci_set_drvdata(pdev, NULL);
+#endif
+
+        /* free dev, wait for the release() finished */
+        wait_for_completion(&done);
+
+        the_controller = NULL;
+}
+
+
+/*
+ * wrap this driver around the specified device, but
+ * don't respond over USB until a gadget driver binds to us.
+ */
+static int langwell_udc_probe(struct pci_dev *pdev,
+                const struct pci_device_id *id)
+{
+        struct langwell_udc     *dev;
+#ifndef OTG_TRANSCEIVER
+        unsigned long           resource, len;
+#endif
+        void                    __iomem *base = NULL;
+        size_t                  size;
+        int                     retval;
+
+        if (the_controller) {
+                dev_warn(&pdev->dev, "ignoring\n");
+                return -EBUSY;
+        }
+
+        /* alloc, and start init */
+        dev = kzalloc(sizeof *dev, GFP_KERNEL);
+        if (dev == NULL) {
+                retval = -ENOMEM;
+                goto error;
+        }
+
+        /* initialize device spinlock */
+        spin_lock_init(&dev->lock);
+
+        dev->pdev = pdev;
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+#ifdef  OTG_TRANSCEIVER
+        /* PCI device is already enabled by otg_transceiver driver */
+        dev->enabled = 1;
+
+        /* mem region and register base */
+        dev->region = 1;
+        dev->transceiver = otg_get_transceiver();
+        dev->lotg = otg_to_langwell(dev->transceiver);
+        base = dev->lotg->regs;
+#else
+        pci_set_drvdata(pdev, dev);
+
+        /* now all the pci goodies ... */
+        if (pci_enable_device(pdev) < 0) {
+                retval = -ENODEV;
+                goto error;
+        }
+        dev->enabled = 1;
+
+        /* control register: BAR 0 */
+        resource = pci_resource_start(pdev, 0);
+        len = pci_resource_len(pdev, 0);
+        if (!request_mem_region(resource, len, driver_name)) {
+                dev_err(&dev->pdev->dev, "controller already in use\n");
+                retval = -EBUSY;
+                goto error;
+        }
+        dev->region = 1;
+
+        base = ioremap_nocache(resource, len);
+#endif
+        if (base == NULL) {
+                dev_err(&dev->pdev->dev, "can't map memory\n");
+                retval = -EFAULT;
+                goto error;
+        }
+
+        dev->cap_regs = (struct langwell_cap_regs __iomem *) base;
+        dev_vdbg(&dev->pdev->dev, "dev->cap_regs: %p\n", dev->cap_regs);
+        dev->op_regs = (struct langwell_op_regs __iomem *)
+                (base + OP_REG_OFFSET);
+        dev_vdbg(&dev->pdev->dev, "dev->op_regs: %p\n", dev->op_regs);
+
+        /* irq setup after old hardware is cleaned up */
+        if (!pdev->irq) {
+                dev_err(&dev->pdev->dev, "No IRQ. Check PCI setup!\n");
+                retval = -ENODEV;
+                goto error;
+        }
+
+        dev->has_sram = 1;
+        dev->got_sram = 0;
+        dev_vdbg(&dev->pdev->dev, "dev->has_sram: %d\n", dev->has_sram);
+
+#ifndef OTG_TRANSCEIVER
+        /* enable SRAM caching if detected */
+        if (dev->has_sram && !dev->got_sram)
+                sram_init(dev);
+
+        dev_info(&dev->pdev->dev,
+                        "irq %d, io mem: 0x%08lx, len: 0x%08lx, pci mem 0x%p\n",
+                        pdev->irq, resource, len, base);
+        /* enables bus-mastering for device dev */
+        pci_set_master(pdev);
+
+        if (request_irq(pdev->irq, langwell_irq, IRQF_SHARED,
+                                driver_name, dev) != 0) {
+                dev_err(&dev->pdev->dev,
+                                "request interrupt %d failed\n", pdev->irq);
+                retval = -EBUSY;
+                goto error;
+        }
+        dev->got_irq = 1;
+#endif
+
+        /* set stopped bit */
+        dev->stopped = 1;
+
+        /* capabilities and endpoint number */
+        dev->lpm = (readl(&dev->cap_regs->hccparams) & HCC_LEN) ? 1 : 0;
+        dev->dciversion = readw(&dev->cap_regs->dciversion);
+        dev->devcap = (readl(&dev->cap_regs->dccparams) & DEVCAP) ? 1 : 0;
+        dev_vdbg(&dev->pdev->dev, "dev->lpm: %d\n", dev->lpm);
+        dev_vdbg(&dev->pdev->dev, "dev->dciversion: 0x%04x\n",
+                        dev->dciversion);
+        dev_vdbg(&dev->pdev->dev, "dccparams: 0x%08x\n",
+                        readl(&dev->cap_regs->dccparams));
+        dev_vdbg(&dev->pdev->dev, "dev->devcap: %d\n", dev->devcap);
+        if (!dev->devcap) {
+                dev_err(&dev->pdev->dev, "can't support device mode\n");
+                retval = -ENODEV;
+                goto error;
+        }
+
+        /* a pair of endpoints (out/in) for each address */
+        dev->ep_max = DEN(readl(&dev->cap_regs->dccparams)) * 2;
+        dev_vdbg(&dev->pdev->dev, "dev->ep_max: %d\n", dev->ep_max);
+
+        /* allocate endpoints memory */
+        dev->ep = kzalloc(sizeof(struct langwell_ep) * dev->ep_max,
+                        GFP_KERNEL);
+        if (!dev->ep) {
+                dev_err(&dev->pdev->dev, "allocate endpoints memory failed\n");
+                retval = -ENOMEM;
+                goto error;
+        }
+
+        /* allocate device dQH memory */
+        size = dev->ep_max * sizeof(struct langwell_dqh);
+        dev_vdbg(&dev->pdev->dev, "orig size = %zd\n", size);
+        if (size < DQH_ALIGNMENT)
+                size = DQH_ALIGNMENT;
+        else if ((size % DQH_ALIGNMENT) != 0) {
+                size += DQH_ALIGNMENT + 1;
+                size &= ~(DQH_ALIGNMENT - 1);
+        }
