77 files changed, 15244 insertions, 5312 deletions

diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index cd27f9bde2c8..029e288805b6 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -158,6 +158,7 @@ config USB_GADGET_FSL_USB2
         boolean "Freescale Highspeed USB DR Peripheral Controller"
         depends on FSL_SOC || ARCH_MXC
         select USB_GADGET_DUALSPEED
+        select USB_FSL_MPH_DR_OF if OF
         help
            Some of Freescale PowerPC processors have a High Speed
            Dual-Role(DR) USB controller, which supports device mode.
@@ -175,15 +176,15 @@ config USB_FSL_USB2
         default USB_GADGET
         select USB_GADGET_SELECTED
 
-config USB_GADGET_LH7A40X
-        boolean "LH7A40X"
-        depends on ARCH_LH7A40X
+config USB_GADGET_FUSB300
+        boolean "Faraday FUSB300 USB Peripheral Controller"
+        select USB_GADGET_DUALSPEED
         help
-           This driver provides USB Device Controller driver for LH7A40x
+           Faraday usb device controller FUSB300 driver
 
-config USB_LH7A40X
+config USB_FUSB300
         tristate
-        depends on USB_GADGET_LH7A40X
+        depends on USB_GADGET_FUSB300
         default USB_GADGET
         select USB_GADGET_SELECTED
 
@@ -209,17 +210,6 @@ config USB_OMAP
         default USB_GADGET
         select USB_GADGET_SELECTED
 
-config USB_OTG
-        boolean "OTG Support"
-        depends on USB_GADGET_OMAP && ARCH_OMAP_OTG && USB_OHCI_HCD
-        help
-           The most notable feature of USB OTG is support for a
-           "Dual-Role" device, which can act as either a device
-           or a host.  The initial role choice can be changed
-           later, when two dual-role devices talk to each other.
-
-           Select this only if your OMAP board has a Mini-AB connector.
-
 config USB_GADGET_PXA25X
         boolean "PXA 25x or IXP 4xx"
         depends on (ARCH_PXA && PXA25x) || ARCH_IXP4XX
@@ -270,6 +260,24 @@ config USB_R8A66597
         default USB_GADGET
         select USB_GADGET_SELECTED
 
+config USB_GADGET_RENESAS_USBHS
+        boolean "Renesas USBHS"
+        depends on USB_RENESAS_USBHS
+        select USB_GADGET_DUALSPEED
+        help
+           Renesas USBHS is a discrete USB host and peripheral controller
+           chip that supports both full and high speed USB 2.0 data transfers.
+           platform is able to configure endpoint (pipe) style
+
+           Say "y" to enable the gadget specific portion of the USBHS driver.
+
+
+config USB_RENESAS_USBHS_UDC
+        tristate
+        depends on USB_GADGET_RENESAS_USBHS
+        default USB_GADGET
+        select USB_GADGET_SELECTED
+
 config USB_GADGET_PXA27X
         boolean "PXA 27x"
         depends on ARCH_PXA && (PXA27x || PXA3xx)
@@ -348,6 +356,36 @@ config USB_S3C2410_DEBUG
         boolean "S3C2410 udc debug messages"
         depends on USB_GADGET_S3C2410
 
+config USB_GADGET_S3C_HSUDC
+        boolean "S3C2416, S3C2443 and S3C2450 USB Device Controller"
+        depends on ARCH_S3C2410
+        select USB_GADGET_DUALSPEED
+        help
+          Samsung's S3C2416, S3C2443 and S3C2450 is an ARM9 based SoC
+          integrated with dual speed USB 2.0 device controller. It has
+          8 endpoints, as well as endpoint zero.
+
+          This driver has been tested on S3C2416 and S3C2450 processors.
+
+config USB_S3C_HSUDC
+        tristate
+        depends on USB_GADGET_S3C_HSUDC
+        default USB_GADGET
+        select USB_GADGET_SELECTED
+
+config USB_GADGET_PXA_U2O
+        boolean "PXA9xx Processor USB2.0 controller"
+        select USB_GADGET_DUALSPEED
+        help
+          PXA9xx Processor series include a high speed USB2.0 device
+          controller, which support high speed and full speed USB peripheral.
+
+config USB_PXA_U2O
+        tristate
+        depends on USB_GADGET_PXA_U2O
+        default USB_GADGET
+        select USB_GADGET_SELECTED
+
 #
 # Controllers available in both integrated and discrete versions
 #
@@ -424,8 +462,8 @@ config USB_FSL_QE
         default USB_GADGET
         select USB_GADGET_SELECTED
 
-config USB_GADGET_CI13XXX
-        boolean "MIPS USB CI13xxx"
+config USB_GADGET_CI13XXX_PCI
+        boolean "MIPS USB CI13xxx PCI UDC"
         depends on PCI
         select USB_GADGET_DUALSPEED
         help
@@ -436,9 +474,9 @@ config USB_GADGET_CI13XXX
           dynamically linked module called "ci13xxx_udc" and force all
           gadget drivers to also be dynamically linked.
 
-config USB_CI13XXX
+config USB_CI13XXX_PCI
         tristate
-        depends on USB_GADGET_CI13XXX
+        depends on USB_GADGET_CI13XXX_PCI
         default USB_GADGET
         select USB_GADGET_SELECTED
 
@@ -505,6 +543,56 @@ config USB_LANGWELL
         default USB_GADGET
         select USB_GADGET_SELECTED
 
+config USB_GADGET_EG20T
+        boolean "Intel EG20T PCH/OKI SEMICONDUCTOR ML7213 IOH UDC"
+        depends on PCI
+        select USB_GADGET_DUALSPEED
+        help
+          This is a USB device driver for EG20T PCH.
+          EG20T PCH is the platform controller hub that is used in Intel's
+          general embedded platform. EG20T PCH has USB device interface.
+          Using this interface, it is able to access system devices connected
+          to USB device.
+          This driver enables USB device function.
+          USB device is a USB peripheral controller which
+          supports both full and high speed USB 2.0 data transfers.
+          This driver supports both control transfer and bulk transfer modes.
+          This driver dose not support interrupt transfer or isochronous
+          transfer modes.
+
+          This driver also can be used for OKI SEMICONDUCTOR's ML7213 which is
+          for IVI(In-Vehicle Infotainment) use.
+          ML7213 is companion chip for Intel Atom E6xx series.
+          ML7213 is completely compatible for Intel EG20T PCH.
+
+config USB_EG20T
+        tristate
+        depends on USB_GADGET_EG20T
+        default USB_GADGET
+        select USB_GADGET_SELECTED
+
+config USB_GADGET_CI13XXX_MSM
+        boolean "MIPS USB CI13xxx for MSM"
+        depends on ARCH_MSM
+        select USB_GADGET_DUALSPEED
+        select USB_MSM_OTG
+        help
+          MSM SoC has chipidea USB controller.  This driver uses
+          ci13xxx_udc core.
+          This driver depends on OTG driver for PHY initialization,
+          clock management, powering up VBUS, and power management.
+          This driver is not supported on boards like trout which
+          has an external PHY.
+
+          Say "y" to link the driver statically, or "m" to build a
+          dynamically linked module called "ci13xxx_msm" and force all
+          gadget drivers to also be dynamically linked.
+
+config USB_CI13XXX_MSM
+        tristate
+        depends on USB_GADGET_CI13XXX_MSM
+        default USB_GADGET
+        select USB_GADGET_SELECTED
 
 #
 # LAST -- dummy/emulated controller
@@ -544,13 +632,10 @@ config USB_DUMMY_HCD
 
 endchoice
 
+# Selected by UDC drivers that support high-speed operation.
 config USB_GADGET_DUALSPEED
         bool
         depends on USB_GADGET
-        default n
-        help
-          Means that gadget drivers should include extra descriptors
-          and code to handle dual-speed controllers.
 
 #
 # USB Gadget Drivers
@@ -695,6 +780,19 @@ config USB_ETH_EEM
          If you say "y" here, the Ethernet gadget driver will use the EEM
          protocol rather than ECM.  If unsure, say "n".
 
+config USB_G_NCM
+        tristate "Network Control Model (NCM) support"
+        depends on NET
+        select CRC32
+        help
+          This driver implements USB CDC NCM subclass standard. NCM is
+          an advanced protocol for Ethernet encapsulation, allows grouping
+          of several ethernet frames into one USB transfer and diffferent
+          alignment possibilities.
+
+          Say "y" to link the driver statically, or "m" to build a
+          dynamically linked module called "g_ncm".
+
 config USB_GADGETFS
         tristate "Gadget Filesystem (EXPERIMENTAL)"
         depends on EXPERIMENTAL
@@ -716,8 +814,8 @@ config USB_FUNCTIONFS
         depends on EXPERIMENTAL
         select USB_FUNCTIONFS_GENERIC if !(USB_FUNCTIONFS_ETH || USB_FUNCTIONFS_RNDIS)
         help
-          The Function Filesystem (FunctioFS) lets one create USB
-          composite functions in user space in the same way as GadgetFS
+          The Function Filesystem (FunctionFS) lets one create USB
+          composite functions in user space in the same way GadgetFS
           lets one create USB gadgets in user space.  This allows creation
           of composite gadgets such that some of the functions are
           implemented in kernel space (for instance Ethernet, serial or
@@ -733,14 +831,14 @@ config USB_FUNCTIONFS_ETH
         bool "Include configuration with CDC ECM (Ethernet)"
         depends on USB_FUNCTIONFS && NET
         help
-          Include a configuration with CDC ECM funcion (Ethernet) and the
-          Funcion Filesystem.
+          Include a configuration with CDC ECM function (Ethernet) and the
+          Function Filesystem.
 
 config USB_FUNCTIONFS_RNDIS
         bool "Include configuration with RNDIS (Ethernet)"
         depends on USB_FUNCTIONFS && NET
         help
-          Include a configuration with RNDIS funcion (Ethernet) and the Filesystem.
+          Include a configuration with RNDIS function (Ethernet) and the Filesystem.
 
 config USB_FUNCTIONFS_GENERIC
         bool "Include 'pure' configuration"
diff --git a/drivers/usb/gadget/Makefile b/drivers/usb/gadget/Makefile
index 27283df37d09..4fe92b18a055 100644
--- a/drivers/usb/gadget/Makefile
+++ b/drivers/usb/gadget/Makefile
@@ -1,9 +1,7 @@
 #
 # USB peripheral controller drivers
 #
-ifeq ($(CONFIG_USB_GADGET_DEBUG),y)
-        EXTRA_CFLAGS            += -DDEBUG
-endif
+ccflags-$(CONFIG_USB_GADGET_DEBUG) := -DDEBUG
 
 obj-$(CONFIG_USB_DUMMY_HCD)     += dummy_hcd.o
 obj-$(CONFIG_USB_NET2280)       += net2280.o
@@ -13,40 +11,44 @@ obj-$(CONFIG_USB_PXA27X)	+= pxa27x_udc.o
 obj-$(CONFIG_USB_IMX)           += imx_udc.o
 obj-$(CONFIG_USB_GOKU)          += goku_udc.o
 obj-$(CONFIG_USB_OMAP)          += omap_udc.o
-obj-$(CONFIG_USB_LH7A40X)       += lh7a40x_udc.o
 obj-$(CONFIG_USB_S3C2410)       += s3c2410_udc.o
 obj-$(CONFIG_USB_AT91)          += at91_udc.o
 obj-$(CONFIG_USB_ATMEL_USBA)    += atmel_usba_udc.o
 obj-$(CONFIG_USB_FSL_USB2)      += fsl_usb2_udc.o
-fsl_usb2_udc-objs               := fsl_udc_core.o
-ifeq ($(CONFIG_ARCH_MXC),y)
-fsl_usb2_udc-objs               += fsl_mxc_udc.o
-endif
+fsl_usb2_udc-y                  := fsl_udc_core.o
+fsl_usb2_udc-$(CONFIG_ARCH_MXC) += fsl_mxc_udc.o
 obj-$(CONFIG_USB_M66592)        += m66592-udc.o
 obj-$(CONFIG_USB_R8A66597)      += r8a66597-udc.o
 obj-$(CONFIG_USB_FSL_QE)        += fsl_qe_udc.o
-obj-$(CONFIG_USB_CI13XXX)       += ci13xxx_udc.o
+obj-$(CONFIG_USB_CI13XXX_PCI)   += ci13xxx_pci.o
 obj-$(CONFIG_USB_S3C_HSOTG)     += s3c-hsotg.o
+obj-$(CONFIG_USB_S3C_HSUDC)     += s3c-hsudc.o
 obj-$(CONFIG_USB_LANGWELL)      += langwell_udc.o
+obj-$(CONFIG_USB_EG20T)         += pch_udc.o
+obj-$(CONFIG_USB_PXA_U2O)       += mv_udc.o
+mv_udc-y                        := mv_udc_core.o mv_udc_phy.o
+obj-$(CONFIG_USB_CI13XXX_MSM)   += ci13xxx_msm.o
+obj-$(CONFIG_USB_FUSB300)       += fusb300_udc.o
 
 #
 # USB gadget drivers
 #
-g_zero-objs                     := zero.o
-g_audio-objs                    := audio.o
-g_ether-objs                    := ether.o
-g_serial-objs                   := serial.o
-g_midi-objs                     := gmidi.o
-gadgetfs-objs                   := inode.o
-g_file_storage-objs             := file_storage.o
-g_mass_storage-objs             := mass_storage.o
-g_printer-objs                  := printer.o
-g_cdc-objs                      := cdc2.o
-g_multi-objs                    := multi.o
-g_hid-objs                      := hid.o
-g_dbgp-objs                     := dbgp.o
-g_nokia-objs                    := nokia.o
-g_webcam-objs                   := webcam.o
+g_zero-y                        := zero.o
+g_audio-y                       := audio.o
+g_ether-y                       := ether.o
+g_serial-y                      := serial.o
+g_midi-y                        := gmidi.o
+gadgetfs-y                      := inode.o
+g_file_storage-y                := file_storage.o
+g_mass_storage-y                := mass_storage.o
+g_printer-y                     := printer.o
+g_cdc-y                         := cdc2.o
+g_multi-y                       := multi.o
+g_hid-y                         := hid.o
+g_dbgp-y                        := dbgp.o
+g_nokia-y                       := nokia.o
+g_webcam-y                      := webcam.o
+g_ncm-y                         := ncm.o
 
 obj-$(CONFIG_USB_ZERO)          += g_zero.o
 obj-$(CONFIG_USB_AUDIO)         += g_audio.o
@@ -64,4 +66,4 @@ obj-$(CONFIG_USB_G_DBGP)	+= g_dbgp.o
 obj-$(CONFIG_USB_G_MULTI)       += g_multi.o
 obj-$(CONFIG_USB_G_NOKIA)       += g_nokia.o
 obj-$(CONFIG_USB_G_WEBCAM)      += g_webcam.o
-
+obj-$(CONFIG_USB_G_NCM)         += g_ncm.o
diff --git a/drivers/usb/gadget/amd5536udc.c b/drivers/usb/gadget/amd5536udc.c
index 731150d4b1d9..95e8138cd48f 100644
--- a/drivers/usb/gadget/amd5536udc.c
+++ b/drivers/usb/gadget/amd5536udc.c
@@ -60,6 +60,7 @@
 #include <linux/device.h>
 #include <linux/io.h>
 #include <linux/irq.h>
+#include <linux/prefetch.h>
 
 #include <asm/byteorder.h>
 #include <asm/system.h>
@@ -203,7 +204,7 @@ static void print_regs(struct udc *dev)
                 DBG(dev, "DMA mode       = PPBNDU (packet per buffer "
                         "WITHOUT desc. update)\n");
                 dev_info(&dev->pdev->dev, "DMA mode (%s)\n", "PPBNDU");
-        } else if (use_dma && use_dma_ppb_du && use_dma_ppb_du) {
+        } else if (use_dma && use_dma_ppb && use_dma_ppb_du) {
                 DBG(dev, "DMA mode       = PPBDU (packet per buffer "
                         "WITH desc. update)\n");
                 dev_info(&dev->pdev->dev, "DMA mode (%s)\n", "PPBDU");
@@ -278,7 +279,7 @@ static int udc_enable_dev_setup_interrupts(struct udc *dev)
         return 0;
 }
 
-/* Calculates fifo start of endpoint based on preceeding endpoints */
+/* Calculates fifo start of endpoint based on preceding endpoints */
 static int udc_set_txfifo_addr(struct udc_ep *ep)
 {
         struct udc      *dev;
@@ -1954,13 +1955,14 @@ static int setup_ep0(struct udc *dev)
 }
 
 /* Called by gadget driver to register itself */
-int usb_gadget_register_driver(struct usb_gadget_driver *driver)
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
 {
         struct udc              *dev = udc;
         int                     retval;
         u32 tmp;
 
-        if (!driver || !driver->bind || !driver->setup
+        if (!driver || !bind || !driver->setup
                         || driver->speed != USB_SPEED_HIGH)
                 return -EINVAL;
         if (!dev)
@@ -1972,7 +1974,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
         dev->driver = driver;
         dev->gadget.dev.driver = &driver->driver;
 
-        retval = driver->bind(&dev->gadget);
+        retval = bind(&dev->gadget);
 
         /* Some gadget drivers use both ep0 directions.
          * NOTE: to gadget driver, ep0 is just one endpoint...
@@ -2000,7 +2002,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
 
         return 0;
 }
-EXPORT_SYMBOL(usb_gadget_register_driver);
+EXPORT_SYMBOL(usb_gadget_probe_driver);
 
 /* shutdown requests and disconnect from gadget */
 static void
@@ -2136,7 +2138,7 @@ static irqreturn_t udc_data_out_isr(struct udc *dev, int ep_ix)
         if (use_dma) {
                 /* BNA event ? */
                 if (tmp & AMD_BIT(UDC_EPSTS_BNA)) {
-                        DBG(dev, "BNA ep%dout occured - DESPTR = %x \n",
+                        DBG(dev, "BNA ep%dout occurred - DESPTR = %x \n",
                                         ep->num, readl(&ep->regs->desptr));
                         /* clear BNA */
                         writel(tmp | AMD_BIT(UDC_EPSTS_BNA), &ep->regs->sts);
@@ -2150,7 +2152,7 @@ static irqreturn_t udc_data_out_isr(struct udc *dev, int ep_ix)
         }
         /* HE event ? */
         if (tmp & AMD_BIT(UDC_EPSTS_HE)) {
-                dev_err(&dev->pdev->dev, "HE ep%dout occured\n", ep->num);
+                dev_err(&dev->pdev->dev, "HE ep%dout occurred\n", ep->num);
 
                 /* clear HE */
                 writel(tmp | AMD_BIT(UDC_EPSTS_HE), &ep->regs->sts);
@@ -2353,7 +2355,7 @@ static irqreturn_t udc_data_in_isr(struct udc *dev, int ep_ix)
                 /* BNA ? */
                 if (epsts & AMD_BIT(UDC_EPSTS_BNA)) {
                         dev_err(&dev->pdev->dev,
-                                "BNA ep%din occured - DESPTR = %08lx \n",
+                                "BNA ep%din occurred - DESPTR = %08lx \n",
                                 ep->num,
                                 (unsigned long) readl(&ep->regs->desptr));
 
@@ -2366,7 +2368,7 @@ static irqreturn_t udc_data_in_isr(struct udc *dev, int ep_ix)
         /* HE event ? */
         if (epsts & AMD_BIT(UDC_EPSTS_HE)) {
                 dev_err(&dev->pdev->dev,
-                        "HE ep%dn occured - DESPTR = %08lx \n",
+                        "HE ep%dn occurred - DESPTR = %08lx \n",
                         ep->num, (unsigned long) readl(&ep->regs->desptr));
 
                 /* clear HE */
@@ -2383,7 +2385,7 @@ static irqreturn_t udc_data_in_isr(struct udc *dev, int ep_ix)
                         req = list_entry(ep->queue.next,
                                         struct udc_request, queue);
                         /*
-                         * length bytes transfered
+                         * length bytes transferred
                          * check dma done of last desc. in PPBDU mode
                          */
                         if (use_dma_ppb_du) {
@@ -2783,7 +2785,7 @@ static irqreturn_t udc_control_in_isr(struct udc *dev)
                                         /* write fifo */
                                         udc_txfifo_write(ep, &req->req);
 
