Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: (100 commits)
  usb-storage: revert DMA-alignment change for Wireless USB
  USB: use reset_resume when normal resume fails
  usb_gadget: composite cdc gadget fault handling
  usb gadget: minor USBCV fix for composite framework
  USB: Fix bug with byte order in isp116x-hcd.c fio write/read
  USB: fix double kfree in ipaq in error case
  USB: fix build error in cdc-acm for CONFIG_PM=n
  USB: remove board-specific UP2OCR configuration from pxa27x-udc
  USB: EHCI: Reconciling USB register differences on MPC85xx vs MPC83xx
  USB: Fix pointer/int cast in USB devio code
  usb gadget: g_cdc dependso on NET
  USB: Au1xxx-usb: suspend/resume support.
  USB: Au1xxx-usb: clean up ohci/ehci bus glue sources.
  usbfs: don't store bad pointers in registration
  usbfs: fix race between open and unregister
  usbfs: simplify the lookup-by-minor routines
  usbfs: send disconnect signals when device is unregistered
  USB: Force unbinding of drivers lacking reset_resume or other methods
  USB: ohci-pnx4008: I2C cleanups and fixes
  USB: debug port converter does not accept more than 8 byte packets
  ...

39 files changed, 8315 insertions, 6074 deletions

diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index d6bab0d5f453..c6a8c6b1116a 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -586,6 +586,20 @@ config USB_G_PRINTER
           For more information, see Documentation/usb/gadget_printer.txt
           which includes sample code for accessing the device file.
 
+config USB_CDC_COMPOSITE
+        tristate "CDC Composite Device (Ethernet and ACM)"
+        depends on NET
+        help
+          This driver provides two functions in one configuration:
+          a CDC Ethernet (ECM) link, and a CDC ACM (serial port) link.
+
+          This driver requires four bulk and two interrupt endpoints,
+          plus the ability to handle altsettings.  Not all peripheral
+          controllers are that capable.
+
+          Say "y" to link the driver statically, or "m" to build a
+          dynamically linked module.
+
 # put drivers that need isochronous transfer support (for audio
 # or video class gadget drivers), or specific hardware, here.
 
diff --git a/drivers/usb/gadget/Makefile b/drivers/usb/gadget/Makefile
index e258afd25faf..fcb5cb9094d9 100644
--- a/drivers/usb/gadget/Makefile
+++ b/drivers/usb/gadget/Makefile
@@ -22,18 +22,22 @@ obj-$(CONFIG_USB_M66592)	+= m66592-udc.o
 #
 # USB gadget drivers
 #
-g_zero-objs                     := zero.o usbstring.o config.o epautoconf.o
-g_ether-objs                    := ether.o usbstring.o config.o epautoconf.o
-g_serial-objs                   := serial.o usbstring.o config.o epautoconf.o
+C_UTILS =       composite.o usbstring.o config.o epautoconf.o
+
+g_zero-objs                     := zero.o f_sourcesink.o f_loopback.o $(C_UTILS)
+g_ether-objs                    := ether.o u_ether.o f_subset.o f_ecm.o $(C_UTILS)
+g_serial-objs                   := serial.o u_serial.o f_acm.o f_serial.o $(C_UTILS)
 g_midi-objs                     := gmidi.o usbstring.o config.o epautoconf.o
 gadgetfs-objs                   := inode.o
 g_file_storage-objs             := file_storage.o usbstring.o config.o \
                                         epautoconf.o
 g_printer-objs                  := printer.o usbstring.o config.o \
                                         epautoconf.o
+g_cdc-objs                      := cdc2.o u_ether.o f_ecm.o \
+                                        u_serial.o f_acm.o $(C_UTILS)
 
 ifeq ($(CONFIG_USB_ETH_RNDIS),y)
-        g_ether-objs            += rndis.o
+        g_ether-objs            += f_rndis.o rndis.o
 endif
  
 obj-$(CONFIG_USB_ZERO)          += g_zero.o
@@ -43,4 +47,5 @@ obj-$(CONFIG_USB_FILE_STORAGE)	+= g_file_storage.o
 obj-$(CONFIG_USB_G_SERIAL)      += g_serial.o
 obj-$(CONFIG_USB_G_PRINTER)     += g_printer.o
 obj-$(CONFIG_USB_MIDI_GADGET)   += g_midi.o
+obj-$(CONFIG_USB_CDC_COMPOSITE) += g_cdc.o
 
diff --git a/drivers/usb/gadget/amd5536udc.c b/drivers/usb/gadget/amd5536udc.c
index f261d2a9a5f0..1500e1b3c302 100644
--- a/drivers/usb/gadget/amd5536udc.c
+++ b/drivers/usb/gadget/amd5536udc.c
@@ -3342,7 +3342,7 @@ static int udc_probe(struct udc *dev)
         spin_lock_init(&dev->lock);
         dev->gadget.ops = &udc_ops;
 
-        strcpy(dev->gadget.dev.bus_id, "gadget");
+        dev_set_name(&dev->gadget.dev, "gadget");
         dev->gadget.dev.release = gadget_release;
         dev->gadget.name = name;
         dev->gadget.name = name;
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index b6b2a0a5ba37..e2d8a5d86c40 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -1687,6 +1687,19 @@ static int __init at91udc_probe(struct platform_device *pdev)
                                 udc->board.pullup_active_low);
         }
 
+        /* newer chips have more FIFO memory than rm9200 */
+        if (cpu_is_at91sam9260()) {
+                udc->ep[0].maxpacket = 64;
+                udc->ep[3].maxpacket = 64;
+                udc->ep[4].maxpacket = 512;
+                udc->ep[5].maxpacket = 512;
+        } else if (cpu_is_at91sam9261()) {
+                udc->ep[3].maxpacket = 64;
+        } else if (cpu_is_at91sam9263()) {
+                udc->ep[0].maxpacket = 64;
+                udc->ep[3].maxpacket = 64;
+        }
+
         udc->udp_baseaddr = ioremap(res->start, res->end - res->start + 1);
         if (!udc->udp_baseaddr) {
                 retval = -ENOMEM;
diff --git a/drivers/usb/gadget/cdc2.c b/drivers/usb/gadget/cdc2.c
new file mode 100644
index 000000000000..d490d0289507
--- /dev/null
+++ b/drivers/usb/gadget/cdc2.c
@@ -0,0 +1,246 @@
+/*
+ * cdc2.c -- CDC Composite driver, with ECM and ACM support
+ *
+ * Copyright (C) 2008 David Brownell
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <linux/kernel.h>
+#include <linux/utsname.h>
+
+#include "u_ether.h"
+#include "u_serial.h"
+
+
+#define DRIVER_DESC             "CDC Composite Gadget"
+#define DRIVER_VERSION          "King Kamehameha Day 2008"
+
+/*-------------------------------------------------------------------------*/
+
+/* DO NOT REUSE THESE IDs with a protocol-incompatible driver!!  Ever!!
+ * Instead:  allocate your own, using normal USB-IF procedures.
+ */
+
+/* Thanks to NetChip Technologies for donating this product ID.
+ * It's for devices with only this composite CDC configuration.
+ */
+#define CDC_VENDOR_NUM          0x0525  /* NetChip */
+#define CDC_PRODUCT_NUM         0xa4aa  /* CDC Composite: ECM + ACM */
+
+/*-------------------------------------------------------------------------*/
+
+static struct usb_device_descriptor device_desc = {
+        .bLength =              sizeof device_desc,
+        .bDescriptorType =      USB_DT_DEVICE,
+
+        .bcdUSB =               __constant_cpu_to_le16(0x0200),
+
+        .bDeviceClass =         USB_CLASS_COMM,
+        .bDeviceSubClass =      0,
+        .bDeviceProtocol =      0,
+        /* .bMaxPacketSize0 = f(hardware) */
+
+        /* Vendor and product id can be overridden by module parameters.  */
+        .idVendor =             __constant_cpu_to_le16(CDC_VENDOR_NUM),
+        .idProduct =            __constant_cpu_to_le16(CDC_PRODUCT_NUM),
+        /* .bcdDevice = f(hardware) */
+        /* .iManufacturer = DYNAMIC */
+        /* .iProduct = DYNAMIC */
+        /* NO SERIAL NUMBER */
+        .bNumConfigurations =   1,
+};
+
+static struct usb_otg_descriptor otg_descriptor = {
+        .bLength =              sizeof otg_descriptor,
+        .bDescriptorType =      USB_DT_OTG,
+
+        /* REVISIT SRP-only hardware is possible, although
+         * it would not be called "OTG" ...
+         */
+        .bmAttributes =         USB_OTG_SRP | USB_OTG_HNP,
+};
+
+static const struct usb_descriptor_header *otg_desc[] = {
+        (struct usb_descriptor_header *) &otg_descriptor,
+        NULL,
+};
+
+
+/* string IDs are assigned dynamically */
+
+#define STRING_MANUFACTURER_IDX         0
+#define STRING_PRODUCT_IDX              1
+
+static char manufacturer[50];
+
+static struct usb_string strings_dev[] = {
+        [STRING_MANUFACTURER_IDX].s = manufacturer,
+        [STRING_PRODUCT_IDX].s = DRIVER_DESC,
+        {  } /* end of list */
+};
+
+static struct usb_gadget_strings stringtab_dev = {
+        .language       = 0x0409,       /* en-us */
+        .strings        = strings_dev,
+};
+
+static struct usb_gadget_strings *dev_strings[] = {
+        &stringtab_dev,
+        NULL,
+};
+
+static u8 hostaddr[ETH_ALEN];
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * We _always_ have both CDC ECM and CDC ACM functions.
+ */
+static int __init cdc_do_config(struct usb_configuration *c)
+{
+        int     status;
+
+        if (gadget_is_otg(c->cdev->gadget)) {
+                c->descriptors = otg_desc;
+                c->bmAttributes |= USB_CONFIG_ATT_WAKEUP;
+        }
+
+        status = ecm_bind_config(c, hostaddr);
+        if (status < 0)
+                return status;
+
+        status = acm_bind_config(c, 0);
+        if (status < 0)
+                return status;
+
+        return 0;
+}
+
+static struct usb_configuration cdc_config_driver = {
+        .label                  = "CDC Composite (ECM + ACM)",
+        .bind                   = cdc_do_config,
+        .bConfigurationValue    = 1,
+        /* .iConfiguration = DYNAMIC */
+        .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
+        .bMaxPower              = 1,    /* 2 mA, minimal */
+};
+
+/*-------------------------------------------------------------------------*/
+
+static int __init cdc_bind(struct usb_composite_dev *cdev)
+{
+        int                     gcnum;
+        struct usb_gadget       *gadget = cdev->gadget;
+        int                     status;
+
+        if (!can_support_ecm(cdev->gadget)) {
+                ERROR(cdev, "controller '%s' not usable\n", gadget->name);
+                return -EINVAL;
+        }
+
+        /* set up network link layer */
+        status = gether_setup(cdev->gadget, hostaddr);
+        if (status < 0)
+                return status;
+
+        /* set up serial link layer */
+        status = gserial_setup(cdev->gadget, 1);
+        if (status < 0)
+                goto fail0;
+
+        gcnum = usb_gadget_controller_number(gadget);
+        if (gcnum >= 0)
+                device_desc.bcdDevice = cpu_to_le16(0x0300 | gcnum);
+        else {
+                /* We assume that can_support_ecm() tells the truth;
+                 * but if the controller isn't recognized at all then
+                 * that assumption is a bit more likely to be wrong.
+                 */
+                WARN(cdev, "controller '%s' not recognized; trying %s\n",
+                                gadget->name,
+                                cdc_config_driver.label);
+                device_desc.bcdDevice =
+                        __constant_cpu_to_le16(0x0300 | 0x0099);
+        }
+
+
+        /* Allocate string descriptor numbers ... note that string
+         * contents can be overridden by the composite_dev glue.
+         */
+
+        /* device descriptor strings: manufacturer, product */
+        snprintf(manufacturer, sizeof manufacturer, "%s %s with %s",
+                init_utsname()->sysname, init_utsname()->release,
+                gadget->name);
+        status = usb_string_id(cdev);
+        if (status < 0)
+                goto fail1;
+        strings_dev[STRING_MANUFACTURER_IDX].id = status;
+        device_desc.iManufacturer = status;
+
+        status = usb_string_id(cdev);
+        if (status < 0)
+                goto fail1;
+        strings_dev[STRING_PRODUCT_IDX].id = status;
+        device_desc.iProduct = status;
+
+        /* register our configuration */
+        status = usb_add_config(cdev, &cdc_config_driver);
+        if (status < 0)
+                goto fail1;
+
+        INFO(cdev, "%s, version: " DRIVER_VERSION "\n", DRIVER_DESC);
+
+        return 0;
+
+fail1:
+        gserial_cleanup();
+fail0:
+        gether_cleanup();
+        return status;
+}
+
+static int __exit cdc_unbind(struct usb_composite_dev *cdev)
+{
+        gserial_cleanup();
+        gether_cleanup();
+        return 0;
+}
+
+static struct usb_composite_driver cdc_driver = {
+        .name           = "g_cdc",
+        .dev            = &device_desc,
+        .strings        = dev_strings,
+        .bind           = cdc_bind,
+        .unbind         = __exit_p(cdc_unbind),
+};
+
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_AUTHOR("David Brownell");
+MODULE_LICENSE("GPL");
+
+static int __init init(void)
+{
+        return usb_composite_register(&cdc_driver);
+}
+module_init(init);
+
+static void __exit cleanup(void)
+{
+        usb_composite_unregister(&cdc_driver);
+}
+module_exit(cleanup);
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
new file mode 100644
index 000000000000..85c876c1f150
--- /dev/null
+++ b/drivers/usb/gadget/composite.c
@@ -0,0 +1,1041 @@
+/*
+ * composite.c - infrastructure for Composite USB Gadgets
+ *
+ * Copyright (C) 2006-2008 David Brownell
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+/* #define VERBOSE_DEBUG */
+
+#include <linux/kallsyms.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/device.h>
+
+#include <linux/usb/composite.h>
+
+
+/*
+ * The code in this file is utility code, used to build a gadget driver
+ * from one or more "function" drivers, one or more "configuration"
+ * objects, and a "usb_composite_driver" by gluing them together along
+ * with the relevant device-wide data.
+ */
+
+/* big enough to hold our biggest descriptor */
+#define USB_BUFSIZ      512
+
+static struct usb_composite_driver *composite;
+
+/* Some systems will need runtime overrides for the  product identifers
+ * published in the device descriptor, either numbers or strings or both.
+ * String parameters are in UTF-8 (superset of ASCII's 7 bit characters).
+ */
+
+static ushort idVendor;
+module_param(idVendor, ushort, 0);
+MODULE_PARM_DESC(idVendor, "USB Vendor ID");
+
+static ushort idProduct;
+module_param(idProduct, ushort, 0);
+MODULE_PARM_DESC(idProduct, "USB Product ID");
+
+static ushort bcdDevice;
+module_param(bcdDevice, ushort, 0);
+MODULE_PARM_DESC(bcdDevice, "USB Device version (BCD)");
+
+static char *iManufacturer;
+module_param(iManufacturer, charp, 0);
+MODULE_PARM_DESC(iManufacturer, "USB Manufacturer string");
+
+static char *iProduct;
+module_param(iProduct, charp, 0);
+MODULE_PARM_DESC(iProduct, "USB Product string");
+
+static char *iSerialNumber;
+module_param(iSerialNumber, charp, 0);
+MODULE_PARM_DESC(iSerialNumber, "SerialNumber string");
+
+/*-------------------------------------------------------------------------*/
+
+/**
+ * usb_add_function() - add a function to a configuration
+ * @config: the configuration
+ * @function: the function being added
+ * Context: single threaded during gadget setup
+ *
+ * After initialization, each configuration must have one or more
+ * functions added to it.  Adding a function involves calling its @bind()
+ * method to allocate resources such as interface and string identifiers
+ * and endpoints.
+ *
+ * This function returns the value of the function's bind(), which is
+ * zero for success else a negative errno value.
+ */
+int __init usb_add_function(struct usb_configuration *config,
+                struct usb_function *function)
+{
+        int     value = -EINVAL;
+
+        DBG(config->cdev, "adding '%s'/%p to config '%s'/%p\n",
+                        function->name, function,
+                        config->label, config);
+
+        if (!function->set_alt || !function->disable)
+                goto done;
+
+        function->config = config;
+        list_add_tail(&function->list, &config->functions);
+
+        /* REVISIT *require* function->bind? */
+        if (function->bind) {
+                value = function->bind(config, function);
+                if (value < 0) {
+                        list_del(&function->list);
+                        function->config = NULL;
+                }
+        } else
+                value = 0;
+
+        /* We allow configurations that don't work at both speeds.
+         * If we run into a lowspeed Linux system, treat it the same
+         * as full speed ... it's the function drivers that will need
+         * to avoid bulk and ISO transfers.
+         */
+        if (!config->fullspeed && function->descriptors)
+                config->fullspeed = true;
+        if (!config->highspeed && function->hs_descriptors)
+                config->highspeed = true;
+
+done:
+        if (value)
+                DBG(config->cdev, "adding '%s'/%p --> %d\n",
+                                function->name, function, value);
+        return value;
+}
+
+/**
+ * usb_interface_id() - allocate an unused interface ID
+ * @config: configuration associated with the interface
+ * @function: function handling the interface
+ * Context: single threaded during gadget setup
+ *
+ * usb_interface_id() is called from usb_function.bind() callbacks to
+ * allocate new interface IDs.  The function driver will then store that
+ * ID in interface, association, CDC union, and other descriptors.  It
+ * will also handle any control requests targetted at that interface,
+ * particularly changing its altsetting via set_alt().  There may
+ * also be class-specific or vendor-specific requests to handle.
+ *
+ * All interface identifier should be allocated using this routine, to
+ * ensure that for example different functions don't wrongly assign
+ * different meanings to the same identifier.  Note that since interface
+ * identifers are configuration-specific, functions used in more than
+ * one configuration (or more than once in a given configuration) need
+ * multiple versions of the relevant descriptors.
+ *
+ * Returns the interface ID which was allocated; or -ENODEV if no
+ * more interface IDs can be allocated.
+ */
+int __init usb_interface_id(struct usb_configuration *config,
+                struct usb_function *function)
+{
+        unsigned id = config->next_interface_id;
+
+        if (id < MAX_CONFIG_INTERFACES) {
+                config->interface[id] = function;
+                config->next_interface_id = id + 1;
+                return id;
+        }
+        return -ENODEV;
+}
+
+static int config_buf(struct usb_configuration *config,
+                enum usb_device_speed speed, void *buf, u8 type)
+{
+        struct usb_config_descriptor    *c = buf;
+        void                            *next = buf + USB_DT_CONFIG_SIZE;
+        int                             len = USB_BUFSIZ - USB_DT_CONFIG_SIZE;
+        struct usb_function             *f;
+        int                             status;
+
+        /* write the config descriptor */
+        c = buf;
+        c->bLength = USB_DT_CONFIG_SIZE;
+        c->bDescriptorType = type;
+        /* wTotalLength is written later */
+        c->bNumInterfaces = config->next_interface_id;
+        c->bConfigurationValue = config->bConfigurationValue;
+        c->iConfiguration = config->iConfiguration;
+        c->bmAttributes = USB_CONFIG_ATT_ONE | config->bmAttributes;
+        c->bMaxPower = config->bMaxPower;
+
+        /* There may be e.g. OTG descriptors */
+        if (config->descriptors) {
+                status = usb_descriptor_fillbuf(next, len,
+                                config->descriptors);
+                if (status < 0)
+                        return status;
+                len -= status;
+                next += status;
+        }
+
+        /* add each function's descriptors */
+        list_for_each_entry(f, &config->functions, list) {
+                struct usb_descriptor_header **descriptors;
+
+                if (speed == USB_SPEED_HIGH)
+                        descriptors = f->hs_descriptors;
+                else
+                        descriptors = f->descriptors;
+                if (!descriptors)
+                        continue;
+                status = usb_descriptor_fillbuf(next, len,
+                        (const struct usb_descriptor_header **) descriptors);
+                if (status < 0)
+                        return status;
+                len -= status;
+                next += status;
+        }
+
+        len = next - buf;
+        c->wTotalLength = cpu_to_le16(len);
+        return len;
+}
+
+static int config_desc(struct usb_composite_dev *cdev, unsigned w_value)
+{
+        struct usb_gadget               *gadget = cdev->gadget;
+        struct usb_configuration        *c;
+        u8                              type = w_value >> 8;
+        enum usb_device_speed           speed = USB_SPEED_UNKNOWN;
+
+        if (gadget_is_dualspeed(gadget)) {
+                int                     hs = 0;
+
+                if (gadget->speed == USB_SPEED_HIGH)
+                        hs = 1;
+                if (type == USB_DT_OTHER_SPEED_CONFIG)
+                        hs = !hs;
+                if (hs)
+                        speed = USB_SPEED_HIGH;
+
+        }
+
+        /* This is a lookup by config *INDEX* */
+        w_value &= 0xff;
+        list_for_each_entry(c, &cdev->configs, list) {
+                /* ignore configs that won't work at this speed */
+                if (speed == USB_SPEED_HIGH) {
+                        if (!c->highspeed)
+                                continue;
+                } else {
+                        if (!c->fullspeed)
+                                continue;
+                }
+                if (w_value == 0)
+                        return config_buf(c, speed, cdev->req->buf, type);
+                w_value--;
+        }
+        return -EINVAL;
+}
+
+static int count_configs(struct usb_composite_dev *cdev, unsigned type)
+{
+        struct usb_gadget               *gadget = cdev->gadget;
+        struct usb_configuration        *c;
+        unsigned                        count = 0;
+        int                             hs = 0;
+
+        if (gadget_is_dualspeed(gadget)) {
+                if (gadget->speed == USB_SPEED_HIGH)
+                        hs = 1;
+                if (type == USB_DT_DEVICE_QUALIFIER)
+                        hs = !hs;
+        }
+        list_for_each_entry(c, &cdev->configs, list) {
+                /* ignore configs that won't work at this speed */
+                if (hs) {
+                        if (!c->highspeed)
+                                continue;
+                } else {
+                        if (!c->fullspeed)
+                                continue;
+                }
+                count++;
+        }
+        return count;
+}
+
+static void device_qual(struct usb_composite_dev *cdev)
+{
+        struct usb_qualifier_descriptor *qual = cdev->req->buf;
+
+        qual->bLength = sizeof(*qual);
+        qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
+        /* POLICY: same bcdUSB and device type info at both speeds */
+        qual->bcdUSB = cdev->desc.bcdUSB;
+        qual->bDeviceClass = cdev->desc.bDeviceClass;
+        qual->bDeviceSubClass = cdev->desc.bDeviceSubClass;
+        qual->bDeviceProtocol = cdev->desc.bDeviceProtocol;
+        /* ASSUME same EP0 fifo size at both speeds */
+        qual->bMaxPacketSize0 = cdev->desc.bMaxPacketSize0;
+        qual->bNumConfigurations = count_configs(cdev, USB_DT_DEVICE_QUALIFIER);
+        qual->bRESERVED = 0;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static void reset_config(struct usb_composite_dev *cdev)
+{
+        struct usb_function             *f;
+
+        DBG(cdev, "reset config\n");
+
+        list_for_each_entry(f, &cdev->config->functions, list) {
+                if (f->disable)
+                        f->disable(f);
+        }
+        cdev->config = NULL;
+}
+
+static int set_config(struct usb_composite_dev *cdev,
+                const struct usb_ctrlrequest *ctrl, unsigned number)
+{
+        struct usb_gadget       *gadget = cdev->gadget;
+        struct usb_configuration *c = NULL;
+        int                     result = -EINVAL;
+        unsigned                power = gadget_is_otg(gadget) ? 8 : 100;
+        int                     tmp;
+
+        if (cdev->config)
+                reset_config(cdev);
+
+        if (number) {
+                list_for_each_entry(c, &cdev->configs, list) {
+                        if (c->bConfigurationValue == number) {
+                                result = 0;
+                                break;
+                        }
+                }
+                if (result < 0)
+                        goto done;
+        } else
+                result = 0;
+
+        INFO(cdev, "%s speed config #%d: %s\n",
+                ({ char *speed;
+                switch (gadget->speed) {
+                case USB_SPEED_LOW:     speed = "low"; break;
+                case USB_SPEED_FULL:    speed = "full"; break;
+                case USB_SPEED_HIGH:    speed = "high"; break;
+                default:                speed = "?"; break;
+                } ; speed; }), number, c ? c->label : "unconfigured");
+
+        if (!c)
+                goto done;
+
+        cdev->config = c;
+
+        /* Initialize all interfaces by setting them to altsetting zero. */
+        for (tmp = 0; tmp < MAX_CONFIG_INTERFACES; tmp++) {
+                struct usb_function     *f = c->interface[tmp];
+
+                if (!f)
+                        break;
+
+                result = f->set_alt(f, tmp, 0);
+                if (result < 0) {
+                        DBG(cdev, "interface %d (%s/%p) alt 0 --> %d\n",
+                                        tmp, f->name, f, result);
+
+                        reset_config(cdev);
+                        goto done;
+                }
+        }
+
+        /* when we return, be sure our power usage is valid */
+        power = 2 * c->bMaxPower;
+done:
+        usb_gadget_vbus_draw(gadget, power);
+        return result;
+}
+
+/**
+ * usb_add_config() - add a configuration to a device.
+ * @cdev: wraps the USB gadget
+ * @config: the configuration, with bConfigurationValue assigned
+ * Context: single threaded during gadget setup
+ *
+ * One of the main tasks of a composite driver's bind() routine is to
+ * add each of the configurations it supports, using this routine.
+ *
+ * This function returns the value of the configuration's bind(), which
+ * is zero for success else a negative errno value.  Binding configurations
+ * assigns global resources including string IDs, and per-configuration
+ * resources such as interface IDs and endpoints.
+ */
+int __init usb_add_config(struct usb_composite_dev *cdev,
+                struct usb_configuration *config)
+{
+        int                             status = -EINVAL;
+        struct usb_configuration        *c;
+
+        DBG(cdev, "adding config #%u '%s'/%p\n",
+                        config->bConfigurationValue,
+                        config->label, config);
+
+        if (!config->bConfigurationValue || !config->bind)
+                goto done;
+
+        /* Prevent duplicate configuration identifiers */
+        list_for_each_entry(c, &cdev->configs, list) {
+                if (c->bConfigurationValue == config->bConfigurationValue) {
+                        status = -EBUSY;
+                        goto done;
+                }
+        }
+
+        config->cdev = cdev;
+        list_add_tail(&config->list, &cdev->configs);
+
+        INIT_LIST_HEAD(&config->functions);
+        config->next_interface_id = 0;
+
+        status = config->bind(config);
+        if (status < 0) {
+                list_del(&config->list);
+                config->cdev = NULL;
+        } else {
+                unsigned        i;
+
+                DBG(cdev, "cfg %d/%p speeds:%s%s\n",
+                        config->bConfigurationValue, config,
+                        config->highspeed ? " high" : "",
+                        config->fullspeed
+                                ? (gadget_is_dualspeed(cdev->gadget)
+                                        ? " full"
+                                        : " full/low")
+                                : "");
+
+                for (i = 0; i < MAX_CONFIG_INTERFACES; i++) {
+                        struct usb_function     *f = config->interface[i];
+
+                        if (!f)
+                                continue;
+                        DBG(cdev, "  interface %d = %s/%p\n",
+                                i, f->name, f);
+                }
+        }
+
+        /* set_alt(), or next config->bind(), sets up
+         * ep->driver_data as needed.
+         */
+        usb_ep_autoconfig_reset(cdev->gadget);
+
+done:
+        if (status)
+                DBG(cdev, "added config '%s'/%u --> %d\n", config->label,
+                                config->bConfigurationValue, status);
+        return status;
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* We support strings in multiple languages ... string descriptor zero
+ * says which languages are supported.  The typical case will be that
+ * only one language (probably English) is used, with I18N handled on
+ * the host side.
+ */
+
+static void collect_langs(struct usb_gadget_strings **sp, __le16 *buf)
+{
+        const struct usb_gadget_strings *s;
+        u16                             language;
+        __le16                          *tmp;
+
+        while (*sp) {
+                s = *sp;
+                language = cpu_to_le16(s->language);
+                for (tmp = buf; *tmp && tmp < &buf[126]; tmp++) {
+                        if (*tmp == language)
+                                goto repeat;
+                }
+                *tmp++ = language;
+repeat:
+                sp++;
+        }
+}
+
+static int lookup_string(
+        struct usb_gadget_strings       **sp,
+        void                            *buf,
+        u16                             language,
+        int                             id
+)
+{
+        struct usb_gadget_strings       *s;
+        int                             value;
+
+        while (*sp) {
+                s = *sp++;
+                if (s->language != language)
+                        continue;
+                value = usb_gadget_get_string(s, id, buf);
+                if (value > 0)
+                        return value;
+        }
+        return -EINVAL;
+}
+
+static int get_string(struct usb_composite_dev *cdev,
+                void *buf, u16 language, int id)
+{
+        struct usb_configuration        *c;
+        struct usb_function             *f;
+        int                             len;
+
+        /* Yes, not only is USB's I18N support probably more than most
+         * folk will ever care about ... also, it's all supported here.
+         * (Except for UTF8 support for Unicode's "Astral Planes".)
+         */
+
+        /* 0 == report all available language codes */
+        if (id == 0) {
+                struct usb_string_descriptor    *s = buf;
+                struct usb_gadget_strings       **sp;
+
+                memset(s, 0, 256);
+                s->bDescriptorType = USB_DT_STRING;
+
+                sp = composite->strings;
+                if (sp)
+                        collect_langs(sp, s->wData);
+
+                list_for_each_entry(c, &cdev->configs, list) {
+                        sp = c->strings;
+                        if (sp)
+                                collect_langs(sp, s->wData);
+
+                        list_for_each_entry(f, &c->functions, list) {
+                                sp = f->strings;
+                                if (sp)
+                                        collect_langs(sp, s->wData);
+                        }
+                }
+
+                for (len = 0; s->wData[len] && len <= 126; len++)
+                        continue;
+                if (!len)
+                        return -EINVAL;
+
+                s->bLength = 2 * (len + 1);
+                return s->bLength;
+        }
+
+        /* Otherwise, look up and return a specified string.  String IDs
+         * are device-scoped, so we look up each string table we're told
+         * about.  These lookups are infrequent; simpler-is-better here.
+         */
+        if (composite->strings) {
+                len = lookup_string(composite->strings, buf, language, id);
+                if (len > 0)
+                        return len;
+        }
+        list_for_each_entry(c, &cdev->configs, list) {
+                if (c->strings) {
+                        len = lookup_string(c->strings, buf, language, id);
+                        if (len > 0)
+                                return len;
+                }
+                list_for_each_entry(f, &c->functions, list) {
+                        if (!f->strings)
+                                continue;
+                        len = lookup_string(f->strings, buf, language, id);
+                        if (len > 0)
+                                return len;
+                }
+        }
+        return -EINVAL;
+}
+
+/**
+ * usb_string_id() - allocate an unused string ID
+ * @cdev: the device whose string descriptor IDs are being allocated
+ * Context: single threaded during gadget setup
+ *
+ * @usb_string_id() is called from bind() callbacks to allocate
+ * string IDs.  Drivers for functions, configurations, or gadgets will
+ * then store that ID in the appropriate descriptors and string table.
+ *
+ * All string identifier should be allocated using this routine, to
+ * ensure that for example different functions don't wrongly assign
+ * different meanings to the same identifier.
+ */
+int __init usb_string_id(struct usb_composite_dev *cdev)
+{
+        if (cdev->next_string_id < 254) {
+                /* string id 0 is reserved */
+                cdev->next_string_id++;
+                return cdev->next_string_id;
+        }
+        return -ENODEV;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static void composite_setup_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        if (req->status || req->actual != req->length)
+                DBG((struct usb_composite_dev *) ep->driver_data,
+                                "setup complete --> %d, %d/%d\n",
+                                req->status, req->actual, req->length);
+}
+
+/*
+ * The setup() callback implements all the ep0 functionality that's
+ * not handled lower down, in hardware or the hardware driver(like
+ * device and endpoint feature flags, and their status).  It's all
+ * housekeeping for the gadget function we're implementing.  Most of
+ * the work is in config and function specific setup.
+ */
+static int
+composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
+{
+        struct usb_composite_dev        *cdev = get_gadget_data(gadget);
+        struct usb_request              *req = cdev->req;
+        int                             value = -EOPNOTSUPP;
+        u16                             w_index = le16_to_cpu(ctrl->wIndex);
+        u16                             w_value = le16_to_cpu(ctrl->wValue);
+        u16                             w_length = le16_to_cpu(ctrl->wLength);
+        struct usb_function             *f = NULL;
+
+        /* partial re-init of the response message; the function or the
+         * gadget might need to intercept e.g. a control-OUT completion
+         * when we delegate to it.
+         */
+        req->zero = 0;
+        req->complete = composite_setup_complete;
+        req->length = USB_BUFSIZ;
+        gadget->ep0->driver_data = cdev;
+
+        switch (ctrl->bRequest) {
+
+        /* we handle all standard USB descriptors */
+        case USB_REQ_GET_DESCRIPTOR:
+                if (ctrl->bRequestType != USB_DIR_IN)
+                        goto unknown;
+                switch (w_value >> 8) {
+
+                case USB_DT_DEVICE:
+                        cdev->desc.bNumConfigurations =
+                                count_configs(cdev, USB_DT_DEVICE);
+                        value = min(w_length, (u16) sizeof cdev->desc);
+                        memcpy(req->buf, &cdev->desc, value);
+                        break;
+                case USB_DT_DEVICE_QUALIFIER:
+                        if (!gadget_is_dualspeed(gadget))
+                                break;
+                        device_qual(cdev);
+                        value = min_t(int, w_length,
+                                sizeof(struct usb_qualifier_descriptor));
+                        break;
+                case USB_DT_OTHER_SPEED_CONFIG:
+                        if (!gadget_is_dualspeed(gadget))
+                                break;
+                        /* FALLTHROUGH */
+                case USB_DT_CONFIG:
+                        value = config_desc(cdev, w_value);
+                        if (value >= 0)
+                                value = min(w_length, (u16) value);
+                        break;
+                case USB_DT_STRING:
+                        value = get_string(cdev, req->buf,
+                                        w_index, w_value & 0xff);
+                        if (value >= 0)
+                                value = min(w_length, (u16) value);
+                        break;
+                }
+                break;
+
+        /* any number of configs can work */
+        case USB_REQ_SET_CONFIGURATION:
+                if (ctrl->bRequestType != 0)
+                        goto unknown;
+                if (gadget_is_otg(gadget)) {
+                        if (gadget->a_hnp_support)
+                                DBG(cdev, "HNP available\n");
+                        else if (gadget->a_alt_hnp_support)
+                                DBG(cdev, "HNP on another port\n");
+                        else
+                                VDBG(cdev, "HNP inactive\n");
+                }
+                spin_lock(&cdev->lock);
+                value = set_config(cdev, ctrl, w_value);
+                spin_unlock(&cdev->lock);
+                break;
+        case USB_REQ_GET_CONFIGURATION:
+                if (ctrl->bRequestType != USB_DIR_IN)
+                        goto unknown;
+                if (cdev->config)
+                        *(u8 *)req->buf = cdev->config->bConfigurationValue;
+                else
+                        *(u8 *)req->buf = 0;
+                value = min(w_length, (u16) 1);
+                break;
+
+        /* function drivers must handle get/set altsetting; if there's
+         * no get() method, we know only altsetting zero works.
+         */
+        case USB_REQ_SET_INTERFACE:
+                if (ctrl->bRequestType != USB_RECIP_INTERFACE)
+                        goto unknown;
+                if (!cdev->config || w_index >= MAX_CONFIG_INTERFACES)
+                        break;
+                f = cdev->config->interface[w_index];
+                if (!f)
+                        break;
+                if (w_value && !f->get_alt)
+                        break;
+                value = f->set_alt(f, w_index, w_value);
+                break;
+        case USB_REQ_GET_INTERFACE:
+                if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE))
+                        goto unknown;
+                if (!cdev->config || w_index >= MAX_CONFIG_INTERFACES)
+                        break;
+                f = cdev->config->interface[w_index];
+                if (!f)
+                        break;
+                /* lots of interfaces only need altsetting zero... */
+                value = f->get_alt ? f->get_alt(f, w_index) : 0;
+                if (value < 0)
+                        break;
+                *((u8 *)req->buf) = value;
+                value = min(w_length, (u16) 1);
+                break;
+        default:
+unknown:
+                VDBG(cdev,
+                        "non-core control req%02x.%02x v%04x i%04x l%d\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, w_length);
+
+                /* functions always handle their interfaces ... punt other
+                 * recipients (endpoint, other, WUSB, ...) to the current
+                 * configuration code.
+                 *
+                 * REVISIT it could make sense to let the composite device
+                 * take such requests too, if that's ever needed:  to work
+                 * in config 0, etc.
+                 */
+                if ((ctrl->bRequestType & USB_RECIP_MASK)
+                                == USB_RECIP_INTERFACE) {
+                        f = cdev->config->interface[w_index];
+                        if (f && f->setup)
+                                value = f->setup(f, ctrl);
+                        else
+                                f = NULL;
+                }
+                if (value < 0 && !f) {
+                        struct usb_configuration        *c;
+
+                        c = cdev->config;
+                        if (c && c->setup)
+                                value = c->setup(c, ctrl);
+                }
+
+                goto done;
+        }
+
+        /* respond with data transfer before status phase? */
+        if (value >= 0) {
+                req->length = value;
+                req->zero = value < w_length;
+                value = usb_ep_queue(gadget->ep0, req, GFP_ATOMIC);
+                if (value < 0) {
+                        DBG(cdev, "ep_queue --> %d\n", value);
+                        req->status = 0;
+                        composite_setup_complete(gadget->ep0, req);
+                }
+        }
+
+done:
+        /* device either stalls (value < 0) or reports success */
+        return value;
+}
+
+static void composite_disconnect(struct usb_gadget *gadget)
+{
+        struct usb_composite_dev        *cdev = get_gadget_data(gadget);
+        unsigned long                   flags;
+
+        /* REVISIT:  should we have config and device level
+         * disconnect callbacks?
+         */
+        spin_lock_irqsave(&cdev->lock, flags);
+        if (cdev->config)
+                reset_config(cdev);
+        spin_unlock_irqrestore(&cdev->lock, flags);
+}
+
+/*-------------------------------------------------------------------------*/
+
+static void /* __init_or_exit */
+composite_unbind(struct usb_gadget *gadget)
+{
+        struct usb_composite_dev        *cdev = get_gadget_data(gadget);
+
+        /* composite_disconnect() must already have been called
+         * by the underlying peripheral controller driver!
+         * so there's no i/o concurrency that could affect the
+         * state protected by cdev->lock.
+         */
+        WARN_ON(cdev->config);
+
+        while (!list_empty(&cdev->configs)) {
+                struct usb_configuration        *c;
+
+                c = list_first_entry(&cdev->configs,
+                                struct usb_configuration, list);
+                while (!list_empty(&c->functions)) {
+                        struct usb_function             *f;
+
+                        f = list_first_entry(&c->functions,
+                                        struct usb_function, list);
+                        list_del(&f->list);
+                        if (f->unbind) {
+                                DBG(cdev, "unbind function '%s'/%p\n",
+                                                f->name, f);
+                                f->unbind(c, f);
+                                /* may free memory for "f" */
+                        }
+                }
+                list_del(&c->list);
+                if (c->unbind) {
+                        DBG(cdev, "unbind config '%s'/%p\n", c->label, c);
+                        c->unbind(c);
+                        /* may free memory for "c" */
+                }
+        }
+        if (composite->unbind)
+                composite->unbind(cdev);
+
+        if (cdev->req) {
+                kfree(cdev->req->buf);
+                usb_ep_free_request(gadget->ep0, cdev->req);
+        }
+        kfree(cdev);
+        set_gadget_data(gadget, NULL);
+        composite = NULL;
+}
+
+static void __init
+string_override_one(struct usb_gadget_strings *tab, u8 id, const char *s)
+{
+        struct usb_string               *str = tab->strings;
+
+        for (str = tab->strings; str->s; str++) {
+                if (str->id == id) {
+                        str->s = s;
+                        return;
+                }
+        }
+}
+
+static void __init
+string_override(struct usb_gadget_strings **tab, u8 id, const char *s)
+{
+        while (*tab) {
+                string_override_one(*tab, id, s);
+                tab++;
+        }
+}
+
+static int __init composite_bind(struct usb_gadget *gadget)
+{
+        struct usb_composite_dev        *cdev;
+        int                             status = -ENOMEM;
+
+        cdev = kzalloc(sizeof *cdev, GFP_KERNEL);
+        if (!cdev)
+                return status;
+
+        spin_lock_init(&cdev->lock);
+        cdev->gadget = gadget;
+        set_gadget_data(gadget, cdev);
+        INIT_LIST_HEAD(&cdev->configs);
+
+        /* preallocate control response and buffer */
+        cdev->req = usb_ep_alloc_request(gadget->ep0, GFP_KERNEL);
+        if (!cdev->req)
+                goto fail;
+        cdev->req->buf = kmalloc(USB_BUFSIZ, GFP_KERNEL);
+        if (!cdev->req->buf)
+                goto fail;
+        cdev->req->complete = composite_setup_complete;
+        gadget->ep0->driver_data = cdev;
+
+        cdev->bufsiz = USB_BUFSIZ;
+        cdev->driver = composite;
+
+        usb_gadget_set_selfpowered(gadget);
+
+        /* interface and string IDs start at zero via kzalloc.
+         * we force endpoints to start unassigned; few controller
+         * drivers will zero ep->driver_data.
+         */
+        usb_ep_autoconfig_reset(cdev->gadget);
+
+        /* composite gadget needs to assign strings for whole device (like
+         * serial number), register function drivers, potentially update
+         * power state and consumption, etc
+         */
+        status = composite->bind(cdev);
+        if (status < 0)
+                goto fail;
+
+        cdev->desc = *composite->dev;
+        cdev->desc.bMaxPacketSize0 = gadget->ep0->maxpacket;
+
+        /* standardized runtime overrides for device ID data */
+        if (idVendor)
+                cdev->desc.idVendor = cpu_to_le16(idVendor);
+        if (idProduct)
+                cdev->desc.idProduct = cpu_to_le16(idProduct);
+        if (bcdDevice)
+                cdev->desc.bcdDevice = cpu_to_le16(bcdDevice);
+
+        /* strings can't be assigned before bind() allocates the
+         * releavnt identifiers
+         */
+        if (cdev->desc.iManufacturer && iManufacturer)
+                string_override(composite->strings,
+                        cdev->desc.iManufacturer, iManufacturer);
+        if (cdev->desc.iProduct && iProduct)
+                string_override(composite->strings,
+                        cdev->desc.iProduct, iProduct);
+        if (cdev->desc.iSerialNumber && iSerialNumber)
+                string_override(composite->strings,
+                        cdev->desc.iSerialNumber, iSerialNumber);
+
+        INFO(cdev, "%s ready\n", composite->name);
+        return 0;
+
+fail:
+        composite_unbind(gadget);
+        return status;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static void
+composite_suspend(struct usb_gadget *gadget)
+{
+        struct usb_composite_dev        *cdev = get_gadget_data(gadget);
+        struct usb_function             *f;
+
+        /* REVISIT:  should we have config and device level
+         * suspend/resume callbacks?
+         */
+        DBG(cdev, "suspend\n");
+        if (cdev->config) {
+                list_for_each_entry(f, &cdev->config->functions, list) {
+                        if (f->suspend)
+                                f->suspend(f);
+                }
+        }
+}
+
+static void
+composite_resume(struct usb_gadget *gadget)
+{
+        struct usb_composite_dev        *cdev = get_gadget_data(gadget);
+        struct usb_function             *f;
+
+        /* REVISIT:  should we have config and device level
+         * suspend/resume callbacks?
+         */
+        DBG(cdev, "resume\n");
+        if (cdev->config) {
+                list_for_each_entry(f, &cdev->config->functions, list) {
+                        if (f->resume)
+                                f->resume(f);
+                }
+        }
+}
+
+/*-------------------------------------------------------------------------*/
+
+static struct usb_gadget_driver composite_driver = {
+        .speed          = USB_SPEED_HIGH,
+
+        .bind           = composite_bind,
+        .unbind         = __exit_p(composite_unbind),
+
+        .setup          = composite_setup,
+        .disconnect     = composite_disconnect,
+
+        .suspend        = composite_suspend,
+        .resume         = composite_resume,
+
+        .driver = {
+                .owner          = THIS_MODULE,
+        },
+};
+
+/**
+ * usb_composite_register() - register a composite driver
+ * @driver: the driver to register
+ * Context: single threaded during gadget setup
+ *
+ * This function is used to register drivers using the composite driver
+ * framework.  The return value is zero, or a negative errno value.
+ * Those values normally come from the driver's @bind method, which does
+ * all the work of setting up the driver to match the hardware.
+ *
+ * On successful return, the gadget is ready to respond to requests from
+ * the host, unless one of its components invokes usb_gadget_disconnect()
+ * while it was binding.  That would usually be done in order to wait for
+ * some userspace participation.
+ */
+int __init usb_composite_register(struct usb_composite_driver *driver)
+{
+        if (!driver || !driver->dev || !driver->bind || composite)
+                return -EINVAL;
+
+        if (!driver->name)
+                driver->name = "composite";
+        composite_driver.function =  (char *) driver->name;
+        composite_driver.driver.name = driver->name;
+        composite = driver;
+
+        return usb_gadget_register_driver(&composite_driver);
+}
+
+/**
+ * usb_composite_unregister() - unregister a composite driver
+ * @driver: the driver to unregister
+ *
+ * This function is used to unregister drivers using the composite
+ * driver framework.
+ */
+void __exit usb_composite_unregister(struct usb_composite_driver *driver)
+{
+        if (composite != driver)
+                return;
+        usb_gadget_unregister_driver(&composite_driver);
+}
diff --git a/drivers/usb/gadget/config.c b/drivers/usb/gadget/config.c
index a4e54b2743f0..1ca1c326392a 100644
--- a/drivers/usb/gadget/config.c
+++ b/drivers/usb/gadget/config.c
@@ -96,7 +96,7 @@ int usb_gadget_config_buf(
         /* config descriptor first */
         if (length < USB_DT_CONFIG_SIZE || !desc)
                 return -EINVAL;
-        *cp = *config; 
+        *cp = *config;
 
         /* then interface/endpoint/class/vendor/... */
         len = usb_descriptor_fillbuf(USB_DT_CONFIG_SIZE + (u8*)buf,
@@ -115,3 +115,77 @@ int usb_gadget_config_buf(
         return len;
 }
 
+/**
+ * usb_copy_descriptors - copy a vector of USB descriptors
+ * @src: null-terminated vector to copy
+ * Context: initialization code, which may sleep
+ *
+ * This makes a copy of a vector of USB descriptors.  Its primary use
+ * is to support usb_function objects which can have multiple copies,
+ * each needing different descriptors.  Functions may have static
+ * tables of descriptors, which are used as templates and customized
+ * with identifiers (for interfaces, strings, endpoints, and more)
+ * as needed by a given function instance.
+ */
+struct usb_descriptor_header **__init
+usb_copy_descriptors(struct usb_descriptor_header **src)
+{
+        struct usb_descriptor_header **tmp;
+        unsigned bytes;
+        unsigned n_desc;
+        void *mem;
+        struct usb_descriptor_header **ret;
+
+        /* count descriptors and their sizes; then add vector size */
+        for (bytes = 0, n_desc = 0, tmp = src; *tmp; tmp++, n_desc++)
+                bytes += (*tmp)->bLength;
+        bytes += (n_desc + 1) * sizeof(*tmp);
+
+        mem = kmalloc(bytes, GFP_KERNEL);
+        if (!mem)
+                return NULL;
+
+        /* fill in pointers starting at "tmp",
+         * to descriptors copied starting at "mem";
+         * and return "ret"
+         */
+        tmp = mem;
+        ret = mem;
+        mem += (n_desc + 1) * sizeof(*tmp);
+        while (*src) {
+                memcpy(mem, *src, (*src)->bLength);
+                *tmp = mem;
+                tmp++;
+                mem += (*src)->bLength;
+                src++;
+        }
+        *tmp = NULL;
+
+        return ret;
+}
+
+/**
+ * usb_find_endpoint - find a copy of an endpoint descriptor
+ * @src: original vector of descriptors
+ * @copy: copy of @src
+ * @ep: endpoint descriptor found in @src
+ *
+ * This returns the copy of the @match descriptor made for @copy.  Its
+ * intended use is to help remembering the endpoint descriptor to use
+ * when enabling a given endpoint.
+ */
+struct usb_endpoint_descriptor *__init
+usb_find_endpoint(
+        struct usb_descriptor_header **src,
+        struct usb_descriptor_header **copy,
+        struct usb_endpoint_descriptor *match
+)
+{
+        while (*src) {
+                if (*src == (void *) match)
+                        return (void *)*copy;
+                src++;
+                copy++;
+        }
+        return NULL;
+}
diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
index 42036192a03c..21d1406af9ee 100644
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -862,7 +862,7 @@ static int dummy_udc_probe (struct platform_device *pdev)
         /* maybe claim OTG support, though we won't complete HNP */
         dum->gadget.is_otg = (dummy_to_hcd(dum)->self.otg_port != 0);
 
-        strcpy (dum->gadget.dev.bus_id, "gadget");
+        dev_set_name(&dum->gadget.dev, "gadget");
         dum->gadget.dev.parent = &pdev->dev;
         dum->gadget.dev.release = dummy_gadget_release;
         rc = device_register (&dum->gadget.dev);
@@ -1865,7 +1865,7 @@ static int dummy_hcd_probe(struct platform_device *pdev)
 
         dev_info(&pdev->dev, "%s, driver " DRIVER_VERSION "\n", driver_desc);
 
-        hcd = usb_create_hcd(&dummy_hcd, &pdev->dev, pdev->dev.bus_id);
+        hcd = usb_create_hcd(&dummy_hcd, &pdev->dev, dev_name(&pdev->dev));
         if (!hcd)
                 return -ENOMEM;
         the_controller = hcd_to_dummy (hcd);
diff --git a/drivers/usb/gadget/epautoconf.c b/drivers/usb/gadget/epautoconf.c
index 8bdad221fa91..9462e30192d8 100644
--- a/drivers/usb/gadget/epautoconf.c
+++ b/drivers/usb/gadget/epautoconf.c
@@ -159,6 +159,7 @@ ep_matches (
         /* MATCH!! */
 
         /* report address */
+        desc->bEndpointAddress &= USB_DIR_IN;
         if (isdigit (ep->name [2])) {
                 u8      num = simple_strtol (&ep->name [2], NULL, 10);
                 desc->bEndpointAddress |= num;
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index 4ce3950b997f..d7aaaa29b1e1 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -1,8 +1,9 @@
 /*
  * ether.c -- Ethernet gadget driver, with CDC and non-CDC options
  *
- * Copyright (C) 2003-2005 David Brownell
+ * Copyright (C) 2003-2005,2008 David Brownell
  * Copyright (C) 2003-2004 Robert Schwebel, Benedikt Spranger
+ * Copyright (C) 2008 Nokia Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -23,18 +24,9 @@
 
 #include <linux/kernel.h>
 #include <linux/utsname.h>
-#include <linux/device.h>
-#include <linux/ctype.h>
-#include <linux/etherdevice.h>
-#include <linux/ethtool.h>
 
-#include <linux/usb/ch9.h>
-#include <linux/usb/cdc.h>
-#include <linux/usb/gadget.h>
+#include "u_ether.h"
 
-#include "gadget_chips.h"
-
-/*-------------------------------------------------------------------------*/
 
 /*
  * Ethernet gadget driver -- with CDC and non-CDC options
@@ -46,7 +38,11 @@
  * this USB-IF standard as its open-systems interoperability solution;
  * most host side USB stacks (except from Microsoft) support it.
  *
- * There's some hardware that can't talk CDC.  We make that hardware
+ * This is sometimes called "CDC ECM" (Ethernet Control Model) to support
+ * TLA-soup.  "CDC ACM" (Abstract Control Model) is for modems, and a new
+ * "CDC EEM" (Ethernet Emulation Model) is starting to spread.
+ *
+ * There's some hardware that can't talk CDC ECM.  We make that hardware
  * implement a "minimalist" vendor-agnostic CDC core:  same framing, but
  * link-level setup only requires activating the configuration.  Only the
  * endpoint descriptors, and product/vendor IDs, are relevant; no control
@@ -64,70 +60,40 @@
  * A third option is also in use.  Rather than CDC Ethernet, or something
  * simpler, Microsoft pushes their own approach: RNDIS.  The published
  * RNDIS specs are ambiguous and appear to be incomplete, and are also
- * needlessly complex.
+ * needlessly complex.  They borrow more from CDC ACM than CDC ECM.
  */
 
 #define DRIVER_DESC             "Ethernet Gadget"
-#define DRIVER_VERSION          "May Day 2005"
-
-static const char shortname [] = "ether";
-static const char driver_desc [] = DRIVER_DESC;
-
-#define RX_EXTRA        20              /* guard against rx overflows */
-
-#include "rndis.h"
+#define DRIVER_VERSION          "Memorial Day 2008"
 
-#ifndef CONFIG_USB_ETH_RNDIS
-#define rndis_uninit(x)         do{}while(0)
-#define rndis_deregister(c)     do{}while(0)
-#define rndis_exit()            do{}while(0)
+#ifdef CONFIG_USB_ETH_RNDIS
+#define PREFIX                  "RNDIS/"
+#else
+#define PREFIX                  ""
 #endif
 
-/* CDC and RNDIS support the same host-chosen outgoing packet filters. */
-#define DEFAULT_FILTER  (USB_CDC_PACKET_TYPE_BROADCAST \
-                        |USB_CDC_PACKET_TYPE_ALL_MULTICAST \
-                        |USB_CDC_PACKET_TYPE_PROMISCUOUS \
-                        |USB_CDC_PACKET_TYPE_DIRECTED)
-
-
-/*-------------------------------------------------------------------------*/
-
-struct eth_dev {
-        spinlock_t              lock;
-        struct usb_gadget       *gadget;
-        struct usb_request      *req;           /* for control responses */
-        struct usb_request      *stat_req;      /* for cdc & rndis status */
-
-        u8                      config;
-        struct usb_ep           *in_ep, *out_ep, *status_ep;
-        const struct usb_endpoint_descriptor
-                                *in, *out, *status;
-
-        spinlock_t              req_lock;
-        struct list_head        tx_reqs, rx_reqs;
-
-        struct net_device       *net;
-        struct net_device_stats stats;
-        atomic_t                tx_qlen;
-
-        struct work_struct      work;
-        unsigned                zlp:1;
-        unsigned                cdc:1;
-        unsigned                rndis:1;
-        unsigned                suspended:1;
-        u16                     cdc_filter;
-        unsigned long           todo;
-#define WORK_RX_MEMORY          0
-        int                     rndis_config;
-        u8                      host_mac [ETH_ALEN];
-};
-
-/* This version autoconfigures as much as possible at run-time.
+/*
+ * This driver aims for interoperability by using CDC ECM unless
+ *
+ *              can_support_ecm()
+ *
+ * returns false, in which case it supports the CDC Subset.  By default,
+ * that returns true; most hardware has no problems with CDC ECM, that's
+ * a good default.  Previous versions of this driver had no default; this
+ * version changes that, removing overhead for new controller support.
  *
- * It also ASSUMES a self-powered device, without remote wakeup,
- * although remote wakeup support would make sense.
+ *      IF YOUR HARDWARE CAN'T SUPPORT CDC ECM, UPDATE THAT ROUTINE!
  */
 
+static inline bool has_rndis(void)
+{
+#ifdef  CONFIG_USB_ETH_RNDIS
+        return true;
+#else
+        return false;
+#endif
+}
+
 /*-------------------------------------------------------------------------*/
 
 /* DO NOT REUSE THESE IDs with a protocol-incompatible driver!!  Ever!!
@@ -137,8 +103,8 @@ struct eth_dev {
 /* Thanks to NetChip Technologies for donating this product ID.
  * It's for devices with only CDC Ethernet configurations.
  */
-#define CDC_VENDOR_NUM  0x0525          /* NetChip */
-#define CDC_PRODUCT_NUM 0xa4a1          /* Linux-USB Ethernet Gadget */
+#define CDC_VENDOR_NUM          0x0525  /* NetChip */
+#define CDC_PRODUCT_NUM         0xa4a1  /* Linux-USB Ethernet Gadget */
 
 /* For hardware that can't talk CDC, we use the same vendor ID that
  * ARM Linux has used for ethernet-over-usb, both with sa1100 and
@@ -162,274 +128,9 @@ struct eth_dev {
 #define RNDIS_VENDOR_NUM        0x0525  /* NetChip */
 #define RNDIS_PRODUCT_NUM       0xa4a2  /* Ethernet/RNDIS Gadget */
 
-
-/* Some systems will want different product identifers published in the
- * device descriptor, either numbers or strings or both.  These string
- * parameters are in UTF-8 (superset of ASCII's 7 bit characters).
- */
-
-static ushort idVendor;
-module_param(idVendor, ushort, S_IRUGO);
-MODULE_PARM_DESC(idVendor, "USB Vendor ID");
-
-static ushort idProduct;
-module_param(idProduct, ushort, S_IRUGO);
-MODULE_PARM_DESC(idProduct, "USB Product ID");
-
-static ushort bcdDevice;
-module_param(bcdDevice, ushort, S_IRUGO);
-MODULE_PARM_DESC(bcdDevice, "USB Device version (BCD)");
-
-static char *iManufacturer;
-module_param(iManufacturer, charp, S_IRUGO);
-MODULE_PARM_DESC(iManufacturer, "USB Manufacturer string");
-
-static char *iProduct;
-module_param(iProduct, charp, S_IRUGO);
-MODULE_PARM_DESC(iProduct, "USB Product string");
-
-static char *iSerialNumber;
-module_param(iSerialNumber, charp, S_IRUGO);
-MODULE_PARM_DESC(iSerialNumber, "SerialNumber");
-
-/* initial value, changed by "ifconfig usb0 hw ether xx:xx:xx:xx:xx:xx" */
-static char *dev_addr;
-module_param(dev_addr, charp, S_IRUGO);
-MODULE_PARM_DESC(dev_addr, "Device Ethernet Address");
-
-/* this address is invisible to ifconfig */
-static char *host_addr;
-module_param(host_addr, charp, S_IRUGO);
-MODULE_PARM_DESC(host_addr, "Host Ethernet Address");
-
-
-/*-------------------------------------------------------------------------*/
-
-/* Include CDC support if we could run on CDC-capable hardware. */
-
-#ifdef CONFIG_USB_GADGET_NET2280
-#define DEV_CONFIG_CDC
-#endif
-
-#ifdef CONFIG_USB_GADGET_DUMMY_HCD
-#define DEV_CONFIG_CDC
-#endif
-
-#ifdef CONFIG_USB_GADGET_GOKU
-#define DEV_CONFIG_CDC
-#endif
-
-#ifdef CONFIG_USB_GADGET_LH7A40X
-#define DEV_CONFIG_CDC
-#endif
-
-#ifdef CONFIG_USB_GADGET_MQ11XX
-#define DEV_CONFIG_CDC
-#endif
-
-#ifdef CONFIG_USB_GADGET_OMAP
-#define DEV_CONFIG_CDC
-#endif
-
-#ifdef CONFIG_USB_GADGET_N9604
-#define DEV_CONFIG_CDC
-#endif
-
-#ifdef CONFIG_USB_GADGET_S3C2410
-#define DEV_CONFIG_CDC
-#endif
-
-#ifdef CONFIG_USB_GADGET_AT91
-#define DEV_CONFIG_CDC
-#endif
-
-#ifdef CONFIG_USB_GADGET_MUSBHSFC
-#define DEV_CONFIG_CDC
-#endif
-
-#ifdef CONFIG_USB_GADGET_MUSB_HDRC
-#define DEV_CONFIG_CDC
-#endif
-
-#ifdef CONFIG_USB_GADGET_ATMEL_USBA
-#define DEV_CONFIG_CDC
-#endif
-
-#ifdef CONFIG_USB_GADGET_FSL_USB2
-#define DEV_CONFIG_CDC
-#endif
-
-/* For CDC-incapable hardware, choose the simple cdc subset.
- * Anything that talks bulk (without notable bugs) can do this.
- */
-#ifdef CONFIG_USB_GADGET_PXA25X
-#define DEV_CONFIG_SUBSET
-#endif
-
-#ifdef CONFIG_USB_GADGET_PXA27X
-#define DEV_CONFIG_SUBSET
-#endif
-
-#ifdef CONFIG_USB_GADGET_SUPERH
-#define DEV_CONFIG_SUBSET
-#endif
-
-#ifdef CONFIG_USB_GADGET_SA1100
-/* use non-CDC for backwards compatibility */
-#define DEV_CONFIG_SUBSET
-#endif
-
-#ifdef CONFIG_USB_GADGET_M66592
-#define DEV_CONFIG_CDC
-#endif
-
-#ifdef CONFIG_USB_GADGET_AMD5536UDC
-#define DEV_CONFIG_CDC
-#endif
-
-
-/*-------------------------------------------------------------------------*/
-
-/* "main" config is either CDC, or its simple subset */
-static inline int is_cdc(struct eth_dev *dev)
-{
-#if     !defined(DEV_CONFIG_SUBSET)
-        return 1;               /* only cdc possible */
-#elif   !defined (DEV_CONFIG_CDC)
-        return 0;               /* only subset possible */
-#else
-        return dev->cdc;        /* depends on what hardware we found */
-#endif
-}
-
-/* "secondary" RNDIS config may sometimes be activated */
-static inline int rndis_active(struct eth_dev *dev)
-{
-#ifdef  CONFIG_USB_ETH_RNDIS
-        return dev->rndis;
-#else
-        return 0;
-#endif
-}
-
-#define subset_active(dev)      (!is_cdc(dev) && !rndis_active(dev))
-#define cdc_active(dev)         ( is_cdc(dev) && !rndis_active(dev))
-
-
-
-#define DEFAULT_QLEN    2       /* double buffering by default */
-
-/* peak bulk transfer bits-per-second */
-#define HS_BPS          (13 * 512 * 8 * 1000 * 8)
-#define FS_BPS          (19 *  64 * 1 * 1000 * 8)
-
-#ifdef CONFIG_USB_GADGET_DUALSPEED
-#define DEVSPEED        USB_SPEED_HIGH
-
-static unsigned qmult = 5;
-module_param (qmult, uint, S_IRUGO|S_IWUSR);
-
-
-/* for dual-speed hardware, use deeper queues at highspeed */
-#define qlen(gadget) \
-        (DEFAULT_QLEN*((gadget->speed == USB_SPEED_HIGH) ? qmult : 1))
-
-static inline int BITRATE(struct usb_gadget *g)
-{
-        return (g->speed == USB_SPEED_HIGH) ? HS_BPS : FS_BPS;
-}
-
-#else   /* full speed (low speed doesn't do bulk) */
-
-#define qmult           1
-
-#define DEVSPEED        USB_SPEED_FULL
-
-#define qlen(gadget) DEFAULT_QLEN
-
-static inline int BITRATE(struct usb_gadget *g)
-{
-        return FS_BPS;
-}
-#endif
-
-
-/*-------------------------------------------------------------------------*/
-
-#define xprintk(d,level,fmt,args...) \
-        printk(level "%s: " fmt , (d)->net->name , ## args)
-
-#ifdef DEBUG
-#undef DEBUG
-#define DEBUG(dev,fmt,args...) \
-        xprintk(dev , KERN_DEBUG , fmt , ## args)
-#else
-#define DEBUG(dev,fmt,args...) \
-        do { } while (0)
-#endif /* DEBUG */
-
-#ifdef VERBOSE_DEBUG
-#define VDEBUG  DEBUG
-#else
-#define VDEBUG(dev,fmt,args...) \
-        do { } while (0)
-#endif /* DEBUG */
-
-#define ERROR(dev,fmt,args...) \
-        xprintk(dev , KERN_ERR , fmt , ## args)
-#define WARN(dev,fmt,args...) \
-        xprintk(dev , KERN_WARNING , fmt , ## args)
-#define INFO(dev,fmt,args...) \
-        xprintk(dev , KERN_INFO , fmt , ## args)
-
 /*-------------------------------------------------------------------------*/
 
-/* USB DRIVER HOOKUP (to the hardware driver, below us), mostly
- * ep0 implementation:  descriptors, config management, setup().
- * also optional class-specific notification interrupt transfer.
- */
-
-/*
- * DESCRIPTORS ... most are static, but strings and (full) configuration
- * descriptors are built on demand.  For now we do either full CDC, or
- * our simple subset, with RNDIS as an optional second configuration.
- *
- * RNDIS includes some CDC ACM descriptors ... like CDC Ethernet.  But
- * the class descriptors match a modem (they're ignored; it's really just
- * Ethernet functionality), they don't need the NOP altsetting, and the
- * status transfer endpoint isn't optional.
- */
-
-#define STRING_MANUFACTURER             1
-#define STRING_PRODUCT                  2
-#define STRING_ETHADDR                  3
-#define STRING_DATA                     4
-#define STRING_CONTROL                  5
-#define STRING_RNDIS_CONTROL            6
-#define STRING_CDC                      7
-#define STRING_SUBSET                   8
-#define STRING_RNDIS                    9
-#define STRING_SERIALNUMBER             10
-
-/* holds our biggest descriptor (or RNDIS response) */
-#define USB_BUFSIZ      256
-
-/*
- * This device advertises one configuration, eth_config, unless RNDIS
- * is enabled (rndis_config) on hardware supporting at least two configs.
- *
- * NOTE:  Controllers like superh_udc should probably be able to use
- * an RNDIS-only configuration.
- *
- * FIXME define some higher-powered configurations to make it easier
- * to recharge batteries ...
- */
-
-#define DEV_CONFIG_VALUE        1       /* cdc or subset */
-#define DEV_RNDIS_CONFIG_VALUE  2       /* rndis; optional */
-
-static struct usb_device_descriptor
-device_desc = {
+static struct usb_device_descriptor device_desc = {
         .bLength =              sizeof device_desc,
         .bDescriptorType =      USB_DT_DEVICE,
 