+        dev->ep_dqh = dma_alloc_coherent(&pdev->dev, size,
+                                        &dev->ep_dqh_dma, GFP_KERNEL);
+        if (!dev->ep_dqh) {
+                dev_err(&dev->pdev->dev, "allocate dQH memory failed\n");
+                retval = -ENOMEM;
+                goto error;
+        }
+        dev->ep_dqh_size = size;
+        dev_vdbg(&dev->pdev->dev, "ep_dqh_size = %zd\n", dev->ep_dqh_size);
+
+        /* initialize ep0 status request structure */
+        dev->status_req = kzalloc(sizeof(struct langwell_request), GFP_KERNEL);
+        if (!dev->status_req) {
+                dev_err(&dev->pdev->dev,
+                                "allocate status_req memory failed\n");
+                retval = -ENOMEM;
+                goto error;
+        }
+        INIT_LIST_HEAD(&dev->status_req->queue);
+
+        /* allocate a small amount of memory to get valid address */
+        dev->status_req->req.buf = kmalloc(8, GFP_KERNEL);
+        dev->status_req->req.dma = virt_to_phys(dev->status_req->req.buf);
+
+        dev->resume_state = USB_STATE_NOTATTACHED;
+        dev->usb_state = USB_STATE_POWERED;
+        dev->ep0_dir = USB_DIR_OUT;
+
+        /* remote wakeup reset to 0 when the device is reset */
+        dev->remote_wakeup = 0;
+        dev->dev_status = 1 << USB_DEVICE_SELF_POWERED;
+
+#ifndef OTG_TRANSCEIVER
+        /* reset device controller */
+        langwell_udc_reset(dev);
+#endif
+
+        /* initialize gadget structure */
+        dev->gadget.ops = &langwell_ops;        /* usb_gadget_ops */
+        dev->gadget.ep0 = &dev->ep[0].ep;       /* gadget ep0 */
+        INIT_LIST_HEAD(&dev->gadget.ep_list);   /* ep_list */
+        dev->gadget.speed = USB_SPEED_UNKNOWN;  /* speed */
+        dev->gadget.is_dualspeed = 1;           /* support dual speed */
+#ifdef  OTG_TRANSCEIVER
+        dev->gadget.is_otg = 1;                 /* support otg mode */
+#endif
+
+        /* the "gadget" abstracts/virtualizes the controller */
+        dev_set_name(&dev->gadget.dev, "gadget");
+        dev->gadget.dev.parent = &pdev->dev;
+        dev->gadget.dev.dma_mask = pdev->dev.dma_mask;
+        dev->gadget.dev.release = gadget_release;
+        dev->gadget.name = driver_name;         /* gadget name */
+
+        /* controller endpoints reinit */
+        eps_reinit(dev);
+
+#ifndef OTG_TRANSCEIVER
+        /* reset ep0 dQH and endptctrl */
+        ep0_reset(dev);
+#endif
+
+        /* create dTD dma_pool resource */
+        dev->dtd_pool = dma_pool_create("langwell_dtd",
+                        &dev->pdev->dev,
+                        sizeof(struct langwell_dtd),
+                        DTD_ALIGNMENT,
+                        DMA_BOUNDARY);
+
+        if (!dev->dtd_pool) {
+                retval = -ENOMEM;
+                goto error;
+        }
+
+        /* done */
+        dev_info(&dev->pdev->dev, "%s\n", driver_desc);
+        dev_info(&dev->pdev->dev, "irq %d, pci mem %p\n", pdev->irq, base);
+        dev_info(&dev->pdev->dev, "Driver version: " DRIVER_VERSION "\n");
+        dev_info(&dev->pdev->dev, "Support (max) %d endpoints\n", dev->ep_max);
+        dev_info(&dev->pdev->dev, "Device interface version: 0x%04x\n",
+                        dev->dciversion);
+        dev_info(&dev->pdev->dev, "Controller mode: %s\n",
+                        dev->devcap ? "Device" : "Host");
+        dev_info(&dev->pdev->dev, "Support USB LPM: %s\n",
+                        dev->lpm ? "Yes" : "No");
+
+        dev_vdbg(&dev->pdev->dev,
+                        "After langwell_udc_probe(), print all registers:\n");
+        print_all_registers(dev);
+
+        the_controller = dev;
+
+        retval = device_register(&dev->gadget.dev);
+        if (retval)
+                goto error;
+
+        retval = usb_add_gadget_udc(&pdev->dev, &dev->gadget);
+        if (retval)
+                goto error;
+
+        retval = device_create_file(&pdev->dev, &dev_attr_langwell_udc);
+        if (retval)
+                goto error;
+
+        retval = device_create_file(&pdev->dev, &dev_attr_remote_wakeup);
+        if (retval)
+                goto error_attr1;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+
+error_attr1:
+        device_remove_file(&pdev->dev, &dev_attr_langwell_udc);
+error:
+        if (dev) {
+                dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+                langwell_udc_remove(pdev);
+        }
+
+        return retval;
+}
+
+
+/* device controller suspend */
+static int langwell_udc_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+        struct langwell_udc     *dev = the_controller;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        usb_del_gadget_udc(&dev->gadget);
+        /* disable interrupt and set controller to stop state */
+        langwell_udc_stop(dev);
+
+        /* disable IRQ handler */
+        if (dev->got_irq)
+                free_irq(pdev->irq, dev);
+        dev->got_irq = 0;
+
+        /* save PCI state */
+        pci_save_state(pdev);
+
+        spin_lock_irq(&dev->lock);
+        /* stop all usb activities */
+        stop_activity(dev, dev->driver);
+        spin_unlock_irq(&dev->lock);
+
+        /* free dTD dma_pool and dQH */
+        if (dev->dtd_pool)
+                dma_pool_destroy(dev->dtd_pool);
+
+        if (dev->ep_dqh)
+                dma_free_coherent(&pdev->dev, dev->ep_dqh_size,
+                        dev->ep_dqh, dev->ep_dqh_dma);
+
+        /* release SRAM caching */
+        if (dev->has_sram && dev->got_sram)