-                                        /* lengh bytes transfered */
+                                        /* lengh bytes transferred */
                                         len = req->req.length - req->req.actual;
                                         if (len > ep->ep.maxpacket)
                                                 len = ep->ep.maxpacket;
@@ -3358,7 +3360,6 @@ static int udc_probe(struct udc *dev)
         dev_set_name(&dev->gadget.dev, "gadget");
         dev->gadget.dev.release = gadget_release;
         dev->gadget.name = name;
-        dev->gadget.name = name;
         dev->gadget.is_dualspeed = 1;
 
         /* init registers, interrupts, ... */
@@ -3382,8 +3383,10 @@ static int udc_probe(struct udc *dev)
         udc = dev;
 
         retval = device_register(&dev->gadget.dev);
-        if (retval)
+        if (retval) {
+                put_device(&dev->gadget.dev);
                 goto finished;
+        }
 
         /* timer init */
         init_timer(&udc_timer);
diff --git a/drivers/usb/gadget/amd5536udc.h b/drivers/usb/gadget/amd5536udc.h
index 4bbabbbfc93f..1d1c7543468e 100644
--- a/drivers/usb/gadget/amd5536udc.h
+++ b/drivers/usb/gadget/amd5536udc.h
@@ -584,7 +584,7 @@ union udc_setup_data {
  * SET and GET bitfields in u32 values
  * via constants for mask/offset:
  * <bit_field_stub_name> is the text between
- * UDC_ and _MASK|_OFS of appropiate
+ * UDC_ and _MASK|_OFS of appropriate
  * constant
  *
  * set bitfield value in u32 u32Val
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index 93ead19507b6..f4690ffcb489 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -38,6 +38,7 @@
 #include <linux/clk.h>
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
+#include <linux/prefetch.h>
 
 #include <asm/byteorder.h>
 #include <mach/hardware.h>
@@ -826,7 +827,7 @@ done:
         return status;
 }
 
-/* reinit == restore inital software state */
+/* reinit == restore initial software state */
 static void udc_reinit(struct at91_udc *udc)
 {
         u32 i;
@@ -1266,7 +1267,6 @@ write_in:
         csr |= AT91_UDP_TXPKTRDY;
         __raw_writel(csr, creg);
         udc->req_pending = 0;
-        return;
 }
 
 static void handle_ep0(struct at91_udc *udc)
@@ -1628,7 +1628,8 @@ static void at91_vbus_timer(unsigned long data)
                 schedule_work(&udc->vbus_timer_work);
 }
 
-int usb_gadget_register_driver (struct usb_gadget_driver *driver)
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
 {
         struct at91_udc *udc = &controller;
         int             retval;
@@ -1636,7 +1637,7 @@ int usb_gadget_register_driver (struct usb_gadget_driver *driver)
 
         if (!driver
                         || driver->speed < USB_SPEED_FULL
-                        || !driver->bind
+                        || !bind
                         || !driver->setup) {
                 DBG("bad parameter.\n");
                 return -EINVAL;
@@ -1653,9 +1654,9 @@ int usb_gadget_register_driver (struct usb_gadget_driver *driver)
         udc->enabled = 1;
         udc->selfpowered = 1;
 
-        retval = driver->bind(&udc->gadget);
+        retval = bind(&udc->gadget);
         if (retval) {
-                DBG("driver->bind() returned %d\n", retval);
+                DBG("bind() returned %d\n", retval);
                 udc->driver = NULL;
                 udc->gadget.dev.driver = NULL;
                 dev_set_drvdata(&udc->gadget.dev, NULL);
@@ -1671,7 +1672,7 @@ int usb_gadget_register_driver (struct usb_gadget_driver *driver)
         DBG("bound to %s\n", driver->driver.name);
         return 0;
 }
-EXPORT_SYMBOL (usb_gadget_register_driver);
+EXPORT_SYMBOL(usb_gadget_probe_driver);
 
 int usb_gadget_unregister_driver (struct usb_gadget_driver *driver)
 {
@@ -1767,7 +1768,7 @@ static int __init at91udc_probe(struct platform_device *pdev)
         }
 
         /* newer chips have more FIFO memory than rm9200 */
-        if (cpu_is_at91sam9260()) {
+        if (cpu_is_at91sam9260() || cpu_is_at91sam9g20()) {
                 udc->ep[0].maxpacket = 64;
                 udc->ep[3].maxpacket = 64;
                 udc->ep[4].maxpacket = 512;
@@ -1798,8 +1799,10 @@ static int __init at91udc_probe(struct platform_device *pdev)
         }
 
         retval = device_register(&udc->gadget.dev);
-        if (retval < 0)
+        if (retval < 0) {
+                put_device(&udc->gadget.dev);
                 goto fail0b;
+        }
 
         /* don't do anything until we have both gadget driver and VBUS */
         clk_enable(udc->iclk);
diff --git a/drivers/usb/gadget/atmel_usba_udc.c b/drivers/usb/gadget/atmel_usba_udc.c
index d623c7bda1f6..db1a659702ba 100644
--- a/drivers/usb/gadget/atmel_usba_udc.c
+++ b/drivers/usb/gadget/atmel_usba_udc.c
@@ -1789,7 +1789,8 @@ out:
         return IRQ_HANDLED;
 }
 
-int usb_gadget_register_driver(struct usb_gadget_driver *driver)
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
 {
         struct usba_udc *udc = &the_udc;
         unsigned long flags;
@@ -1812,7 +1813,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
         clk_enable(udc->pclk);
         clk_enable(udc->hclk);
 
-        ret = driver->bind(&udc->gadget);
+        ret = bind(&udc->gadget);
         if (ret) {
                 DBG(DBG_ERR, "Could not bind to driver %s: error %d\n",
                         driver->driver.name, ret);
@@ -1841,7 +1842,7 @@ err_driver_bind:
         udc->gadget.dev.driver = NULL;
         return ret;
 }
-EXPORT_SYMBOL(usb_gadget_register_driver);
+EXPORT_SYMBOL(usb_gadget_probe_driver);
 
 int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
 {
@@ -2014,6 +2015,9 @@ static int __init usba_udc_probe(struct platform_device *pdev)
                         } else {
                                 disable_irq(gpio_to_irq(udc->vbus_pin));
                         }
+                } else {
+                        /* gpio_request fail so use -EINVAL for gpio_is_valid */
+                        udc->vbus_pin = -EINVAL;
                 }
         }
 
@@ -2053,8 +2057,10 @@ static int __exit usba_udc_remove(struct platform_device *pdev)
                 usba_ep_cleanup_debugfs(&usba_ep[i]);
         usba_cleanup_debugfs(udc);
 
-        if (gpio_is_valid(udc->vbus_pin))
+        if (gpio_is_valid(udc->vbus_pin)) {
+                free_irq(gpio_to_irq(udc->vbus_pin), udc);
                 gpio_free(udc->vbus_pin);
+        }
 
         free_irq(udc->irq, udc);
         kfree(usba_ep);
@@ -2089,6 +2095,6 @@ static void __exit udc_exit(void)
 module_exit(udc_exit);
 
 MODULE_DESCRIPTION("Atmel USBA UDC driver");
-MODULE_AUTHOR("Haavard Skinnemoen <hskinnemoen@atmel.com>");
+MODULE_AUTHOR("Haavard Skinnemoen (Atmel)");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:atmel_usba_udc");
diff --git a/drivers/usb/gadget/audio.c b/drivers/usb/gadget/audio.c
index b744ccd0f34d..93b999e49ef3 100644
--- a/drivers/usb/gadget/audio.c
+++ b/drivers/usb/gadget/audio.c
@@ -89,7 +89,7 @@ static const struct usb_descriptor_header *otg_desc[] = {
 
 /*-------------------------------------------------------------------------*/
 
-static int __ref audio_do_config(struct usb_configuration *c)
+static int __init audio_do_config(struct usb_configuration *c)
 {
         /* FIXME alloc iConfiguration string, set it in c->strings */
 
@@ -105,7 +105,6 @@ static int __ref audio_do_config(struct usb_configuration *c)
 
 static struct usb_configuration audio_config_driver = {
         .label                  = DRIVER_DESC,
-        .bind                   = audio_do_config,
         .bConfigurationValue    = 1,
         /* .iConfiguration = DYNAMIC */
         .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
@@ -113,7 +112,7 @@ static struct usb_configuration audio_config_driver = {
 
 /*-------------------------------------------------------------------------*/
 
-static int __ref audio_bind(struct usb_composite_dev *cdev)
+static int __init audio_bind(struct usb_composite_dev *cdev)
 {
         int                     gcnum;
         int                     status;
@@ -145,7 +144,7 @@ static int __ref audio_bind(struct usb_composite_dev *cdev)
         strings_dev[STRING_PRODUCT_IDX].id = status;
         device_desc.iProduct = status;
 
-        status = usb_add_config(cdev, &audio_config_driver);
+        status = usb_add_config(cdev, &audio_config_driver, audio_do_config);
         if (status < 0)
                 goto fail;
 
@@ -166,13 +165,12 @@ static struct usb_composite_driver audio_driver = {
         .name           = "g_audio",
         .dev            = &device_desc,
         .strings        = audio_strings,
-        .bind           = audio_bind,
         .unbind         = __exit_p(audio_unbind),
 };
 
 static int __init init(void)
 {
-        return usb_composite_register(&audio_driver);
+        return usb_composite_probe(&audio_driver, audio_bind);
 }
 module_init(init);
 
diff --git a/drivers/usb/gadget/cdc2.c b/drivers/usb/gadget/cdc2.c
index 1f5ba2fd4c1f..2720ab07ef1a 100644
--- a/drivers/usb/gadget/cdc2.c
+++ b/drivers/usb/gadget/cdc2.c
@@ -129,7 +129,7 @@ static u8 hostaddr[ETH_ALEN];
 /*
  * We _always_ have both CDC ECM and CDC ACM functions.
  */
-static int __ref cdc_do_config(struct usb_configuration *c)
+static int __init cdc_do_config(struct usb_configuration *c)
 {
         int     status;
 
@@ -151,7 +151,6 @@ static int __ref cdc_do_config(struct usb_configuration *c)
 
 static struct usb_configuration cdc_config_driver = {
         .label                  = "CDC Composite (ECM + ACM)",
-        .bind                   = cdc_do_config,
         .bConfigurationValue    = 1,
         /* .iConfiguration = DYNAMIC */
         .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
@@ -159,7 +158,7 @@ static struct usb_configuration cdc_config_driver = {
 
 /*-------------------------------------------------------------------------*/
 
-static int __ref cdc_bind(struct usb_composite_dev *cdev)
+static int __init cdc_bind(struct usb_composite_dev *cdev)
 {
         int                     gcnum;
         struct usb_gadget       *gadget = cdev->gadget;
@@ -218,7 +217,7 @@ static int __ref cdc_bind(struct usb_composite_dev *cdev)
         device_desc.iProduct = status;
 
         /* register our configuration */
-        status = usb_add_config(cdev, &cdc_config_driver);
+        status = usb_add_config(cdev, &cdc_config_driver, cdc_do_config);
         if (status < 0)
                 goto fail1;
 
@@ -245,7 +244,6 @@ static struct usb_composite_driver cdc_driver = {
         .name           = "g_cdc",
         .dev            = &device_desc,
         .strings        = dev_strings,
-        .bind           = cdc_bind,
         .unbind         = __exit_p(cdc_unbind),
 };
 
@@ -255,7 +253,7 @@ MODULE_LICENSE("GPL");
 
 static int __init init(void)
 {
-        return usb_composite_register(&cdc_driver);
+        return usb_composite_probe(&cdc_driver, cdc_bind);
 }
 module_init(init);
 
diff --git a/drivers/usb/gadget/ci13xxx_msm.c b/drivers/usb/gadget/ci13xxx_msm.c
new file mode 100644
index 000000000000..139ac9419597
--- /dev/null
+++ b/drivers/usb/gadget/ci13xxx_msm.c
@@ -0,0 +1,134 @@
+/* Copyright (c) 2010, Code Aurora Forum. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+#include <linux/usb/msm_hsusb_hw.h>
+#include <linux/usb/ulpi.h>
+
+#include "ci13xxx_udc.c"
+
+#define MSM_USB_BASE    (udc->regs)
+
+static irqreturn_t msm_udc_irq(int irq, void *data)
+{
+        return udc_irq();
+}
+
+static void ci13xxx_msm_notify_event(struct ci13xxx *udc, unsigned event)
+{
+        struct device *dev = udc->gadget.dev.parent;
+        int val;
+
+        switch (event) {
+        case CI13XXX_CONTROLLER_RESET_EVENT:
+                dev_dbg(dev, "CI13XXX_CONTROLLER_RESET_EVENT received\n");
+                writel(0, USB_AHBBURST);
+                writel(0, USB_AHBMODE);
+                break;
+        case CI13XXX_CONTROLLER_STOPPED_EVENT:
+                dev_dbg(dev, "CI13XXX_CONTROLLER_STOPPED_EVENT received\n");
+                /*
+                 * Put the transceiver in non-driving mode. Otherwise host
+                 * may not detect soft-disconnection.
+                 */
+                val = otg_io_read(udc->transceiver, ULPI_FUNC_CTRL);
+                val &= ~ULPI_FUNC_CTRL_OPMODE_MASK;
+                val |= ULPI_FUNC_CTRL_OPMODE_NONDRIVING;
+                otg_io_write(udc->transceiver, val, ULPI_FUNC_CTRL);
+                break;
+        default:
+                dev_dbg(dev, "unknown ci13xxx_udc event\n");
+                break;
+        }
+}
+
+static struct ci13xxx_udc_driver ci13xxx_msm_udc_driver = {
+        .name                   = "ci13xxx_msm",
+        .flags                  = CI13XXX_REGS_SHARED |
+                                  CI13XXX_REQUIRE_TRANSCEIVER |
+                                  CI13XXX_PULLUP_ON_VBUS |
+                                  CI13XXX_DISABLE_STREAMING,
+
+        .notify_event           = ci13xxx_msm_notify_event,
+};
+
+static int ci13xxx_msm_probe(struct platform_device *pdev)
+{
+        struct resource *res;
+        void __iomem *regs;
+        int irq;
+        int ret;
+
+        dev_dbg(&pdev->dev, "ci13xxx_msm_probe\n");
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_err(&pdev->dev, "failed to get platform resource mem\n");
+                return -ENXIO;
+        }
+
+        regs = ioremap(res->start, resource_size(res));
+        if (!regs) {
+                dev_err(&pdev->dev, "ioremap failed\n");
+                return -ENOMEM;
+        }
+
+        ret = udc_probe(&ci13xxx_msm_udc_driver, &pdev->dev, regs);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "udc_probe failed\n");
+                goto iounmap;
+        }
+
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                dev_err(&pdev->dev, "IRQ not found\n");
+                ret = -ENXIO;
+                goto udc_remove;
+        }
+
+        ret = request_irq(irq, msm_udc_irq, IRQF_SHARED, pdev->name, pdev);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "request_irq failed\n");
+                goto udc_remove;
+        }
+
+        pm_runtime_no_callbacks(&pdev->dev);
+        pm_runtime_enable(&pdev->dev);
+
+        return 0;
+
+udc_remove:
+        udc_remove();
+iounmap:
+        iounmap(regs);
+
+        return ret;
+}
+
+static struct platform_driver ci13xxx_msm_driver = {
+        .probe = ci13xxx_msm_probe,
+        .driver = { .name = "msm_hsusb", },
+};
+
+static int __init ci13xxx_msm_init(void)
+{
+        return platform_driver_register(&ci13xxx_msm_driver);
+}
+module_init(ci13xxx_msm_init);
diff --git a/drivers/usb/gadget/ci13xxx_pci.c b/drivers/usb/gadget/ci13xxx_pci.c
new file mode 100644
index 000000000000..883ab5e832d1
--- /dev/null
+++ b/drivers/usb/gadget/ci13xxx_pci.c
@@ -0,0 +1,176 @@
+/*
+ * ci13xxx_pci.c - MIPS USB IP core family device controller
+ *
+ * Copyright (C) 2008 Chipidea - MIPS Technologies, Inc. All rights reserved.
+ *
+ * Author: David Lopo
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/pci.h>
+
+#include "ci13xxx_udc.c"
+
+/* driver name */
+#define UDC_DRIVER_NAME   "ci13xxx_pci"
+
+/******************************************************************************
+ * PCI block
+ *****************************************************************************/
+/**
+ * ci13xxx_pci_irq: interrut handler
+ * @irq:  irq number
+ * @pdev: USB Device Controller interrupt source
+ *
+ * This function returns IRQ_HANDLED if the IRQ has been handled
+ * This is an ISR don't trace, use attribute interface instead
+ */
+static irqreturn_t ci13xxx_pci_irq(int irq, void *pdev)
+{
+        if (irq == 0) {
+                dev_err(&((struct pci_dev *)pdev)->dev, "Invalid IRQ0 usage!");
+                return IRQ_HANDLED;
+        }
+        return udc_irq();
+}
+
+static struct ci13xxx_udc_driver ci13xxx_pci_udc_driver = {
+        .name           = UDC_DRIVER_NAME,
+};
+
+/**
+ * ci13xxx_pci_probe: PCI probe
+ * @pdev: USB device controller being probed
+ * @id:   PCI hotplug ID connecting controller to UDC framework
+ *
+ * This function returns an error code
+ * Allocates basic PCI resources for this USB device controller, and then
+ * invokes the udc_probe() method to start the UDC associated with it
+ */
+static int __devinit ci13xxx_pci_probe(struct pci_dev *pdev,
+                                       const struct pci_device_id *id)
+{
+        void __iomem *regs = NULL;
+        int retval = 0;
+
+        if (id == NULL)
+                return -EINVAL;
+
+        retval = pci_enable_device(pdev);
+        if (retval)
+                goto done;
+
+        if (!pdev->irq) {
+                dev_err(&pdev->dev, "No IRQ, check BIOS/PCI setup!");
+                retval = -ENODEV;
+                goto disable_device;
+        }
+
+        retval = pci_request_regions(pdev, UDC_DRIVER_NAME);
+        if (retval)
+                goto disable_device;
+
+        /* BAR 0 holds all the registers */
+        regs = pci_iomap(pdev, 0, 0);
+        if (!regs) {
+                dev_err(&pdev->dev, "Error mapping memory!");
+                retval = -EFAULT;
+                goto release_regions;
+        }
+        pci_set_drvdata(pdev, (__force void *)regs);
+
+        pci_set_master(pdev);
+        pci_try_set_mwi(pdev);
+
+        retval = udc_probe(&ci13xxx_pci_udc_driver, &pdev->dev, regs);
+        if (retval)
+                goto iounmap;
+
+        /* our device does not have MSI capability */
+
+        retval = request_irq(pdev->irq, ci13xxx_pci_irq, IRQF_SHARED,
+                             UDC_DRIVER_NAME, pdev);
+        if (retval)
+                goto gadget_remove;
+
+        return 0;
+
+ gadget_remove:
+        udc_remove();
+ iounmap:
+        pci_iounmap(pdev, regs);
+ release_regions:
+        pci_release_regions(pdev);
+ disable_device:
+        pci_disable_device(pdev);
+ done:
+        return retval;
+}
+
+/**
+ * ci13xxx_pci_remove: PCI remove
+ * @pdev: USB Device Controller being removed
+ *
+ * Reverses the effect of ci13xxx_pci_probe(),
+ * first invoking the udc_remove() and then releases
+ * all PCI resources allocated for this USB device controller
+ */
+static void __devexit ci13xxx_pci_remove(struct pci_dev *pdev)
+{
+        free_irq(pdev->irq, pdev);
+        udc_remove();
+        pci_iounmap(pdev, (__force void __iomem *)pci_get_drvdata(pdev));
+        pci_release_regions(pdev);
+        pci_disable_device(pdev);
+}
+
+/**
+ * PCI device table
+ * PCI device structure
+ *
+ * Check "pci.h" for details
+ */
+static DEFINE_PCI_DEVICE_TABLE(ci13xxx_pci_id_table) = {
+        { PCI_DEVICE(0x153F, 0x1004) },
+        { PCI_DEVICE(0x153F, 0x1006) },
+        { 0, 0, 0, 0, 0, 0, 0 /* end: all zeroes */ }
+};
+MODULE_DEVICE_TABLE(pci, ci13xxx_pci_id_table);
+
+static struct pci_driver ci13xxx_pci_driver = {
+        .name         = UDC_DRIVER_NAME,
+        .id_table     = ci13xxx_pci_id_table,
+        .probe        = ci13xxx_pci_probe,
+        .remove       = __devexit_p(ci13xxx_pci_remove),
+};
+
+/**
+ * ci13xxx_pci_init: module init
+ *
+ * Driver load
+ */
+static int __init ci13xxx_pci_init(void)
+{
+        return pci_register_driver(&ci13xxx_pci_driver);
+}
+module_init(ci13xxx_pci_init);
+
+/**
+ * ci13xxx_pci_exit: module exit
+ *
+ * Driver unload
+ */
+static void __exit ci13xxx_pci_exit(void)
+{
+        pci_unregister_driver(&ci13xxx_pci_driver);
+}
+module_exit(ci13xxx_pci_exit);
+
+MODULE_AUTHOR("MIPS - David Lopo <dlopo@chipidea.mips.com>");
+MODULE_DESCRIPTION("MIPS CI13XXX USB Peripheral Controller");
+MODULE_LICENSE("GPL");
+MODULE_VERSION("June 2008");
diff --git a/drivers/usb/gadget/ci13xxx_udc.c b/drivers/usb/gadget/ci13xxx_udc.c
index 699695128e33..baaf87ed7685 100644
--- a/drivers/usb/gadget/ci13xxx_udc.c
+++ b/drivers/usb/gadget/ci13xxx_udc.c
@@ -22,7 +22,6 @@
  * - ENDPT:  endpoint operations (Gadget API)
  * - GADGET: gadget operations (Gadget API)
  * - BUS:    bus glue code, bus abstraction layer
- * - PCI:    PCI core interface and PCI resources (interrupts, memory...)
  *
  * Compile Options
  * - CONFIG_USB_GADGET_DEBUG_FILES: enable debug facilities
@@ -60,11 +59,11 @@
 #include <linux/io.h>
 #include <linux/irq.h>
 #include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/pci.h>
 #include <linux/slab.h>
+#include <linux/pm_runtime.h>
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
+#include <linux/usb/otg.h>
 