@@ -438,2220 +139,234 @@ device_desc = {
         .bDeviceClass =         USB_CLASS_COMM,
         .bDeviceSubClass =      0,
         .bDeviceProtocol =      0,
+        /* .bMaxPacketSize0 = f(hardware) */
 
+        /* Vendor and product id defaults change according to what configs
+         * we support.  (As does bNumConfigurations.)  These values can
+         * also be overridden by module parameters.
+         */
         .idVendor =             __constant_cpu_to_le16 (CDC_VENDOR_NUM),
         .idProduct =            __constant_cpu_to_le16 (CDC_PRODUCT_NUM),
-        .iManufacturer =        STRING_MANUFACTURER,
-        .iProduct =             STRING_PRODUCT,
+        /* .bcdDevice = f(hardware) */
+        /* .iManufacturer = DYNAMIC */
+        /* .iProduct = DYNAMIC */
+        /* NO SERIAL NUMBER */
         .bNumConfigurations =   1,
 };
 
-static struct usb_otg_descriptor
-otg_descriptor = {
+static struct usb_otg_descriptor otg_descriptor = {
         .bLength =              sizeof otg_descriptor,
         .bDescriptorType =      USB_DT_OTG,
 
-        .bmAttributes =         USB_OTG_SRP,
-};
-
-static struct usb_config_descriptor
-eth_config = {
-        .bLength =              sizeof eth_config,
-        .bDescriptorType =      USB_DT_CONFIG,
-
-        /* compute wTotalLength on the fly */
-        .bNumInterfaces =       2,
-        .bConfigurationValue =  DEV_CONFIG_VALUE,
-        .iConfiguration =       STRING_CDC,
-        .bmAttributes =         USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
-        .bMaxPower =            50,
-};
-
-#ifdef  CONFIG_USB_ETH_RNDIS
-static struct usb_config_descriptor
-rndis_config = {
-        .bLength =              sizeof rndis_config,
-        .bDescriptorType =      USB_DT_CONFIG,
-
-        /* compute wTotalLength on the fly */
-        .bNumInterfaces =       2,
-        .bConfigurationValue =  DEV_RNDIS_CONFIG_VALUE,
-        .iConfiguration =       STRING_RNDIS,
-        .bmAttributes =         USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
-        .bMaxPower =            50,
-};
-#endif
-
-/*
- * Compared to the simple CDC subset, the full CDC Ethernet model adds
- * three class descriptors, two interface descriptors, optional status
- * endpoint.  Both have a "data" interface and two bulk endpoints.
- * There are also differences in how control requests are handled.
- *
- * RNDIS shares a lot with CDC-Ethernet, since it's a variant of the
- * CDC-ACM (modem) spec.  Unfortunately MSFT's RNDIS driver is buggy; it
- * may hang or oops.  Since bugfixes (or accurate specs, letting Linux
- * work around those bugs) are unlikely to ever come from MSFT, you may
- * wish to avoid using RNDIS.
- *
- * MCCI offers an alternative to RNDIS if you need to connect to Windows
- * but have hardware that can't support CDC Ethernet.   We add descriptors
- * to present the CDC Subset as a (nonconformant) CDC MDLM variant called
- * "SAFE".  That borrows from both CDC Ethernet and CDC MDLM.  You can
- * get those drivers from MCCI, or bundled with various products.
- */
-
-#ifdef  DEV_CONFIG_CDC
-static struct usb_interface_descriptor
-control_intf = {
-        .bLength =              sizeof control_intf,
-        .bDescriptorType =      USB_DT_INTERFACE,
-
-        .bInterfaceNumber =     0,
-        /* status endpoint is optional; this may be patched later */
-        .bNumEndpoints =        1,
-        .bInterfaceClass =      USB_CLASS_COMM,
-        .bInterfaceSubClass =   USB_CDC_SUBCLASS_ETHERNET,
-        .bInterfaceProtocol =   USB_CDC_PROTO_NONE,
-        .iInterface =           STRING_CONTROL,
-};
-#endif
-
-#ifdef  CONFIG_USB_ETH_RNDIS
-static const struct usb_interface_descriptor
-rndis_control_intf = {
-        .bLength =              sizeof rndis_control_intf,
-        .bDescriptorType =      USB_DT_INTERFACE,
-
-        .bInterfaceNumber =     0,
-        .bNumEndpoints =        1,
-        .bInterfaceClass =      USB_CLASS_COMM,
-        .bInterfaceSubClass =   USB_CDC_SUBCLASS_ACM,
-        .bInterfaceProtocol =   USB_CDC_ACM_PROTO_VENDOR,
-        .iInterface =           STRING_RNDIS_CONTROL,
-};
-#endif
-
-static const struct usb_cdc_header_desc header_desc = {
-        .bLength =              sizeof header_desc,
-        .bDescriptorType =      USB_DT_CS_INTERFACE,
-        .bDescriptorSubType =   USB_CDC_HEADER_TYPE,
-
-        .bcdCDC =               __constant_cpu_to_le16 (0x0110),
-};
-
-#if defined(DEV_CONFIG_CDC) || defined(CONFIG_USB_ETH_RNDIS)
-
-static const struct usb_cdc_union_desc union_desc = {
-        .bLength =              sizeof union_desc,
-        .bDescriptorType =      USB_DT_CS_INTERFACE,
-        .bDescriptorSubType =   USB_CDC_UNION_TYPE,
-
-        .bMasterInterface0 =    0,      /* index of control interface */
-        .bSlaveInterface0 =     1,      /* index of DATA interface */
-};
-
-#endif  /* CDC || RNDIS */
-
-#ifdef  CONFIG_USB_ETH_RNDIS
-
-static const struct usb_cdc_call_mgmt_descriptor call_mgmt_descriptor = {
-        .bLength =              sizeof call_mgmt_descriptor,
-        .bDescriptorType =      USB_DT_CS_INTERFACE,
-        .bDescriptorSubType =   USB_CDC_CALL_MANAGEMENT_TYPE,
-
-        .bmCapabilities =       0x00,
-        .bDataInterface =       0x01,
-};
-
-static const struct usb_cdc_acm_descriptor acm_descriptor = {
-        .bLength =              sizeof acm_descriptor,
-        .bDescriptorType =      USB_DT_CS_INTERFACE,
-        .bDescriptorSubType =   USB_CDC_ACM_TYPE,
-
-        .bmCapabilities =       0x00,
-};
-
-#endif
-
-#ifndef DEV_CONFIG_CDC
-
-/* "SAFE" loosely follows CDC WMC MDLM, violating the spec in various
- * ways:  data endpoints live in the control interface, there's no data
- * interface, and it's not used to talk to a cell phone radio.
- */
-
-static const struct usb_cdc_mdlm_desc mdlm_desc = {
-        .bLength =              sizeof mdlm_desc,
-        .bDescriptorType =      USB_DT_CS_INTERFACE,
-        .bDescriptorSubType =   USB_CDC_MDLM_TYPE,
-
-        .bcdVersion =           __constant_cpu_to_le16(0x0100),
-        .bGUID = {
-                0x5d, 0x34, 0xcf, 0x66, 0x11, 0x18, 0x11, 0xd6,
-                0xa2, 0x1a, 0x00, 0x01, 0x02, 0xca, 0x9a, 0x7f,
-        },
-};
-
-/* since "usb_cdc_mdlm_detail_desc" is a variable length structure, we
- * can't really use its struct.  All we do here is say that we're using
- * the submode of "SAFE" which directly matches the CDC Subset.
- */
-static const u8 mdlm_detail_desc[] = {
-        6,
-        USB_DT_CS_INTERFACE,
-        USB_CDC_MDLM_DETAIL_TYPE,
-
-        0,      /* "SAFE" */
-        0,      /* network control capabilities (none) */
-        0,      /* network data capabilities ("raw" encapsulation) */
-};
-
-#endif
-
-static const struct usb_cdc_ether_desc ether_desc = {
-        .bLength =              sizeof ether_desc,
-        .bDescriptorType =      USB_DT_CS_INTERFACE,
-        .bDescriptorSubType =   USB_CDC_ETHERNET_TYPE,
-
-        /* this descriptor actually adds value, surprise! */
-        .iMACAddress =          STRING_ETHADDR,
-        .bmEthernetStatistics = __constant_cpu_to_le32 (0), /* no statistics */
-        .wMaxSegmentSize =      __constant_cpu_to_le16 (ETH_FRAME_LEN),
-        .wNumberMCFilters =     __constant_cpu_to_le16 (0),
-        .bNumberPowerFilters =  0,
-};
-
-
-#if defined(DEV_CONFIG_CDC) || defined(CONFIG_USB_ETH_RNDIS)
-
-/* include the status endpoint if we can, even where it's optional.
- * use wMaxPacketSize big enough to fit CDC_NOTIFY_SPEED_CHANGE in one
- * packet, to simplify cancellation; and a big transfer interval, to
- * waste less bandwidth.
- *
- * some drivers (like Linux 2.4 cdc-ether!) "need" it to exist even
- * if they ignore the connect/disconnect notifications that real aether
- * can provide.  more advanced cdc configurations might want to support
- * encapsulated commands (vendor-specific, using control-OUT).
- *
- * RNDIS requires the status endpoint, since it uses that encapsulation
- * mechanism for its funky RPC scheme.
- */
-
-#define LOG2_STATUS_INTERVAL_MSEC       5       /* 1 << 5 == 32 msec */
-#define STATUS_BYTECOUNT                16      /* 8 byte header + data */
-
-static struct usb_endpoint_descriptor
-fs_status_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-
-        .bEndpointAddress =     USB_DIR_IN,
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       __constant_cpu_to_le16 (STATUS_BYTECOUNT),
-        .bInterval =            1 << LOG2_STATUS_INTERVAL_MSEC,
-};
-#endif
-
-#ifdef  DEV_CONFIG_CDC
-
-/* the default data interface has no endpoints ... */
-
-static const struct usb_interface_descriptor
-data_nop_intf = {
-        .bLength =              sizeof data_nop_intf,
-        .bDescriptorType =      USB_DT_INTERFACE,
-
-        .bInterfaceNumber =     1,
-        .bAlternateSetting =    0,
-        .bNumEndpoints =        0,
-        .bInterfaceClass =      USB_CLASS_CDC_DATA,
-        .bInterfaceSubClass =   0,
-        .bInterfaceProtocol =   0,
-};
-
-/* ... but the "real" data interface has two bulk endpoints */
-
-static const struct usb_interface_descriptor
-data_intf = {
-        .bLength =              sizeof data_intf,
-        .bDescriptorType =      USB_DT_INTERFACE,
-
-        .bInterfaceNumber =     1,
-        .bAlternateSetting =    1,
-        .bNumEndpoints =        2,
-        .bInterfaceClass =      USB_CLASS_CDC_DATA,
-        .bInterfaceSubClass =   0,
-        .bInterfaceProtocol =   0,
-        .iInterface =           STRING_DATA,
-};
-
-#endif
-
-#ifdef  CONFIG_USB_ETH_RNDIS
-
-/* RNDIS doesn't activate by changing to the "real" altsetting */
-
-static const struct usb_interface_descriptor
-rndis_data_intf = {
-        .bLength =              sizeof rndis_data_intf,
-        .bDescriptorType =      USB_DT_INTERFACE,
-
-        .bInterfaceNumber =     1,
-        .bAlternateSetting =    0,
-        .bNumEndpoints =        2,
-        .bInterfaceClass =      USB_CLASS_CDC_DATA,
-        .bInterfaceSubClass =   0,
-        .bInterfaceProtocol =   0,
-        .iInterface =           STRING_DATA,
-};
-
-#endif
-
-#ifdef DEV_CONFIG_SUBSET
-
-/*
- * "Simple" CDC-subset option is a simple vendor-neutral model that most
- * full speed controllers can handle:  one interface, two bulk endpoints.
- *
- * To assist host side drivers, we fancy it up a bit, and add descriptors
- * so some host side drivers will understand it as a "SAFE" variant.
- */
-
-static const struct usb_interface_descriptor
-subset_data_intf = {
-        .bLength =              sizeof subset_data_intf,
-        .bDescriptorType =      USB_DT_INTERFACE,
-
-        .bInterfaceNumber =     0,
-        .bAlternateSetting =    0,
-        .bNumEndpoints =        2,
-        .bInterfaceClass =      USB_CLASS_COMM,
-        .bInterfaceSubClass =   USB_CDC_SUBCLASS_MDLM,
-        .bInterfaceProtocol =   0,
-        .iInterface =           STRING_DATA,
-};
-
-#endif  /* SUBSET */
-
-
-static struct usb_endpoint_descriptor
-fs_source_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-
-        .bEndpointAddress =     USB_DIR_IN,
-        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
-};
-
-static struct usb_endpoint_descriptor
-fs_sink_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-
-        .bEndpointAddress =     USB_DIR_OUT,
-        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        /* REVISIT SRP-only hardware is possible, although
+         * it would not be called "OTG" ...
+         */
+        .bmAttributes =         USB_OTG_SRP | USB_OTG_HNP,
 };
 
-static const struct usb_descriptor_header *fs_eth_function [11] = {
+static const struct usb_descriptor_header *otg_desc[] = {
         (struct usb_descriptor_header *) &otg_descriptor,
-#ifdef DEV_CONFIG_CDC
-        /* "cdc" mode descriptors */
-        (struct usb_descriptor_header *) &control_intf,
-        (struct usb_descriptor_header *) &header_desc,
-        (struct usb_descriptor_header *) &union_desc,
-        (struct usb_descriptor_header *) &ether_desc,
-        /* NOTE: status endpoint may need to be removed */
-        (struct usb_descriptor_header *) &fs_status_desc,
-        /* data interface, with altsetting */
-        (struct usb_descriptor_header *) &data_nop_intf,
-        (struct usb_descriptor_header *) &data_intf,
-        (struct usb_descriptor_header *) &fs_source_desc,
-        (struct usb_descriptor_header *) &fs_sink_desc,
         NULL,
-#endif /* DEV_CONFIG_CDC */
 };
 
-static inline void __init fs_subset_descriptors(void)
-{
-#ifdef DEV_CONFIG_SUBSET
-        /* behavior is "CDC Subset"; extra descriptors say "SAFE" */
-        fs_eth_function[1] = (struct usb_descriptor_header *) &subset_data_intf;
-        fs_eth_function[2] = (struct usb_descriptor_header *) &header_desc;
-        fs_eth_function[3] = (struct usb_descriptor_header *) &mdlm_desc;
-        fs_eth_function[4] = (struct usb_descriptor_header *) &mdlm_detail_desc;
-        fs_eth_function[5] = (struct usb_descriptor_header *) &ether_desc;
-        fs_eth_function[6] = (struct usb_descriptor_header *) &fs_source_desc;
-        fs_eth_function[7] = (struct usb_descriptor_header *) &fs_sink_desc;
-        fs_eth_function[8] = NULL;
-#else
-        fs_eth_function[1] = NULL;
-#endif
-}
 
-#ifdef  CONFIG_USB_ETH_RNDIS
-static const struct usb_descriptor_header *fs_rndis_function [] = {
-        (struct usb_descriptor_header *) &otg_descriptor,
-        /* control interface matches ACM, not Ethernet */
-        (struct usb_descriptor_header *) &rndis_control_intf,
-        (struct usb_descriptor_header *) &header_desc,
-        (struct usb_descriptor_header *) &call_mgmt_descriptor,
-        (struct usb_descriptor_header *) &acm_descriptor,
-        (struct usb_descriptor_header *) &union_desc,
-        (struct usb_descriptor_header *) &fs_status_desc,
-        /* data interface has no altsetting */
-        (struct usb_descriptor_header *) &rndis_data_intf,
-        (struct usb_descriptor_header *) &fs_source_desc,
-        (struct usb_descriptor_header *) &fs_sink_desc,
-        NULL,
-};
-#endif
-
-/*
- * usb 2.0 devices need to expose both high speed and full speed
- * descriptors, unless they only run at full speed.
- */
-
-#if defined(DEV_CONFIG_CDC) || defined(CONFIG_USB_ETH_RNDIS)
-static struct usb_endpoint_descriptor
-hs_status_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       __constant_cpu_to_le16 (STATUS_BYTECOUNT),
-        .bInterval =            LOG2_STATUS_INTERVAL_MSEC + 4,
-};
-#endif /* DEV_CONFIG_CDC */
-
-static struct usb_endpoint_descriptor
-hs_source_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-
-        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
-        .wMaxPacketSize =       __constant_cpu_to_le16 (512),
-};
-
-static struct usb_endpoint_descriptor
-hs_sink_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-
-        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
-        .wMaxPacketSize =       __constant_cpu_to_le16 (512),
-};
+/* string IDs are assigned dynamically */
 
-static struct usb_qualifier_descriptor
-dev_qualifier = {
-        .bLength =              sizeof dev_qualifier,
-        .bDescriptorType =      USB_DT_DEVICE_QUALIFIER,
+#define STRING_MANUFACTURER_IDX         0
+#define STRING_PRODUCT_IDX              1
 
-        .bcdUSB =               __constant_cpu_to_le16 (0x0200),
-        .bDeviceClass =         USB_CLASS_COMM,
+static char manufacturer[50];
 
-        .bNumConfigurations =   1,
+static struct usb_string strings_dev[] = {
+        [STRING_MANUFACTURER_IDX].s = manufacturer,
+        [STRING_PRODUCT_IDX].s = PREFIX DRIVER_DESC,
+        {  } /* end of list */
 };
 
-static const struct usb_descriptor_header *hs_eth_function [11] = {
-        (struct usb_descriptor_header *) &otg_descriptor,
-#ifdef DEV_CONFIG_CDC
-        /* "cdc" mode descriptors */
-        (struct usb_descriptor_header *) &control_intf,
-        (struct usb_descriptor_header *) &header_desc,
-        (struct usb_descriptor_header *) &union_desc,
-        (struct usb_descriptor_header *) &ether_desc,
-        /* NOTE: status endpoint may need to be removed */
-        (struct usb_descriptor_header *) &hs_status_desc,
-        /* data interface, with altsetting */
-        (struct usb_descriptor_header *) &data_nop_intf,
-        (struct usb_descriptor_header *) &data_intf,
-        (struct usb_descriptor_header *) &hs_source_desc,
-        (struct usb_descriptor_header *) &hs_sink_desc,
-        NULL,
-#endif /* DEV_CONFIG_CDC */
+static struct usb_gadget_strings stringtab_dev = {
+        .language       = 0x0409,       /* en-us */
+        .strings        = strings_dev,
 };
 
-static inline void __init hs_subset_descriptors(void)
-{
-#ifdef DEV_CONFIG_SUBSET
-        /* behavior is "CDC Subset"; extra descriptors say "SAFE" */
-        hs_eth_function[1] = (struct usb_descriptor_header *) &subset_data_intf;
-        hs_eth_function[2] = (struct usb_descriptor_header *) &header_desc;
-        hs_eth_function[3] = (struct usb_descriptor_header *) &mdlm_desc;
-        hs_eth_function[4] = (struct usb_descriptor_header *) &mdlm_detail_desc;
-        hs_eth_function[5] = (struct usb_descriptor_header *) &ether_desc;
-        hs_eth_function[6] = (struct usb_descriptor_header *) &hs_source_desc;
-        hs_eth_function[7] = (struct usb_descriptor_header *) &hs_sink_desc;
-        hs_eth_function[8] = NULL;
-#else
-        hs_eth_function[1] = NULL;
-#endif
-}
-
-#ifdef  CONFIG_USB_ETH_RNDIS
-static const struct usb_descriptor_header *hs_rndis_function [] = {
-        (struct usb_descriptor_header *) &otg_descriptor,
-        /* control interface matches ACM, not Ethernet */
-        (struct usb_descriptor_header *) &rndis_control_intf,
-        (struct usb_descriptor_header *) &header_desc,
-        (struct usb_descriptor_header *) &call_mgmt_descriptor,
-        (struct usb_descriptor_header *) &acm_descriptor,
-        (struct usb_descriptor_header *) &union_desc,
-        (struct usb_descriptor_header *) &hs_status_desc,
-        /* data interface has no altsetting */
-        (struct usb_descriptor_header *) &rndis_data_intf,
-        (struct usb_descriptor_header *) &hs_source_desc,
-        (struct usb_descriptor_header *) &hs_sink_desc,
+static struct usb_gadget_strings *dev_strings[] = {
+        &stringtab_dev,
         NULL,
 };
-#endif
-
-
-/* maxpacket and other transfer characteristics vary by speed. */
-static inline struct usb_endpoint_descriptor *
-ep_desc(struct usb_gadget *g, struct usb_endpoint_descriptor *hs,
-                struct usb_endpoint_descriptor *fs)
-{
-        if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
-                return hs;
-        return fs;
-}
 
+static u8 hostaddr[ETH_ALEN];
 
 /*-------------------------------------------------------------------------*/
 
-/* descriptors that are built on-demand */
-
-static char                             manufacturer [50];
-static char                             product_desc [40] = DRIVER_DESC;
-static char                             serial_number [20];
-
-/* address that the host will use ... usually assigned at random */
-static char                             ethaddr [2 * ETH_ALEN + 1];
-
-/* static strings, in UTF-8 */
-static struct usb_string                strings [] = {
-        { STRING_MANUFACTURER,  manufacturer, },
-        { STRING_PRODUCT,       product_desc, },
-        { STRING_SERIALNUMBER,  serial_number, },
-        { STRING_DATA,          "Ethernet Data", },
-        { STRING_ETHADDR,       ethaddr, },
-#ifdef  DEV_CONFIG_CDC
-        { STRING_CDC,           "CDC Ethernet", },
-        { STRING_CONTROL,       "CDC Communications Control", },
-#endif
-#ifdef  DEV_CONFIG_SUBSET
-        { STRING_SUBSET,        "CDC Ethernet Subset", },
-#endif
-#ifdef  CONFIG_USB_ETH_RNDIS
-        { STRING_RNDIS,         "RNDIS", },
-        { STRING_RNDIS_CONTROL, "RNDIS Communications Control", },
-#endif
-        {  }            /* end of list */
-};
-
-static struct usb_gadget_strings        stringtab = {
-        .language       = 0x0409,       /* en-us */
-        .strings        = strings,
-};
-
 /*
- * one config, two interfaces:  control, data.
- * complications: class descriptors, and an altsetting.
- */
-static int
-config_buf(struct usb_gadget *g, u8 *buf, u8 type, unsigned index, int is_otg)
-{
-        int                                     len;
-        const struct usb_config_descriptor      *config;
-        const struct usb_descriptor_header      **function;
-        int                                     hs = 0;
-
-        if (gadget_is_dualspeed(g)) {
-                hs = (g->speed == USB_SPEED_HIGH);
-                if (type == USB_DT_OTHER_SPEED_CONFIG)
-                        hs = !hs;
-        }
-#define which_fn(t)     (hs ? hs_ ## t ## _function : fs_ ## t ## _function)
-
-        if (index >= device_desc.bNumConfigurations)
-                return -EINVAL;
-
-#ifdef  CONFIG_USB_ETH_RNDIS
-        /* list the RNDIS config first, to make Microsoft's drivers
-         * happy. DOCSIS 1.0 needs this too.
-         */
-        if (device_desc.bNumConfigurations == 2 && index == 0) {
-                config = &rndis_config;
-                function = which_fn (rndis);
-        } else
-#endif
-        {
-                config = &eth_config;
-                function = which_fn (eth);
-        }
-
-        /* for now, don't advertise srp-only devices */
-        if (!is_otg)
-                function++;
-
-        len = usb_gadget_config_buf (config, buf, USB_BUFSIZ, function);
-        if (len < 0)
-                return len;
-        ((struct usb_config_descriptor *) buf)->bDescriptorType = type;
-        return len;
-}
-
-/*-------------------------------------------------------------------------*/
-
-static void eth_start (struct eth_dev *dev, gfp_t gfp_flags);
-static int alloc_requests (struct eth_dev *dev, unsigned n, gfp_t gfp_flags);
-
-static int
-set_ether_config (struct eth_dev *dev, gfp_t gfp_flags)
-{
-        int                                     result = 0;
-        struct usb_gadget                       *gadget = dev->gadget;
-
-#if defined(DEV_CONFIG_CDC) || defined(CONFIG_USB_ETH_RNDIS)
-        /* status endpoint used for RNDIS and (optionally) CDC */
-        if (!subset_active(dev) && dev->status_ep) {
-                dev->status = ep_desc (gadget, &hs_status_desc,
-                                                &fs_status_desc);
-                dev->status_ep->driver_data = dev;
-
-                result = usb_ep_enable (dev->status_ep, dev->status);
-                if (result != 0) {
-                        DEBUG (dev, "enable %s --> %d\n",
-                                dev->status_ep->name, result);
-                        goto done;
-                }
-        }
-#endif
-
-        dev->in = ep_desc(gadget, &hs_source_desc, &fs_source_desc);
-        dev->in_ep->driver_data = dev;
-
-        dev->out = ep_desc(gadget, &hs_sink_desc, &fs_sink_desc);
-        dev->out_ep->driver_data = dev;
-
-        /* With CDC,  the host isn't allowed to use these two data
-         * endpoints in the default altsetting for the interface.
-         * so we don't activate them yet.  Reset from SET_INTERFACE.
-         *
-         * Strictly speaking RNDIS should work the same: activation is
-         * a side effect of setting a packet filter.  Deactivation is
-         * from REMOTE_NDIS_HALT_MSG, reset from REMOTE_NDIS_RESET_MSG.
-         */
-        if (!cdc_active(dev)) {
-                result = usb_ep_enable (dev->in_ep, dev->in);
-                if (result != 0) {
-                        DEBUG(dev, "enable %s --> %d\n",
-                                dev->in_ep->name, result);
-                        goto done;
-                }
-
-                result = usb_ep_enable (dev->out_ep, dev->out);
-                if (result != 0) {
-                        DEBUG (dev, "enable %s --> %d\n",
-                                dev->out_ep->name, result);
-                        goto done;
-                }
-        }
-
-done:
-        if (result == 0)
-                result = alloc_requests (dev, qlen (gadget), gfp_flags);
-
-        /* on error, disable any endpoints  */
-        if (result < 0) {
-                if (!subset_active(dev) && dev->status_ep)
-                        (void) usb_ep_disable (dev->status_ep);
-                dev->status = NULL;
-                (void) usb_ep_disable (dev->in_ep);
-                (void) usb_ep_disable (dev->out_ep);
-                dev->in = NULL;
-                dev->out = NULL;
-        }
-
-        /* activate non-CDC configs right away
-         * this isn't strictly according to the RNDIS spec
-         */
-        else if (!cdc_active (dev)) {
-                netif_carrier_on (dev->net);
-                if (netif_running (dev->net)) {
-                        spin_unlock (&dev->lock);
-                        eth_start (dev, GFP_ATOMIC);
-                        spin_lock (&dev->lock);
-                }
-        }
-
-        if (result == 0)
-                DEBUG (dev, "qlen %d\n", qlen (gadget));
-
-        /* caller is responsible for cleanup on error */
-        return result;
-}
-
-static void eth_reset_config (struct eth_dev *dev)
-{
-        struct usb_request      *req;
-
-        if (dev->config == 0)
-                return;
-
-        DEBUG (dev, "%s\n", __func__);
-
-        netif_stop_queue (dev->net);
-        netif_carrier_off (dev->net);
-        rndis_uninit(dev->rndis_config);
-
-        /* disable endpoints, forcing (synchronous) completion of
-         * pending i/o.  then free the requests.
-         */
-        if (dev->in) {
-                usb_ep_disable (dev->in_ep);
-                spin_lock(&dev->req_lock);
-                while (likely (!list_empty (&dev->tx_reqs))) {
-                        req = container_of (dev->tx_reqs.next,
-                                                struct usb_request, list);
-                        list_del (&req->list);
-
-                        spin_unlock(&dev->req_lock);
-                        usb_ep_free_request (dev->in_ep, req);
-                        spin_lock(&dev->req_lock);
-                }
-                spin_unlock(&dev->req_lock);
-        }
-        if (dev->out) {
-                usb_ep_disable (dev->out_ep);
-                spin_lock(&dev->req_lock);
-                while (likely (!list_empty (&dev->rx_reqs))) {
-                        req = container_of (dev->rx_reqs.next,
-                                                struct usb_request, list);
-                        list_del (&req->list);
-
-                        spin_unlock(&dev->req_lock);
-                        usb_ep_free_request (dev->out_ep, req);
-                        spin_lock(&dev->req_lock);
-                }
-                spin_unlock(&dev->req_lock);
-        }
-
-        if (dev->status) {
-                usb_ep_disable (dev->status_ep);
-        }
-        dev->rndis = 0;
-        dev->cdc_filter = 0;
-        dev->config = 0;
-}
-
-/* change our operational config.  must agree with the code
- * that returns config descriptors, and altsetting code.
+ * We may not have an RNDIS configuration, but if we do it needs to be
+ * the first one present.  That's to make Microsoft's drivers happy,
+ * and to follow DOCSIS 1.0 (cable modem standard).
  */
-static int
-eth_set_config (struct eth_dev *dev, unsigned number, gfp_t gfp_flags)
+static int __init rndis_do_config(struct usb_configuration *c)
 {
-        int                     result = 0;
-        struct usb_gadget       *gadget = dev->gadget;
-
-        if (gadget_is_sa1100 (gadget)
-                        && dev->config
-                        && atomic_read (&dev->tx_qlen) != 0) {
-                /* tx fifo is full, but we can't clear it...*/
-                INFO (dev, "can't change configurations\n");
-                return -ESPIPE;
-        }
-        eth_reset_config (dev);
-
-        switch (number) {
-        case DEV_CONFIG_VALUE:
-                result = set_ether_config (dev, gfp_flags);
-                break;
-#ifdef  CONFIG_USB_ETH_RNDIS
-        case DEV_RNDIS_CONFIG_VALUE:
-                dev->rndis = 1;
-                result = set_ether_config (dev, gfp_flags);
-                break;
-#endif
-        default:
-                result = -EINVAL;
-                /* FALL THROUGH */
-        case 0:
-                break;
-        }
-
-        if (result) {
-                if (number)
-                        eth_reset_config (dev);
-                usb_gadget_vbus_draw(dev->gadget,
-                                gadget_is_otg(dev->gadget) ? 8 : 100);
-        } else {
-                char *speed;
-                unsigned power;
-
-                power = 2 * eth_config.bMaxPower;
-                usb_gadget_vbus_draw(dev->gadget, power);
+        /* FIXME alloc iConfiguration string, set it in c->strings */
 
-                switch (gadget->speed) {
-                case USB_SPEED_FULL:    speed = "full"; break;
-#ifdef CONFIG_USB_GADGET_DUALSPEED
-                case USB_SPEED_HIGH:    speed = "high"; break;
-#endif
-                default:                speed = "?"; break;
-                }
-
-                dev->config = number;
-                INFO (dev, "%s speed config #%d: %d mA, %s, using %s\n",
-                                speed, number, power, driver_desc,
-                                rndis_active(dev)
-                                        ? "RNDIS"
-                                        : (cdc_active(dev)
-                                                ? "CDC Ethernet"
-                                                : "CDC Ethernet Subset"));
+        if (gadget_is_otg(c->cdev->gadget)) {
+                c->descriptors = otg_desc;
+                c->bmAttributes |= USB_CONFIG_ATT_WAKEUP;
         }
-        return result;
-}
-
-/*-------------------------------------------------------------------------*/
-
-#ifdef  DEV_CONFIG_CDC
 
-/* The interrupt endpoint is used in CDC networking models (Ethernet, ATM)
- * only to notify the host about link status changes (which we support) or
- * report completion of some encapsulated command (as used in RNDIS).  Since
- * we want this CDC Ethernet code to be vendor-neutral, we don't use that
- * command mechanism; and only one status request is ever queued.
- */
-
-static void eth_status_complete (struct usb_ep *ep, struct usb_request *req)
-{
-        struct usb_cdc_notification     *event = req->buf;
-        int                             value = req->status;
-        struct eth_dev                  *dev = ep->driver_data;
-
-        /* issue the second notification if host reads the first */
-        if (event->bNotificationType == USB_CDC_NOTIFY_NETWORK_CONNECTION
-                        && value == 0) {
-                __le32  *data = req->buf + sizeof *event;
-
-                event->bmRequestType = 0xA1;
-                event->bNotificationType = USB_CDC_NOTIFY_SPEED_CHANGE;
-                event->wValue = __constant_cpu_to_le16 (0);
-                event->wIndex = __constant_cpu_to_le16 (1);
-                event->wLength = __constant_cpu_to_le16 (8);
-
-                /* SPEED_CHANGE data is up/down speeds in bits/sec */
-                data [0] = data [1] = cpu_to_le32 (BITRATE (dev->gadget));
-
-                req->length = STATUS_BYTECOUNT;
-                value = usb_ep_queue (ep, req, GFP_ATOMIC);
-                DEBUG (dev, "send SPEED_CHANGE --> %d\n", value);
-                if (value == 0)
-                        return;
-        } else if (value != -ECONNRESET)
-                DEBUG (dev, "event %02x --> %d\n",
-                        event->bNotificationType, value);
-        req->context = NULL;
+        return rndis_bind_config(c, hostaddr);
 }
 
-static void issue_start_status (struct eth_dev *dev)
-{
-        struct usb_request              *req = dev->stat_req;
-        struct usb_cdc_notification     *event;
-        int                             value;
-
-        DEBUG (dev, "%s, flush old status first\n", __func__);
-
-        /* flush old status
-         *
-         * FIXME ugly idiom, maybe we'd be better with just
-         * a "cancel the whole queue" primitive since any
-         * unlink-one primitive has way too many error modes.
-         * here, we "know" toggle is already clear...
-         *
-         * FIXME iff req->context != null just dequeue it
-         */
-        usb_ep_disable (dev->status_ep);
-        usb_ep_enable (dev->status_ep, dev->status);
-
-        /* 3.8.1 says to issue first NETWORK_CONNECTION, then
-         * a SPEED_CHANGE.  could be useful in some configs.
-         */
-        event = req->buf;
-        event->bmRequestType = 0xA1;
-        event->bNotificationType = USB_CDC_NOTIFY_NETWORK_CONNECTION;
-        event->wValue = __constant_cpu_to_le16 (1);     /* connected */
-        event->wIndex = __constant_cpu_to_le16 (1);
-        event->wLength = 0;
-
-        req->length = sizeof *event;
-        req->complete = eth_status_complete;
-        req->context = dev;
-
-        value = usb_ep_queue (dev->status_ep, req, GFP_ATOMIC);
-        if (value < 0)
-                DEBUG (dev, "status buf queue --> %d\n", value);
-}
-
-#endif
+static struct usb_configuration rndis_config_driver = {
+        .label                  = "RNDIS",
+        .bind                   = rndis_do_config,
+        .bConfigurationValue    = 2,
+        /* .iConfiguration = DYNAMIC */
+        .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
+        .bMaxPower              = 1,    /* 2 mA, minimal */
+};
 
 /*-------------------------------------------------------------------------*/
 
-static void eth_setup_complete (struct usb_ep *ep, struct usb_request *req)
-{
-        if (req->status || req->actual != req->length)
-                DEBUG ((struct eth_dev *) ep->driver_data,
-                                "setup complete --> %d, %d/%d\n",
-                                req->status, req->actual, req->length);
-}
-
-#ifdef CONFIG_USB_ETH_RNDIS
-
-static void rndis_response_complete (struct usb_ep *ep, struct usb_request *req)
-{
-        if (req->status || req->actual != req->length)
-                DEBUG ((struct eth_dev *) ep->driver_data,
-                        "rndis response complete --> %d, %d/%d\n",
-                        req->status, req->actual, req->length);
-
-        /* done sending after USB_CDC_GET_ENCAPSULATED_RESPONSE */
-}
-
-static void rndis_command_complete (struct usb_ep *ep, struct usb_request *req)
-{
-        struct eth_dev          *dev = ep->driver_data;
-        int                     status;
-
-        /* received RNDIS command from USB_CDC_SEND_ENCAPSULATED_COMMAND */
-        spin_lock(&dev->lock);
-        status = rndis_msg_parser (dev->rndis_config, (u8 *) req->buf);
-        if (status < 0)
-                ERROR(dev, "%s: rndis parse error %d\n", __func__, status);
-        spin_unlock(&dev->lock);
-}
-
-#endif  /* RNDIS */
-
 /*
- * The setup() callback implements all the ep0 functionality that's not
- * handled lower down.  CDC has a number of less-common features:
- *
- *  - two interfaces:  control, and ethernet data
- *  - Ethernet data interface has two altsettings:  default, and active
- *  - class-specific descriptors for the control interface
- *  - class-specific control requests
+ * We _always_ have an ECM or CDC Subset configuration.
  */
-static int
-eth_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
+static int __init eth_do_config(struct usb_configuration *c)
 {
-        struct eth_dev          *dev = get_gadget_data (gadget);
-        struct usb_request      *req = dev->req;
-        int                     value = -EOPNOTSUPP;
-        u16                     wIndex = le16_to_cpu(ctrl->wIndex);
-        u16                     wValue = le16_to_cpu(ctrl->wValue);
-        u16                     wLength = le16_to_cpu(ctrl->wLength);
-
-        /* descriptors just go into the pre-allocated ep0 buffer,
-         * while config change events may enable network traffic.
-         */
-        req->complete = eth_setup_complete;
-        switch (ctrl->bRequest) {
-
-        case USB_REQ_GET_DESCRIPTOR:
-                if (ctrl->bRequestType != USB_DIR_IN)
-                        break;
-                switch (wValue >> 8) {
-
-                case USB_DT_DEVICE:
-                        value = min (wLength, (u16) sizeof device_desc);
-                        memcpy (req->buf, &device_desc, value);
-                        break;
-                case USB_DT_DEVICE_QUALIFIER:
-                        if (!gadget_is_dualspeed(gadget))
-                                break;
-                        value = min (wLength, (u16) sizeof dev_qualifier);
-                        memcpy (req->buf, &dev_qualifier, value);
-                        break;
-
-                case USB_DT_OTHER_SPEED_CONFIG:
-                        if (!gadget_is_dualspeed(gadget))
-                                break;
-                        // FALLTHROUGH
-                case USB_DT_CONFIG:
-                        value = config_buf(gadget, req->buf,
-                                        wValue >> 8,
-                                        wValue & 0xff,
-                                        gadget_is_otg(gadget));
-                        if (value >= 0)
-                                value = min (wLength, (u16) value);
-                        break;
-
-                case USB_DT_STRING:
-                        value = usb_gadget_get_string (&stringtab,
-                                        wValue & 0xff, req->buf);
-                        if (value >= 0)
-                                value = min (wLength, (u16) value);
-                        break;
-                }
-                break;
-
-        case USB_REQ_SET_CONFIGURATION:
-                if (ctrl->bRequestType != 0)
-                        break;
-                if (gadget->a_hnp_support)
-                        DEBUG (dev, "HNP available\n");
-                else if (gadget->a_alt_hnp_support)
-                        DEBUG (dev, "HNP needs a different root port\n");
-                spin_lock (&dev->lock);
-                value = eth_set_config (dev, wValue, GFP_ATOMIC);
-                spin_unlock (&dev->lock);
-                break;
-        case USB_REQ_GET_CONFIGURATION:
-                if (ctrl->bRequestType != USB_DIR_IN)
-                        break;
-                *(u8 *)req->buf = dev->config;
-                value = min (wLength, (u16) 1);
-                break;
-
-        case USB_REQ_SET_INTERFACE:
-                if (ctrl->bRequestType != USB_RECIP_INTERFACE
-                                || !dev->config
-                                || wIndex > 1)
-                        break;
-                if (!cdc_active(dev) && wIndex != 0)
-                        break;
-                spin_lock (&dev->lock);
-
-                /* PXA hardware partially handles SET_INTERFACE;
-                 * we need to kluge around that interference.
-                 */
-                if (gadget_is_pxa (gadget)) {
-                        value = eth_set_config (dev, DEV_CONFIG_VALUE,
-                                                GFP_ATOMIC);
-                        goto done_set_intf;
-                }
-
-#ifdef DEV_CONFIG_CDC
-                switch (wIndex) {
-                case 0:         /* control/master intf */
-                        if (wValue != 0)
-                                break;
-                        if (dev->status) {
-                                usb_ep_disable (dev->status_ep);
-                                usb_ep_enable (dev->status_ep, dev->status);
-                        }
-                        value = 0;
-                        break;
-                case 1:         /* data intf */
-                        if (wValue > 1)
-                                break;
-                        usb_ep_disable (dev->in_ep);
-                        usb_ep_disable (dev->out_ep);
-
-                        /* CDC requires the data transfers not be done from
-                         * the default interface setting ... also, setting
-                         * the non-default interface resets filters etc.
-                         */
-                        if (wValue == 1) {
-                                if (!cdc_active (dev))
-                                        break;
-                                usb_ep_enable (dev->in_ep, dev->in);
-                                usb_ep_enable (dev->out_ep, dev->out);
-                                dev->cdc_filter = DEFAULT_FILTER;
-                                netif_carrier_on (dev->net);
-                                if (dev->status)
-                                        issue_start_status (dev);
-                                if (netif_running (dev->net)) {
-                                        spin_unlock (&dev->lock);
-                                        eth_start (dev, GFP_ATOMIC);
-                                        spin_lock (&dev->lock);
-                                }
-                        } else {
-                                netif_stop_queue (dev->net);
-                                netif_carrier_off (dev->net);
-                        }
-                        value = 0;
-                        break;
-                }
-#else
-                /* FIXME this is wrong, as is the assumption that
-                 * all non-PXA hardware talks real CDC ...
-                 */
-                dev_warn (&gadget->dev, "set_interface ignored!\n");
-#endif /* DEV_CONFIG_CDC */
-
-done_set_intf:
-                spin_unlock (&dev->lock);
-                break;
-        case USB_REQ_GET_INTERFACE:
-                if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE)
-                                || !dev->config
-                                || wIndex > 1)
-                        break;
-                if (!(cdc_active(dev) || rndis_active(dev)) && wIndex != 0)
-                        break;
-
-                /* for CDC, iff carrier is on, data interface is active. */
-                if (rndis_active(dev) || wIndex != 1)
-                        *(u8 *)req->buf = 0;
-                else
-                        *(u8 *)req->buf = netif_carrier_ok (dev->net) ? 1 : 0;
-                value = min (wLength, (u16) 1);
-                break;
-
-#ifdef DEV_CONFIG_CDC
-        case USB_CDC_SET_ETHERNET_PACKET_FILTER:
-                /* see 6.2.30: no data, wIndex = interface,
-                 * wValue = packet filter bitmap
-                 */
-                if (ctrl->bRequestType != (USB_TYPE_CLASS|USB_RECIP_INTERFACE)
-                                || !cdc_active(dev)
-                                || wLength != 0
-                                || wIndex > 1)
-                        break;
-                DEBUG (dev, "packet filter %02x\n", wValue);
-                dev->cdc_filter = wValue;
-                value = 0;
-                break;
-
-        /* and potentially:
-         * case USB_CDC_SET_ETHERNET_MULTICAST_FILTERS:
-         * case USB_CDC_SET_ETHERNET_PM_PATTERN_FILTER:
-         * case USB_CDC_GET_ETHERNET_PM_PATTERN_FILTER:
-         * case USB_CDC_GET_ETHERNET_STATISTIC:
-         */
-
-#endif /* DEV_CONFIG_CDC */
+        /* FIXME alloc iConfiguration string, set it in c->strings */
 
-#ifdef CONFIG_USB_ETH_RNDIS
-        /* RNDIS uses the CDC command encapsulation mechanism to implement
-         * an RPC scheme, with much getting/setting of attributes by OID.
-         */
-        case USB_CDC_SEND_ENCAPSULATED_COMMAND:
-                if (ctrl->bRequestType != (USB_TYPE_CLASS|USB_RECIP_INTERFACE)
-                                || !rndis_active(dev)
-                                || wLength > USB_BUFSIZ
-                                || wValue
-                                || rndis_control_intf.bInterfaceNumber
-                                        != wIndex)
-                        break;
-                /* read the request, then process it */
-                value = wLength;
-                req->complete = rndis_command_complete;
-                /* later, rndis_control_ack () sends a notification */
-                break;
-
-        case USB_CDC_GET_ENCAPSULATED_RESPONSE:
-                if ((USB_DIR_IN|USB_TYPE_CLASS|USB_RECIP_INTERFACE)
-                                        == ctrl->bRequestType
-                                && rndis_active(dev)
-                                // && wLength >= 0x0400
-                                && !wValue
-                                && rndis_control_intf.bInterfaceNumber
-                                        == wIndex) {
-                        u8 *buf;
-                        u32 n;
-
-                        /* return the result */
-                        buf = rndis_get_next_response(dev->rndis_config, &n);
-                        if (buf) {
-                                memcpy(req->buf, buf, n);
-                                req->complete = rndis_response_complete;
-                                rndis_free_response(dev->rndis_config, buf);
-                                value = n;
-                        }
-                        /* else stalls ... spec says to avoid that */
-                }
-                break;
-#endif  /* RNDIS */
-
-        default:
-                VDEBUG (dev,
-                        "unknown control req%02x.%02x v%04x i%04x l%d\n",
-                        ctrl->bRequestType, ctrl->bRequest,
-                        wValue, wIndex, wLength);
+        if (gadget_is_otg(c->cdev->gadget)) {
+                c->descriptors = otg_desc;
+                c->bmAttributes |= USB_CONFIG_ATT_WAKEUP;
         }
 
-        /* respond with data transfer before status phase? */
-        if (value >= 0) {
-                req->length = value;
-                req->zero = value < wLength
-                                && (value % gadget->ep0->maxpacket) == 0;
-                value = usb_ep_queue (gadget->ep0, req, GFP_ATOMIC);
-                if (value < 0) {
-                        DEBUG (dev, "ep_queue --> %d\n", value);
-                        req->status = 0;
-                        eth_setup_complete (gadget->ep0, req);
-                }
-        }
-
-        /* host either stalls (value < 0) or reports success */
-        return value;
-}
-
-static void
-eth_disconnect (struct usb_gadget *gadget)
-{
-        struct eth_dev          *dev = get_gadget_data (gadget);
-        unsigned long           flags;
-
-        spin_lock_irqsave (&dev->lock, flags);
-        netif_stop_queue (dev->net);
-        netif_carrier_off (dev->net);
-        eth_reset_config (dev);
-        spin_unlock_irqrestore (&dev->lock, flags);
-
-        /* FIXME RNDIS should enter RNDIS_UNINITIALIZED */
-
-        /* next we may get setup() calls to enumerate new connections;
-         * or an unbind() during shutdown (including removing module).
-         */
-}
-
-/*-------------------------------------------------------------------------*/
-
-/* NETWORK DRIVER HOOKUP (to the layer above this driver) */
-
-static int eth_change_mtu (struct net_device *net, int new_mtu)
-{
-        struct eth_dev  *dev = netdev_priv(net);
-
-        if (dev->rndis)
-                return -EBUSY;
-
-        if (new_mtu <= ETH_HLEN || new_mtu > ETH_FRAME_LEN)
-                return -ERANGE;
-        /* no zero-length packet read wanted after mtu-sized packets */
-        if (((new_mtu + sizeof (struct ethhdr)) % dev->in_ep->maxpacket) == 0)
-                return -EDOM;
-        net->mtu = new_mtu;
-        return 0;
-}
-
-static struct net_device_stats *eth_get_stats (struct net_device *net)
-{
-        return &((struct eth_dev *)netdev_priv(net))->stats;
-}
-
-static void eth_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *p)
-{
-        struct eth_dev  *dev = netdev_priv(net);
-        strlcpy(p->driver, shortname, sizeof p->driver);
-        strlcpy(p->version, DRIVER_VERSION, sizeof p->version);
-        strlcpy(p->fw_version, dev->gadget->name, sizeof p->fw_version);
-        strlcpy (p->bus_info, dev->gadget->dev.bus_id, sizeof p->bus_info);
-}
-
-static u32 eth_get_link(struct net_device *net)
-{
-        struct eth_dev  *dev = netdev_priv(net);
-        return dev->gadget->speed != USB_SPEED_UNKNOWN;
-}
-
-static struct ethtool_ops ops = {
-        .get_drvinfo = eth_get_drvinfo,
-        .get_link = eth_get_link
-};
-
-static void defer_kevent (struct eth_dev *dev, int flag)
-{
-        if (test_and_set_bit (flag, &dev->todo))
-                return;
-        if (!schedule_work (&dev->work))
-                ERROR (dev, "kevent %d may have been dropped\n", flag);
+        if (can_support_ecm(c->cdev->gadget))
+                return ecm_bind_config(c, hostaddr);
         else
-                DEBUG (dev, "kevent %d scheduled\n", flag);
-}
-
-static void rx_complete (struct usb_ep *ep, struct usb_request *req);
-
-static int
-rx_submit (struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags)
-{
-        struct sk_buff          *skb;
-        int                     retval = -ENOMEM;
-        size_t                  size;
-
-        /* Padding up to RX_EXTRA handles minor disagreements with host.
-         * Normally we use the USB "terminate on short read" convention;
-         * so allow up to (N*maxpacket), since that memory is normally
-         * already allocated.  Some hardware doesn't deal well with short
-         * reads (e.g. DMA must be N*maxpacket), so for now don't trim a
-         * byte off the end (to force hardware errors on overflow).
-         *
-         * RNDIS uses internal framing, and explicitly allows senders to
-         * pad to end-of-packet.  That's potentially nice for speed,
-         * but means receivers can't recover synch on their own.
-         */
-        size = (sizeof (struct ethhdr) + dev->net->mtu + RX_EXTRA);
-        size += dev->out_ep->maxpacket - 1;
-        if (rndis_active(dev))
-                size += sizeof (struct rndis_packet_msg_type);
-        size -= size % dev->out_ep->maxpacket;
-
-        skb = alloc_skb(size + NET_IP_ALIGN, gfp_flags);
-        if (skb == NULL) {
-                DEBUG (dev, "no rx skb\n");
-                goto enomem;
-        }
-
-        /* Some platforms perform better when IP packets are aligned,
-         * but on at least one, checksumming fails otherwise.  Note:
-         * RNDIS headers involve variable numbers of LE32 values.
-         */
-        skb_reserve(skb, NET_IP_ALIGN);
-
-        req->buf = skb->data;
-        req->length = size;
-        req->complete = rx_complete;
-        req->context = skb;
-
-        retval = usb_ep_queue (dev->out_ep, req, gfp_flags);
-        if (retval == -ENOMEM)
-enomem:
-                defer_kevent (dev, WORK_RX_MEMORY);
-        if (retval) {
-                DEBUG (dev, "rx submit --> %d\n", retval);
-                if (skb)
-                        dev_kfree_skb_any(skb);
-                spin_lock(&dev->req_lock);
-                list_add (&req->list, &dev->rx_reqs);
-                spin_unlock(&dev->req_lock);
-        }
-        return retval;
-}
-
-static void rx_complete (struct usb_ep *ep, struct usb_request *req)
-{
-        struct sk_buff  *skb = req->context;
-        struct eth_dev  *dev = ep->driver_data;
-        int             status = req->status;
-
-        switch (status) {
-
-        /* normal completion */
-        case 0:
-                skb_put (skb, req->actual);
-                /* we know MaxPacketsPerTransfer == 1 here */
-                if (rndis_active(dev))
-                        status = rndis_rm_hdr (skb);
-                if (status < 0
-                                || ETH_HLEN > skb->len
-                                || skb->len > ETH_FRAME_LEN) {
-                        dev->stats.rx_errors++;
-                        dev->stats.rx_length_errors++;
-                        DEBUG (dev, "rx length %d\n", skb->len);
-                        break;
-                }
-
-                skb->protocol = eth_type_trans (skb, dev->net);
-                dev->stats.rx_packets++;
-                dev->stats.rx_bytes += skb->len;
-
-                /* no buffer copies needed, unless hardware can't
-                 * use skb buffers.
-                 */
-                status = netif_rx (skb);
-                skb = NULL;
-                break;
-
-        /* software-driven interface shutdown */
-        case -ECONNRESET:               // unlink
-        case -ESHUTDOWN:                // disconnect etc
-                VDEBUG (dev, "rx shutdown, code %d\n", status);
-                goto quiesce;
-
-        /* for hardware automagic (such as pxa) */
-        case -ECONNABORTED:             // endpoint reset
-                DEBUG (dev, "rx %s reset\n", ep->name);
-                defer_kevent (dev, WORK_RX_MEMORY);
-quiesce:
-                dev_kfree_skb_any (skb);
-                goto clean;
-
-        /* data overrun */
-        case -EOVERFLOW:
-                dev->stats.rx_over_errors++;
-                // FALLTHROUGH
-
-        default:
-                dev->stats.rx_errors++;
-                DEBUG (dev, "rx status %d\n", status);
-                break;
-        }
-
-        if (skb)
-                dev_kfree_skb_any (skb);
-        if (!netif_running (dev->net)) {
-clean:
-                spin_lock(&dev->req_lock);
-                list_add (&req->list, &dev->rx_reqs);
-                spin_unlock(&dev->req_lock);
-                req = NULL;
-        }
-        if (req)
-                rx_submit (dev, req, GFP_ATOMIC);
-}
-
-static int prealloc (struct list_head *list, struct usb_ep *ep,
-                        unsigned n, gfp_t gfp_flags)
-{
-        unsigned                i;
-        struct usb_request      *req;
-
-        if (!n)
-                return -ENOMEM;
-
-        /* queue/recycle up to N requests */
-        i = n;
-        list_for_each_entry (req, list, list) {
-                if (i-- == 0)
-                        goto extra;
-        }
-        while (i--) {
-                req = usb_ep_alloc_request (ep, gfp_flags);
-                if (!req)
-                        return list_empty (list) ? -ENOMEM : 0;
-                list_add (&req->list, list);
-        }
-        return 0;
-
-extra:
-        /* free extras */
-        for (;;) {
-                struct list_head        *next;
-
-                next = req->list.next;
-                list_del (&req->list);
-                usb_ep_free_request (ep, req);
-
-                if (next == list)
-                        break;
-
-                req = container_of (next, struct usb_request, list);
-        }
-        return 0;
-}
-
-static int alloc_requests (struct eth_dev *dev, unsigned n, gfp_t gfp_flags)
-{
-        int status;
-
-        spin_lock(&dev->req_lock);
-        status = prealloc (&dev->tx_reqs, dev->in_ep, n, gfp_flags);
-        if (status < 0)
-                goto fail;
-        status = prealloc (&dev->rx_reqs, dev->out_ep, n, gfp_flags);
-        if (status < 0)
-                goto fail;
-        goto done;
-fail:
-        DEBUG (dev, "can't alloc requests\n");
-done:
-        spin_unlock(&dev->req_lock);
-        return status;
-}
-
-static void rx_fill (struct eth_dev *dev, gfp_t gfp_flags)
-{
-        struct usb_request      *req;
-        unsigned long           flags;
-
-        /* fill unused rxq slots with some skb */
-        spin_lock_irqsave(&dev->req_lock, flags);
-        while (!list_empty (&dev->rx_reqs)) {
-                req = container_of (dev->rx_reqs.next,
-                                struct usb_request, list);
-                list_del_init (&req->list);
-                spin_unlock_irqrestore(&dev->req_lock, flags);
-
-                if (rx_submit (dev, req, gfp_flags) < 0) {
-                        defer_kevent (dev, WORK_RX_MEMORY);
-                        return;
-                }
-
-                spin_lock_irqsave(&dev->req_lock, flags);
-        }
-        spin_unlock_irqrestore(&dev->req_lock, flags);
-}
-
-static void eth_work (struct work_struct *work)
-{
-        struct eth_dev  *dev = container_of(work, struct eth_dev, work);
-
-        if (test_and_clear_bit (WORK_RX_MEMORY, &dev->todo)) {
-                if (netif_running (dev->net))
-                        rx_fill (dev, GFP_KERNEL);
-        }
-
-        if (dev->todo)
-                DEBUG (dev, "work done, flags = 0x%lx\n", dev->todo);
-}
-
-static void tx_complete (struct usb_ep *ep, struct usb_request *req)
-{
-        struct sk_buff  *skb = req->context;
-        struct eth_dev  *dev = ep->driver_data;
-
-        switch (req->status) {
-        default:
-                dev->stats.tx_errors++;
-                VDEBUG (dev, "tx err %d\n", req->status);
-                /* FALLTHROUGH */
-        case -ECONNRESET:               // unlink
-        case -ESHUTDOWN:                // disconnect etc
-                break;
-        case 0:
-                dev->stats.tx_bytes += skb->len;
-        }
-        dev->stats.tx_packets++;
-
-        spin_lock(&dev->req_lock);
-        list_add (&req->list, &dev->tx_reqs);
-        spin_unlock(&dev->req_lock);
-        dev_kfree_skb_any (skb);
-
-        atomic_dec (&dev->tx_qlen);
-        if (netif_carrier_ok (dev->net))
-                netif_wake_queue (dev->net);
-}
-
-static inline int eth_is_promisc (struct eth_dev *dev)
-{
-        /* no filters for the CDC subset; always promisc */
-        if (subset_active (dev))
-                return 1;
-        return dev->cdc_filter & USB_CDC_PACKET_TYPE_PROMISCUOUS;
-}
-
-static int eth_start_xmit (struct sk_buff *skb, struct net_device *net)
-{
-        struct eth_dev          *dev = netdev_priv(net);
-        int                     length = skb->len;
-        int                     retval;
-        struct usb_request      *req = NULL;
-        unsigned long           flags;
-
-        /* apply outgoing CDC or RNDIS filters */
-        if (!eth_is_promisc (dev)) {
-                u8              *dest = skb->data;
-
-                if (is_multicast_ether_addr(dest)) {
-                        u16     type;
-
-                        /* ignores USB_CDC_PACKET_TYPE_MULTICAST and host
-                         * SET_ETHERNET_MULTICAST_FILTERS requests
-                         */
-                        if (is_broadcast_ether_addr(dest))
-                                type = USB_CDC_PACKET_TYPE_BROADCAST;
-                        else
-                                type = USB_CDC_PACKET_TYPE_ALL_MULTICAST;
-                        if (!(dev->cdc_filter & type)) {
-                                dev_kfree_skb_any (skb);
-                                return 0;
-                        }
-                }
-                /* ignores USB_CDC_PACKET_TYPE_DIRECTED */
-        }
-
-        spin_lock_irqsave(&dev->req_lock, flags);
-        /*
-         * this freelist can be empty if an interrupt triggered disconnect()
-         * and reconfigured the gadget (shutting down this queue) after the
-         * network stack decided to xmit but before we got the spinlock.
-         */
-        if (list_empty(&dev->tx_reqs)) {
-                spin_unlock_irqrestore(&dev->req_lock, flags);
-                return 1;
-        }
-
-        req = container_of (dev->tx_reqs.next, struct usb_request, list);
-        list_del (&req->list);
-
-        /* temporarily stop TX queue when the freelist empties */
-        if (list_empty (&dev->tx_reqs))
-                netif_stop_queue (net);
-        spin_unlock_irqrestore(&dev->req_lock, flags);
-
-        /* no buffer copies needed, unless the network stack did it
-         * or the hardware can't use skb buffers.
-         * or there's not enough space for any RNDIS headers we need
-         */
-        if (rndis_active(dev)) {
-                struct sk_buff  *skb_rndis;
-
-                skb_rndis = skb_realloc_headroom (skb,
-                                sizeof (struct rndis_packet_msg_type));
-                if (!skb_rndis)
-                        goto drop;
-
-                dev_kfree_skb_any (skb);
-                skb = skb_rndis;
-                rndis_add_hdr (skb);
-                length = skb->len;
-        }
-        req->buf = skb->data;
-        req->context = skb;
-        req->complete = tx_complete;
-
-        /* use zlp framing on tx for strict CDC-Ether conformance,
-         * though any robust network rx path ignores extra padding.
-         * and some hardware doesn't like to write zlps.
-         */
-        req->zero = 1;
-        if (!dev->zlp && (length % dev->in_ep->maxpacket) == 0)
-                length++;
-
-        req->length = length;
-
-        /* throttle highspeed IRQ rate back slightly */
-        if (gadget_is_dualspeed(dev->gadget))
-                req->no_interrupt = (dev->gadget->speed == USB_SPEED_HIGH)
-                        ? ((atomic_read(&dev->tx_qlen) % qmult) != 0)
-                        : 0;
-
-        retval = usb_ep_queue (dev->in_ep, req, GFP_ATOMIC);
-        switch (retval) {
-        default:
-                DEBUG (dev, "tx queue err %d\n", retval);
-                break;
-        case 0:
-                net->trans_start = jiffies;
-                atomic_inc (&dev->tx_qlen);
-        }
-
-        if (retval) {
-drop:
-                dev->stats.tx_dropped++;
-                dev_kfree_skb_any (skb);
-                spin_lock_irqsave(&dev->req_lock, flags);
-                if (list_empty (&dev->tx_reqs))
-                        netif_start_queue (net);
-                list_add (&req->list, &dev->tx_reqs);
-                spin_unlock_irqrestore(&dev->req_lock, flags);
-        }
-        return 0;
-}
-
-/*-------------------------------------------------------------------------*/
-
-#ifdef CONFIG_USB_ETH_RNDIS
-
-/* The interrupt endpoint is used in RNDIS to notify the host when messages
- * other than data packets are available ... notably the REMOTE_NDIS_*_CMPLT
- * messages, but also REMOTE_NDIS_INDICATE_STATUS_MSG and potentially even
- * REMOTE_NDIS_KEEPALIVE_MSG.
- *
- * The RNDIS control queue is processed by GET_ENCAPSULATED_RESPONSE, and
- * normally just one notification will be queued.
- */
-
-static struct usb_request *eth_req_alloc (struct usb_ep *, unsigned, gfp_t);
-static void eth_req_free (struct usb_ep *ep, struct usb_request *req);
-
-static void
-rndis_control_ack_complete (struct usb_ep *ep, struct usb_request *req)
-{
-        struct eth_dev          *dev = ep->driver_data;
-
-        if (req->status || req->actual != req->length)
-                DEBUG (dev,
-                        "rndis control ack complete --> %d, %d/%d\n",
-                        req->status, req->actual, req->length);
-        req->context = NULL;
-
-        if (req != dev->stat_req)
-                eth_req_free(ep, req);
-}
-
-static int rndis_control_ack (struct net_device *net)
-{
-        struct eth_dev          *dev = netdev_priv(net);
-        int                     length;
-        struct usb_request      *resp = dev->stat_req;
-
-        /* in case RNDIS calls this after disconnect */
-        if (!dev->status) {
-                DEBUG (dev, "status ENODEV\n");
-                return -ENODEV;
-        }
-
-        /* in case queue length > 1 */
-        if (resp->context) {
-                resp = eth_req_alloc (dev->status_ep, 8, GFP_ATOMIC);
-                if (!resp)
-                        return -ENOMEM;
-        }
-
-        /* Send RNDIS RESPONSE_AVAILABLE notification;
-         * USB_CDC_NOTIFY_RESPONSE_AVAILABLE should work too
-         */
-        resp->length = 8;
-        resp->complete = rndis_control_ack_complete;
-        resp->context = dev;
-
-        *((__le32 *) resp->buf) = __constant_cpu_to_le32 (1);
-        *((__le32 *) resp->buf + 1) = __constant_cpu_to_le32 (0);
-
-        length = usb_ep_queue (dev->status_ep, resp, GFP_ATOMIC);
-        if (length < 0) {
-                resp->status = 0;
-                rndis_control_ack_complete (dev->status_ep, resp);
-        }
-
-        return 0;
-}
-
-#else
-
-#define rndis_control_ack       NULL
-
-#endif  /* RNDIS */
-
-static void eth_start (struct eth_dev *dev, gfp_t gfp_flags)
-{
-        DEBUG (dev, "%s\n", __func__);
-
-        /* fill the rx queue */
-        rx_fill (dev, gfp_flags);
-
-        /* and open the tx floodgates */
-        atomic_set (&dev->tx_qlen, 0);
-        netif_wake_queue (dev->net);
-        if (rndis_active(dev)) {
-                rndis_set_param_medium (dev->rndis_config,
-                                        NDIS_MEDIUM_802_3,
-                                        BITRATE(dev->gadget)/100);
-                (void) rndis_signal_connect (dev->rndis_config);
-        }
-}
-
-static int eth_open (struct net_device *net)
-{
-        struct eth_dev          *dev = netdev_priv(net);
-
-        DEBUG (dev, "%s\n", __func__);
-        if (netif_carrier_ok (dev->net))
-                eth_start (dev, GFP_KERNEL);
-        return 0;
+                return geth_bind_config(c, hostaddr);
 }
 
-static int eth_stop (struct net_device *net)
-{
-        struct eth_dev          *dev = netdev_priv(net);
-
-        VDEBUG (dev, "%s\n", __func__);
-        netif_stop_queue (net);
-
-        DEBUG (dev, "stop stats: rx/tx %ld/%ld, errs %ld/%ld\n",
-                dev->stats.rx_packets, dev->stats.tx_packets,
-                dev->stats.rx_errors, dev->stats.tx_errors
-                );
-
-        /* ensure there are no more active requests */
-        if (dev->config) {
-                usb_ep_disable (dev->in_ep);
-                usb_ep_disable (dev->out_ep);
-                if (netif_carrier_ok (dev->net)) {
-                        DEBUG (dev, "host still using in/out endpoints\n");
-                        // FIXME idiom may leave toggle wrong here
-                        usb_ep_enable (dev->in_ep, dev->in);
-                        usb_ep_enable (dev->out_ep, dev->out);
-                }
-                if (dev->status_ep) {
-                        usb_ep_disable (dev->status_ep);
-                        usb_ep_enable (dev->status_ep, dev->status);
-                }
-        }
-
-        if (rndis_active(dev)) {
-                rndis_set_param_medium(dev->rndis_config, NDIS_MEDIUM_802_3, 0);
-                (void) rndis_signal_disconnect (dev->rndis_config);
-        }
-
-        return 0;
-}
+static struct usb_configuration eth_config_driver = {
+        /* .label = f(hardware) */
+        .bind                   = eth_do_config,
+        .bConfigurationValue    = 1,
+        /* .iConfiguration = DYNAMIC */
+        .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
+        .bMaxPower              = 1,    /* 2 mA, minimal */
+};
 