+                sram_deinit(dev);
+
+        /* set device power state */
+        pci_set_power_state(pdev, PCI_D3hot);
+
+        /* enter PHY low power suspend */
+        if (dev->pdev->device != 0x0829)
+                langwell_phy_low_power(dev, 1);
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+
+/* device controller resume */
+static int langwell_udc_resume(struct pci_dev *pdev)
+{
+        struct langwell_udc     *dev = the_controller;
+        size_t                  size;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* exit PHY low power suspend */
+        if (dev->pdev->device != 0x0829)
+                langwell_phy_low_power(dev, 0);
+
+        /* set device D0 power state */
+        pci_set_power_state(pdev, PCI_D0);
+
+        /* enable SRAM caching if detected */
+        if (dev->has_sram && !dev->got_sram)
+                sram_init(dev);
+
+        /* allocate device dQH memory */
+        size = dev->ep_max * sizeof(struct langwell_dqh);
+        dev_vdbg(&dev->pdev->dev, "orig size = %zd\n", size);
+        if (size < DQH_ALIGNMENT)
+                size = DQH_ALIGNMENT;
+        else if ((size % DQH_ALIGNMENT) != 0) {
+                size += DQH_ALIGNMENT + 1;
+                size &= ~(DQH_ALIGNMENT - 1);
+        }
+        dev->ep_dqh = dma_alloc_coherent(&pdev->dev, size,
+                                        &dev->ep_dqh_dma, GFP_KERNEL);
+        if (!dev->ep_dqh) {
+                dev_err(&dev->pdev->dev, "allocate dQH memory failed\n");
+                return -ENOMEM;
+        }
+        dev->ep_dqh_size = size;
+        dev_vdbg(&dev->pdev->dev, "ep_dqh_size = %zd\n", dev->ep_dqh_size);
+
+        /* create dTD dma_pool resource */
+        dev->dtd_pool = dma_pool_create("langwell_dtd",
+                        &dev->pdev->dev,
+                        sizeof(struct langwell_dtd),
+                        DTD_ALIGNMENT,
+                        DMA_BOUNDARY);
+
+        if (!dev->dtd_pool)
+                return -ENOMEM;
+
+        /* restore PCI state */
+        pci_restore_state(pdev);
+
+        /* enable IRQ handler */
+        if (request_irq(pdev->irq, langwell_irq, IRQF_SHARED,
+                                driver_name, dev) != 0) {
+                dev_err(&dev->pdev->dev, "request interrupt %d failed\n",
+                                pdev->irq);
+                return -EBUSY;
+        }
+        dev->got_irq = 1;
+
+        /* reset and start controller to run state */
+        if (dev->stopped) {
+                /* reset device controller */
+                langwell_udc_reset(dev);
+
+                /* reset ep0 dQH and endptctrl */
+                ep0_reset(dev);
+
+                /* start device if gadget is loaded */
+                if (dev->driver)
+                        langwell_udc_start(dev);
+        }
+
+        /* reset USB status */
+        dev->usb_state = USB_STATE_ATTACHED;
+        dev->ep0_state = WAIT_FOR_SETUP;
+        dev->ep0_dir = USB_DIR_OUT;
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+        return 0;
+}
+
+
+/* pci driver shutdown */
+static void langwell_udc_shutdown(struct pci_dev *pdev)
+{
+        struct langwell_udc     *dev = the_controller;
+        u32                     usbmode;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        /* reset controller mode to IDLE */
+        usbmode = readl(&dev->op_regs->usbmode);
+        dev_dbg(&dev->pdev->dev, "usbmode = 0x%08x\n", usbmode);
+        usbmode &= (~3 | MODE_IDLE);
+        writel(usbmode, &dev->op_regs->usbmode);
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+/*-------------------------------------------------------------------------*/
+
+static const struct pci_device_id pci_ids[] = { {
+        .class =        ((PCI_CLASS_SERIAL_USB << 8) | 0xfe),
+        .class_mask =   ~0,
+        .vendor =       0x8086,
+        .device =       0x0811,
+        .subvendor =    PCI_ANY_ID,
+        .subdevice =    PCI_ANY_ID,
+}, { /* end: all zeroes */ }
+};
+
+MODULE_DEVICE_TABLE(pci, pci_ids);
+
+
+static struct pci_driver langwell_pci_driver = {
+        .name =         (char *) driver_name,
+        .id_table =     pci_ids,
+
+        .probe =        langwell_udc_probe,
+        .remove =       langwell_udc_remove,
+
+        /* device controller suspend/resume */
+        .suspend =      langwell_udc_suspend,
+        .resume =       langwell_udc_resume,
+
+        .shutdown =     langwell_udc_shutdown,
+};
+
+
+static int __init init(void)
+{
+#ifdef  OTG_TRANSCEIVER
+        return langwell_register_peripheral(&langwell_pci_driver);
+#else
+        return pci_register_driver(&langwell_pci_driver);
+#endif
+}
+module_init(init);
+
+
+static void __exit cleanup(void)
+{
+#ifdef  OTG_TRANSCEIVER
+        return langwell_unregister_peripheral(&langwell_pci_driver);
+#else
+        pci_unregister_driver(&langwell_pci_driver);
+#endif
+}
+module_exit(cleanup);
+
+
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_AUTHOR("Xiaochen Shen <xiaochen.shen@intel.com>");
+MODULE_VERSION(DRIVER_VERSION);
+MODULE_LICENSE("GPL");
+
diff --git a/drivers/usb/gadget/langwell_udc.h b/drivers/usb/gadget/langwell_udc.h
new file mode 100644
index 00000000000..f1d9c1bb04f
--- /dev/null
+++ b/drivers/usb/gadget/langwell_udc.h
@@ -0,0 +1,233 @@
+/*
+ * Intel Langwell USB Device Controller driver
+ * Copyright (C) 2008-2009, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <linux/usb/langwell_udc.h>
+#include <linux/usb/langwell_otg.h>
+