 #include "ci13xxx_udc.h"
 
@@ -75,15 +74,23 @@
 /* ctrl register bank access */
 static DEFINE_SPINLOCK(udc_lock);
 
-/* driver name */
-#define UDC_DRIVER_NAME   "ci13xxx_udc"
-
 /* control endpoint description */
 static const struct usb_endpoint_descriptor
-ctrl_endpt_desc = {
+ctrl_endpt_out_desc = {
+        .bLength         = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType = USB_DT_ENDPOINT,
+
+        .bEndpointAddress = USB_DIR_OUT,
+        .bmAttributes    = USB_ENDPOINT_XFER_CONTROL,
+        .wMaxPacketSize  = cpu_to_le16(CTRL_PAYLOAD_MAX),
+};
+
+static const struct usb_endpoint_descriptor
+ctrl_endpt_in_desc = {
         .bLength         = USB_DT_ENDPOINT_SIZE,
         .bDescriptorType = USB_DT_ENDPOINT,
 
+        .bEndpointAddress = USB_DIR_IN,
         .bmAttributes    = USB_ENDPOINT_XFER_CONTROL,
         .wMaxPacketSize  = cpu_to_le16(CTRL_PAYLOAD_MAX),
 };
@@ -132,6 +139,9 @@ static struct {
         size_t        size;   /* bank size */
 } hw_bank;
 
+/* MSM specific */
+#define ABS_AHBBURST        (0x0090UL)
+#define ABS_AHBMODE         (0x0098UL)
 /* UDC register map */
 #define ABS_CAPLENGTH       (0x100UL)
 #define ABS_HCCPARAMS       (0x108UL)
@@ -248,13 +258,7 @@ static u32 hw_ctest_and_write(u32 addr, u32 mask, u32 data)
         return (reg & mask) >> ffs_nr(mask);
 }
 
-/**
- * hw_device_reset: resets chip (execute without interruption)
- * @base: register base address
- *
- * This function returns an error code
- */
-static int hw_device_reset(void __iomem *base)
+static int hw_device_init(void __iomem *base)
 {
         u32 reg;
 
@@ -271,6 +275,28 @@ static int hw_device_reset(void __iomem *base)
         hw_bank.size += CAP_LAST;
         hw_bank.size /= sizeof(u32);
 
+        reg = hw_aread(ABS_DCCPARAMS, DCCPARAMS_DEN) >> ffs_nr(DCCPARAMS_DEN);
+        hw_ep_max = reg * 2;   /* cache hw ENDPT_MAX */
+
+        if (hw_ep_max == 0 || hw_ep_max > ENDPT_MAX)
+                return -ENODEV;
+
+        /* setup lock mode ? */
+
+        /* ENDPTSETUPSTAT is '0' by default */
+
+        /* HCSPARAMS.bf.ppc SHOULD BE zero for device */
+
+        return 0;
+}
+/**
+ * hw_device_reset: resets chip (execute without interruption)
+ * @base: register base address
+ *
+ * This function returns an error code
+ */
+static int hw_device_reset(struct ci13xxx *udc)
+{
         /* should flush & stop before reset */
         hw_cwrite(CAP_ENDPTFLUSH, ~0, ~0);
         hw_cwrite(CAP_USBCMD, USBCMD_RS, 0);
@@ -279,6 +305,14 @@ static int hw_device_reset(void __iomem *base)
         while (hw_cread(CAP_USBCMD, USBCMD_RST))
                 udelay(10);             /* not RTOS friendly */
 
+
+        if (udc->udc_driver->notify_event)
+                udc->udc_driver->notify_event(udc,
+                        CI13XXX_CONTROLLER_RESET_EVENT);
+
+        if (udc->udc_driver->flags & CI13XXX_DISABLE_STREAMING)
+                hw_cwrite(CAP_USBMODE, USBMODE_SDIS, USBMODE_SDIS);
+
         /* USBMODE should be configured step by step */
         hw_cwrite(CAP_USBMODE, USBMODE_CM, USBMODE_CM_IDLE);
         hw_cwrite(CAP_USBMODE, USBMODE_CM, USBMODE_CM_DEVICE);
@@ -290,18 +324,6 @@ static int hw_device_reset(void __iomem *base)
                 return -ENODEV;
         }
 
-        reg = hw_aread(ABS_DCCPARAMS, DCCPARAMS_DEN) >> ffs_nr(DCCPARAMS_DEN);
-        if (reg == 0 || reg > ENDPT_MAX)
-                return -ENODEV;
-
-        hw_ep_max = reg;   /* cache hw ENDPT_MAX */
-
-        /* setup lock mode ? */
-
-        /* ENDPTSETUPSTAT is '0' by default */
-
-        /* HCSPARAMS.bf.ppc SHOULD BE zero for device */
-
         return 0;
 }
 
@@ -413,20 +435,6 @@ static int hw_ep_get_halt(int num, int dir)
 }
 
 /**
- * hw_ep_is_primed: test if endpoint is primed (execute without interruption)
- * @num:   endpoint number
- * @dir:   endpoint direction
- *
- * This function returns true if endpoint primed
- */
-static int hw_ep_is_primed(int num, int dir)
-{
-        u32 reg = hw_cread(CAP_ENDPTPRIME, ~0) | hw_cread(CAP_ENDPTSTAT, ~0);
-
-        return test_bit(hw_ep_bit(num, dir), (void *)&reg);
-}
-
-/**
  * hw_test_and_clear_setup_status: test & clear setup status (execute without
  *                                 interruption)
  * @n: bit number (endpoint)
@@ -450,10 +458,6 @@ static int hw_ep_prime(int num, int dir, int is_ctrl)
 {
         int n = hw_ep_bit(num, dir);
 
-        /* the caller should flush first */
-        if (hw_ep_is_primed(num, dir))
-                return -EBUSY;
-
         if (is_ctrl && dir == RX && hw_cread(CAP_ENDPTSETUPSTAT, BIT(num)))
                 return -EAGAIN;
 
@@ -1186,16 +1190,17 @@ static ssize_t show_qheads(struct device *dev, struct device_attribute *attr,
         }
 
         spin_lock_irqsave(udc->lock, flags);
-        for (i = 0; i < hw_ep_max; i++) {
-                struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[i];
+        for (i = 0; i < hw_ep_max/2; i++) {
+                struct ci13xxx_ep *mEpRx = &udc->ci13xxx_ep[i];
+                struct ci13xxx_ep *mEpTx = &udc->ci13xxx_ep[i + hw_ep_max/2];
                 n += scnprintf(buf + n, PAGE_SIZE - n,
                                "EP=%02i: RX=%08X TX=%08X\n",
-                               i, (u32)mEp->qh[RX].dma, (u32)mEp->qh[TX].dma);
+                               i, (u32)mEpRx->qh.dma, (u32)mEpTx->qh.dma);
                 for (j = 0; j < (sizeof(struct ci13xxx_qh)/sizeof(u32)); j++) {
                         n += scnprintf(buf + n, PAGE_SIZE - n,
                                        " %04X:    %08X    %08X\n", j,
-                                       *((u32 *)mEp->qh[RX].ptr + j),
-                                       *((u32 *)mEp->qh[TX].ptr + j));
+                                       *((u32 *)mEpRx->qh.ptr + j),
+                                       *((u32 *)mEpTx->qh.ptr + j));
                 }
         }
         spin_unlock_irqrestore(udc->lock, flags);
@@ -1282,7 +1287,7 @@ static ssize_t show_requests(struct device *dev, struct device_attribute *attr,
         unsigned long flags;
         struct list_head   *ptr = NULL;
         struct ci13xxx_req *req = NULL;
-        unsigned i, j, k, n = 0, qSize = sizeof(struct ci13xxx_td)/sizeof(u32);
+        unsigned i, j, n = 0, qSize = sizeof(struct ci13xxx_td)/sizeof(u32);
 
         dbg_trace("[%s] %p\n", __func__, buf);
         if (attr == NULL || buf == NULL) {
@@ -1292,22 +1297,20 @@ static ssize_t show_requests(struct device *dev, struct device_attribute *attr,
 
         spin_lock_irqsave(udc->lock, flags);
         for (i = 0; i < hw_ep_max; i++)
-                for (k = RX; k <= TX; k++)
-                        list_for_each(ptr, &udc->ci13xxx_ep[i].qh[k].queue)
-                        {
-                                req = list_entry(ptr,
-                                                 struct ci13xxx_req, queue);
+                list_for_each(ptr, &udc->ci13xxx_ep[i].qh.queue)
+                {
+                        req = list_entry(ptr, struct ci13xxx_req, queue);
 
+                        n += scnprintf(buf + n, PAGE_SIZE - n,
+                                        "EP=%02i: TD=%08X %s\n",
+                                        i % hw_ep_max/2, (u32)req->dma,
+                                        ((i < hw_ep_max/2) ? "RX" : "TX"));
+
+                        for (j = 0; j < qSize; j++)
                                 n += scnprintf(buf + n, PAGE_SIZE - n,
-                                               "EP=%02i: TD=%08X %s\n",
-                                               i, (u32)req->dma,
-                                               ((k == RX) ? "RX" : "TX"));
-
-                                for (j = 0; j < qSize; j++)
-                                        n += scnprintf(buf + n, PAGE_SIZE - n,
-                                                       " %04X:    %08X\n", j,
-                                                       *((u32 *)req->ptr + j));
-                        }
+                                                " %04X:    %08X\n", j,
+                                                *((u32 *)req->ptr + j));
+                }
         spin_unlock_irqrestore(udc->lock, flags);
 
         return n;
@@ -1413,6 +1416,8 @@ static inline u8 _usb_addr(struct ci13xxx_ep *ep)
 static int _hardware_enqueue(struct ci13xxx_ep *mEp, struct ci13xxx_req *mReq)
 {
         unsigned i;
+        int ret = 0;
+        unsigned length = mReq->req.length;
 
         trace("%p, %p", mEp, mReq);
 
@@ -1420,53 +1425,91 @@ static int _hardware_enqueue(struct ci13xxx_ep *mEp, struct ci13xxx_req *mReq)
         if (mReq->req.status == -EALREADY)
                 return -EALREADY;
 
-        if (hw_ep_is_primed(mEp->num, mEp->dir))
-                return -EBUSY;
-
         mReq->req.status = -EALREADY;
-
-        if (mReq->req.length && !mReq->req.dma) {
+        if (length && !mReq->req.dma) {
                 mReq->req.dma = \
                         dma_map_single(mEp->device, mReq->req.buf,
-                                       mReq->req.length, mEp->dir ?
-                                       DMA_TO_DEVICE : DMA_FROM_DEVICE);
+                                       length, mEp->dir ? DMA_TO_DEVICE :
+                                       DMA_FROM_DEVICE);
                 if (mReq->req.dma == 0)
                         return -ENOMEM;
 
                 mReq->map = 1;
         }
 
+        if (mReq->req.zero && length && (length % mEp->ep.maxpacket == 0)) {
+                mReq->zptr = dma_pool_alloc(mEp->td_pool, GFP_ATOMIC,
+                                           &mReq->zdma);
+                if (mReq->zptr == NULL) {
+                        if (mReq->map) {
+                                dma_unmap_single(mEp->device, mReq->req.dma,
+                                        length, mEp->dir ? DMA_TO_DEVICE :
+                                        DMA_FROM_DEVICE);
+                                mReq->req.dma = 0;
+                                mReq->map     = 0;
+                        }
+                        return -ENOMEM;
+                }
+                memset(mReq->zptr, 0, sizeof(*mReq->zptr));
+                mReq->zptr->next    = TD_TERMINATE;
+                mReq->zptr->token   = TD_STATUS_ACTIVE;
+                if (!mReq->req.no_interrupt)
+                        mReq->zptr->token   |= TD_IOC;
+        }
         /*
          * TD configuration
          * TODO - handle requests which spawns into several TDs
          */
         memset(mReq->ptr, 0, sizeof(*mReq->ptr));
-        mReq->ptr->next    |= TD_TERMINATE;
-        mReq->ptr->token    = mReq->req.length << ffs_nr(TD_TOTAL_BYTES);
+        mReq->ptr->token    = length << ffs_nr(TD_TOTAL_BYTES);
         mReq->ptr->token   &= TD_TOTAL_BYTES;
-        mReq->ptr->token   |= TD_IOC;
         mReq->ptr->token   |= TD_STATUS_ACTIVE;
+        if (mReq->zptr) {
+                mReq->ptr->next    = mReq->zdma;
+        } else {
+                mReq->ptr->next    = TD_TERMINATE;
+                if (!mReq->req.no_interrupt)
+                        mReq->ptr->token  |= TD_IOC;
+        }
         mReq->ptr->page[0]  = mReq->req.dma;
         for (i = 1; i < 5; i++)
                 mReq->ptr->page[i] =
-                        (mReq->req.dma + i * PAGE_SIZE) & ~TD_RESERVED_MASK;
+                        (mReq->req.dma + i * CI13XXX_PAGE_SIZE) & ~TD_RESERVED_MASK;
 
-        /*
-         *  QH configuration
-         *  At this point it's guaranteed exclusive access to qhead
-         *  (endpt is not primed) so it's no need to use tripwire
-         */
-        mEp->qh[mEp->dir].ptr->td.next   = mReq->dma;    /* TERMINATE = 0 */
-        mEp->qh[mEp->dir].ptr->td.token &= ~TD_STATUS;   /* clear status */
-        if (mReq->req.zero == 0)
-                mEp->qh[mEp->dir].ptr->cap |=  QH_ZLT;
-        else
-                mEp->qh[mEp->dir].ptr->cap &= ~QH_ZLT;
+        if (!list_empty(&mEp->qh.queue)) {
+                struct ci13xxx_req *mReqPrev;
+                int n = hw_ep_bit(mEp->num, mEp->dir);
+                int tmp_stat;
+
+                mReqPrev = list_entry(mEp->qh.queue.prev,
+                                struct ci13xxx_req, queue);
+                if (mReqPrev->zptr)
+                        mReqPrev->zptr->next = mReq->dma & TD_ADDR_MASK;
+                else
+                        mReqPrev->ptr->next = mReq->dma & TD_ADDR_MASK;
+                wmb();
+                if (hw_cread(CAP_ENDPTPRIME, BIT(n)))
+                        goto done;
+                do {
+                        hw_cwrite(CAP_USBCMD, USBCMD_ATDTW, USBCMD_ATDTW);
+                        tmp_stat = hw_cread(CAP_ENDPTSTAT, BIT(n));
+                } while (!hw_cread(CAP_USBCMD, USBCMD_ATDTW));
+                hw_cwrite(CAP_USBCMD, USBCMD_ATDTW, 0);
+                if (tmp_stat)
+                        goto done;
+        }
+
+        /*  QH configuration */
+        mEp->qh.ptr->td.next   = mReq->dma;    /* TERMINATE = 0 */
+        mEp->qh.ptr->td.token &= ~TD_STATUS;   /* clear status */
+        mEp->qh.ptr->cap |=  QH_ZLT;
 
         wmb();   /* synchronize before ep prime */
 
-        return hw_ep_prime(mEp->num, mEp->dir,
+        ret = hw_ep_prime(mEp->num, mEp->dir,
                            mEp->type == USB_ENDPOINT_XFER_CONTROL);
+done:
+        return ret;
 }
 
 /**
@@ -1483,8 +1526,15 @@ static int _hardware_dequeue(struct ci13xxx_ep *mEp, struct ci13xxx_req *mReq)
         if (mReq->req.status != -EALREADY)
                 return -EINVAL;
 
-        if (hw_ep_is_primed(mEp->num, mEp->dir))
-                hw_ep_flush(mEp->num, mEp->dir);
+        if ((TD_STATUS_ACTIVE & mReq->ptr->token) != 0)
+                return -EBUSY;
+
+        if (mReq->zptr) {
+                if ((TD_STATUS_ACTIVE & mReq->zptr->token) != 0)
+                        return -EBUSY;
+                dma_pool_free(mEp->td_pool, mReq->zptr, mReq->zdma);
+                mReq->zptr = NULL;
+        }
 
         mReq->req.status = 0;
 
@@ -1496,9 +1546,7 @@ static int _hardware_dequeue(struct ci13xxx_ep *mEp, struct ci13xxx_req *mReq)
         }
 
         mReq->req.status = mReq->ptr->token & TD_STATUS;
-        if      ((TD_STATUS_ACTIVE & mReq->req.status) != 0)
-                mReq->req.status = -ECONNRESET;
-        else if ((TD_STATUS_HALTED & mReq->req.status) != 0)
+        if ((TD_STATUS_HALTED & mReq->req.status) != 0)
                 mReq->req.status = -1;
         else if ((TD_STATUS_DT_ERR & mReq->req.status) != 0)
                 mReq->req.status = -1;
@@ -1531,16 +1579,16 @@ __acquires(mEp->lock)
 
         hw_ep_flush(mEp->num, mEp->dir);
 
-        while (!list_empty(&mEp->qh[mEp->dir].queue)) {
+        while (!list_empty(&mEp->qh.queue)) {
 
                 /* pop oldest request */
                 struct ci13xxx_req *mReq = \
-                        list_entry(mEp->qh[mEp->dir].queue.next,
+                        list_entry(mEp->qh.queue.next,
                                    struct ci13xxx_req, queue);
                 list_del_init(&mReq->queue);
                 mReq->req.status = -ESHUTDOWN;
 
-                if (!mReq->req.no_interrupt && mReq->req.complete != NULL) {
+                if (mReq->req.complete != NULL) {
                         spin_unlock(mEp->lock);
                         mReq->req.complete(&mEp->ep, &mReq->req);
                         spin_lock(mEp->lock);
@@ -1557,26 +1605,28 @@ __acquires(mEp->lock)
  * Caller must hold lock
  */
 static int _gadget_stop_activity(struct usb_gadget *gadget)
-__releases(udc->lock)
-__acquires(udc->lock)
 {
         struct usb_ep *ep;
         struct ci13xxx    *udc = container_of(gadget, struct ci13xxx, gadget);
-        struct ci13xxx_ep *mEp = container_of(gadget->ep0,
-                                              struct ci13xxx_ep, ep);
+        unsigned long flags;
 
         trace("%p", gadget);
 
         if (gadget == NULL)
                 return -EINVAL;
 