 /*-------------------------------------------------------------------------*/
 
-static struct usb_request *
-eth_req_alloc (struct usb_ep *ep, unsigned size, gfp_t gfp_flags)
+static int __init eth_bind(struct usb_composite_dev *cdev)
 {
-        struct usb_request      *req;
-
-        req = usb_ep_alloc_request (ep, gfp_flags);
-        if (!req)
-                return NULL;
-
-        req->buf = kmalloc (size, gfp_flags);
-        if (!req->buf) {
-                usb_ep_free_request (ep, req);
-                req = NULL;
-        }
-        return req;
-}
-
-static void
-eth_req_free (struct usb_ep *ep, struct usb_request *req)
-{
-        kfree (req->buf);
-        usb_ep_free_request (ep, req);
-}
-
-
-static void /* __init_or_exit */
-eth_unbind (struct usb_gadget *gadget)
-{
-        struct eth_dev          *dev = get_gadget_data (gadget);
-
-        DEBUG (dev, "unbind\n");
-        rndis_deregister (dev->rndis_config);
-        rndis_exit ();
-
-        /* we've already been disconnected ... no i/o is active */
-        if (dev->req) {
-                eth_req_free (gadget->ep0, dev->req);
-                dev->req = NULL;
-        }
-        if (dev->stat_req) {
-                eth_req_free (dev->status_ep, dev->stat_req);
-                dev->stat_req = NULL;
-        }
-
-        unregister_netdev (dev->net);
-        free_netdev(dev->net);
-
-        /* assuming we used keventd, it must quiesce too */
-        flush_scheduled_work ();
-        set_gadget_data (gadget, NULL);
-}
-
-static u8 __init nibble (unsigned char c)
-{
-        if (likely (isdigit (c)))
-                return c - '0';
-        c = toupper (c);
-        if (likely (isxdigit (c)))
-                return 10 + c - 'A';
-        return 0;
-}
+        int                     gcnum;
+        struct usb_gadget       *gadget = cdev->gadget;
+        int                     status;
 
-static int __init get_ether_addr(const char *str, u8 *dev_addr)
-{
-        if (str) {
-                unsigned        i;
+        /* set up network link layer */
+        status = gether_setup(cdev->gadget, hostaddr);
+        if (status < 0)
+                return status;
 
-                for (i = 0; i < 6; i++) {
-                        unsigned char num;
+        /* set up main config label and device descriptor */
+        if (can_support_ecm(cdev->gadget)) {
+                /* ECM */
+                eth_config_driver.label = "CDC Ethernet (ECM)";
+        } else {
+                /* CDC Subset */
+                eth_config_driver.label = "CDC Subset/SAFE";
 
-                        if((*str == '.') || (*str == ':'))
-                                str++;
-                        num = nibble(*str++) << 4;
-                        num |= (nibble(*str++));
-                        dev_addr [i] = num;
-                }
-                if (is_valid_ether_addr (dev_addr))
-                        return 0;
+                device_desc.idVendor = cpu_to_le16(SIMPLE_VENDOR_NUM),
+                device_desc.idProduct = cpu_to_le16(SIMPLE_PRODUCT_NUM),
+                device_desc.bDeviceClass = USB_CLASS_VENDOR_SPEC;
         }
-        random_ether_addr(dev_addr);
-        return 1;
-}
-
-static int __init
-eth_bind (struct usb_gadget *gadget)
-{
-        struct eth_dev          *dev;
-        struct net_device       *net;
-        u8                      cdc = 1, zlp = 1, rndis = 1;
-        struct usb_ep           *in_ep, *out_ep, *status_ep = NULL;
-        int                     status = -ENOMEM;
-        int                     gcnum;
-
-        /* these flags are only ever cleared; compiler take note */
-#ifndef DEV_CONFIG_CDC
-        cdc = 0;
-#endif
-#ifndef CONFIG_USB_ETH_RNDIS
-        rndis = 0;
-#endif
 
-        /* Because most host side USB stacks handle CDC Ethernet, that
-         * standard protocol is _strongly_ preferred for interop purposes.
-         * (By everyone except Microsoft.)
-         */
-        if (gadget_is_pxa (gadget)) {
-                /* pxa doesn't support altsettings */
-                cdc = 0;
-        } else if (gadget_is_musbhdrc(gadget)) {
-                /* reduce tx dma overhead by avoiding special cases */
-                zlp = 0;
-        } else if (gadget_is_sh(gadget)) {
-                /* sh doesn't support multiple interfaces or configs */
-                cdc = 0;
-                rndis = 0;
-        } else if (gadget_is_sa1100 (gadget)) {
-                /* hardware can't write zlps */
-                zlp = 0;
-                /* sa1100 CAN do CDC, without status endpoint ... we use
-                 * non-CDC to be compatible with ARM Linux-2.4 "usb-eth".
-                 */
-                cdc = 0;
+        if (has_rndis()) {
+                /* RNDIS plus ECM-or-Subset */
+                device_desc.idVendor = cpu_to_le16(RNDIS_VENDOR_NUM),
+                device_desc.idProduct = cpu_to_le16(RNDIS_PRODUCT_NUM),
+                device_desc.bNumConfigurations = 2;
         }
 
-        gcnum = usb_gadget_controller_number (gadget);
+        gcnum = usb_gadget_controller_number(gadget);
         if (gcnum >= 0)
-                device_desc.bcdDevice = cpu_to_le16 (0x0200 + gcnum);
+                device_desc.bcdDevice = cpu_to_le16(0x0300 | gcnum);
         else {
-                /* can't assume CDC works.  don't want to default to
-                 * anything less functional on CDC-capable hardware,
-                 * so we fail in this case.
+                /* We assume that can_support_ecm() tells the truth;
+                 * but if the controller isn't recognized at all then
+                 * that assumption is a bit more likely to be wrong.
                  */
-                dev_err (&gadget->dev,
-                        "controller '%s' not recognized\n",
-                        gadget->name);
-                return -ENODEV;
-        }
-        snprintf (manufacturer, sizeof manufacturer, "%s %s/%s",
-                init_utsname()->sysname, init_utsname()->release,
-                gadget->name);
-
-        /* If there's an RNDIS configuration, that's what Windows wants to
-         * be using ... so use these product IDs here and in the "linux.inf"
-         * needed to install MSFT drivers.  Current Linux kernels will use
-         * the second configuration if it's CDC Ethernet, and need some help
-         * to choose the right configuration otherwise.
-         */
-        if (rndis) {
-                device_desc.idVendor =
-                        __constant_cpu_to_le16(RNDIS_VENDOR_NUM);
-                device_desc.idProduct =
-                        __constant_cpu_to_le16(RNDIS_PRODUCT_NUM);
-                snprintf (product_desc, sizeof product_desc,
-                        "RNDIS/%s", driver_desc);
-
-        /* CDC subset ... recognized by Linux since 2.4.10, but Windows
-         * drivers aren't widely available.  (That may be improved by
-         * supporting one submode of the "SAFE" variant of MDLM.)
-         */
-        } else if (!cdc) {
-                device_desc.idVendor =
-                        __constant_cpu_to_le16(SIMPLE_VENDOR_NUM);
-                device_desc.idProduct =
-                        __constant_cpu_to_le16(SIMPLE_PRODUCT_NUM);
-        }
-
-        /* support optional vendor/distro customization */
-        if (idVendor) {
-                if (!idProduct) {
-                        dev_err (&gadget->dev, "idVendor needs idProduct!\n");
-                        return -ENODEV;
-                }
-                device_desc.idVendor = cpu_to_le16(idVendor);
-                device_desc.idProduct = cpu_to_le16(idProduct);
-                if (bcdDevice)
-                        device_desc.bcdDevice = cpu_to_le16(bcdDevice);
-        }
-        if (iManufacturer)
-                strlcpy (manufacturer, iManufacturer, sizeof manufacturer);
-        if (iProduct)
-                strlcpy (product_desc, iProduct, sizeof product_desc);
-        if (iSerialNumber) {
-                device_desc.iSerialNumber = STRING_SERIALNUMBER,
-                strlcpy(serial_number, iSerialNumber, sizeof serial_number);
-        }
-
-        /* all we really need is bulk IN/OUT */
-        usb_ep_autoconfig_reset (gadget);
-        in_ep = usb_ep_autoconfig (gadget, &fs_source_desc);
-        if (!in_ep) {
-autoconf_fail:
-                dev_err (&gadget->dev,
-                        "can't autoconfigure on %s\n",
-                        gadget->name);
-                return -ENODEV;
-        }
-        in_ep->driver_data = in_ep;     /* claim */
-
-        out_ep = usb_ep_autoconfig (gadget, &fs_sink_desc);
-        if (!out_ep)
-                goto autoconf_fail;
-        out_ep->driver_data = out_ep;   /* claim */
-
-#if defined(DEV_CONFIG_CDC) || defined(CONFIG_USB_ETH_RNDIS)
-        /* CDC Ethernet control interface doesn't require a status endpoint.
-         * Since some hosts expect one, try to allocate one anyway.
-         */
-        if (cdc || rndis) {
-                status_ep = usb_ep_autoconfig (gadget, &fs_status_desc);
-                if (status_ep) {
-                        status_ep->driver_data = status_ep;     /* claim */
-                } else if (rndis) {
-                        dev_err (&gadget->dev,
-                                "can't run RNDIS on %s\n",
-                                gadget->name);
-                        return -ENODEV;
-#ifdef DEV_CONFIG_CDC
-                /* pxa25x only does CDC subset; often used with RNDIS */
-                } else if (cdc) {
-                        control_intf.bNumEndpoints = 0;
-                        /* FIXME remove endpoint from descriptor list */
-#endif
-                }
-        }
-#endif
-
-        /* one config:  cdc, else minimal subset */
-        if (!cdc) {
-                eth_config.bNumInterfaces = 1;
-                eth_config.iConfiguration = STRING_SUBSET;
-
-                /* use functions to set these up, in case we're built to work
-                 * with multiple controllers and must override CDC Ethernet.
-                 */
-                fs_subset_descriptors();
-                hs_subset_descriptors();
-        }
-
-        device_desc.bMaxPacketSize0 = gadget->ep0->maxpacket;
-        usb_gadget_set_selfpowered (gadget);
-
-        /* For now RNDIS is always a second config */
-        if (rndis)
-                device_desc.bNumConfigurations = 2;
-
-        if (gadget_is_dualspeed(gadget)) {
-                if (rndis)
-                        dev_qualifier.bNumConfigurations = 2;
-                else if (!cdc)
-                        dev_qualifier.bDeviceClass = USB_CLASS_VENDOR_SPEC;
-
-                /* assumes ep0 uses the same value for both speeds ... */
-                dev_qualifier.bMaxPacketSize0 = device_desc.bMaxPacketSize0;
-
-                /* and that all endpoints are dual-speed */
-                hs_source_desc.bEndpointAddress =
-                                fs_source_desc.bEndpointAddress;
-                hs_sink_desc.bEndpointAddress =
-                                fs_sink_desc.bEndpointAddress;
-#if defined(DEV_CONFIG_CDC) || defined(CONFIG_USB_ETH_RNDIS)
-                if (status_ep)
-                        hs_status_desc.bEndpointAddress =
-                                        fs_status_desc.bEndpointAddress;
-#endif
+                WARN(cdev, "controller '%s' not recognized; trying %s\n",
+                                gadget->name,
+                                eth_config_driver.label);
+                device_desc.bcdDevice =
+                        __constant_cpu_to_le16(0x0300 | 0x0099);
         }
 
-        if (gadget_is_otg(gadget)) {
-                otg_descriptor.bmAttributes |= USB_OTG_HNP,
-                eth_config.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
-                eth_config.bMaxPower = 4;
-#ifdef  CONFIG_USB_ETH_RNDIS
-                rndis_config.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
-                rndis_config.bMaxPower = 4;
-#endif
-        }
-
-        net = alloc_etherdev (sizeof *dev);
-        if (!net)
-                return status;
-        dev = netdev_priv(net);
-        spin_lock_init (&dev->lock);
-        spin_lock_init (&dev->req_lock);
-        INIT_WORK (&dev->work, eth_work);
-        INIT_LIST_HEAD (&dev->tx_reqs);
-        INIT_LIST_HEAD (&dev->rx_reqs);
-
-        /* network device setup */
-        dev->net = net;
-        strcpy (net->name, "usb%d");
-        dev->cdc = cdc;
-        dev->zlp = zlp;
 
-        dev->in_ep = in_ep;
-        dev->out_ep = out_ep;
-        dev->status_ep = status_ep;
-
-        /* Module params for these addresses should come from ID proms.
-         * The host side address is used with CDC and RNDIS, and commonly
-         * ends up in a persistent config database.  It's not clear if
-         * host side code for the SAFE thing cares -- its original BLAN
-         * thing didn't, Sharp never assigned those addresses on Zaurii.
+        /* Allocate string descriptor numbers ... note that string
+         * contents can be overridden by the composite_dev glue.
          */
-        if (get_ether_addr(dev_addr, net->dev_addr))
-                dev_warn(&gadget->dev,
-                        "using random %s ethernet address\n", "self");
-        if (get_ether_addr(host_addr, dev->host_mac))
-                dev_warn(&gadget->dev,
-                        "using random %s ethernet address\n", "host");
-        snprintf (ethaddr, sizeof ethaddr, "%02X%02X%02X%02X%02X%02X",
-                dev->host_mac [0], dev->host_mac [1],
-                dev->host_mac [2], dev->host_mac [3],
-                dev->host_mac [4], dev->host_mac [5]);
-
-        if (rndis) {
-                status = rndis_init();
-                if (status < 0) {
-                        dev_err (&gadget->dev, "can't init RNDIS, %d\n",
-                                status);
-                        goto fail;
-                }
-        }
 
-        net->change_mtu = eth_change_mtu;
-        net->get_stats = eth_get_stats;
-        net->hard_start_xmit = eth_start_xmit;
-        net->open = eth_open;
-        net->stop = eth_stop;
-        // watchdog_timeo, tx_timeout ...
-        // set_multicast_list
-        SET_ETHTOOL_OPS(net, &ops);
+        /* device descriptor strings: manufacturer, product */
+        snprintf(manufacturer, sizeof manufacturer, "%s %s with %s",
+                init_utsname()->sysname, init_utsname()->release,
+                gadget->name);
+        status = usb_string_id(cdev);
+        if (status < 0)
+                goto fail;
+        strings_dev[STRING_MANUFACTURER_IDX].id = status;
+        device_desc.iManufacturer = status;
 
-        /* preallocate control message data and buffer */
-        dev->req = eth_req_alloc (gadget->ep0, USB_BUFSIZ, GFP_KERNEL);
-        if (!dev->req)
+        status = usb_string_id(cdev);
+        if (status < 0)
                 goto fail;
-        dev->req->complete = eth_setup_complete;
+        strings_dev[STRING_PRODUCT_IDX].id = status;
+        device_desc.iProduct = status;
 
-        /* ... and maybe likewise for status transfer */
-#if defined(DEV_CONFIG_CDC) || defined(CONFIG_USB_ETH_RNDIS)
-        if (dev->status_ep) {
-                dev->stat_req = eth_req_alloc (dev->status_ep,
-                                        STATUS_BYTECOUNT, GFP_KERNEL);
-                if (!dev->stat_req) {
-                        eth_req_free (gadget->ep0, dev->req);
+        /* register our configuration(s); RNDIS first, if it's used */
+        if (has_rndis()) {
+                status = usb_add_config(cdev, &rndis_config_driver);
+                if (status < 0)
                         goto fail;
-                }
-                dev->stat_req->context = NULL;
         }
-#endif
-
-        /* finish hookup to lower layer ... */
-        dev->gadget = gadget;
-        set_gadget_data (gadget, dev);
-        gadget->ep0->driver_data = dev;
 
-        /* two kinds of host-initiated state changes:
-         *  - iff DATA transfer is active, carrier is "on"
-         *  - tx queueing enabled if open *and* carrier is "on"
-         */
-        netif_stop_queue (dev->net);
-        netif_carrier_off (dev->net);
-
-        SET_NETDEV_DEV (dev->net, &gadget->dev);
-        status = register_netdev (dev->net);
+        status = usb_add_config(cdev, &eth_config_driver);
         if (status < 0)
-                goto fail1;
-
-        INFO (dev, "%s, version: " DRIVER_VERSION "\n", driver_desc);
-        INFO (dev, "using %s, OUT %s IN %s%s%s\n", gadget->name,
-                out_ep->name, in_ep->name,
-                status_ep ? " STATUS " : "",
-                status_ep ? status_ep->name : ""
-                );
-        INFO (dev, "MAC %02x:%02x:%02x:%02x:%02x:%02x\n",
-                net->dev_addr [0], net->dev_addr [1],
-                net->dev_addr [2], net->dev_addr [3],
-                net->dev_addr [4], net->dev_addr [5]);
-
-        if (cdc || rndis)
-                INFO (dev, "HOST MAC %02x:%02x:%02x:%02x:%02x:%02x\n",
-                        dev->host_mac [0], dev->host_mac [1],
-                        dev->host_mac [2], dev->host_mac [3],
-                        dev->host_mac [4], dev->host_mac [5]);
-
-        if (rndis) {
-                u32     vendorID = 0;
-
-                /* FIXME RNDIS vendor id == "vendor NIC code" == ? */
-
-                dev->rndis_config = rndis_register (rndis_control_ack);
-                if (dev->rndis_config < 0) {
-fail0:
-                        unregister_netdev (dev->net);
-                        status = -ENODEV;
-                        goto fail;
-                }
+                goto fail;
 
-                /* these set up a lot of the OIDs that RNDIS needs */
-                rndis_set_host_mac (dev->rndis_config, dev->host_mac);
-                if (rndis_set_param_dev (dev->rndis_config, dev->net,
-                                         &dev->stats, &dev->cdc_filter))
-                        goto fail0;
-                if (rndis_set_param_vendor(dev->rndis_config, vendorID,
-                                        manufacturer))
-                        goto fail0;
-                if (rndis_set_param_medium(dev->rndis_config,
-                                        NDIS_MEDIUM_802_3, 0))
-                        goto fail0;
-                INFO (dev, "RNDIS ready\n");
-        }
+        INFO(cdev, "%s, version: " DRIVER_VERSION "\n", DRIVER_DESC);
 
-        return status;
+        return 0;
 
-fail1:
-        dev_dbg(&gadget->dev, "register_netdev failed, %d\n", status);
 fail:
-        eth_unbind (gadget);
+        gether_cleanup();
         return status;
 }
 
-/*-------------------------------------------------------------------------*/
-
-static void
-eth_suspend (struct usb_gadget *gadget)
-{
-        struct eth_dev          *dev = get_gadget_data (gadget);
-
-        DEBUG (dev, "suspend\n");
-        dev->suspended = 1;
-}
-
-static void
-eth_resume (struct usb_gadget *gadget)
+static int __exit eth_unbind(struct usb_composite_dev *cdev)
 {
-        struct eth_dev          *dev = get_gadget_data (gadget);
-
-        DEBUG (dev, "resume\n");
-        dev->suspended = 0;
+        gether_cleanup();
+        return 0;
 }
 
-/*-------------------------------------------------------------------------*/
-
-static struct usb_gadget_driver eth_driver = {
-        .speed          = DEVSPEED,
-
-        .function       = (char *) driver_desc,
+static struct usb_composite_driver eth_driver = {
+        .name           = "g_ether",
+        .dev            = &device_desc,
+        .strings        = dev_strings,
         .bind           = eth_bind,
-        .unbind         = eth_unbind,
-
-        .setup          = eth_setup,
-        .disconnect     = eth_disconnect,
-
-        .suspend        = eth_suspend,
-        .resume         = eth_resume,
-
-        .driver = {
-                .name           = (char *) shortname,
-                .owner          = THIS_MODULE,
-        },
+        .unbind         = __exit_p(eth_unbind),
 };
 
-MODULE_DESCRIPTION (DRIVER_DESC);
-MODULE_AUTHOR ("David Brownell, Benedikt Spanger");
-MODULE_LICENSE ("GPL");
+MODULE_DESCRIPTION(PREFIX DRIVER_DESC);
+MODULE_AUTHOR("David Brownell, Benedikt Spanger");
+MODULE_LICENSE("GPL");
 
-
-static int __init init (void)
+static int __init init(void)
 {
-        return usb_gadget_register_driver (&eth_driver);
+        return usb_composite_register(&eth_driver);
 }
-module_init (init);
+module_init(init);
 