+/*-------------------------------------------------------------------------*/
+
+/* driver data structures and utilities */
+
+/*
+ * dTD: Device Endpoint Transfer Descriptor
+ * describe to the device controller the location and quantity of
+ * data to be send/received for given transfer
+ */
+struct langwell_dtd {
+        u32     dtd_next;
+/* bits 31:5, next transfer element pointer */
+#define DTD_NEXT(d)     (((d)>>5)&0x7ffffff)
+#define DTD_NEXT_MASK   (0x7ffffff << 5)
+/* terminate */
+#define DTD_TERM        BIT(0)
+        /* bits 7:0, execution back states */
+        u32     dtd_status:8;
+#define DTD_STATUS(d)   (((d)>>0)&0xff)
+#define DTD_STS_ACTIVE  BIT(7)  /* active */
+#define DTD_STS_HALTED  BIT(6)  /* halted */
+#define DTD_STS_DBE     BIT(5)  /* data buffer error */
+#define DTD_STS_TRE     BIT(3)  /* transaction error  */
+        /* bits 9:8 */
+        u32     dtd_res0:2;
+        /* bits 11:10, multipier override */
+        u32     dtd_multo:2;
+#define DTD_MULTO       (BIT(11) | BIT(10))
+        /* bits 14:12 */
+        u32     dtd_res1:3;
+        /* bit 15, interrupt on complete */
+        u32     dtd_ioc:1;
+#define DTD_IOC         BIT(15)
+        /* bits 30:16, total bytes */
+        u32     dtd_total:15;
+#define DTD_TOTAL(d)    (((d)>>16)&0x7fff)
+#define DTD_MAX_TRANSFER_LENGTH 0x4000
+        /* bit 31 */
+        u32     dtd_res2:1;
+        /* dTD buffer pointer page 0 to 4 */
+        u32     dtd_buf[5];
+#define DTD_OFFSET_MASK 0xfff
+/* bits 31:12, buffer pointer */
+#define DTD_BUFFER(d)   (((d)>>12)&0x3ff)
+/* bits 11:0, current offset */
+#define DTD_C_OFFSET(d) (((d)>>0)&0xfff)
+/* bits 10:0, frame number */
+#define DTD_FRAME(d)    (((d)>>0)&0x7ff)
+
+        /* driver-private parts */
+
+        /* dtd dma address */
+        dma_addr_t              dtd_dma;
+        /* next dtd virtual address */
+        struct langwell_dtd     *next_dtd_virt;
+};
+
+
+/*
+ * dQH: Device Endpoint Queue Head
+ * describe where all transfers are managed
+ * 48-byte data structure, aligned on 64-byte boundary
+ *
+ * These are associated with dTD structure
+ */
+struct langwell_dqh {
+        /* endpoint capabilities and characteristics */
+        u32     dqh_res0:15;    /* bits 14:0 */
+        u32     dqh_ios:1;      /* bit 15, interrupt on setup */
+#define DQH_IOS         BIT(15)
+        u32     dqh_mpl:11;     /* bits 26:16, maximum packet length */
+#define DQH_MPL         (0x7ff << 16)
+        u32     dqh_res1:2;     /* bits 28:27 */
+        u32     dqh_zlt:1;      /* bit 29, zero length termination */
+#define DQH_ZLT         BIT(29)
+        u32     dqh_mult:2;     /* bits 31:30 */
+#define DQH_MULT        (BIT(30) | BIT(31))
+
+        /* current dTD pointer */
+        u32     dqh_current;    /* locate the transfer in progress */
+#define DQH_C_DTD(e)    \
+        (((e)>>5)&0x7ffffff)    /* bits 31:5, current dTD pointer */
+
+        /* transfer overlay, hardware parts of a struct langwell_dtd */
+        u32     dtd_next;
+        u32     dtd_status:8;   /* bits 7:0, execution back states */
+        u32     dtd_res0:2;     /* bits 9:8 */
+        u32     dtd_multo:2;    /* bits 11:10, multipier override */
+        u32     dtd_res1:3;     /* bits 14:12 */
+        u32     dtd_ioc:1;      /* bit 15, interrupt on complete */
+        u32     dtd_total:15;   /* bits 30:16, total bytes */
+        u32     dtd_res2:1;     /* bit 31 */
+        u32     dtd_buf[5];     /* dTD buffer pointer page 0 to 4 */
+
+        u32     dqh_res2;
+        struct usb_ctrlrequest  dqh_setup;      /* setup packet buffer */
+} __attribute__ ((aligned(64)));
+
+
+/* endpoint data structure */
+struct langwell_ep {
+        struct usb_ep           ep;
+        dma_addr_t              dma;
+        struct langwell_udc     *dev;
+        unsigned long           irqs;
+        struct list_head        queue;
+        struct langwell_dqh     *dqh;
+        const struct usb_endpoint_descriptor    *desc;
+        char                    name[14];
+        unsigned                stopped:1,
+                                ep_type:2,
+                                ep_num:8;
+};
+
+
+/* request data structure */
+struct langwell_request {
+        struct usb_request      req;
+        struct langwell_dtd     *dtd, *head, *tail;
+        struct langwell_ep      *ep;
+        dma_addr_t              dtd_dma;
+        struct list_head        queue;
+        unsigned                dtd_count;
+        unsigned                mapped:1;
+};
+
+
+/* ep0 transfer state */
+enum ep0_state {
+        WAIT_FOR_SETUP,
+        DATA_STATE_XMIT,
+        DATA_STATE_NEED_ZLP,
+        WAIT_FOR_OUT_STATUS,
+        DATA_STATE_RECV,
+};
+
+
+/* device suspend state */
+enum lpm_state {
+        LPM_L0, /* on */
+        LPM_L1, /* LPM L1 sleep */
+        LPM_L2, /* suspend */
+        LPM_L3, /* off */
+};
+
+
+/* device data structure */
+struct langwell_udc {
+        /* each pci device provides one gadget, several endpoints */
+        struct usb_gadget       gadget;
+        spinlock_t              lock;   /* device lock */
+        struct langwell_ep      *ep;
+        struct usb_gadget_driver        *driver;
+        struct otg_transceiver  *transceiver;
+        u8                      dev_addr;
+        u32                     usb_state;
+        u32                     resume_state;
+        u32                     bus_reset;
+        enum lpm_state          lpm_state;
+        enum ep0_state          ep0_state;
+        u32                     ep0_dir;