-        spin_unlock(udc->lock);
+        spin_lock_irqsave(udc->lock, flags);
+        udc->gadget.speed = USB_SPEED_UNKNOWN;
+        udc->remote_wakeup = 0;
+        udc->suspended = 0;
+        spin_unlock_irqrestore(udc->lock, flags);
 
         /* flush all endpoints */
         gadget_for_each_ep(ep, gadget) {
                 usb_ep_fifo_flush(ep);
         }
-        usb_ep_fifo_flush(gadget->ep0);
+        usb_ep_fifo_flush(&udc->ep0out.ep);
+        usb_ep_fifo_flush(&udc->ep0in.ep);
 
         udc->driver->disconnect(gadget);
 
@@ -1584,15 +1634,12 @@ __acquires(udc->lock)
         gadget_for_each_ep(ep, gadget) {
                 usb_ep_disable(ep);
         }
-        usb_ep_disable(gadget->ep0);
 
-        if (mEp->status != NULL) {
-                usb_ep_free_request(gadget->ep0, mEp->status);
-                mEp->status = NULL;
+        if (udc->status != NULL) {
+                usb_ep_free_request(&udc->ep0in.ep, udc->status);
+                udc->status = NULL;
         }
 
-        spin_lock(udc->lock);
-
         return 0;
 }
 
@@ -1609,7 +1656,6 @@ static void isr_reset_handler(struct ci13xxx *udc)
 __releases(udc->lock)
 __acquires(udc->lock)
 {
-        struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[0];
         int retval;
 
         trace("%p", udc);
@@ -1621,6 +1667,7 @@ __acquires(udc->lock)
 
         dbg_event(0xFF, "BUS RST", 0);
 
+        spin_unlock(udc->lock);
         retval = _gadget_stop_activity(&udc->gadget);
         if (retval)
                 goto done;
@@ -1629,15 +1676,10 @@ __acquires(udc->lock)
         if (retval)
                 goto done;
 
-        spin_unlock(udc->lock);
-        retval = usb_ep_enable(&mEp->ep, &ctrl_endpt_desc);
-        if (!retval) {
-                mEp->status = usb_ep_alloc_request(&mEp->ep, GFP_KERNEL);
-                if (mEp->status == NULL) {
-                        usb_ep_disable(&mEp->ep);
-                        retval = -ENOMEM;
-                }
-        }
+        udc->status = usb_ep_alloc_request(&udc->ep0in.ep, GFP_ATOMIC);
+        if (udc->status == NULL)
+                retval = -ENOMEM;
+
         spin_lock(udc->lock);
 
  done:
@@ -1667,16 +1709,17 @@ static void isr_get_status_complete(struct usb_ep *ep, struct usb_request *req)
 
 /**
  * isr_get_status_response: get_status request response
- * @ep:    endpoint
+ * @udc: udc struct
  * @setup: setup request packet
  *
  * This function returns an error code
  */
-static int isr_get_status_response(struct ci13xxx_ep *mEp,
+static int isr_get_status_response(struct ci13xxx *udc,
                                    struct usb_ctrlrequest *setup)
 __releases(mEp->lock)
 __acquires(mEp->lock)
 {
+        struct ci13xxx_ep *mEp = &udc->ep0in;
         struct usb_request *req = NULL;
         gfp_t gfp_flags = GFP_ATOMIC;
         int dir, num, retval;
@@ -1701,7 +1744,8 @@ __acquires(mEp->lock)
         }
 
         if ((setup->bRequestType & USB_RECIP_MASK) == USB_RECIP_DEVICE) {
-                /* TODO: D1 - Remote Wakeup; D0 - Self Powered */
+                /* Assume that device is bus powered for now. */
+                *((u16 *)req->buf) = _udc->remote_wakeup << 1;
                 retval = 0;
         } else if ((setup->bRequestType & USB_RECIP_MASK) \
                    == USB_RECIP_ENDPOINT) {
@@ -1730,28 +1774,48 @@ __acquires(mEp->lock)
 }
 
 /**
+ * isr_setup_status_complete: setup_status request complete function
+ * @ep:  endpoint
+ * @req: request handled
+ *
+ * Caller must release lock. Put the port in test mode if test mode
+ * feature is selected.
+ */
+static void
+isr_setup_status_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct ci13xxx *udc = req->context;
+        unsigned long flags;
+
+        trace("%p, %p", ep, req);
+
+        spin_lock_irqsave(udc->lock, flags);
+        if (udc->test_mode)
+                hw_port_test_set(udc->test_mode);
+        spin_unlock_irqrestore(udc->lock, flags);
+}
+
+/**
  * isr_setup_status_phase: queues the status phase of a setup transation
- * @mEp: endpoint
+ * @udc: udc struct
  *
  * This function returns an error code
  */
-static int isr_setup_status_phase(struct ci13xxx_ep *mEp)
+static int isr_setup_status_phase(struct ci13xxx *udc)
 __releases(mEp->lock)
 __acquires(mEp->lock)
 {
         int retval;
+        struct ci13xxx_ep *mEp;
 
-        trace("%p", mEp);
-
-        /* mEp is always valid & configured */
-
-        if (mEp->type == USB_ENDPOINT_XFER_CONTROL)
-                mEp->dir = (mEp->dir == TX) ? RX : TX;
+        trace("%p", udc);
 
-        mEp->status->no_interrupt = 1;
+        mEp = (udc->ep0_dir == TX) ? &udc->ep0out : &udc->ep0in;
+        udc->status->context = udc;
+        udc->status->complete = isr_setup_status_complete;
 
         spin_unlock(mEp->lock);
-        retval = usb_ep_queue(&mEp->ep, mEp->status, GFP_ATOMIC);
+        retval = usb_ep_queue(&mEp->ep, udc->status, GFP_ATOMIC);
         spin_lock(mEp->lock);
 
         return retval;
@@ -1768,40 +1832,37 @@ static int isr_tr_complete_low(struct ci13xxx_ep *mEp)
 __releases(mEp->lock)
 __acquires(mEp->lock)
 {
-        struct ci13xxx_req *mReq;
-        int retval;
+        struct ci13xxx_req *mReq, *mReqTemp;
+        struct ci13xxx_ep *mEpTemp = mEp;
+        int uninitialized_var(retval);
 
         trace("%p", mEp);
 
-        if (list_empty(&mEp->qh[mEp->dir].queue))
+        if (list_empty(&mEp->qh.queue))
                 return -EINVAL;
 
-        /* pop oldest request */
-        mReq = list_entry(mEp->qh[mEp->dir].queue.next,
-                          struct ci13xxx_req, queue);
-        list_del_init(&mReq->queue);
-
-        retval = _hardware_dequeue(mEp, mReq);
-        if (retval < 0) {
-                dbg_event(_usb_addr(mEp), "DONE", retval);
-                goto done;
-        }
-
-        dbg_done(_usb_addr(mEp), mReq->ptr->token, retval);
-
-        if (!mReq->req.no_interrupt && mReq->req.complete != NULL) {
-                spin_unlock(mEp->lock);
-                mReq->req.complete(&mEp->ep, &mReq->req);
-                spin_lock(mEp->lock);
+        list_for_each_entry_safe(mReq, mReqTemp, &mEp->qh.queue,
+                        queue) {
+                retval = _hardware_dequeue(mEp, mReq);
+                if (retval < 0)
+                        break;
+                list_del_init(&mReq->queue);
+                dbg_done(_usb_addr(mEp), mReq->ptr->token, retval);
+                if (mReq->req.complete != NULL) {
+                        spin_unlock(mEp->lock);
+                        if ((mEp->type == USB_ENDPOINT_XFER_CONTROL) &&
+                                        mReq->req.length)
+                                mEpTemp = &_udc->ep0in;
+                        mReq->req.complete(&mEpTemp->ep, &mReq->req);
+                        spin_lock(mEp->lock);
+                }
         }
 
-        if (!list_empty(&mEp->qh[mEp->dir].queue)) {
-                mReq = list_entry(mEp->qh[mEp->dir].queue.next,
-                                  struct ci13xxx_req, queue);
-                _hardware_enqueue(mEp, mReq);
-        }
+        if (retval == -EBUSY)
+                retval = 0;
+        if (retval < 0)
+                dbg_event(_usb_addr(mEp), "DONE", retval);
 
- done:
         return retval;
 }
 
@@ -1816,6 +1877,7 @@ __releases(udc->lock)
 __acquires(udc->lock)
 {
         unsigned i;
+        u8 tmode = 0;
 
         trace("%p", udc);
 
@@ -1826,19 +1888,17 @@ __acquires(udc->lock)
 
         for (i = 0; i < hw_ep_max; i++) {
                 struct ci13xxx_ep *mEp  = &udc->ci13xxx_ep[i];
-                int type, num, err = -EINVAL;
+                int type, num, dir, err = -EINVAL;
                 struct usb_ctrlrequest req;
 
-
                 if (mEp->desc == NULL)
                         continue;   /* not configured */
 
-                if ((mEp->dir == RX && hw_test_and_clear_complete(i)) ||
-                    (mEp->dir == TX && hw_test_and_clear_complete(i + 16))) {
+                if (hw_test_and_clear_complete(i)) {
                         err = isr_tr_complete_low(mEp);
                         if (mEp->type == USB_ENDPOINT_XFER_CONTROL) {
                                 if (err > 0)   /* needs status phase */
-                                        err = isr_setup_status_phase(mEp);
+                                        err = isr_setup_status_phase(udc);
                                 if (err < 0) {
                                         dbg_event(_usb_addr(mEp),
                                                   "ERROR", err);
@@ -1859,36 +1919,56 @@ __acquires(udc->lock)
                         continue;
                 }
 
+                /*
+                 * Flush data and handshake transactions of previous
+                 * setup packet.
+                 */
+                _ep_nuke(&udc->ep0out);
+                _ep_nuke(&udc->ep0in);
+
                 /* read_setup_packet */
                 do {
                         hw_test_and_set_setup_guard();
-                        memcpy(&req, &mEp->qh[RX].ptr->setup, sizeof(req));
+                        memcpy(&req, &mEp->qh.ptr->setup, sizeof(req));
                 } while (!hw_test_and_clear_setup_guard());
 
                 type = req.bRequestType;
 
-                mEp->dir = (type & USB_DIR_IN) ? TX : RX;
+                udc->ep0_dir = (type & USB_DIR_IN) ? TX : RX;
 
                 dbg_setup(_usb_addr(mEp), &req);
 
                 switch (req.bRequest) {
                 case USB_REQ_CLEAR_FEATURE:
-                        if (type != (USB_DIR_OUT|USB_RECIP_ENDPOINT) &&
-                            le16_to_cpu(req.wValue) != USB_ENDPOINT_HALT)
-                                goto delegate;
-                        if (req.wLength != 0)
-                                break;
-                        num  = le16_to_cpu(req.wIndex);
-                        num &= USB_ENDPOINT_NUMBER_MASK;
-                        if (!udc->ci13xxx_ep[num].wedge) {
-                                spin_unlock(udc->lock);
-                                err = usb_ep_clear_halt(
-                                        &udc->ci13xxx_ep[num].ep);
-                                spin_lock(udc->lock);
-                                if (err)
+                        if (type == (USB_DIR_OUT|USB_RECIP_ENDPOINT) &&
+                                        le16_to_cpu(req.wValue) ==
+                                        USB_ENDPOINT_HALT) {
+                                if (req.wLength != 0)
+                                        break;
+                                num  = le16_to_cpu(req.wIndex);
+                                dir = num & USB_ENDPOINT_DIR_MASK;
+                                num &= USB_ENDPOINT_NUMBER_MASK;
+                                if (dir) /* TX */
+                                        num += hw_ep_max/2;
+                                if (!udc->ci13xxx_ep[num].wedge) {
+                                        spin_unlock(udc->lock);
+                                        err = usb_ep_clear_halt(
+                                                &udc->ci13xxx_ep[num].ep);
+                                        spin_lock(udc->lock);
+                                        if (err)
+                                                break;
+                                }
+                                err = isr_setup_status_phase(udc);
+                        } else if (type == (USB_DIR_OUT|USB_RECIP_DEVICE) &&
+                                        le16_to_cpu(req.wValue) ==
+                                        USB_DEVICE_REMOTE_WAKEUP) {
+                                if (req.wLength != 0)
                                         break;
+                                udc->remote_wakeup = 0;
+                                err = isr_setup_status_phase(udc);
+                        } else {
+                                goto delegate;
                         }
-                        err = isr_setup_status_phase(mEp);
                         break;
                 case USB_REQ_GET_STATUS:
                         if (type != (USB_DIR_IN|USB_RECIP_DEVICE)   &&
@@ -1898,7 +1978,7 @@ __acquires(udc->lock)
                         if (le16_to_cpu(req.wLength) != 2 ||
                             le16_to_cpu(req.wValue)  != 0)
                                 break;
-                        err = isr_get_status_response(mEp, &req);
+                        err = isr_get_status_response(udc, &req);
                         break;
                 case USB_REQ_SET_ADDRESS:
                         if (type != (USB_DIR_OUT|USB_RECIP_DEVICE))
@@ -1909,28 +1989,59 @@ __acquires(udc->lock)
                         err = hw_usb_set_address((u8)le16_to_cpu(req.wValue));
                         if (err)
                                 break;
-                        err = isr_setup_status_phase(mEp);
+                        err = isr_setup_status_phase(udc);
                         break;
                 case USB_REQ_SET_FEATURE:
-                        if (type != (USB_DIR_OUT|USB_RECIP_ENDPOINT) &&
-                            le16_to_cpu(req.wValue) != USB_ENDPOINT_HALT)
-                                goto delegate;
-                        if (req.wLength != 0)
-                                break;
-                        num  = le16_to_cpu(req.wIndex);
-                        num &= USB_ENDPOINT_NUMBER_MASK;
+                        if (type == (USB_DIR_OUT|USB_RECIP_ENDPOINT) &&
+                                        le16_to_cpu(req.wValue) ==
+                                        USB_ENDPOINT_HALT) {
+                                if (req.wLength != 0)
+                                        break;
+                                num  = le16_to_cpu(req.wIndex);
+                                dir = num & USB_ENDPOINT_DIR_MASK;
+                                num &= USB_ENDPOINT_NUMBER_MASK;
+                                if (dir) /* TX */
+                                        num += hw_ep_max/2;
 
-                        spin_unlock(udc->lock);
-                        err = usb_ep_set_halt(&udc->ci13xxx_ep[num].ep);
-                        spin_lock(udc->lock);
-                        if (err)
-                                break;
-                        err = isr_setup_status_phase(mEp);
+                                spin_unlock(udc->lock);
+                                err = usb_ep_set_halt(&udc->ci13xxx_ep[num].ep);
+                                spin_lock(udc->lock);
+                                if (!err)
+                                        isr_setup_status_phase(udc);
+                        } else if (type == (USB_DIR_OUT|USB_RECIP_DEVICE)) {
+                                if (req.wLength != 0)
+                                        break;
+                                switch (le16_to_cpu(req.wValue)) {
+                                case USB_DEVICE_REMOTE_WAKEUP:
+                                        udc->remote_wakeup = 1;
+                                        err = isr_setup_status_phase(udc);
+                                        break;
+                                case USB_DEVICE_TEST_MODE:
+                                        tmode = le16_to_cpu(req.wIndex) >> 8;
+                                        switch (tmode) {
+                                        case TEST_J:
+                                        case TEST_K:
+                                        case TEST_SE0_NAK:
+                                        case TEST_PACKET:
+                                        case TEST_FORCE_EN:
+                                                udc->test_mode = tmode;
+                                                err = isr_setup_status_phase(
+                                                                udc);
+                                                break;
+                                        default:
+                                                break;
+                                        }
+                                default:
+                                        goto delegate;
+                                }
+                        } else {
+                                goto delegate;
+                        }
                         break;
                 default:
 delegate:
                         if (req.wLength == 0)   /* no data phase */
-                                mEp->dir = TX;
+                                udc->ep0_dir = TX;
 
                         spin_unlock(udc->lock);
                         err = udc->driver->setup(&udc->gadget, &req);
@@ -1961,7 +2072,7 @@ static int ep_enable(struct usb_ep *ep,
                      const struct usb_endpoint_descriptor *desc)
 {
         struct ci13xxx_ep *mEp = container_of(ep, struct ci13xxx_ep, ep);
-        int direction, retval = 0;
+        int retval = 0;
         unsigned long flags;
 
         trace("%p, %p", ep, desc);
@@ -1975,7 +2086,7 @@ static int ep_enable(struct usb_ep *ep,
 
         mEp->desc = desc;
 
-        if (!list_empty(&mEp->qh[mEp->dir].queue))
+        if (!list_empty(&mEp->qh.queue))
                 warn("enabling a non-empty endpoint!");
 
         mEp->dir  = usb_endpoint_dir_in(desc) ? TX : RX;
@@ -1984,30 +2095,28 @@ static int ep_enable(struct usb_ep *ep,
 
         mEp->ep.maxpacket = __constant_le16_to_cpu(desc->wMaxPacketSize);
 
-        direction = mEp->dir;
-        do {
-                dbg_event(_usb_addr(mEp), "ENABLE", 0);
+        dbg_event(_usb_addr(mEp), "ENABLE", 0);
 
-                mEp->qh[mEp->dir].ptr->cap = 0;
+        mEp->qh.ptr->cap = 0;
 
-                if (mEp->type == USB_ENDPOINT_XFER_CONTROL)
-                        mEp->qh[mEp->dir].ptr->cap |=  QH_IOS;
-                else if (mEp->type == USB_ENDPOINT_XFER_ISOC)
-                        mEp->qh[mEp->dir].ptr->cap &= ~QH_MULT;
-                else
-                        mEp->qh[mEp->dir].ptr->cap &= ~QH_ZLT;
+        if (mEp->type == USB_ENDPOINT_XFER_CONTROL)
+                mEp->qh.ptr->cap |=  QH_IOS;
+        else if (mEp->type == USB_ENDPOINT_XFER_ISOC)
+                mEp->qh.ptr->cap &= ~QH_MULT;
+        else
+                mEp->qh.ptr->cap &= ~QH_ZLT;
 
-                mEp->qh[mEp->dir].ptr->cap |=
-                        (mEp->ep.maxpacket << ffs_nr(QH_MAX_PKT)) & QH_MAX_PKT;
-                mEp->qh[mEp->dir].ptr->td.next |= TD_TERMINATE;   /* needed? */
+        mEp->qh.ptr->cap |=
+                (mEp->ep.maxpacket << ffs_nr(QH_MAX_PKT)) & QH_MAX_PKT;
+        mEp->qh.ptr->td.next |= TD_TERMINATE;   /* needed? */
 
+        /*
+         * Enable endpoints in the HW other than ep0 as ep0
+         * is always enabled
+         */
+        if (mEp->num)
                 retval |= hw_ep_enable(mEp->num, mEp->dir, mEp->type);
 
-                if (mEp->type == USB_ENDPOINT_XFER_CONTROL)
-                        mEp->dir = (mEp->dir == TX) ? RX : TX;
-
-        } while (mEp->dir != direction);
-
         spin_unlock_irqrestore(mEp->lock, flags);
         return retval;
 }
@@ -2061,7 +2170,6 @@ static struct usb_request *ep_alloc_request(struct usb_ep *ep, gfp_t gfp_flags)
 {
         struct ci13xxx_ep  *mEp  = container_of(ep, struct ci13xxx_ep, ep);
         struct ci13xxx_req *mReq = NULL;
-        unsigned long flags;
 
         trace("%p, %i", ep, gfp_flags);
 
@@ -2070,8 +2178,6 @@ static struct usb_request *ep_alloc_request(struct usb_ep *ep, gfp_t gfp_flags)
                 return NULL;
         }
 
-        spin_lock_irqsave(mEp->lock, flags);
-
         mReq = kzalloc(sizeof(struct ci13xxx_req), gfp_flags);
         if (mReq != NULL) {
                 INIT_LIST_HEAD(&mReq->queue);
@@ -2086,8 +2192,6 @@ static struct usb_request *ep_alloc_request(struct usb_ep *ep, gfp_t gfp_flags)
 
         dbg_event(_usb_addr(mEp), "ALLOC", mReq == NULL);
 