-static void __exit cleanup (void)
+static void __exit cleanup(void)
 {
-        usb_gadget_unregister_driver (&eth_driver);
+        usb_composite_unregister(&eth_driver);
 }
-module_exit (cleanup);
-
+module_exit(cleanup);
diff --git a/drivers/usb/gadget/f_acm.c b/drivers/usb/gadget/f_acm.c
new file mode 100644
index 000000000000..d8faccf27895
--- /dev/null
+++ b/drivers/usb/gadget/f_acm.c
@@ -0,0 +1,589 @@
+/*
+ * f_acm.c -- USB CDC serial (ACM) function driver
+ *
+ * Copyright (C) 2003 Al Borchers (alborchers@steinerpoint.com)
+ * Copyright (C) 2008 by David Brownell
+ * Copyright (C) 2008 by Nokia Corporation
+ *
+ * This software is distributed under the terms of the GNU General
+ * Public License ("GPL") as published by the Free Software Foundation,
+ * either version 2 of that License or (at your option) any later version.
+ */
+
+/* #define VERBOSE_DEBUG */
+
+#include <linux/kernel.h>
+#include <linux/device.h>
+
+#include "u_serial.h"
+#include "gadget_chips.h"
+
+
+/*
+ * This CDC ACM function support just wraps control functions and
+ * notifications around the generic serial-over-usb code.
+ *
+ * Because CDC ACM is standardized by the USB-IF, many host operating
+ * systems have drivers for it.  Accordingly, ACM is the preferred
+ * interop solution for serial-port type connections.  The control
+ * models are often not necessary, and in any case don't do much in
+ * this bare-bones implementation.
+ *
+ * Note that even MS-Windows has some support for ACM.  However, that
+ * support is somewhat broken because when you use ACM in a composite
+ * device, having multiple interfaces confuses the poor OS.  It doesn't
+ * seem to understand CDC Union descriptors.  The new "association"
+ * descriptors (roughly equivalent to CDC Unions) may sometimes help.
+ */
+
+struct acm_ep_descs {
+        struct usb_endpoint_descriptor  *in;
+        struct usb_endpoint_descriptor  *out;
+        struct usb_endpoint_descriptor  *notify;
+};
+
+struct f_acm {
+        struct gserial                  port;
+        u8                              ctrl_id, data_id;
+        u8                              port_num;
+
+        struct usb_descriptor_header    **fs_function;
+        struct acm_ep_descs             fs;
+        struct usb_descriptor_header    **hs_function;
+        struct acm_ep_descs             hs;
+
+        struct usb_ep                   *notify;
+        struct usb_endpoint_descriptor  *notify_desc;
+
+        struct usb_cdc_line_coding      port_line_coding;       /* 8-N-1 etc */
+        u16                             port_handshake_bits;
+#define RS232_RTS       (1 << 1)        /* unused with full duplex */
+#define RS232_DTR       (1 << 0)        /* host is ready for data r/w */
+};
+
+static inline struct f_acm *func_to_acm(struct usb_function *f)
+{
+        return container_of(f, struct f_acm, port.func);
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* notification endpoint uses smallish and infrequent fixed-size messages */
+
+#define GS_LOG2_NOTIFY_INTERVAL         5       /* 1 << 5 == 32 msec */
+#define GS_NOTIFY_MAXPACKET             8
+
+/* interface and class descriptors: */
+
+static struct usb_interface_descriptor acm_control_interface_desc __initdata = {
+        .bLength =              USB_DT_INTERFACE_SIZE,
+        .bDescriptorType =      USB_DT_INTERFACE,
+        /* .bInterfaceNumber = DYNAMIC */
+        .bNumEndpoints =        1,
+        .bInterfaceClass =      USB_CLASS_COMM,
+        .bInterfaceSubClass =   USB_CDC_SUBCLASS_ACM,
+        .bInterfaceProtocol =   USB_CDC_ACM_PROTO_AT_V25TER,
+        /* .iInterface = DYNAMIC */
+};
+
+static struct usb_interface_descriptor acm_data_interface_desc __initdata = {
+        .bLength =              USB_DT_INTERFACE_SIZE,
+        .bDescriptorType =      USB_DT_INTERFACE,
+        /* .bInterfaceNumber = DYNAMIC */
+        .bNumEndpoints =        2,
+        .bInterfaceClass =      USB_CLASS_CDC_DATA,
+        .bInterfaceSubClass =   0,
+        .bInterfaceProtocol =   0,
+        /* .iInterface = DYNAMIC */
+};
+
+static struct usb_cdc_header_desc acm_header_desc __initdata = {
+        .bLength =              sizeof(acm_header_desc),
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubType =   USB_CDC_HEADER_TYPE,
+        .bcdCDC =               __constant_cpu_to_le16(0x0110),
+};
+
+static struct usb_cdc_call_mgmt_descriptor
+acm_call_mgmt_descriptor __initdata = {
+        .bLength =              sizeof(acm_call_mgmt_descriptor),
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubType =   USB_CDC_CALL_MANAGEMENT_TYPE,
+        .bmCapabilities =       0,
+        /* .bDataInterface = DYNAMIC */
+};
+
+static struct usb_cdc_acm_descriptor acm_descriptor __initdata = {
+        .bLength =              sizeof(acm_descriptor),
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubType =   USB_CDC_ACM_TYPE,
+        .bmCapabilities =       (1 << 1),
+};
+
+static struct usb_cdc_union_desc acm_union_desc __initdata = {
+        .bLength =              sizeof(acm_union_desc),
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubType =   USB_CDC_UNION_TYPE,
+        /* .bMasterInterface0 = DYNAMIC */
+        /* .bSlaveInterface0 =  DYNAMIC */
+};
+
+/* full speed support: */
+
+static struct usb_endpoint_descriptor acm_fs_notify_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_INT,
+        .wMaxPacketSize =       __constant_cpu_to_le16(GS_NOTIFY_MAXPACKET),
+        .bInterval =            1 << GS_LOG2_NOTIFY_INTERVAL,
+};
+
+static struct usb_endpoint_descriptor acm_fs_in_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_endpoint_descriptor acm_fs_out_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+        .bEndpointAddress =     USB_DIR_OUT,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_descriptor_header *acm_fs_function[] __initdata = {
+        (struct usb_descriptor_header *) &acm_control_interface_desc,
+        (struct usb_descriptor_header *) &acm_header_desc,
+        (struct usb_descriptor_header *) &acm_call_mgmt_descriptor,
+        (struct usb_descriptor_header *) &acm_descriptor,
+        (struct usb_descriptor_header *) &acm_union_desc,
+        (struct usb_descriptor_header *) &acm_fs_notify_desc,
+        (struct usb_descriptor_header *) &acm_data_interface_desc,
+        (struct usb_descriptor_header *) &acm_fs_in_desc,
+        (struct usb_descriptor_header *) &acm_fs_out_desc,
+        NULL,
+};
+
+/* high speed support: */
+
+static struct usb_endpoint_descriptor acm_hs_notify_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_INT,
+        .wMaxPacketSize =       __constant_cpu_to_le16(GS_NOTIFY_MAXPACKET),
+        .bInterval =            GS_LOG2_NOTIFY_INTERVAL+4,
+};
+
+static struct usb_endpoint_descriptor acm_hs_in_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize =       __constant_cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor acm_hs_out_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize =       __constant_cpu_to_le16(512),
+};
+
+static struct usb_descriptor_header *acm_hs_function[] __initdata = {
+        (struct usb_descriptor_header *) &acm_control_interface_desc,
+        (struct usb_descriptor_header *) &acm_header_desc,
+        (struct usb_descriptor_header *) &acm_call_mgmt_descriptor,
+        (struct usb_descriptor_header *) &acm_descriptor,
+        (struct usb_descriptor_header *) &acm_union_desc,
+        (struct usb_descriptor_header *) &acm_hs_notify_desc,
+        (struct usb_descriptor_header *) &acm_data_interface_desc,
+        (struct usb_descriptor_header *) &acm_hs_in_desc,
+        (struct usb_descriptor_header *) &acm_hs_out_desc,
+        NULL,
+};
+
+/* string descriptors: */
+
+#define ACM_CTRL_IDX    0
+#define ACM_DATA_IDX    1
+
+/* static strings, in UTF-8 */
+static struct usb_string acm_string_defs[] = {
+        [ACM_CTRL_IDX].s = "CDC Abstract Control Model (ACM)",
+        [ACM_DATA_IDX].s = "CDC ACM Data",
+        {  /* ZEROES END LIST */ },
+};
+
+static struct usb_gadget_strings acm_string_table = {
+        .language =             0x0409, /* en-us */
+        .strings =              acm_string_defs,
+};
+
+static struct usb_gadget_strings *acm_strings[] = {
+        &acm_string_table,
+        NULL,
+};
+
+/*-------------------------------------------------------------------------*/
+
+/* ACM control ... data handling is delegated to tty library code.
+ * The main task of this function is to activate and deactivate
+ * that code based on device state; track parameters like line
+ * speed, handshake state, and so on; and issue notifications.
+ */
+
+static void acm_complete_set_line_coding(struct usb_ep *ep,
+                struct usb_request *req)
+{
+        struct f_acm    *acm = ep->driver_data;
+        struct usb_composite_dev *cdev = acm->port.func.config->cdev;
+
+        if (req->status != 0) {
+                DBG(cdev, "acm ttyGS%d completion, err %d\n",
+                                acm->port_num, req->status);
+                return;
+        }
+
+        /* normal completion */
+        if (req->actual != sizeof(acm->port_line_coding)) {
+                DBG(cdev, "acm ttyGS%d short resp, len %d\n",
+                                acm->port_num, req->actual);
+                usb_ep_set_halt(ep);
+        } else {
+                struct usb_cdc_line_coding      *value = req->buf;
+
+                /* REVISIT:  we currently just remember this data.
+                 * If we change that, (a) validate it first, then
+                 * (b) update whatever hardware needs updating,
+                 * (c) worry about locking.  This is information on
+                 * the order of 9600-8-N-1 ... most of which means
+                 * nothing unless we control a real RS232 line.
+                 */
+                acm->port_line_coding = *value;
+        }
+}
+
+static int acm_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
+{
+        struct f_acm            *acm = func_to_acm(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+        struct usb_request      *req = cdev->req;
+        int                     value = -EOPNOTSUPP;
+        u16                     w_index = le16_to_cpu(ctrl->wIndex);
+        u16                     w_value = le16_to_cpu(ctrl->wValue);
+        u16                     w_length = le16_to_cpu(ctrl->wLength);
+
+        /* composite driver infrastructure handles everything except
+         * CDC class messages; interface activation uses set_alt().
+         */
+        switch ((ctrl->bRequestType << 8) | ctrl->bRequest) {
+
+        /* SET_LINE_CODING ... just read and save what the host sends */
+        case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
+                        | USB_CDC_REQ_SET_LINE_CODING:
+                if (w_length != sizeof(struct usb_cdc_line_coding)
+                                || w_index != acm->ctrl_id)
+                        goto invalid;
+
+                value = w_length;
+                cdev->gadget->ep0->driver_data = acm;
+                req->complete = acm_complete_set_line_coding;
+                break;
+
+        /* GET_LINE_CODING ... return what host sent, or initial value */
+        case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
+                        | USB_CDC_REQ_GET_LINE_CODING:
+                if (w_index != acm->ctrl_id)
+                        goto invalid;
+
+                value = min_t(unsigned, w_length,
+                                sizeof(struct usb_cdc_line_coding));
+                memcpy(req->buf, &acm->port_line_coding, value);
+                break;
+
+        /* SET_CONTROL_LINE_STATE ... save what the host sent */
+        case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
+                        | USB_CDC_REQ_SET_CONTROL_LINE_STATE:
+                if (w_index != acm->ctrl_id)
+                        goto invalid;
+
+                value = 0;
+
+                /* FIXME we should not allow data to flow until the
+                 * host sets the RS232_DTR bit; and when it clears
+                 * that bit, we should return to that no-flow state.
+                 */
+                acm->port_handshake_bits = w_value;
+                break;
+
+        default:
+invalid:
+                VDBG(cdev, "invalid control req%02x.%02x v%04x i%04x l%d\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, w_length);
+        }
+
+        /* respond with data transfer or status phase? */
+        if (value >= 0) {
+                DBG(cdev, "acm ttyGS%d req%02x.%02x v%04x i%04x l%d\n",
+                        acm->port_num, ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, w_length);
+                req->zero = 0;
+                req->length = value;
+                value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
+                if (value < 0)
+                        ERROR(cdev, "acm response on ttyGS%d, err %d\n",
+                                        acm->port_num, value);
+        }
+
+        /* device either stalls (value < 0) or reports success */
+        return value;
+}
+
+static int acm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
+{
+        struct f_acm            *acm = func_to_acm(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+
+        /* we know alt == 0, so this is an activation or a reset */
+
+        if (intf == acm->ctrl_id) {
+                /* REVISIT this may need more work when we start to
+                 * send notifications ...
+                 */
+                if (acm->notify->driver_data) {
+                        VDBG(cdev, "reset acm control interface %d\n", intf);
+                        usb_ep_disable(acm->notify);
+                } else {
+                        VDBG(cdev, "init acm ctrl interface %d\n", intf);
+                        acm->notify_desc = ep_choose(cdev->gadget,
+                                        acm->hs.notify,
+                                        acm->fs.notify);
+                }
+                usb_ep_enable(acm->notify, acm->notify_desc);
+                acm->notify->driver_data = acm;
+
+        } else if (intf == acm->data_id) {
+                if (acm->port.in->driver_data) {
+                        DBG(cdev, "reset acm ttyGS%d\n", acm->port_num);
+                        gserial_disconnect(&acm->port);
+                } else {
+                        DBG(cdev, "activate acm ttyGS%d\n", acm->port_num);
+                        acm->port.in_desc = ep_choose(cdev->gadget,
+                                        acm->hs.in, acm->fs.in);
+                        acm->port.out_desc = ep_choose(cdev->gadget,
+                                        acm->hs.out, acm->fs.out);
+                }
+                gserial_connect(&acm->port, acm->port_num);
+
+        } else
+                return -EINVAL;
+
+        return 0;
+}
+
+static void acm_disable(struct usb_function *f)
+{
+        struct f_acm    *acm = func_to_acm(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+
+        DBG(cdev, "acm ttyGS%d deactivated\n", acm->port_num);
+        gserial_disconnect(&acm->port);
+        usb_ep_disable(acm->notify);
+        acm->notify->driver_data = NULL;
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* ACM function driver setup/binding */
+static int __init
+acm_bind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct usb_composite_dev *cdev = c->cdev;
+        struct f_acm            *acm = func_to_acm(f);
+        int                     status;
+        struct usb_ep           *ep;
+
+        /* allocate instance-specific interface IDs, and patch descriptors */
+        status = usb_interface_id(c, f);
+        if (status < 0)
+                goto fail;
+        acm->ctrl_id = status;
+
+        acm_control_interface_desc.bInterfaceNumber = status;
+        acm_union_desc .bMasterInterface0 = status;
+
+        status = usb_interface_id(c, f);
+        if (status < 0)
+                goto fail;
+        acm->data_id = status;
+
+        acm_data_interface_desc.bInterfaceNumber = status;
+        acm_union_desc.bSlaveInterface0 = status;
+        acm_call_mgmt_descriptor.bDataInterface = status;
+
+        status = -ENODEV;
+
+        /* allocate instance-specific endpoints */
+        ep = usb_ep_autoconfig(cdev->gadget, &acm_fs_in_desc);
+        if (!ep)
+                goto fail;
+        acm->port.in = ep;
+        ep->driver_data = cdev; /* claim */
+
+        ep = usb_ep_autoconfig(cdev->gadget, &acm_fs_out_desc);
+        if (!ep)
+                goto fail;
+        acm->port.out = ep;
+        ep->driver_data = cdev; /* claim */
+
+        ep = usb_ep_autoconfig(cdev->gadget, &acm_fs_notify_desc);
+        if (!ep)
+                goto fail;
+        acm->notify = ep;
+        ep->driver_data = cdev; /* claim */
+
+        /* copy descriptors, and track endpoint copies */
+        f->descriptors = usb_copy_descriptors(acm_fs_function);
+
+        acm->fs.in = usb_find_endpoint(acm_fs_function,
+                        f->descriptors, &acm_fs_in_desc);
+        acm->fs.out = usb_find_endpoint(acm_fs_function,
+                        f->descriptors, &acm_fs_out_desc);
+        acm->fs.notify = usb_find_endpoint(acm_fs_function,
+                        f->descriptors, &acm_fs_notify_desc);
+
+        /* support all relevant hardware speeds... we expect that when
+         * hardware is dual speed, all bulk-capable endpoints work at
+         * both speeds
+         */
+        if (gadget_is_dualspeed(c->cdev->gadget)) {
+                acm_hs_in_desc.bEndpointAddress =
+                                acm_fs_in_desc.bEndpointAddress;
+                acm_hs_out_desc.bEndpointAddress =
+                                acm_fs_out_desc.bEndpointAddress;
+                acm_hs_notify_desc.bEndpointAddress =
+                                acm_fs_notify_desc.bEndpointAddress;
+
+                /* copy descriptors, and track endpoint copies */
+                f->hs_descriptors = usb_copy_descriptors(acm_hs_function);
+
+                acm->hs.in = usb_find_endpoint(acm_hs_function,
+                                f->hs_descriptors, &acm_hs_in_desc);
+                acm->hs.out = usb_find_endpoint(acm_hs_function,
+                                f->hs_descriptors, &acm_hs_out_desc);
+                acm->hs.notify = usb_find_endpoint(acm_hs_function,
+                                f->hs_descriptors, &acm_hs_notify_desc);
+        }
+
+        /* FIXME provide a callback for triggering notifications */
+
+        DBG(cdev, "acm ttyGS%d: %s speed IN/%s OUT/%s NOTIFY/%s\n",
+                        acm->port_num,
+                        gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
+                        acm->port.in->name, acm->port.out->name,
+                        acm->notify->name);
+        return 0;
+
+fail:
+        /* we might as well release our claims on endpoints */
+        if (acm->notify)
+                acm->notify->driver_data = NULL;
+        if (acm->port.out)
+                acm->port.out->driver_data = NULL;
+        if (acm->port.in)
+                acm->port.in->driver_data = NULL;
+
+        ERROR(cdev, "%s/%p: can't bind, err %d\n", f->name, f, status);
+
+        return status;
+}
+
+static void
+acm_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+        if (gadget_is_dualspeed(c->cdev->gadget))
+                usb_free_descriptors(f->hs_descriptors);
+        usb_free_descriptors(f->descriptors);
+        kfree(func_to_acm(f));
+}
+
+/* Some controllers can't support CDC ACM ... */
+static inline bool can_support_cdc(struct usb_configuration *c)
+{
+        /* SH3 doesn't support multiple interfaces */
+        if (gadget_is_sh(c->cdev->gadget))
+                return false;
+
+        /* sa1100 doesn't have a third interrupt endpoint */
+        if (gadget_is_sa1100(c->cdev->gadget))
+                return false;
+
+        /* everything else is *probably* fine ... */
+        return true;
+}
+
+/**
+ * acm_bind_config - add a CDC ACM function to a configuration
+ * @c: the configuration to support the CDC ACM instance
+ * @port_num: /dev/ttyGS* port this interface will use
+ * Context: single threaded during gadget setup
+ *
+ * Returns zero on success, else negative errno.
+ *
+ * Caller must have called @gserial_setup() with enough ports to
+ * handle all the ones it binds.  Caller is also responsible
+ * for calling @gserial_cleanup() before module unload.
+ */
+int __init acm_bind_config(struct usb_configuration *c, u8 port_num)
+{
+        struct f_acm    *acm;
+        int             status;
+
+        if (!can_support_cdc(c))
+                return -EINVAL;
+
+        /* REVISIT might want instance-specific strings to help
+         * distinguish instances ...
+         */
+
+        /* maybe allocate device-global string IDs, and patch descriptors */
+        if (acm_string_defs[ACM_CTRL_IDX].id == 0) {
+                status = usb_string_id(c->cdev);
+                if (status < 0)
+                        return status;
+                acm_string_defs[ACM_CTRL_IDX].id = status;
+
+                acm_control_interface_desc.iInterface = status;
+
+                status = usb_string_id(c->cdev);
+                if (status < 0)
+                        return status;
+                acm_string_defs[ACM_DATA_IDX].id = status;
+
+                acm_data_interface_desc.iInterface = status;
+        }
+
+        /* allocate and initialize one new instance */
+        acm = kzalloc(sizeof *acm, GFP_KERNEL);
+        if (!acm)
+                return -ENOMEM;
+
+        acm->port_num = port_num;
+
+        acm->port.func.name = "acm";
+        acm->port.func.strings = acm_strings;
+        /* descriptors are per-instance copies */
+        acm->port.func.bind = acm_bind;
+        acm->port.func.unbind = acm_unbind;
+        acm->port.func.set_alt = acm_set_alt;
+        acm->port.func.setup = acm_setup;
+        acm->port.func.disable = acm_disable;
+
+        status = usb_add_function(c, &acm->port.func);
+        if (status)
+                kfree(acm);
+        return status;
+}
diff --git a/drivers/usb/gadget/f_ecm.c b/drivers/usb/gadget/f_ecm.c
new file mode 100644
index 000000000000..0822e9d7693a
--- /dev/null
+++ b/drivers/usb/gadget/f_ecm.c
@@ -0,0 +1,833 @@
+/*
+ * f_ecm.c -- USB CDC Ethernet (ECM) link function driver
+ *
+ * Copyright (C) 2003-2005,2008 David Brownell
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+/* #define VERBOSE_DEBUG */
+
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/etherdevice.h>
+
+#include "u_ether.h"
+
+
+/*
+ * This function is a "CDC Ethernet Networking Control Model" (CDC ECM)
+ * Ethernet link.  The data transfer model is simple (packets sent and
+ * received over bulk endpoints using normal short packet termination),
+ * and the control model exposes various data and optional notifications.
+ *
+ * ECM is well standardized and (except for Microsoft) supported by most
+ * operating systems with USB host support.  It's the preferred interop
+ * solution for Ethernet over USB, at least for firmware based solutions.
+ * (Hardware solutions tend to be more minimalist.)  A newer and simpler
+ * "Ethernet Emulation Model" (CDC EEM) hasn't yet caught on.
+ *
+ * Note that ECM requires the use of "alternate settings" for its data
+ * interface.  This means that the set_alt() method has real work to do,
+ * and also means that a get_alt() method is required.
+ */
+
+struct ecm_ep_descs {
+        struct usb_endpoint_descriptor  *in;
+        struct usb_endpoint_descriptor  *out;
+        struct usb_endpoint_descriptor  *notify;
+};
+
+enum ecm_notify_state {
+        ECM_NOTIFY_NONE,                /* don't notify */
+        ECM_NOTIFY_CONNECT,             /* issue CONNECT next */
+        ECM_NOTIFY_SPEED,               /* issue SPEED_CHANGE next */
+};
+
+struct f_ecm {
+        struct gether                   port;
+        u8                              ctrl_id, data_id;
+
+        char                            ethaddr[14];
+
+        struct usb_descriptor_header    **fs_function;
+        struct ecm_ep_descs             fs;
+        struct usb_descriptor_header    **hs_function;
+        struct ecm_ep_descs             hs;
+
+        struct usb_ep                   *notify;
+        struct usb_endpoint_descriptor  *notify_desc;
+        struct usb_request              *notify_req;
+        u8                              notify_state;
+        bool                            is_open;
+
+        /* FIXME is_open needs some irq-ish locking
+         * ... possibly the same as port.ioport
+         */
+};
+
+static inline struct f_ecm *func_to_ecm(struct usb_function *f)
+{
+        return container_of(f, struct f_ecm, port.func);
+}
+
+/* peak (theoretical) bulk transfer rate in bits-per-second */
+static inline unsigned bitrate(struct usb_gadget *g)
+{
+        if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
+                return 13 * 512 * 8 * 1000 * 8;
+        else
+                return 19 *  64 * 1 * 1000 * 8;
+}
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * Include the status endpoint if we can, even though it's optional.
+ *
+ * Use wMaxPacketSize big enough to fit CDC_NOTIFY_SPEED_CHANGE in one
+ * packet, to simplify cancellation; and a big transfer interval, to
+ * waste less bandwidth.
+ *
+ * Some drivers (like Linux 2.4 cdc-ether!) "need" it to exist even
+ * if they ignore the connect/disconnect notifications that real aether
+ * can provide.  More advanced cdc configurations might want to support
+ * encapsulated commands (vendor-specific, using control-OUT).
+ */
+
+#define LOG2_STATUS_INTERVAL_MSEC       5       /* 1 << 5 == 32 msec */
+#define STATUS_BYTECOUNT                16      /* 8 byte header + data */
+
+
+/* interface descriptor: */
+
+static struct usb_interface_descriptor ecm_control_intf __initdata = {
+        .bLength =              sizeof ecm_control_intf,
+        .bDescriptorType =      USB_DT_INTERFACE,
+
+        /* .bInterfaceNumber = DYNAMIC */
+        /* status endpoint is optional; this could be patched later */
+        .bNumEndpoints =        1,
+        .bInterfaceClass =      USB_CLASS_COMM,
+        .bInterfaceSubClass =   USB_CDC_SUBCLASS_ETHERNET,
+        .bInterfaceProtocol =   USB_CDC_PROTO_NONE,
+        /* .iInterface = DYNAMIC */
+};
+
+static struct usb_cdc_header_desc header_desc __initdata = {
+        .bLength =              sizeof header_desc,
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubType =   USB_CDC_HEADER_TYPE,
+
+        .bcdCDC =               __constant_cpu_to_le16(0x0110),
+};
+
+static struct usb_cdc_union_desc ecm_union_desc __initdata = {
+        .bLength =              sizeof(ecm_union_desc),
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubType =   USB_CDC_UNION_TYPE,
+        /* .bMasterInterface0 = DYNAMIC */
+        /* .bSlaveInterface0 =  DYNAMIC */
+};
+
+static struct usb_cdc_ether_desc ether_desc __initdata = {
+        .bLength =              sizeof ether_desc,
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubType =   USB_CDC_ETHERNET_TYPE,
+
+        /* this descriptor actually adds value, surprise! */
+        /* .iMACAddress = DYNAMIC */
+        .bmEthernetStatistics = __constant_cpu_to_le32(0), /* no statistics */
+        .wMaxSegmentSize =      __constant_cpu_to_le16(ETH_FRAME_LEN),
+        .wNumberMCFilters =     __constant_cpu_to_le16(0),
+        .bNumberPowerFilters =  0,
+};
+
+/* the default data interface has no endpoints ... */
+
+static struct usb_interface_descriptor ecm_data_nop_intf __initdata = {
+        .bLength =              sizeof ecm_data_nop_intf,
+        .bDescriptorType =      USB_DT_INTERFACE,
+
+        .bInterfaceNumber =     1,
+        .bAlternateSetting =    0,
+        .bNumEndpoints =        0,
+        .bInterfaceClass =      USB_CLASS_CDC_DATA,
+        .bInterfaceSubClass =   0,
+        .bInterfaceProtocol =   0,
+        /* .iInterface = DYNAMIC */
+};
+
+/* ... but the "real" data interface has two bulk endpoints */
+
+static struct usb_interface_descriptor ecm_data_intf __initdata = {
+        .bLength =              sizeof ecm_data_intf,
+        .bDescriptorType =      USB_DT_INTERFACE,
+
+        .bInterfaceNumber =     1,
+        .bAlternateSetting =    1,
+        .bNumEndpoints =        2,
+        .bInterfaceClass =      USB_CLASS_CDC_DATA,
+        .bInterfaceSubClass =   0,
+        .bInterfaceProtocol =   0,
+        /* .iInterface = DYNAMIC */
+};
+
+/* full speed support: */
+
+static struct usb_endpoint_descriptor fs_notify_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_INT,
+        .wMaxPacketSize =       __constant_cpu_to_le16(STATUS_BYTECOUNT),
+        .bInterval =            1 << LOG2_STATUS_INTERVAL_MSEC,
+};
+
+static struct usb_endpoint_descriptor fs_in_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_endpoint_descriptor fs_out_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_OUT,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_descriptor_header *eth_fs_function[] __initdata = {
+        /* CDC ECM control descriptors */
+        (struct usb_descriptor_header *) &ecm_control_intf,
+        (struct usb_descriptor_header *) &header_desc,
+        (struct usb_descriptor_header *) &ecm_union_desc,
+        (struct usb_descriptor_header *) &ether_desc,
+        /* NOTE: status endpoint might need to be removed */
+        (struct usb_descriptor_header *) &fs_notify_desc,
+        /* data interface, altsettings 0 and 1 */
+        (struct usb_descriptor_header *) &ecm_data_nop_intf,
+        (struct usb_descriptor_header *) &ecm_data_intf,
+        (struct usb_descriptor_header *) &fs_in_desc,
+        (struct usb_descriptor_header *) &fs_out_desc,
+        NULL,
+};
+
+/* high speed support: */
+
+static struct usb_endpoint_descriptor hs_notify_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_INT,
+        .wMaxPacketSize =       __constant_cpu_to_le16(STATUS_BYTECOUNT),
+        .bInterval =            LOG2_STATUS_INTERVAL_MSEC + 4,
+};
+static struct usb_endpoint_descriptor hs_in_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize =       __constant_cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor hs_out_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_OUT,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize =       __constant_cpu_to_le16(512),
+};
+
+static struct usb_descriptor_header *eth_hs_function[] __initdata = {
+        /* CDC ECM control descriptors */
+        (struct usb_descriptor_header *) &ecm_control_intf,
+        (struct usb_descriptor_header *) &header_desc,
+        (struct usb_descriptor_header *) &ecm_union_desc,
+        (struct usb_descriptor_header *) &ether_desc,
+        /* NOTE: status endpoint might need to be removed */
+        (struct usb_descriptor_header *) &hs_notify_desc,
+        /* data interface, altsettings 0 and 1 */
+        (struct usb_descriptor_header *) &ecm_data_nop_intf,
+        (struct usb_descriptor_header *) &ecm_data_intf,
+        (struct usb_descriptor_header *) &hs_in_desc,
+        (struct usb_descriptor_header *) &hs_out_desc,
+        NULL,
+};
+
+/* string descriptors: */
+
+static struct usb_string ecm_string_defs[] = {
+        [0].s = "CDC Ethernet Control Model (ECM)",
+        [1].s = NULL /* DYNAMIC */,
+        [2].s = "CDC Ethernet Data",
+        {  } /* end of list */
+};
+
+static struct usb_gadget_strings ecm_string_table = {
+        .language =             0x0409, /* en-us */
+        .strings =              ecm_string_defs,
+};
+
+static struct usb_gadget_strings *ecm_strings[] = {
+        &ecm_string_table,
+        NULL,
+};
+
+/*-------------------------------------------------------------------------*/
+
+static void ecm_do_notify(struct f_ecm *ecm)
+{
+        struct usb_request              *req = ecm->notify_req;
+        struct usb_cdc_notification     *event;
+        struct usb_composite_dev        *cdev = ecm->port.func.config->cdev;
+        __le32                          *data;
+        int                             status;
+
+        /* notification already in flight? */
+        if (!req)
+                return;
+
+        event = req->buf;
+        switch (ecm->notify_state) {
+        case ECM_NOTIFY_NONE:
+                return;
+
+        case ECM_NOTIFY_CONNECT:
+                event->bNotificationType = USB_CDC_NOTIFY_NETWORK_CONNECTION;
+                if (ecm->is_open)
+                        event->wValue = cpu_to_le16(1);
+                else
+                        event->wValue = cpu_to_le16(0);
+                event->wLength = 0;
+                req->length = sizeof *event;
+
+                DBG(cdev, "notify connect %s\n",
+                                ecm->is_open ? "true" : "false");
+                ecm->notify_state = ECM_NOTIFY_SPEED;
+                break;
+
+        case ECM_NOTIFY_SPEED:
+                event->bNotificationType = USB_CDC_NOTIFY_SPEED_CHANGE;
+                event->wValue = cpu_to_le16(0);
+                event->wLength = cpu_to_le16(8);
+                req->length = STATUS_BYTECOUNT;
+
+                /* SPEED_CHANGE data is up/down speeds in bits/sec */
+                data = req->buf + sizeof *event;
+                data[0] = cpu_to_le32(bitrate(cdev->gadget));
+                data[1] = data[0];
+
+                DBG(cdev, "notify speed %d\n", bitrate(cdev->gadget));
+                ecm->notify_state = ECM_NOTIFY_NONE;
+                break;
+        }
+        event->bmRequestType = 0xA1;
+        event->wIndex = cpu_to_le16(ecm->ctrl_id);
+
+        ecm->notify_req = NULL;
+        status = usb_ep_queue(ecm->notify, req, GFP_ATOMIC);
+        if (status < 0) {
+                ecm->notify_req = req;
+                DBG(cdev, "notify --> %d\n", status);
+        }
+}
+
+static void ecm_notify(struct f_ecm *ecm)
+{
+        /* NOTE on most versions of Linux, host side cdc-ethernet
+         * won't listen for notifications until its netdevice opens.
+         * The first notification then sits in the FIFO for a long
+         * time, and the second one is queued.
+         */
+        ecm->notify_state = ECM_NOTIFY_CONNECT;
+        ecm_do_notify(ecm);
+}
+
+static void ecm_notify_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct f_ecm                    *ecm = req->context;
+        struct usb_composite_dev        *cdev = ecm->port.func.config->cdev;
+        struct usb_cdc_notification     *event = req->buf;
+
+        switch (req->status) {
+        case 0:
+                /* no fault */
+                break;
+        case -ECONNRESET:
+        case -ESHUTDOWN:
+                ecm->notify_state = ECM_NOTIFY_NONE;
+                break;
+        default:
+                DBG(cdev, "event %02x --> %d\n",
+                        event->bNotificationType, req->status);
+                break;
+        }
+        ecm->notify_req = req;
+        ecm_do_notify(ecm);
+}
+
+static int ecm_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
+{
+        struct f_ecm            *ecm = func_to_ecm(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+        struct usb_request      *req = cdev->req;
+        int                     value = -EOPNOTSUPP;
+        u16                     w_index = le16_to_cpu(ctrl->wIndex);
+        u16                     w_value = le16_to_cpu(ctrl->wValue);
+        u16                     w_length = le16_to_cpu(ctrl->wLength);
+
+        /* composite driver infrastructure handles everything except
+         * CDC class messages; interface activation uses set_alt().
+         */
+        switch ((ctrl->bRequestType << 8) | ctrl->bRequest) {
+        case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
+                        | USB_CDC_SET_ETHERNET_PACKET_FILTER:
+                /* see 6.2.30: no data, wIndex = interface,
+                 * wValue = packet filter bitmap
+                 */
+                if (w_length != 0 || w_index != ecm->ctrl_id)
+                        goto invalid;
+                DBG(cdev, "packet filter %02x\n", w_value);
+                /* REVISIT locking of cdc_filter.  This assumes the UDC
+                 * driver won't have a concurrent packet TX irq running on
+                 * another CPU; or that if it does, this write is atomic...
+                 */
+                ecm->port.cdc_filter = w_value;
+                value = 0;
+                break;
+
+        /* and optionally:
+         * case USB_CDC_SEND_ENCAPSULATED_COMMAND:
+         * case USB_CDC_GET_ENCAPSULATED_RESPONSE:
+         * case USB_CDC_SET_ETHERNET_MULTICAST_FILTERS:
+         * case USB_CDC_SET_ETHERNET_PM_PATTERN_FILTER:
+         * case USB_CDC_GET_ETHERNET_PM_PATTERN_FILTER:
+         * case USB_CDC_GET_ETHERNET_STATISTIC:
+         */
+
+        default:
+invalid:
+                DBG(cdev, "invalid control req%02x.%02x v%04x i%04x l%d\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, w_length);
+        }
+
+        /* respond with data transfer or status phase? */
+        if (value >= 0) {
+                DBG(cdev, "ecm req%02x.%02x v%04x i%04x l%d\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, w_length);
+                req->zero = 0;
+                req->length = value;
+                value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
+                if (value < 0)
+                        ERROR(cdev, "ecm req %02x.%02x response err %d\n",
+                                        ctrl->bRequestType, ctrl->bRequest,
+                                        value);
+        }
+
+        /* device either stalls (value < 0) or reports success */
+        return value;
+}
+
+
+static int ecm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
+{
+        struct f_ecm            *ecm = func_to_ecm(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+
+        /* Control interface has only altsetting 0 */
+        if (intf == ecm->ctrl_id) {
+                if (alt != 0)
+                        goto fail;
+
+                if (ecm->notify->driver_data) {
+                        VDBG(cdev, "reset ecm control %d\n", intf);
+                        usb_ep_disable(ecm->notify);
+                } else {
+                        VDBG(cdev, "init ecm ctrl %d\n", intf);
+                        ecm->notify_desc = ep_choose(cdev->gadget,
+                                        ecm->hs.notify,
+                                        ecm->fs.notify);
+                }
+                usb_ep_enable(ecm->notify, ecm->notify_desc);
+                ecm->notify->driver_data = ecm;
+
+        /* Data interface has two altsettings, 0 and 1 */
+        } else if (intf == ecm->data_id) {
+                if (alt > 1)
+                        goto fail;
+
+                if (ecm->port.in_ep->driver_data) {
+                        DBG(cdev, "reset ecm\n");
+                        gether_disconnect(&ecm->port);
+                }
+
+                if (!ecm->port.in) {
+                        DBG(cdev, "init ecm\n");
+                        ecm->port.in = ep_choose(cdev->gadget,
+                                        ecm->hs.in, ecm->fs.in);
+                        ecm->port.out = ep_choose(cdev->gadget,
+                                        ecm->hs.out, ecm->fs.out);
+                }
+
+                /* CDC Ethernet only sends data in non-default altsettings.
+                 * Changing altsettings resets filters, statistics, etc.
+                 */
+                if (alt == 1) {
+                        struct net_device       *net;
+
+                        /* Enable zlps by default for ECM conformance;
+                         * override for musb_hdrc (avoids txdma ovhead)
+                         * and sa1100 (can't).
+                         */
+                        ecm->port.is_zlp_ok = !(
+                                   gadget_is_sa1100(cdev->gadget)
+                                || gadget_is_musbhdrc(cdev->gadget)
+                                );
+                        ecm->port.cdc_filter = DEFAULT_FILTER;
+                        DBG(cdev, "activate ecm\n");
+                        net = gether_connect(&ecm->port);
+                        if (IS_ERR(net))
+                                return PTR_ERR(net);
+                }
+
+                /* NOTE this can be a minor disagreement with the ECM spec,
+                 * which says speed notifications will "always" follow
+                 * connection notifications.  But we allow one connect to
+                 * follow another (if the first is in flight), and instead
+                 * just guarantee that a speed notification is always sent.
+                 */
+                ecm_notify(ecm);
+        } else
+                goto fail;
+
+        return 0;
+fail:
+        return -EINVAL;
+}
+
+/* Because the data interface supports multiple altsettings,
+ * this ECM function *MUST* implement a get_alt() method.
+ */
+static int ecm_get_alt(struct usb_function *f, unsigned intf)
+{
+        struct f_ecm            *ecm = func_to_ecm(f);
+
+        if (intf == ecm->ctrl_id)
+                return 0;
+        return ecm->port.in_ep->driver_data ? 1 : 0;
+}
+
+static void ecm_disable(struct usb_function *f)
+{
+        struct f_ecm            *ecm = func_to_ecm(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+
+        DBG(cdev, "ecm deactivated\n");
+
+        if (ecm->port.in_ep->driver_data)
+                gether_disconnect(&ecm->port);
+
+        if (ecm->notify->driver_data) {
+                usb_ep_disable(ecm->notify);
+                ecm->notify->driver_data = NULL;
+                ecm->notify_desc = NULL;
+        }
+}
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * Callbacks let us notify the host about connect/disconnect when the
+ * net device is opened or closed.
+ *
+ * For testing, note that link states on this side include both opened
+ * and closed variants of:
+ *
+ *   - disconnected/unconfigured
+ *   - configured but inactive (data alt 0)
+ *   - configured and active (data alt 1)
+ *
+ * Each needs to be tested with unplug, rmmod, SET_CONFIGURATION, and
+ * SET_INTERFACE (altsetting).  Remember also that "configured" doesn't
+ * imply the host is actually polling the notification endpoint, and
+ * likewise that "active" doesn't imply it's actually using the data
+ * endpoints for traffic.
+ */
+
+static void ecm_open(struct gether *geth)
+{
+        struct f_ecm            *ecm = func_to_ecm(&geth->func);
+
+        DBG(ecm->port.func.config->cdev, "%s\n", __func__);
+
+        ecm->is_open = true;
+        ecm_notify(ecm);
+}
+
+static void ecm_close(struct gether *geth)
+{
+        struct f_ecm            *ecm = func_to_ecm(&geth->func);
+
+        DBG(ecm->port.func.config->cdev, "%s\n", __func__);
+
+        ecm->is_open = false;
+        ecm_notify(ecm);
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* ethernet function driver setup/binding */
+
+static int __init
+ecm_bind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct usb_composite_dev *cdev = c->cdev;
+        struct f_ecm            *ecm = func_to_ecm(f);
+        int                     status;
+        struct usb_ep           *ep;
+
+        /* allocate instance-specific interface IDs */
+        status = usb_interface_id(c, f);
+        if (status < 0)
+                goto fail;
+        ecm->ctrl_id = status;
+
+        ecm_control_intf.bInterfaceNumber = status;
+        ecm_union_desc.bMasterInterface0 = status;
+
+        status = usb_interface_id(c, f);
+        if (status < 0)
+                goto fail;
+        ecm->data_id = status;
+
+        ecm_data_nop_intf.bInterfaceNumber = status;
+        ecm_data_intf.bInterfaceNumber = status;
+        ecm_union_desc.bSlaveInterface0 = status;
+
+        status = -ENODEV;
+
+        /* allocate instance-specific endpoints */
+        ep = usb_ep_autoconfig(cdev->gadget, &fs_in_desc);
+        if (!ep)
+                goto fail;
+        ecm->port.in_ep = ep;
+        ep->driver_data = cdev; /* claim */
+
+        ep = usb_ep_autoconfig(cdev->gadget, &fs_out_desc);
+        if (!ep)
+                goto fail;
+        ecm->port.out_ep = ep;
+        ep->driver_data = cdev; /* claim */
+
+        /* NOTE:  a status/notification endpoint is *OPTIONAL* but we
+         * don't treat it that way.  It's simpler, and some newer CDC
+         * profiles (wireless handsets) no longer treat it as optional.
+         */
+        ep = usb_ep_autoconfig(cdev->gadget, &fs_notify_desc);
+        if (!ep)
+                goto fail;
+        ecm->notify = ep;
+        ep->driver_data = cdev; /* claim */
+
+        status = -ENOMEM;
+
+        /* allocate notification request and buffer */
+        ecm->notify_req = usb_ep_alloc_request(ep, GFP_KERNEL);
+        if (!ecm->notify_req)
+                goto fail;
+        ecm->notify_req->buf = kmalloc(STATUS_BYTECOUNT, GFP_KERNEL);
+        if (!ecm->notify_req->buf)
+                goto fail;
+        ecm->notify_req->context = ecm;
+        ecm->notify_req->complete = ecm_notify_complete;
+
+        /* copy descriptors, and track endpoint copies */
+        f->descriptors = usb_copy_descriptors(eth_fs_function);
+        if (!f->descriptors)
+                goto fail;
+
+        ecm->fs.in = usb_find_endpoint(eth_fs_function,
+                        f->descriptors, &fs_in_desc);
+        ecm->fs.out = usb_find_endpoint(eth_fs_function,
+                        f->descriptors, &fs_out_desc);
+        ecm->fs.notify = usb_find_endpoint(eth_fs_function,
+                        f->descriptors, &fs_notify_desc);
+
+        /* support all relevant hardware speeds... we expect that when
+         * hardware is dual speed, all bulk-capable endpoints work at
+         * both speeds
+         */
+        if (gadget_is_dualspeed(c->cdev->gadget)) {
+                hs_in_desc.bEndpointAddress =
+                                fs_in_desc.bEndpointAddress;
+                hs_out_desc.bEndpointAddress =
+                                fs_out_desc.bEndpointAddress;
+                hs_notify_desc.bEndpointAddress =
+                                fs_notify_desc.bEndpointAddress;
+
+                /* copy descriptors, and track endpoint copies */
+                f->hs_descriptors = usb_copy_descriptors(eth_hs_function);
+                if (!f->hs_descriptors)
+                        goto fail;
+
+                ecm->hs.in = usb_find_endpoint(eth_hs_function,
+                                f->hs_descriptors, &hs_in_desc);
+                ecm->hs.out = usb_find_endpoint(eth_hs_function,
+                                f->hs_descriptors, &hs_out_desc);
+                ecm->hs.notify = usb_find_endpoint(eth_hs_function,
+                                f->hs_descriptors, &hs_notify_desc);
+        }
+
+        /* NOTE:  all that is done without knowing or caring about
+         * the network link ... which is unavailable to this code
+         * until we're activated via set_alt().
+         */
+
+        ecm->port.open = ecm_open;
+        ecm->port.close = ecm_close;
+
+        DBG(cdev, "CDC Ethernet: %s speed IN/%s OUT/%s NOTIFY/%s\n",
+                        gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
+                        ecm->port.in_ep->name, ecm->port.out_ep->name,
+                        ecm->notify->name);
+        return 0;
+
+fail:
+        if (f->descriptors)
+                usb_free_descriptors(f->descriptors);
+
+        if (ecm->notify_req) {
+                kfree(ecm->notify_req->buf);
+                usb_ep_free_request(ecm->notify, ecm->notify_req);
+        }
+
+        /* we might as well release our claims on endpoints */
+        if (ecm->notify)
+                ecm->notify->driver_data = NULL;
+        if (ecm->port.out)
+                ecm->port.out_ep->driver_data = NULL;
+        if (ecm->port.in)
+                ecm->port.in_ep->driver_data = NULL;
+
+        ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
+
+        return status;
+}
+
+static void
+ecm_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct f_ecm            *ecm = func_to_ecm(f);
+
+        DBG(c->cdev, "ecm unbind\n");
+
+        if (gadget_is_dualspeed(c->cdev->gadget))
+                usb_free_descriptors(f->hs_descriptors);
+        usb_free_descriptors(f->descriptors);
+
+        kfree(ecm->notify_req->buf);
+        usb_ep_free_request(ecm->notify, ecm->notify_req);
+
+        ecm_string_defs[1].s = NULL;
+        kfree(ecm);
+}
+
+/**
+ * ecm_bind_config - add CDC Ethernet network link to a configuration
+ * @c: the configuration to support the network link
+ * @ethaddr: a buffer in which the ethernet address of the host side
+ *      side of the link was recorded
+ * Context: single threaded during gadget setup
+ *
+ * Returns zero on success, else negative errno.
+ *
+ * Caller must have called @gether_setup().  Caller is also responsible
+ * for calling @gether_cleanup() before module unload.
+ */
+int __init ecm_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN])
+{
+        struct f_ecm    *ecm;
+        int             status;
+
+        if (!can_support_ecm(c->cdev->gadget) || !ethaddr)
+                return -EINVAL;
+
+        /* maybe allocate device-global string IDs */
+        if (ecm_string_defs[0].id == 0) {
+
+                /* control interface label */
+                status = usb_string_id(c->cdev);
+                if (status < 0)
+                        return status;
+                ecm_string_defs[0].id = status;
+                ecm_control_intf.iInterface = status;
+
+                /* data interface label */
+                status = usb_string_id(c->cdev);
+                if (status < 0)
+                        return status;
+                ecm_string_defs[2].id = status;
+                ecm_data_intf.iInterface = status;
+
+                /* MAC address */
+                status = usb_string_id(c->cdev);
+                if (status < 0)
+                        return status;
+                ecm_string_defs[1].id = status;
+                ether_desc.iMACAddress = status;
+        }
+
+        /* allocate and initialize one new instance */
+        ecm = kzalloc(sizeof *ecm, GFP_KERNEL);
+        if (!ecm)
+                return -ENOMEM;
+
+        /* export host's Ethernet address in CDC format */
+        snprintf(ecm->ethaddr, sizeof ecm->ethaddr,
+                "%02X%02X%02X%02X%02X%02X",
+                ethaddr[0], ethaddr[1], ethaddr[2],
+                ethaddr[3], ethaddr[4], ethaddr[5]);
+        ecm_string_defs[1].s = ecm->ethaddr;
+
+        ecm->port.cdc_filter = DEFAULT_FILTER;
+
+        ecm->port.func.name = "cdc_ethernet";
+        ecm->port.func.strings = ecm_strings;
+        /* descriptors are per-instance copies */
+        ecm->port.func.bind = ecm_bind;
+        ecm->port.func.unbind = ecm_unbind;
+        ecm->port.func.set_alt = ecm_set_alt;
+        ecm->port.func.get_alt = ecm_get_alt;
+        ecm->port.func.setup = ecm_setup;
+        ecm->port.func.disable = ecm_disable;
+
+        status = usb_add_function(c, &ecm->port.func);
+        if (status) {
+                ecm_string_defs[1].s = NULL;
+                kfree(ecm);
+        }
+        return status;
+}
diff --git a/drivers/usb/gadget/f_loopback.c b/drivers/usb/gadget/f_loopback.c
new file mode 100644
index 000000000000..eda4cde72c82
--- /dev/null
+++ b/drivers/usb/gadget/f_loopback.c
@@ -0,0 +1,381 @@
+/*
+ * f_loopback.c - USB peripheral loopback configuration driver
+ *
+ * Copyright (C) 2003-2008 David Brownell
+ * Copyright (C) 2008 by Nokia Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+/* #define VERBOSE_DEBUG */
+
+#include <linux/kernel.h>
+#include <linux/utsname.h>
+#include <linux/device.h>
+
+#include "g_zero.h"
+#include "gadget_chips.h"
+
+
+/*
+ * LOOPBACK FUNCTION ... a testing vehicle for USB peripherals,
+ *
+ * This takes messages of various sizes written OUT to a device, and loops
+ * them back so they can be read IN from it.  It has been used by certain
+ * test applications.  It supports limited testing of data queueing logic.
+ *
+ *
+ * This is currently packaged as a configuration driver, which can't be
+ * combined with other functions to make composite devices.  However, it
+ * can be combined with other independent configurations.
+ */
+struct f_loopback {
+        struct usb_function     function;
+
+        struct usb_ep           *in_ep;
+        struct usb_ep           *out_ep;
+};
+
+static inline struct f_loopback *func_to_loop(struct usb_function *f)
+{
+        return container_of(f, struct f_loopback, function);
+}
+
+static unsigned qlen = 32;
+module_param(qlen, uint, 0);
+MODULE_PARM_DESC(qlenn, "depth of loopback queue");
+
+/*-------------------------------------------------------------------------*/
+
+static struct usb_interface_descriptor loopback_intf = {
+        .bLength =              sizeof loopback_intf,
+        .bDescriptorType =      USB_DT_INTERFACE,
+
+        .bNumEndpoints =        2,
+        .bInterfaceClass =      USB_CLASS_VENDOR_SPEC,
+        /* .iInterface = DYNAMIC */
+};
+
+/* full speed support: */
+
+static struct usb_endpoint_descriptor fs_source_desc = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_endpoint_descriptor fs_sink_desc = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_OUT,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_descriptor_header *fs_loopback_descs[] = {
+        (struct usb_descriptor_header *) &loopback_intf,
+        (struct usb_descriptor_header *) &fs_sink_desc,
+        (struct usb_descriptor_header *) &fs_source_desc,
+        NULL,
+};
+
+/* high speed support: */
+
+static struct usb_endpoint_descriptor hs_source_desc = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize =       __constant_cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor hs_sink_desc = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize =       __constant_cpu_to_le16(512),
+};
+
+static struct usb_descriptor_header *hs_loopback_descs[] = {
+        (struct usb_descriptor_header *) &loopback_intf,
+        (struct usb_descriptor_header *) &hs_source_desc,
+        (struct usb_descriptor_header *) &hs_sink_desc,
+        NULL,
+};
+
+/* function-specific strings: */
+
+static struct usb_string strings_loopback[] = {
+        [0].s = "loop input to output",
+        {  }                    /* end of list */
+};
+
+static struct usb_gadget_strings stringtab_loop = {
+        .language       = 0x0409,       /* en-us */
+        .strings        = strings_loopback,
+};
+
+static struct usb_gadget_strings *loopback_strings[] = {
+        &stringtab_loop,
+        NULL,
+};
+
+/*-------------------------------------------------------------------------*/
+
+static int __init
+loopback_bind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct usb_composite_dev *cdev = c->cdev;
+        struct f_loopback       *loop = func_to_loop(f);
+        int                     id;
+
+        /* allocate interface ID(s) */
+        id = usb_interface_id(c, f);
+        if (id < 0)
+                return id;
+        loopback_intf.bInterfaceNumber = id;
+
+        /* allocate endpoints */
+
+        loop->in_ep = usb_ep_autoconfig(cdev->gadget, &fs_source_desc);
+        if (!loop->in_ep) {
+autoconf_fail:
+                ERROR(cdev, "%s: can't autoconfigure on %s\n",
+                        f->name, cdev->gadget->name);
+                return -ENODEV;
+        }
+        loop->in_ep->driver_data = cdev;        /* claim */
+
+        loop->out_ep = usb_ep_autoconfig(cdev->gadget, &fs_sink_desc);
+        if (!loop->out_ep)
+                goto autoconf_fail;
+        loop->out_ep->driver_data = cdev;       /* claim */
+
+        /* support high speed hardware */
+        if (gadget_is_dualspeed(c->cdev->gadget)) {
+                hs_source_desc.bEndpointAddress =
+                                fs_source_desc.bEndpointAddress;
+                hs_sink_desc.bEndpointAddress =
+                                fs_sink_desc.bEndpointAddress;
+                f->hs_descriptors = hs_loopback_descs;
+        }
+
+        DBG(cdev, "%s speed %s: IN/%s, OUT/%s\n",
+                        gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
+                        f->name, loop->in_ep->name, loop->out_ep->name);
+        return 0;
+}
+
+static void
+loopback_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+        kfree(func_to_loop(f));
+}
+
+static void loopback_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct f_loopback       *loop = ep->driver_data;
+        struct usb_composite_dev *cdev = loop->function.config->cdev;
+        int                     status = req->status;
+
+        switch (status) {
+
+        case 0:                         /* normal completion? */
+                if (ep == loop->out_ep) {
+                        /* loop this OUT packet back IN to the host */
+                        req->zero = (req->actual < req->length);
+                        req->length = req->actual;
+                        status = usb_ep_queue(loop->in_ep, req, GFP_ATOMIC);
+                        if (status == 0)
+                                return;
+
+                        /* "should never get here" */
+                        ERROR(cdev, "can't loop %s to %s: %d\n",
+                                ep->name, loop->in_ep->name,
+                                status);
+                }
+
+                /* queue the buffer for some later OUT packet */
+                req->length = buflen;
+                status = usb_ep_queue(loop->out_ep, req, GFP_ATOMIC);
+                if (status == 0)
+                        return;
+
+                /* "should never get here" */
+                /* FALLTHROUGH */
+
+        default:
+                ERROR(cdev, "%s loop complete --> %d, %d/%d\n", ep->name,
+                                status, req->actual, req->length);
+                /* FALLTHROUGH */
+
+        /* NOTE:  since this driver doesn't maintain an explicit record
+         * of requests it submitted (just maintains qlen count), we
+         * rely on the hardware driver to clean up on disconnect or
+         * endpoint disable.
+         */
+        case -ECONNABORTED:             /* hardware forced ep reset */
+        case -ECONNRESET:               /* request dequeued */
+        case -ESHUTDOWN:                /* disconnect from host */
+                free_ep_req(ep, req);
+                return;
+        }
+}
+
+static void disable_loopback(struct f_loopback *loop)
+{
+        struct usb_composite_dev        *cdev;
+
+        cdev = loop->function.config->cdev;
+        disable_endpoints(cdev, loop->in_ep, loop->out_ep);
+        VDBG(cdev, "%s disabled\n", loop->function.name);
+}
+
+static int
+enable_loopback(struct usb_composite_dev *cdev, struct f_loopback *loop)
+{
+        int                                     result = 0;
+        const struct usb_endpoint_descriptor    *src, *sink;
+        struct usb_ep                           *ep;
+        struct usb_request                      *req;
+        unsigned                                i;
+
+        src = ep_choose(cdev->gadget, &hs_source_desc, &fs_source_desc);
+        sink = ep_choose(cdev->gadget, &hs_sink_desc, &fs_sink_desc);
+
+        /* one endpoint writes data back IN to the host */
+        ep = loop->in_ep;
+        result = usb_ep_enable(ep, src);
+        if (result < 0)
+                return result;
+        ep->driver_data = loop;
+
+        /* one endpoint just reads OUT packets */
+        ep = loop->out_ep;
+        result = usb_ep_enable(ep, sink);
+        if (result < 0) {
+fail0:
+                ep = loop->in_ep;
+                usb_ep_disable(ep);
+                ep->driver_data = NULL;
+                return result;
+        }
+        ep->driver_data = loop;
+
+        /* allocate a bunch of read buffers and queue them all at once.
+         * we buffer at most 'qlen' transfers; fewer if any need more
+         * than 'buflen' bytes each.
+         */
+        for (i = 0; i < qlen && result == 0; i++) {
+                req = alloc_ep_req(ep);
+                if (req) {
+                        req->complete = loopback_complete;
+                        result = usb_ep_queue(ep, req, GFP_ATOMIC);
+                        if (result)
+                                ERROR(cdev, "%s queue req --> %d\n",
+                                                ep->name, result);
+                } else {
+                        usb_ep_disable(ep);
+                        ep->driver_data = NULL;
+                        result = -ENOMEM;
+                        goto fail0;
+                }
+        }
+
+        DBG(cdev, "%s enabled\n", loop->function.name);
+        return result;
+}
+
+static int loopback_set_alt(struct usb_function *f,
+                unsigned intf, unsigned alt)
+{
+        struct f_loopback       *loop = func_to_loop(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+
+        /* we know alt is zero */
+        if (loop->in_ep->driver_data)
+                disable_loopback(loop);
+        return enable_loopback(cdev, loop);
+}
+
+static void loopback_disable(struct usb_function *f)
+{
+        struct f_loopback       *loop = func_to_loop(f);
+
+        disable_loopback(loop);
+}
+
+/*-------------------------------------------------------------------------*/
+
+static int __init loopback_bind_config(struct usb_configuration *c)
+{
+        struct f_loopback       *loop;
+        int                     status;
+
+        loop = kzalloc(sizeof *loop, GFP_KERNEL);
+        if (!loop)
+                return -ENOMEM;
+
+        loop->function.name = "loopback";
+        loop->function.descriptors = fs_loopback_descs;
+        loop->function.bind = loopback_bind;
+        loop->function.unbind = loopback_unbind;
+        loop->function.set_alt = loopback_set_alt;
+        loop->function.disable = loopback_disable;
+
+        status = usb_add_function(c, &loop->function);
+        if (status)
+                kfree(loop);
+        return status;
+}
+
+static struct usb_configuration loopback_driver = {
+        .label          = "loopback",
+        .strings        = loopback_strings,
+        .bind           = loopback_bind_config,
+        .bConfigurationValue = 2,
+        .bmAttributes   = USB_CONFIG_ATT_SELFPOWER,
+        .bMaxPower      = 1,    /* 2 mA, minimal */
+        /* .iConfiguration = DYNAMIC */
+};
+
+/**
+ * loopback_add - add a loopback testing configuration to a device
+ * @cdev: the device to support the loopback configuration
+ */
+int __init loopback_add(struct usb_composite_dev *cdev)
+{
+        int id;
+
+        /* allocate string ID(s) */
+        id = usb_string_id(cdev);
+        if (id < 0)
+                return id;
+        strings_loopback[0].id = id;
+
+        loopback_intf.iInterface = id;
+        loopback_driver.iConfiguration = id;
+
+        /* support OTG systems */
+        if (gadget_is_otg(cdev->gadget)) {
+                loopback_driver.descriptors = otg_desc;
+                loopback_driver.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
+        }
+
+        return usb_add_config(cdev, &loopback_driver);
+}
diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
new file mode 100644
index 000000000000..61652f0f13fd
--- /dev/null
+++ b/drivers/usb/gadget/f_rndis.c
@@ -0,0 +1,827 @@
+/*
+ * f_rndis.c -- RNDIS link function driver
+ *
+ * Copyright (C) 2003-2005,2008 David Brownell
+ * Copyright (C) 2003-2004 Robert Schwebel, Benedikt Spranger
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+/* #define VERBOSE_DEBUG */
+
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/etherdevice.h>
+
+#include <asm/atomic.h>
+
+#include "u_ether.h"
+#include "rndis.h"
+
+
+/*
+ * This function is an RNDIS Ethernet port -- a Microsoft protocol that's
+ * been promoted instead of the standard CDC Ethernet.  The published RNDIS
+ * spec is ambiguous, incomplete, and needlessly complex.  Variants such as
+ * ActiveSync have even worse status in terms of specification.
+ *
+ * In short:  it's a protocol controlled by (and for) Microsoft, not for an
+ * Open ecosystem or markets.  Linux supports it *only* because Microsoft
+ * doesn't support the CDC Ethernet standard.
+ *
+ * The RNDIS data transfer model is complex, with multiple Ethernet packets
+ * per USB message, and out of band data.  The control model is built around
+ * what's essentially an "RNDIS RPC" protocol.  It's all wrapped in a CDC ACM
+ * (modem, not Ethernet) veneer, with those ACM descriptors being entirely
+ * useless (they're ignored).  RNDIS expects to be the only function in its
+ * configuration, so it's no real help if you need composite devices; and
+ * it expects to be the first configuration too.
+ *
+ * There is a single technical advantage of RNDIS over CDC Ethernet, if you
+ * discount the fluff that its RPC can be made to deliver: it doesn't need
+ * a NOP altsetting for the data interface.  That lets it work on some of the
+ * "so smart it's stupid" hardware which takes over configuration changes
+ * from the software, and adds restrictions like "no altsettings".
+ *
+ * Unfortunately MSFT's RNDIS drivers are buggy.  They hang or oops, and
+ * have all sorts of contrary-to-specification oddities that can prevent
+ * them from working sanely.  Since bugfixes (or accurate specs, letting
+ * Linux work around those bugs) are unlikely to ever come from MSFT, you
+ * may want to avoid using RNDIS on purely operational grounds.
+ *
+ * Omissions from the RNDIS 1.0 specification include:
+ *
+ *   - Power management ... references data that's scattered around lots
+ *     of other documentation, which is incorrect/incomplete there too.
+ *
+ *   - There are various undocumented protocol requirements, like the need
+ *     to send garbage in some control-OUT messages.
+ *
+ *   - MS-Windows drivers sometimes emit undocumented requests.
+ */
+
+struct rndis_ep_descs {
+        struct usb_endpoint_descriptor  *in;
+        struct usb_endpoint_descriptor  *out;
+        struct usb_endpoint_descriptor  *notify;
+};
+
+struct f_rndis {
+        struct gether                   port;
+        u8                              ctrl_id, data_id;
+        u8                              ethaddr[ETH_ALEN];
+        int                             config;
+
+        struct usb_descriptor_header    **fs_function;
+        struct rndis_ep_descs           fs;
+        struct usb_descriptor_header    **hs_function;
+        struct rndis_ep_descs           hs;
+
+        struct usb_ep                   *notify;
+        struct usb_endpoint_descriptor  *notify_desc;
+        struct usb_request              *notify_req;
+        atomic_t                        notify_count;
+};
+
+static inline struct f_rndis *func_to_rndis(struct usb_function *f)
+{
+        return container_of(f, struct f_rndis, port.func);
+}
+
+/* peak (theoretical) bulk transfer rate in bits-per-second */
+static unsigned int bitrate(struct usb_gadget *g)
+{
+        if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
+                return 13 * 512 * 8 * 1000 * 8;
+        else
+                return 19 *  64 * 1 * 1000 * 8;
+}
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ */
+
+#define LOG2_STATUS_INTERVAL_MSEC       5       /* 1 << 5 == 32 msec */
+#define STATUS_BYTECOUNT                8       /* 8 bytes data */
+
+
+/* interface descriptor: */
+
+static struct usb_interface_descriptor rndis_control_intf __initdata = {
+        .bLength =              sizeof rndis_control_intf,
+        .bDescriptorType =      USB_DT_INTERFACE,
+
+        /* .bInterfaceNumber = DYNAMIC */
+        /* status endpoint is optional; this could be patched later */
+        .bNumEndpoints =        1,
+        .bInterfaceClass =      USB_CLASS_COMM,
+        .bInterfaceSubClass =   USB_CDC_SUBCLASS_ACM,
+        .bInterfaceProtocol =   USB_CDC_ACM_PROTO_VENDOR,
+        /* .iInterface = DYNAMIC */
+};
+
+static struct usb_cdc_header_desc header_desc __initdata = {
+        .bLength =              sizeof header_desc,
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubType =   USB_CDC_HEADER_TYPE,
+
+        .bcdCDC =               __constant_cpu_to_le16(0x0110),
+};
+
+static struct usb_cdc_call_mgmt_descriptor call_mgmt_descriptor __initdata = {
+        .bLength =              sizeof call_mgmt_descriptor,
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubType =   USB_CDC_CALL_MANAGEMENT_TYPE,
+
+        .bmCapabilities =       0x00,
+        .bDataInterface =       0x01,
+};
+
+static struct usb_cdc_acm_descriptor acm_descriptor __initdata = {
+        .bLength =              sizeof acm_descriptor,
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubType =   USB_CDC_ACM_TYPE,
+
+        .bmCapabilities =       0x00,
+};
+
+static struct usb_cdc_union_desc rndis_union_desc __initdata = {
+        .bLength =              sizeof(rndis_union_desc),
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubType =   USB_CDC_UNION_TYPE,
+        /* .bMasterInterface0 = DYNAMIC */
+        /* .bSlaveInterface0 =  DYNAMIC */
+};
+
+/* the data interface has two bulk endpoints */
+
+static struct usb_interface_descriptor rndis_data_intf __initdata = {
+        .bLength =              sizeof rndis_data_intf,
+        .bDescriptorType =      USB_DT_INTERFACE,
+
+        /* .bInterfaceNumber = DYNAMIC */
+        .bAlternateSetting =    1,
+        .bNumEndpoints =        2,
+        .bInterfaceClass =      USB_CLASS_CDC_DATA,
+        .bInterfaceSubClass =   0,
+        .bInterfaceProtocol =   0,
+        /* .iInterface = DYNAMIC */
+};
+
+/* full speed support: */
+
+static struct usb_endpoint_descriptor fs_notify_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_INT,
+        .wMaxPacketSize =       __constant_cpu_to_le16(STATUS_BYTECOUNT),
+        .bInterval =            1 << LOG2_STATUS_INTERVAL_MSEC,
+};
+
+static struct usb_endpoint_descriptor fs_in_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_endpoint_descriptor fs_out_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_OUT,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_descriptor_header *eth_fs_function[] __initdata = {
+        /* control interface matches ACM, not Ethernet */
+        (struct usb_descriptor_header *) &rndis_control_intf,
+        (struct usb_descriptor_header *) &header_desc,
+        (struct usb_descriptor_header *) &call_mgmt_descriptor,
+        (struct usb_descriptor_header *) &acm_descriptor,
+        (struct usb_descriptor_header *) &rndis_union_desc,
+        (struct usb_descriptor_header *) &fs_notify_desc,
+        /* data interface has no altsetting */
+        (struct usb_descriptor_header *) &rndis_data_intf,
+        (struct usb_descriptor_header *) &fs_in_desc,
+        (struct usb_descriptor_header *) &fs_out_desc,
+        NULL,
+};
+
+/* high speed support: */
+
+static struct usb_endpoint_descriptor hs_notify_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_INT,
+        .wMaxPacketSize =       __constant_cpu_to_le16(STATUS_BYTECOUNT),
+        .bInterval =            LOG2_STATUS_INTERVAL_MSEC + 4,
+};
+static struct usb_endpoint_descriptor hs_in_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize =       __constant_cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor hs_out_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_OUT,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize =       __constant_cpu_to_le16(512),
+};
+
+static struct usb_descriptor_header *eth_hs_function[] __initdata = {
+        /* control interface matches ACM, not Ethernet */
+        (struct usb_descriptor_header *) &rndis_control_intf,
+        (struct usb_descriptor_header *) &header_desc,
+        (struct usb_descriptor_header *) &call_mgmt_descriptor,
+        (struct usb_descriptor_header *) &acm_descriptor,
+        (struct usb_descriptor_header *) &rndis_union_desc,
+        (struct usb_descriptor_header *) &hs_notify_desc,
+        /* data interface has no altsetting */
+        (struct usb_descriptor_header *) &rndis_data_intf,
+        (struct usb_descriptor_header *) &hs_in_desc,
+        (struct usb_descriptor_header *) &hs_out_desc,
+        NULL,
+};
+
+/* string descriptors: */
+
+static struct usb_string rndis_string_defs[] = {
+        [0].s = "RNDIS Communications Control",
+        [1].s = "RNDIS Ethernet Data",
+        {  } /* end of list */
+};
+
+static struct usb_gadget_strings rndis_string_table = {
+        .language =             0x0409, /* en-us */
+        .strings =              rndis_string_defs,
+};
+
+static struct usb_gadget_strings *rndis_strings[] = {
+        &rndis_string_table,
+        NULL,
+};
+
+/*-------------------------------------------------------------------------*/
+
+static struct sk_buff *rndis_add_header(struct sk_buff *skb)
+{
+        skb = skb_realloc_headroom(skb, sizeof(struct rndis_packet_msg_type));
+        if (skb)
+                rndis_add_hdr(skb);
+        return skb;
+}
+
+static void rndis_response_available(void *_rndis)
+{
+        struct f_rndis                  *rndis = _rndis;
+        struct usb_request              *req = rndis->notify_req;
+        struct usb_composite_dev        *cdev = rndis->port.func.config->cdev;
+        __le32                          *data = req->buf;
+        int                             status;
+
+        if (atomic_inc_return(&rndis->notify_count))
+                return;
+
+        /* Send RNDIS RESPONSE_AVAILABLE notification; a
+         * USB_CDC_NOTIFY_RESPONSE_AVAILABLE "should" work too
+         *
+         * This is the only notification defined by RNDIS.
+         */
+        data[0] = cpu_to_le32(1);
+        data[1] = cpu_to_le32(0);
+
+        status = usb_ep_queue(rndis->notify, req, GFP_ATOMIC);
+        if (status) {
+                atomic_dec(&rndis->notify_count);
+                DBG(cdev, "notify/0 --> %d\n", status);
+        }
+}
+
+static void rndis_response_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct f_rndis                  *rndis = req->context;
+        struct usb_composite_dev        *cdev = rndis->port.func.config->cdev;
+        int                             status = req->status;
+
+        /* after TX:
+         *  - USB_CDC_GET_ENCAPSULATED_RESPONSE (ep0/control)
+         *  - RNDIS_RESPONSE_AVAILABLE (status/irq)
+         */
+        switch (status) {
+        case -ECONNRESET:
+        case -ESHUTDOWN:
+                /* connection gone */
+                atomic_set(&rndis->notify_count, 0);
+                break;
+        default:
+                DBG(cdev, "RNDIS %s response error %d, %d/%d\n",
+                        ep->name, status,
+                        req->actual, req->length);
+                /* FALLTHROUGH */
+        case 0:
+                if (ep != rndis->notify)
+                        break;
+
+                /* handle multiple pending RNDIS_RESPONSE_AVAILABLE
+                 * notifications by resending until we're done
+                 */
+                if (atomic_dec_and_test(&rndis->notify_count))
+                        break;
+                status = usb_ep_queue(rndis->notify, req, GFP_ATOMIC);
+                if (status) {
+                        atomic_dec(&rndis->notify_count);
+                        DBG(cdev, "notify/1 --> %d\n", status);
+                }
+                break;
+        }
+}
+
+static void rndis_command_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct f_rndis                  *rndis = req->context;
+        struct usb_composite_dev        *cdev = rndis->port.func.config->cdev;
+        int                             status;
+
+        /* received RNDIS command from USB_CDC_SEND_ENCAPSULATED_COMMAND */
+//      spin_lock(&dev->lock);
+        status = rndis_msg_parser(rndis->config, (u8 *) req->buf);
+        if (status < 0)
+                ERROR(cdev, "RNDIS command error %d, %d/%d\n",
+                        status, req->actual, req->length);
+//      spin_unlock(&dev->lock);
+}
+
+static int
+rndis_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
+{
+        struct f_rndis          *rndis = func_to_rndis(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+        struct usb_request      *req = cdev->req;
+        int                     value = -EOPNOTSUPP;
+        u16                     w_index = le16_to_cpu(ctrl->wIndex);
+        u16                     w_value = le16_to_cpu(ctrl->wValue);
+        u16                     w_length = le16_to_cpu(ctrl->wLength);
+
+        /* composite driver infrastructure handles everything except
+         * CDC class messages; interface activation uses set_alt().
+         */
+        switch ((ctrl->bRequestType << 8) | ctrl->bRequest) {
+
+        /* RNDIS uses the CDC command encapsulation mechanism to implement
+         * an RPC scheme, with much getting/setting of attributes by OID.
+         */
+        case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
+                        | USB_CDC_SEND_ENCAPSULATED_COMMAND:
+                if (w_length > req->length || w_value
+                                || w_index != rndis->ctrl_id)
+                        goto invalid;
+                /* read the request; process it later */
+                value = w_length;
+                req->complete = rndis_command_complete;
+                req->context = rndis;
+                /* later, rndis_response_available() sends a notification */
+                break;
+
+        case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
+                        | USB_CDC_GET_ENCAPSULATED_RESPONSE:
+                if (w_value || w_index != rndis->ctrl_id)
+                        goto invalid;
+                else {
+                        u8 *buf;
+                        u32 n;
+
+                        /* return the result */
+                        buf = rndis_get_next_response(rndis->config, &n);
+                        if (buf) {
+                                memcpy(req->buf, buf, n);
+                                req->complete = rndis_response_complete;
+                                rndis_free_response(rndis->config, buf);
+                                value = n;
+                        }
+                        /* else stalls ... spec says to avoid that */
+                }
+                break;
+
+        default:
+invalid:
+                VDBG(cdev, "invalid control req%02x.%02x v%04x i%04x l%d\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, w_length);
+        }
+
+        /* respond with data transfer or status phase? */
+        if (value >= 0) {
+                DBG(cdev, "rndis req%02x.%02x v%04x i%04x l%d\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, w_length);
+                req->zero = 0;
+                req->length = value;
+                value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
+                if (value < 0)
+                        ERROR(cdev, "rndis response on err %d\n", value);
+        }
+
+        /* device either stalls (value < 0) or reports success */
+        return value;
+}
+
+
+static int rndis_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
+{
+        struct f_rndis          *rndis = func_to_rndis(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+
+        /* we know alt == 0 */
+
+        if (intf == rndis->ctrl_id) {
+                if (rndis->notify->driver_data) {
+                        VDBG(cdev, "reset rndis control %d\n", intf);
+                        usb_ep_disable(rndis->notify);
+                } else {
+                        VDBG(cdev, "init rndis ctrl %d\n", intf);
+                        rndis->notify_desc = ep_choose(cdev->gadget,
+                                        rndis->hs.notify,
+                                        rndis->fs.notify);
+                }
+                usb_ep_enable(rndis->notify, rndis->notify_desc);
+                rndis->notify->driver_data = rndis;
+
+        } else if (intf == rndis->data_id) {
+                struct net_device       *net;
+
+                if (rndis->port.in_ep->driver_data) {
+                        DBG(cdev, "reset rndis\n");
+                        gether_disconnect(&rndis->port);
+                } else {
+                        DBG(cdev, "init rndis\n");
+                        rndis->port.in = ep_choose(cdev->gadget,
+                                        rndis->hs.in, rndis->fs.in);
+                        rndis->port.out = ep_choose(cdev->gadget,
+                                        rndis->hs.out, rndis->fs.out);
+                }
+
+                /* Avoid ZLPs; they can be troublesome. */
+                rndis->port.is_zlp_ok = false;
+
+                /* RNDIS should be in the "RNDIS uninitialized" state,
+                 * either never activated or after rndis_uninit().
+                 *
+                 * We don't want data to flow here until a nonzero packet
+                 * filter is set, at which point it enters "RNDIS data
+                 * initialized" state ... but we do want the endpoints
+                 * to be activated.  It's a strange little state.
+                 *
+                 * REVISIT the RNDIS gadget code has done this wrong for a
+                 * very long time.  We need another call to the link layer
+                 * code -- gether_updown(...bool) maybe -- to do it right.
+                 */
+                rndis->port.cdc_filter = 0;
+
+                DBG(cdev, "RNDIS RX/TX early activation ... \n");
+                net = gether_connect(&rndis->port);
+                if (IS_ERR(net))
+                        return PTR_ERR(net);
+
+                rndis_set_param_dev(rndis->config, net,
+                                &rndis->port.cdc_filter);
+        } else
+                goto fail;
+
+        return 0;
+fail:
+        return -EINVAL;
+}
+
+static void rndis_disable(struct usb_function *f)
+{
+        struct f_rndis          *rndis = func_to_rndis(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+
+        if (!rndis->notify->driver_data)
+                return;
+
+        DBG(cdev, "rndis deactivated\n");
+
+        rndis_uninit(rndis->config);
+        gether_disconnect(&rndis->port);
+
+        usb_ep_disable(rndis->notify);
+        rndis->notify->driver_data = NULL;
+}
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * This isn't quite the same mechanism as CDC Ethernet, since the
+ * notification scheme passes less data, but the same set of link
+ * states must be tested.  A key difference is that altsettings are
+ * not used to tell whether the link should send packets or not.
+ */
+
+static void rndis_open(struct gether *geth)
+{
+        struct f_rndis          *rndis = func_to_rndis(&geth->func);
+        struct usb_composite_dev *cdev = geth->func.config->cdev;
+
+        DBG(cdev, "%s\n", __func__);
+
+        rndis_set_param_medium(rndis->config, NDIS_MEDIUM_802_3,
+                                bitrate(cdev->gadget) / 100);
+        rndis_signal_connect(rndis->config);
+}
+
+static void rndis_close(struct gether *geth)
+{
+        struct f_rndis          *rndis = func_to_rndis(&geth->func);
+
+        DBG(geth->func.config->cdev, "%s\n", __func__);
+
+        rndis_set_param_medium(rndis->config, NDIS_MEDIUM_802_3, 0);
+        rndis_signal_disconnect(rndis->config);
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* ethernet function driver setup/binding */
+
+static int __init
+rndis_bind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct usb_composite_dev *cdev = c->cdev;
+        struct f_rndis          *rndis = func_to_rndis(f);
+        int                     status;
+        struct usb_ep           *ep;
+
+        /* allocate instance-specific interface IDs */
+        status = usb_interface_id(c, f);
+        if (status < 0)
+                goto fail;
+        rndis->ctrl_id = status;
+
+        rndis_control_intf.bInterfaceNumber = status;
+        rndis_union_desc.bMasterInterface0 = status;
+
+        status = usb_interface_id(c, f);
+        if (status < 0)
+                goto fail;
+        rndis->data_id = status;
+
+        rndis_data_intf.bInterfaceNumber = status;
+        rndis_union_desc.bSlaveInterface0 = status;
+
+        status = -ENODEV;
+
+        /* allocate instance-specific endpoints */
+        ep = usb_ep_autoconfig(cdev->gadget, &fs_in_desc);
+        if (!ep)
+                goto fail;
+        rndis->port.in_ep = ep;
+        ep->driver_data = cdev; /* claim */
+
+        ep = usb_ep_autoconfig(cdev->gadget, &fs_out_desc);
+        if (!ep)
+                goto fail;
+        rndis->port.out_ep = ep;
+        ep->driver_data = cdev; /* claim */
+
+        /* NOTE:  a status/notification endpoint is, strictly speaking,
+         * optional.  We don't treat it that way though!  It's simpler,
+         * and some newer profiles don't treat it as optional.
+         */
+        ep = usb_ep_autoconfig(cdev->gadget, &fs_notify_desc);
+        if (!ep)
+                goto fail;
+        rndis->notify = ep;
+        ep->driver_data = cdev; /* claim */
+
+        status = -ENOMEM;
+
+        /* allocate notification request and buffer */
+        rndis->notify_req = usb_ep_alloc_request(ep, GFP_KERNEL);
+        if (!rndis->notify_req)
+                goto fail;
+        rndis->notify_req->buf = kmalloc(STATUS_BYTECOUNT, GFP_KERNEL);
+        if (!rndis->notify_req->buf)
+                goto fail;
+        rndis->notify_req->length = STATUS_BYTECOUNT;
+        rndis->notify_req->context = rndis;
+        rndis->notify_req->complete = rndis_response_complete;
+
+        /* copy descriptors, and track endpoint copies */
+        f->descriptors = usb_copy_descriptors(eth_fs_function);
+        if (!f->descriptors)
+                goto fail;
+
+        rndis->fs.in = usb_find_endpoint(eth_fs_function,
+                        f->descriptors, &fs_in_desc);
+        rndis->fs.out = usb_find_endpoint(eth_fs_function,
+                        f->descriptors, &fs_out_desc);
+        rndis->fs.notify = usb_find_endpoint(eth_fs_function,
+                        f->descriptors, &fs_notify_desc);
+
+        /* support all relevant hardware speeds... we expect that when
+         * hardware is dual speed, all bulk-capable endpoints work at
+         * both speeds
+         */
+        if (gadget_is_dualspeed(c->cdev->gadget)) {
+                hs_in_desc.bEndpointAddress =
+                                fs_in_desc.bEndpointAddress;
+                hs_out_desc.bEndpointAddress =
+                                fs_out_desc.bEndpointAddress;
+
+                /* copy descriptors, and track endpoint copies */
+                f->hs_descriptors = usb_copy_descriptors(eth_hs_function);
+
+                if (!f->hs_descriptors)
+                        goto fail;
+
+                rndis->hs.in = usb_find_endpoint(eth_hs_function,
+                                f->hs_descriptors, &hs_in_desc);
+                rndis->hs.out = usb_find_endpoint(eth_hs_function,
+                                f->hs_descriptors, &hs_out_desc);
+        }
+
+        rndis->port.open = rndis_open;
+        rndis->port.close = rndis_close;
+
+        status = rndis_register(rndis_response_available, rndis);
+        if (status < 0)
+                goto fail;
+        rndis->config = status;
+
+        rndis_set_param_medium(rndis->config, NDIS_MEDIUM_802_3, 0);
+        rndis_set_host_mac(rndis->config, rndis->ethaddr);
+
+#if 0
+// FIXME
+        if (rndis_set_param_vendor(rndis->config, vendorID,
+                                manufacturer))
+                goto fail0;
+#endif
+
+        /* NOTE:  all that is done without knowing or caring about
+         * the network link ... which is unavailable to this code
+         * until we're activated via set_alt().
+         */
+
+        DBG(cdev, "RNDIS: %s speed IN/%s OUT/%s NOTIFY/%s\n",
+                        gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
+                        rndis->port.in_ep->name, rndis->port.out_ep->name,
+                        rndis->notify->name);
+        return 0;
+
+fail:
+        if (gadget_is_dualspeed(c->cdev->gadget) && f->hs_descriptors)
+                usb_free_descriptors(f->hs_descriptors);
+        if (f->descriptors)
+                usb_free_descriptors(f->descriptors);
+
+        if (rndis->notify_req) {
+                kfree(rndis->notify_req->buf);
+                usb_ep_free_request(rndis->notify, rndis->notify_req);
+        }
+
+        /* we might as well release our claims on endpoints */
+        if (rndis->notify)
+                rndis->notify->driver_data = NULL;
+        if (rndis->port.out)
+                rndis->port.out_ep->driver_data = NULL;
+        if (rndis->port.in)
+                rndis->port.in_ep->driver_data = NULL;
+
+        ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
+
+        return status;
+}
+
+static void
+rndis_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct f_rndis          *rndis = func_to_rndis(f);
+
+        rndis_deregister(rndis->config);
+        rndis_exit();
+
+        if (gadget_is_dualspeed(c->cdev->gadget))
+                usb_free_descriptors(f->hs_descriptors);
+        usb_free_descriptors(f->descriptors);
+
+        kfree(rndis->notify_req->buf);
+        usb_ep_free_request(rndis->notify, rndis->notify_req);
+
+        kfree(rndis);
+}
+
+/* Some controllers can't support RNDIS ... */
+static inline bool can_support_rndis(struct usb_configuration *c)
+{
+        /* only two endpoints on sa1100 */
+        if (gadget_is_sa1100(c->cdev->gadget))
+                return false;
+
+        /* everything else is *presumably* fine */
+        return true;
+}
+
+/**
+ * rndis_bind_config - add RNDIS network link to a configuration
+ * @c: the configuration to support the network link
+ * @ethaddr: a buffer in which the ethernet address of the host side
+ *      side of the link was recorded
+ * Context: single threaded during gadget setup
+ *
+ * Returns zero on success, else negative errno.
+ *
+ * Caller must have called @gether_setup().  Caller is also responsible
+ * for calling @gether_cleanup() before module unload.
+ */
+int __init rndis_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN])
+{
+        struct f_rndis  *rndis;
+        int             status;
+
+        if (!can_support_rndis(c) || !ethaddr)
+                return -EINVAL;
+
+        /* maybe allocate device-global string IDs */
+        if (rndis_string_defs[0].id == 0) {
+
+                /* ... and setup RNDIS itself */
+                status = rndis_init();
+                if (status < 0)
+                        return status;
+
+                /* control interface label */
+                status = usb_string_id(c->cdev);
+                if (status < 0)
+                        return status;
+                rndis_string_defs[0].id = status;
+                rndis_control_intf.iInterface = status;
+
+                /* data interface label */
+                status = usb_string_id(c->cdev);
+                if (status < 0)
+                        return status;
+                rndis_string_defs[1].id = status;
+                rndis_data_intf.iInterface = status;
+        }
+
+        /* allocate and initialize one new instance */
+        status = -ENOMEM;
+        rndis = kzalloc(sizeof *rndis, GFP_KERNEL);
+        if (!rndis)
+                goto fail;
+
+        memcpy(rndis->ethaddr, ethaddr, ETH_ALEN);
+
+        /* RNDIS activates when the host changes this filter */
+        rndis->port.cdc_filter = 0;
+
+        /* RNDIS has special (and complex) framing */
+        rndis->port.header_len = sizeof(struct rndis_packet_msg_type);
+        rndis->port.wrap = rndis_add_header;
+        rndis->port.unwrap = rndis_rm_hdr;
+
+        rndis->port.func.name = "rndis";
+        rndis->port.func.strings = rndis_strings;
+        /* descriptors are per-instance copies */
+        rndis->port.func.bind = rndis_bind;
+        rndis->port.func.unbind = rndis_unbind;
+        rndis->port.func.set_alt = rndis_set_alt;
+        rndis->port.func.setup = rndis_setup;
+        rndis->port.func.disable = rndis_disable;
+
+        status = usb_add_function(c, &rndis->port.func);
+        if (status) {
+                kfree(rndis);
+fail:
+                rndis_exit();
+        }
+        return status;
+}
diff --git a/drivers/usb/gadget/f_serial.c b/drivers/usb/gadget/f_serial.c
new file mode 100644
index 000000000000..1b6bde9aaed5
--- /dev/null
+++ b/drivers/usb/gadget/f_serial.c
@@ -0,0 +1,296 @@
+/*
+ * f_serial.c - generic USB serial function driver
+ *
+ * Copyright (C) 2003 Al Borchers (alborchers@steinerpoint.com)
+ * Copyright (C) 2008 by David Brownell
+ * Copyright (C) 2008 by Nokia Corporation
+ *
+ * This software is distributed under the terms of the GNU General
+ * Public License ("GPL") as published by the Free Software Foundation,
+ * either version 2 of that License or (at your option) any later version.
+ */
+
+#include <linux/kernel.h>
+#include <linux/device.h>
+
+#include "u_serial.h"
+#include "gadget_chips.h"
+
+
+/*
+ * This function packages a simple "generic serial" port with no real
+ * control mechanisms, just raw data transfer over two bulk endpoints.
+ *
+ * Because it's not standardized, this isn't as interoperable as the
+ * CDC ACM driver.  However, for many purposes it's just as functional
+ * if you can arrange appropriate host side drivers.
+ */
+
+struct gser_descs {
+        struct usb_endpoint_descriptor  *in;
+        struct usb_endpoint_descriptor  *out;
+};
+
+struct f_gser {
+        struct gserial                  port;
+        u8                              data_id;
+        u8                              port_num;
+
+        struct usb_descriptor_header    **fs_function;
+        struct gser_descs               fs;
+        struct usb_descriptor_header    **hs_function;
+        struct gser_descs               hs;
+};
+
+static inline struct f_gser *func_to_gser(struct usb_function *f)
+{
+        return container_of(f, struct f_gser, port.func);
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* interface descriptor: */
+
+static struct usb_interface_descriptor gser_interface_desc __initdata = {
+        .bLength =              USB_DT_INTERFACE_SIZE,
+        .bDescriptorType =      USB_DT_INTERFACE,
+        /* .bInterfaceNumber = DYNAMIC */
+        .bNumEndpoints =        2,
+        .bInterfaceClass =      USB_CLASS_VENDOR_SPEC,
+        .bInterfaceSubClass =   0,
+        .bInterfaceProtocol =   0,
+        /* .iInterface = DYNAMIC */
+};
+
+/* full speed support: */
+
+static struct usb_endpoint_descriptor gser_fs_in_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_endpoint_descriptor gser_fs_out_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+        .bEndpointAddress =     USB_DIR_OUT,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_descriptor_header *gser_fs_function[] __initdata = {
+        (struct usb_descriptor_header *) &gser_interface_desc,
+        (struct usb_descriptor_header *) &gser_fs_in_desc,
+        (struct usb_descriptor_header *) &gser_fs_out_desc,
+        NULL,
+};
+
+/* high speed support: */
+
+static struct usb_endpoint_descriptor gser_hs_in_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize =       __constant_cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor gser_hs_out_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize =       __constant_cpu_to_le16(512),
+};
+
+static struct usb_descriptor_header *gser_hs_function[] __initdata = {
+        (struct usb_descriptor_header *) &gser_interface_desc,
+        (struct usb_descriptor_header *) &gser_hs_in_desc,
+        (struct usb_descriptor_header *) &gser_hs_out_desc,
+        NULL,
+};
+
+/* string descriptors: */
+
+static struct usb_string gser_string_defs[] = {
+        [0].s = "Generic Serial",
+        {  } /* end of list */
+};
+
+static struct usb_gadget_strings gser_string_table = {
+        .language =             0x0409, /* en-us */
+        .strings =              gser_string_defs,
+};
+
+static struct usb_gadget_strings *gser_strings[] = {
+        &gser_string_table,
+        NULL,
+};
+
+/*-------------------------------------------------------------------------*/
+
+static int gser_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
+{
+        struct f_gser           *gser = func_to_gser(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+
+        /* we know alt == 0, so this is an activation or a reset */
+
+        if (gser->port.in->driver_data) {
+                DBG(cdev, "reset generic ttyGS%d\n", gser->port_num);
+                gserial_disconnect(&gser->port);
+        } else {
+                DBG(cdev, "activate generic ttyGS%d\n", gser->port_num);
+                gser->port.in_desc = ep_choose(cdev->gadget,
+                                gser->hs.in, gser->fs.in);
+                gser->port.out_desc = ep_choose(cdev->gadget,
+                                gser->hs.out, gser->fs.out);
+        }
+        gserial_connect(&gser->port, gser->port_num);
+        return 0;
+}
+
+static void gser_disable(struct usb_function *f)
+{
+        struct f_gser   *gser = func_to_gser(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+
+        DBG(cdev, "generic ttyGS%d deactivated\n", gser->port_num);
+        gserial_disconnect(&gser->port);
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* serial function driver setup/binding */
+
+static int __init
+gser_bind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct usb_composite_dev *cdev = c->cdev;
+        struct f_gser           *gser = func_to_gser(f);
+        int                     status;
+        struct usb_ep           *ep;
+
+        /* allocate instance-specific interface IDs */
+        status = usb_interface_id(c, f);
+        if (status < 0)
+                goto fail;
+        gser->data_id = status;
+        gser_interface_desc.bInterfaceNumber = status;
+
+        status = -ENODEV;
+
+        /* allocate instance-specific endpoints */
+        ep = usb_ep_autoconfig(cdev->gadget, &gser_fs_in_desc);
+        if (!ep)
+                goto fail;
+        gser->port.in = ep;
+        ep->driver_data = cdev; /* claim */
+
+        ep = usb_ep_autoconfig(cdev->gadget, &gser_fs_out_desc);
+        if (!ep)
+                goto fail;
+        gser->port.out = ep;
+        ep->driver_data = cdev; /* claim */
+
+        /* copy descriptors, and track endpoint copies */
+        f->descriptors = usb_copy_descriptors(gser_fs_function);
+
+        gser->fs.in = usb_find_endpoint(gser_fs_function,
+                        f->descriptors, &gser_fs_in_desc);
+        gser->fs.out = usb_find_endpoint(gser_fs_function,
+                        f->descriptors, &gser_fs_out_desc);
+
+
+        /* support all relevant hardware speeds... we expect that when
+         * hardware is dual speed, all bulk-capable endpoints work at
+         * both speeds
+         */
+        if (gadget_is_dualspeed(c->cdev->gadget)) {
+                gser_hs_in_desc.bEndpointAddress =
+                                gser_fs_in_desc.bEndpointAddress;
+                gser_hs_out_desc.bEndpointAddress =
+                                gser_fs_out_desc.bEndpointAddress;
+
+                /* copy descriptors, and track endpoint copies */
+                f->hs_descriptors = usb_copy_descriptors(gser_hs_function);
+
+                gser->hs.in = usb_find_endpoint(gser_hs_function,
+                                f->hs_descriptors, &gser_hs_in_desc);
+                gser->hs.out = usb_find_endpoint(gser_hs_function,
+                                f->hs_descriptors, &gser_hs_out_desc);
+        }
+
+        DBG(cdev, "generic ttyGS%d: %s speed IN/%s OUT/%s\n",
+                        gser->port_num,
+                        gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
+                        gser->port.in->name, gser->port.out->name);
+        return 0;
+
+fail:
+        /* we might as well release our claims on endpoints */
+        if (gser->port.out)
+                gser->port.out->driver_data = NULL;
+        if (gser->port.in)
+                gser->port.in->driver_data = NULL;
+
+        ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
+
+        return status;
+}
+
+static void
+gser_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+        if (gadget_is_dualspeed(c->cdev->gadget))
+                usb_free_descriptors(f->hs_descriptors);
+        usb_free_descriptors(f->descriptors);
+        kfree(func_to_gser(f));
+}
+
+/**
+ * gser_bind_config - add a generic serial function to a configuration
+ * @c: the configuration to support the serial instance
+ * @port_num: /dev/ttyGS* port this interface will use
+ * Context: single threaded during gadget setup
+ *
+ * Returns zero on success, else negative errno.
+ *
+ * Caller must have called @gserial_setup() with enough ports to
+ * handle all the ones it binds.  Caller is also responsible
+ * for calling @gserial_cleanup() before module unload.
+ */
+int __init gser_bind_config(struct usb_configuration *c, u8 port_num)
+{
+        struct f_gser   *gser;
+        int             status;
+
+        /* REVISIT might want instance-specific strings to help
+         * distinguish instances ...
+         */
+
+        /* maybe allocate device-global string ID */
+        if (gser_string_defs[0].id == 0) {
+                status = usb_string_id(c->cdev);
+                if (status < 0)
+                        return status;
+                gser_string_defs[0].id = status;
+        }
+
+        /* allocate and initialize one new instance */
+        gser = kzalloc(sizeof *gser, GFP_KERNEL);
+        if (!gser)
+                return -ENOMEM;
+
+        gser->port_num = port_num;
+
+        gser->port.func.name = "gser";
+        gser->port.func.strings = gser_strings;
+        gser->port.func.bind = gser_bind;
+        gser->port.func.unbind = gser_unbind;
+        gser->port.func.set_alt = gser_set_alt;
+        gser->port.func.disable = gser_disable;
+
+        status = usb_add_function(c, &gser->port.func);
+        if (status)
+                kfree(gser);
+        return status;
+}
diff --git a/drivers/usb/gadget/f_sourcesink.c b/drivers/usb/gadget/f_sourcesink.c
new file mode 100644
index 000000000000..f18c3a14d72a
--- /dev/null
+++ b/drivers/usb/gadget/f_sourcesink.c
@@ -0,0 +1,587 @@
+/*
+ * f_sourcesink.c - USB peripheral source/sink configuration driver
+ *
+ * Copyright (C) 2003-2008 David Brownell
+ * Copyright (C) 2008 by Nokia Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+/* #define VERBOSE_DEBUG */
+
+#include <linux/kernel.h>
+#include <linux/utsname.h>
+#include <linux/device.h>
+
+#include "g_zero.h"
+#include "gadget_chips.h"
+
+
+/*
+ * SOURCE/SINK FUNCTION ... a primary testing vehicle for USB peripheral
+ * controller drivers.
+ *
+ * This just sinks bulk packets OUT to the peripheral and sources them IN
+ * to the host, optionally with specific data patterns for integrity tests.
+ * As such it supports basic functionality and load tests.
+ *
+ * In terms of control messaging, this supports all the standard requests
+ * plus two that support control-OUT tests.  If the optional "autoresume"
+ * mode is enabled, it provides good functional coverage for the "USBCV"
+ * test harness from USB-IF.
+ *
+ * Note that because this doesn't queue more than one request at a time,
+ * some other function must be used to test queueing logic.  The network
+ * link (g_ether) is the best overall option for that, since its TX and RX
+ * queues are relatively independent, will receive a range of packet sizes,
+ * and can often be made to run out completely.  Those issues are important
+ * when stress testing peripheral controller drivers.
+ *
+ *
+ * This is currently packaged as a configuration driver, which can't be
+ * combined with other functions to make composite devices.  However, it
+ * can be combined with other independent configurations.
+ */
+struct f_sourcesink {
+        struct usb_function     function;
+
+        struct usb_ep           *in_ep;
+        struct usb_ep           *out_ep;
+        struct timer_list       resume;
+};
+
+static inline struct f_sourcesink *func_to_ss(struct usb_function *f)
+{
+        return container_of(f, struct f_sourcesink, function);
+}
+
+static unsigned autoresume;
+module_param(autoresume, uint, 0);
+MODULE_PARM_DESC(autoresume, "zero, or seconds before remote wakeup");
+
+static unsigned pattern;
+module_param(pattern, uint, 0);
+MODULE_PARM_DESC(pattern, "0 = all zeroes, 1 = mod63 ");
+
+/*-------------------------------------------------------------------------*/
+
+static struct usb_interface_descriptor source_sink_intf = {
+        .bLength =              sizeof source_sink_intf,
+        .bDescriptorType =      USB_DT_INTERFACE,
+
+        .bNumEndpoints =        2,
+        .bInterfaceClass =      USB_CLASS_VENDOR_SPEC,
+        /* .iInterface = DYNAMIC */
+};
+
+/* full speed support: */
+
+static struct usb_endpoint_descriptor fs_source_desc = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_endpoint_descriptor fs_sink_desc = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_OUT,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_descriptor_header *fs_source_sink_descs[] = {
+        (struct usb_descriptor_header *) &source_sink_intf,
+        (struct usb_descriptor_header *) &fs_sink_desc,
+        (struct usb_descriptor_header *) &fs_source_desc,
+        NULL,
+};
+
+/* high speed support: */
+
+static struct usb_endpoint_descriptor hs_source_desc = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize =       __constant_cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor hs_sink_desc = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize =       __constant_cpu_to_le16(512),
+};
+
+static struct usb_descriptor_header *hs_source_sink_descs[] = {
+        (struct usb_descriptor_header *) &source_sink_intf,
+        (struct usb_descriptor_header *) &hs_source_desc,
+        (struct usb_descriptor_header *) &hs_sink_desc,
+        NULL,
+};
+
+/* function-specific strings: */
+
+static struct usb_string strings_sourcesink[] = {
+        [0].s = "source and sink data",
+        {  }                    /* end of list */
+};
+
+static struct usb_gadget_strings stringtab_sourcesink = {
+        .language       = 0x0409,       /* en-us */
+        .strings        = strings_sourcesink,
+};
+
+static struct usb_gadget_strings *sourcesink_strings[] = {
+        &stringtab_sourcesink,
+        NULL,
+};
+
+/*-------------------------------------------------------------------------*/
+
+static void sourcesink_autoresume(unsigned long _c)
+{
+        struct usb_composite_dev *cdev = (void *)_c;
+        struct usb_gadget       *g = cdev->gadget;
+
+        /* Normally the host would be woken up for something
+         * more significant than just a timer firing; likely
+         * because of some direct user request.
+         */
+        if (g->speed != USB_SPEED_UNKNOWN) {
+                int status = usb_gadget_wakeup(g);
+                DBG(cdev, "%s --> %d\n", __func__, status);
+        }
+}
+
+static int __init
+sourcesink_bind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct usb_composite_dev *cdev = c->cdev;
+        struct f_sourcesink     *ss = func_to_ss(f);
+        int     id;
+
+        /* allocate interface ID(s) */
+        id = usb_interface_id(c, f);
+        if (id < 0)
+                return id;
+        source_sink_intf.bInterfaceNumber = id;
+
+        /* allocate endpoints */
+        ss->in_ep = usb_ep_autoconfig(cdev->gadget, &fs_source_desc);
+        if (!ss->in_ep) {
+autoconf_fail:
+                ERROR(cdev, "%s: can't autoconfigure on %s\n",
+                        f->name, cdev->gadget->name);
+                return -ENODEV;
+        }
+        ss->in_ep->driver_data = cdev;  /* claim */
+
+        ss->out_ep = usb_ep_autoconfig(cdev->gadget, &fs_sink_desc);
+        if (!ss->out_ep)
+                goto autoconf_fail;
+        ss->out_ep->driver_data = cdev; /* claim */
+
+        setup_timer(&ss->resume, sourcesink_autoresume,
+                        (unsigned long) c->cdev);
+
+        /* support high speed hardware */
+        if (gadget_is_dualspeed(c->cdev->gadget)) {
+                hs_source_desc.bEndpointAddress =
+                                fs_source_desc.bEndpointAddress;
+                hs_sink_desc.bEndpointAddress =
+                                fs_sink_desc.bEndpointAddress;
+                f->hs_descriptors = hs_source_sink_descs;
+        }
+
+        DBG(cdev, "%s speed %s: IN/%s, OUT/%s\n",
+                        gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
+                        f->name, ss->in_ep->name, ss->out_ep->name);
+        return 0;
+}
+
+static void
+sourcesink_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+        kfree(func_to_ss(f));
+}
+
+/* optionally require specific source/sink data patterns  */
+static int check_read_data(struct f_sourcesink *ss, struct usb_request *req)
+{
+        unsigned                i;
+        u8                      *buf = req->buf;
+        struct usb_composite_dev *cdev = ss->function.config->cdev;
+
+        for (i = 0; i < req->actual; i++, buf++) {
+                switch (pattern) {
+
+                /* all-zeroes has no synchronization issues */
+                case 0:
+                        if (*buf == 0)
+                                continue;
+                        break;
+
+                /* "mod63" stays in sync with short-terminated transfers,
+                 * OR otherwise when host and gadget agree on how large
+                 * each usb transfer request should be.  Resync is done
+                 * with set_interface or set_config.  (We *WANT* it to
+                 * get quickly out of sync if controllers or their drivers
+                 * stutter for any reason, including buffer duplcation...)
+                 */
+                case 1:
+                        if (*buf == (u8)(i % 63))
+                                continue;
+                        break;
+                }
+                ERROR(cdev, "bad OUT byte, buf[%d] = %d\n", i, *buf);
+                usb_ep_set_halt(ss->out_ep);
+                return -EINVAL;
+        }
+        return 0;
+}
+
+static void reinit_write_data(struct usb_ep *ep, struct usb_request *req)
+{
+        unsigned        i;
+        u8              *buf = req->buf;
+
+        switch (pattern) {
+        case 0:
+                memset(req->buf, 0, req->length);
+                break;
+        case 1:
+                for  (i = 0; i < req->length; i++)
+                        *buf++ = (u8) (i % 63);
+                break;
+        }
+}
+
+static void source_sink_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct f_sourcesink     *ss = ep->driver_data;
+        struct usb_composite_dev *cdev = ss->function.config->cdev;
+        int                     status = req->status;
+
+        switch (status) {
+
+        case 0:                         /* normal completion? */
+                if (ep == ss->out_ep) {
+                        check_read_data(ss, req);
+                        memset(req->buf, 0x55, req->length);
+                } else
+                        reinit_write_data(ep, req);
+                break;
+
+        /* this endpoint is normally active while we're configured */
+        case -ECONNABORTED:             /* hardware forced ep reset */
+        case -ECONNRESET:               /* request dequeued */
+        case -ESHUTDOWN:                /* disconnect from host */
+                VDBG(cdev, "%s gone (%d), %d/%d\n", ep->name, status,
+                                req->actual, req->length);
+                if (ep == ss->out_ep)
+                        check_read_data(ss, req);
+                free_ep_req(ep, req);
+                return;
+
+        case -EOVERFLOW:                /* buffer overrun on read means that
+                                         * we didn't provide a big enough
+                                         * buffer.
+                                         */
+        default:
+#if 1
+                DBG(cdev, "%s complete --> %d, %d/%d\n", ep->name,
+                                status, req->actual, req->length);
+#endif
+        case -EREMOTEIO:                /* short read */
+                break;
+        }
+
+        status = usb_ep_queue(ep, req, GFP_ATOMIC);
+        if (status) {
+                ERROR(cdev, "kill %s:  resubmit %d bytes --> %d\n",
+                                ep->name, req->length, status);
+                usb_ep_set_halt(ep);
+                /* FIXME recover later ... somehow */
+        }
+}
+
+static int source_sink_start_ep(struct f_sourcesink *ss, bool is_in)
+{
+        struct usb_ep           *ep;
+        struct usb_request      *req;
+        int                     status;
+
+        ep = is_in ? ss->in_ep : ss->out_ep;
+        req = alloc_ep_req(ep);
+        if (!req)
+                return -ENOMEM;
+
+        req->complete = source_sink_complete;
+        if (is_in)
+                reinit_write_data(ep, req);
+        else
+                memset(req->buf, 0x55, req->length);
+
+        status = usb_ep_queue(ep, req, GFP_ATOMIC);
+        if (status) {
+                struct usb_composite_dev        *cdev;
+
+                cdev = ss->function.config->cdev;
+                ERROR(cdev, "start %s %s --> %d\n",
+                                is_in ? "IN" : "OUT",
+                                ep->name, status);
+                free_ep_req(ep, req);
+        }
+
+        return status;
+}
+
+static void disable_source_sink(struct f_sourcesink *ss)
+{
+        struct usb_composite_dev        *cdev;
+
+        cdev = ss->function.config->cdev;
+        disable_endpoints(cdev, ss->in_ep, ss->out_ep);
+        del_timer(&ss->resume);
+        VDBG(cdev, "%s disabled\n", ss->function.name);
+}
+
+static int
+enable_source_sink(struct usb_composite_dev *cdev, struct f_sourcesink *ss)
+{
+        int                                     result = 0;
+        const struct usb_endpoint_descriptor    *src, *sink;
+        struct usb_ep                           *ep;
+
+        src = ep_choose(cdev->gadget, &hs_source_desc, &fs_source_desc);
+        sink = ep_choose(cdev->gadget, &hs_sink_desc, &fs_sink_desc);
+
+        /* one endpoint writes (sources) zeroes IN (to the host) */
+        ep = ss->in_ep;
+        result = usb_ep_enable(ep, src);
+        if (result < 0)
+                return result;
+        ep->driver_data = ss;
+
+        result = source_sink_start_ep(ss, true);
+        if (result < 0) {
+fail:
+                ep = ss->in_ep;
+                usb_ep_disable(ep);
+                ep->driver_data = NULL;
+                return result;
+        }
+
+        /* one endpoint reads (sinks) anything OUT (from the host) */
+        ep = ss->out_ep;
+        result = usb_ep_enable(ep, sink);
+        if (result < 0)
+                goto fail;
+        ep->driver_data = ss;
+
+        result = source_sink_start_ep(ss, false);
+        if (result < 0) {
+                usb_ep_disable(ep);
+                ep->driver_data = NULL;
+                goto fail;
+        }
+
+        DBG(cdev, "%s enabled\n", ss->function.name);
+        return result;
+}
+
+static int sourcesink_set_alt(struct usb_function *f,
+                unsigned intf, unsigned alt)
+{
+        struct f_sourcesink     *ss = func_to_ss(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+
+        /* we know alt is zero */
+        if (ss->in_ep->driver_data)
+                disable_source_sink(ss);
+        return enable_source_sink(cdev, ss);
+}
+
+static void sourcesink_disable(struct usb_function *f)
+{
+        struct f_sourcesink     *ss = func_to_ss(f);
+
+        disable_source_sink(ss);
+}
+
+static void sourcesink_suspend(struct usb_function *f)
+{
+        struct f_sourcesink     *ss = func_to_ss(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+
+        if (cdev->gadget->speed == USB_SPEED_UNKNOWN)
+                return;
+
+        if (autoresume) {
+                mod_timer(&ss->resume, jiffies + (HZ * autoresume));
+                DBG(cdev, "suspend, wakeup in %d seconds\n", autoresume);
+        } else
+                DBG(cdev, "%s\n", __func__);
+}
+
+static void sourcesink_resume(struct usb_function *f)
+{
+        struct f_sourcesink     *ss = func_to_ss(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+
+        DBG(cdev, "%s\n", __func__);
+        del_timer(&ss->resume);
+}
+
+/*-------------------------------------------------------------------------*/
+
+static int __init sourcesink_bind_config(struct usb_configuration *c)
+{
+        struct f_sourcesink     *ss;
+        int                     status;
+
+        ss = kzalloc(sizeof *ss, GFP_KERNEL);
+        if (!ss)
+                return -ENOMEM;
+
+        ss->function.name = "source/sink";
+        ss->function.descriptors = fs_source_sink_descs;
+        ss->function.bind = sourcesink_bind;
+        ss->function.unbind = sourcesink_unbind;
+        ss->function.set_alt = sourcesink_set_alt;
+        ss->function.disable = sourcesink_disable;
+        ss->function.suspend = sourcesink_suspend;
+        ss->function.resume = sourcesink_resume;
+
+        status = usb_add_function(c, &ss->function);
+        if (status)
+                kfree(ss);
+        return status;
+}
+
+static int sourcesink_setup(struct usb_configuration *c,
+                const struct usb_ctrlrequest *ctrl)
+{
+        struct usb_request      *req = c->cdev->req;
+        int                     value = -EOPNOTSUPP;
+        u16                     w_index = le16_to_cpu(ctrl->wIndex);
+        u16                     w_value = le16_to_cpu(ctrl->wValue);
+        u16                     w_length = le16_to_cpu(ctrl->wLength);
+
+        /* composite driver infrastructure handles everything except
+         * the two control test requests.
+         */
+        switch (ctrl->bRequest) {
+
+        /*
+         * These are the same vendor-specific requests supported by
+         * Intel's USB 2.0 compliance test devices.  We exceed that
+         * device spec by allowing multiple-packet requests.
+         *
+         * NOTE:  the Control-OUT data stays in req->buf ... better
+         * would be copying it into a scratch buffer, so that other
+         * requests may safely intervene.
+         */
+        case 0x5b:      /* control WRITE test -- fill the buffer */
+                if (ctrl->bRequestType != (USB_DIR_OUT|USB_TYPE_VENDOR))
+                        goto unknown;
+                if (w_value || w_index)
+                        break;
+                /* just read that many bytes into the buffer */
+                if (w_length > req->length)
+                        break;
+                value = w_length;
+                break;
+        case 0x5c:      /* control READ test -- return the buffer */
+                if (ctrl->bRequestType != (USB_DIR_IN|USB_TYPE_VENDOR))
+                        goto unknown;
+                if (w_value || w_index)
+                        break;
+                /* expect those bytes are still in the buffer; send back */
+                if (w_length > req->length)
+                        break;
+                value = w_length;
+                break;
+
+        default:
+unknown:
+                VDBG(c->cdev,
+                        "unknown control req%02x.%02x v%04x i%04x l%d\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, w_length);
+        }
+
+        /* respond with data transfer or status phase? */
+        if (value >= 0) {
+                VDBG(c->cdev, "source/sink req%02x.%02x v%04x i%04x l%d\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, w_length);
+                req->zero = 0;
+                req->length = value;
+                value = usb_ep_queue(c->cdev->gadget->ep0, req, GFP_ATOMIC);
+                if (value < 0)
+                        ERROR(c->cdev, "source/sinkc response, err %d\n",
+                                        value);
+        }
+
+        /* device either stalls (value < 0) or reports success */
+        return value;
+}
+
+static struct usb_configuration sourcesink_driver = {
+        .label          = "source/sink",
+        .strings        = sourcesink_strings,
+        .bind           = sourcesink_bind_config,
+        .setup          = sourcesink_setup,
+        .bConfigurationValue = 3,
+        .bmAttributes   = USB_CONFIG_ATT_SELFPOWER,
+        .bMaxPower      = 1,    /* 2 mA, minimal */
+        /* .iConfiguration = DYNAMIC */
+};
+
+/**
+ * sourcesink_add - add a source/sink testing configuration to a device
+ * @cdev: the device to support the configuration
+ */
+int __init sourcesink_add(struct usb_composite_dev *cdev)
+{
+        int id;
+
+        /* allocate string ID(s) */
+        id = usb_string_id(cdev);
+        if (id < 0)
+                return id;
+        strings_sourcesink[0].id = id;
+
+        source_sink_intf.iInterface = id;
+        sourcesink_driver.iConfiguration = id;
+
+        /* support autoresume for remote wakeup testing */
+        if (autoresume)
+                sourcesink_driver.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
+
+        /* support OTG systems */
+        if (gadget_is_otg(cdev->gadget)) {
+                sourcesink_driver.descriptors = otg_desc;
+                sourcesink_driver.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
+        }
+
+        return usb_add_config(cdev, &sourcesink_driver);
+}
diff --git a/drivers/usb/gadget/f_subset.c b/drivers/usb/gadget/f_subset.c
new file mode 100644
index 000000000000..afeab9a0523f
--- /dev/null
+++ b/drivers/usb/gadget/f_subset.c
@@ -0,0 +1,423 @@
+/*
+ * f_subset.c -- "CDC Subset" Ethernet link function driver
+ *
+ * Copyright (C) 2003-2005,2008 David Brownell
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/etherdevice.h>
+
+#include "u_ether.h"
+
+
+/*
+ * This function packages a simple "CDC Subset" Ethernet port with no real
+ * control mechanisms; just raw data transfer over two bulk endpoints.
+ * The data transfer model is exactly that of CDC Ethernet, which is
+ * why we call it the "CDC Subset".
+ *
+ * Because it's not standardized, this has some interoperability issues.
+ * They mostly relate to driver binding, since the data transfer model is
+ * so simple (CDC Ethernet).  The original versions of this protocol used
+ * specific product/vendor IDs:  byteswapped IDs for Digital Equipment's
+ * SA-1100 "Itsy" board, which could run Linux 2.4 kernels and supported
+ * daughtercards with USB peripheral connectors.  (It was used more often
+ * with other boards, using the Itsy identifiers.)  Linux hosts recognized
+ * this with CONFIG_USB_ARMLINUX; these devices have only one configuration
+ * and one interface.
+ *
+ * At some point, MCCI defined a (nonconformant) CDC MDLM variant called
+ * "SAFE", which happens to have a mode which is identical to the "CDC
+ * Subset" in terms of data transfer and lack of control model.  This was
+ * adopted by later Sharp Zaurus models, and by some other software which
+ * Linux hosts recognize with CONFIG_USB_NET_ZAURUS.
+ *
+ * Because Microsoft's RNDIS drivers are far from robust, we added a few
+ * descriptors to the CDC Subset code, making this code look like a SAFE
+ * implementation.  This lets you use MCCI's host side MS-Windows drivers
+ * if you get fed up with RNDIS.  It also makes it easier for composite
+ * drivers to work, since they can use class based binding instead of
+ * caring about specific product and vendor IDs.
+ */
+
+struct geth_descs {
+        struct usb_endpoint_descriptor  *in;
+        struct usb_endpoint_descriptor  *out;
+};
+
+struct f_gether {
+        struct gether                   port;
+
+        char                            ethaddr[14];
+
+        struct usb_descriptor_header    **fs_function;
+        struct geth_descs               fs;
+        struct usb_descriptor_header    **hs_function;
+        struct geth_descs               hs;
+};
+
+static inline struct f_gether *func_to_geth(struct usb_function *f)
+{
+        return container_of(f, struct f_gether, port.func);
+}
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * "Simple" CDC-subset option is a simple vendor-neutral model that most
+ * full speed controllers can handle:  one interface, two bulk endpoints.
+ * To assist host side drivers, we fancy it up a bit, and add descriptors so
+ * some host side drivers will understand it as a "SAFE" variant.
+ *
+ * "SAFE" loosely follows CDC WMC MDLM, violating the spec in various ways.
+ * Data endpoints live in the control interface, there's no data interface.
+ * And it's not used to talk to a cell phone radio.
+ */
+
+/* interface descriptor: */
+
+static struct usb_interface_descriptor subset_data_intf __initdata = {
+        .bLength =              sizeof subset_data_intf,
+        .bDescriptorType =      USB_DT_INTERFACE,
+
+        /* .bInterfaceNumber = DYNAMIC */
+        .bAlternateSetting =    0,
+        .bNumEndpoints =        2,
+        .bInterfaceClass =      USB_CLASS_COMM,
+        .bInterfaceSubClass =   USB_CDC_SUBCLASS_MDLM,
+        .bInterfaceProtocol =   0,
+        /* .iInterface = DYNAMIC */
+};
+
+static struct usb_cdc_header_desc header_desc __initdata = {
+        .bLength =              sizeof header_desc,
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubType =   USB_CDC_HEADER_TYPE,
+
+        .bcdCDC =               __constant_cpu_to_le16(0x0110),
+};
+
+static struct usb_cdc_mdlm_desc mdlm_desc __initdata = {
+        .bLength =              sizeof mdlm_desc,
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubType =   USB_CDC_MDLM_TYPE,
+
+        .bcdVersion =           __constant_cpu_to_le16(0x0100),
+        .bGUID = {
+                0x5d, 0x34, 0xcf, 0x66, 0x11, 0x18, 0x11, 0xd6,
+                0xa2, 0x1a, 0x00, 0x01, 0x02, 0xca, 0x9a, 0x7f,
+        },
+};
+
+/* since "usb_cdc_mdlm_detail_desc" is a variable length structure, we
+ * can't really use its struct.  All we do here is say that we're using
+ * the submode of "SAFE" which directly matches the CDC Subset.
+ */
+static u8 mdlm_detail_desc[] __initdata = {
+        6,
+        USB_DT_CS_INTERFACE,
+        USB_CDC_MDLM_DETAIL_TYPE,
+
+        0,      /* "SAFE" */
+        0,      /* network control capabilities (none) */
+        0,      /* network data capabilities ("raw" encapsulation) */
+};
+
+static struct usb_cdc_ether_desc ether_desc __initdata = {
+        .bLength =              sizeof ether_desc,
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubType =   USB_CDC_ETHERNET_TYPE,
+
+        /* this descriptor actually adds value, surprise! */
+        /* .iMACAddress = DYNAMIC */
+        .bmEthernetStatistics = __constant_cpu_to_le32(0), /* no statistics */
+        .wMaxSegmentSize =      __constant_cpu_to_le16(ETH_FRAME_LEN),
+        .wNumberMCFilters =     __constant_cpu_to_le16(0),
+        .bNumberPowerFilters =  0,
+};
+
+/* full speed support: */
+
+static struct usb_endpoint_descriptor fs_in_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_endpoint_descriptor fs_out_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_OUT,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_descriptor_header *fs_eth_function[] __initdata = {
+        (struct usb_descriptor_header *) &subset_data_intf,
+        (struct usb_descriptor_header *) &header_desc,
+        (struct usb_descriptor_header *) &mdlm_desc,
+        (struct usb_descriptor_header *) &mdlm_detail_desc,
+        (struct usb_descriptor_header *) &ether_desc,
+        (struct usb_descriptor_header *) &fs_in_desc,
+        (struct usb_descriptor_header *) &fs_out_desc,
+        NULL,
+};
+
+/* high speed support: */
+
+static struct usb_endpoint_descriptor hs_in_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize =       __constant_cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor hs_out_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize =       __constant_cpu_to_le16(512),
+};
+
+static struct usb_descriptor_header *hs_eth_function[] __initdata = {
+        (struct usb_descriptor_header *) &subset_data_intf,
+        (struct usb_descriptor_header *) &header_desc,
+        (struct usb_descriptor_header *) &mdlm_desc,
+        (struct usb_descriptor_header *) &mdlm_detail_desc,
+        (struct usb_descriptor_header *) &ether_desc,
+        (struct usb_descriptor_header *) &hs_in_desc,
+        (struct usb_descriptor_header *) &hs_out_desc,
+        NULL,
+};
+
+/* string descriptors: */
+
+static struct usb_string geth_string_defs[] = {
+        [0].s = "CDC Ethernet Subset/SAFE",
+        [1].s = NULL /* DYNAMIC */,
+        {  } /* end of list */
+};
+
+static struct usb_gadget_strings geth_string_table = {
+        .language =             0x0409, /* en-us */
+        .strings =              geth_string_defs,
+};
+
+static struct usb_gadget_strings *geth_strings[] = {
+        &geth_string_table,
+        NULL,
+};
+
+/*-------------------------------------------------------------------------*/
+
+static int geth_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
+{
+        struct f_gether         *geth = func_to_geth(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+        struct net_device       *net;
+
+        /* we know alt == 0, so this is an activation or a reset */
+
+        if (geth->port.in_ep->driver_data) {
+                DBG(cdev, "reset cdc subset\n");
+                gether_disconnect(&geth->port);
+        }
+
+        DBG(cdev, "init + activate cdc subset\n");
+        geth->port.in = ep_choose(cdev->gadget,
+                        geth->hs.in, geth->fs.in);
+        geth->port.out = ep_choose(cdev->gadget,
+                        geth->hs.out, geth->fs.out);
+
+        net = gether_connect(&geth->port);
+        return IS_ERR(net) ? PTR_ERR(net) : 0;
+}
+
+static void geth_disable(struct usb_function *f)
+{
+        struct f_gether *geth = func_to_geth(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+
+        DBG(cdev, "net deactivated\n");
+        gether_disconnect(&geth->port);
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* serial function driver setup/binding */
+
+static int __init
+geth_bind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct usb_composite_dev *cdev = c->cdev;
+        struct f_gether         *geth = func_to_geth(f);
+        int                     status;
+        struct usb_ep           *ep;
+
+        /* allocate instance-specific interface IDs */
+        status = usb_interface_id(c, f);
+        if (status < 0)
+                goto fail;
+        subset_data_intf.bInterfaceNumber = status;
+
+        status = -ENODEV;
+
+        /* allocate instance-specific endpoints */
+        ep = usb_ep_autoconfig(cdev->gadget, &fs_in_desc);
+        if (!ep)
+                goto fail;
+        geth->port.in_ep = ep;
+        ep->driver_data = cdev; /* claim */
+
+        ep = usb_ep_autoconfig(cdev->gadget, &fs_out_desc);
+        if (!ep)
+                goto fail;
+        geth->port.out_ep = ep;
+        ep->driver_data = cdev; /* claim */
+
+        /* copy descriptors, and track endpoint copies */
+        f->descriptors = usb_copy_descriptors(fs_eth_function);
+
+        geth->fs.in = usb_find_endpoint(fs_eth_function,
+                        f->descriptors, &fs_in_desc);
+        geth->fs.out = usb_find_endpoint(fs_eth_function,
+                        f->descriptors, &fs_out_desc);
+
+
+        /* support all relevant hardware speeds... we expect that when
+         * hardware is dual speed, all bulk-capable endpoints work at
+         * both speeds
+         */
+        if (gadget_is_dualspeed(c->cdev->gadget)) {
+                hs_in_desc.bEndpointAddress =
+                                fs_in_desc.bEndpointAddress;
+                hs_out_desc.bEndpointAddress =
+                                fs_out_desc.bEndpointAddress;
+
+                /* copy descriptors, and track endpoint copies */
+                f->hs_descriptors = usb_copy_descriptors(hs_eth_function);
+
+                geth->hs.in = usb_find_endpoint(hs_eth_function,
+                                f->hs_descriptors, &hs_in_desc);
+                geth->hs.out = usb_find_endpoint(hs_eth_function,
+                                f->hs_descriptors, &hs_out_desc);
+        }
+
+        /* NOTE:  all that is done without knowing or caring about
+         * the network link ... which is unavailable to this code
+         * until we're activated via set_alt().
+         */
+
+        DBG(cdev, "CDC Subset: %s speed IN/%s OUT/%s\n",
+                        gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
+                        geth->port.in_ep->name, geth->port.out_ep->name);
+        return 0;
+
+fail:
+        /* we might as well release our claims on endpoints */
+        if (geth->port.out)
+                geth->port.out_ep->driver_data = NULL;
+        if (geth->port.in)
+                geth->port.in_ep->driver_data = NULL;
+
+        ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
+
+        return status;
+}
+
+static void
+geth_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+        if (gadget_is_dualspeed(c->cdev->gadget))
+                usb_free_descriptors(f->hs_descriptors);
+        usb_free_descriptors(f->descriptors);
+        geth_string_defs[1].s = NULL;
+        kfree(func_to_geth(f));
+}
+
+/**
+ * geth_bind_config - add CDC Subset network link to a configuration
+ * @c: the configuration to support the network link
+ * @ethaddr: a buffer in which the ethernet address of the host side
+ *      side of the link was recorded
+ * Context: single threaded during gadget setup
+ *
+ * Returns zero on success, else negative errno.
+ *
+ * Caller must have called @gether_setup().  Caller is also responsible
+ * for calling @gether_cleanup() before module unload.
+ */
+int __init geth_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN])
+{
+        struct f_gether *geth;
+        int             status;
+
+        if (!ethaddr)
+                return -EINVAL;
+
+        /* maybe allocate device-global string IDs */
+        if (geth_string_defs[0].id == 0) {
+
+                /* interface label */
+                status = usb_string_id(c->cdev);
+                if (status < 0)
+                        return status;
+                geth_string_defs[0].id = status;
+                subset_data_intf.iInterface = status;
+
+                /* MAC address */
+                status = usb_string_id(c->cdev);
+                if (status < 0)
+                        return status;
+                geth_string_defs[1].id = status;
+                ether_desc.iMACAddress = status;
+        }
+
+        /* allocate and initialize one new instance */
+        geth = kzalloc(sizeof *geth, GFP_KERNEL);
+        if (!geth)
+                return -ENOMEM;
+
+        /* export host's Ethernet address in CDC format */
+        snprintf(geth->ethaddr, sizeof geth->ethaddr,
+                "%02X%02X%02X%02X%02X%02X",
+                ethaddr[0], ethaddr[1], ethaddr[2],
+                ethaddr[3], ethaddr[4], ethaddr[5]);
+        geth_string_defs[1].s = geth->ethaddr;
+
+        geth->port.cdc_filter = DEFAULT_FILTER;
+
+        geth->port.func.name = "cdc_subset";
+        geth->port.func.strings = geth_strings;
+        geth->port.func.bind = geth_bind;
+        geth->port.func.unbind = geth_unbind;
+        geth->port.func.set_alt = geth_set_alt;
+        geth->port.func.disable = geth_disable;
+
+        status = usb_add_function(c, &geth->port.func);
+        if (status) {
+                geth_string_defs[1].s = NULL;
+                kfree(geth);
+        }
+        return status;
+}
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
index 47bb9f09a1aa..15c24edbb61a 100644
--- a/drivers/usb/gadget/file_storage.c
+++ b/drivers/usb/gadget/file_storage.c
@@ -3867,8 +3867,8 @@ static int __init fsg_bind(struct usb_gadget *gadget)
                 curlun->dev.parent = &gadget->dev;
                 curlun->dev.driver = &fsg_driver.driver;
                 dev_set_drvdata(&curlun->dev, fsg);
-                snprintf(curlun->dev.bus_id, BUS_ID_SIZE,
-                                "%s-lun%d", gadget->dev.bus_id, i);
+                dev_set_name(&curlun->dev,"%s-lun%d",
+                             dev_name(&gadget->dev), i);
 