+        u16                     dciversion;
+        unsigned                ep_max;
+        unsigned                devcap:1,
+                                enabled:1,
+                                region:1,
+                                got_irq:1,
+                                powered:1,
+                                remote_wakeup:1,
+                                rate:1,
+                                is_reset:1,
+                                softconnected:1,
+                                vbus_active:1,
+                                suspended:1,
+                                stopped:1,
+                                lpm:1,          /* LPM capability */
+                                has_sram:1,     /* SRAM caching */
+                                got_sram:1;
+
+        /* pci state used to access those endpoints */
+        struct pci_dev          *pdev;
+
+        /* Langwell otg transceiver */
+        struct langwell_otg     *lotg;
+
+        /* control registers */
+        struct langwell_cap_regs        __iomem *cap_regs;
+        struct langwell_op_regs         __iomem *op_regs;
+
+        struct usb_ctrlrequest  local_setup_buff;
+        struct langwell_dqh     *ep_dqh;
+        size_t                  ep_dqh_size;
+        dma_addr_t              ep_dqh_dma;
+
+        /* ep0 status request */
+        struct langwell_request *status_req;
+
+        /* dma pool */
+        struct dma_pool         *dtd_pool;
+
+        /* make sure release() is done */
+        struct completion       *done;
+
+        /* for private SRAM caching */
+        unsigned int            sram_addr;
+        unsigned int            sram_size;
+
+        /* device status data for get_status request */
+        u16                     dev_status;
+};
+
diff --git a/drivers/usb/gadget/mv_udc_phy.c b/drivers/usb/gadget/mv_udc_phy.c
new file mode 100644
index 00000000000..d4dea97e38a
--- /dev/null
+++ b/drivers/usb/gadget/mv_udc_phy.c
@@ -0,0 +1,214 @@
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/io.h>
+#include <linux/errno.h>
+
+#include <mach/cputype.h>
+
+#ifdef CONFIG_ARCH_MMP
+
+#define UTMI_REVISION           0x0
+#define UTMI_CTRL               0x4
+#define UTMI_PLL                0x8
+#define UTMI_TX                 0xc
+#define UTMI_RX                 0x10
+#define UTMI_IVREF              0x14
+#define UTMI_T0                 0x18
+#define UTMI_T1                 0x1c
+#define UTMI_T2                 0x20
+#define UTMI_T3                 0x24
+#define UTMI_T4                 0x28
+#define UTMI_T5                 0x2c
+#define UTMI_RESERVE            0x30
+#define UTMI_USB_INT            0x34
+#define UTMI_DBG_CTL            0x38
+#define UTMI_OTG_ADDON          0x3c
+
+/* For UTMICTRL Register */
+#define UTMI_CTRL_USB_CLK_EN                    (1 << 31)
+/* pxa168 */
+#define UTMI_CTRL_SUSPEND_SET1                  (1 << 30)
+#define UTMI_CTRL_SUSPEND_SET2                  (1 << 29)
+#define UTMI_CTRL_RXBUF_PDWN                    (1 << 24)
+#define UTMI_CTRL_TXBUF_PDWN                    (1 << 11)
+
+#define UTMI_CTRL_INPKT_DELAY_SHIFT             30
+#define UTMI_CTRL_INPKT_DELAY_SOF_SHIFT         28
+#define UTMI_CTRL_PU_REF_SHIFT                  20
+#define UTMI_CTRL_ARC_PULLDN_SHIFT              12
+#define UTMI_CTRL_PLL_PWR_UP_SHIFT              1
+#define UTMI_CTRL_PWR_UP_SHIFT                  0
+/* For UTMI_PLL Register */
+#define UTMI_PLL_CLK_BLK_EN_SHIFT               24
+#define UTMI_PLL_FBDIV_SHIFT                    4
+#define UTMI_PLL_REFDIV_SHIFT                   0
+#define UTMI_PLL_FBDIV_MASK                     0x00000FF0
+#define UTMI_PLL_REFDIV_MASK                    0x0000000F
+#define UTMI_PLL_ICP_MASK                       0x00007000
+#define UTMI_PLL_KVCO_MASK                      0x00031000
+#define UTMI_PLL_PLLCALI12_SHIFT                29
+#define UTMI_PLL_PLLCALI12_MASK                 (0x3 << 29)
+#define UTMI_PLL_PLLVDD18_SHIFT                 27
+#define UTMI_PLL_PLLVDD18_MASK                  (0x3 << 27)
+#define UTMI_PLL_PLLVDD12_SHIFT                 25
+#define UTMI_PLL_PLLVDD12_MASK                  (0x3 << 25)
+#define UTMI_PLL_KVCO_SHIFT                     15
+#define UTMI_PLL_ICP_SHIFT                      12
+/* For UTMI_TX Register */
+#define UTMI_TX_REG_EXT_FS_RCAL_SHIFT           27
+#define UTMI_TX_REG_EXT_FS_RCAL_MASK            (0xf << 27)
+#define UTMI_TX_REG_EXT_FS_RCAL_EN_MASK         26
+#define UTMI_TX_REG_EXT_FS_RCAL_EN              (0x1 << 26)
+#define UTMI_TX_LOW_VDD_EN_SHIFT                11
+#define UTMI_TX_IMPCAL_VTH_SHIFT                14
+#define UTMI_TX_IMPCAL_VTH_MASK                 (0x7 << 14)
+#define UTMI_TX_CK60_PHSEL_SHIFT                17
+#define UTMI_TX_CK60_PHSEL_MASK                 (0xf << 17)
+#define UTMI_TX_TXVDD12_SHIFT                   22
+#define UTMI_TX_TXVDD12_MASK                    (0x3 << 22)
+#define UTMI_TX_AMP_SHIFT                       0
+#define UTMI_TX_AMP_MASK                        (0x7 << 0)
+/* For UTMI_RX Register */
+#define UTMI_RX_SQ_THRESH_SHIFT                 4
+#define UTMI_RX_SQ_THRESH_MASK                  (0xf << 4)
+#define UTMI_REG_SQ_LENGTH_SHIFT                15
+#define UTMI_REG_SQ_LENGTH_MASK                 (0x3 << 15)
+
+#define REG_RCAL_START                          0x00001000
+#define VCOCAL_START                            0x00200000
+#define KVCO_EXT                                0x00400000
+#define PLL_READY                               0x00800000