-        spin_unlock_irqrestore(mEp->lock, flags);
-
         return (mReq == NULL) ? NULL : &mReq->req;
 }
 
@@ -2143,11 +2247,15 @@ static int ep_queue(struct usb_ep *ep, struct usb_request *req,
 
         spin_lock_irqsave(mEp->lock, flags);
 
-        if (mEp->type == USB_ENDPOINT_XFER_CONTROL &&
-            !list_empty(&mEp->qh[mEp->dir].queue)) {
-                _ep_nuke(mEp);
-                retval = -EOVERFLOW;
-                warn("endpoint ctrl %X nuked", _usb_addr(mEp));
+        if (mEp->type == USB_ENDPOINT_XFER_CONTROL) {
+                if (req->length)
+                        mEp = (_udc->ep0_dir == RX) ?
+                                &_udc->ep0out : &_udc->ep0in;
+                if (!list_empty(&mEp->qh.queue)) {
+                        _ep_nuke(mEp);
+                        retval = -EOVERFLOW;
+                        warn("endpoint ctrl %X nuked", _usb_addr(mEp));
+                }
         }
 
         /* first nuke then test link, e.g. previous status has not sent */
@@ -2157,8 +2265,8 @@ static int ep_queue(struct usb_ep *ep, struct usb_request *req,
                 goto done;
         }
 
-        if (req->length > (4 * PAGE_SIZE)) {
-                req->length = (4 * PAGE_SIZE);
+        if (req->length > (4 * CI13XXX_PAGE_SIZE)) {
+                req->length = (4 * CI13XXX_PAGE_SIZE);
                 retval = -EMSGSIZE;
                 warn("request length truncated");
         }
@@ -2168,13 +2276,15 @@ static int ep_queue(struct usb_ep *ep, struct usb_request *req,
         /* push request */
         mReq->req.status = -EINPROGRESS;
         mReq->req.actual = 0;
-        list_add_tail(&mReq->queue, &mEp->qh[mEp->dir].queue);
 
         retval = _hardware_enqueue(mEp, mReq);
-        if (retval == -EALREADY || retval == -EBUSY) {
+
+        if (retval == -EALREADY) {
                 dbg_event(_usb_addr(mEp), "QUEUE", retval);
                 retval = 0;
         }
+        if (!retval)
+                list_add_tail(&mReq->queue, &mEp->qh.queue);
 
  done:
         spin_unlock_irqrestore(mEp->lock, flags);
@@ -2194,22 +2304,28 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
 
         trace("%p, %p", ep, req);
 
-        if (ep == NULL || req == NULL || mEp->desc == NULL ||
-            list_empty(&mReq->queue)  || list_empty(&mEp->qh[mEp->dir].queue))
+        if (ep == NULL || req == NULL || mReq->req.status != -EALREADY ||
+                mEp->desc == NULL || list_empty(&mReq->queue) ||
+                list_empty(&mEp->qh.queue))
                 return -EINVAL;
 
         spin_lock_irqsave(mEp->lock, flags);
 
         dbg_event(_usb_addr(mEp), "DEQUEUE", 0);
 
-        if (mReq->req.status == -EALREADY)
-                _hardware_dequeue(mEp, mReq);
+        hw_ep_flush(mEp->num, mEp->dir);
 
         /* pop request */
         list_del_init(&mReq->queue);
+        if (mReq->map) {
+                dma_unmap_single(mEp->device, mReq->req.dma, mReq->req.length,
+                                 mEp->dir ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+                mReq->req.dma = 0;
+                mReq->map     = 0;
+        }
         req->status = -ECONNRESET;
 
-        if (!mReq->req.no_interrupt && mReq->req.complete != NULL) {
+        if (mReq->req.complete != NULL) {
                 spin_unlock(mEp->lock);
                 mReq->req.complete(&mEp->ep, &mReq->req);
                 spin_lock(mEp->lock);
@@ -2240,7 +2356,7 @@ static int ep_set_halt(struct usb_ep *ep, int value)
 #ifndef STALL_IN
         /* g_file_storage MS compliant but g_zero fails chapter 9 compliance */
         if (value && mEp->type == USB_ENDPOINT_XFER_BULK && mEp->dir == TX &&
-            !list_empty(&mEp->qh[mEp->dir].queue)) {
+            !list_empty(&mEp->qh.queue)) {
                 spin_unlock_irqrestore(mEp->lock, flags);
                 return -EAGAIN;
         }
@@ -2332,30 +2448,104 @@ static const struct usb_ep_ops usb_ep_ops = {
 /******************************************************************************
  * GADGET block
  *****************************************************************************/
+static int ci13xxx_vbus_session(struct usb_gadget *_gadget, int is_active)
+{
+        struct ci13xxx *udc = container_of(_gadget, struct ci13xxx, gadget);
+        unsigned long flags;
+        int gadget_ready = 0;
+
+        if (!(udc->udc_driver->flags & CI13XXX_PULLUP_ON_VBUS))
+                return -EOPNOTSUPP;
+
+        spin_lock_irqsave(udc->lock, flags);
+        udc->vbus_active = is_active;
+        if (udc->driver)
+                gadget_ready = 1;
+        spin_unlock_irqrestore(udc->lock, flags);
+
+        if (gadget_ready) {
+                if (is_active) {
+                        pm_runtime_get_sync(&_gadget->dev);
+                        hw_device_reset(udc);
+                        hw_device_state(udc->ep0out.qh.dma);
+                } else {
+                        hw_device_state(0);
+                        if (udc->udc_driver->notify_event)
+                                udc->udc_driver->notify_event(udc,
+                                CI13XXX_CONTROLLER_STOPPED_EVENT);
+                        _gadget_stop_activity(&udc->gadget);
+                        pm_runtime_put_sync(&_gadget->dev);
+                }
+        }
+
+        return 0;
+}
+
+static int ci13xxx_wakeup(struct usb_gadget *_gadget)
+{
+        struct ci13xxx *udc = container_of(_gadget, struct ci13xxx, gadget);
+        unsigned long flags;
+        int ret = 0;
+
+        trace();
+
+        spin_lock_irqsave(udc->lock, flags);
+        if (!udc->remote_wakeup) {
+                ret = -EOPNOTSUPP;
+                dbg_trace("remote wakeup feature is not enabled\n");
+                goto out;
+        }
+        if (!hw_cread(CAP_PORTSC, PORTSC_SUSP)) {
+                ret = -EINVAL;
+                dbg_trace("port is not suspended\n");
+                goto out;
+        }
+        hw_cwrite(CAP_PORTSC, PORTSC_FPR, PORTSC_FPR);
+out:
+        spin_unlock_irqrestore(udc->lock, flags);
+        return ret;
+}
+
+static int ci13xxx_vbus_draw(struct usb_gadget *_gadget, unsigned mA)
+{
+        struct ci13xxx *udc = container_of(_gadget, struct ci13xxx, gadget);
+
+        if (udc->transceiver)
+                return otg_set_power(udc->transceiver, mA);
+        return -ENOTSUPP;
+}
+
 /**
  * Device operations part of the API to the USB controller hardware,
  * which don't involve endpoints (or i/o)
  * Check  "usb_gadget.h" for details
  */
-static const struct usb_gadget_ops usb_gadget_ops;
+static const struct usb_gadget_ops usb_gadget_ops = {
+        .vbus_session   = ci13xxx_vbus_session,
+        .wakeup         = ci13xxx_wakeup,
+        .vbus_draw      = ci13xxx_vbus_draw,
+};
 
 /**
- * usb_gadget_register_driver: register a gadget driver
+ * usb_gadget_probe_driver: register a gadget driver
+ * @driver: the driver being registered
+ * @bind: the driver's bind callback
  *
- * Check usb_gadget_register_driver() at "usb_gadget.h" for details
- * Interrupts are enabled here
+ * Check usb_gadget_probe_driver() at <linux/usb/gadget.h> for details.
+ * Interrupts are enabled here.
  */
-int usb_gadget_register_driver(struct usb_gadget_driver *driver)
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
 {
         struct ci13xxx *udc = _udc;
-        unsigned long i, k, flags;
+        unsigned long flags;
+        int i, j;
         int retval = -ENOMEM;
 
         trace("%p", driver);
 
         if (driver             == NULL ||
-            driver->bind       == NULL ||
-            driver->unbind     == NULL ||
+            bind               == NULL ||
             driver->setup      == NULL ||
             driver->disconnect == NULL ||
             driver->suspend    == NULL ||
@@ -2369,13 +2559,13 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
         /* alloc resources */
         udc->qh_pool = dma_pool_create("ci13xxx_qh", &udc->gadget.dev,
                                        sizeof(struct ci13xxx_qh),
-                                       64, PAGE_SIZE);
+                                       64, CI13XXX_PAGE_SIZE);
         if (udc->qh_pool == NULL)
                 return -ENOMEM;
 
         udc->td_pool = dma_pool_create("ci13xxx_td", &udc->gadget.dev,
                                        sizeof(struct ci13xxx_td),
-                                       64, PAGE_SIZE);
+                                       64, CI13XXX_PAGE_SIZE);
         if (udc->td_pool == NULL) {
                 dma_pool_destroy(udc->qh_pool);
                 udc->qh_pool = NULL;
@@ -2386,68 +2576,88 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
 
         info("hw_ep_max = %d", hw_ep_max);
 
-        udc->driver = driver;
-        udc->gadget.ops        = NULL;
         udc->gadget.dev.driver = NULL;
 
         retval = 0;
-        for (i = 0; i < hw_ep_max; i++) {
-                struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[i];
-
-                scnprintf(mEp->name, sizeof(mEp->name), "ep%i", (int)i);
-
-                mEp->lock         = udc->lock;
-                mEp->device       = &udc->gadget.dev;
-                mEp->td_pool      = udc->td_pool;
-
-                mEp->ep.name      = mEp->name;
-                mEp->ep.ops       = &usb_ep_ops;
-                mEp->ep.maxpacket = CTRL_PAYLOAD_MAX;
-
-                /* this allocation cannot be random */
-                for (k = RX; k <= TX; k++) {
-                        INIT_LIST_HEAD(&mEp->qh[k].queue);
-                        mEp->qh[k].ptr = dma_pool_alloc(udc->qh_pool,
-                                                        GFP_KERNEL,
-                                                        &mEp->qh[k].dma);
-                        if (mEp->qh[k].ptr == NULL)
+        for (i = 0; i < hw_ep_max/2; i++) {
+                for (j = RX; j <= TX; j++) {
+                        int k = i + j * hw_ep_max/2;
+                        struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[k];
+
+                        scnprintf(mEp->name, sizeof(mEp->name), "ep%i%s", i,
+                                        (j == TX)  ? "in" : "out");
+
+                        mEp->lock         = udc->lock;
+                        mEp->device       = &udc->gadget.dev;
+                        mEp->td_pool      = udc->td_pool;
+
+                        mEp->ep.name      = mEp->name;
+                        mEp->ep.ops       = &usb_ep_ops;
+                        mEp->ep.maxpacket = CTRL_PAYLOAD_MAX;
+
+                        INIT_LIST_HEAD(&mEp->qh.queue);
+                        spin_unlock_irqrestore(udc->lock, flags);
+                        mEp->qh.ptr = dma_pool_alloc(udc->qh_pool, GFP_KERNEL,
+                                        &mEp->qh.dma);
+                        spin_lock_irqsave(udc->lock, flags);
+                        if (mEp->qh.ptr == NULL)
                                 retval = -ENOMEM;
                         else
-                                memset(mEp->qh[k].ptr, 0,
-                                       sizeof(*mEp->qh[k].ptr));
-                }
-                if (i == 0)
-                        udc->gadget.ep0 = &mEp->ep;
-                else
+                                memset(mEp->qh.ptr, 0, sizeof(*mEp->qh.ptr));
+
+                        /* skip ep0 out and in endpoints */
+                        if (i == 0)
+                                continue;
+
                         list_add_tail(&mEp->ep.ep_list, &udc->gadget.ep_list);
+                }
         }
         if (retval)
                 goto done;
+        spin_unlock_irqrestore(udc->lock, flags);
+        retval = usb_ep_enable(&udc->ep0out.ep, &ctrl_endpt_out_desc);
+        if (retval)
+                return retval;
+        retval = usb_ep_enable(&udc->ep0in.ep, &ctrl_endpt_in_desc);
+        if (retval)
+                return retval;
+        spin_lock_irqsave(udc->lock, flags);
 
+        udc->gadget.ep0 = &udc->ep0in.ep;
         /* bind gadget */
         driver->driver.bus     = NULL;
-        udc->gadget.ops        = &usb_gadget_ops;
         udc->gadget.dev.driver = &driver->driver;
 
         spin_unlock_irqrestore(udc->lock, flags);
-        retval = driver->bind(&udc->gadget);                /* MAY SLEEP */
+        retval = bind(&udc->gadget);                /* MAY SLEEP */
         spin_lock_irqsave(udc->lock, flags);
 
         if (retval) {
-                udc->gadget.ops        = NULL;
                 udc->gadget.dev.driver = NULL;
                 goto done;
         }
 
-        retval = hw_device_state(udc->ci13xxx_ep[0].qh[RX].dma);
+        udc->driver = driver;
+        pm_runtime_get_sync(&udc->gadget.dev);
+        if (udc->udc_driver->flags & CI13XXX_PULLUP_ON_VBUS) {
+                if (udc->vbus_active) {
+                        if (udc->udc_driver->flags & CI13XXX_REGS_SHARED)
+                                hw_device_reset(udc);
+                } else {
+                        pm_runtime_put_sync(&udc->gadget.dev);
+                        goto done;
+                }
+        }
+
+        retval = hw_device_state(udc->ep0out.qh.dma);
+        if (retval)
+                pm_runtime_put_sync(&udc->gadget.dev);
 
  done:
         spin_unlock_irqrestore(udc->lock, flags);
-        if (retval)
-                usb_gadget_unregister_driver(driver);
         return retval;
 }
-EXPORT_SYMBOL(usb_gadget_register_driver);
+EXPORT_SYMBOL(usb_gadget_probe_driver);
 
 /**
  * usb_gadget_unregister_driver: unregister a gadget driver
@@ -2457,12 +2667,11 @@ EXPORT_SYMBOL(usb_gadget_register_driver);
 int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
 {
         struct ci13xxx *udc = _udc;
-        unsigned long i, k, flags;
+        unsigned long i, flags;
 
         trace("%p", driver);
 
         if (driver             == NULL ||
-            driver->bind       == NULL ||
             driver->unbind     == NULL ||
             driver->setup      == NULL ||
             driver->disconnect == NULL ||
@@ -2473,35 +2682,35 @@ int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
 
         spin_lock_irqsave(udc->lock, flags);
 
-        hw_device_state(0);
-
-        /* unbind gadget */
-        if (udc->gadget.ops != NULL) {
+        if (!(udc->udc_driver->flags & CI13XXX_PULLUP_ON_VBUS) ||
+                        udc->vbus_active) {
+                hw_device_state(0);
+                if (udc->udc_driver->notify_event)
+                        udc->udc_driver->notify_event(udc,
+                        CI13XXX_CONTROLLER_STOPPED_EVENT);
                 _gadget_stop_activity(&udc->gadget);
+                pm_runtime_put(&udc->gadget.dev);
+        }
 
-                spin_unlock_irqrestore(udc->lock, flags);
-                driver->unbind(&udc->gadget);               /* MAY SLEEP */
-                spin_lock_irqsave(udc->lock, flags);
+        /* unbind gadget */
+        spin_unlock_irqrestore(udc->lock, flags);
+        driver->unbind(&udc->gadget);               /* MAY SLEEP */
+        spin_lock_irqsave(udc->lock, flags);
 
-                udc->gadget.ops        = NULL;
-                udc->gadget.dev.driver = NULL;
-        }
+        udc->gadget.dev.driver = NULL;
 
         /* free resources */
         for (i = 0; i < hw_ep_max; i++) {
                 struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[i];
 
-                if (i == 0)
-                        udc->gadget.ep0 = NULL;
-                else if (!list_empty(&mEp->ep.ep_list))
+                if (!list_empty(&mEp->ep.ep_list))
                         list_del_init(&mEp->ep.ep_list);
 
-                for (k = RX; k <= TX; k++)
-                        if (mEp->qh[k].ptr != NULL)
-                                dma_pool_free(udc->qh_pool,
-                                              mEp->qh[k].ptr, mEp->qh[k].dma);
+                if (mEp->qh.ptr != NULL)
+                        dma_pool_free(udc->qh_pool, mEp->qh.ptr, mEp->qh.dma);
         }
 
+        udc->gadget.ep0 = NULL;
         udc->driver = NULL;
 
         spin_unlock_irqrestore(udc->lock, flags);
@@ -2542,6 +2751,14 @@ static irqreturn_t udc_irq(void)
         }
 
         spin_lock(udc->lock);
+
+        if (udc->udc_driver->flags & CI13XXX_REGS_SHARED) {
+                if (hw_cread(CAP_USBMODE, USBMODE_CM) !=
+                                USBMODE_CM_DEVICE) {
+                        spin_unlock(udc->lock);
+                        return IRQ_NONE;
+                }
+        }
         intr = hw_test_and_clear_intr_active();
         if (intr) {
                 isr_statistics.hndl.buf[isr_statistics.hndl.idx++] = intr;
@@ -2557,6 +2774,12 @@ static irqreturn_t udc_irq(void)
                         isr_statistics.pci++;
                         udc->gadget.speed = hw_port_is_high_speed() ?
                                 USB_SPEED_HIGH : USB_SPEED_FULL;
+                        if (udc->suspended) {
+                                spin_unlock(udc->lock);
+                                udc->driver->resume(&udc->gadget);
+                                spin_lock(udc->lock);
+                                udc->suspended = 0;
+                        }
                 }
                 if (USBi_UEI & intr)
                         isr_statistics.uei++;
@@ -2564,8 +2787,15 @@ static irqreturn_t udc_irq(void)
                         isr_statistics.ui++;
                         isr_tr_complete_handler(udc);
                 }
-                if (USBi_SLI & intr)
+                if (USBi_SLI & intr) {
+                        if (udc->gadget.speed != USB_SPEED_UNKNOWN) {
+                                udc->suspended = 1;
+                                spin_unlock(udc->lock);
+                                udc->driver->suspend(&udc->gadget);
+                                spin_lock(udc->lock);
+                        }
                         isr_statistics.sli++;
+                }
                 retval = IRQ_HANDLED;
         } else {
                 isr_statistics.none++;
@@ -2600,14 +2830,16 @@ static void udc_release(struct device *dev)
  * No interrupts active, the IRQ has not been requested yet
  * Kernel assumes 32-bit DMA operations by default, no need to dma_set_mask
  */
-static int udc_probe(struct device *dev, void __iomem *regs, const char *name)
+static int udc_probe(struct ci13xxx_udc_driver *driver, struct device *dev,
+                void __iomem *regs)
 {
         struct ci13xxx *udc;
         int retval = 0;
 
         trace("%p, %p, %p", dev, regs, name);
 
-        if (dev == NULL || regs == NULL || name == NULL)
+        if (dev == NULL || regs == NULL || driver == NULL ||
+                        driver->name == NULL)
                 return -EINVAL;
 
         udc = kzalloc(sizeof(struct ci13xxx), GFP_KERNEL);
@@ -2615,42 +2847,77 @@ static int udc_probe(struct device *dev, void __iomem *regs, const char *name)
                 return -ENOMEM;
 
         udc->lock = &udc_lock;
+        udc->regs = regs;
+        udc->udc_driver = driver;
 
-        retval = hw_device_reset(regs);
-        if (retval)
-                goto done;
-
-        udc->gadget.ops          = NULL;
+        udc->gadget.ops          = &usb_gadget_ops;
         udc->gadget.speed        = USB_SPEED_UNKNOWN;
         udc->gadget.is_dualspeed = 1;
         udc->gadget.is_otg       = 0;
-        udc->gadget.name         = name;
+        udc->gadget.name         = driver->name;
 
         INIT_LIST_HEAD(&udc->gadget.ep_list);
         udc->gadget.ep0 = NULL;
 
         dev_set_name(&udc->gadget.dev, "gadget");
         udc->gadget.dev.dma_mask = dev->dma_mask;
+        udc->gadget.dev.coherent_dma_mask = dev->coherent_dma_mask;
         udc->gadget.dev.parent   = dev;
         udc->gadget.dev.release  = udc_release;
 