                 if ((rc = device_register(&curlun->dev)) != 0) {
                         INFO(fsg, "failed to register LUN%d: %d\n", i, rc);
diff --git a/drivers/usb/gadget/fsl_usb2_udc.c b/drivers/usb/gadget/fsl_usb2_udc.c
index 18687543d7fa..1695382f30fe 100644
--- a/drivers/usb/gadget/fsl_usb2_udc.c
+++ b/drivers/usb/gadget/fsl_usb2_udc.c
@@ -2331,7 +2331,7 @@ static int __init fsl_udc_probe(struct platform_device *pdev)
         udc_controller->gadget.name = driver_name;
 
         /* Setup gadget.dev and register with kernel */
-        strcpy(udc_controller->gadget.dev.bus_id, "gadget");
+        dev_set_name(&udc_controller->gadget.dev, "gadget");
         udc_controller->gadget.dev.release = fsl_udc_release;
         udc_controller->gadget.dev.parent = &pdev->dev;
         ret = device_register(&udc_controller->gadget.dev);
diff --git a/drivers/usb/gadget/g_zero.h b/drivers/usb/gadget/g_zero.h
new file mode 100644
index 000000000000..dd2f16ad5a88
--- /dev/null
+++ b/drivers/usb/gadget/g_zero.h
@@ -0,0 +1,25 @@
+/*
+ * This header declares the utility functions used by "Gadget Zero", plus
+ * interfaces to its two single-configuration function drivers.
+ */
+
+#ifndef __G_ZERO_H
+#define __G_ZERO_H
+
+#include <linux/usb/composite.h>
+
+/* global state */
+extern unsigned buflen;
+extern const struct usb_descriptor_header *otg_desc[];
+
+/* common utilities */
+struct usb_request *alloc_ep_req(struct usb_ep *ep);
+void free_ep_req(struct usb_ep *ep, struct usb_request *req);
+void disable_endpoints(struct usb_composite_dev *cdev,
+                struct usb_ep *in, struct usb_ep *out);
+
+/* configuration-specific linkup */
+int sourcesink_add(struct usb_composite_dev *cdev);
+int loopback_add(struct usb_composite_dev *cdev);
+
+#endif /* __G_ZERO_H */
diff --git a/drivers/usb/gadget/gadget_chips.h b/drivers/usb/gadget/gadget_chips.h
index ca5149ea7312..5246e8fef2b2 100644
--- a/drivers/usb/gadget/gadget_chips.h
+++ b/drivers/usb/gadget/gadget_chips.h
@@ -214,3 +214,26 @@ static inline int usb_gadget_controller_number(struct usb_gadget *gadget)
                 return 0x21;
         return -ENOENT;
 }
+
+
+/**
+ * gadget_supports_altsettings - return true if altsettings work
+ * @gadget: the gadget in question
+ */
+static inline bool gadget_supports_altsettings(struct usb_gadget *gadget)
+{
+        /* PXA 21x/25x/26x has no altsettings at all */
+        if (gadget_is_pxa(gadget))
+                return false;
+
+        /* PXA 27x and 3xx have *broken* altsetting support */
+        if (gadget_is_pxa27x(gadget))
+                return false;
+
+        /* SH3 hardware just doesn't do altsettings */
+        if (gadget_is_sh(gadget))
+                return false;
+
+        /* Everything else is *presumably* fine ... */
+        return true;
+}
diff --git a/drivers/usb/gadget/goku_udc.c b/drivers/usb/gadget/goku_udc.c
index be6613afedbf..48f1c63b7013 100644
--- a/drivers/usb/gadget/goku_udc.c
+++ b/drivers/usb/gadget/goku_udc.c
@@ -1790,7 +1790,7 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         dev->gadget.ops = &goku_ops;
 
         /* the "gadget" abstracts/virtualizes the controller */
-        strcpy(dev->gadget.dev.bus_id, "gadget");
+        dev_set_name(&dev->gadget.dev, "gadget");
         dev->gadget.dev.parent = &pdev->dev;
         dev->gadget.dev.dma_mask = pdev->dev.dma_mask;
         dev->gadget.dev.release = gadget_release;
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index f132a9219e11..04692d59fc1c 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -32,6 +32,7 @@
 #include <asm/uaccess.h>
 #include <linux/slab.h>
 #include <linux/poll.h>
+#include <linux/smp_lock.h>
 
 #include <linux/device.h>
 #include <linux/moduleparam.h>
@@ -483,8 +484,7 @@ ep_release (struct inode *inode, struct file *fd)
         return 0;
 }
 
-static int ep_ioctl (struct inode *inode, struct file *fd,
-                unsigned code, unsigned long value)
+static long ep_ioctl(struct file *fd, unsigned code, unsigned long value)
 {
         struct ep_data          *data = fd->private_data;
         int                     status;
@@ -740,7 +740,7 @@ static const struct file_operations ep_io_operations = {
 
         .read =         ep_read,
         .write =        ep_write,
-        .ioctl =        ep_ioctl,
+        .unlocked_ioctl = ep_ioctl,
         .release =      ep_release,
 
         .aio_read =     ep_aio_read,
@@ -1294,15 +1294,18 @@ out:
        return mask;
 }
 
-static int dev_ioctl (struct inode *inode, struct file *fd,
-                unsigned code, unsigned long value)
+static long dev_ioctl (struct file *fd, unsigned code, unsigned long value)
 {
         struct dev_data         *dev = fd->private_data;
         struct usb_gadget       *gadget = dev->gadget;
+        long ret = -ENOTTY;
 
-        if (gadget->ops->ioctl)
-                return gadget->ops->ioctl (gadget, code, value);
-        return -ENOTTY;
+        if (gadget->ops->ioctl) {
+                lock_kernel();
+                ret = gadget->ops->ioctl (gadget, code, value);
+                unlock_kernel();
+        }
+        return ret;
 }
 
 /* used after device configuration */
@@ -1314,7 +1317,7 @@ static const struct file_operations ep0_io_operations = {
         .write =        ep0_write,
         .fasync =       ep0_fasync,
         .poll =         ep0_poll,
-        .ioctl =        dev_ioctl,
+        .unlocked_ioctl =       dev_ioctl,
         .release =      dev_release,
 };
 
@@ -1964,7 +1967,7 @@ static const struct file_operations dev_init_operations = {
         .open =         dev_open,
         .write =        dev_config,
         .fasync =       ep0_fasync,
-        .ioctl =        dev_ioctl,
+        .unlocked_ioctl = dev_ioctl,
         .release =      dev_release,
 };
 
diff --git a/drivers/usb/gadget/lh7a40x_udc.c b/drivers/usb/gadget/lh7a40x_udc.c
index 825abd2621b3..c6e7df04c69a 100644
--- a/drivers/usb/gadget/lh7a40x_udc.c
+++ b/drivers/usb/gadget/lh7a40x_udc.c
@@ -1970,7 +1970,7 @@ static const struct usb_gadget_ops lh7a40x_udc_ops = {
 
 static void nop_release(struct device *dev)
 {
-        DEBUG("%s %s\n", __func__, dev->bus_id);
+        DEBUG("%s %s\n", __func__, dev_name(dev));
 }
 
 static struct lh7a40x_udc memory = {
diff --git a/drivers/usb/gadget/m66592-udc.c b/drivers/usb/gadget/m66592-udc.c
index ee6b35fa870f..8da7535c0c70 100644
--- a/drivers/usb/gadget/m66592-udc.c
+++ b/drivers/usb/gadget/m66592-udc.c
@@ -1593,7 +1593,7 @@ static int __init m66592_probe(struct platform_device *pdev)
 
         m66592->gadget.ops = &m66592_gadget_ops;
         device_initialize(&m66592->gadget.dev);
-        strcpy(m66592->gadget.dev.bus_id, "gadget");
+        dev_set_name(&m66592->gadget, "gadget");
         m66592->gadget.is_dualspeed = 1;
         m66592->gadget.dev.parent = &pdev->dev;
         m66592->gadget.dev.dma_mask = pdev->dev.dma_mask;
diff --git a/drivers/usb/gadget/ndis.h b/drivers/usb/gadget/ndis.h
index 09e3ee4eeae1..df886cec5ef4 100644
--- a/drivers/usb/gadget/ndis.h
+++ b/drivers/usb/gadget/ndis.h
@@ -1,11 +1,11 @@
 /*
- * ndis.h 
- * 
+ * ndis.h
+ *
  * ntddndis.h modified by Benedikt Spranger <b.spranger@pengutronix.de>
- * 
- * Thanks to the cygwin development team, 
+ *
+ * Thanks to the cygwin development team,
  * espacially to Casper S. Hornstrup <chorns@users.sourceforge.net>
- * 
+ *
  * THIS SOFTWARE IS NOT COPYRIGHTED
  *
  * This source code is offered for use in the public domain. You may
diff --git a/drivers/usb/gadget/net2280.c b/drivers/usb/gadget/net2280.c
index e01862300169..b67ab677af72 100644
--- a/drivers/usb/gadget/net2280.c
+++ b/drivers/usb/gadget/net2280.c
@@ -2768,7 +2768,7 @@ static int net2280_probe (struct pci_dev *pdev, const struct pci_device_id *id)
         dev->gadget.is_dualspeed = 1;
 
         /* the "gadget" abstracts/virtualizes the controller */
-        strcpy (dev->gadget.dev.bus_id, "gadget");
+        dev_set_name(&dev->gadget.dev, "gadget");
         dev->gadget.dev.parent = &pdev->dev;
         dev->gadget.dev.dma_mask = pdev->dev.dma_mask;
         dev->gadget.dev.release = gadget_release;
diff --git a/drivers/usb/gadget/omap_udc.c b/drivers/usb/gadget/omap_udc.c
index 03a7f49d207d..4b79a8509e84 100644
--- a/drivers/usb/gadget/omap_udc.c
+++ b/drivers/usb/gadget/omap_udc.c
@@ -2686,7 +2686,7 @@ omap_udc_setup(struct platform_device *odev, struct otg_transceiver *xceiv)
         udc->gadget.name = driver_name;
 
         device_initialize(&udc->gadget.dev);
-        strcpy (udc->gadget.dev.bus_id, "gadget");
+        dev_set_name(&udc->gadget.dev, "gadget");
         udc->gadget.dev.release = omap_udc_release;
         udc->gadget.dev.parent = &odev->dev;
         if (use_dma)
diff --git a/drivers/usb/gadget/printer.c b/drivers/usb/gadget/printer.c
index ec8f2eb041ca..9caaec3ae9a3 100644
--- a/drivers/usb/gadget/printer.c
+++ b/drivers/usb/gadget/printer.c
@@ -828,9 +828,8 @@ printer_poll(struct file *fd, poll_table *wait)
         return status;
 }
 
-static int
-printer_ioctl(struct inode *inode, struct file *fd, unsigned int code,
-                unsigned long arg)
+static long
+printer_ioctl(struct file *fd, unsigned int code, unsigned long arg)
 {
         struct printer_dev      *dev = fd->private_data;
         unsigned long           flags;
@@ -869,7 +868,7 @@ static struct file_operations printer_io_operations = {
         .write =        printer_write,
         .fsync =        printer_fsync,
         .poll =         printer_poll,
-        .ioctl =        printer_ioctl,
+        .unlocked_ioctl = printer_ioctl,
         .release =      printer_close
 };
 
diff --git a/drivers/usb/gadget/pxa25x_udc.c b/drivers/usb/gadget/pxa25x_udc.c
index 031dceb93023..fbd6289977c8 100644
--- a/drivers/usb/gadget/pxa25x_udc.c
+++ b/drivers/usb/gadget/pxa25x_udc.c
@@ -1818,7 +1818,7 @@ pxa25x_udc_irq(int irq, void *_dev)
 
 static void nop_release (struct device *dev)
 {
-        DMSG("%s %s\n", __func__, dev->bus_id);
+        DMSG("%s %s\n", __func__, dev_name(dev));
 }
 
 /* this uses load-time allocation and initialization (instead of
diff --git a/drivers/usb/gadget/pxa27x_udc.c b/drivers/usb/gadget/pxa27x_udc.c
index 9c0e82ec5c43..9d447d8cfc0c 100644
--- a/drivers/usb/gadget/pxa27x_udc.c
+++ b/drivers/usb/gadget/pxa27x_udc.c
@@ -1575,7 +1575,6 @@ static void udc_enable(struct pxa_udc *udc)
 {
         udc_writel(udc, UDCICR0, 0);
         udc_writel(udc, UDCICR1, 0);
-        udc_writel(udc, UP2OCR, UP2OCR_HXOE);
         udc_clear_mask_UDCCR(udc, UDCCR_UDE);
 
         clk_enable(udc->clk);
diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c
index d0677f5d3cd5..7228e8562236 100644
--- a/drivers/usb/gadget/rndis.c
+++ b/drivers/usb/gadget/rndis.c
@@ -1,8 +1,6 @@
 /*
  * RNDIS MSG parser
  *
- * Version:     $Id: rndis.c,v 1.19 2004/03/25 21:33:46 robert Exp $
- *
  * Authors:     Benedikt Spranger, Pengutronix
  *              Robert Schwebel, Pengutronix
  *
@@ -30,6 +28,7 @@
 #include <linux/init.h>
 #include <linux/list.h>
 #include <linux/proc_fs.h>
+#include <linux/seq_file.h>
 #include <linux/netdevice.h>
 
 #include <asm/io.h>
@@ -38,9 +37,7 @@
 #include <asm/unaligned.h>
 
 
-#undef  RNDIS_PM
-#undef  RNDIS_WAKEUP
-#undef  VERBOSE
+#undef  VERBOSE_DEBUG
 
 #include "rndis.h"
 
@@ -96,9 +93,6 @@ static const u32 oid_supported_list [] =
         OID_GEN_MAXIMUM_TOTAL_SIZE,
         OID_GEN_MEDIA_CONNECT_STATUS,
         OID_GEN_PHYSICAL_MEDIUM,
-#if 0
-        OID_GEN_RNDIS_CONFIG_PARAMETER,
-#endif
 
         /* the statistical stuff */
         OID_GEN_XMIT_OK,
@@ -146,7 +140,14 @@ static const u32 oid_supported_list [] =
 #endif  /* RNDIS_OPTIONAL_STATS */
 
 #ifdef  RNDIS_PM
-        /* PM and wakeup are mandatory for USB: */
+        /* PM and wakeup are "mandatory" for USB, but the RNDIS specs
+         * don't say what they mean ... and the NDIS specs are often
+         * confusing and/or ambiguous in this context.  (That is, more
+         * so than their specs for the other OIDs.)
+         *
+         * FIXME someone who knows what these should do, please
+         * implement them!
+         */
 
         /* power management */
         OID_PNP_CAPABILITIES,
@@ -173,6 +174,8 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         __le32                  *outbuf;
         int                     i, count;
         rndis_query_cmplt_type  *resp;
+        struct net_device       *net;
+        struct net_device_stats *stats;
 
         if (!r) return -ENOMEM;
         resp = (rndis_query_cmplt_type *) r->buf;
@@ -194,6 +197,12 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         outbuf = (__le32 *) &resp[1];
         resp->InformationBufferOffset = __constant_cpu_to_le32 (16);
 
+        net = rndis_per_dev_params[configNr].dev;
+        if (net->get_stats)
+                stats = net->get_stats(net);
+        else
+                stats = NULL;
+
         switch (OID) {
 
         /* general oids (table 4-1) */
@@ -350,11 +359,9 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         case OID_GEN_XMIT_OK:
                 if (rndis_debug > 1)
                         DBG("%s: OID_GEN_XMIT_OK\n", __func__);
-                if (rndis_per_dev_params [configNr].stats) {
-                        *outbuf = cpu_to_le32 (
-                            rndis_per_dev_params [configNr].stats->tx_packets -
-                            rndis_per_dev_params [configNr].stats->tx_errors -
-                            rndis_per_dev_params [configNr].stats->tx_dropped);
+                if (stats) {
+                        *outbuf = cpu_to_le32(stats->tx_packets
+                                - stats->tx_errors - stats->tx_dropped);
                         retval = 0;
                 }
                 break;
@@ -363,11 +370,9 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         case OID_GEN_RCV_OK:
                 if (rndis_debug > 1)
                         DBG("%s: OID_GEN_RCV_OK\n", __func__);
-                if (rndis_per_dev_params [configNr].stats) {
-                        *outbuf = cpu_to_le32 (
-                            rndis_per_dev_params [configNr].stats->rx_packets -
-                            rndis_per_dev_params [configNr].stats->rx_errors -
-                            rndis_per_dev_params [configNr].stats->rx_dropped);
+                if (stats) {
+                        *outbuf = cpu_to_le32(stats->rx_packets
+                                - stats->rx_errors - stats->rx_dropped);
                         retval = 0;
                 }
                 break;
@@ -376,9 +381,8 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         case OID_GEN_XMIT_ERROR:
                 if (rndis_debug > 1)
                         DBG("%s: OID_GEN_XMIT_ERROR\n", __func__);
-                if (rndis_per_dev_params [configNr].stats) {
-                        *outbuf = cpu_to_le32 (rndis_per_dev_params [configNr]
-                                        .stats->tx_errors);
+                if (stats) {
+                        *outbuf = cpu_to_le32(stats->tx_errors);
                         retval = 0;
                 }
                 break;
@@ -387,9 +391,8 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         case OID_GEN_RCV_ERROR:
                 if (rndis_debug > 1)
                         DBG("%s: OID_GEN_RCV_ERROR\n", __func__);
-                if (rndis_per_dev_params [configNr].stats) {
-                        *outbuf = cpu_to_le32 (rndis_per_dev_params [configNr]
-                                        .stats->rx_errors);
+                if (stats) {
+                        *outbuf = cpu_to_le32(stats->rx_errors);
                         retval = 0;
                 }
                 break;
@@ -397,150 +400,12 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         /* mandatory */
         case OID_GEN_RCV_NO_BUFFER:
                 DBG("%s: OID_GEN_RCV_NO_BUFFER\n", __func__);
-                if (rndis_per_dev_params [configNr].stats) {
-                        *outbuf = cpu_to_le32 (rndis_per_dev_params [configNr]
-                                        .stats->rx_dropped);
-                        retval = 0;
-                }
-                break;
-
-#ifdef  RNDIS_OPTIONAL_STATS
-        case OID_GEN_DIRECTED_BYTES_XMIT:
-                DBG("%s: OID_GEN_DIRECTED_BYTES_XMIT\n", __func__);
-                /*
-                 * Aunt Tilly's size of shoes
-                 * minus antarctica count of penguins
-                 * divided by weight of Alpha Centauri
-                 */
-                if (rndis_per_dev_params [configNr].stats) {
-                        *outbuf = cpu_to_le32 (
-                                (rndis_per_dev_params [configNr]
-                                        .stats->tx_packets -
-                                 rndis_per_dev_params [configNr]
-                                         .stats->tx_errors -
-                                 rndis_per_dev_params [configNr]
-                                         .stats->tx_dropped)
-                                * 123);
-                        retval = 0;
-                }
-                break;
-
-        case OID_GEN_DIRECTED_FRAMES_XMIT:
-                DBG("%s: OID_GEN_DIRECTED_FRAMES_XMIT\n", __func__);
-                /* dito */
-                if (rndis_per_dev_params [configNr].stats) {
-                        *outbuf = cpu_to_le32 (
-                                (rndis_per_dev_params [configNr]
-                                        .stats->tx_packets -
-                                 rndis_per_dev_params [configNr]
-                                         .stats->tx_errors -
-                                 rndis_per_dev_params [configNr]
-                                         .stats->tx_dropped)
-                                / 123);
-                        retval = 0;
-                }
-                break;
-
-        case OID_GEN_MULTICAST_BYTES_XMIT:
-                DBG("%s: OID_GEN_MULTICAST_BYTES_XMIT\n", __func__);
-                if (rndis_per_dev_params [configNr].stats) {
-                        *outbuf = cpu_to_le32 (rndis_per_dev_params [configNr]
-                                        .stats->multicast*1234);
-                        retval = 0;
-                }
-                break;
-
-        case OID_GEN_MULTICAST_FRAMES_XMIT:
-                DBG("%s: OID_GEN_MULTICAST_FRAMES_XMIT\n", __func__);
-                if (rndis_per_dev_params [configNr].stats) {
-                        *outbuf = cpu_to_le32 (rndis_per_dev_params [configNr]
-                                        .stats->multicast);
-                        retval = 0;
-                }
-                break;
-
-        case OID_GEN_BROADCAST_BYTES_XMIT:
-                DBG("%s: OID_GEN_BROADCAST_BYTES_XMIT\n", __func__);
-                if (rndis_per_dev_params [configNr].stats) {
-                        *outbuf = cpu_to_le32 (rndis_per_dev_params [configNr]
-                                        .stats->tx_packets/42*255);
-                        retval = 0;
-                }
-                break;
-
-        case OID_GEN_BROADCAST_FRAMES_XMIT:
-                DBG("%s: OID_GEN_BROADCAST_FRAMES_XMIT\n", __func__);
-                if (rndis_per_dev_params [configNr].stats) {
-                        *outbuf = cpu_to_le32 (rndis_per_dev_params [configNr]
-                                        .stats->tx_packets/42);
-                        retval = 0;
-                }
-                break;
-
-        case OID_GEN_DIRECTED_BYTES_RCV:
-                DBG("%s: OID_GEN_DIRECTED_BYTES_RCV\n", __func__);
-                *outbuf = __constant_cpu_to_le32 (0);
-                retval = 0;
-                break;
-
-        case OID_GEN_DIRECTED_FRAMES_RCV:
-                DBG("%s: OID_GEN_DIRECTED_FRAMES_RCV\n", __func__);
-                *outbuf = __constant_cpu_to_le32 (0);
-                retval = 0;
-                break;
-
-        case OID_GEN_MULTICAST_BYTES_RCV:
-                DBG("%s: OID_GEN_MULTICAST_BYTES_RCV\n", __func__);
-                if (rndis_per_dev_params [configNr].stats) {
-                        *outbuf = cpu_to_le32 (rndis_per_dev_params [configNr]
-                                        .stats->multicast * 1111);
-                        retval = 0;
-                }
-                break;
-
-        case OID_GEN_MULTICAST_FRAMES_RCV:
-                DBG("%s: OID_GEN_MULTICAST_FRAMES_RCV\n", __func__);
-                if (rndis_per_dev_params [configNr].stats) {
-                        *outbuf = cpu_to_le32 (rndis_per_dev_params [configNr]
-                                        .stats->multicast);
-                        retval = 0;
-                }
-                break;
-
-        case OID_GEN_BROADCAST_BYTES_RCV:
-                DBG("%s: OID_GEN_BROADCAST_BYTES_RCV\n", __func__);
-                if (rndis_per_dev_params [configNr].stats) {
-                        *outbuf = cpu_to_le32 (rndis_per_dev_params [configNr]
-                                        .stats->rx_packets/42*255);
-                        retval = 0;
-                }
-                break;
-
-        case OID_GEN_BROADCAST_FRAMES_RCV:
-                DBG("%s: OID_GEN_BROADCAST_FRAMES_RCV\n", __func__);
-                if (rndis_per_dev_params [configNr].stats) {
-                        *outbuf = cpu_to_le32 (rndis_per_dev_params [configNr]
-                                        .stats->rx_packets/42);
+                if (stats) {
+                        *outbuf = cpu_to_le32(stats->rx_dropped);
                         retval = 0;
                 }
                 break;
 
-        case OID_GEN_RCV_CRC_ERROR:
-                DBG("%s: OID_GEN_RCV_CRC_ERROR\n", __func__);
-                if (rndis_per_dev_params [configNr].stats) {
-                        *outbuf = cpu_to_le32 (rndis_per_dev_params [configNr]
-                                        .stats->rx_crc_errors);
-                        retval = 0;
-                }
-                break;
-
-        case OID_GEN_TRANSMIT_QUEUE_LENGTH:
-                DBG("%s: OID_GEN_TRANSMIT_QUEUE_LENGTH\n", __func__);
-                *outbuf = __constant_cpu_to_le32 (0);
-                retval = 0;
-                break;
-#endif  /* RNDIS_OPTIONAL_STATS */
-
         /* ieee802.3 OIDs (table 4-3) */
 
         /* mandatory */
@@ -592,9 +457,8 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         /* mandatory */
         case OID_802_3_RCV_ERROR_ALIGNMENT:
                 DBG("%s: OID_802_3_RCV_ERROR_ALIGNMENT\n", __func__);
-                if (rndis_per_dev_params [configNr].stats) {
-                        *outbuf = cpu_to_le32 (rndis_per_dev_params [configNr]
-                                        .stats->rx_frame_errors);
+                if (stats) {
+                        *outbuf = cpu_to_le32(stats->rx_frame_errors);
                         retval = 0;
                 }
                 break;
@@ -613,64 +477,6 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                 retval = 0;
                 break;
 
-#ifdef  RNDIS_OPTIONAL_STATS
-        case OID_802_3_XMIT_DEFERRED:
-                DBG("%s: OID_802_3_XMIT_DEFERRED\n", __func__);
-                /* TODO */
-                break;
-
-        case OID_802_3_XMIT_MAX_COLLISIONS:
-                DBG("%s: OID_802_3_XMIT_MAX_COLLISIONS\n", __func__);
-                /* TODO */
-                break;
-
-        case OID_802_3_RCV_OVERRUN:
-                DBG("%s: OID_802_3_RCV_OVERRUN\n", __func__);
-                /* TODO */
-                break;
-
-        case OID_802_3_XMIT_UNDERRUN:
-                DBG("%s: OID_802_3_XMIT_UNDERRUN\n", __func__);
-                /* TODO */
-                break;
-
-        case OID_802_3_XMIT_HEARTBEAT_FAILURE:
-                DBG("%s: OID_802_3_XMIT_HEARTBEAT_FAILURE\n", __func__);
-                /* TODO */
-                break;
-
-        case OID_802_3_XMIT_TIMES_CRS_LOST:
-                DBG("%s: OID_802_3_XMIT_TIMES_CRS_LOST\n", __func__);
-                /* TODO */
-                break;
-
-        case OID_802_3_XMIT_LATE_COLLISIONS:
-                DBG("%s: OID_802_3_XMIT_LATE_COLLISIONS\n", __func__);
-                /* TODO */
-                break;
-#endif  /* RNDIS_OPTIONAL_STATS */
-
-#ifdef  RNDIS_PM
-        /* power management OIDs (table 4-5) */
-        case OID_PNP_CAPABILITIES:
-                DBG("%s: OID_PNP_CAPABILITIES\n", __func__);
-
-                /* for now, no wakeup capabilities */
-                length = sizeof (struct NDIS_PNP_CAPABILITIES);
-                memset(outbuf, 0, length);
-                retval = 0;
-                break;
-        case OID_PNP_QUERY_POWER:
-                DBG("%s: OID_PNP_QUERY_POWER D%d\n", __func__,
-                                get_unaligned_le32(buf) - 1);
-                /* only suspend is a real power state, and
-                 * it can't be entered by OID_PNP_SET_POWER...
-                 */
-                length = 0;
-                retval = 0;
-                break;
-#endif
-
         default:
                 pr_warning("%s: query unknown OID 0x%08X\n",
                          __func__, OID);
@@ -726,9 +532,6 @@ static int gen_ndis_set_resp (u8 configNr, u32 OID, u8 *buf, u32 buf_len,
                  * what makes the packet flow start and stop, like
                  * activating the CDC Ethernet altsetting.
                  */
-#ifdef  RNDIS_PM
-update_linkstate:
-#endif
                 retval = 0;
                 if (*params->filter) {
                         params->state = RNDIS_DATA_INITIALIZED;
@@ -747,49 +550,6 @@ update_linkstate:
                 DBG("%s: OID_802_3_MULTICAST_LIST\n", __func__);
                 retval = 0;
                 break;
-#if 0
-        case OID_GEN_RNDIS_CONFIG_PARAMETER:
-                {
-                struct rndis_config_parameter   *param;
-                param = (struct rndis_config_parameter *) buf;
-                DBG("%s: OID_GEN_RNDIS_CONFIG_PARAMETER '%*s'\n",
-                        __func__,
-                        min(cpu_to_le32(param->ParameterNameLength),80),
-                        buf + param->ParameterNameOffset);
-                retval = 0;
-                }
-                break;
-#endif
-
-#ifdef  RNDIS_PM
-        case OID_PNP_SET_POWER:
-                /* The only real power state is USB suspend, and RNDIS requests
-                 * can't enter it; this one isn't really about power.  After
-                 * resuming, Windows forces a reset, and then SET_POWER D0.
-                 * FIXME ... then things go batty; Windows wedges itself.
-                 */
-                i = get_unaligned_le32(buf);
-                DBG("%s: OID_PNP_SET_POWER D%d\n", __func__, i - 1);
-                switch (i) {
-                case NdisDeviceStateD0:
-                        *params->filter = params->saved_filter;
-                        goto update_linkstate;
-                case NdisDeviceStateD3:
-                case NdisDeviceStateD2:
-                case NdisDeviceStateD1:
-                        params->saved_filter = *params->filter;
-                        retval = 0;
-                        break;
-                }
-                break;
-
-#ifdef  RNDIS_WAKEUP
-        // no wakeup support advertised, so wakeup OIDs always fail:
-        //  - OID_PNP_ENABLE_WAKE_UP
-        //  - OID_PNP_{ADD,REMOVE}_WAKE_UP_PATTERN
-#endif
-
-#endif  /* RNDIS_PM */
 
         default:
                 pr_warning("%s: set unknown OID 0x%08X, size %d\n",
@@ -807,8 +567,10 @@ static int rndis_init_response (int configNr, rndis_init_msg_type *buf)
 {
         rndis_init_cmplt_type   *resp;
         rndis_resp_t            *r;
+        struct rndis_params     *params = rndis_per_dev_params + configNr;
 
-        if (!rndis_per_dev_params [configNr].dev) return -ENOTSUPP;
+        if (!params->dev)
+                return -ENOTSUPP;
 
         r = rndis_add_response (configNr, sizeof (rndis_init_cmplt_type));
         if (!r)
@@ -826,7 +588,7 @@ static int rndis_init_response (int configNr, rndis_init_msg_type *buf)
         resp->Medium = __constant_cpu_to_le32 (RNDIS_MEDIUM_802_3);
         resp->MaxPacketsPerTransfer = __constant_cpu_to_le32 (1);
         resp->MaxTransferSize = cpu_to_le32 (
-                  rndis_per_dev_params [configNr].dev->mtu
+                  params->dev->mtu
                 + sizeof (struct ethhdr)
                 + sizeof (struct rndis_packet_msg_type)
                 + 22);
@@ -834,10 +596,7 @@ static int rndis_init_response (int configNr, rndis_init_msg_type *buf)
         resp->AFListOffset = __constant_cpu_to_le32 (0);
         resp->AFListSize = __constant_cpu_to_le32 (0);
 
-        if (rndis_per_dev_params [configNr].ack)
-                rndis_per_dev_params [configNr].ack (
-                        rndis_per_dev_params [configNr].dev);
-
+        params->resp_avail(params->v);
         return 0;
 }
 
@@ -845,9 +604,11 @@ static int rndis_query_response (int configNr, rndis_query_msg_type *buf)
 {
         rndis_query_cmplt_type *resp;
         rndis_resp_t            *r;
+        struct rndis_params     *params = rndis_per_dev_params + configNr;
 
         // DBG("%s: OID = %08X\n", __func__, cpu_to_le32(buf->OID));
-        if (!rndis_per_dev_params [configNr].dev) return -ENOTSUPP;
+        if (!params->dev)
+                return -ENOTSUPP;
 
         /*
          * we need more memory:
@@ -878,9 +639,7 @@ static int rndis_query_response (int configNr, rndis_query_msg_type *buf)
         } else
                 resp->Status = __constant_cpu_to_le32 (RNDIS_STATUS_SUCCESS);
 
-        if (rndis_per_dev_params [configNr].ack)
-                rndis_per_dev_params [configNr].ack (
-                        rndis_per_dev_params [configNr].dev);
+        params->resp_avail(params->v);
         return 0;
 }
 
@@ -889,6 +648,7 @@ static int rndis_set_response (int configNr, rndis_set_msg_type *buf)
         u32                     BufLength, BufOffset;
         rndis_set_cmplt_type    *resp;
         rndis_resp_t            *r;
+        struct rndis_params     *params = rndis_per_dev_params + configNr;
 
         r = rndis_add_response (configNr, sizeof (rndis_set_cmplt_type));
         if (!r)
@@ -898,7 +658,7 @@ static int rndis_set_response (int configNr, rndis_set_msg_type *buf)
         BufLength = le32_to_cpu (buf->InformationBufferLength);
         BufOffset = le32_to_cpu (buf->InformationBufferOffset);
 
-#ifdef  VERBOSE
+#ifdef  VERBOSE_DEBUG
         DBG("%s: Length: %d\n", __func__, BufLength);
         DBG("%s: Offset: %d\n", __func__, BufOffset);
         DBG("%s: InfoBuffer: ", __func__);
@@ -919,10 +679,7 @@ static int rndis_set_response (int configNr, rndis_set_msg_type *buf)
         else
                 resp->Status = __constant_cpu_to_le32 (RNDIS_STATUS_SUCCESS);
 
-        if (rndis_per_dev_params [configNr].ack)
-                rndis_per_dev_params [configNr].ack (
-                        rndis_per_dev_params [configNr].dev);
-
+        params->resp_avail(params->v);
         return 0;
 }
 
@@ -930,6 +687,7 @@ static int rndis_reset_response (int configNr, rndis_reset_msg_type *buf)
 {
         rndis_reset_cmplt_type  *resp;
         rndis_resp_t            *r;
+        struct rndis_params     *params = rndis_per_dev_params + configNr;
 
         r = rndis_add_response (configNr, sizeof (rndis_reset_cmplt_type));
         if (!r)
@@ -942,10 +700,7 @@ static int rndis_reset_response (int configNr, rndis_reset_msg_type *buf)
         /* resent information */
         resp->AddressingReset = __constant_cpu_to_le32 (1);
 
-        if (rndis_per_dev_params [configNr].ack)
-                rndis_per_dev_params [configNr].ack (
-                        rndis_per_dev_params [configNr].dev);
-
+        params->resp_avail(params->v);
         return 0;
 }
 
@@ -954,6 +709,7 @@ static int rndis_keepalive_response (int configNr,
 {
         rndis_keepalive_cmplt_type      *resp;
         rndis_resp_t                    *r;
+        struct rndis_params     *params = rndis_per_dev_params + configNr;
 
         /* host "should" check only in RNDIS_DATA_INITIALIZED state */
 
@@ -968,10 +724,7 @@ static int rndis_keepalive_response (int configNr,
         resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
         resp->Status = __constant_cpu_to_le32 (RNDIS_STATUS_SUCCESS);
 
-        if (rndis_per_dev_params [configNr].ack)
-                rndis_per_dev_params [configNr].ack (
-                        rndis_per_dev_params [configNr].dev);
-
+        params->resp_avail(params->v);
         return 0;
 }
 
@@ -983,8 +736,9 @@ static int rndis_indicate_status_msg (int configNr, u32 status)
 {
         rndis_indicate_status_msg_type  *resp;
         rndis_resp_t                    *r;
+        struct rndis_params     *params = rndis_per_dev_params + configNr;
 
-        if (rndis_per_dev_params [configNr].state == RNDIS_UNINITIALIZED)
+        if (params->state == RNDIS_UNINITIALIZED)
                 return -ENOTSUPP;
 
         r = rndis_add_response (configNr,
@@ -1000,9 +754,7 @@ static int rndis_indicate_status_msg (int configNr, u32 status)
         resp->StatusBufferLength = __constant_cpu_to_le32 (0);
         resp->StatusBufferOffset = __constant_cpu_to_le32 (0);
 
-        if (rndis_per_dev_params [configNr].ack)
-                rndis_per_dev_params [configNr].ack (
-                        rndis_per_dev_params [configNr].dev);
+        params->resp_avail(params->v);
         return 0;
 }
 
@@ -1029,7 +781,6 @@ void rndis_uninit (int configNr)
 
         if (configNr >= RNDIS_MAX_CONFIGS)
                 return;
-        rndis_per_dev_params [configNr].used = 0;
         rndis_per_dev_params [configNr].state = RNDIS_UNINITIALIZED;
 
         /* drain the response queue */
@@ -1142,21 +893,25 @@ int rndis_msg_parser (u8 configNr, u8 *buf)
         return -ENOTSUPP;
 }
 
-int rndis_register (int (* rndis_control_ack) (struct net_device *))
+int rndis_register(void (*resp_avail)(void *v), void *v)
 {
         u8 i;
 
+        if (!resp_avail)
+                return -EINVAL;
+
         for (i = 0; i < RNDIS_MAX_CONFIGS; i++) {
                 if (!rndis_per_dev_params [i].used) {
                         rndis_per_dev_params [i].used = 1;
-                        rndis_per_dev_params [i].ack = rndis_control_ack;
+                        rndis_per_dev_params [i].resp_avail = resp_avail;
+                        rndis_per_dev_params [i].v = v;
                         DBG("%s: configNr = %d\n", __func__, i);
                         return i;
                 }
         }
         DBG("failed\n");
 
-        return -1;
+        return -ENODEV;
 }
 
 void rndis_deregister (int configNr)
@@ -1169,16 +924,14 @@ void rndis_deregister (int configNr)
         return;
 }
 
-int rndis_set_param_dev (u8 configNr, struct net_device *dev,
-                         struct net_device_stats *stats,
-                         u16 *cdc_filter)
+int rndis_set_param_dev(u8 configNr, struct net_device *dev, u16 *cdc_filter)
 {
         DBG("%s:\n", __func__ );
-        if (!dev || !stats) return -1;
+        if (!dev)
+                return -EINVAL;
         if (configNr >= RNDIS_MAX_CONFIGS) return -1;
 
         rndis_per_dev_params [configNr].dev = dev;
-        rndis_per_dev_params [configNr].stats = stats;
         rndis_per_dev_params [configNr].filter = cdc_filter;
 
         return 0;
@@ -1296,14 +1049,11 @@ int rndis_rm_hdr(struct sk_buff *skb)
 
 #ifdef  CONFIG_USB_GADGET_DEBUG_FILES
 
-static int rndis_proc_read (char *page, char **start, off_t off, int count, int *eof,
-                void *data)
+static int rndis_proc_show(struct seq_file *m, void *v)
 {
-        char *out = page;
-        int len;
-        rndis_params *param = (rndis_params *) data;
+        rndis_params *param = m->private;
 
-        out += snprintf (out, count,
+        seq_printf(m,
                          "Config Nr. %d\n"
                          "used      : %s\n"
                          "state     : %s\n"
@@ -1326,25 +1076,13 @@ static int rndis_proc_read (char *page, char **start, off_t off, int count, int
                          (param->media_state) ? 0 : param->speed*100,
                          (param->media_state) ? "disconnected" : "connected",
                          param->vendorID, param->vendorDescr);
-
-        len = out - page;
-        len -= off;
-
-        if (len < count) {
-                *eof = 1;
-                if (len <= 0)
-                        return 0;
-        } else
-                len = count;
-
-        *start = page + off;
-        return len;
+        return 0;
 }
 
-static int rndis_proc_write (struct file *file, const char __user *buffer,
-                unsigned long count, void *data)
+static ssize_t rndis_proc_write(struct file *file, const char __user *buffer,
+                size_t count, loff_t *ppos)
 {
-        rndis_params *p = data;
+        rndis_params *p = PDE(file->f_path.dentry->d_inode)->data;
         u32 speed = 0;
         int i, fl_speed = 0;
 
@@ -1386,6 +1124,20 @@ static int rndis_proc_write (struct file *file, const char __user *buffer,
         return count;
 }
 
+static int rndis_proc_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, rndis_proc_show, PDE(inode)->data);
+}
+
+static const struct file_operations rndis_proc_fops = {
+        .owner          = THIS_MODULE,
+        .open           = rndis_proc_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+        .write          = rndis_proc_write,
+};
+
 #define NAME_TEMPLATE   "driver/rndis-%03d"
 
 static struct proc_dir_entry *rndis_connect_state [RNDIS_MAX_CONFIGS];
@@ -1403,7 +1155,9 @@ int __init rndis_init (void)
 
                 sprintf (name, NAME_TEMPLATE, i);
                 if (!(rndis_connect_state [i]
-                                = create_proc_entry (name, 0660, NULL)))
+                                = proc_create_data(name, 0660, NULL,
+                                        &rndis_proc_fops,
+                                        (void *)(rndis_per_dev_params + i))))
                 {
                         DBG("%s :remove entries", __func__);
                         while (i) {
@@ -1413,11 +1167,6 @@ int __init rndis_init (void)
                         DBG("\n");
                         return -EIO;
                 }
-
-                rndis_connect_state [i]->write_proc = rndis_proc_write;
-                rndis_connect_state [i]->read_proc = rndis_proc_read;
-                rndis_connect_state [i]->data = (void *)
-                                (rndis_per_dev_params + i);
 #endif
                 rndis_per_dev_params [i].confignr = i;
                 rndis_per_dev_params [i].used = 0;
diff --git a/drivers/usb/gadget/rndis.h b/drivers/usb/gadget/rndis.h
index 397b149f3ca7..aac61dfe0f03 100644
--- a/drivers/usb/gadget/rndis.h
+++ b/drivers/usb/gadget/rndis.h
@@ -1,8 +1,6 @@
 /*
  * RNDIS        Definitions for Remote NDIS
  *
- * Version:     $Id: rndis.h,v 1.15 2004/03/25 21:33:46 robert Exp $
- *
  * Authors:     Benedikt Spranger, Pengutronix
  *              Robert Schwebel, Pengutronix
  *
@@ -235,20 +233,19 @@ typedef struct rndis_params
         const u8                *host_mac;
         u16                     *filter;
         struct net_device       *dev;
-        struct net_device_stats *stats;
 
         u32                     vendorID;
         const char              *vendorDescr;
-        int                     (*ack) (struct net_device *);
+        void                    (*resp_avail)(void *v);
+        void                    *v;
         struct list_head        resp_queue;
 } rndis_params;
 
 /* RNDIS Message parser and other useless functions */
 int  rndis_msg_parser (u8 configNr, u8 *buf);
-int  rndis_register (int (*rndis_control_ack) (struct net_device *));
+int  rndis_register(void (*resp_avail)(void *v), void *v);
 void rndis_deregister (int configNr);
 int  rndis_set_param_dev (u8 configNr, struct net_device *dev,
-                         struct net_device_stats *stats,
                          u16 *cdc_filter);
 int  rndis_set_param_vendor (u8 configNr, u32 vendorID,
                             const char *vendorDescr);
diff --git a/drivers/usb/gadget/serial.c b/drivers/usb/gadget/serial.c
index fa019fa73334..b3699afff002 100644
--- a/drivers/usb/gadget/serial.c
+++ b/drivers/usb/gadget/serial.c
@@ -1,15 +1,9 @@
 /*
- * g_serial.c -- USB gadget serial driver
+ * serial.c -- USB gadget serial driver
  *
- * Copyright 2003 (C) Al Borchers (alborchers@steinerpoint.com)
- *
- * This code is based in part on the Gadget Zero driver, which
- * is Copyright (C) 2003 by David Brownell, all rights reserved.
- *
- * This code also borrows from usbserial.c, which is
- * Copyright (C) 1999 - 2002 Greg Kroah-Hartman (greg@kroah.com)
- * Copyright (C) 2000 Peter Berger (pberger@brimson.com)
- * Copyright (C) 2000 Al Borchers (alborchers@steinerpoint.com)
+ * Copyright (C) 2003 Al Borchers (alborchers@steinerpoint.com)
+ * Copyright (C) 2008 by David Brownell
+ * Copyright (C) 2008 by Nokia Corporation
  *
  * This software is distributed under the terms of the GNU General
  * Public License ("GPL") as published by the Free Software Foundation,
@@ -22,2254 +16,237 @@
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
 
-#include <linux/usb/ch9.h>
-#include <linux/usb/cdc.h>
-#include <linux/usb/gadget.h>
-
+#include "u_serial.h"
 #include "gadget_chips.h"
 
 
 /* Defines */
 
-#define GS_VERSION_STR                  "v2.2"
-#define GS_VERSION_NUM                  0x2200
+#define GS_VERSION_STR                  "v2.4"
+#define GS_VERSION_NUM                  0x2400
 
 #define GS_LONG_NAME                    "Gadget Serial"
-#define GS_SHORT_NAME                   "g_serial"
-
-#define GS_MAJOR                        127
-#define GS_MINOR_START                  0
-
-/* REVISIT only one port is supported for now;
- * see gs_{send,recv}_packet() ... no multiplexing,
- * and no support for multiple ACM devices.
- */
-#define GS_NUM_PORTS                    1
-
-#define GS_NUM_CONFIGS                  1
-#define GS_NO_CONFIG_ID                 0
-#define GS_BULK_CONFIG_ID               1
-#define GS_ACM_CONFIG_ID                2
-
-#define GS_MAX_NUM_INTERFACES           2
-#define GS_BULK_INTERFACE_ID            0
-#define GS_CONTROL_INTERFACE_ID         0
-#define GS_DATA_INTERFACE_ID            1
-
-#define GS_MAX_DESC_LEN                 256
-
-#define GS_DEFAULT_READ_Q_SIZE          32
-#define GS_DEFAULT_WRITE_Q_SIZE         32
-
-#define GS_DEFAULT_WRITE_BUF_SIZE       8192
-#define GS_TMP_BUF_SIZE                 8192
-
-#define GS_CLOSE_TIMEOUT                15
-
-#define GS_DEFAULT_USE_ACM              0
-
-/* 9600-8-N-1 ... matches init_termios.c_cflag and defaults
- * expected by "usbser.sys" on MS-Windows.
- */
-#define GS_DEFAULT_DTE_RATE             9600
-#define GS_DEFAULT_DATA_BITS            8
-#define GS_DEFAULT_PARITY               USB_CDC_NO_PARITY
-#define GS_DEFAULT_CHAR_FORMAT          USB_CDC_1_STOP_BITS
-
-/* maxpacket and other transfer characteristics vary by speed. */
-static inline struct usb_endpoint_descriptor *
-choose_ep_desc(struct usb_gadget *g, struct usb_endpoint_descriptor *hs,
-                struct usb_endpoint_descriptor *fs)
-{
-        if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
-                return hs;
-        return fs;
-}
-
-
-/* debug settings */
-#ifdef DEBUG
-static int debug = 1;
-#else
-#define debug 0
-#endif
-
-#define gs_debug(format, arg...) \
-        do { if (debug) pr_debug(format, ## arg); } while (0)
-#define gs_debug_level(level, format, arg...) \
-        do { if (debug >= level) pr_debug(format, ## arg); } while (0)
+#define GS_VERSION_NAME                 GS_LONG_NAME " " GS_VERSION_STR
 
+/*-------------------------------------------------------------------------*/
 
 /* Thanks to NetChip Technologies for donating this product ID.
- *
- * DO NOT REUSE THESE IDs with a protocol-incompatible driver!!  Ever!!
- * Instead:  allocate your own, using normal USB-IF procedures.
- */
+*
+* DO NOT REUSE THESE IDs with a protocol-incompatible driver!!  Ever!!
+* Instead:  allocate your own, using normal USB-IF procedures.
+*/
 #define GS_VENDOR_ID                    0x0525  /* NetChip */
 #define GS_PRODUCT_ID                   0xa4a6  /* Linux-USB Serial Gadget */
 #define GS_CDC_PRODUCT_ID               0xa4a7  /* ... as CDC-ACM */
 
-#define GS_LOG2_NOTIFY_INTERVAL         5       /* 1 << 5 == 32 msec */
-#define GS_NOTIFY_MAXPACKET             8
+/* string IDs are assigned dynamically */
 
+#define STRING_MANUFACTURER_IDX         0
+#define STRING_PRODUCT_IDX              1
+#define STRING_DESCRIPTION_IDX          2
 
-/* circular buffer */
-struct gs_buf {
-        unsigned int            buf_size;
-        char                    *buf_buf;
-        char                    *buf_get;
-        char                    *buf_put;
-};
+static char manufacturer[50];
 