+#define CLK_BLK_EN                              0x01000000
+#endif
+
+static unsigned int u2o_read(unsigned int base, unsigned int offset)
+{
+        return readl(base + offset);
+}
+
+static void u2o_set(unsigned int base, unsigned int offset, unsigned int value)
+{
+        unsigned int reg;
+
+        reg = readl(base + offset);
+        reg |= value;
+        writel(reg, base + offset);
+        readl(base + offset);
+}
+
+static void u2o_clear(unsigned int base, unsigned int offset,
+        unsigned int value)
+{
+        unsigned int reg;
+
+        reg = readl(base + offset);
+        reg &= ~value;
+        writel(reg, base + offset);
+        readl(base + offset);
+}
+
+static void u2o_write(unsigned int base, unsigned int offset,
+        unsigned int value)
+{
+        writel(value, base + offset);
+        readl(base + offset);
+}
+
+#ifdef CONFIG_ARCH_MMP
+int mv_udc_phy_init(unsigned int base)
+{
+        unsigned long timeout;
+
+        /* Initialize the USB PHY power */
+        if (cpu_is_pxa910()) {
+                u2o_set(base, UTMI_CTRL, (1 << UTMI_CTRL_INPKT_DELAY_SOF_SHIFT)
+                        | (1 << UTMI_CTRL_PU_REF_SHIFT));
+        }
+
+        u2o_set(base, UTMI_CTRL, 1 << UTMI_CTRL_PLL_PWR_UP_SHIFT);
+        u2o_set(base, UTMI_CTRL, 1 << UTMI_CTRL_PWR_UP_SHIFT);
+
+        /* UTMI_PLL settings */
+        u2o_clear(base, UTMI_PLL, UTMI_PLL_PLLVDD18_MASK
+                | UTMI_PLL_PLLVDD12_MASK | UTMI_PLL_PLLCALI12_MASK
+                | UTMI_PLL_FBDIV_MASK | UTMI_PLL_REFDIV_MASK
+                | UTMI_PLL_ICP_MASK | UTMI_PLL_KVCO_MASK);
+
+        u2o_set(base, UTMI_PLL, (0xee << UTMI_PLL_FBDIV_SHIFT)
+                | (0xb << UTMI_PLL_REFDIV_SHIFT)
+                | (3 << UTMI_PLL_PLLVDD18_SHIFT)
+                | (3 << UTMI_PLL_PLLVDD12_SHIFT)
+                | (3 << UTMI_PLL_PLLCALI12_SHIFT)
+                | (1 << UTMI_PLL_ICP_SHIFT) | (3 << UTMI_PLL_KVCO_SHIFT));
+
+        /* UTMI_TX */
+        u2o_clear(base, UTMI_TX, UTMI_TX_REG_EXT_FS_RCAL_EN_MASK
+                | UTMI_TX_TXVDD12_MASK
+                | UTMI_TX_CK60_PHSEL_MASK | UTMI_TX_IMPCAL_VTH_MASK
+                | UTMI_TX_REG_EXT_FS_RCAL_MASK | UTMI_TX_AMP_MASK);
+        u2o_set(base, UTMI_TX, (3 << UTMI_TX_TXVDD12_SHIFT)
+                | (4 << UTMI_TX_CK60_PHSEL_SHIFT)
+                | (4 << UTMI_TX_IMPCAL_VTH_SHIFT)
+                | (8 << UTMI_TX_REG_EXT_FS_RCAL_SHIFT)
+                | (3 << UTMI_TX_AMP_SHIFT));
+
+        /* UTMI_RX */
+        u2o_clear(base, UTMI_RX, UTMI_RX_SQ_THRESH_MASK
+                | UTMI_REG_SQ_LENGTH_MASK);
+        if (cpu_is_pxa168())
+                u2o_set(base, UTMI_RX, (7 << UTMI_RX_SQ_THRESH_SHIFT)
+                        | (2 << UTMI_REG_SQ_LENGTH_SHIFT));
+        else
+                u2o_set(base, UTMI_RX, (0x7 << UTMI_RX_SQ_THRESH_SHIFT)
+                        | (2 << UTMI_REG_SQ_LENGTH_SHIFT));
+
+        /* UTMI_IVREF */
+        if (cpu_is_pxa168())
+                /*
+                 * fixing Microsoft Altair board interface with NEC hub issue -
+                 * Set UTMI_IVREF from 0x4a3 to 0x4bf
+                 */
+                u2o_write(base, UTMI_IVREF, 0x4bf);
+
+        /* calibrate */
+        timeout = jiffies + 100;
+        while ((u2o_read(base, UTMI_PLL) & PLL_READY) == 0) {
+                if (time_after(jiffies, timeout))
+                        return -ETIME;
+                cpu_relax();
+        }
+
+        /* toggle VCOCAL_START bit of UTMI_PLL */
+        udelay(200);
+        u2o_set(base, UTMI_PLL, VCOCAL_START);
+        udelay(40);
+        u2o_clear(base, UTMI_PLL, VCOCAL_START);
+
+        /* toggle REG_RCAL_START bit of UTMI_TX */
+        udelay(200);
+        u2o_set(base, UTMI_TX, REG_RCAL_START);
+        udelay(40);
+        u2o_clear(base, UTMI_TX, REG_RCAL_START);
+        udelay(200);
+
+        /* make sure phy is ready */
+        timeout = jiffies + 100;
+        while ((u2o_read(base, UTMI_PLL) & PLL_READY) == 0) {
+                if (time_after(jiffies, timeout))
+                        return -ETIME;
+                cpu_relax();
+        }
+
+        if (cpu_is_pxa168()) {
+                u2o_set(base, UTMI_RESERVE, 1 << 5);
+                /* Turn on UTMI PHY OTG extension */
+                u2o_write(base, UTMI_OTG_ADDON, 1);
+        }
+        return 0;
+}
+#else
+int mv_udc_phy_init(unsigned int base)
+{
+        return 0;
+}
+#endif
diff --git a/drivers/usb/gadget/u_audio.c b/drivers/usb/gadget/u_audio.c
new file mode 100644
index 00000000000..59ffe1ecf1c
--- /dev/null
+++ b/drivers/usb/gadget/u_audio.c
@@ -0,0 +1,327 @@
+/*
+ * u_audio.c -- ALSA audio utilities for Gadget stack
+ *
+ * Copyright (C) 2008 Bryan Wu <cooloney@kernel.org>
+ * Copyright (C) 2008 Analog Devices, Inc
+ *
+ * Enter bugs at http://blackfin.uclinux.org/
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/device.h>
+#include <linux/delay.h>
+#include <linux/ctype.h>
+#include <linux/random.h>
+#include <linux/syscalls.h>
+
+#include "u_audio.h"
+
+/*
+ * This component encapsulates the ALSA devices for USB audio gadget
+ */
+
+#define FILE_PCM_PLAYBACK       "/dev/snd/pcmC0D0p"
+#define FILE_PCM_CAPTURE        "/dev/snd/pcmC0D0c"
+#define FILE_CONTROL            "/dev/snd/controlC0"
+
+static char *fn_play = FILE_PCM_PLAYBACK;
+module_param(fn_play, charp, S_IRUGO);
+MODULE_PARM_DESC(fn_play, "Playback PCM device file name");
+
+static char *fn_cap = FILE_PCM_CAPTURE;
+module_param(fn_cap, charp, S_IRUGO);