+        retval = hw_device_init(regs);
+        if (retval < 0)
+                goto free_udc;
+
+        udc->transceiver = otg_get_transceiver();
+
+        if (udc->udc_driver->flags & CI13XXX_REQUIRE_TRANSCEIVER) {
+                if (udc->transceiver == NULL) {
+                        retval = -ENODEV;
+                        goto free_udc;
+                }
+        }
+
+        if (!(udc->udc_driver->flags & CI13XXX_REGS_SHARED)) {
+                retval = hw_device_reset(udc);
+                if (retval)
+                        goto put_transceiver;
+        }
+
         retval = device_register(&udc->gadget.dev);
-        if (retval)
-                goto done;
+        if (retval) {
+                put_device(&udc->gadget.dev);
+                goto put_transceiver;
+        }
 
 #ifdef CONFIG_USB_GADGET_DEBUG_FILES
         retval = dbg_create_files(&udc->gadget.dev);
 #endif
-        if (retval) {
-                device_unregister(&udc->gadget.dev);
-                goto done;
+        if (retval)
+                goto unreg_device;
+
+        if (udc->transceiver) {
+                retval = otg_set_peripheral(udc->transceiver, &udc->gadget);
+                if (retval)
+                        goto remove_dbg;
         }
+        pm_runtime_no_callbacks(&udc->gadget.dev);
+        pm_runtime_enable(&udc->gadget.dev);
 
         _udc = udc;
         return retval;
 
- done:
         err("error = %i", retval);
+remove_dbg:
+#ifdef CONFIG_USB_GADGET_DEBUG_FILES
+        dbg_remove_files(&udc->gadget.dev);
+#endif
+unreg_device:
+        device_unregister(&udc->gadget.dev);
+put_transceiver:
+        if (udc->transceiver)
+                otg_put_transceiver(udc->transceiver);
+free_udc:
         kfree(udc);
         _udc = NULL;
         return retval;
@@ -2670,6 +2937,10 @@ static void udc_remove(void)
                 return;
         }
 
+        if (udc->transceiver) {
+                otg_set_peripheral(udc->transceiver, &udc->gadget);
+                otg_put_transceiver(udc->transceiver);
+        }
 #ifdef CONFIG_USB_GADGET_DEBUG_FILES
         dbg_remove_files(&udc->gadget.dev);
 #endif
@@ -2678,156 +2949,3 @@ static void udc_remove(void)
         kfree(udc);
         _udc = NULL;
 }
-
-/******************************************************************************
- * PCI block
- *****************************************************************************/
-/**
- * ci13xxx_pci_irq: interrut handler
- * @irq:  irq number
- * @pdev: USB Device Controller interrupt source
- *
- * This function returns IRQ_HANDLED if the IRQ has been handled
- * This is an ISR don't trace, use attribute interface instead
- */
-static irqreturn_t ci13xxx_pci_irq(int irq, void *pdev)
-{
-        if (irq == 0) {
-                dev_err(&((struct pci_dev *)pdev)->dev, "Invalid IRQ0 usage!");
-                return IRQ_HANDLED;
-        }
-        return udc_irq();
-}
-
-/**
- * ci13xxx_pci_probe: PCI probe
- * @pdev: USB device controller being probed
- * @id:   PCI hotplug ID connecting controller to UDC framework
- *
- * This function returns an error code
- * Allocates basic PCI resources for this USB device controller, and then
- * invokes the udc_probe() method to start the UDC associated with it
- */
-static int __devinit ci13xxx_pci_probe(struct pci_dev *pdev,
-                                       const struct pci_device_id *id)
-{
-        void __iomem *regs = NULL;
-        int retval = 0;
-
-        if (id == NULL)
-                return -EINVAL;
-
-        retval = pci_enable_device(pdev);
-        if (retval)
-                goto done;
-
-        if (!pdev->irq) {
-                dev_err(&pdev->dev, "No IRQ, check BIOS/PCI setup!");
-                retval = -ENODEV;
-                goto disable_device;
-        }
-
-        retval = pci_request_regions(pdev, UDC_DRIVER_NAME);
-        if (retval)
-                goto disable_device;
-
-        /* BAR 0 holds all the registers */
-        regs = pci_iomap(pdev, 0, 0);
-        if (!regs) {
-                dev_err(&pdev->dev, "Error mapping memory!");
-                retval = -EFAULT;
-                goto release_regions;
-        }
-        pci_set_drvdata(pdev, (__force void *)regs);
-
-        pci_set_master(pdev);
-        pci_try_set_mwi(pdev);
-
-        retval = udc_probe(&pdev->dev, regs, UDC_DRIVER_NAME);
-        if (retval)
-                goto iounmap;
-
-        /* our device does not have MSI capability */
-
-        retval = request_irq(pdev->irq, ci13xxx_pci_irq, IRQF_SHARED,
-                             UDC_DRIVER_NAME, pdev);
-        if (retval)
-                goto gadget_remove;
-
-        return 0;
-
- gadget_remove:
-        udc_remove();
- iounmap:
-        pci_iounmap(pdev, regs);
- release_regions:
-        pci_release_regions(pdev);
- disable_device:
-        pci_disable_device(pdev);
- done:
-        return retval;
-}
-
-/**
- * ci13xxx_pci_remove: PCI remove
- * @pdev: USB Device Controller being removed
- *
- * Reverses the effect of ci13xxx_pci_probe(),
- * first invoking the udc_remove() and then releases
- * all PCI resources allocated for this USB device controller
- */
-static void __devexit ci13xxx_pci_remove(struct pci_dev *pdev)
-{
-        free_irq(pdev->irq, pdev);
-        udc_remove();
-        pci_iounmap(pdev, (__force void __iomem *)pci_get_drvdata(pdev));
-        pci_release_regions(pdev);
-        pci_disable_device(pdev);
-}
-
-/**
- * PCI device table
- * PCI device structure
- *
- * Check "pci.h" for details
- */
-static DEFINE_PCI_DEVICE_TABLE(ci13xxx_pci_id_table) = {
-        { PCI_DEVICE(0x153F, 0x1004) },
-        { PCI_DEVICE(0x153F, 0x1006) },
-        { 0, 0, 0, 0, 0, 0, 0 /* end: all zeroes */ }
-};
-MODULE_DEVICE_TABLE(pci, ci13xxx_pci_id_table);
-
-static struct pci_driver ci13xxx_pci_driver = {
-        .name         = UDC_DRIVER_NAME,
-        .id_table     = ci13xxx_pci_id_table,
-        .probe        = ci13xxx_pci_probe,
-        .remove       = __devexit_p(ci13xxx_pci_remove),
-};
-
-/**
- * ci13xxx_pci_init: module init
- *
- * Driver load
- */
-static int __init ci13xxx_pci_init(void)
-{
-        return pci_register_driver(&ci13xxx_pci_driver);
-}
-module_init(ci13xxx_pci_init);
-
-/**
- * ci13xxx_pci_exit: module exit
- *
- * Driver unload
- */
-static void __exit ci13xxx_pci_exit(void)
-{
-        pci_unregister_driver(&ci13xxx_pci_driver);
-}
-module_exit(ci13xxx_pci_exit);
-
-MODULE_AUTHOR("MIPS - David Lopo <dlopo@chipidea.mips.com>");
-MODULE_DESCRIPTION("MIPS CI13XXX USB Peripheral Controller");
-MODULE_LICENSE("GPL");
-MODULE_VERSION("June 2008");
diff --git a/drivers/usb/gadget/ci13xxx_udc.h b/drivers/usb/gadget/ci13xxx_udc.h
index 4026e9cede34..23707775cb43 100644
--- a/drivers/usb/gadget/ci13xxx_udc.h
+++ b/drivers/usb/gadget/ci13xxx_udc.h
@@ -19,7 +19,8 @@
 /******************************************************************************
  * DEFINE
  *****************************************************************************/
-#define ENDPT_MAX          (16)
+#define CI13XXX_PAGE_SIZE  4096ul /* page size for TD's */
+#define ENDPT_MAX          (32)
 #define CTRL_PAYLOAD_MAX   (64)
 #define RX        (0)  /* similar to USB_DIR_OUT but can be used as an index */
 #define TX        (1)  /* similar to USB_DIR_IN  but can be used as an index */
@@ -32,6 +33,7 @@ struct ci13xxx_td {
         /* 0 */
         u32 next;
 #define TD_TERMINATE          BIT(0)
+#define TD_ADDR_MASK          (0xFFFFFFEUL << 5)
         /* 1 */
         u32 token;
 #define TD_STATUS             (0x00FFUL <<  0)
@@ -73,6 +75,8 @@ struct ci13xxx_req {
         struct list_head     queue;
         struct ci13xxx_td   *ptr;
         dma_addr_t           dma;
+        struct ci13xxx_td   *zptr;
+        dma_addr_t           zdma;
 };
 
 /* Extension of usb_ep */
@@ -87,8 +91,7 @@ struct ci13xxx_ep {
                 struct list_head   queue;
                 struct ci13xxx_qh *ptr;
                 dma_addr_t         dma;
-        }                                      qh[2];
-        struct usb_request                    *status;
+        }                                      qh;
         int                                    wedge;
 
         /* global resources */
@@ -97,17 +100,43 @@ struct ci13xxx_ep {
         struct dma_pool                       *td_pool;
 };
 
+struct ci13xxx;
+struct ci13xxx_udc_driver {
+        const char      *name;
+        unsigned long    flags;
+#define CI13XXX_REGS_SHARED             BIT(0)
+#define CI13XXX_REQUIRE_TRANSCEIVER     BIT(1)
+#define CI13XXX_PULLUP_ON_VBUS          BIT(2)
+#define CI13XXX_DISABLE_STREAMING       BIT(3)
+
+#define CI13XXX_CONTROLLER_RESET_EVENT          0
+#define CI13XXX_CONTROLLER_STOPPED_EVENT        1
+        void    (*notify_event) (struct ci13xxx *udc, unsigned event);
+};
+
 /* CI13XXX UDC descriptor & global resources */
 struct ci13xxx {
         spinlock_t                *lock;      /* ctrl register bank access */
+        void __iomem              *regs;      /* registers address space */
 
         struct dma_pool           *qh_pool;   /* DMA pool for queue heads */
         struct dma_pool           *td_pool;   /* DMA pool for transfer descs */
+        struct usb_request        *status;    /* ep0 status request */
 
         struct usb_gadget          gadget;     /* USB slave device */
         struct ci13xxx_ep          ci13xxx_ep[ENDPT_MAX]; /* extended endpts */
+        u32                        ep0_dir;    /* ep0 direction */
+#define ep0out ci13xxx_ep[0]
+#define ep0in  ci13xxx_ep[16]
+        u8                         remote_wakeup; /* Is remote wakeup feature
+                                                        enabled by the host? */
+        u8                         suspended;  /* suspended by the host */
+        u8                         test_mode;  /* the selected test mode */
 
         struct usb_gadget_driver  *driver;     /* 3rd party gadget driver */
+        struct ci13xxx_udc_driver *udc_driver; /* device controller driver */
+        int                        vbus_active; /* is VBUS active */
+        struct otg_transceiver    *transceiver; /* Transceiver struct */
 };
 
 /******************************************************************************
@@ -130,6 +159,7 @@ struct ci13xxx {
 #define USBCMD_RS             BIT(0)
 #define USBCMD_RST            BIT(1)
 #define USBCMD_SUTW           BIT(13)
+#define USBCMD_ATDTW          BIT(14)
 
 /* USBSTS & USBINTR */
 #define USBi_UI               BIT(0)
@@ -143,6 +173,7 @@ struct ci13xxx {
 #define DEVICEADDR_USBADR     (0x7FUL << 25)
 
 /* PORTSC */
+#define PORTSC_FPR            BIT(6)
 #define PORTSC_SUSP           BIT(7)
 #define PORTSC_HSP            BIT(9)
 #define PORTSC_PTC            (0x0FUL << 16)
@@ -157,6 +188,7 @@ struct ci13xxx {
 #define    USBMODE_CM_DEVICE  (0x02UL <<  0)
 #define    USBMODE_CM_HOST    (0x03UL <<  0)
 #define USBMODE_SLOM          BIT(3)
+#define USBMODE_SDIS          BIT(4)
 
 /* ENDPTCTRL */
 #define ENDPTCTRL_RXS         BIT(0)
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 1160c55de7f2..5cbb1a41c223 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -24,6 +24,7 @@
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/device.h>
+#include <linux/utsname.h>
 
 #include <linux/usb/composite.h>
 
@@ -39,8 +40,9 @@
 #define USB_BUFSIZ      1024
 
 static struct usb_composite_driver *composite;
+static int (*composite_gadget_bind)(struct usb_composite_dev *cdev);
 
-/* Some systems will need runtime overrides for the  product identifers
+/* Some systems will need runtime overrides for the  product identifiers
  * published in the device descriptor, either numbers or strings or both.
  * String parameters are in UTF-8 (superset of ASCII's 7 bit characters).
  */
@@ -69,6 +71,8 @@ static char *iSerialNumber;
 module_param(iSerialNumber, charp, 0);
 MODULE_PARM_DESC(iSerialNumber, "SerialNumber string");
 
+static char composite_manufacturer[50];
+
 /*-------------------------------------------------------------------------*/
 
 /**
@@ -201,14 +205,14 @@ int usb_function_activate(struct usb_function *function)
  * usb_interface_id() is called from usb_function.bind() callbacks to
  * allocate new interface IDs.  The function driver will then store that
  * ID in interface, association, CDC union, and other descriptors.  It
- * will also handle any control requests targetted at that interface,
+ * will also handle any control requests targeted at that interface,
  * particularly changing its altsetting via set_alt().  There may
  * also be class-specific or vendor-specific requests to handle.
  *
  * All interface identifier should be allocated using this routine, to
  * ensure that for example different functions don't wrongly assign
  * different meanings to the same identifier.  Note that since interface
- * identifers are configuration-specific, functions used in more than
+ * identifiers are configuration-specific, functions used in more than
  * one configuration (or more than once in a given configuration) need
  * multiple versions of the relevant descriptors.
  *
@@ -457,12 +461,23 @@ static int set_config(struct usb_composite_dev *cdev,
                         reset_config(cdev);
                         goto done;
                 }
+
+                if (result == USB_GADGET_DELAYED_STATUS) {
+                        DBG(cdev,
+                         "%s: interface %d (%s) requested delayed status\n",
+                                        __func__, tmp, f->name);
+                        cdev->delayed_status++;
+                        DBG(cdev, "delayed_status count %d\n",
+                                        cdev->delayed_status);
+                }
         }
 
         /* when we return, be sure our power usage is valid */
         power = c->bMaxPower ? (2 * c->bMaxPower) : CONFIG_USB_GADGET_VBUS_DRAW;
 done:
         usb_gadget_vbus_draw(gadget, power);
+        if (result >= 0 && cdev->delayed_status)
+                result = USB_GADGET_DELAYED_STATUS;
         return result;
 }
 
@@ -470,18 +485,20 @@ done:
  * usb_add_config() - add a configuration to a device.
  * @cdev: wraps the USB gadget
  * @config: the configuration, with bConfigurationValue assigned
+ * @bind: the configuration's bind function
  * Context: single threaded during gadget setup
  *
- * One of the main tasks of a composite driver's bind() routine is to
+ * One of the main tasks of a composite @bind() routine is to
  * add each of the configurations it supports, using this routine.
  *
- * This function returns the value of the configuration's bind(), which
+ * This function returns the value of the configuration's @bind(), which
  * is zero for success else a negative errno value.  Binding configurations
  * assigns global resources including string IDs, and per-configuration
  * resources such as interface IDs and endpoints.
  */
 int usb_add_config(struct usb_composite_dev *cdev,
-                struct usb_configuration *config)
+                struct usb_configuration *config,
+                int (*bind)(struct usb_configuration *))
 {
         int                             status = -EINVAL;
         struct usb_configuration        *c;
@@ -490,7 +507,7 @@ int usb_add_config(struct usb_composite_dev *cdev,
                         config->bConfigurationValue,
                         config->label, config);
 
-        if (!config->bConfigurationValue || !config->bind)
+        if (!config->bConfigurationValue || !bind)
                 goto done;
 
         /* Prevent duplicate configuration identifiers */
@@ -507,7 +524,7 @@ int usb_add_config(struct usb_composite_dev *cdev,
         INIT_LIST_HEAD(&config->functions);
         config->next_interface_id = 0;
 
-        status = config->bind(config);
+        status = bind(config);
         if (status < 0) {
                 list_del(&config->list);
                 config->cdev = NULL;
@@ -533,7 +550,7 @@ int usb_add_config(struct usb_composite_dev *cdev,
                 }
         }
 
-        /* set_alt(), or next config->bind(), sets up
+        /* set_alt(), or next bind(), sets up
          * ep->driver_data as needed.
          */
         usb_ep_autoconfig_reset(cdev->gadget);
@@ -599,6 +616,7 @@ static int get_string(struct usb_composite_dev *cdev,
         struct usb_configuration        *c;
         struct usb_function             *f;
         int                             len;
+        const char                      *str;
 
         /* Yes, not only is USB's I18N support probably more than most
          * folk will ever care about ... also, it's all supported here.
@@ -638,9 +656,29 @@ static int get_string(struct usb_composite_dev *cdev,
                 return s->bLength;
         }
 
-        /* Otherwise, look up and return a specified string.  String IDs
-         * are device-scoped, so we look up each string table we're told
-         * about.  These lookups are infrequent; simpler-is-better here.
+        /* Otherwise, look up and return a specified string.  First
+         * check if the string has not been overridden.
+         */
+        if (cdev->manufacturer_override == id)
+                str = iManufacturer ?: composite->iManufacturer ?:
+                        composite_manufacturer;
+        else if (cdev->product_override == id)
+                str = iProduct ?: composite->iProduct;
+        else if (cdev->serial_override == id)
+                str = iSerialNumber;
+        else
+                str = NULL;
+        if (str) {
+                struct usb_gadget_strings strings = {
+                        .language = language,
+                        .strings  = &(struct usb_string) { 0xff, str }
+                };
+                return usb_gadget_get_string(&strings, 0xff, buf);
+        }
+
+        /* String IDs are device-scoped, so we look up each string
+         * table we're told about.  These lookups are infrequent;
+         * simpler-is-better here.
          */
         if (composite->strings) {
                 len = lookup_string(composite->strings, buf, language, id);
@@ -786,7 +824,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
          */
         req->zero = 0;
         req->complete = composite_setup_complete;
-        req->length = USB_BUFSIZ;
+        req->length = 0;
         gadget->ep0->driver_data = cdev;
 
         switch (ctrl->bRequest) {
@@ -860,7 +898,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
         case USB_REQ_SET_INTERFACE:
                 if (ctrl->bRequestType != USB_RECIP_INTERFACE)
                         goto unknown;
-                if (!cdev->config || w_index >= MAX_CONFIG_INTERFACES)
+                if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
                         break;
                 f = cdev->config->interface[intf];
                 if (!f)
@@ -868,11 +906,19 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
                 if (w_value && !f->set_alt)
                         break;
                 value = f->set_alt(f, w_index, w_value);
+                if (value == USB_GADGET_DELAYED_STATUS) {
+                        DBG(cdev,
+                         "%s: interface %d (%s) requested delayed status\n",
+                                        __func__, intf, f->name);
+                        cdev->delayed_status++;
+                        DBG(cdev, "delayed_status count %d\n",
+                                        cdev->delayed_status);
+                }
                 break;
         case USB_REQ_GET_INTERFACE:
                 if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE))
                         goto unknown;
-                if (!cdev->config || w_index >= MAX_CONFIG_INTERFACES)
+                if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
                         break;
                 f = cdev->config->interface[intf];
                 if (!f)
@@ -901,6 +947,8 @@ unknown:
                  */
                 switch (ctrl->bRequestType & USB_RECIP_MASK) {
                 case USB_RECIP_INTERFACE:
+                        if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
+                                break;
                         f = cdev->config->interface[intf];
                         break;
 