-/* the port structure holds info for each port, one for each minor number */
-struct gs_port {
-        struct gs_dev           *port_dev;      /* pointer to device struct */
-        struct tty_struct       *port_tty;      /* pointer to tty struct */
-        spinlock_t              port_lock;
-        int                     port_num;
-        int                     port_open_count;
-        int                     port_in_use;    /* open/close in progress */
-        wait_queue_head_t       port_write_wait;/* waiting to write */
-        struct gs_buf           *port_write_buf;
-        struct usb_cdc_line_coding port_line_coding;    /* 8-N-1 etc */
-        u16                     port_handshake_bits;
-#define RS232_RTS       (1 << 1)
-#define RS232_DTE       (1 << 0)
+static struct usb_string strings_dev[] = {
+        [STRING_MANUFACTURER_IDX].s = manufacturer,
+        [STRING_PRODUCT_IDX].s = GS_VERSION_NAME,
+        [STRING_DESCRIPTION_IDX].s = NULL /* updated; f(use_acm) */,
+        {  } /* end of list */
 };
 
-/* the device structure holds info for the USB device */
-struct gs_dev {
-        struct usb_gadget       *dev_gadget;    /* gadget device pointer */
-        spinlock_t              dev_lock;       /* lock for set/reset config */
-        int                     dev_config;     /* configuration number */
-        struct usb_ep           *dev_notify_ep; /* address of notify endpoint */
-        struct usb_ep           *dev_in_ep;     /* address of in endpoint */
-        struct usb_ep           *dev_out_ep;    /* address of out endpoint */
-        struct usb_endpoint_descriptor          /* descriptor of notify ep */
-                                *dev_notify_ep_desc;
-        struct usb_endpoint_descriptor          /* descriptor of in endpoint */
-                                *dev_in_ep_desc;
-        struct usb_endpoint_descriptor          /* descriptor of out endpoint */
-                                *dev_out_ep_desc;
-        struct usb_request      *dev_ctrl_req;  /* control request */
-        struct list_head        dev_req_list;   /* list of write requests */
-        int                     dev_sched_port; /* round robin port scheduled */
-        struct gs_port          *dev_port[GS_NUM_PORTS]; /* the ports */
+static struct usb_gadget_strings stringtab_dev = {
+        .language       = 0x0409,       /* en-us */
+        .strings        = strings_dev,
 };
 
-
-/* Functions */
-
-/* tty driver internals */
-static int gs_send(struct gs_dev *dev);
-static int gs_send_packet(struct gs_dev *dev, char *packet,
-        unsigned int size);
-static int gs_recv_packet(struct gs_dev *dev, char *packet,
-        unsigned int size);
-static void gs_read_complete(struct usb_ep *ep, struct usb_request *req);
-static void gs_write_complete(struct usb_ep *ep, struct usb_request *req);
-
-/* gadget driver internals */
-static int gs_set_config(struct gs_dev *dev, unsigned config);
-static void gs_reset_config(struct gs_dev *dev);
-static int gs_build_config_buf(u8 *buf, struct usb_gadget *g,
-                u8 type, unsigned int index, int is_otg);
-
-static struct usb_request *gs_alloc_req(struct usb_ep *ep, unsigned int len,
-        gfp_t kmalloc_flags);
-static void gs_free_req(struct usb_ep *ep, struct usb_request *req);
-
-static int gs_alloc_ports(struct gs_dev *dev, gfp_t kmalloc_flags);
-static void gs_free_ports(struct gs_dev *dev);
-
-/* circular buffer */
-static struct gs_buf *gs_buf_alloc(unsigned int size, gfp_t kmalloc_flags);
-static void gs_buf_free(struct gs_buf *gb);
-static void gs_buf_clear(struct gs_buf *gb);
-static unsigned int gs_buf_data_avail(struct gs_buf *gb);
-static unsigned int gs_buf_space_avail(struct gs_buf *gb);
-static unsigned int gs_buf_put(struct gs_buf *gb, const char *buf,
-        unsigned int count);
-static unsigned int gs_buf_get(struct gs_buf *gb, char *buf,
-        unsigned int count);
-
-
-/* Globals */
-
-static struct gs_dev *gs_device;
-
-static struct mutex gs_open_close_lock[GS_NUM_PORTS];
-
-
-/*-------------------------------------------------------------------------*/
-
-/* USB descriptors */
-
-#define GS_MANUFACTURER_STR_ID  1
-#define GS_PRODUCT_STR_ID       2
-#define GS_SERIAL_STR_ID        3
-#define GS_BULK_CONFIG_STR_ID   4
-#define GS_ACM_CONFIG_STR_ID    5
-#define GS_CONTROL_STR_ID       6
-#define GS_DATA_STR_ID          7
-
-/* static strings, in UTF-8 */
-static char manufacturer[50];
-static struct usb_string gs_strings[] = {
-        { GS_MANUFACTURER_STR_ID, manufacturer },
-        { GS_PRODUCT_STR_ID, GS_LONG_NAME },
-        { GS_BULK_CONFIG_STR_ID, "Gadget Serial Bulk" },
-        { GS_ACM_CONFIG_STR_ID, "Gadget Serial CDC ACM" },
-        { GS_CONTROL_STR_ID, "Gadget Serial Control" },
-        { GS_DATA_STR_ID, "Gadget Serial Data" },
-        {  } /* end of list */
-};
-
-static struct usb_gadget_strings gs_string_table = {
-        .language =             0x0409, /* en-us */
-        .strings =              gs_strings,
+static struct usb_gadget_strings *dev_strings[] = {
+        &stringtab_dev,
+        NULL,
 };
 
-static struct usb_device_descriptor gs_device_desc = {
+static struct usb_device_descriptor device_desc = {
         .bLength =              USB_DT_DEVICE_SIZE,
         .bDescriptorType =      USB_DT_DEVICE,
         .bcdUSB =               __constant_cpu_to_le16(0x0200),
+        /* .bDeviceClass = f(use_acm) */
         .bDeviceSubClass =      0,
         .bDeviceProtocol =      0,
+        /* .bMaxPacketSize0 = f(hardware) */
         .idVendor =             __constant_cpu_to_le16(GS_VENDOR_ID),
-        .idProduct =            __constant_cpu_to_le16(GS_PRODUCT_ID),
-        .iManufacturer =        GS_MANUFACTURER_STR_ID,
-        .iProduct =             GS_PRODUCT_STR_ID,
-        .bNumConfigurations =   GS_NUM_CONFIGS,
+        /* .idProduct = f(use_acm) */
+        /* .bcdDevice = f(hardware) */
+        /* .iManufacturer = DYNAMIC */
+        /* .iProduct = DYNAMIC */
+        .bNumConfigurations =   1,
 };
 
-static struct usb_otg_descriptor gs_otg_descriptor = {
-        .bLength =              sizeof(gs_otg_descriptor),
+static struct usb_otg_descriptor otg_descriptor = {
+        .bLength =              sizeof otg_descriptor,
         .bDescriptorType =      USB_DT_OTG,
-        .bmAttributes =         USB_OTG_SRP,
-};
-
-static struct usb_config_descriptor gs_bulk_config_desc = {
-        .bLength =              USB_DT_CONFIG_SIZE,
-        .bDescriptorType =      USB_DT_CONFIG,
-        /* .wTotalLength computed dynamically */
-        .bNumInterfaces =       1,
-        .bConfigurationValue =  GS_BULK_CONFIG_ID,
-        .iConfiguration =       GS_BULK_CONFIG_STR_ID,
-        .bmAttributes =         USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
-        .bMaxPower =            1,
-};
-
-static struct usb_config_descriptor gs_acm_config_desc = {
-        .bLength =              USB_DT_CONFIG_SIZE,
-        .bDescriptorType =      USB_DT_CONFIG,
-        /* .wTotalLength computed dynamically */
-        .bNumInterfaces =       2,
-        .bConfigurationValue =  GS_ACM_CONFIG_ID,
-        .iConfiguration =       GS_ACM_CONFIG_STR_ID,
-        .bmAttributes =         USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
-        .bMaxPower =            1,
-};
-
-static const struct usb_interface_descriptor gs_bulk_interface_desc = {
-        .bLength =              USB_DT_INTERFACE_SIZE,
-        .bDescriptorType =      USB_DT_INTERFACE,
-        .bInterfaceNumber =     GS_BULK_INTERFACE_ID,
-        .bNumEndpoints =        2,
-        .bInterfaceClass =      USB_CLASS_VENDOR_SPEC,
-        .bInterfaceSubClass =   0,
-        .bInterfaceProtocol =   0,
-        .iInterface =           GS_DATA_STR_ID,
-};
-
-static const struct usb_interface_descriptor gs_control_interface_desc = {
-        .bLength =              USB_DT_INTERFACE_SIZE,
-        .bDescriptorType =      USB_DT_INTERFACE,
-        .bInterfaceNumber =     GS_CONTROL_INTERFACE_ID,
-        .bNumEndpoints =        1,
-        .bInterfaceClass =      USB_CLASS_COMM,
-        .bInterfaceSubClass =   USB_CDC_SUBCLASS_ACM,
-        .bInterfaceProtocol =   USB_CDC_ACM_PROTO_AT_V25TER,
-        .iInterface =           GS_CONTROL_STR_ID,
-};
-
-static const struct usb_interface_descriptor gs_data_interface_desc = {
-        .bLength =              USB_DT_INTERFACE_SIZE,
-        .bDescriptorType =      USB_DT_INTERFACE,
-        .bInterfaceNumber =     GS_DATA_INTERFACE_ID,
-        .bNumEndpoints =        2,
-        .bInterfaceClass =      USB_CLASS_CDC_DATA,
-        .bInterfaceSubClass =   0,
-        .bInterfaceProtocol =   0,
-        .iInterface =           GS_DATA_STR_ID,
-};
-
-static const struct usb_cdc_header_desc gs_header_desc = {
-        .bLength =              sizeof(gs_header_desc),
-        .bDescriptorType =      USB_DT_CS_INTERFACE,
-        .bDescriptorSubType =   USB_CDC_HEADER_TYPE,
-        .bcdCDC =               __constant_cpu_to_le16(0x0110),
-};
-
-static const struct usb_cdc_call_mgmt_descriptor gs_call_mgmt_descriptor = {
-        .bLength =              sizeof(gs_call_mgmt_descriptor),
-        .bDescriptorType =      USB_DT_CS_INTERFACE,
-        .bDescriptorSubType =   USB_CDC_CALL_MANAGEMENT_TYPE,
-        .bmCapabilities =       0,
-        .bDataInterface =       1,      /* index of data interface */
-};
-
-static struct usb_cdc_acm_descriptor gs_acm_descriptor = {
-        .bLength =              sizeof(gs_acm_descriptor),
-        .bDescriptorType =      USB_DT_CS_INTERFACE,
-        .bDescriptorSubType =   USB_CDC_ACM_TYPE,
-        .bmCapabilities =       (1 << 1),
-};
-
-static const struct usb_cdc_union_desc gs_union_desc = {
-        .bLength =              sizeof(gs_union_desc),
-        .bDescriptorType =      USB_DT_CS_INTERFACE,
-        .bDescriptorSubType =   USB_CDC_UNION_TYPE,
-        .bMasterInterface0 =    0,      /* index of control interface */
-        .bSlaveInterface0 =     1,      /* index of data interface */
-};
-
-static struct usb_endpoint_descriptor gs_fullspeed_notify_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-        .bEndpointAddress =     USB_DIR_IN,
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       __constant_cpu_to_le16(GS_NOTIFY_MAXPACKET),
-        .bInterval =            1 << GS_LOG2_NOTIFY_INTERVAL,
-};
-
-static struct usb_endpoint_descriptor gs_fullspeed_in_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-        .bEndpointAddress =     USB_DIR_IN,
-        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
-};
-
-static struct usb_endpoint_descriptor gs_fullspeed_out_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-        .bEndpointAddress =     USB_DIR_OUT,
-        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
-};
-
-static const struct usb_descriptor_header *gs_bulk_fullspeed_function[] = {
-        (struct usb_descriptor_header *) &gs_otg_descriptor,
-        (struct usb_descriptor_header *) &gs_bulk_interface_desc,
-        (struct usb_descriptor_header *) &gs_fullspeed_in_desc,
-        (struct usb_descriptor_header *) &gs_fullspeed_out_desc,
-        NULL,
-};
-
-static const struct usb_descriptor_header *gs_acm_fullspeed_function[] = {
-        (struct usb_descriptor_header *) &gs_otg_descriptor,
-        (struct usb_descriptor_header *) &gs_control_interface_desc,
-        (struct usb_descriptor_header *) &gs_header_desc,
-        (struct usb_descriptor_header *) &gs_call_mgmt_descriptor,
-        (struct usb_descriptor_header *) &gs_acm_descriptor,
-        (struct usb_descriptor_header *) &gs_union_desc,
-        (struct usb_descriptor_header *) &gs_fullspeed_notify_desc,
-        (struct usb_descriptor_header *) &gs_data_interface_desc,
-        (struct usb_descriptor_header *) &gs_fullspeed_in_desc,
-        (struct usb_descriptor_header *) &gs_fullspeed_out_desc,
-        NULL,
-};
 
-static struct usb_endpoint_descriptor gs_highspeed_notify_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-        .bEndpointAddress =     USB_DIR_IN,
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       __constant_cpu_to_le16(GS_NOTIFY_MAXPACKET),
-        .bInterval =            GS_LOG2_NOTIFY_INTERVAL+4,
-};
-
-static struct usb_endpoint_descriptor gs_highspeed_in_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
-        .wMaxPacketSize =       __constant_cpu_to_le16(512),
-};
-
-static struct usb_endpoint_descriptor gs_highspeed_out_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
-        .wMaxPacketSize =       __constant_cpu_to_le16(512),
-};
-
-static struct usb_qualifier_descriptor gs_qualifier_desc = {
-        .bLength =              sizeof(struct usb_qualifier_descriptor),
-        .bDescriptorType =      USB_DT_DEVICE_QUALIFIER,
-        .bcdUSB =               __constant_cpu_to_le16 (0x0200),
-        /* assumes ep0 uses the same value for both speeds ... */
-        .bNumConfigurations =   GS_NUM_CONFIGS,
-};
-
-static const struct usb_descriptor_header *gs_bulk_highspeed_function[] = {
-        (struct usb_descriptor_header *) &gs_otg_descriptor,
-        (struct usb_descriptor_header *) &gs_bulk_interface_desc,
-        (struct usb_descriptor_header *) &gs_highspeed_in_desc,
-        (struct usb_descriptor_header *) &gs_highspeed_out_desc,
-        NULL,
+        /* REVISIT SRP-only hardware is possible, although
+         * it would not be called "OTG" ...
+         */
+        .bmAttributes =         USB_OTG_SRP | USB_OTG_HNP,
 };
 
-static const struct usb_descriptor_header *gs_acm_highspeed_function[] = {
-        (struct usb_descriptor_header *) &gs_otg_descriptor,
-        (struct usb_descriptor_header *) &gs_control_interface_desc,
-        (struct usb_descriptor_header *) &gs_header_desc,
-        (struct usb_descriptor_header *) &gs_call_mgmt_descriptor,
-        (struct usb_descriptor_header *) &gs_acm_descriptor,
-        (struct usb_descriptor_header *) &gs_union_desc,
-        (struct usb_descriptor_header *) &gs_highspeed_notify_desc,
-        (struct usb_descriptor_header *) &gs_data_interface_desc,
-        (struct usb_descriptor_header *) &gs_highspeed_in_desc,
-        (struct usb_descriptor_header *) &gs_highspeed_out_desc,
+static const struct usb_descriptor_header *otg_desc[] = {
+        (struct usb_descriptor_header *) &otg_descriptor,
         NULL,
 };
 
-
 /*-------------------------------------------------------------------------*/
 
 /* Module */
-MODULE_DESCRIPTION(GS_LONG_NAME);
+MODULE_DESCRIPTION(GS_VERSION_NAME);
 MODULE_AUTHOR("Al Borchers");
+MODULE_AUTHOR("David Brownell");
 MODULE_LICENSE("GPL");
 
-#ifdef DEBUG
-module_param(debug, int, S_IRUGO|S_IWUSR);
-MODULE_PARM_DESC(debug, "Enable debugging, 0=off, 1=on");
-#endif
-
-static unsigned int read_q_size = GS_DEFAULT_READ_Q_SIZE;
-module_param(read_q_size, uint, S_IRUGO);
-MODULE_PARM_DESC(read_q_size, "Read request queue size, default=32");
-
-static unsigned int write_q_size = GS_DEFAULT_WRITE_Q_SIZE;
-module_param(write_q_size, uint, S_IRUGO);
-MODULE_PARM_DESC(write_q_size, "Write request queue size, default=32");
+static int use_acm = true;
+module_param(use_acm, bool, 0);
+MODULE_PARM_DESC(use_acm, "Use CDC ACM, default=yes");
 
-static unsigned int write_buf_size = GS_DEFAULT_WRITE_BUF_SIZE;
-module_param(write_buf_size, uint, S_IRUGO);
-MODULE_PARM_DESC(write_buf_size, "Write buffer size, default=8192");
-
-static unsigned int use_acm = GS_DEFAULT_USE_ACM;
-module_param(use_acm, uint, S_IRUGO);
-MODULE_PARM_DESC(use_acm, "Use CDC ACM, 0=no, 1=yes, default=no");
+static unsigned n_ports = 1;
+module_param(n_ports, uint, 0);
+MODULE_PARM_DESC(n_ports, "number of ports to create, default=1");
 
 /*-------------------------------------------------------------------------*/
 
-/* TTY Driver */
-
-/*
- * gs_open
- */
-static int gs_open(struct tty_struct *tty, struct file *file)
-{
-        int port_num;
-        unsigned long flags;
-        struct gs_port *port;
-        struct gs_dev *dev;
-        struct gs_buf *buf;
-        struct mutex *mtx;
-        int ret;
-
-        port_num = tty->index;
-
-        gs_debug("gs_open: (%d,%p,%p)\n", port_num, tty, file);
-
-        if (port_num < 0 || port_num >= GS_NUM_PORTS) {
-                pr_err("gs_open: (%d,%p,%p) invalid port number\n",
-                        port_num, tty, file);
-                return -ENODEV;
-        }
-
-        dev = gs_device;
-
-        if (dev == NULL) {
-                pr_err("gs_open: (%d,%p,%p) NULL device pointer\n",
-                        port_num, tty, file);
-                return -ENODEV;
-        }
-
-        mtx = &gs_open_close_lock[port_num];
-        if (mutex_lock_interruptible(mtx)) {
-                pr_err("gs_open: (%d,%p,%p) interrupted waiting for mutex\n",
-                        port_num, tty, file);
-                return -ERESTARTSYS;
-        }
-
-        spin_lock_irqsave(&dev->dev_lock, flags);
-
-        if (dev->dev_config == GS_NO_CONFIG_ID) {
-                pr_err("gs_open: (%d,%p,%p) device is not connected\n",
-                        port_num, tty, file);
-                ret = -ENODEV;
-                goto exit_unlock_dev;
-        }
-
-        port = dev->dev_port[port_num];
-
-        if (port == NULL) {
-                pr_err("gs_open: (%d,%p,%p) NULL port pointer\n",
-                        port_num, tty, file);
-                ret = -ENODEV;
-                goto exit_unlock_dev;
-        }
-
-        spin_lock(&port->port_lock);
-        spin_unlock(&dev->dev_lock);
-
-        if (port->port_dev == NULL) {
-                pr_err("gs_open: (%d,%p,%p) port disconnected (1)\n",
-                        port_num, tty, file);
-                ret = -EIO;
-                goto exit_unlock_port;
-        }
-
-        if (port->port_open_count > 0) {
-                ++port->port_open_count;
-                gs_debug("gs_open: (%d,%p,%p) already open\n",
-                        port_num, tty, file);
-                ret = 0;
-                goto exit_unlock_port;
-        }
-
-        tty->driver_data = NULL;
-
-        /* mark port as in use, we can drop port lock and sleep if necessary */
-        port->port_in_use = 1;
-
-        /* allocate write buffer on first open */
-        if (port->port_write_buf == NULL) {
-                spin_unlock_irqrestore(&port->port_lock, flags);
-                buf = gs_buf_alloc(write_buf_size, GFP_KERNEL);
-                spin_lock_irqsave(&port->port_lock, flags);
-
-                /* might have been disconnected while asleep, check */
-                if (port->port_dev == NULL) {
-                        pr_err("gs_open: (%d,%p,%p) port disconnected (2)\n",
-                                port_num, tty, file);
-                        port->port_in_use = 0;
-                        ret = -EIO;
-                        goto exit_unlock_port;
-                }
-
-                if ((port->port_write_buf=buf) == NULL) {
-                        pr_err("gs_open: (%d,%p,%p) cannot allocate "
-                                "port write buffer\n",
-                                port_num, tty, file);
-                        port->port_in_use = 0;
-                        ret = -ENOMEM;
-                        goto exit_unlock_port;
-                }
-
-        }
-
-        /* wait for carrier detect (not implemented) */
-
-        /* might have been disconnected while asleep, check */
-        if (port->port_dev == NULL) {
-                pr_err("gs_open: (%d,%p,%p) port disconnected (3)\n",
-                        port_num, tty, file);
-                port->port_in_use = 0;
-                ret = -EIO;
-                goto exit_unlock_port;
-        }
-
-        tty->driver_data = port;
-        port->port_tty = tty;
-        port->port_open_count = 1;
-        port->port_in_use = 0;
-
-        gs_debug("gs_open: (%d,%p,%p) completed\n", port_num, tty, file);
-
-        ret = 0;
-
-exit_unlock_port:
-        spin_unlock_irqrestore(&port->port_lock, flags);
-        mutex_unlock(mtx);
-        return ret;
-
-exit_unlock_dev:
-        spin_unlock_irqrestore(&dev->dev_lock, flags);
-        mutex_unlock(mtx);
-        return ret;
-
-}
-
-/*
- * gs_close
- */
-
-static int gs_write_finished_event_safely(struct gs_port *p)
-{
-        int cond;
-
-        spin_lock_irq(&(p)->port_lock);
-        cond = !(p)->port_dev || !gs_buf_data_avail((p)->port_write_buf);
-        spin_unlock_irq(&(p)->port_lock);
-        return cond;
-}
-
-static void gs_close(struct tty_struct *tty, struct file *file)
-{
-        struct gs_port *port = tty->driver_data;
-        struct mutex *mtx;
-
-        if (port == NULL) {
-                pr_err("gs_close: NULL port pointer\n");
-                return;
-        }
-
-        gs_debug("gs_close: (%d,%p,%p)\n", port->port_num, tty, file);
-
-        mtx = &gs_open_close_lock[port->port_num];
-        mutex_lock(mtx);
-
-        spin_lock_irq(&port->port_lock);
-
-        if (port->port_open_count == 0) {
-                pr_err("gs_close: (%d,%p,%p) port is already closed\n",
-                        port->port_num, tty, file);
-                goto exit;
-        }
-
-        if (port->port_open_count > 1) {
-                --port->port_open_count;
-                goto exit;
-        }
-
-        /* free disconnected port on final close */
-        if (port->port_dev == NULL) {
-                kfree(port);
-                goto exit;
-        }
-
-        /* mark port as closed but in use, we can drop port lock */
-        /* and sleep if necessary */
-        port->port_in_use = 1;
-        port->port_open_count = 0;
-
-        /* wait for write buffer to drain, or */
-        /* at most GS_CLOSE_TIMEOUT seconds */
-        if (gs_buf_data_avail(port->port_write_buf) > 0) {
-                spin_unlock_irq(&port->port_lock);
-                wait_event_interruptible_timeout(port->port_write_wait,
-                                        gs_write_finished_event_safely(port),
-                                        GS_CLOSE_TIMEOUT * HZ);
-                spin_lock_irq(&port->port_lock);
-        }
-
-        /* free disconnected port on final close */
-        /* (might have happened during the above sleep) */
-        if (port->port_dev == NULL) {
-                kfree(port);
-                goto exit;
-        }
-
-        gs_buf_clear(port->port_write_buf);
-
-        tty->driver_data = NULL;
-        port->port_tty = NULL;
-        port->port_in_use = 0;
-
-        gs_debug("gs_close: (%d,%p,%p) completed\n",
-                port->port_num, tty, file);
-
-exit:
-        spin_unlock_irq(&port->port_lock);
-        mutex_unlock(mtx);
-}
-
-/*
- * gs_write
- */
-static int gs_write(struct tty_struct *tty, const unsigned char *buf, int count)
+static int __init serial_bind_config(struct usb_configuration *c)
 {
-        unsigned long flags;
-        struct gs_port *port = tty->driver_data;
-        int ret;
-
-        if (port == NULL) {
-                pr_err("gs_write: NULL port pointer\n");
-                return -EIO;
-        }
-
-        gs_debug("gs_write: (%d,%p) writing %d bytes\n", port->port_num, tty,
-                count);
-
-        if (count == 0)
-                return 0;
-
-        spin_lock_irqsave(&port->port_lock, flags);
-
-        if (port->port_dev == NULL) {
-                pr_err("gs_write: (%d,%p) port is not connected\n",
-                        port->port_num, tty);
-                ret = -EIO;
-                goto exit;
-        }
-
-        if (port->port_open_count == 0) {
-                pr_err("gs_write: (%d,%p) port is closed\n",
-                        port->port_num, tty);
-                ret = -EBADF;
-                goto exit;
-        }
-
-        count = gs_buf_put(port->port_write_buf, buf, count);
-
-        spin_unlock_irqrestore(&port->port_lock, flags);
-
-        gs_send(gs_device);
-
-        gs_debug("gs_write: (%d,%p) wrote %d bytes\n", port->port_num, tty,
-                count);
+        unsigned i;
+        int status = 0;
 
-        return count;
-
-exit:
-        spin_unlock_irqrestore(&port->port_lock, flags);
-        return ret;
-}
-
-/*
- * gs_put_char
- */
-static int gs_put_char(struct tty_struct *tty, unsigned char ch)
-{
-        unsigned long flags;
-        struct gs_port *port = tty->driver_data;
-        int ret = 0;
-
-        if (port == NULL) {
-                pr_err("gs_put_char: NULL port pointer\n");
-                return 0;
-        }
-
-        gs_debug("gs_put_char: (%d,%p) char=0x%x, called from %p\n",
-                port->port_num, tty, ch, __builtin_return_address(0));
-
-        spin_lock_irqsave(&port->port_lock, flags);
-
-        if (port->port_dev == NULL) {
-                pr_err("gs_put_char: (%d,%p) port is not connected\n",
-                        port->port_num, tty);
-                goto exit;
-        }
-
-        if (port->port_open_count == 0) {
-                pr_err("gs_put_char: (%d,%p) port is closed\n",
-                        port->port_num, tty);
-                goto exit;
-        }
-
-        ret = gs_buf_put(port->port_write_buf, &ch, 1);
-
-exit:
-        spin_unlock_irqrestore(&port->port_lock, flags);
-        return ret;
-}
-
-/*
- * gs_flush_chars
- */
-static void gs_flush_chars(struct tty_struct *tty)
-{
-        unsigned long flags;
-        struct gs_port *port = tty->driver_data;
-
-        if (port == NULL) {
-                pr_err("gs_flush_chars: NULL port pointer\n");
-                return;
-        }
-
-        gs_debug("gs_flush_chars: (%d,%p)\n", port->port_num, tty);
-
-        spin_lock_irqsave(&port->port_lock, flags);
-
-        if (port->port_dev == NULL) {
-                pr_err("gs_flush_chars: (%d,%p) port is not connected\n",
-                        port->port_num, tty);
-                goto exit;
-        }
-
-        if (port->port_open_count == 0) {
-                pr_err("gs_flush_chars: (%d,%p) port is closed\n",
-                        port->port_num, tty);
-                goto exit;
-        }
-
-        spin_unlock_irqrestore(&port->port_lock, flags);
-
-        gs_send(gs_device);
-
-        return;
-
-exit:
-        spin_unlock_irqrestore(&port->port_lock, flags);
-}
-
-/*
- * gs_write_room
- */
-static int gs_write_room(struct tty_struct *tty)
-{
-
-        int room = 0;
-        unsigned long flags;
-        struct gs_port *port = tty->driver_data;
-
-
-        if (port == NULL)
-                return 0;
-
-        spin_lock_irqsave(&port->port_lock, flags);
-
-        if (port->port_dev != NULL && port->port_open_count > 0
-        && port->port_write_buf != NULL)
-                room = gs_buf_space_avail(port->port_write_buf);
-
-        spin_unlock_irqrestore(&port->port_lock, flags);
-
-        gs_debug("gs_write_room: (%d,%p) room=%d\n",
-                port->port_num, tty, room);
-
-        return room;
-}
-
-/*
- * gs_chars_in_buffer
- */
-static int gs_chars_in_buffer(struct tty_struct *tty)
-{
-        int chars = 0;
-        unsigned long flags;
-        struct gs_port *port = tty->driver_data;
-
-        if (port == NULL)
-                return 0;
-
-        spin_lock_irqsave(&port->port_lock, flags);
-
-        if (port->port_dev != NULL && port->port_open_count > 0
-        && port->port_write_buf != NULL)
-                chars = gs_buf_data_avail(port->port_write_buf);
-
-        spin_unlock_irqrestore(&port->port_lock, flags);
-
-        gs_debug("gs_chars_in_buffer: (%d,%p) chars=%d\n",
-                port->port_num, tty, chars);
-
-        return chars;
-}
-
-/*
- * gs_throttle
- */
-static void gs_throttle(struct tty_struct *tty)
-{
-}
-
-/*
- * gs_unthrottle
- */
-static void gs_unthrottle(struct tty_struct *tty)
-{
-}
-
-/*
- * gs_break
- */
-static void gs_break(struct tty_struct *tty, int break_state)
-{
-}
-
-/*
- * gs_ioctl
- */
-static int gs_ioctl(struct tty_struct *tty, struct file *file, unsigned int cmd, unsigned long arg)
-{
-        struct gs_port *port = tty->driver_data;
-
-        if (port == NULL) {
-                pr_err("gs_ioctl: NULL port pointer\n");
-                return -EIO;
+        for (i = 0; i < n_ports && status == 0; i++) {
+                if (use_acm)
+                        status = acm_bind_config(c, i);
+                else
+                        status = gser_bind_config(c, i);
         }
-
-        gs_debug("gs_ioctl: (%d,%p,%p) cmd=0x%4.4x, arg=%lu\n",
-                port->port_num, tty, file, cmd, arg);
-
-        /* handle ioctls */
-
-        /* could not handle ioctl */
-        return -ENOIOCTLCMD;
-}
-
-/*
- * gs_set_termios
- */
-static void gs_set_termios(struct tty_struct *tty, struct ktermios *old)
-{
+        return status;
 }
 
-static const struct tty_operations gs_tty_ops = {
-        .open =                 gs_open,
-        .close =                gs_close,
-        .write =                gs_write,
-        .put_char =             gs_put_char,
-        .flush_chars =          gs_flush_chars,
-        .write_room =           gs_write_room,
-        .ioctl =                gs_ioctl,
-        .set_termios =          gs_set_termios,
-        .throttle =             gs_throttle,
-        .unthrottle =           gs_unthrottle,
-        .break_ctl =            gs_break,
-        .chars_in_buffer =      gs_chars_in_buffer,
+static struct usb_configuration serial_config_driver = {
+        /* .label = f(use_acm) */
+        .bind           = serial_bind_config,
+        /* .bConfigurationValue = f(use_acm) */
+        /* .iConfiguration = DYNAMIC */
+        .bmAttributes   = USB_CONFIG_ATT_SELFPOWER,
+        .bMaxPower      = 1,    /* 2 mA, minimal */
 };
 
-/*-------------------------------------------------------------------------*/
-
-/*
-* gs_send
-*
-* This function finds available write requests, calls
-* gs_send_packet to fill these packets with data, and
-* continues until either there are no more write requests
-* available or no more data to send.  This function is
-* run whenever data arrives or write requests are available.
-*/
-static int gs_send(struct gs_dev *dev)
-{
-        int ret,len;
-        unsigned long flags;
-        struct usb_ep *ep;
-        struct usb_request *req;
-
-        if (dev == NULL) {
-                pr_err("gs_send: NULL device pointer\n");
-                return -ENODEV;
-        }
-
-        spin_lock_irqsave(&dev->dev_lock, flags);
-
-        ep = dev->dev_in_ep;
-
-        while(!list_empty(&dev->dev_req_list)) {
-
-                req = list_entry(dev->dev_req_list.next,
-                                struct usb_request, list);
-
-                len = gs_send_packet(dev, req->buf, ep->maxpacket);
-
-                if (len > 0) {
-                        gs_debug_level(3, "gs_send: len=%d, 0x%2.2x "
-                                        "0x%2.2x 0x%2.2x ...\n", len,
-                                        *((unsigned char *)req->buf),
-                                        *((unsigned char *)req->buf+1),
-                                        *((unsigned char *)req->buf+2));
-                        list_del(&req->list);
-                        req->length = len;
-                        spin_unlock_irqrestore(&dev->dev_lock, flags);
-                        if ((ret=usb_ep_queue(ep, req, GFP_ATOMIC))) {
-                                pr_err(
-                                "gs_send: cannot queue read request, ret=%d\n",
-                                        ret);
-                                spin_lock_irqsave(&dev->dev_lock, flags);
-                                break;
-                        }
-                        spin_lock_irqsave(&dev->dev_lock, flags);
-                } else {
-                        break;
-                }
-
-        }
-
-        spin_unlock_irqrestore(&dev->dev_lock, flags);
-
-        return 0;
-}
-
-/*
- * gs_send_packet
- *
- * If there is data to send, a packet is built in the given
- * buffer and the size is returned.  If there is no data to
- * send, 0 is returned.  If there is any error a negative
- * error number is returned.
- *
- * Called during USB completion routine, on interrupt time.
- *
- * We assume that disconnect will not happen until all completion
- * routines have completed, so we can assume that the dev_port
- * array does not change during the lifetime of this function.
- */
-static int gs_send_packet(struct gs_dev *dev, char *packet, unsigned int size)
-{
-        unsigned int len;
-        struct gs_port *port;
-
-        /* TEMPORARY -- only port 0 is supported right now */
-        port = dev->dev_port[0];
-
-        if (port == NULL) {
-                pr_err("gs_send_packet: port=%d, NULL port pointer\n", 0);
-                return -EIO;
-        }
-
-        spin_lock(&port->port_lock);
-
-        len = gs_buf_data_avail(port->port_write_buf);
-        if (len < size)
-                size = len;
-
-        if (size == 0)
-                goto exit;
-
-        size = gs_buf_get(port->port_write_buf, packet, size);
-
-        if (port->port_tty)
-                wake_up_interruptible(&port->port_tty->write_wait);
-
-exit:
-        spin_unlock(&port->port_lock);
-        return size;
-}
-
-/*
- * gs_recv_packet
- *
- * Called for each USB packet received.  Reads the packet
- * header and stuffs the data in the appropriate tty buffer.
- * Returns 0 if successful, or a negative error number.
- *
- * Called during USB completion routine, on interrupt time.
- *
- * We assume that disconnect will not happen until all completion
- * routines have completed, so we can assume that the dev_port
- * array does not change during the lifetime of this function.
- */
-static int gs_recv_packet(struct gs_dev *dev, char *packet, unsigned int size)
-{
-        unsigned int len;
-        struct gs_port *port;
-        int ret;
-        struct tty_struct *tty;
-
-        /* TEMPORARY -- only port 0 is supported right now */
-        port = dev->dev_port[0];
-
-        if (port == NULL) {
-                pr_err("gs_recv_packet: port=%d, NULL port pointer\n",
-                        port->port_num);
-                return -EIO;
-        }
-
-        spin_lock(&port->port_lock);
-
-        if (port->port_open_count == 0) {
-                pr_err("gs_recv_packet: port=%d, port is closed\n",
-                        port->port_num);
-                ret = -EIO;
-                goto exit;
-        }
-
-
-        tty = port->port_tty;
-
-        if (tty == NULL) {
-                pr_err("gs_recv_packet: port=%d, NULL tty pointer\n",
-                        port->port_num);
-                ret = -EIO;
-                goto exit;
-        }
-
-        if (port->port_tty->magic != TTY_MAGIC) {
-                pr_err("gs_recv_packet: port=%d, bad tty magic\n",
-                        port->port_num);
-                ret = -EIO;
-                goto exit;
-        }
-
-        len = tty_buffer_request_room(tty, size);
-        if (len > 0) {
-                tty_insert_flip_string(tty, packet, len);
-                tty_flip_buffer_push(port->port_tty);
-                wake_up_interruptible(&port->port_tty->read_wait);
-        }
-        ret = 0;
-exit:
-        spin_unlock(&port->port_lock);
-        return ret;
-}
-
-/*
-* gs_read_complete
-*/
-static void gs_read_complete(struct usb_ep *ep, struct usb_request *req)
+static int __init gs_bind(struct usb_composite_dev *cdev)
 {
-        int ret;
-        struct gs_dev *dev = ep->driver_data;
-
-        if (dev == NULL) {
-                pr_err("gs_read_complete: NULL device pointer\n");
-                return;
-        }
+        int                     gcnum;
+        struct usb_gadget       *gadget = cdev->gadget;
+        int                     status;
 
-        switch(req->status) {
-        case 0:
-                /* normal completion */
-                gs_recv_packet(dev, req->buf, req->actual);
-requeue:
-                req->length = ep->maxpacket;
-                if ((ret=usb_ep_queue(ep, req, GFP_ATOMIC))) {
-                        pr_err(
-                        "gs_read_complete: cannot queue read request, ret=%d\n",
-                                ret);
-                }
-                break;
-
-        case -ESHUTDOWN:
-                /* disconnect */
-                gs_debug("gs_read_complete: shutdown\n");
-                gs_free_req(ep, req);
-                break;
-
-        default:
-                /* unexpected */
-                pr_err(
-                "gs_read_complete: unexpected status error, status=%d\n",
-                        req->status);
-                goto requeue;
-                break;
-        }
-}
-
-/*
-* gs_write_complete
-*/
-static void gs_write_complete(struct usb_ep *ep, struct usb_request *req)
-{
-        struct gs_dev *dev = ep->driver_data;
-
-        if (dev == NULL) {
-                pr_err("gs_write_complete: NULL device pointer\n");
-                return;
-        }
+        status = gserial_setup(cdev->gadget, n_ports);
+        if (status < 0)
+                return status;
 
-        switch(req->status) {
-        case 0:
-                /* normal completion */
-requeue:
-                spin_lock(&dev->dev_lock);
-                list_add(&req->list, &dev->dev_req_list);
-                spin_unlock(&dev->dev_lock);
-
-                gs_send(dev);
-
-                break;
-
-        case -ESHUTDOWN:
-                /* disconnect */
-                gs_debug("gs_write_complete: shutdown\n");
-                gs_free_req(ep, req);
-                break;
-
-        default:
-                pr_err(
-                "gs_write_complete: unexpected status error, status=%d\n",
-                        req->status);
-                goto requeue;
-                break;
-        }
-}
+        /* Allocate string descriptor numbers ... note that string
+         * contents can be overridden by the composite_dev glue.
+         */
 
-/*-------------------------------------------------------------------------*/
+        /* device description: manufacturer, product */
+        snprintf(manufacturer, sizeof manufacturer, "%s %s with %s",
+                init_utsname()->sysname, init_utsname()->release,
+                gadget->name);
+        status = usb_string_id(cdev);
+        if (status < 0)
+                goto fail;
+        strings_dev[STRING_MANUFACTURER_IDX].id = status;
 
-/* Gadget Driver */
+        device_desc.iManufacturer = status;
 
-/*
- * gs_unbind
- *
- * Called on module unload.  Frees the control request and device
- * structure.
- */
-static void /* __init_or_exit */ gs_unbind(struct usb_gadget *gadget)
-{
-        struct gs_dev *dev = get_gadget_data(gadget);
+        status = usb_string_id(cdev);
+        if (status < 0)
+                goto fail;
+        strings_dev[STRING_PRODUCT_IDX].id = status;
 
-        gs_device = NULL;
+        device_desc.iProduct = status;
 
-        /* read/write requests already freed, only control request remains */
-        if (dev != NULL) {
-                if (dev->dev_ctrl_req != NULL) {
-                        gs_free_req(gadget->ep0, dev->dev_ctrl_req);
-                        dev->dev_ctrl_req = NULL;
-                }
-                gs_reset_config(dev);
-                gs_free_ports(dev);
-                kfree(dev);
-                set_gadget_data(gadget, NULL);
-        }
+        /* config description */
+        status = usb_string_id(cdev);
+        if (status < 0)
+                goto fail;
+        strings_dev[STRING_DESCRIPTION_IDX].id = status;
 
-        pr_info("gs_unbind: %s %s unbound\n", GS_LONG_NAME,
-                GS_VERSION_STR);
-}
-
-/*
- * gs_bind
- *
- * Called on module load.  Allocates and initializes the device
- * structure and a control request.
- */
-static int __init gs_bind(struct usb_gadget *gadget)
-{
-        int ret;
-        struct usb_ep *ep;
-        struct gs_dev *dev;
-        int gcnum;
-
-        /* Some controllers can't support CDC ACM:
-         * - sh doesn't support multiple interfaces or configs;
-         * - sa1100 doesn't have a third interrupt endpoint
-         */
-        if (gadget_is_sh(gadget) || gadget_is_sa1100(gadget))
-                use_acm = 0;
+        serial_config_driver.iConfiguration = status;
 
+        /* set up other descriptors */
         gcnum = usb_gadget_controller_number(gadget);
         if (gcnum >= 0)
-                gs_device_desc.bcdDevice =
-                                cpu_to_le16(GS_VERSION_NUM | gcnum);
+                device_desc.bcdDevice = cpu_to_le16(GS_VERSION_NUM | gcnum);
         else {
+                /* this is so simple (for now, no altsettings) that it
+                 * SHOULD NOT have problems with bulk-capable hardware.
+                 * so warn about unrcognized controllers -- don't panic.
+                 *
+                 * things like configuration and altsetting numbering
+                 * can need hardware-specific attention though.
+                 */
                 pr_warning("gs_bind: controller '%s' not recognized\n",
                         gadget->name);
-                /* unrecognized, but safe unless bulk is REALLY quirky */
-                gs_device_desc.bcdDevice =
-                        __constant_cpu_to_le16(GS_VERSION_NUM|0x0099);
-        }
-
-        dev = kzalloc(sizeof(struct gs_dev), GFP_KERNEL);
-        if (dev == NULL)
-                return -ENOMEM;
-
-        usb_ep_autoconfig_reset(gadget);
-
-        ep = usb_ep_autoconfig(gadget, &gs_fullspeed_in_desc);
-        if (!ep)
-                goto autoconf_fail;
-        dev->dev_in_ep = ep;
-        ep->driver_data = dev;  /* claim the endpoint */
-
-        ep = usb_ep_autoconfig(gadget, &gs_fullspeed_out_desc);
-        if (!ep)
-                goto autoconf_fail;
-        dev->dev_out_ep = ep;
-        ep->driver_data = dev;  /* claim the endpoint */
-
-        if (use_acm) {
-                ep = usb_ep_autoconfig(gadget, &gs_fullspeed_notify_desc);
-                if (!ep) {
-                        pr_err("gs_bind: cannot run ACM on %s\n", gadget->name);
-                        goto autoconf_fail;
-                }
-                gs_device_desc.idProduct = __constant_cpu_to_le16(
-                                                GS_CDC_PRODUCT_ID),
-                dev->dev_notify_ep = ep;
-                ep->driver_data = dev;  /* claim the endpoint */
-        }
-
-        gs_device_desc.bDeviceClass = use_acm
-                ? USB_CLASS_COMM : USB_CLASS_VENDOR_SPEC;
-        gs_device_desc.bMaxPacketSize0 = gadget->ep0->maxpacket;
-
-        if (gadget_is_dualspeed(gadget)) {
-                gs_qualifier_desc.bDeviceClass = use_acm
-                        ? USB_CLASS_COMM : USB_CLASS_VENDOR_SPEC;
-                /* assume ep0 uses the same packet size for both speeds */
-                gs_qualifier_desc.bMaxPacketSize0 =
-                        gs_device_desc.bMaxPacketSize0;
-                /* assume endpoints are dual-speed */
-                gs_highspeed_notify_desc.bEndpointAddress =
-                        gs_fullspeed_notify_desc.bEndpointAddress;
-                gs_highspeed_in_desc.bEndpointAddress =
-                        gs_fullspeed_in_desc.bEndpointAddress;
-                gs_highspeed_out_desc.bEndpointAddress =
-                        gs_fullspeed_out_desc.bEndpointAddress;
-        }
-
-        usb_gadget_set_selfpowered(gadget);
-
-        if (gadget_is_otg(gadget)) {
-                gs_otg_descriptor.bmAttributes |= USB_OTG_HNP,
-                gs_bulk_config_desc.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
-                gs_acm_config_desc.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
+                device_desc.bcdDevice =
+                        __constant_cpu_to_le16(GS_VERSION_NUM | 0x0099);
         }
 
-        gs_device = dev;
-
-        snprintf(manufacturer, sizeof(manufacturer), "%s %s with %s",
-                init_utsname()->sysname, init_utsname()->release,
-                gadget->name);
-
-        dev->dev_gadget = gadget;
-        spin_lock_init(&dev->dev_lock);
-        INIT_LIST_HEAD(&dev->dev_req_list);
-        set_gadget_data(gadget, dev);
-
-        if ((ret=gs_alloc_ports(dev, GFP_KERNEL)) != 0) {
-                pr_err("gs_bind: cannot allocate ports\n");
-                gs_unbind(gadget);
-                return ret;
+        if (gadget_is_otg(cdev->gadget)) {
+                serial_config_driver.descriptors = otg_desc;
+                serial_config_driver.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
         }
 
-        /* preallocate control response and buffer */
-        dev->dev_ctrl_req = gs_alloc_req(gadget->ep0, GS_MAX_DESC_LEN,
-                GFP_KERNEL);
-        if (dev->dev_ctrl_req == NULL) {
-                gs_unbind(gadget);
-                return -ENOMEM;
-        }
-        gadget->ep0->driver_data = dev;
+        /* register our configuration */
+        status = usb_add_config(cdev, &serial_config_driver);
+        if (status < 0)
+                goto fail;
 
-        pr_info("gs_bind: %s %s bound\n",
-                GS_LONG_NAME, GS_VERSION_STR);
+        INFO(cdev, "%s\n", GS_VERSION_NAME);
 
         return 0;
 
-autoconf_fail:
-        kfree(dev);
-        pr_err("gs_bind: cannot autoconfigure on %s\n", gadget->name);
-        return -ENODEV;
-}
-
-static int gs_setup_standard(struct usb_gadget *gadget,
-        const struct usb_ctrlrequest *ctrl)
-{
-        int ret = -EOPNOTSUPP;
-        struct gs_dev *dev = get_gadget_data(gadget);
-        struct usb_request *req = dev->dev_ctrl_req;
-        u16 wIndex = le16_to_cpu(ctrl->wIndex);
-        u16 wValue = le16_to_cpu(ctrl->wValue);
-        u16 wLength = le16_to_cpu(ctrl->wLength);
-
-        switch (ctrl->bRequest) {
-        case USB_REQ_GET_DESCRIPTOR:
-                if (ctrl->bRequestType != USB_DIR_IN)
-                        break;
-
-                switch (wValue >> 8) {
-                case USB_DT_DEVICE:
-                        ret = min(wLength,
-                                (u16)sizeof(struct usb_device_descriptor));
-                        memcpy(req->buf, &gs_device_desc, ret);
-                        break;
-
-                case USB_DT_DEVICE_QUALIFIER:
-                        if (!gadget_is_dualspeed(gadget))
-                                break;
-                        ret = min(wLength,
-                                (u16)sizeof(struct usb_qualifier_descriptor));
-                        memcpy(req->buf, &gs_qualifier_desc, ret);
-                        break;
-
-                case USB_DT_OTHER_SPEED_CONFIG:
-                        if (!gadget_is_dualspeed(gadget))
-                                break;
-                        /* fall through */
-                case USB_DT_CONFIG:
-                        ret = gs_build_config_buf(req->buf, gadget,
-                                wValue >> 8, wValue & 0xff,
-                                gadget_is_otg(gadget));
-                        if (ret >= 0)
-                                ret = min(wLength, (u16)ret);
-                        break;
-
-                case USB_DT_STRING:
-                        /* wIndex == language code. */
-                        ret = usb_gadget_get_string(&gs_string_table,
-                                wValue & 0xff, req->buf);
-                        if (ret >= 0)
-                                ret = min(wLength, (u16)ret);
-                        break;
-                }
-                break;
-
-        case USB_REQ_SET_CONFIGURATION:
-                if (ctrl->bRequestType != 0)
-                        break;
-                spin_lock(&dev->dev_lock);
-                ret = gs_set_config(dev, wValue);
-                spin_unlock(&dev->dev_lock);
-                break;
-
-        case USB_REQ_GET_CONFIGURATION:
-                if (ctrl->bRequestType != USB_DIR_IN)
-                        break;
-                *(u8 *)req->buf = dev->dev_config;
-                ret = min(wLength, (u16)1);
-                break;
-
-        case USB_REQ_SET_INTERFACE:
-                if (ctrl->bRequestType != USB_RECIP_INTERFACE
-                                || !dev->dev_config
-                                || wIndex >= GS_MAX_NUM_INTERFACES)
-                        break;
-                if (dev->dev_config == GS_BULK_CONFIG_ID
-                                && wIndex != GS_BULK_INTERFACE_ID)
-                        break;
-                /* no alternate interface settings */
-                if (wValue != 0)
-                        break;
-                spin_lock(&dev->dev_lock);
-                /* PXA hardware partially handles SET_INTERFACE;
-                 * we need to kluge around that interference.  */
-                if (gadget_is_pxa(gadget)) {
-                        ret = gs_set_config(dev, use_acm ?
-                                GS_ACM_CONFIG_ID : GS_BULK_CONFIG_ID);
-                        goto set_interface_done;
-                }
-                if (dev->dev_config != GS_BULK_CONFIG_ID
-                                && wIndex == GS_CONTROL_INTERFACE_ID) {
-                        if (dev->dev_notify_ep) {
-                                usb_ep_disable(dev->dev_notify_ep);
-                                usb_ep_enable(dev->dev_notify_ep, dev->dev_notify_ep_desc);
-                        }
-                } else {
-                        usb_ep_disable(dev->dev_in_ep);
-                        usb_ep_disable(dev->dev_out_ep);
-                        usb_ep_enable(dev->dev_in_ep, dev->dev_in_ep_desc);
-                        usb_ep_enable(dev->dev_out_ep, dev->dev_out_ep_desc);
-                }
-                ret = 0;
-set_interface_done:
-                spin_unlock(&dev->dev_lock);
-                break;
-
-        case USB_REQ_GET_INTERFACE:
-                if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE)
-                || dev->dev_config == GS_NO_CONFIG_ID)
-                        break;
-                if (wIndex >= GS_MAX_NUM_INTERFACES
-                                || (dev->dev_config == GS_BULK_CONFIG_ID
-                                && wIndex != GS_BULK_INTERFACE_ID)) {
-                        ret = -EDOM;
-                        break;
-                }
-                /* no alternate interface settings */
-                *(u8 *)req->buf = 0;
-                ret = min(wLength, (u16)1);
-                break;
-
-        default:
-                pr_err("gs_setup: unknown standard request, type=%02x, "
-                        "request=%02x, value=%04x, index=%04x, length=%d\n",
-                        ctrl->bRequestType, ctrl->bRequest,
-                        wValue, wIndex, wLength);
-                break;
-        }
-
-        return ret;
+fail:
+        gserial_cleanup();
+        return status;
 }
 
-static void gs_setup_complete_set_line_coding(struct usb_ep *ep,
-                struct usb_request *req)
-{
-        struct gs_dev *dev = ep->driver_data;
-        struct gs_port *port = dev->dev_port[0]; /* ACM only has one port */
-
-        switch (req->status) {
-        case 0:
-                /* normal completion */
-                if (req->actual != sizeof(port->port_line_coding))
-                        usb_ep_set_halt(ep);
-                else if (port) {
-                        struct usb_cdc_line_coding      *value = req->buf;
-
-                        /* REVISIT:  we currently just remember this data.
-                         * If we change that, (a) validate it first, then
-                         * (b) update whatever hardware needs updating.
-                         */
-                        spin_lock(&port->port_lock);
-                        port->port_line_coding = *value;
-                        spin_unlock(&port->port_lock);
-                }
-                break;
-
-        case -ESHUTDOWN:
-                /* disconnect */
-                gs_free_req(ep, req);
-                break;
-
-        default:
-                /* unexpected */
-                break;
-        }
-        return;
-}
-
-static int gs_setup_class(struct usb_gadget *gadget,
-        const struct usb_ctrlrequest *ctrl)
-{
-        int ret = -EOPNOTSUPP;
-        struct gs_dev *dev = get_gadget_data(gadget);
-        struct gs_port *port = dev->dev_port[0];        /* ACM only has one port */
-        struct usb_request *req = dev->dev_ctrl_req;
-        u16 wIndex = le16_to_cpu(ctrl->wIndex);
-        u16 wValue = le16_to_cpu(ctrl->wValue);
-        u16 wLength = le16_to_cpu(ctrl->wLength);
-
-        switch (ctrl->bRequest) {
-        case USB_CDC_REQ_SET_LINE_CODING:
-                if (wLength != sizeof(struct usb_cdc_line_coding))
-                        break;
-                ret = wLength;
-                req->complete = gs_setup_complete_set_line_coding;
-                break;
-
-        case USB_CDC_REQ_GET_LINE_CODING:
-                ret = min_t(int, wLength, sizeof(struct usb_cdc_line_coding));
-                if (port) {
-                        spin_lock(&port->port_lock);
-                        memcpy(req->buf, &port->port_line_coding, ret);
-                        spin_unlock(&port->port_lock);
-                }
-                break;
-
-        case USB_CDC_REQ_SET_CONTROL_LINE_STATE:
-                if (wLength != 0)
-                        break;
-                ret = 0;
-                if (port) {
-                        /* REVISIT:  we currently just remember this data.
-                         * If we change that, update whatever hardware needs
-                         * updating.
-                         */
-                        spin_lock(&port->port_lock);
-                        port->port_handshake_bits = wValue;
-                        spin_unlock(&port->port_lock);
-                }
-                break;
-
-        default:
-                /* NOTE:  strictly speaking, we should accept AT-commands
-                 * using SEND_ENCPSULATED_COMMAND/GET_ENCAPSULATED_RESPONSE.
-                 * But our call management descriptor says we don't handle
-                 * call management, so we should be able to get by without
-                 * handling those "required" commands (except by stalling).
-                 */
-                pr_err("gs_setup: unknown class request, "
-                                "type=%02x, request=%02x, value=%04x, "
-                                "index=%04x, length=%d\n",
-                        ctrl->bRequestType, ctrl->bRequest,
-                        wValue, wIndex, wLength);
-                break;
-        }
-
-        return ret;
-}
-
-/*
- * gs_setup_complete
- */
-static void gs_setup_complete(struct usb_ep *ep, struct usb_request *req)
-{
-        if (req->status || req->actual != req->length) {
-                pr_err("gs_setup_complete: status error, status=%d, "
-                        "actual=%d, length=%d\n",
-                        req->status, req->actual, req->length);
-        }
-}
-
-/*
- * gs_setup
- *
- * Implements all the control endpoint functionality that's not
- * handled in hardware or the hardware driver.
- *
- * Returns the size of the data sent to the host, or a negative
- * error number.
- */
-static int gs_setup(struct usb_gadget *gadget,
-        const struct usb_ctrlrequest *ctrl)
-{
-        int             ret = -EOPNOTSUPP;
-        struct gs_dev   *dev = get_gadget_data(gadget);
-        struct usb_request *req = dev->dev_ctrl_req;
-        u16             wIndex = le16_to_cpu(ctrl->wIndex);
-        u16             wValue = le16_to_cpu(ctrl->wValue);
-        u16             wLength = le16_to_cpu(ctrl->wLength);
-
-        req->complete = gs_setup_complete;
-
-        switch (ctrl->bRequestType & USB_TYPE_MASK) {
-        case USB_TYPE_STANDARD:
-                ret = gs_setup_standard(gadget, ctrl);
-                break;
-
-        case USB_TYPE_CLASS:
-                ret = gs_setup_class(gadget, ctrl);
-                break;
-
-        default:
-                pr_err("gs_setup: unknown request, type=%02x, request=%02x, "
-                        "value=%04x, index=%04x, length=%d\n",
-                        ctrl->bRequestType, ctrl->bRequest,
-                        wValue, wIndex, wLength);
-                break;
-        }
-
-        /* respond with data transfer before status phase? */
-        if (ret >= 0) {
-                req->length = ret;
-                req->zero = ret < wLength
-                                && (ret % gadget->ep0->maxpacket) == 0;
-                ret = usb_ep_queue(gadget->ep0, req, GFP_ATOMIC);
-                if (ret < 0) {
-                        pr_err("gs_setup: cannot queue response, ret=%d\n",
-                                ret);
-                        req->status = 0;
-                        gs_setup_complete(gadget->ep0, req);
-                }
-        }
-
-        /* device either stalls (ret < 0) or reports success */
-        return ret;
-}
-
-/*
- * gs_disconnect
- *
- * Called when the device is disconnected.  Frees the closed
- * ports and disconnects open ports.  Open ports will be freed
- * on close.  Then reallocates the ports for the next connection.
- */
-static void gs_disconnect(struct usb_gadget *gadget)
-{
-        unsigned long flags;
-        struct gs_dev *dev = get_gadget_data(gadget);
-
-        spin_lock_irqsave(&dev->dev_lock, flags);
-
-        gs_reset_config(dev);
-
-        /* free closed ports and disconnect open ports */
-        /* (open ports will be freed when closed) */
-        gs_free_ports(dev);
-
-        /* re-allocate ports for the next connection */
-        if (gs_alloc_ports(dev, GFP_ATOMIC) != 0)
-                pr_err("gs_disconnect: cannot re-allocate ports\n");
-
-        spin_unlock_irqrestore(&dev->dev_lock, flags);
-
-        pr_info("gs_disconnect: %s disconnected\n", GS_LONG_NAME);
-}
-
-static struct usb_gadget_driver gs_gadget_driver = {
-#ifdef CONFIG_USB_GADGET_DUALSPEED
-        .speed =                USB_SPEED_HIGH,
-#else
-        .speed =                USB_SPEED_FULL,
-#endif /* CONFIG_USB_GADGET_DUALSPEED */
-        .function =             GS_LONG_NAME,
-        .bind =                 gs_bind,
-        .unbind =               gs_unbind,
-        .setup =                gs_setup,
-        .disconnect =           gs_disconnect,
-        .driver = {
-                .name =         GS_SHORT_NAME,
-                .owner =        THIS_MODULE,
-        },
+static struct usb_composite_driver gserial_driver = {
+        .name           = "g_serial",
+        .dev            = &device_desc,
+        .strings        = dev_strings,
+        .bind           = gs_bind,
 };
 
-/*
- * gs_set_config
- *
- * Configures the device by enabling device specific
- * optimizations, setting up the endpoints, allocating
- * read and write requests and queuing read requests.
- *
- * The device lock must be held when calling this function.
- */
-static int gs_set_config(struct gs_dev *dev, unsigned config)
+static int __init init(void)
 {
-        int i;
-        int ret = 0;
-        struct usb_gadget *gadget = dev->dev_gadget;
-        struct usb_ep *ep;
-        struct usb_endpoint_descriptor *out, *in, *notify;
-        struct usb_request *req;
-
-        if (dev == NULL) {
-                pr_err("gs_set_config: NULL device pointer\n");
-                return 0;
-        }
-
-        if (config == dev->dev_config)
-                return 0;
-
-        gs_reset_config(dev);
-
-        switch (config) {
-        case GS_NO_CONFIG_ID:
-                return 0;
-        case GS_BULK_CONFIG_ID:
-                if (use_acm)
-                        return -EINVAL;
-                break;
-        case GS_ACM_CONFIG_ID:
-                if (!use_acm)
-                        return -EINVAL;
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        in = choose_ep_desc(gadget,
-                        &gs_highspeed_in_desc,
-                        &gs_fullspeed_in_desc);
-        out = choose_ep_desc(gadget,
-                        &gs_highspeed_out_desc,
-                        &gs_fullspeed_out_desc);
-        notify = dev->dev_notify_ep
-                ? choose_ep_desc(gadget,
-                                &gs_highspeed_notify_desc,
-                                &gs_fullspeed_notify_desc)
-                : NULL;
-
-        ret = usb_ep_enable(dev->dev_in_ep, in);
-        if (ret == 0) {
-                dev->dev_in_ep_desc = in;
-        } else {
-                pr_debug("%s: cannot enable %s %s, ret=%d\n",
-                        __func__, "IN", dev->dev_in_ep->name, ret);
-                return ret;
-        }
-
-        ret = usb_ep_enable(dev->dev_out_ep, out);
-        if (ret == 0) {
-                dev->dev_out_ep_desc = out;
-        } else {
-                pr_debug("%s: cannot enable %s %s, ret=%d\n",
-                        __func__, "OUT", dev->dev_out_ep->name, ret);
-fail0:
-                usb_ep_disable(dev->dev_in_ep);
-                return ret;
-        }
-
-        if (notify) {
-                ret = usb_ep_enable(dev->dev_notify_ep, notify);
-                if (ret == 0) {
-                        dev->dev_notify_ep_desc = notify;
-                } else {
-                        pr_debug("%s: cannot enable %s %s, ret=%d\n",
-                                __func__, "NOTIFY",
-                                dev->dev_notify_ep->name, ret);
-                        usb_ep_disable(dev->dev_out_ep);
-                        goto fail0;
-                }
-        }
-
-        dev->dev_config = config;
-
-        /* allocate and queue read requests */
-        ep = dev->dev_out_ep;
-        for (i=0; i<read_q_size && ret == 0; i++) {
-                if ((req=gs_alloc_req(ep, ep->maxpacket, GFP_ATOMIC))) {
-                        req->complete = gs_read_complete;
-                        if ((ret=usb_ep_queue(ep, req, GFP_ATOMIC))) {
-                                pr_err("gs_set_config: cannot queue read "
-                                        "request, ret=%d\n", ret);
-                        }
-                } else {
-                        pr_err("gs_set_config: cannot allocate "
-                                        "read requests\n");
-                        ret = -ENOMEM;
-                        goto exit_reset_config;
-                }
-        }
-
-        /* allocate write requests, and put on free list */
-        ep = dev->dev_in_ep;
-        for (i=0; i<write_q_size; i++) {
-                req = gs_alloc_req(ep, ep->maxpacket, GFP_ATOMIC);
-                if (req) {
-                        req->complete = gs_write_complete;
-                        list_add(&req->list, &dev->dev_req_list);
-                } else {
-                        pr_err("gs_set_config: cannot allocate "
-                                        "write requests\n");
-                        ret = -ENOMEM;
-                        goto exit_reset_config;
-                }
-        }
-
-        /* REVISIT the ACM mode should be able to actually *issue* some
-         * notifications, for at least serial state change events if
-         * not also for network connection; say so in bmCapabilities.
+        /* We *could* export two configs; that'd be much cleaner...
+         * but neither of these product IDs was defined that way.
          */
-
-        pr_info("gs_set_config: %s configured, %s speed %s config\n",
-                GS_LONG_NAME,
-                gadget->speed == USB_SPEED_HIGH ? "high" : "full",
-                config == GS_BULK_CONFIG_ID ? "BULK" : "CDC-ACM");
-
-        return 0;
-
-exit_reset_config:
-        gs_reset_config(dev);
-        return ret;
-}
-
-/*
- * gs_reset_config
- *
- * Mark the device as not configured, disable all endpoints,
- * which forces completion of pending I/O and frees queued
- * requests, and free the remaining write requests on the
- * free list.
- *
- * The device lock must be held when calling this function.
- */
-static void gs_reset_config(struct gs_dev *dev)
-{
-        struct usb_request *req;
-
-        if (dev == NULL) {
-                pr_err("gs_reset_config: NULL device pointer\n");
-                return;
-        }
-
-        if (dev->dev_config == GS_NO_CONFIG_ID)
-                return;
-
-        dev->dev_config = GS_NO_CONFIG_ID;
-
-        /* free write requests on the free list */
-        while(!list_empty(&dev->dev_req_list)) {
-                req = list_entry(dev->dev_req_list.next,
-                                struct usb_request, list);
-                list_del(&req->list);
-                gs_free_req(dev->dev_in_ep, req);
-        }
-
-        /* disable endpoints, forcing completion of pending i/o; */
-        /* completion handlers free their requests in this case */
-        if (dev->dev_notify_ep)
-                usb_ep_disable(dev->dev_notify_ep);
-        usb_ep_disable(dev->dev_in_ep);
-        usb_ep_disable(dev->dev_out_ep);
-}
-
-/*
- * gs_build_config_buf
- *
- * Builds the config descriptors in the given buffer and returns the
- * length, or a negative error number.
- */
-static int gs_build_config_buf(u8 *buf, struct usb_gadget *g,
-        u8 type, unsigned int index, int is_otg)
-{
-        int len;
-        int high_speed = 0;
-        const struct usb_config_descriptor *config_desc;
-        const struct usb_descriptor_header **function;
-
-        if (index >= gs_device_desc.bNumConfigurations)
-                return -EINVAL;
-
-        /* other speed switches high and full speed */
-        if (gadget_is_dualspeed(g)) {
-                high_speed = (g->speed == USB_SPEED_HIGH);
-                if (type == USB_DT_OTHER_SPEED_CONFIG)
-                        high_speed = !high_speed;
-        }
-
         if (use_acm) {
-                config_desc = &gs_acm_config_desc;
-                function = high_speed
-                        ? gs_acm_highspeed_function
-                        : gs_acm_fullspeed_function;
+                serial_config_driver.label = "CDC ACM config";
+                serial_config_driver.bConfigurationValue = 2;
+                device_desc.bDeviceClass = USB_CLASS_COMM;
+                device_desc.idProduct =
+                                __constant_cpu_to_le16(GS_CDC_PRODUCT_ID);
         } else {
-                config_desc = &gs_bulk_config_desc;
-                function = high_speed
-                        ? gs_bulk_highspeed_function
-                        : gs_bulk_fullspeed_function;
-        }
-
-        /* for now, don't advertise srp-only devices */
-        if (!is_otg)
-                function++;
-
-        len = usb_gadget_config_buf(config_desc, buf, GS_MAX_DESC_LEN, function);
-        if (len < 0)
-                return len;
-
-        ((struct usb_config_descriptor *)buf)->bDescriptorType = type;
-
-        return len;
-}
-
-/*
- * gs_alloc_req
- *
- * Allocate a usb_request and its buffer.  Returns a pointer to the
- * usb_request or NULL if there is an error.
- */
-static struct usb_request *
-gs_alloc_req(struct usb_ep *ep, unsigned int len, gfp_t kmalloc_flags)
-{
-        struct usb_request *req;
-
-        if (ep == NULL)
-                return NULL;
-
-        req = usb_ep_alloc_request(ep, kmalloc_flags);
-
-        if (req != NULL) {
-                req->length = len;
-                req->buf = kmalloc(len, kmalloc_flags);
-                if (req->buf == NULL) {
-                        usb_ep_free_request(ep, req);
-                        return NULL;
-                }
+                serial_config_driver.label = "Generic Serial config";
+                serial_config_driver.bConfigurationValue = 1;
+                device_desc.bDeviceClass = USB_CLASS_VENDOR_SPEC;
+                device_desc.idProduct =
+                                __constant_cpu_to_le16(GS_PRODUCT_ID);
         }
+        strings_dev[STRING_DESCRIPTION_IDX].s = serial_config_driver.label;
 