+MODULE_PARM_DESC(fn_cap, "Capture PCM device file name");
+
+static char *fn_cntl = FILE_CONTROL;
+module_param(fn_cntl, charp, S_IRUGO);
+MODULE_PARM_DESC(fn_cntl, "Control device file name");
+
+/*-------------------------------------------------------------------------*/
+
+/**
+ * Some ALSA internal helper functions
+ */
+static int snd_interval_refine_set(struct snd_interval *i, unsigned int val)
+{
+        struct snd_interval t;
+        t.empty = 0;
+        t.min = t.max = val;
+        t.openmin = t.openmax = 0;
+        t.integer = 1;
+        return snd_interval_refine(i, &t);
+}
+
+static int _snd_pcm_hw_param_set(struct snd_pcm_hw_params *params,
+                                 snd_pcm_hw_param_t var, unsigned int val,
+                                 int dir)
+{
+        int changed;
+        if (hw_is_mask(var)) {
+                struct snd_mask *m = hw_param_mask(params, var);
+                if (val == 0 && dir < 0) {
+                        changed = -EINVAL;
+                        snd_mask_none(m);
+                } else {
+                        if (dir > 0)
+                                val++;
+                        else if (dir < 0)
+                                val--;
+                        changed = snd_mask_refine_set(
+                                        hw_param_mask(params, var), val);
+                }
+        } else if (hw_is_interval(var)) {
+                struct snd_interval *i = hw_param_interval(params, var);
+                if (val == 0 && dir < 0) {
+                        changed = -EINVAL;
+                        snd_interval_none(i);
+                } else if (dir == 0)
+                        changed = snd_interval_refine_set(i, val);
+                else {
+                        struct snd_interval t;
+                        t.openmin = 1;
+                        t.openmax = 1;
+                        t.empty = 0;
+                        t.integer = 0;
+                        if (dir < 0) {
+                                t.min = val - 1;
+                                t.max = val;
+                        } else {
+                                t.min = val;
+                                t.max = val+1;
+                        }
+                        changed = snd_interval_refine(i, &t);
+                }
+        } else
+                return -EINVAL;
+        if (changed) {
+                params->cmask |= 1 << var;
+                params->rmask |= 1 << var;
+        }
+        return changed;
+}
+/*-------------------------------------------------------------------------*/
+
+/**
+ * Set default hardware params
+ */
+static int playback_default_hw_params(struct gaudio_snd_dev *snd)
+{
+        struct snd_pcm_substream *substream = snd->substream;
+        struct snd_pcm_hw_params *params;
+        snd_pcm_sframes_t result;
+
+       /*
+        * SNDRV_PCM_ACCESS_RW_INTERLEAVED,
+        * SNDRV_PCM_FORMAT_S16_LE
+        * CHANNELS: 2
+        * RATE: 48000
+        */
+        snd->access = SNDRV_PCM_ACCESS_RW_INTERLEAVED;
+        snd->format = SNDRV_PCM_FORMAT_S16_LE;
+        snd->channels = 2;
+        snd->rate = 48000;
+
+        params = kzalloc(sizeof(*params), GFP_KERNEL);
+        if (!params)
+                return -ENOMEM;
+
+        _snd_pcm_hw_params_any(params);
+        _snd_pcm_hw_param_set(params, SNDRV_PCM_HW_PARAM_ACCESS,
+                        snd->access, 0);
+        _snd_pcm_hw_param_set(params, SNDRV_PCM_HW_PARAM_FORMAT,
+                        snd->format, 0);
+        _snd_pcm_hw_param_set(params, SNDRV_PCM_HW_PARAM_CHANNELS,
+                        snd->channels, 0);
+        _snd_pcm_hw_param_set(params, SNDRV_PCM_HW_PARAM_RATE,
+                        snd->rate, 0);
+
+        snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
+        snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS, params);
+
+        result = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_PREPARE, NULL);
+        if (result < 0) {
+                ERROR(snd->card,
+                        "Preparing sound card failed: %d\n", (int)result);
+                kfree(params);
+                return result;
+        }
+
+        /* Store the hardware parameters */
+        snd->access = params_access(params);
+        snd->format = params_format(params);
+        snd->channels = params_channels(params);
+        snd->rate = params_rate(params);
+
+        kfree(params);
+
+        INFO(snd->card,
+                "Hardware params: access %x, format %x, channels %d, rate %d\n",
+                snd->access, snd->format, snd->channels, snd->rate);
+
+        return 0;
+}
+
+/**
+ * Playback audio buffer data by ALSA PCM device
+ */
+static size_t u_audio_playback(struct gaudio *card, void *buf, size_t count)
+{
+        struct gaudio_snd_dev   *snd = &card->playback;
+        struct snd_pcm_substream *substream = snd->substream;
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        mm_segment_t old_fs;
+        ssize_t result;
+        snd_pcm_sframes_t frames;
+
+try_again:
+        if (runtime->status->state == SNDRV_PCM_STATE_XRUN ||
+                runtime->status->state == SNDRV_PCM_STATE_SUSPENDED) {
+                result = snd_pcm_kernel_ioctl(substream,
+                                SNDRV_PCM_IOCTL_PREPARE, NULL);
+                if (result < 0) {
+                        ERROR(card, "Preparing sound card failed: %d\n",
+                                        (int)result);
+                        return result;