@@ -929,7 +977,7 @@ unknown:
         }
 
         /* respond with data transfer before status phase? */
-        if (value >= 0) {
+        if (value >= 0 && value != USB_GADGET_DELAYED_STATUS) {
                 req->length = value;
                 req->zero = value < w_length;
                 value = usb_ep_queue(gadget->ep0, req, GFP_ATOMIC);
@@ -938,6 +986,10 @@ unknown:
                         req->status = 0;
                         composite_setup_complete(gadget->ep0, req);
                 }
+        } else if (value == USB_GADGET_DELAYED_STATUS && w_length != 0) {
+                WARN(cdev,
+                        "%s: Delayed status not supported for w_length != 0",
+                        __func__);
         }
 
 done:
@@ -1019,32 +1071,23 @@ composite_unbind(struct usb_gadget *gadget)
                 kfree(cdev->req->buf);
                 usb_ep_free_request(gadget->ep0, cdev->req);
         }
+        device_remove_file(&gadget->dev, &dev_attr_suspended);
         kfree(cdev);
         set_gadget_data(gadget, NULL);
-        device_remove_file(&gadget->dev, &dev_attr_suspended);
         composite = NULL;
 }
 
-static void
-string_override_one(struct usb_gadget_strings *tab, u8 id, const char *s)
+static u8 override_id(struct usb_composite_dev *cdev, u8 *desc)
 {
-        struct usb_string               *str = tab->strings;
-
-        for (str = tab->strings; str->s; str++) {
-                if (str->id == id) {
-                        str->s = s;
-                        return;
-                }
+        if (!*desc) {
+                int ret = usb_string_id(cdev);
+                if (unlikely(ret < 0))
+                        WARNING(cdev, "failed to override string ID\n");
+                else
+                        *desc = ret;
         }
-}
 
-static void
-string_override(struct usb_gadget_strings **tab, u8 id, const char *s)
-{
-        while (*tab) {
-                string_override_one(*tab, id, s);
-                tab++;
-        }
+        return *desc;
 }
 
 static int composite_bind(struct usb_gadget *gadget)
@@ -1074,7 +1117,13 @@ static int composite_bind(struct usb_gadget *gadget)
         cdev->bufsiz = USB_BUFSIZ;
         cdev->driver = composite;
 
-        usb_gadget_set_selfpowered(gadget);
+        /*
+         * As per USB compliance update, a device that is actively drawing
+         * more than 100mA from USB must report itself as bus-powered in
+         * the GetStatus(DEVICE) call.
+         */
+        if (CONFIG_USB_GADGET_VBUS_DRAW <= USB_SELF_POWER_VBUS_MAX_DRAW)
+                usb_gadget_set_selfpowered(gadget);
 
         /* interface and string IDs start at zero via kzalloc.
          * we force endpoints to start unassigned; few controller
@@ -1082,38 +1131,53 @@ static int composite_bind(struct usb_gadget *gadget)
          */
         usb_ep_autoconfig_reset(cdev->gadget);
 
-        /* standardized runtime overrides for device ID data */
-        if (idVendor)
-                cdev->desc.idVendor = cpu_to_le16(idVendor);
-        if (idProduct)
-                cdev->desc.idProduct = cpu_to_le16(idProduct);
-        if (bcdDevice)
-                cdev->desc.bcdDevice = cpu_to_le16(bcdDevice);
-
         /* composite gadget needs to assign strings for whole device (like
          * serial number), register function drivers, potentially update
          * power state and consumption, etc
          */
-        status = composite->bind(cdev);
+        status = composite_gadget_bind(cdev);
         if (status < 0)
                 goto fail;
 
         cdev->desc = *composite->dev;
         cdev->desc.bMaxPacketSize0 = gadget->ep0->maxpacket;
 
-        /* strings can't be assigned before bind() allocates the
-         * releavnt identifiers
-         */
-        if (cdev->desc.iManufacturer && iManufacturer)
-                string_override(composite->strings,
-                        cdev->desc.iManufacturer, iManufacturer);
-        if (cdev->desc.iProduct && iProduct)
-                string_override(composite->strings,
-                        cdev->desc.iProduct, iProduct);
-        if (cdev->desc.iSerialNumber && iSerialNumber)
-                string_override(composite->strings,
-                        cdev->desc.iSerialNumber, iSerialNumber);
+        /* standardized runtime overrides for device ID data */
+        if (idVendor)
+                cdev->desc.idVendor = cpu_to_le16(idVendor);
+        if (idProduct)
+                cdev->desc.idProduct = cpu_to_le16(idProduct);
+        if (bcdDevice)
+                cdev->desc.bcdDevice = cpu_to_le16(bcdDevice);
+
+        /* string overrides */
+        if (iManufacturer || !cdev->desc.iManufacturer) {
+                if (!iManufacturer && !composite->iManufacturer &&
+                    !*composite_manufacturer)
+                        snprintf(composite_manufacturer,
+                                 sizeof composite_manufacturer,
+                                 "%s %s with %s",
+                                 init_utsname()->sysname,
+                                 init_utsname()->release,
+                                 gadget->name);
+
+                cdev->manufacturer_override =
+                        override_id(cdev, &cdev->desc.iManufacturer);
+        }
+
+        if (iProduct || (!cdev->desc.iProduct && composite->iProduct))
+                cdev->product_override =
+                        override_id(cdev, &cdev->desc.iProduct);
+
+        if (iSerialNumber)
+                cdev->serial_override =
+                        override_id(cdev, &cdev->desc.iSerialNumber);
 
+        /* has userspace failed to provide a serial number? */
+        if (composite->needs_serial && !cdev->desc.iSerialNumber)
+                WARNING(cdev, "userspace failed to provide iSerialNumber\n");
+
+        /* finish up */
         status = device_create_file(&gadget->dev, &dev_attr_suspended);
         if (status)
                 goto fail;
@@ -1148,6 +1212,8 @@ composite_suspend(struct usb_gadget *gadget)
                 composite->suspend(cdev);
 
         cdev->suspended = 1;
+
+        usb_gadget_vbus_draw(gadget, 2);
 }
 
 static void
@@ -1155,6 +1221,7 @@ composite_resume(struct usb_gadget *gadget)
 {
         struct usb_composite_dev        *cdev = get_gadget_data(gadget);
         struct usb_function             *f;
+        u8                              maxpower;
 
         /* REVISIT:  should we have config level
          * suspend/resume callbacks?
@@ -1167,6 +1234,11 @@ composite_resume(struct usb_gadget *gadget)
                         if (f->resume)
                                 f->resume(f);
                 }
+
+                maxpower = cdev->config->bMaxPower;
+
+                usb_gadget_vbus_draw(gadget, maxpower ?
+                        (2 * maxpower) : CONFIG_USB_GADGET_VBUS_DRAW);
         }
 
         cdev->suspended = 0;
@@ -1177,7 +1249,6 @@ composite_resume(struct usb_gadget *gadget)
 static struct usb_gadget_driver composite_driver = {
         .speed          = USB_SPEED_HIGH,
 
-        .bind           = composite_bind,
         .unbind         = composite_unbind,
 
         .setup          = composite_setup,
@@ -1192,8 +1263,12 @@ static struct usb_gadget_driver composite_driver = {
 };
 
 /**
- * usb_composite_register() - register a composite driver
+ * usb_composite_probe() - register a composite driver
  * @driver: the driver to register
+ * @bind: the callback used to allocate resources that are shared across the
+ *      whole device, such as string IDs, and add its configurations using
+ *      @usb_add_config().  This may fail by returning a negative errno
+ *      value; it should return zero on successful initialization.
  * Context: single threaded during gadget setup
  *
  * This function is used to register drivers using the composite driver
@@ -1206,18 +1281,22 @@ static struct usb_gadget_driver composite_driver = {
  * while it was binding.  That would usually be done in order to wait for
  * some userspace participation.
  */
-int usb_composite_register(struct usb_composite_driver *driver)
+int usb_composite_probe(struct usb_composite_driver *driver,
+                               int (*bind)(struct usb_composite_dev *cdev))
 {
-        if (!driver || !driver->dev || !driver->bind || composite)
+        if (!driver || !driver->dev || !bind || composite)
                 return -EINVAL;
 
         if (!driver->name)
                 driver->name = "composite";
+        if (!driver->iProduct)
+                driver->iProduct = driver->name;
         composite_driver.function =  (char *) driver->name;
         composite_driver.driver.name = driver->name;
         composite = driver;
+        composite_gadget_bind = bind;
 
-        return usb_gadget_register_driver(&composite_driver);
+        return usb_gadget_probe_driver(&composite_driver, composite_bind);
 }
 
 /**
@@ -1233,3 +1312,40 @@ void usb_composite_unregister(struct usb_composite_driver *driver)
                 return;
         usb_gadget_unregister_driver(&composite_driver);
 }
+
+/**
+ * usb_composite_setup_continue() - Continue with the control transfer
+ * @cdev: the composite device who's control transfer was kept waiting
+ *
+ * This function must be called by the USB function driver to continue
+ * with the control transfer's data/status stage in case it had requested to
+ * delay the data/status stages. A USB function's setup handler (e.g. set_alt())
+ * can request the composite framework to delay the setup request's data/status
+ * stages by returning USB_GADGET_DELAYED_STATUS.
+ */
+void usb_composite_setup_continue(struct usb_composite_dev *cdev)
+{
+        int                     value;
+        struct usb_request      *req = cdev->req;
+        unsigned long           flags;
+
+        DBG(cdev, "%s\n", __func__);
+        spin_lock_irqsave(&cdev->lock, flags);
+
+        if (cdev->delayed_status == 0) {
+                WARN(cdev, "%s: Unexpected call\n", __func__);
+
+        } else if (--cdev->delayed_status == 0) {
+                DBG(cdev, "%s: Completing delayed status\n", __func__);
+                req->length = 0;
+                value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
+                if (value < 0) {
+                        DBG(cdev, "ep_queue --> %d\n", value);
+                        req->status = 0;
+                        composite_setup_complete(cdev->gadget->ep0, req);
+                }
+        }
+
+        spin_unlock_irqrestore(&cdev->lock, flags);
+}
+
diff --git a/drivers/usb/gadget/dbgp.c b/drivers/usb/gadget/dbgp.c
index 0ed50a2c0a36..dbe92ee88477 100644
--- a/drivers/usb/gadget/dbgp.c
+++ b/drivers/usb/gadget/dbgp.c
@@ -261,8 +261,8 @@ static int __init dbgp_configure_endpoints(struct usb_gadget *gadget)
         o_desc.wMaxPacketSize =
                 __constant_cpu_to_le16(USB_DEBUG_MAX_PACKET_SIZE);
 
-        dbg_desc.bDebugInEndpoint = i_desc.bEndpointAddress & 0x7f;
-        dbg_desc.bDebugOutEndpoint = o_desc.bEndpointAddress & 0x7f;
+        dbg_desc.bDebugInEndpoint = i_desc.bEndpointAddress;
+        dbg_desc.bDebugOutEndpoint = o_desc.bEndpointAddress;
 
 #ifdef CONFIG_USB_G_DBGP_SERIAL
         dbgp.serial->in = dbgp.i_ep;
@@ -312,6 +312,7 @@ static int __init dbgp_bind(struct usb_gadget *gadget)
 
         dbgp.req->length = DBGP_REQ_EP0_LEN;
         gadget->ep0->driver_data = gadget;
+        device_desc.bMaxPacketSize0 = gadget->ep0->maxpacket;
 
 #ifdef CONFIG_USB_G_DBGP_SERIAL
         dbgp.serial = kzalloc(sizeof(struct gserial), GFP_KERNEL);
@@ -350,9 +351,9 @@ static int dbgp_setup(struct usb_gadget *gadget,
         u8 request = ctrl->bRequest;
         u16 value = le16_to_cpu(ctrl->wValue);
         u16 length = le16_to_cpu(ctrl->wLength);
-        int err = 0;
-        void *data;
-        u16 len;
+        int err = -EOPNOTSUPP;
+        void *data = NULL;
+        u16 len = 0;
 
         gadget->ep0->driver_data = gadget;
 
@@ -371,10 +372,9 @@ static int dbgp_setup(struct usb_gadget *gadget,
                 default:
                         goto fail;
                 }
+                err = 0;
         } else if (request == USB_REQ_SET_FEATURE &&
                    value == USB_DEVICE_DEBUG_MODE) {
-                len = 0;
-                data = NULL;
                 dev_dbg(&dbgp.gadget->dev, "setup: feat debug\n");
 #ifdef CONFIG_USB_G_DBGP_PRINTK
                 err = dbgp_enable_ep();
@@ -386,15 +386,13 @@ static int dbgp_setup(struct usb_gadget *gadget,
         } else
                 goto fail;
 
-        if (len >= 0) {
-                req->length = min(length, len);
-                req->zero = len < req->length;
-                if (data && req->length)
-                        memcpy(req->buf, data, req->length);
+        req->length = min(length, len);
+        req->zero = len < req->length;
+        if (data && req->length)
+                memcpy(req->buf, data, req->length);
 
-                req->complete = dbgp_setup_complete;
-                return usb_ep_queue(gadget->ep0, req, GFP_ATOMIC);
-        }
+        req->complete = dbgp_setup_complete;
+        return usb_ep_queue(gadget->ep0, req, GFP_ATOMIC);
 
 fail:
         dev_dbg(&dbgp.gadget->dev,
@@ -405,7 +403,6 @@ fail:
 static struct usb_gadget_driver dbgp_driver = {
         .function = "dbgp",
         .speed = USB_SPEED_HIGH,
-        .bind = dbgp_bind,
         .unbind = dbgp_unbind,
         .setup = dbgp_setup,
         .disconnect = dbgp_disconnect,
@@ -417,7 +414,7 @@ static struct usb_gadget_driver dbgp_driver = {
 
 static int __init dbgp_init(void)
 {
-        return usb_gadget_register_driver(&dbgp_driver);
+        return usb_gadget_probe_driver(&dbgp_driver, dbgp_bind);
 }
 
 static void __exit dbgp_exit(void)
diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
index dc6546248ed9..d3dcabc1a5fc 100644
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -748,7 +748,8 @@ static DEVICE_ATTR (function, S_IRUGO, show_function, NULL);
  */
 
 int
-usb_gadget_register_driver (struct usb_gadget_driver *driver)
+usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
 {
         struct dummy    *dum = the_controller;
         int             retval, i;
@@ -757,8 +758,7 @@ usb_gadget_register_driver (struct usb_gadget_driver *driver)
                 return -EINVAL;
         if (dum->driver)
                 return -EBUSY;
-        if (!driver->bind || !driver->setup
-                        || driver->speed == USB_SPEED_UNKNOWN)
+        if (!bind || !driver->setup || driver->speed == USB_SPEED_UNKNOWN)
                 return -EINVAL;
 
         /*
@@ -796,7 +796,7 @@ usb_gadget_register_driver (struct usb_gadget_driver *driver)
         dum->gadget.dev.driver = &driver->driver;
         dev_dbg (udc_dev(dum), "binding gadget driver '%s'\n",
                         driver->driver.name);
-        retval = driver->bind(&dum->gadget);
+        retval = bind(&dum->gadget);
         if (retval) {
                 dum->driver = NULL;
                 dum->gadget.dev.driver = NULL;
@@ -812,7 +812,7 @@ usb_gadget_register_driver (struct usb_gadget_driver *driver)
         usb_hcd_poll_rh_status (dummy_to_hcd (dum));
         return 0;
 }
-EXPORT_SYMBOL (usb_gadget_register_driver);
+EXPORT_SYMBOL(usb_gadget_probe_driver);
 
 int
 usb_gadget_unregister_driver (struct usb_gadget_driver *driver)
@@ -874,6 +874,8 @@ static int dummy_udc_probe (struct platform_device *pdev)
         struct dummy    *dum = the_controller;
         int             rc;
 
+        usb_get_hcd(dummy_to_hcd(dum));
+
         dum->gadget.name = gadget_name;
         dum->gadget.ops = &dummy_ops;
         dum->gadget.is_dualspeed = 1;
@@ -885,15 +887,16 @@ static int dummy_udc_probe (struct platform_device *pdev)
         dum->gadget.dev.parent = &pdev->dev;
         dum->gadget.dev.release = dummy_gadget_release;
         rc = device_register (&dum->gadget.dev);
-        if (rc < 0)
+        if (rc < 0) {
+                put_device(&dum->gadget.dev);
                 return rc;
+        }
 
-        usb_get_hcd (dummy_to_hcd (dum));
-
-        platform_set_drvdata (pdev, dum);
         rc = device_create_file (&dum->gadget.dev, &dev_attr_function);
         if (rc < 0)
                 device_unregister (&dum->gadget.dev);
+        else
+                platform_set_drvdata(pdev, dum);
         return rc;
 }
 
@@ -1195,6 +1198,139 @@ static struct dummy_ep *find_endpoint (struct dummy *dum, u8 address)
 #define Ep_Request      (USB_TYPE_STANDARD | USB_RECIP_ENDPOINT)
 #define Ep_InRequest    (Ep_Request | USB_DIR_IN)
 
+
+/**
+ * handle_control_request() - handles all control transfers
+ * @dum: pointer to dummy (the_controller)
+ * @urb: the urb request to handle
+ * @setup: pointer to the setup data for a USB device control
+ *       request
+ * @status: pointer to request handling status
+ *
+ * Return 0 - if the request was handled
+ *        1 - if the request wasn't handles
+ *        error code on error
+ */
+static int handle_control_request(struct dummy *dum, struct urb *urb,
+                                  struct usb_ctrlrequest *setup,
+                                  int *status)
+{
+        struct dummy_ep         *ep2;
+        int                     ret_val = 1;
+        unsigned        w_index;
+        unsigned        w_value;
+
+        w_index = le16_to_cpu(setup->wIndex);
+        w_value = le16_to_cpu(setup->wValue);
+        switch (setup->bRequest) {
+        case USB_REQ_SET_ADDRESS:
+                if (setup->bRequestType != Dev_Request)
+                        break;
+                dum->address = w_value;
+                *status = 0;
+                dev_dbg(udc_dev(dum), "set_address = %d\n",
+                                w_value);
+                ret_val = 0;
+                break;
+        case USB_REQ_SET_FEATURE:
+                if (setup->bRequestType == Dev_Request) {
+                        ret_val = 0;
+                        switch (w_value) {
+                        case USB_DEVICE_REMOTE_WAKEUP:
+                                break;
+                        case USB_DEVICE_B_HNP_ENABLE:
+                                dum->gadget.b_hnp_enable = 1;
+                                break;
+                        case USB_DEVICE_A_HNP_SUPPORT:
+                                dum->gadget.a_hnp_support = 1;
+                                break;
+                        case USB_DEVICE_A_ALT_HNP_SUPPORT:
+                                dum->gadget.a_alt_hnp_support = 1;
+                                break;
+                        default:
+                                ret_val = -EOPNOTSUPP;
+                        }
+                        if (ret_val == 0) {
+                                dum->devstatus |= (1 << w_value);
+                                *status = 0;
+                        }
+                } else if (setup->bRequestType == Ep_Request) {
+                        /* endpoint halt */
+                        ep2 = find_endpoint(dum, w_index);
+                        if (!ep2 || ep2->ep.name == ep0name) {
+                                ret_val = -EOPNOTSUPP;
+                                break;
+                        }
+                        ep2->halted = 1;
+                        ret_val = 0;
+                        *status = 0;
+                }
+                break;
+        case USB_REQ_CLEAR_FEATURE:
+                if (setup->bRequestType == Dev_Request) {
+                        ret_val = 0;
+                        switch (w_value) {
+                        case USB_DEVICE_REMOTE_WAKEUP:
+                                w_value = USB_DEVICE_REMOTE_WAKEUP;
+                                break;
+                        default:
+                                ret_val = -EOPNOTSUPP;
+                                break;
+                        }
+                        if (ret_val == 0) {
+                                dum->devstatus &= ~(1 << w_value);
+                                *status = 0;
+                        }
+                } else if (setup->bRequestType == Ep_Request) {
+                        /* endpoint halt */
+                        ep2 = find_endpoint(dum, w_index);
+                        if (!ep2) {
+                                ret_val = -EOPNOTSUPP;
+                                break;
+                        }
+                        if (!ep2->wedged)
+                                ep2->halted = 0;
+                        ret_val = 0;
+                        *status = 0;
+                }
+                break;
+        case USB_REQ_GET_STATUS:
+                if (setup->bRequestType == Dev_InRequest
+                                || setup->bRequestType == Intf_InRequest
+                                || setup->bRequestType == Ep_InRequest) {
+                        char *buf;
+                        /*
+                         * device: remote wakeup, selfpowered
+                         * interface: nothing
+                         * endpoint: halt
+                         */
+                        buf = (char *)urb->transfer_buffer;
+                        if (urb->transfer_buffer_length > 0) {
+                                if (setup->bRequestType == Ep_InRequest) {
+                                        ep2 = find_endpoint(dum, w_index);
+                                        if (!ep2) {
+                                                ret_val = -EOPNOTSUPP;
+                                                break;
+                                        }
+                                        buf[0] = ep2->halted;
+                                } else if (setup->bRequestType ==
+                                           Dev_InRequest) {
+                                        buf[0] = (u8)dum->devstatus;
+                                } else
+                                        buf[0] = 0;
+                        }
+                        if (urb->transfer_buffer_length > 1)
+                                buf[1] = 0;
+                        urb->actual_length = min_t(u32, 2,
+                                urb->transfer_buffer_length);
+                        ret_val = 0;
+                        *status = 0;
+                }
+                break;
+        }
+        return ret_val;
+}
+
 /* drive both sides of the transfers; looks like irq handlers to
  * both drivers except the callbacks aren't in_irq().
  */
@@ -1297,14 +1433,8 @@ restart:
                 if (ep == &dum->ep [0] && ep->setup_stage) {
                         struct usb_ctrlrequest          setup;
                         int                             value = 1;
-                        struct dummy_ep                 *ep2;
-                        unsigned                        w_index;
-                        unsigned                        w_value;
 