-        return req;
+        return usb_composite_register(&gserial_driver);
 }
+module_init(init);
 
-/*
- * gs_free_req
- *
- * Free a usb_request and its buffer.
- */
-static void gs_free_req(struct usb_ep *ep, struct usb_request *req)
+static void __exit cleanup(void)
 {
-        if (ep != NULL && req != NULL) {
-                kfree(req->buf);
-                usb_ep_free_request(ep, req);
-        }
-}
-
-/*
- * gs_alloc_ports
- *
- * Allocate all ports and set the gs_dev struct to point to them.
- * Return 0 if successful, or a negative error number.
- *
- * The device lock is normally held when calling this function.
- */
-static int gs_alloc_ports(struct gs_dev *dev, gfp_t kmalloc_flags)
-{
-        int i;
-        struct gs_port *port;
-
-        if (dev == NULL)
-                return -EIO;
-
-        for (i=0; i<GS_NUM_PORTS; i++) {
-                if ((port=kzalloc(sizeof(struct gs_port), kmalloc_flags)) == NULL)
-                        return -ENOMEM;
-
-                port->port_dev = dev;
-                port->port_num = i;
-                port->port_line_coding.dwDTERate = cpu_to_le32(GS_DEFAULT_DTE_RATE);
-                port->port_line_coding.bCharFormat = GS_DEFAULT_CHAR_FORMAT;
-                port->port_line_coding.bParityType = GS_DEFAULT_PARITY;
-                port->port_line_coding.bDataBits = GS_DEFAULT_DATA_BITS;
-                spin_lock_init(&port->port_lock);
-                init_waitqueue_head(&port->port_write_wait);
-
-                dev->dev_port[i] = port;
-        }
-
-        return 0;
-}
-
-/*
- * gs_free_ports
- *
- * Free all closed ports.  Open ports are disconnected by
- * freeing their write buffers, setting their device pointers
- * and the pointers to them in the device to NULL.  These
- * ports will be freed when closed.
- *
- * The device lock is normally held when calling this function.
- */
-static void gs_free_ports(struct gs_dev *dev)
-{
-        int i;
-        unsigned long flags;
-        struct gs_port *port;
-
-        if (dev == NULL)
-                return;
-
-        for (i=0; i<GS_NUM_PORTS; i++) {
-                if ((port=dev->dev_port[i]) != NULL) {
-                        dev->dev_port[i] = NULL;
-
-                        spin_lock_irqsave(&port->port_lock, flags);
-
-                        if (port->port_write_buf != NULL) {
-                                gs_buf_free(port->port_write_buf);
-                                port->port_write_buf = NULL;
-                        }
-
-                        if (port->port_open_count > 0 || port->port_in_use) {
-                                port->port_dev = NULL;
-                                wake_up_interruptible(&port->port_write_wait);
-                                if (port->port_tty) {
-                                        tty_hangup(port->port_tty);
-                                }
-                                spin_unlock_irqrestore(&port->port_lock, flags);
-                        } else {
-                                spin_unlock_irqrestore(&port->port_lock, flags);
-                                kfree(port);
-                        }
-
-                }
-        }
-}
-
-/*-------------------------------------------------------------------------*/
-
-/* Circular Buffer */
-
-/*
- * gs_buf_alloc
- *
- * Allocate a circular buffer and all associated memory.
- */
-static struct gs_buf *gs_buf_alloc(unsigned int size, gfp_t kmalloc_flags)
-{
-        struct gs_buf *gb;
-
-        if (size == 0)
-                return NULL;
-
-        gb = kmalloc(sizeof(struct gs_buf), kmalloc_flags);
-        if (gb == NULL)
-                return NULL;
-
-        gb->buf_buf = kmalloc(size, kmalloc_flags);
-        if (gb->buf_buf == NULL) {
-                kfree(gb);
-                return NULL;
-        }
-
-        gb->buf_size = size;
-        gb->buf_get = gb->buf_put = gb->buf_buf;
-
-        return gb;
-}
-
-/*
- * gs_buf_free
- *
- * Free the buffer and all associated memory.
- */
-static void gs_buf_free(struct gs_buf *gb)
-{
-        if (gb) {
-                kfree(gb->buf_buf);
-                kfree(gb);
-        }
-}
-
-/*
- * gs_buf_clear
- *
- * Clear out all data in the circular buffer.
- */
-static void gs_buf_clear(struct gs_buf *gb)
-{
-        if (gb != NULL)
-                gb->buf_get = gb->buf_put;
-                /* equivalent to a get of all data available */
-}
-
-/*
- * gs_buf_data_avail
- *
- * Return the number of bytes of data available in the circular
- * buffer.
- */
-static unsigned int gs_buf_data_avail(struct gs_buf *gb)
-{
-        if (gb != NULL)
-                return (gb->buf_size + gb->buf_put - gb->buf_get) % gb->buf_size;
-        else
-                return 0;
-}
-
-/*
- * gs_buf_space_avail
- *
- * Return the number of bytes of space available in the circular
- * buffer.
- */
-static unsigned int gs_buf_space_avail(struct gs_buf *gb)
-{
-        if (gb != NULL)
-                return (gb->buf_size + gb->buf_get - gb->buf_put - 1) % gb->buf_size;
-        else
-                return 0;
-}
-
-/*
- * gs_buf_put
- *
- * Copy data data from a user buffer and put it into the circular buffer.
- * Restrict to the amount of space available.
- *
- * Return the number of bytes copied.
- */
-static unsigned int
-gs_buf_put(struct gs_buf *gb, const char *buf, unsigned int count)
-{
-        unsigned int len;
-
-        if (gb == NULL)
-                return 0;
-
-        len  = gs_buf_space_avail(gb);
-        if (count > len)
-                count = len;
-
-        if (count == 0)
-                return 0;
-
-        len = gb->buf_buf + gb->buf_size - gb->buf_put;
-        if (count > len) {
-                memcpy(gb->buf_put, buf, len);
-                memcpy(gb->buf_buf, buf+len, count - len);
-                gb->buf_put = gb->buf_buf + count - len;
-        } else {
-                memcpy(gb->buf_put, buf, count);
-                if (count < len)
-                        gb->buf_put += count;
-                else /* count == len */
-                        gb->buf_put = gb->buf_buf;
-        }
-
-        return count;
-}
-
-/*
- * gs_buf_get
- *
- * Get data from the circular buffer and copy to the given buffer.
- * Restrict to the amount of data available.
- *
- * Return the number of bytes copied.
- */
-static unsigned int
-gs_buf_get(struct gs_buf *gb, char *buf, unsigned int count)
-{
-        unsigned int len;
-
-        if (gb == NULL)
-                return 0;
-
-        len = gs_buf_data_avail(gb);
-        if (count > len)
-                count = len;
-
-        if (count == 0)
-                return 0;
-
-        len = gb->buf_buf + gb->buf_size - gb->buf_get;
-        if (count > len) {
-                memcpy(buf, gb->buf_get, len);
-                memcpy(buf+len, gb->buf_buf, count - len);
-                gb->buf_get = gb->buf_buf + count - len;
-        } else {
-                memcpy(buf, gb->buf_get, count);
-                if (count < len)
-                        gb->buf_get += count;
-                else /* count == len */
-                        gb->buf_get = gb->buf_buf;
-        }
-
-        return count;
-}
-
-/*-------------------------------------------------------------------------*/
-
-static struct tty_driver *gs_tty_driver;
-
-/*
- *  gs_module_init
- *
- *  Register as a USB gadget driver and a tty driver.
- */
-static int __init gs_module_init(void)
-{
-        int i;
-        int retval;
-
-        retval = usb_gadget_register_driver(&gs_gadget_driver);
-        if (retval) {
-                pr_err("gs_module_init: cannot register gadget driver, "
-                        "ret=%d\n", retval);
-                return retval;
-        }
-
-        gs_tty_driver = alloc_tty_driver(GS_NUM_PORTS);
-        if (!gs_tty_driver)
-                return -ENOMEM;
-        gs_tty_driver->owner = THIS_MODULE;
-        gs_tty_driver->driver_name = GS_SHORT_NAME;
-        gs_tty_driver->name = "ttygs";
-        gs_tty_driver->major = GS_MAJOR;
-        gs_tty_driver->minor_start = GS_MINOR_START;
-        gs_tty_driver->type = TTY_DRIVER_TYPE_SERIAL;
-        gs_tty_driver->subtype = SERIAL_TYPE_NORMAL;
-        gs_tty_driver->flags = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
-        gs_tty_driver->init_termios = tty_std_termios;
-        /* must match GS_DEFAULT_DTE_RATE and friends */
-        gs_tty_driver->init_termios.c_cflag =
-                B9600 | CS8 | CREAD | HUPCL | CLOCAL;
-        gs_tty_driver->init_termios.c_ispeed = GS_DEFAULT_DTE_RATE;
-        gs_tty_driver->init_termios.c_ospeed = GS_DEFAULT_DTE_RATE;
-        tty_set_operations(gs_tty_driver, &gs_tty_ops);
-
-        for (i = 0; i < GS_NUM_PORTS; i++)
-                mutex_init(&gs_open_close_lock[i]);
-
-        retval = tty_register_driver(gs_tty_driver);
-        if (retval) {
-                usb_gadget_unregister_driver(&gs_gadget_driver);
-                put_tty_driver(gs_tty_driver);
-                pr_err("gs_module_init: cannot register tty driver, "
-                                "ret=%d\n", retval);
-                return retval;
-        }
-
-        pr_info("gs_module_init: %s %s loaded\n",
-                        GS_LONG_NAME, GS_VERSION_STR);
-        return 0;
-}
-module_init(gs_module_init);
-
-/*
- * gs_module_exit
- *
- * Unregister as a tty driver and a USB gadget driver.
- */
-static void __exit gs_module_exit(void)
-{
-        tty_unregister_driver(gs_tty_driver);
-        put_tty_driver(gs_tty_driver);
-        usb_gadget_unregister_driver(&gs_gadget_driver);
-
-        pr_info("gs_module_exit: %s %s unloaded\n",
-                        GS_LONG_NAME, GS_VERSION_STR);
+        usb_composite_unregister(&gserial_driver);
+        gserial_cleanup();
 }
-module_exit(gs_module_exit);
+module_exit(cleanup);
diff --git a/drivers/usb/gadget/u_ether.c b/drivers/usb/gadget/u_ether.c
new file mode 100644
index 000000000000..5458f43a8668
--- /dev/null
+++ b/drivers/usb/gadget/u_ether.c
@@ -0,0 +1,967 @@
+/*
+ * u_ether.c -- Ethernet-over-USB link layer utilities for Gadget stack
+ *
+ * Copyright (C) 2003-2005,2008 David Brownell
+ * Copyright (C) 2003-2004 Robert Schwebel, Benedikt Spranger
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+/* #define VERBOSE_DEBUG */
+
+#include <linux/kernel.h>
+#include <linux/utsname.h>
+#include <linux/device.h>
+#include <linux/ctype.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+
+#include "u_ether.h"
+
+
+/*
+ * This component encapsulates the Ethernet link glue needed to provide
+ * one (!) network link through the USB gadget stack, normally "usb0".
+ *
+ * The control and data models are handled by the function driver which
+ * connects to this code; such as CDC Ethernet, "CDC Subset", or RNDIS.
+ * That includes all descriptor and endpoint management.
+ *
+ * Link level addressing is handled by this component using module
+ * parameters; if no such parameters are provided, random link level
+ * addresses are used.  Each end of the link uses one address.  The
+ * host end address is exported in various ways, and is often recorded
+ * in configuration databases.
+ *
+ * The driver which assembles each configuration using such a link is
+ * responsible for ensuring that each configuration includes at most one
+ * instance of is network link.  (The network layer provides ways for
+ * this single "physical" link to be used by multiple virtual links.)
+ */
+
+#define DRIVER_VERSION  "29-May-2008"
+
+struct eth_dev {
+        /* lock is held while accessing port_usb
+         * or updating its backlink port_usb->ioport
+         */
+        spinlock_t              lock;
+        struct gether           *port_usb;
+
+        struct net_device       *net;
+        struct usb_gadget       *gadget;
+
+        spinlock_t              req_lock;       /* guard {rx,tx}_reqs */
+        struct list_head        tx_reqs, rx_reqs;
+        atomic_t                tx_qlen;
+
+        unsigned                header_len;
+        struct sk_buff          *(*wrap)(struct sk_buff *skb);
+        int                     (*unwrap)(struct sk_buff *skb);
+
+        struct work_struct      work;
+
+        unsigned long           todo;
+#define WORK_RX_MEMORY          0
+
+        bool                    zlp;
+        u8                      host_mac[ETH_ALEN];
+};
+
+/*-------------------------------------------------------------------------*/
+
+#define RX_EXTRA        20      /* bytes guarding against rx overflows */
+
+#define DEFAULT_QLEN    2       /* double buffering by default */
+
+
+#ifdef CONFIG_USB_GADGET_DUALSPEED
+
+static unsigned qmult = 5;
+module_param(qmult, uint, S_IRUGO|S_IWUSR);
+MODULE_PARM_DESC(qmult, "queue length multiplier at high speed");
+
+#else   /* full speed (low speed doesn't do bulk) */
+#define qmult           1
+#endif
+
+/* for dual-speed hardware, use deeper queues at highspeed */
+static inline int qlen(struct usb_gadget *gadget)
+{
+        if (gadget_is_dualspeed(gadget) && gadget->speed == USB_SPEED_HIGH)
+                return qmult * DEFAULT_QLEN;
+        else
+                return DEFAULT_QLEN;
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* REVISIT there must be a better way than having two sets
+ * of debug calls ...
+ */
+
+#undef DBG
+#undef VDBG
+#undef ERROR
+#undef WARN
+#undef INFO
+
+#define xprintk(d, level, fmt, args...) \
+        printk(level "%s: " fmt , (d)->net->name , ## args)
+
+#ifdef DEBUG
+#undef DEBUG
+#define DBG(dev, fmt, args...) \
+        xprintk(dev , KERN_DEBUG , fmt , ## args)
+#else
+#define DBG(dev, fmt, args...) \
+        do { } while (0)
+#endif /* DEBUG */
+
+#ifdef VERBOSE_DEBUG
+#define VDBG    DBG
+#else
+#define VDBG(dev, fmt, args...) \
+        do { } while (0)
+#endif /* DEBUG */
+
+#define ERROR(dev, fmt, args...) \
+        xprintk(dev , KERN_ERR , fmt , ## args)
+#define WARN(dev, fmt, args...) \
+        xprintk(dev , KERN_WARNING , fmt , ## args)
+#define INFO(dev, fmt, args...) \
+        xprintk(dev , KERN_INFO , fmt , ## args)
+
+/*-------------------------------------------------------------------------*/
+
+/* NETWORK DRIVER HOOKUP (to the layer above this driver) */
+
+static int eth_change_mtu(struct net_device *net, int new_mtu)
+{
+        struct eth_dev  *dev = netdev_priv(net);
+        unsigned long   flags;
+        int             status = 0;
+
+        /* don't change MTU on "live" link (peer won't know) */
+        spin_lock_irqsave(&dev->lock, flags);
+        if (dev->port_usb)
+                status = -EBUSY;
+        else if (new_mtu <= ETH_HLEN || new_mtu > ETH_FRAME_LEN)
+                status = -ERANGE;
+        else
+                net->mtu = new_mtu;
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        return status;
+}
+
+static void eth_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *p)
+{
+        struct eth_dev  *dev = netdev_priv(net);
+
+        strlcpy(p->driver, "g_ether", sizeof p->driver);
+        strlcpy(p->version, DRIVER_VERSION, sizeof p->version);
+        strlcpy(p->fw_version, dev->gadget->name, sizeof p->fw_version);
+        strlcpy(p->bus_info, dev_name(&dev->gadget->dev), sizeof p->bus_info);
+}
+
+static u32 eth_get_link(struct net_device *net)
+{
+        struct eth_dev  *dev = netdev_priv(net);
+        return dev->gadget->speed != USB_SPEED_UNKNOWN;
+}
+
+/* REVISIT can also support:
+ *   - WOL (by tracking suspends and issuing remote wakeup)
+ *   - msglevel (implies updated messaging)
+ *   - ... probably more ethtool ops
+ */
+
+static struct ethtool_ops ops = {
+        .get_drvinfo = eth_get_drvinfo,
+        .get_link = eth_get_link
+};
+
+static void defer_kevent(struct eth_dev *dev, int flag)
+{
+        if (test_and_set_bit(flag, &dev->todo))
+                return;
+        if (!schedule_work(&dev->work))
+                ERROR(dev, "kevent %d may have been dropped\n", flag);
+        else
+                DBG(dev, "kevent %d scheduled\n", flag);
+}
+
+static void rx_complete(struct usb_ep *ep, struct usb_request *req);
+
+static int
+rx_submit(struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags)
+{
+        struct sk_buff  *skb;
+        int             retval = -ENOMEM;
+        size_t          size = 0;
+        struct usb_ep   *out;
+        unsigned long   flags;
+
+        spin_lock_irqsave(&dev->lock, flags);
+        if (dev->port_usb)
+                out = dev->port_usb->out_ep;
+        else
+                out = NULL;
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        if (!out)
+                return -ENOTCONN;
+
+
+        /* Padding up to RX_EXTRA handles minor disagreements with host.
+         * Normally we use the USB "terminate on short read" convention;
+         * so allow up to (N*maxpacket), since that memory is normally
+         * already allocated.  Some hardware doesn't deal well with short
+         * reads (e.g. DMA must be N*maxpacket), so for now don't trim a
+         * byte off the end (to force hardware errors on overflow).
+         *
+         * RNDIS uses internal framing, and explicitly allows senders to
+         * pad to end-of-packet.  That's potentially nice for speed, but
+         * means receivers can't recover lost synch on their own (because
+         * new packets don't only start after a short RX).
+         */
+        size += sizeof(struct ethhdr) + dev->net->mtu + RX_EXTRA;
+        size += dev->port_usb->header_len;
+        size += out->maxpacket - 1;
+        size -= size % out->maxpacket;
+
+        skb = alloc_skb(size + NET_IP_ALIGN, gfp_flags);
+        if (skb == NULL) {
+                DBG(dev, "no rx skb\n");
+                goto enomem;
+        }
+
+        /* Some platforms perform better when IP packets are aligned,
+         * but on at least one, checksumming fails otherwise.  Note:
+         * RNDIS headers involve variable numbers of LE32 values.
+         */
+        skb_reserve(skb, NET_IP_ALIGN);
+
+        req->buf = skb->data;
+        req->length = size;
+        req->complete = rx_complete;
+        req->context = skb;
+
+        retval = usb_ep_queue(out, req, gfp_flags);
+        if (retval == -ENOMEM)
+enomem:
+                defer_kevent(dev, WORK_RX_MEMORY);
+        if (retval) {
+                DBG(dev, "rx submit --> %d\n", retval);
+                if (skb)
+                        dev_kfree_skb_any(skb);
+                spin_lock_irqsave(&dev->req_lock, flags);
+                list_add(&req->list, &dev->rx_reqs);
+                spin_unlock_irqrestore(&dev->req_lock, flags);
+        }
+        return retval;
+}
+
+static void rx_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct sk_buff  *skb = req->context;
+        struct eth_dev  *dev = ep->driver_data;
+        int             status = req->status;
+
+        switch (status) {
+
+        /* normal completion */
+        case 0:
+                skb_put(skb, req->actual);
+                if (dev->unwrap)
+                        status = dev->unwrap(skb);
+                if (status < 0
+                                || ETH_HLEN > skb->len
+                                || skb->len > ETH_FRAME_LEN) {
+                        dev->net->stats.rx_errors++;
+                        dev->net->stats.rx_length_errors++;
+                        DBG(dev, "rx length %d\n", skb->len);
+                        break;
+                }
+
+                skb->protocol = eth_type_trans(skb, dev->net);
+                dev->net->stats.rx_packets++;
+                dev->net->stats.rx_bytes += skb->len;
+
+                /* no buffer copies needed, unless hardware can't
+                 * use skb buffers.
+                 */
+                status = netif_rx(skb);
+                skb = NULL;
+                break;
+
+        /* software-driven interface shutdown */
+        case -ECONNRESET:               /* unlink */
+        case -ESHUTDOWN:                /* disconnect etc */
+                VDBG(dev, "rx shutdown, code %d\n", status);
+                goto quiesce;
+
+        /* for hardware automagic (such as pxa) */
+        case -ECONNABORTED:             /* endpoint reset */
+                DBG(dev, "rx %s reset\n", ep->name);
+                defer_kevent(dev, WORK_RX_MEMORY);
+quiesce:
+                dev_kfree_skb_any(skb);
+                goto clean;
+
+        /* data overrun */
+        case -EOVERFLOW:
+                dev->net->stats.rx_over_errors++;
+                /* FALLTHROUGH */
+
+        default:
+                dev->net->stats.rx_errors++;
+                DBG(dev, "rx status %d\n", status);
+                break;
+        }
+
+        if (skb)
+                dev_kfree_skb_any(skb);
+        if (!netif_running(dev->net)) {
+clean:
+                spin_lock(&dev->req_lock);
+                list_add(&req->list, &dev->rx_reqs);
+                spin_unlock(&dev->req_lock);
+                req = NULL;
+        }
+        if (req)
+                rx_submit(dev, req, GFP_ATOMIC);
+}
+
+static int prealloc(struct list_head *list, struct usb_ep *ep, unsigned n)
+{
+        unsigned                i;
+        struct usb_request      *req;
+
+        if (!n)
+                return -ENOMEM;
+
+        /* queue/recycle up to N requests */
+        i = n;
+        list_for_each_entry(req, list, list) {
+                if (i-- == 0)
+                        goto extra;
+        }
+        while (i--) {
+                req = usb_ep_alloc_request(ep, GFP_ATOMIC);
+                if (!req)
+                        return list_empty(list) ? -ENOMEM : 0;
+                list_add(&req->list, list);
+        }
+        return 0;
+
+extra:
+        /* free extras */
+        for (;;) {
+                struct list_head        *next;
+
+                next = req->list.next;
+                list_del(&req->list);
+                usb_ep_free_request(ep, req);
+
+                if (next == list)
+                        break;
+
+                req = container_of(next, struct usb_request, list);
+        }
+        return 0;
+}
+
+static int alloc_requests(struct eth_dev *dev, struct gether *link, unsigned n)
+{
+        int     status;
+
+        spin_lock(&dev->req_lock);
+        status = prealloc(&dev->tx_reqs, link->in_ep, n);
+        if (status < 0)
+                goto fail;
+        status = prealloc(&dev->rx_reqs, link->out_ep, n);
+        if (status < 0)
+                goto fail;
+        goto done;
+fail:
+        DBG(dev, "can't alloc requests\n");
+done:
+        spin_unlock(&dev->req_lock);
+        return status;
+}
+
+static void rx_fill(struct eth_dev *dev, gfp_t gfp_flags)
+{
+        struct usb_request      *req;
+        unsigned long           flags;
+
+        /* fill unused rxq slots with some skb */
+        spin_lock_irqsave(&dev->req_lock, flags);
+        while (!list_empty(&dev->rx_reqs)) {
+                req = container_of(dev->rx_reqs.next,
+                                struct usb_request, list);
+                list_del_init(&req->list);
+                spin_unlock_irqrestore(&dev->req_lock, flags);
+
+                if (rx_submit(dev, req, gfp_flags) < 0) {
+                        defer_kevent(dev, WORK_RX_MEMORY);
+                        return;
+                }
+
+                spin_lock_irqsave(&dev->req_lock, flags);
+        }
+        spin_unlock_irqrestore(&dev->req_lock, flags);
+}
+
+static void eth_work(struct work_struct *work)
+{
+        struct eth_dev  *dev = container_of(work, struct eth_dev, work);
+
+        if (test_and_clear_bit(WORK_RX_MEMORY, &dev->todo)) {
+                if (netif_running(dev->net))
+                        rx_fill(dev, GFP_KERNEL);
+        }
+
+        if (dev->todo)
+                DBG(dev, "work done, flags = 0x%lx\n", dev->todo);
+}
+
+static void tx_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct sk_buff  *skb = req->context;
+        struct eth_dev  *dev = ep->driver_data;
+
+        switch (req->status) {
+        default:
+                dev->net->stats.tx_errors++;
+                VDBG(dev, "tx err %d\n", req->status);
+                /* FALLTHROUGH */
+        case -ECONNRESET:               /* unlink */
+        case -ESHUTDOWN:                /* disconnect etc */
+                break;
+        case 0:
+                dev->net->stats.tx_bytes += skb->len;
+        }
+        dev->net->stats.tx_packets++;
+
+        spin_lock(&dev->req_lock);
+        list_add(&req->list, &dev->tx_reqs);
+        spin_unlock(&dev->req_lock);
+        dev_kfree_skb_any(skb);
+
+        atomic_dec(&dev->tx_qlen);
+        if (netif_carrier_ok(dev->net))
+                netif_wake_queue(dev->net);
+}
+
+static inline int is_promisc(u16 cdc_filter)
+{
+        return cdc_filter & USB_CDC_PACKET_TYPE_PROMISCUOUS;
+}
+
+static int eth_start_xmit(struct sk_buff *skb, struct net_device *net)
+{
+        struct eth_dev          *dev = netdev_priv(net);
+        int                     length = skb->len;
+        int                     retval;
+        struct usb_request      *req = NULL;
+        unsigned long           flags;
+        struct usb_ep           *in;
+        u16                     cdc_filter;
+
+        spin_lock_irqsave(&dev->lock, flags);
+        if (dev->port_usb) {
+                in = dev->port_usb->in_ep;
+                cdc_filter = dev->port_usb->cdc_filter;
+        } else {
+                in = NULL;
+                cdc_filter = 0;
+        }
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        if (!in) {
+                dev_kfree_skb_any(skb);
+                return 0;
+        }
+
+        /* apply outgoing CDC or RNDIS filters */
+        if (!is_promisc(cdc_filter)) {
+                u8              *dest = skb->data;
+
+                if (is_multicast_ether_addr(dest)) {
+                        u16     type;
+
+                        /* ignores USB_CDC_PACKET_TYPE_MULTICAST and host
+                         * SET_ETHERNET_MULTICAST_FILTERS requests
+                         */
+                        if (is_broadcast_ether_addr(dest))
+                                type = USB_CDC_PACKET_TYPE_BROADCAST;
+                        else
+                                type = USB_CDC_PACKET_TYPE_ALL_MULTICAST;
+                        if (!(cdc_filter & type)) {
+                                dev_kfree_skb_any(skb);
+                                return 0;
+                        }
+                }
+                /* ignores USB_CDC_PACKET_TYPE_DIRECTED */
+        }
+
+        spin_lock_irqsave(&dev->req_lock, flags);
+        /*
+         * this freelist can be empty if an interrupt triggered disconnect()
+         * and reconfigured the gadget (shutting down this queue) after the
+         * network stack decided to xmit but before we got the spinlock.
+         */
+        if (list_empty(&dev->tx_reqs)) {
+                spin_unlock_irqrestore(&dev->req_lock, flags);
+                return 1;
+        }
+
+        req = container_of(dev->tx_reqs.next, struct usb_request, list);
+        list_del(&req->list);
+
+        /* temporarily stop TX queue when the freelist empties */
+        if (list_empty(&dev->tx_reqs))
+                netif_stop_queue(net);
+        spin_unlock_irqrestore(&dev->req_lock, flags);
+
+        /* no buffer copies needed, unless the network stack did it
+         * or the hardware can't use skb buffers.
+         * or there's not enough space for extra headers we need
+         */
+        if (dev->wrap) {
+                struct sk_buff  *skb_new;
+
+                skb_new = dev->wrap(skb);
+                if (!skb_new)
+                        goto drop;
+
+                dev_kfree_skb_any(skb);
+                skb = skb_new;
+                length = skb->len;
+        }
+        req->buf = skb->data;
+        req->context = skb;
+        req->complete = tx_complete;
+
+        /* use zlp framing on tx for strict CDC-Ether conformance,
+         * though any robust network rx path ignores extra padding.
+         * and some hardware doesn't like to write zlps.
+         */
+        req->zero = 1;
+        if (!dev->zlp && (length % in->maxpacket) == 0)
+                length++;
+
+        req->length = length;
+
+        /* throttle highspeed IRQ rate back slightly */
+        if (gadget_is_dualspeed(dev->gadget))
+                req->no_interrupt = (dev->gadget->speed == USB_SPEED_HIGH)
+                        ? ((atomic_read(&dev->tx_qlen) % qmult) != 0)
+                        : 0;
+
+        retval = usb_ep_queue(in, req, GFP_ATOMIC);
+        switch (retval) {
+        default:
+                DBG(dev, "tx queue err %d\n", retval);
+                break;
+        case 0:
+                net->trans_start = jiffies;
+                atomic_inc(&dev->tx_qlen);
+        }
+
+        if (retval) {
+drop:
+                dev->net->stats.tx_dropped++;
+                dev_kfree_skb_any(skb);
+                spin_lock_irqsave(&dev->req_lock, flags);
+                if (list_empty(&dev->tx_reqs))
+                        netif_start_queue(net);
+                list_add(&req->list, &dev->tx_reqs);
+                spin_unlock_irqrestore(&dev->req_lock, flags);
+        }
+        return 0;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static void eth_start(struct eth_dev *dev, gfp_t gfp_flags)
+{
+        DBG(dev, "%s\n", __func__);
+
+        /* fill the rx queue */
+        rx_fill(dev, gfp_flags);
+
+        /* and open the tx floodgates */
+        atomic_set(&dev->tx_qlen, 0);
+        netif_wake_queue(dev->net);
+}
+
+static int eth_open(struct net_device *net)
+{
+        struct eth_dev  *dev = netdev_priv(net);
+        struct gether   *link;
+
+        DBG(dev, "%s\n", __func__);
+        if (netif_carrier_ok(dev->net))
+                eth_start(dev, GFP_KERNEL);
+
+        spin_lock_irq(&dev->lock);
+        link = dev->port_usb;
+        if (link && link->open)
+                link->open(link);
+        spin_unlock_irq(&dev->lock);
+
+        return 0;
+}
+
+static int eth_stop(struct net_device *net)
+{
+        struct eth_dev  *dev = netdev_priv(net);
+        unsigned long   flags;
+
+        VDBG(dev, "%s\n", __func__);
+        netif_stop_queue(net);
+
+        DBG(dev, "stop stats: rx/tx %ld/%ld, errs %ld/%ld\n",
+                dev->net->stats.rx_packets, dev->net->stats.tx_packets,
+                dev->net->stats.rx_errors, dev->net->stats.tx_errors
+                );
+
+        /* ensure there are no more active requests */
+        spin_lock_irqsave(&dev->lock, flags);
+        if (dev->port_usb) {
+                struct gether   *link = dev->port_usb;
+
+                if (link->close)
+                        link->close(link);
+
+                /* NOTE:  we have no abort-queue primitive we could use
+                 * to cancel all pending I/O.  Instead, we disable then
+                 * reenable the endpoints ... this idiom may leave toggle
+                 * wrong, but that's a self-correcting error.
+                 *
+                 * REVISIT:  we *COULD* just let the transfers complete at
+                 * their own pace; the network stack can handle old packets.
+                 * For the moment we leave this here, since it works.
+                 */
+                usb_ep_disable(link->in_ep);
+                usb_ep_disable(link->out_ep);
+                if (netif_carrier_ok(net)) {
+                        DBG(dev, "host still using in/out endpoints\n");
+                        usb_ep_enable(link->in_ep, link->in);
+                        usb_ep_enable(link->out_ep, link->out);
+                }
+        }
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        return 0;
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* initial value, changed by "ifconfig usb0 hw ether xx:xx:xx:xx:xx:xx" */
+static char *dev_addr;
+module_param(dev_addr, charp, S_IRUGO);
+MODULE_PARM_DESC(dev_addr, "Device Ethernet Address");
+
+/* this address is invisible to ifconfig */
+static char *host_addr;
+module_param(host_addr, charp, S_IRUGO);
+MODULE_PARM_DESC(host_addr, "Host Ethernet Address");
+
+
+static u8 __init nibble(unsigned char c)
+{
+        if (isdigit(c))
+                return c - '0';
+        c = toupper(c);
+        if (isxdigit(c))
+                return 10 + c - 'A';
+        return 0;
+}
+
+static int __init get_ether_addr(const char *str, u8 *dev_addr)
+{
+        if (str) {
+                unsigned        i;
+
+                for (i = 0; i < 6; i++) {
+                        unsigned char num;
+
+                        if ((*str == '.') || (*str == ':'))
+                                str++;
+                        num = nibble(*str++) << 4;
+                        num |= (nibble(*str++));
+                        dev_addr [i] = num;
+                }
+                if (is_valid_ether_addr(dev_addr))
+                        return 0;
+        }
+        random_ether_addr(dev_addr);
+        return 1;
+}
+
+static struct eth_dev *the_dev;
+
+
+/**
+ * gether_setup - initialize one ethernet-over-usb link
+ * @g: gadget to associated with these links
+ * @ethaddr: NULL, or a buffer in which the ethernet address of the
+ *      host side of the link is recorded
+ * Context: may sleep
+ *
+ * This sets up the single network link that may be exported by a
+ * gadget driver using this framework.  The link layer addresses are
+ * set up using module parameters.
+ *
+ * Returns negative errno, or zero on success
+ */
+int __init gether_setup(struct usb_gadget *g, u8 ethaddr[ETH_ALEN])
+{
+        struct eth_dev          *dev;
+        struct net_device       *net;
+        int                     status;
+
+        if (the_dev)
+                return -EBUSY;
+
+        net = alloc_etherdev(sizeof *dev);
+        if (!net)
+                return -ENOMEM;
+
+        dev = netdev_priv(net);
+        spin_lock_init(&dev->lock);
+        spin_lock_init(&dev->req_lock);
+        INIT_WORK(&dev->work, eth_work);
+        INIT_LIST_HEAD(&dev->tx_reqs);
+        INIT_LIST_HEAD(&dev->rx_reqs);
+
+        /* network device setup */
+        dev->net = net;
+        strcpy(net->name, "usb%d");
+
+        if (get_ether_addr(dev_addr, net->dev_addr))
+                dev_warn(&g->dev,
+                        "using random %s ethernet address\n", "self");
+        if (get_ether_addr(host_addr, dev->host_mac))
+                dev_warn(&g->dev,
+                        "using random %s ethernet address\n", "host");
+
+        if (ethaddr)
+                memcpy(ethaddr, dev->host_mac, ETH_ALEN);
+
+        net->change_mtu = eth_change_mtu;
+        net->hard_start_xmit = eth_start_xmit;
+        net->open = eth_open;
+        net->stop = eth_stop;
+        /* watchdog_timeo, tx_timeout ... */
+        /* set_multicast_list */
+        SET_ETHTOOL_OPS(net, &ops);
+
+        /* two kinds of host-initiated state changes:
+         *  - iff DATA transfer is active, carrier is "on"
+         *  - tx queueing enabled if open *and* carrier is "on"
+         */
+        netif_stop_queue(net);
+        netif_carrier_off(net);
+
+        dev->gadget = g;
+        SET_NETDEV_DEV(net, &g->dev);
+
+        status = register_netdev(net);
+        if (status < 0) {
+                dev_dbg(&g->dev, "register_netdev failed, %d\n", status);
+                free_netdev(net);
+        } else {
+                DECLARE_MAC_BUF(tmp);
+
+                INFO(dev, "MAC %s\n", print_mac(tmp, net->dev_addr));
+                INFO(dev, "HOST MAC %s\n", print_mac(tmp, dev->host_mac));
+
+                the_dev = dev;
+        }
+
+        return status;
+}
+
+/**
+ * gether_cleanup - remove Ethernet-over-USB device
+ * Context: may sleep
+ *
+ * This is called to free all resources allocated by @gether_setup().
+ */
+void gether_cleanup(void)
+{
+        if (!the_dev)
+                return;
+
+        unregister_netdev(the_dev->net);
+        free_netdev(the_dev->net);
+
+        /* assuming we used keventd, it must quiesce too */
+        flush_scheduled_work();
+
+        the_dev = NULL;
+}
+
+
+/**
+ * gether_connect - notify network layer that USB link is active
+ * @link: the USB link, set up with endpoints, descriptors matching
+ *      current device speed, and any framing wrapper(s) set up.
+ * Context: irqs blocked
+ *
+ * This is called to activate endpoints and let the network layer know
+ * the connection is active ("carrier detect").  It may cause the I/O
+ * queues to open and start letting network packets flow, but will in
+ * any case activate the endpoints so that they respond properly to the
+ * USB host.
+ *
+ * Verify net_device pointer returned using IS_ERR().  If it doesn't
+ * indicate some error code (negative errno), ep->driver_data values
+ * have been overwritten.
+ */
+struct net_device *gether_connect(struct gether *link)
+{
+        struct eth_dev          *dev = the_dev;
+        int                     result = 0;
+
+        if (!dev)
+                return ERR_PTR(-EINVAL);
+
+        link->in_ep->driver_data = dev;
+        result = usb_ep_enable(link->in_ep, link->in);
+        if (result != 0) {
+                DBG(dev, "enable %s --> %d\n",
+                        link->in_ep->name, result);
+                goto fail0;
+        }
+
+        link->out_ep->driver_data = dev;
+        result = usb_ep_enable(link->out_ep, link->out);
+        if (result != 0) {
+                DBG(dev, "enable %s --> %d\n",
+                        link->out_ep->name, result);
+                goto fail1;
+        }
+
+        if (result == 0)
+                result = alloc_requests(dev, link, qlen(dev->gadget));
+
+        if (result == 0) {
+                dev->zlp = link->is_zlp_ok;
+                DBG(dev, "qlen %d\n", qlen(dev->gadget));
+
+                dev->header_len = link->header_len;
+                dev->unwrap = link->unwrap;
+                dev->wrap = link->wrap;
+
+                spin_lock(&dev->lock);
+                dev->port_usb = link;
+                link->ioport = dev;
+                spin_unlock(&dev->lock);
+
+                netif_carrier_on(dev->net);
+                if (netif_running(dev->net))
+                        eth_start(dev, GFP_ATOMIC);
+
+        /* on error, disable any endpoints  */
+        } else {
+                (void) usb_ep_disable(link->out_ep);
+fail1:
+                (void) usb_ep_disable(link->in_ep);
+        }
+fail0:
+        /* caller is responsible for cleanup on error */
+        if (result < 0)
+                return ERR_PTR(result);
+        return dev->net;
+}
+
+/**
+ * gether_disconnect - notify network layer that USB link is inactive
+ * @link: the USB link, on which gether_connect() was called
+ * Context: irqs blocked
+ *
+ * This is called to deactivate endpoints and let the network layer know
+ * the connection went inactive ("no carrier").
+ *
+ * On return, the state is as if gether_connect() had never been called.
+ * The endpoints are inactive, and accordingly without active USB I/O.
+ * Pointers to endpoint descriptors and endpoint private data are nulled.
+ */
+void gether_disconnect(struct gether *link)
+{
+        struct eth_dev          *dev = link->ioport;
+        struct usb_request      *req;
+
+        WARN_ON(!dev);
+        if (!dev)
+                return;
+
+        DBG(dev, "%s\n", __func__);
+
+        netif_stop_queue(dev->net);
+        netif_carrier_off(dev->net);
+
+        /* disable endpoints, forcing (synchronous) completion
+         * of all pending i/o.  then free the request objects
+         * and forget about the endpoints.
+         */
+        usb_ep_disable(link->in_ep);
+        spin_lock(&dev->req_lock);
+        while (!list_empty(&dev->tx_reqs)) {
+                req = container_of(dev->tx_reqs.next,
+                                        struct usb_request, list);
+                list_del(&req->list);
+
+                spin_unlock(&dev->req_lock);
+                usb_ep_free_request(link->in_ep, req);
+                spin_lock(&dev->req_lock);
+        }
+        spin_unlock(&dev->req_lock);
+        link->in_ep->driver_data = NULL;
+        link->in = NULL;
+
+        usb_ep_disable(link->out_ep);
+        spin_lock(&dev->req_lock);
+        while (!list_empty(&dev->rx_reqs)) {
+                req = container_of(dev->rx_reqs.next,
+                                        struct usb_request, list);
+                list_del(&req->list);
+
+                spin_unlock(&dev->req_lock);
+                usb_ep_free_request(link->out_ep, req);
+                spin_lock(&dev->req_lock);
+        }
+        spin_unlock(&dev->req_lock);
+        link->out_ep->driver_data = NULL;
+        link->out = NULL;
+
+        /* finish forgetting about this USB link episode */
+        dev->header_len = 0;
+        dev->unwrap = NULL;
+        dev->wrap = NULL;
+
+        spin_lock(&dev->lock);
+        dev->port_usb = NULL;
+        link->ioport = NULL;
+        spin_unlock(&dev->lock);
+}
diff --git a/drivers/usb/gadget/u_ether.h b/drivers/usb/gadget/u_ether.h
new file mode 100644
index 000000000000..0d1f7ae3b071
--- /dev/null
+++ b/drivers/usb/gadget/u_ether.h
@@ -0,0 +1,127 @@
+/*
+ * u_ether.h -- interface to USB gadget "ethernet link" utilities
+ *
+ * Copyright (C) 2003-2005,2008 David Brownell
+ * Copyright (C) 2003-2004 Robert Schwebel, Benedikt Spranger
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#ifndef __U_ETHER_H
+#define __U_ETHER_H
+
+#include <linux/err.h>
+#include <linux/if_ether.h>
+#include <linux/usb/composite.h>
+#include <linux/usb/cdc.h>
+
+#include "gadget_chips.h"
+
+
+/*
+ * This represents the USB side of an "ethernet" link, managed by a USB
+ * function which provides control and (maybe) framing.  Two functions
+ * in different configurations could share the same ethernet link/netdev,
+ * using different host interaction models.
+ *
+ * There is a current limitation that only one instance of this link may
+ * be present in any given configuration.  When that's a problem, network
+ * layer facilities can be used to package multiple logical links on this
+ * single "physical" one.
+ */
+struct gether {
+        struct usb_function             func;
+
+        /* updated by gether_{connect,disconnect} */
+        struct eth_dev                  *ioport;
+
+        /* endpoints handle full and/or high speeds */
+        struct usb_ep                   *in_ep;
+        struct usb_ep                   *out_ep;
+
+        /* descriptors match device speed at gether_connect() time */
+        struct usb_endpoint_descriptor  *in;
+        struct usb_endpoint_descriptor  *out;
+
+        bool                            is_zlp_ok;
+
+        u16                             cdc_filter;
+
+        /* hooks for added framing, as needed for RNDIS and EEM.
+         * we currently don't support multiple frames per SKB.
+         */
+        u32                             header_len;
+        struct sk_buff                  *(*wrap)(struct sk_buff *skb);
+        int                             (*unwrap)(struct sk_buff *skb);
+
+        /* called on network open/close */
+        void                            (*open)(struct gether *);
+        void                            (*close)(struct gether *);
+};
+
+#define DEFAULT_FILTER  (USB_CDC_PACKET_TYPE_BROADCAST \
+                        |USB_CDC_PACKET_TYPE_ALL_MULTICAST \
+                        |USB_CDC_PACKET_TYPE_PROMISCUOUS \
+                        |USB_CDC_PACKET_TYPE_DIRECTED)
+
+
+/* netdev setup/teardown as directed by the gadget driver */
+int gether_setup(struct usb_gadget *g, u8 ethaddr[ETH_ALEN]);
+void gether_cleanup(void);
+
+/* connect/disconnect is handled by individual functions */
+struct net_device *gether_connect(struct gether *);
+void gether_disconnect(struct gether *);
+
+/* Some controllers can't support CDC Ethernet (ECM) ... */
+static inline bool can_support_ecm(struct usb_gadget *gadget)
+{
+        if (!gadget_supports_altsettings(gadget))
+                return false;
+
+        /* SA1100 can do ECM, *without* status endpoint ... but we'll
+         * only use it in non-ECM mode for backwards compatibility
+         * (and since we currently require a status endpoint)
+         */
+        if (gadget_is_sa1100(gadget))
+                return false;
+
+        /* Everything else is *presumably* fine ... but this is a bit
+         * chancy, so be **CERTAIN** there are no hardware issues with
+         * your controller.  Add it above if it can't handle CDC.
+         */
+        return true;
+}
+
+/* each configuration may bind one instance of an ethernet link */
+int geth_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN]);
+int ecm_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN]);
+
+#ifdef CONFIG_USB_ETH_RNDIS
+
+int rndis_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN]);
+
+#else
+
+static inline int
+rndis_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN])
+{
+        return 0;
+}
+
+#endif
+
+#endif /* __U_ETHER_H */
diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c
new file mode 100644
index 000000000000..abf9505d3a75
--- /dev/null
+++ b/drivers/usb/gadget/u_serial.c
@@ -0,0 +1,1246 @@
+/*
+ * u_serial.c - utilities for USB gadget "serial port"/TTY support
+ *
+ * Copyright (C) 2003 Al Borchers (alborchers@steinerpoint.com)
+ * Copyright (C) 2008 David Brownell
+ * Copyright (C) 2008 by Nokia Corporation
+ *
+ * This code also borrows from usbserial.c, which is
+ * Copyright (C) 1999 - 2002 Greg Kroah-Hartman (greg@kroah.com)
+ * Copyright (C) 2000 Peter Berger (pberger@brimson.com)
+ * Copyright (C) 2000 Al Borchers (alborchers@steinerpoint.com)
+ *
+ * This software is distributed under the terms of the GNU General
+ * Public License ("GPL") as published by the Free Software Foundation,
+ * either version 2 of that License or (at your option) any later version.
+ */
+
+/* #define VERBOSE_DEBUG */
+
+#include <linux/kernel.h>
+#include <linux/interrupt.h>
+#include <linux/device.h>
+#include <linux/delay.h>
+#include <linux/tty.h>
+#include <linux/tty_flip.h>
+
+#include "u_serial.h"
+
+
+/*
+ * This component encapsulates the TTY layer glue needed to provide basic
+ * "serial port" functionality through the USB gadget stack.  Each such
+ * port is exposed through a /dev/ttyGS* node.
+ *
+ * After initialization (gserial_setup), these TTY port devices stay
+ * available until they are removed (gserial_cleanup).  Each one may be
+ * connected to a USB function (gserial_connect), or disconnected (with
+ * gserial_disconnect) when the USB host issues a config change event.
+ * Data can only flow when the port is connected to the host.
+ *
+ * A given TTY port can be made available in multiple configurations.
+ * For example, each one might expose a ttyGS0 node which provides a
+ * login application.  In one case that might use CDC ACM interface 0,
+ * while another configuration might use interface 3 for that.  The
+ * work to handle that (including descriptor management) is not part
+ * of this component.
+ *
+ * Configurations may expose more than one TTY port.  For example, if
+ * ttyGS0 provides login service, then ttyGS1 might provide dialer access
+ * for a telephone or fax link.  And ttyGS2 might be something that just
+ * needs a simple byte stream interface for some messaging protocol that
+ * is managed in userspace ... OBEX, PTP, and MTP have been mentioned.
+ */
+
+/*
+ * gserial is the lifecycle interface, used by USB functions
+ * gs_port is the I/O nexus, used by the tty driver
+ * tty_struct links to the tty/filesystem framework
+ *
+ * gserial <---> gs_port ... links will be null when the USB link is
+ * inactive; managed by gserial_{connect,disconnect}().
+ *      gserial->ioport == usb_ep->driver_data ... gs_port
+ *      gs_port->port_usb ... gserial
+ *
+ * gs_port <---> tty_struct ... links will be null when the TTY file
+ * isn't opened; managed by gs_open()/gs_close()
+ *      gserial->port_tty ... tty_struct
+ *      tty_struct->driver_data ... gserial
+ */
+
+/* RX and TX queues can buffer QUEUE_SIZE packets before they hit the
+ * next layer of buffering.  For TX that's a circular buffer; for RX
+ * consider it a NOP.  A third layer is provided by the TTY code.
+ */
+#define QUEUE_SIZE              16
+#define WRITE_BUF_SIZE          8192            /* TX only */
+
+/* circular buffer */
+struct gs_buf {
+        unsigned                buf_size;
+        char                    *buf_buf;
+        char                    *buf_get;
+        char                    *buf_put;
+};
+
+/*
+ * The port structure holds info for each port, one for each minor number
+ * (and thus for each /dev/ node).
+ */
+struct gs_port {
+        spinlock_t              port_lock;      /* guard port_* access */
+
+        struct gserial          *port_usb;
+        struct tty_struct       *port_tty;
+
+        unsigned                open_count;
+        bool                    openclose;      /* open/close in progress */
+        u8                      port_num;
+
+        wait_queue_head_t       close_wait;     /* wait for last close */
+
+        struct list_head        read_pool;
+        struct tasklet_struct   push;
+
+        struct list_head        write_pool;
+        struct gs_buf           port_write_buf;
+        wait_queue_head_t       drain_wait;     /* wait while writes drain */
+
+        /* REVISIT this state ... */
+        struct usb_cdc_line_coding port_line_coding;    /* 8-N-1 etc */
+};
+
+/* increase N_PORTS if you need more */
+#define N_PORTS         4
+static struct portmaster {
+        struct mutex    lock;                   /* protect open/close */
+        struct gs_port  *port;
+} ports[N_PORTS];
+static unsigned n_ports;
+
+#define GS_CLOSE_TIMEOUT                15              /* seconds */
+
+
+
+#ifdef VERBOSE_DEBUG
+#define pr_vdebug(fmt, arg...) \
+        pr_debug(fmt, ##arg)
+#else
+#define pr_vdebug(fmt, arg...) \
+        ({ if (0) pr_debug(fmt, ##arg); })
+#endif
+
+/*-------------------------------------------------------------------------*/
+
+/* Circular Buffer */
+
+/*
+ * gs_buf_alloc
+ *
+ * Allocate a circular buffer and all associated memory.
+ */
+static int gs_buf_alloc(struct gs_buf *gb, unsigned size)
+{
+        gb->buf_buf = kmalloc(size, GFP_KERNEL);
+        if (gb->buf_buf == NULL)
+                return -ENOMEM;
+
+        gb->buf_size = size;
+        gb->buf_put = gb->buf_buf;
+        gb->buf_get = gb->buf_buf;
+
+        return 0;
+}
+
+/*
+ * gs_buf_free
+ *
+ * Free the buffer and all associated memory.
+ */
+static void gs_buf_free(struct gs_buf *gb)
+{
+        kfree(gb->buf_buf);
+        gb->buf_buf = NULL;
+}
+
+/*
+ * gs_buf_clear
+ *
+ * Clear out all data in the circular buffer.
+ */
+static void gs_buf_clear(struct gs_buf *gb)
+{
+        gb->buf_get = gb->buf_put;
+        /* equivalent to a get of all data available */
+}
+
+/*
+ * gs_buf_data_avail
+ *
+ * Return the number of bytes of data available in the circular
+ * buffer.
+ */
+static unsigned gs_buf_data_avail(struct gs_buf *gb)
+{
+        return (gb->buf_size + gb->buf_put - gb->buf_get) % gb->buf_size;
+}
+
+/*
+ * gs_buf_space_avail
+ *
+ * Return the number of bytes of space available in the circular
+ * buffer.
+ */
+static unsigned gs_buf_space_avail(struct gs_buf *gb)
+{
+        return (gb->buf_size + gb->buf_get - gb->buf_put - 1) % gb->buf_size;
+}
+
+/*
+ * gs_buf_put
+ *
+ * Copy data data from a user buffer and put it into the circular buffer.
+ * Restrict to the amount of space available.
+ *
+ * Return the number of bytes copied.
+ */
+static unsigned
+gs_buf_put(struct gs_buf *gb, const char *buf, unsigned count)
+{
+        unsigned len;
+
+        len  = gs_buf_space_avail(gb);
+        if (count > len)
+                count = len;
+
+        if (count == 0)
+                return 0;
+
+        len = gb->buf_buf + gb->buf_size - gb->buf_put;
+        if (count > len) {
+                memcpy(gb->buf_put, buf, len);
+                memcpy(gb->buf_buf, buf+len, count - len);
+                gb->buf_put = gb->buf_buf + count - len;
+        } else {
+                memcpy(gb->buf_put, buf, count);
+                if (count < len)
+                        gb->buf_put += count;
+                else /* count == len */
+                        gb->buf_put = gb->buf_buf;
+        }
+
+        return count;
+}
+
+/*
+ * gs_buf_get
+ *
+ * Get data from the circular buffer and copy to the given buffer.
+ * Restrict to the amount of data available.
+ *
+ * Return the number of bytes copied.
+ */
+static unsigned
+gs_buf_get(struct gs_buf *gb, char *buf, unsigned count)
+{
+        unsigned len;
+
+        len = gs_buf_data_avail(gb);
+        if (count > len)
+                count = len;
+
+        if (count == 0)
+                return 0;
+
+        len = gb->buf_buf + gb->buf_size - gb->buf_get;
+        if (count > len) {
+                memcpy(buf, gb->buf_get, len);
+                memcpy(buf+len, gb->buf_buf, count - len);
+                gb->buf_get = gb->buf_buf + count - len;
+        } else {
+                memcpy(buf, gb->buf_get, count);
+                if (count < len)
+                        gb->buf_get += count;
+                else /* count == len */
+                        gb->buf_get = gb->buf_buf;
+        }
+
+        return count;
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* I/O glue between TTY (upper) and USB function (lower) driver layers */
+
+/*
+ * gs_alloc_req
+ *
+ * Allocate a usb_request and its buffer.  Returns a pointer to the
+ * usb_request or NULL if there is an error.
+ */
+static struct usb_request *
+gs_alloc_req(struct usb_ep *ep, unsigned len, gfp_t kmalloc_flags)
+{
+        struct usb_request *req;
+
+        req = usb_ep_alloc_request(ep, kmalloc_flags);
+
+        if (req != NULL) {
+                req->length = len;
+                req->buf = kmalloc(len, kmalloc_flags);
+                if (req->buf == NULL) {
+                        usb_ep_free_request(ep, req);
+                        return NULL;
+                }
+        }
+
+        return req;
+}
+
+/*
+ * gs_free_req
+ *
+ * Free a usb_request and its buffer.
+ */
+static void gs_free_req(struct usb_ep *ep, struct usb_request *req)
+{
+        kfree(req->buf);
+        usb_ep_free_request(ep, req);
+}
+
+/*
+ * gs_send_packet
+ *
+ * If there is data to send, a packet is built in the given
+ * buffer and the size is returned.  If there is no data to
+ * send, 0 is returned.
+ *
+ * Called with port_lock held.
+ */
+static unsigned
+gs_send_packet(struct gs_port *port, char *packet, unsigned size)
+{
+        unsigned len;
+
+        len = gs_buf_data_avail(&port->port_write_buf);
+        if (len < size)
+                size = len;
+        if (size != 0)
+                size = gs_buf_get(&port->port_write_buf, packet, size);
+        return size;
+}
+
+/*
+ * gs_start_tx
+ *
+ * This function finds available write requests, calls
+ * gs_send_packet to fill these packets with data, and
+ * continues until either there are no more write requests
+ * available or no more data to send.  This function is
+ * run whenever data arrives or write requests are available.
+ *
+ * Context: caller owns port_lock; port_usb is non-null.
+ */
+static int gs_start_tx(struct gs_port *port)
+/*
+__releases(&port->port_lock)
+__acquires(&port->port_lock)
+*/
+{
+        struct list_head        *pool = &port->write_pool;
+        struct usb_ep           *in = port->port_usb->in;
+        int                     status = 0;
+        bool                    do_tty_wake = false;
+
+        while (!list_empty(pool)) {
+                struct usb_request      *req;
+                int                     len;
+
+                req = list_entry(pool->next, struct usb_request, list);
+                len = gs_send_packet(port, req->buf, in->maxpacket);
+                if (len == 0) {
+                        wake_up_interruptible(&port->drain_wait);
+                        break;
+                }
+                do_tty_wake = true;
+
+                req->length = len;
+                list_del(&req->list);
+
+#ifdef VERBOSE_DEBUG
+                pr_debug("%s: %s, len=%d, 0x%02x 0x%02x 0x%02x ...\n",
+                                __func__, in->name, len, *((u8 *)req->buf),
+                                *((u8 *)req->buf+1), *((u8 *)req->buf+2));
+#endif
+
+                /* Drop lock while we call out of driver; completions
+                 * could be issued while we do so.  Disconnection may
+                 * happen too; maybe immediately before we queue this!
+                 *
+                 * NOTE that we may keep sending data for a while after
+                 * the TTY closed (dev->ioport->port_tty is NULL).
+                 */
+                spin_unlock(&port->port_lock);
+                status = usb_ep_queue(in, req, GFP_ATOMIC);
+                spin_lock(&port->port_lock);
+
+                if (status) {
+                        pr_debug("%s: %s %s err %d\n",
+                                        __func__, "queue", in->name, status);
+                        list_add(&req->list, pool);
+                        break;
+                }
+
+                /* abort immediately after disconnect */
+                if (!port->port_usb)
+                        break;
+        }
+
+        if (do_tty_wake && port->port_tty)
+                tty_wakeup(port->port_tty);
+        return status;
+}
+
+static void gs_rx_push(unsigned long _port)
+{
+        struct gs_port          *port = (void *)_port;
+        struct tty_struct       *tty = port->port_tty;
+
+        /* With low_latency, tty_flip_buffer_push() doesn't put its
+         * real work through a workqueue, so the ldisc has a better
+         * chance to keep up with peak USB data rates.
+         */
+        if (tty) {
+                tty_flip_buffer_push(tty);
+                wake_up_interruptible(&tty->read_wait);
+        }
+}
+
+/*
+ * gs_recv_packet
+ *
+ * Called for each USB packet received.  Reads the packet
+ * header and stuffs the data in the appropriate tty buffer.
+ * Returns 0 if successful, or a negative error number.
+ *
+ * Called during USB completion routine, on interrupt time.
+ * With port_lock.
+ */
+static int gs_recv_packet(struct gs_port *port, char *packet, unsigned size)
+{
+        unsigned                len;
+        struct tty_struct       *tty;
+
+        /* I/O completions can continue for a while after close(), until the
+         * request queue empties.  Just discard any data we receive, until
+         * something reopens this TTY ... as if there were no HW flow control.
+         */
+        tty = port->port_tty;
+        if (tty == NULL) {
+                pr_vdebug("%s: ttyGS%d, after close\n",
+                                __func__, port->port_num);
+                return -EIO;
+        }
+
+        len = tty_insert_flip_string(tty, packet, size);
+        if (len > 0)
+                tasklet_schedule(&port->push);
+        if (len < size)
+                pr_debug("%s: ttyGS%d, drop %d bytes\n",
+                                __func__, port->port_num, size - len);
+        return 0;
+}
+
+/*
+ * Context: caller owns port_lock, and port_usb is set
+ */
+static unsigned gs_start_rx(struct gs_port *port)
+/*
+__releases(&port->port_lock)
+__acquires(&port->port_lock)
+*/
+{
+        struct list_head        *pool = &port->read_pool;
+        struct usb_ep           *out = port->port_usb->out;
+        unsigned                started = 0;
+
+        while (!list_empty(pool)) {
+                struct usb_request      *req;
+                int                     status;
+                struct tty_struct       *tty;
+
+                /* no more rx if closed or throttled */
+                tty = port->port_tty;
+                if (!tty || test_bit(TTY_THROTTLED, &tty->flags))
+                        break;
+
+                req = list_entry(pool->next, struct usb_request, list);
+                list_del(&req->list);
+                req->length = out->maxpacket;
+
+                /* drop lock while we call out; the controller driver
+                 * may need to call us back (e.g. for disconnect)
+                 */
+                spin_unlock(&port->port_lock);
+                status = usb_ep_queue(out, req, GFP_ATOMIC);
+                spin_lock(&port->port_lock);
+
+                if (status) {
+                        pr_debug("%s: %s %s err %d\n",
+                                        __func__, "queue", out->name, status);
+                        list_add(&req->list, pool);
+                        break;
+                }
+                started++;
+
+                /* abort immediately after disconnect */
+                if (!port->port_usb)
+                        break;
+        }
+        return started;
+}
+
+static void gs_read_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        int             status;
+        struct gs_port  *port = ep->driver_data;
+
+        spin_lock(&port->port_lock);
+        list_add(&req->list, &port->read_pool);
+
+        switch (req->status) {
+        case 0:
+                /* normal completion */
+                status = gs_recv_packet(port, req->buf, req->actual);
+                if (status && status != -EIO)
+                        pr_debug("%s: %s %s err %d\n",
+                                __func__, "recv", ep->name, status);
+                gs_start_rx(port);
+                break;
+
+        case -ESHUTDOWN:
+                /* disconnect */
+                pr_vdebug("%s: %s shutdown\n", __func__, ep->name);
+                break;
+
+        default:
+                /* presumably a transient fault */
+                pr_warning("%s: unexpected %s status %d\n",
+                                __func__, ep->name, req->status);
+                gs_start_rx(port);
+                break;
+        }
+        spin_unlock(&port->port_lock);
+}
+
+static void gs_write_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct gs_port  *port = ep->driver_data;
+
+        spin_lock(&port->port_lock);
+        list_add(&req->list, &port->write_pool);
+
+        switch (req->status) {
+        default:
+                /* presumably a transient fault */
+                pr_warning("%s: unexpected %s status %d\n",
+                                __func__, ep->name, req->status);
+                /* FALL THROUGH */
+        case 0:
+                /* normal completion */
+                gs_start_tx(port);
+                break;
+
+        case -ESHUTDOWN:
+                /* disconnect */
+                pr_vdebug("%s: %s shutdown\n", __func__, ep->name);
+                break;
+        }
+
+        spin_unlock(&port->port_lock);
+}
+
+static void gs_free_requests(struct usb_ep *ep, struct list_head *head)
+{
+        struct usb_request      *req;
+
+        while (!list_empty(head)) {
+                req = list_entry(head->next, struct usb_request, list);
+                list_del(&req->list);
+                gs_free_req(ep, req);
+        }
+}
+
+static int gs_alloc_requests(struct usb_ep *ep, struct list_head *head,
+                void (*fn)(struct usb_ep *, struct usb_request *))
+{
+        int                     i;
+        struct usb_request      *req;
+
+        /* Pre-allocate up to QUEUE_SIZE transfers, but if we can't
+         * do quite that many this time, don't fail ... we just won't
+         * be as speedy as we might otherwise be.
+         */
+        for (i = 0; i < QUEUE_SIZE; i++) {
+                req = gs_alloc_req(ep, ep->maxpacket, GFP_ATOMIC);
+                if (!req)
+                        return list_empty(head) ? -ENOMEM : 0;
+                req->complete = fn;
+                list_add_tail(&req->list, head);
+        }
+        return 0;
+}
+
+/**
+ * gs_start_io - start USB I/O streams
+ * @dev: encapsulates endpoints to use
+ * Context: holding port_lock; port_tty and port_usb are non-null
+ *
+ * We only start I/O when something is connected to both sides of
+ * this port.  If nothing is listening on the host side, we may
+ * be pointlessly filling up our TX buffers and FIFO.
+ */
+static int gs_start_io(struct gs_port *port)
+{
+        struct list_head        *head = &port->read_pool;
+        struct usb_ep           *ep = port->port_usb->out;
+        int                     status;
+        unsigned                started;
+
+        /* Allocate RX and TX I/O buffers.  We can't easily do this much
+         * earlier (with GFP_KERNEL) because the requests are coupled to
+         * endpoints, as are the packet sizes we'll be using.  Different
+         * configurations may use different endpoints with a given port;
+         * and high speed vs full speed changes packet sizes too.
+         */
+        status = gs_alloc_requests(ep, head, gs_read_complete);
+        if (status)
+                return status;
+
+        status = gs_alloc_requests(port->port_usb->in, &port->write_pool,
+                        gs_write_complete);
+        if (status) {
+                gs_free_requests(ep, head);
+                return status;
+        }
+
+        /* queue read requests */
+        started = gs_start_rx(port);
+
+        /* unblock any pending writes into our circular buffer */
+        if (started) {
+                tty_wakeup(port->port_tty);
+        } else {
+                gs_free_requests(ep, head);
+                gs_free_requests(port->port_usb->in, &port->write_pool);
+        }
+
+        return started ? 0 : status;
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* TTY Driver */
+
+/*
+ * gs_open sets up the link between a gs_port and its associated TTY.
+ * That link is broken *only* by TTY close(), and all driver methods
+ * know that.
+ */
+static int gs_open(struct tty_struct *tty, struct file *file)
+{
+        int             port_num = tty->index;
+        struct gs_port  *port;
+        int             status;
+
+        if (port_num < 0 || port_num >= n_ports)
+                return -ENXIO;
+
+        do {
+                mutex_lock(&ports[port_num].lock);
+                port = ports[port_num].port;
+                if (!port)
+                        status = -ENODEV;
+                else {
+                        spin_lock_irq(&port->port_lock);
+
+                        /* already open?  Great. */
+                        if (port->open_count) {
+                                status = 0;
+                                port->open_count++;
+
+                        /* currently opening/closing? wait ... */
+                        } else if (port->openclose) {
+                                status = -EBUSY;
+
+                        /* ... else we do the work */
+                        } else {
+                                status = -EAGAIN;
+                                port->openclose = true;
+                        }
+                        spin_unlock_irq(&port->port_lock);
+                }
+                mutex_unlock(&ports[port_num].lock);
+
+                switch (status) {
+                default:
+                        /* fully handled */
+                        return status;
+                case -EAGAIN:
+                        /* must do the work */
+                        break;
+                case -EBUSY:
+                        /* wait for EAGAIN task to finish */
+                        msleep(1);
+                        /* REVISIT could have a waitchannel here, if
+                         * concurrent open performance is important
+                         */
+                        break;
+                }
+        } while (status != -EAGAIN);
+
+        /* Do the "real open" */
+        spin_lock_irq(&port->port_lock);
+
+        /* allocate circular buffer on first open */
+        if (port->port_write_buf.buf_buf == NULL) {
+
+                spin_unlock_irq(&port->port_lock);
+                status = gs_buf_alloc(&port->port_write_buf, WRITE_BUF_SIZE);
+                spin_lock_irq(&port->port_lock);
+
+                if (status) {
+                        pr_debug("gs_open: ttyGS%d (%p,%p) no buffer\n",
+                                port->port_num, tty, file);
+                        port->openclose = false;
+                        goto exit_unlock_port;
+                }
+        }
+
+        /* REVISIT if REMOVED (ports[].port NULL), abort the open
+         * to let rmmod work faster (but this way isn't wrong).
+         */
+
+        /* REVISIT maybe wait for "carrier detect" */
+
+        tty->driver_data = port;
+        port->port_tty = tty;
+
+        port->open_count = 1;
+        port->openclose = false;
+
+        /* low_latency means ldiscs work in tasklet context, without
+         * needing a workqueue schedule ... easier to keep up.
+         */
+        tty->low_latency = 1;
+
+        /* if connected, start the I/O stream */
+        if (port->port_usb) {
+                pr_debug("gs_open: start ttyGS%d\n", port->port_num);
+                gs_start_io(port);
+
+                /* REVISIT for ACM, issue "network connected" event */
+        }
+
+        pr_debug("gs_open: ttyGS%d (%p,%p)\n", port->port_num, tty, file);
+
+        status = 0;
+
+exit_unlock_port:
+        spin_unlock_irq(&port->port_lock);
+        return status;
+}
+
+static int gs_writes_finished(struct gs_port *p)
+{
+        int cond;
+
+        /* return true on disconnect or empty buffer */
+        spin_lock_irq(&p->port_lock);
+        cond = (p->port_usb == NULL) || !gs_buf_data_avail(&p->port_write_buf);
+        spin_unlock_irq(&p->port_lock);
+
+        return cond;
+}
+
+static void gs_close(struct tty_struct *tty, struct file *file)
+{
+        struct gs_port *port = tty->driver_data;
+
+        spin_lock_irq(&port->port_lock);
+
+        if (port->open_count != 1) {
+                if (port->open_count == 0)
+                        WARN_ON(1);
+                else
+                        --port->open_count;
+                goto exit;
+        }
+
+        pr_debug("gs_close: ttyGS%d (%p,%p) ...\n", port->port_num, tty, file);
+
+        /* mark port as closing but in use; we can drop port lock
+         * and sleep if necessary
+         */
+        port->openclose = true;
+        port->open_count = 0;
+
+        if (port->port_usb)
+                /* REVISIT for ACM, issue "network disconnected" event */;
+
+        /* wait for circular write buffer to drain, disconnect, or at
+         * most GS_CLOSE_TIMEOUT seconds; then discard the rest
+         */
+        if (gs_buf_data_avail(&port->port_write_buf) > 0
+                        && port->port_usb) {
+                spin_unlock_irq(&port->port_lock);
+                wait_event_interruptible_timeout(port->drain_wait,
+                                        gs_writes_finished(port),
+                                        GS_CLOSE_TIMEOUT * HZ);
+                spin_lock_irq(&port->port_lock);
+        }
+
+        /* Iff we're disconnected, there can be no I/O in flight so it's
+         * ok to free the circular buffer; else just scrub it.  And don't
+         * let the push tasklet fire again until we're re-opened.
+         */
+        if (port->port_usb == NULL)
+                gs_buf_free(&port->port_write_buf);
+        else
+                gs_buf_clear(&port->port_write_buf);
+
+        tasklet_kill(&port->push);
+
+        tty->driver_data = NULL;
+        port->port_tty = NULL;
+
+        port->openclose = false;
+
+        pr_debug("gs_close: ttyGS%d (%p,%p) done!\n",
+                        port->port_num, tty, file);
+
+        wake_up_interruptible(&port->close_wait);
+exit:
+        spin_unlock_irq(&port->port_lock);
+}
+
+static int gs_write(struct tty_struct *tty, const unsigned char *buf, int count)
+{
+        struct gs_port  *port = tty->driver_data;
+        unsigned long   flags;
+        int             status;
+
+        pr_vdebug("gs_write: ttyGS%d (%p) writing %d bytes\n",
+                        port->port_num, tty, count);
+
+        spin_lock_irqsave(&port->port_lock, flags);
+        if (count)
+                count = gs_buf_put(&port->port_write_buf, buf, count);
+        /* treat count == 0 as flush_chars() */
+        if (port->port_usb)
+                status = gs_start_tx(port);
+        spin_unlock_irqrestore(&port->port_lock, flags);
+
+        return count;
+}
+
+static int gs_put_char(struct tty_struct *tty, unsigned char ch)
+{
+        struct gs_port  *port = tty->driver_data;
+        unsigned long   flags;
+        int             status;
+
+        pr_vdebug("gs_put_char: (%d,%p) char=0x%x, called from %p\n",
+                port->port_num, tty, ch, __builtin_return_address(0));
+
+        spin_lock_irqsave(&port->port_lock, flags);
+        status = gs_buf_put(&port->port_write_buf, &ch, 1);
+        spin_unlock_irqrestore(&port->port_lock, flags);
+
+        return status;
+}
+
+static void gs_flush_chars(struct tty_struct *tty)
+{
+        struct gs_port  *port = tty->driver_data;
+        unsigned long   flags;
+
+        pr_vdebug("gs_flush_chars: (%d,%p)\n", port->port_num, tty);
+
+        spin_lock_irqsave(&port->port_lock, flags);
+        if (port->port_usb)
+                gs_start_tx(port);
+        spin_unlock_irqrestore(&port->port_lock, flags);
+}
+
+static int gs_write_room(struct tty_struct *tty)
+{
+        struct gs_port  *port = tty->driver_data;
+        unsigned long   flags;
+        int             room = 0;
+
+        spin_lock_irqsave(&port->port_lock, flags);
+        if (port->port_usb)
+                room = gs_buf_space_avail(&port->port_write_buf);
+        spin_unlock_irqrestore(&port->port_lock, flags);
+
+        pr_vdebug("gs_write_room: (%d,%p) room=%d\n",
+                port->port_num, tty, room);
+
+        return room;
+}
+
+static int gs_chars_in_buffer(struct tty_struct *tty)
+{
+        struct gs_port  *port = tty->driver_data;
+        unsigned long   flags;
+        int             chars = 0;
+
+        spin_lock_irqsave(&port->port_lock, flags);
+        chars = gs_buf_data_avail(&port->port_write_buf);
+        spin_unlock_irqrestore(&port->port_lock, flags);
+
+        pr_vdebug("gs_chars_in_buffer: (%d,%p) chars=%d\n",
+                port->port_num, tty, chars);
+
+        return chars;
+}
+
+/* undo side effects of setting TTY_THROTTLED */
+static void gs_unthrottle(struct tty_struct *tty)
+{
+        struct gs_port          *port = tty->driver_data;
+        unsigned long           flags;
+        unsigned                started = 0;
+
+        spin_lock_irqsave(&port->port_lock, flags);
+        if (port->port_usb)
+                started = gs_start_rx(port);
+        spin_unlock_irqrestore(&port->port_lock, flags);
+
+        pr_vdebug("gs_unthrottle: ttyGS%d, %d packets\n",
+                        port->port_num, started);
+}
+
+static const struct tty_operations gs_tty_ops = {
+        .open =                 gs_open,
+        .close =                gs_close,
+        .write =                gs_write,
+        .put_char =             gs_put_char,
+        .flush_chars =          gs_flush_chars,
+        .write_room =           gs_write_room,
+        .chars_in_buffer =      gs_chars_in_buffer,
+        .unthrottle =           gs_unthrottle,
+};
+
+/*-------------------------------------------------------------------------*/
+
+static struct tty_driver *gs_tty_driver;
+
+static int __init
+gs_port_alloc(unsigned port_num, struct usb_cdc_line_coding *coding)
+{
+        struct gs_port  *port;
+
+        port = kzalloc(sizeof(struct gs_port), GFP_KERNEL);
+        if (port == NULL)
+                return -ENOMEM;
+
+        spin_lock_init(&port->port_lock);
+        init_waitqueue_head(&port->close_wait);
+        init_waitqueue_head(&port->drain_wait);
+
+        tasklet_init(&port->push, gs_rx_push, (unsigned long) port);
+
+        INIT_LIST_HEAD(&port->read_pool);
+        INIT_LIST_HEAD(&port->write_pool);
+
+        port->port_num = port_num;
+        port->port_line_coding = *coding;
+
+        ports[port_num].port = port;
+
+        return 0;
+}
+
+/**
+ * gserial_setup - initialize TTY driver for one or more ports
+ * @g: gadget to associate with these ports
+ * @count: how many ports to support
+ * Context: may sleep
+ *
+ * The TTY stack needs to know in advance how many devices it should
+ * plan to manage.  Use this call to set up the ports you will be
+ * exporting through USB.  Later, connect them to functions based
+ * on what configuration is activated by the USB host; and disconnect
+ * them as appropriate.
+ *
+ * An example would be a two-configuration device in which both
+ * configurations expose port 0, but through different functions.
+ * One configuration could even expose port 1 while the other
+ * one doesn't.
+ *
+ * Returns negative errno or zero.
+ */
+int __init gserial_setup(struct usb_gadget *g, unsigned count)
+{
+        unsigned                        i;
+        struct usb_cdc_line_coding      coding;
+        int                             status;
+
+        if (count == 0 || count > N_PORTS)
+                return -EINVAL;
+
+        gs_tty_driver = alloc_tty_driver(count);
+        if (!gs_tty_driver)
+                return -ENOMEM;
+
+        gs_tty_driver->owner = THIS_MODULE;
+        gs_tty_driver->driver_name = "g_serial";
+        gs_tty_driver->name = "ttyGS";
+        /* uses dynamically assigned dev_t values */
+
+        gs_tty_driver->type = TTY_DRIVER_TYPE_SERIAL;
+        gs_tty_driver->subtype = SERIAL_TYPE_NORMAL;
+        gs_tty_driver->flags = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
+        gs_tty_driver->init_termios = tty_std_termios;
+
+        /* 9600-8-N-1 ... matches defaults expected by "usbser.sys" on
+         * MS-Windows.  Otherwise, most of these flags shouldn't affect
+         * anything unless we were to actually hook up to a serial line.
+         */
+        gs_tty_driver->init_termios.c_cflag =
+                        B9600 | CS8 | CREAD | HUPCL | CLOCAL;
+        gs_tty_driver->init_termios.c_ispeed = 9600;
+        gs_tty_driver->init_termios.c_ospeed = 9600;
+
+        coding.dwDTERate = __constant_cpu_to_le32(9600);
+        coding.bCharFormat = 8;
+        coding.bParityType = USB_CDC_NO_PARITY;
+        coding.bDataBits = USB_CDC_1_STOP_BITS;
+
+        tty_set_operations(gs_tty_driver, &gs_tty_ops);
+
+        /* make devices be openable */
+        for (i = 0; i < count; i++) {
+                mutex_init(&ports[i].lock);
+                status = gs_port_alloc(i, &coding);
+                if (status) {
+                        count = i;
+                        goto fail;
+                }
+        }
+        n_ports = count;
+
+        /* export the driver ... */
+        status = tty_register_driver(gs_tty_driver);
+        if (status) {
+                put_tty_driver(gs_tty_driver);
+                pr_err("%s: cannot register, err %d\n",
+                                __func__, status);
+                goto fail;
+        }
+
+        /* ... and sysfs class devices, so mdev/udev make /dev/ttyGS* */
+        for (i = 0; i < count; i++) {
+                struct device   *tty_dev;
+
+                tty_dev = tty_register_device(gs_tty_driver, i, &g->dev);
+                if (IS_ERR(tty_dev))
+                        pr_warning("%s: no classdev for port %d, err %ld\n",
+                                __func__, i, PTR_ERR(tty_dev));
+        }
+
+        pr_debug("%s: registered %d ttyGS* device%s\n", __func__,
+                        count, (count == 1) ? "" : "s");
+
+        return status;
+fail:
+        while (count--)
+                kfree(ports[count].port);
+        put_tty_driver(gs_tty_driver);
+        gs_tty_driver = NULL;
+        return status;
+}
+
+static int gs_closed(struct gs_port *port)
+{
+        int cond;
+
+        spin_lock_irq(&port->port_lock);
+        cond = (port->open_count == 0) && !port->openclose;
+        spin_unlock_irq(&port->port_lock);
+        return cond;
+}
+
+/**
+ * gserial_cleanup - remove TTY-over-USB driver and devices
+ * Context: may sleep
+ *
+ * This is called to free all resources allocated by @gserial_setup().
+ * Accordingly, it may need to wait until some open /dev/ files have
+ * closed.
+ *
+ * The caller must have issued @gserial_disconnect() for any ports
+ * that had previously been connected, so that there is never any
+ * I/O pending when it's called.
+ */
+void gserial_cleanup(void)
+{
+        unsigned        i;
+        struct gs_port  *port;
+
+        if (!gs_tty_driver)
+                return;
+
+        /* start sysfs and /dev/ttyGS* node removal */
+        for (i = 0; i < n_ports; i++)
+                tty_unregister_device(gs_tty_driver, i);
+
+        for (i = 0; i < n_ports; i++) {
+                /* prevent new opens */
+                mutex_lock(&ports[i].lock);
+                port = ports[i].port;
+                ports[i].port = NULL;
+                mutex_unlock(&ports[i].lock);
+
+                /* wait for old opens to finish */
+                wait_event(port->close_wait, gs_closed(port));
+
+                WARN_ON(port->port_usb != NULL);
+
+                kfree(port);
+        }
+        n_ports = 0;
+
+        tty_unregister_driver(gs_tty_driver);
+        gs_tty_driver = NULL;
+
+        pr_debug("%s: cleaned up ttyGS* support\n", __func__);
+}
+
+/**
+ * gserial_connect - notify TTY I/O glue that USB link is active
+ * @gser: the function, set up with endpoints and descriptors
+ * @port_num: which port is active
+ * Context: any (usually from irq)
+ *
+ * This is called activate endpoints and let the TTY layer know that
+ * the connection is active ... not unlike "carrier detect".  It won't
+ * necessarily start I/O queues; unless the TTY is held open by any
+ * task, there would be no point.  However, the endpoints will be
+ * activated so the USB host can perform I/O, subject to basic USB
+ * hardware flow control.
+ *
+ * Caller needs to have set up the endpoints and USB function in @dev
+ * before calling this, as well as the appropriate (speed-specific)
+ * endpoint descriptors, and also have set up the TTY driver by calling
+ * @gserial_setup().
+ *
+ * Returns negative errno or zero.
+ * On success, ep->driver_data will be overwritten.
+ */
+int gserial_connect(struct gserial *gser, u8 port_num)
+{
+        struct gs_port  *port;
+        unsigned long   flags;
+        int             status;
+
+        if (!gs_tty_driver || port_num >= n_ports)
+                return -ENXIO;
+
+        /* we "know" gserial_cleanup() hasn't been called */
+        port = ports[port_num].port;
+
+        /* activate the endpoints */
+        status = usb_ep_enable(gser->in, gser->in_desc);
+        if (status < 0)
+                return status;
+        gser->in->driver_data = port;
+
+        status = usb_ep_enable(gser->out, gser->out_desc);
+        if (status < 0)
+                goto fail_out;
+        gser->out->driver_data = port;
+
+        /* then tell the tty glue that I/O can work */
+        spin_lock_irqsave(&port->port_lock, flags);
+        gser->ioport = port;
+        port->port_usb = gser;
+
+        /* REVISIT unclear how best to handle this state...
+         * we don't really couple it with the Linux TTY.
+         */
+        gser->port_line_coding = port->port_line_coding;
+
+        /* REVISIT if waiting on "carrier detect", signal. */
+
+        /* REVISIT for ACM, issue "network connection" status notification:
+         * connected if open_count, else disconnected.
+         */
+
+        /* if it's already open, start I/O */
+        if (port->open_count) {
+                pr_debug("gserial_connect: start ttyGS%d\n", port->port_num);
+                gs_start_io(port);
+        }
+
+        spin_unlock_irqrestore(&port->port_lock, flags);
+
+        return status;
+
+fail_out:
+        usb_ep_disable(gser->in);
+        gser->in->driver_data = NULL;
+        return status;
+}
+
+/**
+ * gserial_disconnect - notify TTY I/O glue that USB link is inactive
+ * @gser: the function, on which gserial_connect() was called
+ * Context: any (usually from irq)
+ *
+ * This is called to deactivate endpoints and let the TTY layer know
+ * that the connection went inactive ... not unlike "hangup".
+ *
+ * On return, the state is as if gserial_connect() had never been called;
+ * there is no active USB I/O on these endpoints.
+ */
+void gserial_disconnect(struct gserial *gser)
+{
+        struct gs_port  *port = gser->ioport;
+        unsigned long   flags;
+
+        if (!port)
+                return;
+
+        /* tell the TTY glue not to do I/O here any more */
+        spin_lock_irqsave(&port->port_lock, flags);
+
+        /* REVISIT as above: how best to track this? */
+        port->port_line_coding = gser->port_line_coding;
+
+        port->port_usb = NULL;
+        gser->ioport = NULL;
+        if (port->open_count > 0 || port->openclose) {
+                wake_up_interruptible(&port->drain_wait);
+                if (port->port_tty)
+                        tty_hangup(port->port_tty);
+        }
+        spin_unlock_irqrestore(&port->port_lock, flags);
+
+        /* disable endpoints, aborting down any active I/O */
+        usb_ep_disable(gser->out);
+        gser->out->driver_data = NULL;
+
+        usb_ep_disable(gser->in);
+        gser->in->driver_data = NULL;
+
+        /* finally, free any unused/unusable I/O buffers */
+        spin_lock_irqsave(&port->port_lock, flags);
+        if (port->open_count == 0 && !port->openclose)
+                gs_buf_free(&port->port_write_buf);
+        gs_free_requests(gser->out, &port->read_pool);
+        gs_free_requests(gser->in, &port->write_pool);
+        spin_unlock_irqrestore(&port->port_lock, flags);
+}
diff --git a/drivers/usb/gadget/u_serial.h b/drivers/usb/gadget/u_serial.h
new file mode 100644
index 000000000000..7b561138f90e
--- /dev/null
+++ b/drivers/usb/gadget/u_serial.h
@@ -0,0 +1,58 @@
+/*
+ * u_serial.h - interface to USB gadget "serial port"/TTY utilities
+ *
+ * Copyright (C) 2008 David Brownell
+ * Copyright (C) 2008 by Nokia Corporation
+ *
+ * This software is distributed under the terms of the GNU General
+ * Public License ("GPL") as published by the Free Software Foundation,
+ * either version 2 of that License or (at your option) any later version.
+ */
+
+#ifndef __U_SERIAL_H
+#define __U_SERIAL_H
+
+#include <linux/usb/composite.h>
+#include <linux/usb/cdc.h>
+
+/*
+ * One non-multiplexed "serial" I/O port ... there can be several of these
+ * on any given USB peripheral device, if it provides enough endpoints.
+ *
+ * The "u_serial" utility component exists to do one thing:  manage TTY
+ * style I/O using the USB peripheral endpoints listed here, including
+ * hookups to sysfs and /dev for each logical "tty" device.
+ *
+ * REVISIT need TTY --> USB event flow too, so ACM can report open/close
+ * as carrier detect events.  Model after ECM.  There's more ACM state too.
+ *
+ * REVISIT someday, allow multiplexing several TTYs over these endpoints.
+ */
+struct gserial {
+        struct usb_function             func;
+
+        /* port is managed by gserial_{connect,disconnect} */
+        struct gs_port                  *ioport;
+
+        struct usb_ep                   *in;
+        struct usb_ep                   *out;
+        struct usb_endpoint_descriptor  *in_desc;
+        struct usb_endpoint_descriptor  *out_desc;
+
+        /* REVISIT avoid this CDC-ACM support harder ... */
+        struct usb_cdc_line_coding port_line_coding;    /* 9600-8-N-1 etc */
+};
+
+/* port setup/teardown is handled by gadget driver */
+int gserial_setup(struct usb_gadget *g, unsigned n_ports);
+void gserial_cleanup(void);
+
+/* connect/disconnect is handled by individual functions */
+int gserial_connect(struct gserial *, u8 port_num);
+void gserial_disconnect(struct gserial *);
+
+/* functions are bound to configurations by a config or gadget driver */
+int acm_bind_config(struct usb_configuration *c, u8 port_num);
+int gser_bind_config(struct usb_configuration *c, u8 port_num);
+
+#endif /* __U_SERIAL_H */
diff --git a/drivers/usb/gadget/zero.c b/drivers/usb/gadget/zero.c
index fce4924dbbe8..aa0bd4f126a1 100644
--- a/drivers/usb/gadget/zero.c
+++ b/drivers/usb/gadget/zero.c
@@ -1,8 +1,8 @@
 /*
  * zero.c -- Gadget Zero, for USB development
  *
- * Copyright (C) 2003-2007 David Brownell
- * All rights reserved.
+ * Copyright (C) 2003-2008 David Brownell
+ * Copyright (C) 2008 by Nokia Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -30,12 +30,7 @@
  *
  * It supports two similar configurations.  One sinks whatever the usb host
  * writes, and in return sources zeroes.  The other loops whatever the host
- * writes back, so the host can read it.  Module options include:
- *
- *   buflen=N           default N=4096, buffer size used
- *   qlen=N             default N=32, how many buffers in the loopback queue
- *   loopdefault        default false, list loopback config first
- *   autoresume=N       default N=0, seconds before triggering remote wakeup
+ * writes back, so the host can read it.
  *
  * Many drivers will only have one configuration, letting them be much
  * simpler if they also don't support high speed operation (like this
@@ -47,94 +42,35 @@
  * work with low capability USB controllers without four bulk endpoints.
  */
 