+                }
+        }
+
+        frames = bytes_to_frames(runtime, count);
+        old_fs = get_fs();
+        set_fs(KERNEL_DS);
+        result = snd_pcm_lib_write(snd->substream, buf, frames);
+        if (result != frames) {
+                ERROR(card, "Playback error: %d\n", (int)result);
+                set_fs(old_fs);
+                goto try_again;
+        }
+        set_fs(old_fs);
+
+        return 0;
+}
+
+static int u_audio_get_playback_channels(struct gaudio *card)
+{
+        return card->playback.channels;
+}
+
+static int u_audio_get_playback_rate(struct gaudio *card)
+{
+        return card->playback.rate;
+}
+
+/**
+ * Open ALSA PCM and control device files
+ * Initial the PCM or control device
+ */
+static int gaudio_open_snd_dev(struct gaudio *card)
+{
+        struct snd_pcm_file *pcm_file;
+        struct gaudio_snd_dev *snd;
+
+        if (!card)
+                return -ENODEV;
+
+        /* Open control device */
+        snd = &card->control;
+        snd->filp = filp_open(fn_cntl, O_RDWR, 0);
+        if (IS_ERR(snd->filp)) {
+                int ret = PTR_ERR(snd->filp);
+                ERROR(card, "unable to open sound control device file: %s\n",
+                                fn_cntl);
+                snd->filp = NULL;
+                return ret;
+        }
+        snd->card = card;
+
+        /* Open PCM playback device and setup substream */
+        snd = &card->playback;
+        snd->filp = filp_open(fn_play, O_WRONLY, 0);
+        if (IS_ERR(snd->filp)) {
+                ERROR(card, "No such PCM playback device: %s\n", fn_play);
+                snd->filp = NULL;
+        }
+        pcm_file = snd->filp->private_data;
+        snd->substream = pcm_file->substream;
+        snd->card = card;
+        playback_default_hw_params(snd);
+
+        /* Open PCM capture device and setup substream */
+        snd = &card->capture;
+        snd->filp = filp_open(fn_cap, O_RDONLY, 0);
+        if (IS_ERR(snd->filp)) {
+                ERROR(card, "No such PCM capture device: %s\n", fn_cap);
+                snd->substream = NULL;
+                snd->card = NULL;
+                snd->filp = NULL;
+        } else {
+                pcm_file = snd->filp->private_data;
+                snd->substream = pcm_file->substream;
+                snd->card = card;
+        }
+
+        return 0;
+}
+
+/**
+ * Close ALSA PCM and control device files
+ */
+static int gaudio_close_snd_dev(struct gaudio *gau)
+{
+        struct gaudio_snd_dev   *snd;
+
+        /* Close control device */
+        snd = &gau->control;
+        if (snd->filp)
+                filp_close(snd->filp, current->files);
+
+        /* Close PCM playback device and setup substream */
+        snd = &gau->playback;
+        if (snd->filp)
+                filp_close(snd->filp, current->files);
+
+        /* Close PCM capture device and setup substream */
+        snd = &gau->capture;
+        if (snd->filp)
+                filp_close(snd->filp, current->files);
+
+        return 0;
+}
+
+static struct gaudio *the_card;
+/**
+ * gaudio_setup - setup ALSA interface and preparing for USB transfer
+ *
+ * This sets up PCM, mixer or MIDI ALSA devices fore USB gadget using.
+ *
+ * Returns negative errno, or zero on success
+ */
+int __init gaudio_setup(struct gaudio *card)
+{
+        int     ret;
+
+        ret = gaudio_open_snd_dev(card);
+        if (ret)
+                ERROR(card, "we need at least one control device\n");
+        else if (!the_card)
+                the_card = card;
+
+        return ret;
+
+}
+
+/**
+ * gaudio_cleanup - remove ALSA device interface
+ *
+ * This is called to free all resources allocated by @gaudio_setup().
+ */
+void gaudio_cleanup(void)
+{
+        if (the_card) {
+                gaudio_close_snd_dev(the_card);
+                the_card = NULL;
+        }
+}
+
diff --git a/drivers/usb/gadget/u_audio.h b/drivers/usb/gadget/u_audio.h
new file mode 100644
index 00000000000..08ffce3298e
--- /dev/null
+++ b/drivers/usb/gadget/u_audio.h
@@ -0,0 +1,56 @@
+/*
+ * u_audio.h -- interface to USB gadget "ALSA AUDIO" utilities
+ *
+ * Copyright (C) 2008 Bryan Wu <cooloney@kernel.org>
+ * Copyright (C) 2008 Analog Devices, Inc
+ *
+ * Enter bugs at http://blackfin.uclinux.org/
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#ifndef __U_AUDIO_H
+#define __U_AUDIO_H
+
+#include <linux/device.h>
+#include <linux/err.h>
+#include <linux/usb/audio.h>
+#include <linux/usb/composite.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+
+#include "gadget_chips.h"
+
+/*
+ * This represents the USB side of an audio card device, managed by a USB
+ * function which provides control and stream interfaces.
+ */
+
+struct gaudio_snd_dev {
+        struct gaudio                   *card;
+        struct file                     *filp;
+        struct snd_pcm_substream        *substream;
+        int                             access;
+        int                             format;
+        int                             channels;
+        int                             rate;
+};
+
+struct gaudio {
+        struct usb_function             func;
+        struct usb_gadget               *gadget;
+
+        /* ALSA sound device interfaces */
+        struct gaudio_snd_dev           control;
+        struct gaudio_snd_dev           playback;
+        struct gaudio_snd_dev           capture;
+
+        /* TODO */
+};
+
+int gaudio_setup(struct gaudio *card);
+void gaudio_cleanup(void);
+
+#endif /* __U_AUDIO_H */