+/*
+ * driver assumes self-powered hardware, and
+ * has no way for users to trigger remote wakeup.
+ */
+
 /* #define VERBOSE_DEBUG */
 
 #include <linux/kernel.h>
 #include <linux/utsname.h>
 #include <linux/device.h>
 
-#include <linux/usb/ch9.h>
-#include <linux/usb/gadget.h>
-
+#include "g_zero.h"
 #include "gadget_chips.h"
 
 
 /*-------------------------------------------------------------------------*/
 
-#define DRIVER_VERSION          "Earth Day 2008"
+#define DRIVER_VERSION          "Cinco de Mayo 2008"
 
-static const char shortname[] = "zero";
 static const char longname[] = "Gadget Zero";
 
-static const char source_sink[] = "source and sink data";
-static const char loopback[] = "loop input to output";
-
-/*-------------------------------------------------------------------------*/
-
-/*
- * driver assumes self-powered hardware, and
- * has no way for users to trigger remote wakeup.
- *
- * this version autoconfigures as much as possible,
- * which is reasonable for most "bulk-only" drivers.
- */
-static const char *EP_IN_NAME;          /* source */
-static const char *EP_OUT_NAME;         /* sink */
-
-/*-------------------------------------------------------------------------*/
-
-/* big enough to hold our biggest descriptor */
-#define USB_BUFSIZ      256
-
-struct zero_dev {
-        spinlock_t              lock;
-        struct usb_gadget       *gadget;
-        struct usb_request      *req;           /* for control responses */
-
-        /* when configured, we have one of two configs:
-         * - source data (in to host) and sink it (out from host)
-         * - or loop it back (out from host back in to host)
-         */
-        u8                      config;
-        struct usb_ep           *in_ep, *out_ep;
-
-        /* autoresume timer */
-        struct timer_list       resume;
-};
-
-#define DBG(d, fmt, args...) \
-        dev_dbg(&(d)->gadget->dev , fmt , ## args)
-#define VDBG(d, fmt, args...) \
-        dev_vdbg(&(d)->gadget->dev , fmt , ## args)
-#define ERROR(d, fmt, args...) \
-        dev_err(&(d)->gadget->dev , fmt , ## args)
-#define WARN(d, fmt, args...) \
-        dev_warn(&(d)->gadget->dev , fmt , ## args)
-#define INFO(d, fmt, args...) \
-        dev_info(&(d)->gadget->dev , fmt , ## args)
-
-/*-------------------------------------------------------------------------*/
-
-static unsigned buflen = 4096;
-static unsigned qlen = 32;
-static unsigned pattern = 0;
-
-module_param(buflen, uint, S_IRUGO);
-module_param(qlen, uint, S_IRUGO);
-module_param(pattern, uint, S_IRUGO|S_IWUSR);
-
-/*
- * if it's nonzero, autoresume says how many seconds to wait
- * before trying to wake up the host after suspend.
- */
-static unsigned autoresume = 0;
-module_param(autoresume, uint, 0);
+unsigned buflen = 4096;
+module_param(buflen, uint, 0);
 
 /*
  * Normally the "loopback" configuration is second (index 1) so
  * it's not the default.  Here's where to change that order, to
- * work better with hosts where config changes are problematic.
- * Or controllers (like superh) that only support one config.
+ * work better with hosts where config changes are problematic or
+ * controllers (like original superh) that only support one config.
  */
 static int loopdefault = 0;
 module_param(loopdefault, bool, S_IRUGO|S_IWUSR);
@@ -156,24 +92,6 @@ module_param(loopdefault, bool, S_IRUGO|S_IWUSR);
 
 /*-------------------------------------------------------------------------*/
 
-/*
- * DESCRIPTORS ... most are static, but strings and (full)
- * configuration descriptors are built on demand.
- */
-
-#define STRING_MANUFACTURER             25
-#define STRING_PRODUCT                  42
-#define STRING_SERIAL                   101
-#define STRING_SOURCE_SINK              250
-#define STRING_LOOPBACK                 251
-
-/*
- * This device advertises two configurations; these numbers work
- * on a pxa250 as well as more flexible hardware.
- */
-#define CONFIG_SOURCE_SINK      3
-#define CONFIG_LOOPBACK         2
-
 static struct usb_device_descriptor device_desc = {
         .bLength =              sizeof device_desc,
         .bDescriptorType =      USB_DT_DEVICE,
@@ -183,248 +101,64 @@ static struct usb_device_descriptor device_desc = {
 
         .idVendor =             __constant_cpu_to_le16(DRIVER_VENDOR_NUM),
         .idProduct =            __constant_cpu_to_le16(DRIVER_PRODUCT_NUM),
-        .iManufacturer =        STRING_MANUFACTURER,
-        .iProduct =             STRING_PRODUCT,
-        .iSerialNumber =        STRING_SERIAL,
         .bNumConfigurations =   2,
 };
 
-static struct usb_config_descriptor source_sink_config = {
-        .bLength =              sizeof source_sink_config,
-        .bDescriptorType =      USB_DT_CONFIG,
-
-        /* compute wTotalLength on the fly */
-        .bNumInterfaces =       1,
-        .bConfigurationValue =  CONFIG_SOURCE_SINK,
-        .iConfiguration =       STRING_SOURCE_SINK,
-        .bmAttributes =         USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
-        .bMaxPower =            1,      /* self-powered */
-};
-
-static struct usb_config_descriptor loopback_config = {
-        .bLength =              sizeof loopback_config,
-        .bDescriptorType =      USB_DT_CONFIG,
-
-        /* compute wTotalLength on the fly */
-        .bNumInterfaces =       1,
-        .bConfigurationValue =  CONFIG_LOOPBACK,
-        .iConfiguration =       STRING_LOOPBACK,
-        .bmAttributes =         USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
-        .bMaxPower =            1,      /* self-powered */
-};
-
+#ifdef CONFIG_USB_OTG
 static struct usb_otg_descriptor otg_descriptor = {
         .bLength =              sizeof otg_descriptor,
         .bDescriptorType =      USB_DT_OTG,
 
-        .bmAttributes =         USB_OTG_SRP,
-};
-
-/* one interface in each configuration */
-
-static const struct usb_interface_descriptor source_sink_intf = {
-        .bLength =              sizeof source_sink_intf,
-        .bDescriptorType =      USB_DT_INTERFACE,
-
-        .bNumEndpoints =        2,
-        .bInterfaceClass =      USB_CLASS_VENDOR_SPEC,
-        .iInterface =           STRING_SOURCE_SINK,
-};
-
-static const struct usb_interface_descriptor loopback_intf = {
-        .bLength =              sizeof loopback_intf,
-        .bDescriptorType =      USB_DT_INTERFACE,
-
-        .bNumEndpoints =        2,
-        .bInterfaceClass =      USB_CLASS_VENDOR_SPEC,
-        .iInterface =           STRING_LOOPBACK,
-};
-
-/* two full speed bulk endpoints; their use is config-dependent */
-
-static struct usb_endpoint_descriptor fs_source_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-
-        .bEndpointAddress =     USB_DIR_IN,
-        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
-};
-
-static struct usb_endpoint_descriptor fs_sink_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-
-        .bEndpointAddress =     USB_DIR_OUT,
-        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
-};
-
-static const struct usb_descriptor_header *fs_source_sink_function[] = {
-        (struct usb_descriptor_header *) &otg_descriptor,
-        (struct usb_descriptor_header *) &source_sink_intf,
-        (struct usb_descriptor_header *) &fs_sink_desc,
-        (struct usb_descriptor_header *) &fs_source_desc,
-        NULL,
-};
-
-static const struct usb_descriptor_header *fs_loopback_function[] = {
-        (struct usb_descriptor_header *) &otg_descriptor,
-        (struct usb_descriptor_header *) &loopback_intf,
-        (struct usb_descriptor_header *) &fs_sink_desc,
-        (struct usb_descriptor_header *) &fs_source_desc,
-        NULL,
-};
-
-/*
- * usb 2.0 devices need to expose both high speed and full speed
- * descriptors, unless they only run at full speed.
- *
- * that means alternate endpoint descriptors (bigger packets)
- * and a "device qualifier" ... plus more construction options
- * for the config descriptor.
- */
-
-static struct usb_endpoint_descriptor hs_source_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-
-        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
-        .wMaxPacketSize =       __constant_cpu_to_le16(512),
-};
-
-static struct usb_endpoint_descriptor hs_sink_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-
-        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
-        .wMaxPacketSize =       __constant_cpu_to_le16(512),
-};
-
-static struct usb_qualifier_descriptor dev_qualifier = {
-        .bLength =              sizeof dev_qualifier,
-        .bDescriptorType =      USB_DT_DEVICE_QUALIFIER,
-
-        .bcdUSB =               __constant_cpu_to_le16(0x0200),
-        .bDeviceClass =         USB_CLASS_VENDOR_SPEC,
-
-        .bNumConfigurations =   2,
+        /* REVISIT SRP-only hardware is possible, although
+         * it would not be called "OTG" ...
+         */
+        .bmAttributes =         USB_OTG_SRP | USB_OTG_HNP,
 };
 
-static const struct usb_descriptor_header *hs_source_sink_function[] = {
+const struct usb_descriptor_header *otg_desc[] = {
         (struct usb_descriptor_header *) &otg_descriptor,
-        (struct usb_descriptor_header *) &source_sink_intf,
-        (struct usb_descriptor_header *) &hs_source_desc,
-        (struct usb_descriptor_header *) &hs_sink_desc,
         NULL,
 };
+#endif
 
-static const struct usb_descriptor_header *hs_loopback_function[] = {
-        (struct usb_descriptor_header *) &otg_descriptor,
-        (struct usb_descriptor_header *) &loopback_intf,
-        (struct usb_descriptor_header *) &hs_source_desc,
-        (struct usb_descriptor_header *) &hs_sink_desc,
-        NULL,
-};
+/* string IDs are assigned dynamically */
 
-/* maxpacket and other transfer characteristics vary by speed. */
-static inline struct usb_endpoint_descriptor *
-ep_desc(struct usb_gadget *g, struct usb_endpoint_descriptor *hs,
-                struct usb_endpoint_descriptor *fs)
-{
-        if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
-                return hs;
-        return fs;
-}
+#define STRING_MANUFACTURER_IDX         0
+#define STRING_PRODUCT_IDX              1
+#define STRING_SERIAL_IDX               2
 
 static char manufacturer[50];
 
 /* default serial number takes at least two packets */
 static char serial[] = "0123456789.0123456789.0123456789";
 
-
-/* static strings, in UTF-8 */
-static struct usb_string strings[] = {
-        { STRING_MANUFACTURER, manufacturer, },
-        { STRING_PRODUCT, longname, },
-        { STRING_SERIAL, serial, },
-        { STRING_LOOPBACK, loopback, },
-        { STRING_SOURCE_SINK, source_sink, },
+static struct usb_string strings_dev[] = {
+        [STRING_MANUFACTURER_IDX].s = manufacturer,
+        [STRING_PRODUCT_IDX].s = longname,
+        [STRING_SERIAL_IDX].s = serial,
         {  }                    /* end of list */
 };
 
-static struct usb_gadget_strings stringtab = {
+static struct usb_gadget_strings stringtab_dev = {
         .language       = 0x0409,       /* en-us */
-        .strings        = strings,
+        .strings        = strings_dev,
 };
 
-/*
- * config descriptors are also handcrafted.  these must agree with code
- * that sets configurations, and with code managing interfaces and their
- * altsettings.  other complexity may come from:
- *
- *  - high speed support, including "other speed config" rules
- *  - multiple configurations
- *  - interfaces with alternate settings
- *  - embedded class or vendor-specific descriptors
- *
- * this handles high speed, and has a second config that could as easily
- * have been an alternate interface setting (on most hardware).
- *
- * NOTE:  to demonstrate (and test) more USB capabilities, this driver
- * should include an altsetting to test interrupt transfers, including
- * high bandwidth modes at high speed.  (Maybe work like Intel's test
- * device?)
- */
-static int config_buf(struct usb_gadget *gadget,
-                u8 *buf, u8 type, unsigned index)
-{
-        int                             is_source_sink;
-        int                             len;
-        const struct usb_descriptor_header **function;
-        int                             hs = 0;
-
-        /* two configurations will always be index 0 and index 1 */
-        if (index > 1)
-                return -EINVAL;
-        is_source_sink = loopdefault ? (index == 1) : (index == 0);
-
-        if (gadget_is_dualspeed(gadget)) {
-                hs = (gadget->speed == USB_SPEED_HIGH);
-                if (type == USB_DT_OTHER_SPEED_CONFIG)
-                        hs = !hs;
-        }
-        if (hs)
-                function = is_source_sink
-                        ? hs_source_sink_function
-                        : hs_loopback_function;
-        else
-                function = is_source_sink
-                        ? fs_source_sink_function
-                        : fs_loopback_function;
-
-        /* for now, don't advertise srp-only devices */
-        if (!gadget_is_otg(gadget))
-                function++;
-
-        len = usb_gadget_config_buf(is_source_sink
-                                        ? &source_sink_config
-                                        : &loopback_config,
-                        buf, USB_BUFSIZ, function);
-        if (len < 0)
-                return len;
-        ((struct usb_config_descriptor *) buf)->bDescriptorType = type;
-        return len;
-}
+static struct usb_gadget_strings *dev_strings[] = {
+        &stringtab_dev,
+        NULL,
+};
 
 /*-------------------------------------------------------------------------*/
 
-static struct usb_request *alloc_ep_req(struct usb_ep *ep, unsigned length)
+struct usb_request *alloc_ep_req(struct usb_ep *ep)
 {
         struct usb_request      *req;
 
         req = usb_ep_alloc_request(ep, GFP_ATOMIC);
         if (req) {
-                req->length = length;
-                req->buf = kmalloc(length, GFP_ATOMIC);
+                req->length = buflen;
+                req->buf = kmalloc(buflen, GFP_ATOMIC);
                 if (!req->buf) {
                         usb_ep_free_request(ep, req);
                         req = NULL;
@@ -433,681 +167,73 @@ static struct usb_request *alloc_ep_req(struct usb_ep *ep, unsigned length)
         return req;
 }
 
-static void free_ep_req(struct usb_ep *ep, struct usb_request *req)
+void free_ep_req(struct usb_ep *ep, struct usb_request *req)
 {
         kfree(req->buf);
         usb_ep_free_request(ep, req);
 }
 
-/*-------------------------------------------------------------------------*/
-
-/*
- * SOURCE/SINK FUNCTION ... a primary testing vehicle for USB peripherals,
- * this just sinks bulk packets OUT to the peripheral and sources them IN
- * to the host, optionally with specific data patterns.
- *
- * In terms of control messaging, this supports all the standard requests
- * plus two that support control-OUT tests.
- *
- * Note that because this doesn't queue more than one request at a time,
- * some other function must be used to test queueing logic.  The network
- * link (g_ether) is probably the best option for that.
- */
-
-/* optionally require specific source/sink data patterns  */
-
-static int
-check_read_data(
-        struct zero_dev         *dev,
-        struct usb_ep           *ep,
-        struct usb_request      *req
-)
+static void disable_ep(struct usb_composite_dev *cdev, struct usb_ep *ep)
 {
-        unsigned        i;
-        u8              *buf = req->buf;
-
-        for (i = 0; i < req->actual; i++, buf++) {
-                switch (pattern) {
-                /* all-zeroes has no synchronization issues */
-                case 0:
-                        if (*buf == 0)
-                                continue;
-                        break;
-                /* mod63 stays in sync with short-terminated transfers,
-                 * or otherwise when host and gadget agree on how large
-                 * each usb transfer request should be.  resync is done
-                 * with set_interface or set_config.
-                 */
-                case 1:
-                        if (*buf == (u8)(i % 63))
-                                continue;
-                        break;
-                }
-                ERROR(dev, "bad OUT byte, buf[%d] = %d\n", i, *buf);
-                usb_ep_set_halt(ep);
-                return -EINVAL;
+        int                     value;
+
+        if (ep->driver_data) {
+                value = usb_ep_disable(ep);
+                if (value < 0)
+                        DBG(cdev, "disable %s --> %d\n",
+                                        ep->name, value);
+                ep->driver_data = NULL;
         }
-        return 0;
 }
 
-static void reinit_write_data(struct usb_ep *ep, struct usb_request *req)
+void disable_endpoints(struct usb_composite_dev *cdev,
+                struct usb_ep *in, struct usb_ep *out)
 {
-        unsigned        i;
-        u8              *buf = req->buf;
-
-        switch (pattern) {
-        case 0:
-                memset(req->buf, 0, req->length);
-                break;
-        case 1:
-                for  (i = 0; i < req->length; i++)
-                        *buf++ = (u8) (i % 63);
-                break;
-        }
-}
-
-/* if there is only one request in the queue, there'll always be an
- * irq delay between end of one request and start of the next.
- * that prevents using hardware dma queues.
- */
-static void source_sink_complete(struct usb_ep *ep, struct usb_request *req)
-{
-        struct zero_dev *dev = ep->driver_data;
-        int             status = req->status;
-
-        switch (status) {
-
-        case 0:                         /* normal completion? */
-                if (ep == dev->out_ep) {
-                        check_read_data(dev, ep, req);
-                        memset(req->buf, 0x55, req->length);
-                } else
-                        reinit_write_data(ep, req);
-                break;
-
-        /* this endpoint is normally active while we're configured */
-        case -ECONNABORTED:             /* hardware forced ep reset */
-        case -ECONNRESET:               /* request dequeued */
-        case -ESHUTDOWN:                /* disconnect from host */
-                VDBG(dev, "%s gone (%d), %d/%d\n", ep->name, status,
-                                req->actual, req->length);
-                if (ep == dev->out_ep)
-                        check_read_data(dev, ep, req);
-                free_ep_req(ep, req);
-                return;
-
-        case -EOVERFLOW:                /* buffer overrun on read means that
-                                         * we didn't provide a big enough
-                                         * buffer.
-                                         */
-        default:
-#if 1
-                DBG(dev, "%s complete --> %d, %d/%d\n", ep->name,
-                                status, req->actual, req->length);
-#endif
-        case -EREMOTEIO:                /* short read */
-                break;
-        }
-
-        status = usb_ep_queue(ep, req, GFP_ATOMIC);
-        if (status) {
-                ERROR(dev, "kill %s:  resubmit %d bytes --> %d\n",
-                                ep->name, req->length, status);
-                usb_ep_set_halt(ep);
-                /* FIXME recover later ... somehow */
-        }
-}
-
-static struct usb_request *source_sink_start_ep(struct usb_ep *ep)
-{
-        struct usb_request      *req;
-        int                     status;
-
-        req = alloc_ep_req(ep, buflen);
-        if (!req)
-                return NULL;
-
-        memset(req->buf, 0, req->length);
-        req->complete = source_sink_complete;
-
-        if (strcmp(ep->name, EP_IN_NAME) == 0)
-                reinit_write_data(ep, req);
-        else
-                memset(req->buf, 0x55, req->length);
-
-        status = usb_ep_queue(ep, req, GFP_ATOMIC);
-        if (status) {
-                struct zero_dev *dev = ep->driver_data;
-
-                ERROR(dev, "start %s --> %d\n", ep->name, status);
-                free_ep_req(ep, req);
-                req = NULL;
-        }
-
-        return req;
-}
-
-static int set_source_sink_config(struct zero_dev *dev)
-{
-        int                     result = 0;
-        struct usb_ep           *ep;
-        struct usb_gadget       *gadget = dev->gadget;
-
-        gadget_for_each_ep(ep, gadget) {
-                const struct usb_endpoint_descriptor    *d;
-
-                /* one endpoint writes (sources) zeroes in (to the host) */
-                if (strcmp(ep->name, EP_IN_NAME) == 0) {
-                        d = ep_desc(gadget, &hs_source_desc, &fs_source_desc);
-                        result = usb_ep_enable(ep, d);
-                        if (result == 0) {
-                                ep->driver_data = dev;
-                                if (source_sink_start_ep(ep) != NULL) {
-                                        dev->in_ep = ep;
-                                        continue;
-                                }
-                                usb_ep_disable(ep);
-                                result = -EIO;
-                        }
-
-                /* one endpoint reads (sinks) anything out (from the host) */
-                } else if (strcmp(ep->name, EP_OUT_NAME) == 0) {
-                        d = ep_desc(gadget, &hs_sink_desc, &fs_sink_desc);
-                        result = usb_ep_enable(ep, d);
-                        if (result == 0) {
-                                ep->driver_data = dev;
-                                if (source_sink_start_ep(ep) != NULL) {
-                                        dev->out_ep = ep;
-                                        continue;
-                                }
-                                usb_ep_disable(ep);
-                                result = -EIO;
-                        }
-
-                /* ignore any other endpoints */
-                } else
-                        continue;
-
-                /* stop on error */
-                ERROR(dev, "can't start %s, result %d\n", ep->name, result);
-                break;
-        }
-        if (result == 0)
-                DBG(dev, "buflen %d\n", buflen);
-
-        /* caller is responsible for cleanup on error */
-        return result;
-}
-
-/*-------------------------------------------------------------------------*/
-
-static void loopback_complete(struct usb_ep *ep, struct usb_request *req)
-{
-        struct zero_dev *dev = ep->driver_data;
-        int             status = req->status;
-
-        switch (status) {
-
-        case 0:                         /* normal completion? */
-                if (ep == dev->out_ep) {
-                        /* loop this OUT packet back IN to the host */
-                        req->zero = (req->actual < req->length);
-                        req->length = req->actual;
-                        status = usb_ep_queue(dev->in_ep, req, GFP_ATOMIC);
-                        if (status == 0)
-                                return;
-
-                        /* "should never get here" */
-                        ERROR(dev, "can't loop %s to %s: %d\n",
-                                ep->name, dev->in_ep->name,
-                                status);
-                }
-
-                /* queue the buffer for some later OUT packet */
-                req->length = buflen;
-                status = usb_ep_queue(dev->out_ep, req, GFP_ATOMIC);
-                if (status == 0)
-                        return;
-
-                /* "should never get here" */
-                /* FALLTHROUGH */
-
-        default:
-                ERROR(dev, "%s loop complete --> %d, %d/%d\n", ep->name,
-                                status, req->actual, req->length);
-                /* FALLTHROUGH */
-
-        /* NOTE:  since this driver doesn't maintain an explicit record
-         * of requests it submitted (just maintains qlen count), we
-         * rely on the hardware driver to clean up on disconnect or
-         * endpoint disable.
-         */
-        case -ECONNABORTED:             /* hardware forced ep reset */
-        case -ECONNRESET:               /* request dequeued */
-        case -ESHUTDOWN:                /* disconnect from host */
-                free_ep_req(ep, req);
-                return;
-        }
-}
-
-static int set_loopback_config(struct zero_dev *dev)
-{
-        int                     result = 0;
-        struct usb_ep           *ep;
-        struct usb_gadget       *gadget = dev->gadget;
-
-        gadget_for_each_ep(ep, gadget) {
-                const struct usb_endpoint_descriptor    *d;
-
-                /* one endpoint writes data back IN to the host */
-                if (strcmp(ep->name, EP_IN_NAME) == 0) {
-                        d = ep_desc(gadget, &hs_source_desc, &fs_source_desc);
-                        result = usb_ep_enable(ep, d);
-                        if (result == 0) {
-                                ep->driver_data = dev;
-                                dev->in_ep = ep;
-                                continue;
-                        }
-
-                /* one endpoint just reads OUT packets */
-                } else if (strcmp(ep->name, EP_OUT_NAME) == 0) {
-                        d = ep_desc(gadget, &hs_sink_desc, &fs_sink_desc);
-                        result = usb_ep_enable(ep, d);
-                        if (result == 0) {
-                                ep->driver_data = dev;
-                                dev->out_ep = ep;
-                                continue;
-                        }
-
-                /* ignore any other endpoints */
-                } else
-                        continue;
-
-                /* stop on error */
-                ERROR(dev, "can't enable %s, result %d\n", ep->name, result);
-                break;
-        }
-
-        /* allocate a bunch of read buffers and queue them all at once.
-         * we buffer at most 'qlen' transfers; fewer if any need more
-         * than 'buflen' bytes each.
-         */
-        if (result == 0) {
-                struct usb_request      *req;
-                unsigned                i;
-
-                ep = dev->out_ep;
-                for (i = 0; i < qlen && result == 0; i++) {
-                        req = alloc_ep_req(ep, buflen);
-                        if (req) {
-                                req->complete = loopback_complete;
-                                result = usb_ep_queue(ep, req, GFP_ATOMIC);
-                                if (result)
-                                        DBG(dev, "%s queue req --> %d\n",
-                                                        ep->name, result);
-                        } else
-                                result = -ENOMEM;
-                }
-        }
-        if (result == 0)
-                DBG(dev, "qlen %d, buflen %d\n", qlen, buflen);
-
-        /* caller is responsible for cleanup on error */
-        return result;
-}
-
-/*-------------------------------------------------------------------------*/
-
-static void zero_reset_config(struct zero_dev *dev)
-{
-        if (dev->config == 0)
-                return;
-
-        DBG(dev, "reset config\n");
-
-        /* just disable endpoints, forcing completion of pending i/o.
-         * all our completion handlers free their requests in this case.
-         */
-        if (dev->in_ep) {
-                usb_ep_disable(dev->in_ep);
-                dev->in_ep = NULL;
-        }
-        if (dev->out_ep) {
-                usb_ep_disable(dev->out_ep);
-                dev->out_ep = NULL;
-        }
-        dev->config = 0;
-        del_timer(&dev->resume);
-}
-
-/* change our operational config.  this code must agree with the code
- * that returns config descriptors, and altsetting code.
- *
- * it's also responsible for power management interactions. some
- * configurations might not work with our current power sources.
- *
- * note that some device controller hardware will constrain what this
- * code can do, perhaps by disallowing more than one configuration or
- * by limiting configuration choices (like the pxa2xx).
- */
-static int zero_set_config(struct zero_dev *dev, unsigned number)
-{
-        int                     result = 0;
-        struct usb_gadget       *gadget = dev->gadget;
-
-        if (number == dev->config)
-                return 0;
-
-        if (gadget_is_sa1100(gadget) && dev->config) {
-                /* tx fifo is full, but we can't clear it...*/
-                ERROR(dev, "can't change configurations\n");
-                return -ESPIPE;
-        }
-        zero_reset_config(dev);
-
-        switch (number) {
-        case CONFIG_SOURCE_SINK:
-                result = set_source_sink_config(dev);
-                break;
-        case CONFIG_LOOPBACK:
-                result = set_loopback_config(dev);
-                break;
-        default:
-                result = -EINVAL;
-                /* FALL THROUGH */
-        case 0:
-                return result;
-        }
-
-        if (!result && (!dev->in_ep || !dev->out_ep))
-                result = -ENODEV;
-        if (result)
-                zero_reset_config(dev);
-        else {
-                char *speed;
-
-                switch (gadget->speed) {
-                case USB_SPEED_LOW:     speed = "low"; break;
-                case USB_SPEED_FULL:    speed = "full"; break;
-                case USB_SPEED_HIGH:    speed = "high"; break;
-                default:                speed = "?"; break;
-                }
-
-                dev->config = number;
-                INFO(dev, "%s speed config #%d: %s\n", speed, number,
-                                (number == CONFIG_SOURCE_SINK)
-                                        ? source_sink : loopback);
-        }
-        return result;
-}
-
-/*-------------------------------------------------------------------------*/
-
-static void zero_setup_complete(struct usb_ep *ep, struct usb_request *req)
-{
-        if (req->status || req->actual != req->length)
-                DBG((struct zero_dev *) ep->driver_data,
-                                "setup complete --> %d, %d/%d\n",
-                                req->status, req->actual, req->length);
-}
-
-/*
- * The setup() callback implements all the ep0 functionality that's
- * not handled lower down, in hardware or the hardware driver (like
- * device and endpoint feature flags, and their status).  It's all
- * housekeeping for the gadget function we're implementing.  Most of
- * the work is in config-specific setup.
- */
-static int
-zero_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
-{
-        struct zero_dev         *dev = get_gadget_data(gadget);
-        struct usb_request      *req = dev->req;
-        int                     value = -EOPNOTSUPP;
-        u16                     w_index = le16_to_cpu(ctrl->wIndex);
-        u16                     w_value = le16_to_cpu(ctrl->wValue);
-        u16                     w_length = le16_to_cpu(ctrl->wLength);
-
-        /* usually this stores reply data in the pre-allocated ep0 buffer,
-         * but config change events will reconfigure hardware.
-         */
-        req->zero = 0;
-        switch (ctrl->bRequest) {
-
-        case USB_REQ_GET_DESCRIPTOR:
-                if (ctrl->bRequestType != USB_DIR_IN)
-                        goto unknown;
-                switch (w_value >> 8) {
-
-                case USB_DT_DEVICE:
-                        value = min(w_length, (u16) sizeof device_desc);
-                        memcpy(req->buf, &device_desc, value);
-                        break;
-                case USB_DT_DEVICE_QUALIFIER:
-                        if (!gadget_is_dualspeed(gadget))
-                                break;
-                        value = min(w_length, (u16) sizeof dev_qualifier);
-                        memcpy(req->buf, &dev_qualifier, value);
-                        break;
-
-                case USB_DT_OTHER_SPEED_CONFIG:
-                        if (!gadget_is_dualspeed(gadget))
-                                break;
-                        // FALLTHROUGH
-                case USB_DT_CONFIG:
-                        value = config_buf(gadget, req->buf,
-                                        w_value >> 8,
-                                        w_value & 0xff);
-                        if (value >= 0)
-                                value = min(w_length, (u16) value);
-                        break;
-
-                case USB_DT_STRING:
-                        /* wIndex == language code.
-                         * this driver only handles one language, you can
-                         * add string tables for other languages, using
-                         * any UTF-8 characters
-                         */
-                        value = usb_gadget_get_string(&stringtab,
-                                        w_value & 0xff, req->buf);
-                        if (value >= 0)
-                                value = min(w_length, (u16) value);
-                        break;
-                }
-                break;
-
-        /* currently two configs, two speeds */
-        case USB_REQ_SET_CONFIGURATION:
-                if (ctrl->bRequestType != 0)
-                        goto unknown;
-                if (gadget->a_hnp_support)
-                        DBG(dev, "HNP available\n");
-                else if (gadget->a_alt_hnp_support)
-                        DBG(dev, "HNP needs a different root port\n");
-                else
-                        VDBG(dev, "HNP inactive\n");
-                spin_lock(&dev->lock);
-                value = zero_set_config(dev, w_value);
-                spin_unlock(&dev->lock);
-                break;
-        case USB_REQ_GET_CONFIGURATION:
-                if (ctrl->bRequestType != USB_DIR_IN)
-                        goto unknown;
-                *(u8 *)req->buf = dev->config;
-                value = min(w_length, (u16) 1);
-                break;
-
-        /* until we add altsetting support, or other interfaces,
-         * only 0/0 are possible.  pxa2xx only supports 0/0 (poorly)
-         * and already killed pending endpoint I/O.
-         */
-        case USB_REQ_SET_INTERFACE:
-                if (ctrl->bRequestType != USB_RECIP_INTERFACE)
-                        goto unknown;
-                spin_lock(&dev->lock);
-                if (dev->config && w_index == 0 && w_value == 0) {
-                        u8              config = dev->config;
-
-                        /* resets interface configuration, forgets about
-                         * previous transaction state (queued bufs, etc)
-                         * and re-inits endpoint state (toggle etc)
-                         * no response queued, just zero status == success.
-                         * if we had more than one interface we couldn't
-                         * use this "reset the config" shortcut.
-                         */
-                        zero_reset_config(dev);
-                        zero_set_config(dev, config);
-                        value = 0;
-                }
-                spin_unlock(&dev->lock);
-                break;
-        case USB_REQ_GET_INTERFACE:
-                if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE))
-                        goto unknown;
-                if (!dev->config)
-                        break;
-                if (w_index != 0) {
-                        value = -EDOM;
-                        break;
-                }
-                *(u8 *)req->buf = 0;
-                value = min(w_length, (u16) 1);
-                break;
-
-        /*
-         * These are the same vendor-specific requests supported by
-         * Intel's USB 2.0 compliance test devices.  We exceed that
-         * device spec by allowing multiple-packet requests.
-         */
-        case 0x5b:      /* control WRITE test -- fill the buffer */
-                if (ctrl->bRequestType != (USB_DIR_OUT|USB_TYPE_VENDOR))
-                        goto unknown;
-                if (w_value || w_index)
-                        break;
-                /* just read that many bytes into the buffer */
-                if (w_length > USB_BUFSIZ)
-                        break;
-                value = w_length;
-                break;
-        case 0x5c:      /* control READ test -- return the buffer */
-                if (ctrl->bRequestType != (USB_DIR_IN|USB_TYPE_VENDOR))
-                        goto unknown;
-                if (w_value || w_index)
-                        break;
-                /* expect those bytes are still in the buffer; send back */
-                if (w_length > USB_BUFSIZ
-                                || w_length != req->length)
-                        break;
-                value = w_length;
-                break;
-
-        default:
-unknown:
-                VDBG(dev,
-                        "unknown control req%02x.%02x v%04x i%04x l%d\n",
-                        ctrl->bRequestType, ctrl->bRequest,
-                        w_value, w_index, w_length);
-        }
-
-        /* respond with data transfer before status phase? */
-        if (value >= 0) {
-                req->length = value;
-                req->zero = value < w_length;
-                value = usb_ep_queue(gadget->ep0, req, GFP_ATOMIC);
-                if (value < 0) {
-                        DBG(dev, "ep_queue --> %d\n", value);
-                        req->status = 0;
-                        zero_setup_complete(gadget->ep0, req);
-                }
-        }
-
-        /* device either stalls (value < 0) or reports success */
-        return value;
-}
-
-static void zero_disconnect(struct usb_gadget *gadget)
-{
-        struct zero_dev         *dev = get_gadget_data(gadget);
-        unsigned long           flags;
-
-        spin_lock_irqsave(&dev->lock, flags);
-        zero_reset_config(dev);
-
-        /* a more significant application might have some non-usb
-         * activities to quiesce here, saving resources like power
-         * or pushing the notification up a network stack.
-         */
-        spin_unlock_irqrestore(&dev->lock, flags);
-
-        /* next we may get setup() calls to enumerate new connections;
-         * or an unbind() during shutdown (including removing module).
-         */
-}
-
-static void zero_autoresume(unsigned long _dev)
-{
-        struct zero_dev *dev = (struct zero_dev *) _dev;
-        int             status;
-
-        /* normally the host would be woken up for something
-         * more significant than just a timer firing...
-         */
-        if (dev->gadget->speed != USB_SPEED_UNKNOWN) {
-                status = usb_gadget_wakeup(dev->gadget);
-                DBG(dev, "wakeup --> %d\n", status);
-        }
+        disable_ep(cdev, in);
+        disable_ep(cdev, out);
 }
 
 /*-------------------------------------------------------------------------*/
 
-static void zero_unbind(struct usb_gadget *gadget)
+static int __init zero_bind(struct usb_composite_dev *cdev)
 {
-        struct zero_dev         *dev = get_gadget_data(gadget);
-
-        DBG(dev, "unbind\n");
-
-        /* we've already been disconnected ... no i/o is active */
-        if (dev->req) {
-                dev->req->length = USB_BUFSIZ;
-                free_ep_req(gadget->ep0, dev->req);
-        }
-        del_timer_sync(&dev->resume);
-        kfree(dev);
-        set_gadget_data(gadget, NULL);
-}
-
-static int __init zero_bind(struct usb_gadget *gadget)
-{
-        struct zero_dev         *dev;
-        struct usb_ep           *ep;
         int                     gcnum;
+        struct usb_gadget       *gadget = cdev->gadget;
+        int                     id;
 
-        /* FIXME this can't yet work right with SH ... it has only
-         * one configuration, numbered one.
+        /* Allocate string descriptor numbers ... note that string
+         * contents can be overridden by the composite_dev glue.
          */
-        if (gadget_is_sh(gadget))
-                return -ENODEV;
-
-        /* Bulk-only drivers like this one SHOULD be able to
-         * autoconfigure on any sane usb controller driver,
-         * but there may also be important quirks to address.
+        id = usb_string_id(cdev);
+        if (id < 0)
+                return id;
+        strings_dev[STRING_MANUFACTURER_IDX].id = id;
+        device_desc.iManufacturer = id;
+
+        id = usb_string_id(cdev);
+        if (id < 0)
+                return id;
+        strings_dev[STRING_PRODUCT_IDX].id = id;
+        device_desc.iProduct = id;
+
+        id = usb_string_id(cdev);
+        if (id < 0)
+                return id;
+        strings_dev[STRING_SERIAL_IDX].id = id;
+        device_desc.iSerialNumber = id;
+
+        /* Register primary, then secondary configuration.  Note that
+         * SH3 only allows one config...
          */
-        usb_ep_autoconfig_reset(gadget);
-        ep = usb_ep_autoconfig(gadget, &fs_source_desc);
-        if (!ep) {
-autoconf_fail:
-                pr_err("%s: can't autoconfigure on %s\n",
-                        shortname, gadget->name);
-                return -ENODEV;
+        if (loopdefault) {
+                loopback_add(cdev);
+                if (!gadget_is_sh(gadget))
+                        sourcesink_add(cdev);
+        } else {
+                sourcesink_add(cdev);
+                if (!gadget_is_sh(gadget))
+                        loopback_add(cdev);
         }
-        EP_IN_NAME = ep->name;
-        ep->driver_data = ep;   /* claim */
-
-        ep = usb_ep_autoconfig(gadget, &fs_sink_desc);
-        if (!ep)
-                goto autoconf_fail;
-        EP_OUT_NAME = ep->name;
-        ep->driver_data = ep;   /* claim */
 
         gcnum = usb_gadget_controller_number(gadget);
         if (gcnum >= 0)
@@ -1115,144 +241,44 @@ autoconf_fail:
         else {
                 /* gadget zero is so simple (for now, no altsettings) that
                  * it SHOULD NOT have problems with bulk-capable hardware.
-                 * so warn about unrcognized controllers, don't panic.
+                 * so just warn about unrcognized controllers -- don't panic.
                  *
                  * things like configuration and altsetting numbering
                  * can need hardware-specific attention though.
                  */
                 pr_warning("%s: controller '%s' not recognized\n",
-                        shortname, gadget->name);
+                        longname, gadget->name);
                 device_desc.bcdDevice = __constant_cpu_to_le16(0x9999);
         }
 
 
-        /* ok, we made sense of the hardware ... */
-        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
-        if (!dev)
-                return -ENOMEM;
-        spin_lock_init(&dev->lock);
-        dev->gadget = gadget;
-        set_gadget_data(gadget, dev);
-
-        init_timer(&dev->resume);
-        dev->resume.function = zero_autoresume;
-        dev->resume.data = (unsigned long) dev;
-
-        /* preallocate control response and buffer */
-        dev->req = usb_ep_alloc_request(gadget->ep0, GFP_KERNEL);
-        if (!dev->req)
-                goto enomem;
-        dev->req->buf = kmalloc(USB_BUFSIZ, GFP_KERNEL);
-        if (!dev->req->buf)
-                goto enomem;
-
-        dev->req->complete = zero_setup_complete;
-
-        device_desc.bMaxPacketSize0 = gadget->ep0->maxpacket;
-
-        if (gadget_is_dualspeed(gadget)) {
-                /* assume ep0 uses the same value for both speeds ... */
-                dev_qualifier.bMaxPacketSize0 = device_desc.bMaxPacketSize0;
-
-                /* and that all endpoints are dual-speed */
-                hs_source_desc.bEndpointAddress =
-                                fs_source_desc.bEndpointAddress;
-                hs_sink_desc.bEndpointAddress =
-                                fs_sink_desc.bEndpointAddress;
-        }
-
-        if (gadget_is_otg(gadget)) {
-                otg_descriptor.bmAttributes |= USB_OTG_HNP,
-                source_sink_config.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
-                loopback_config.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
-        }
-
-        usb_gadget_set_selfpowered(gadget);
-
-        if (autoresume) {
-                source_sink_config.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
-                loopback_config.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
-        }
-
-        gadget->ep0->driver_data = dev;
-
-        INFO(dev, "%s, version: " DRIVER_VERSION "\n", longname);
-        INFO(dev, "using %s, OUT %s IN %s\n", gadget->name,
-                EP_OUT_NAME, EP_IN_NAME);
+        INFO(cdev, "%s, version: " DRIVER_VERSION "\n", longname);
 
         snprintf(manufacturer, sizeof manufacturer, "%s %s with %s",
                 init_utsname()->sysname, init_utsname()->release,
                 gadget->name);
 
         return 0;
-
-enomem:
-        zero_unbind(gadget);
-        return -ENOMEM;
 }
 
-/*-------------------------------------------------------------------------*/
-
-static void zero_suspend(struct usb_gadget *gadget)
-{
-        struct zero_dev         *dev = get_gadget_data(gadget);
-
-        if (gadget->speed == USB_SPEED_UNKNOWN)
-                return;
-
-        if (autoresume) {
-                mod_timer(&dev->resume, jiffies + (HZ * autoresume));
-                DBG(dev, "suspend, wakeup in %d seconds\n", autoresume);
-        } else
-                DBG(dev, "suspend\n");
-}
-
-static void zero_resume(struct usb_gadget *gadget)
-{
-        struct zero_dev         *dev = get_gadget_data(gadget);
-
-        DBG(dev, "resume\n");
-        del_timer(&dev->resume);
-}
-
-
-/*-------------------------------------------------------------------------*/
-
-static struct usb_gadget_driver zero_driver = {
-#ifdef CONFIG_USB_GADGET_DUALSPEED
-        .speed          = USB_SPEED_HIGH,
-#else
-        .speed          = USB_SPEED_FULL,
-#endif
-        .function       = (char *) longname,
+static struct usb_composite_driver zero_driver = {
+        .name           = "zero",
+        .dev            = &device_desc,
+        .strings        = dev_strings,
         .bind           = zero_bind,
-        .unbind         = __exit_p(zero_unbind),
-
-        .setup          = zero_setup,
-        .disconnect     = zero_disconnect,
-
-        .suspend        = zero_suspend,
-        .resume         = zero_resume,
-
-        .driver         = {
-                .name           = (char *) shortname,
-                .owner          = THIS_MODULE,
-        },
 };
 
 MODULE_AUTHOR("David Brownell");
 MODULE_LICENSE("GPL");
 
-
 static int __init init(void)
 {
-        return usb_gadget_register_driver(&zero_driver);
+        return usb_composite_register(&zero_driver);
 }
 module_init(init);
 
 static void __exit cleanup(void)
 {
-        usb_gadget_unregister_driver(&zero_driver);
+        usb_composite_unregister(&zero_driver);
 }
 module_exit(cleanup);
-