                         setup = *(struct usb_ctrlrequest*) urb->setup_packet;
-                        w_index = le16_to_cpu(setup.wIndex);
-                        w_value = le16_to_cpu(setup.wValue);
-
                         /* paranoia, in case of stale queued data */
                         list_for_each_entry (req, &ep->queue, queue) {
                                 list_del_init (&req->queue);
@@ -1326,117 +1456,9 @@ restart:
                         ep->last_io = jiffies;
                         ep->setup_stage = 0;
                         ep->halted = 0;
-                        switch (setup.bRequest) {
-                        case USB_REQ_SET_ADDRESS:
-                                if (setup.bRequestType != Dev_Request)
-                                        break;
-                                dum->address = w_value;
-                                status = 0;
-                                dev_dbg (udc_dev(dum), "set_address = %d\n",
-                                                w_value);
-                                value = 0;
-                                break;
-                        case USB_REQ_SET_FEATURE:
-                                if (setup.bRequestType == Dev_Request) {
-                                        value = 0;
-                                        switch (w_value) {
-                                        case USB_DEVICE_REMOTE_WAKEUP:
-                                                break;
-                                        case USB_DEVICE_B_HNP_ENABLE:
-                                                dum->gadget.b_hnp_enable = 1;
-                                                break;
-                                        case USB_DEVICE_A_HNP_SUPPORT:
-                                                dum->gadget.a_hnp_support = 1;
-                                                break;
-                                        case USB_DEVICE_A_ALT_HNP_SUPPORT:
-                                                dum->gadget.a_alt_hnp_support
-                                                        = 1;
-                                                break;
-                                        default:
-                                                value = -EOPNOTSUPP;
-                                        }
-                                        if (value == 0) {
-                                                dum->devstatus |=
-                                                        (1 << w_value);
-                                                status = 0;
-                                        }
 
-                                } else if (setup.bRequestType == Ep_Request) {
-                                        // endpoint halt
-                                        ep2 = find_endpoint (dum, w_index);
-                                        if (!ep2 || ep2->ep.name == ep0name) {
-                                                value = -EOPNOTSUPP;
-                                                break;
-                                        }
-                                        ep2->halted = 1;
-                                        value = 0;
-                                        status = 0;
-                                }
-                                break;
-                        case USB_REQ_CLEAR_FEATURE:
-                                if (setup.bRequestType == Dev_Request) {
-                                        switch (w_value) {
-                                        case USB_DEVICE_REMOTE_WAKEUP:
-                                                dum->devstatus &= ~(1 <<
-                                                        USB_DEVICE_REMOTE_WAKEUP);
-                                                value = 0;
-                                                status = 0;
-                                                break;
-                                        default:
-                                                value = -EOPNOTSUPP;
-                                                break;
-                                        }
-                                } else if (setup.bRequestType == Ep_Request) {
-                                        // endpoint halt
-                                        ep2 = find_endpoint (dum, w_index);
-                                        if (!ep2) {
-                                                value = -EOPNOTSUPP;
-                                                break;
-                                        }
-                                        if (!ep2->wedged)
-                                                ep2->halted = 0;
-                                        value = 0;
-                                        status = 0;
-                                }
-                                break;
-                        case USB_REQ_GET_STATUS:
-                                if (setup.bRequestType == Dev_InRequest
-                                                || setup.bRequestType
-                                                        == Intf_InRequest
-                                                || setup.bRequestType
-                                                        == Ep_InRequest
-                                                ) {
-                                        char *buf;
-
-                                        // device: remote wakeup, selfpowered
-                                        // interface: nothing
-                                        // endpoint: halt
-                                        buf = (char *)urb->transfer_buffer;
-                                        if (urb->transfer_buffer_length > 0) {
-                                                if (setup.bRequestType ==
-                                                                Ep_InRequest) {
-        ep2 = find_endpoint (dum, w_index);
-        if (!ep2) {
-                value = -EOPNOTSUPP;
-                break;
-        }
-        buf [0] = ep2->halted;
-                                                } else if (setup.bRequestType ==
-                                                                Dev_InRequest) {
-                                                        buf [0] = (u8)
-                                                                dum->devstatus;
-                                                } else
-                                                        buf [0] = 0;
-                                        }
-                                        if (urb->transfer_buffer_length > 1)
-                                                buf [1] = 0;
-                                        urb->actual_length = min_t(u32, 2,
-                                                urb->transfer_buffer_length);
-                                        value = 0;
-                                        status = 0;
-                                }
-                                break;
-                        }
+                        value = handle_control_request(dum, urb, &setup,
+                                                       &status);
 
                         /* gadget driver handles all other requests.  block
                          * until setup() returns; no reentrancy issues etc.
@@ -1572,8 +1594,8 @@ hub_descriptor (struct usb_hub_descriptor *desc)
         desc->bDescLength = 9;
         desc->wHubCharacteristics = cpu_to_le16(0x0001);
         desc->bNbrPorts = 1;
-        desc->bitmap [0] = 0xff;
-        desc->bitmap [1] = 0xff;
+        desc->u.hs.DeviceRemovable[0] = 0xff;
+        desc->u.hs.DeviceRemovable[1] = 0xff;
 }
 
 static int dummy_hub_control (
@@ -1884,6 +1906,7 @@ static int dummy_hcd_probe(struct platform_device *pdev)
         if (!hcd)
                 return -ENOMEM;
         the_controller = hcd_to_dummy (hcd);
+        hcd->has_tt = 1;
 
         retval = usb_add_hcd(hcd, 0, 0);
         if (retval != 0) {
@@ -1974,11 +1997,29 @@ static int __init init (void)
         retval = platform_device_add(the_hcd_pdev);
         if (retval < 0)
                 goto err_add_hcd;
+        if (!the_controller) {
+                /*
+                 * The hcd was added successfully but its probe function failed
+                 * for some reason.
+                 */
+                retval = -EINVAL;
+                goto err_add_udc;
+        }
         retval = platform_device_add(the_udc_pdev);
         if (retval < 0)
                 goto err_add_udc;
+        if (!platform_get_drvdata(the_udc_pdev)) {
+                /*
+                 * The udc was added successfully but its probe function failed
+                 * for some reason.
+                 */
+                retval = -EINVAL;
+                goto err_probe_udc;
+        }
         return retval;
 
+err_probe_udc:
+        platform_device_del(the_udc_pdev);
 err_add_udc:
         platform_device_del(the_hcd_pdev);
 err_add_hcd:
diff --git a/drivers/usb/gadget/epautoconf.c b/drivers/usb/gadget/epautoconf.c
index 8a832488ccdd..9b7360ff5aa7 100644
--- a/drivers/usb/gadget/epautoconf.c
+++ b/drivers/usb/gadget/epautoconf.c
@@ -128,6 +128,13 @@ ep_matches (
                 }
         }
 
+        /*
+         * If the protocol driver hasn't yet decided on wMaxPacketSize
+         * and wants to know the maximum possible, provide the info.
+         */
+        if (desc->wMaxPacketSize == 0)
+                desc->wMaxPacketSize = cpu_to_le16(ep->maxpacket);
+
         /* endpoint maxpacket size is an input parameter, except for bulk
          * where it's an output parameter representing the full speed limit.
          * the usb spec fixes high speed bulk maxpacket at 512 bytes.
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index 114fa024c22c..1690c9d68256 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -237,7 +237,7 @@ static u8 hostaddr[ETH_ALEN];
  * the first one present.  That's to make Microsoft's drivers happy,
  * and to follow DOCSIS 1.0 (cable modem standard).
  */
-static int __ref rndis_do_config(struct usb_configuration *c)
+static int __init rndis_do_config(struct usb_configuration *c)
 {
         /* FIXME alloc iConfiguration string, set it in c->strings */
 
@@ -251,7 +251,6 @@ static int __ref rndis_do_config(struct usb_configuration *c)
 
 static struct usb_configuration rndis_config_driver = {
         .label                  = "RNDIS",
-        .bind                   = rndis_do_config,
         .bConfigurationValue    = 2,
         /* .iConfiguration = DYNAMIC */
         .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
@@ -270,7 +269,7 @@ MODULE_PARM_DESC(use_eem, "use CDC EEM mode");
 /*
  * We _always_ have an ECM, CDC Subset, or EEM configuration.
  */
-static int __ref eth_do_config(struct usb_configuration *c)
+static int __init eth_do_config(struct usb_configuration *c)
 {
         /* FIXME alloc iConfiguration string, set it in c->strings */
 
@@ -289,7 +288,6 @@ static int __ref eth_do_config(struct usb_configuration *c)
 
 static struct usb_configuration eth_config_driver = {
         /* .label = f(hardware) */
-        .bind                   = eth_do_config,
         .bConfigurationValue    = 1,
         /* .iConfiguration = DYNAMIC */
         .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
@@ -297,7 +295,7 @@ static struct usb_configuration eth_config_driver = {
 
 /*-------------------------------------------------------------------------*/
 
-static int __ref eth_bind(struct usb_composite_dev *cdev)
+static int __init eth_bind(struct usb_composite_dev *cdev)
 {
         int                     gcnum;
         struct usb_gadget       *gadget = cdev->gadget;
@@ -373,12 +371,13 @@ static int __ref eth_bind(struct usb_composite_dev *cdev)
 
         /* register our configuration(s); RNDIS first, if it's used */
         if (has_rndis()) {
-                status = usb_add_config(cdev, &rndis_config_driver);
+                status = usb_add_config(cdev, &rndis_config_driver,
+                                rndis_do_config);
                 if (status < 0)
                         goto fail;
         }
 
-        status = usb_add_config(cdev, &eth_config_driver);
+        status = usb_add_config(cdev, &eth_config_driver, eth_do_config);
         if (status < 0)
                 goto fail;
 
@@ -402,7 +401,6 @@ static struct usb_composite_driver eth_driver = {
         .name           = "g_ether",
         .dev            = &device_desc,
         .strings        = dev_strings,
-        .bind           = eth_bind,
         .unbind         = __exit_p(eth_unbind),
 };
 
@@ -412,7 +410,7 @@ MODULE_LICENSE("GPL");
 
 static int __init init(void)
 {
-        return usb_composite_register(&eth_driver);
+        return usb_composite_probe(&eth_driver, eth_bind);
 }
 module_init(init);
 
diff --git a/drivers/usb/gadget/f_acm.c b/drivers/usb/gadget/f_acm.c
index d47a123f15ab..bd6226cbae86 100644
--- a/drivers/usb/gadget/f_acm.c
+++ b/drivers/usb/gadget/f_acm.c
@@ -111,7 +111,7 @@ acm_iad_descriptor = {
         .bInterfaceCount =      2,      // control + data
         .bFunctionClass =       USB_CLASS_COMM,
         .bFunctionSubClass =    USB_CDC_SUBCLASS_ACM,
-        .bFunctionProtocol =    USB_CDC_PROTO_NONE,
+        .bFunctionProtocol =    USB_CDC_ACM_PROTO_AT_V25TER,
         /* .iFunction =         DYNAMIC */
 };
 
diff --git a/drivers/usb/gadget/f_audio.c b/drivers/usb/gadget/f_audio.c
index 1f48ceb55a77..8ee330a2ab58 100644
--- a/drivers/usb/gadget/f_audio.c
+++ b/drivers/usb/gadget/f_audio.c
@@ -177,7 +177,7 @@ static struct uac_format_type_i_discrete_descriptor_1 as_type_i_desc = {
 };
 
 /* Standard ISO OUT Endpoint Descriptor */
-static struct usb_endpoint_descriptor as_out_ep_desc __initdata = {
+static struct usb_endpoint_descriptor as_out_ep_desc  = {
         .bLength =              USB_DT_ENDPOINT_AUDIO_SIZE,
         .bDescriptorType =      USB_DT_ENDPOINT,
         .bEndpointAddress =     USB_DIR_OUT,
@@ -317,8 +317,6 @@ static void f_audio_playback_work(struct work_struct *data)
 
         u_audio_playback(&audio->card, play_buf->buf, play_buf->actual);
         f_audio_buffer_free(play_buf);
-
-        return;
 }
 
 static int f_audio_out_ep_complete(struct usb_ep *ep, struct usb_request *req)
@@ -708,6 +706,7 @@ f_audio_unbind(struct usb_configuration *c, struct usb_function *f)
         struct f_audio          *audio = func_to_audio(f);
 
         usb_free_descriptors(f->descriptors);
+        usb_free_descriptors(f->hs_descriptors);
         kfree(audio);
 }
 
@@ -744,7 +743,7 @@ int __init control_selector_init(struct f_audio *audio)
 }
 
 /**
- * audio_bind_config - add USB audio fucntion to a configuration
+ * audio_bind_config - add USB audio function to a configuration
  * @c: the configuration to supcard the USB audio function
  * Context: single threaded during gadget setup
  *
diff --git a/drivers/usb/gadget/f_eem.c b/drivers/usb/gadget/f_eem.c
index 95dd4662d6a8..b3c304290150 100644
--- a/drivers/usb/gadget/f_eem.c
+++ b/drivers/usb/gadget/f_eem.c
@@ -314,6 +314,9 @@ eem_unbind(struct usb_configuration *c, struct usb_function *f)
 
 static void eem_cmd_complete(struct usb_ep *ep, struct usb_request *req)
 {
+        struct sk_buff *skb = (struct sk_buff *)req->context;
+
+        dev_kfree_skb_any(skb);
 }
 
 /*
@@ -428,10 +431,11 @@ static int eem_unwrap(struct gether *port,
                                 skb_trim(skb2, len);
                                 put_unaligned_le16(BIT(15) | BIT(11) | len,
                                                         skb_push(skb2, 2));
-                                skb_copy_bits(skb, 0, req->buf, skb->len);
-                                req->length = skb->len;
+                                skb_copy_bits(skb2, 0, req->buf, skb2->len);
+                                req->length = skb2->len;
                                 req->complete = eem_cmd_complete;
                                 req->zero = 1;
+                                req->context = skb2;
                                 if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC))
                                         DBG(cdev, "echo response queue fail\n");
                                 break;
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index e4f595055208..19fffccc370d 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -1,10 +1,10 @@
 /*
- * f_fs.c -- user mode filesystem api for usb composite funtcion controllers
+ * f_fs.c -- user mode file system API for USB composite function controllers
  *
  * Copyright (C) 2010 Samsung Electronics
  * Author: Michal Nazarewicz <m.nazarewicz@samsung.com>
  *
- * Based on inode.c (GadgetFS):
+ * Based on inode.c (GadgetFS) which was:
  * Copyright (C) 2003-2004 David Brownell
  * Copyright (C) 2003 Agilent Technologies
  *
@@ -30,7 +30,6 @@
 #include <linux/blkdev.h>
 #include <linux/pagemap.h>
 #include <asm/unaligned.h>
-#include <linux/smp_lock.h>
 
 #include <linux/usb/composite.h>
 #include <linux/usb/functionfs.h>
@@ -39,62 +38,56 @@
 #define FUNCTIONFS_MAGIC        0xa647361 /* Chosen by a honest dice roll ;) */
 
 
-/* Debuging *****************************************************************/
-
-#define ffs_printk(level, fmt, args...) printk(level "f_fs: " fmt "\n", ## args)
-
-#define FERR(...)  ffs_printk(KERN_ERR,  __VA_ARGS__)
-#define FINFO(...) ffs_printk(KERN_INFO, __VA_ARGS__)
-
-#ifdef DEBUG
-#  define FDBG(...) ffs_printk(KERN_DEBUG, __VA_ARGS__)
-#else
-#  define FDBG(...) do { } while (0)
-#endif /* DEBUG */
-
-#ifdef VERBOSE_DEBUG
-#  define FVDBG FDBG
-#else
-#  define FVDBG(...) do { } while (0)
-#endif /* VERBOSE_DEBUG */
-
-#define ENTER()    FVDBG("%s()", __func__)
+/* Debugging ****************************************************************/
 
 #ifdef VERBOSE_DEBUG
+#  define pr_vdebug pr_debug
 #  define ffs_dump_mem(prefix, ptr, len) \
-        print_hex_dump_bytes("f_fs" prefix ": ", DUMP_PREFIX_NONE, ptr, len)
+        print_hex_dump_bytes(pr_fmt(prefix ": "), DUMP_PREFIX_NONE, ptr, len)
 #else
+#  define pr_vdebug(...)                 do { } while (0)
 #  define ffs_dump_mem(prefix, ptr, len) do { } while (0)
-#endif
+#endif /* VERBOSE_DEBUG */
+
+#define ENTER()    pr_vdebug("%s()\n", __func__)
 
 
 /* The data structure and setup file ****************************************/
 
 enum ffs_state {
-        /* Waiting for descriptors and strings. */
-        /* In this state no open(2), read(2) or write(2) on epfiles
+        /*
+         * Waiting for descriptors and strings.
+         *
+         * In this state no open(2), read(2) or write(2) on epfiles
          * may succeed (which should not be the problem as there
-         * should be no such files opened in the firts place). */
+         * should be no such files opened in the first place).
+         */
         FFS_READ_DESCRIPTORS,
         FFS_READ_STRINGS,
 
-        /* We've got descriptors and strings.  We are or have called
+        /*
+         * We've got descriptors and strings.  We are or have called
          * functionfs_ready_callback().  functionfs_bind() may have
-         * been called but we don't know. */
-        /* This is the only state in which operations on epfiles may
-         * succeed. */
+         * been called but we don't know.
+         *
+         * This is the only state in which operations on epfiles may
+         * succeed.
+         */
         FFS_ACTIVE,
 
-        /* All endpoints have been closed.  This state is also set if
+        /*
+         * All endpoints have been closed.  This state is also set if
          * we encounter an unrecoverable error.  The only
          * unrecoverable error is situation when after reading strings
-         * from user space we fail to initialise EP files or
-         * functionfs_ready_callback() returns with error (<0). */
-        /* In this state no open(2), read(2) or write(2) (both on ep0
+         * from user space we fail to initialise epfiles or
+         * functionfs_ready_callback() returns with error (<0).
+         *
+         * In this state no open(2), read(2) or write(2) (both on ep0
          * as well as epfile) may succeed (at this point epfiles are
          * unlinked and all closed so this is not a problem; ep0 is
          * also closed but ep0 file exists and so open(2) on ep0 must
-         * fail). */
+         * fail).
+         */
         FFS_CLOSING
 };
 
@@ -102,14 +95,18 @@ enum ffs_state {
 enum ffs_setup_state {
         /* There is no setup request pending. */
         FFS_NO_SETUP,
-        /* User has read events and there was a setup request event
+        /*
+         * User has read events and there was a setup request event
          * there.  The next read/write on ep0 will handle the
-         * request. */
+         * request.
+         */
         FFS_SETUP_PENDING,
-        /* There was event pending but before user space handled it
+        /*
+         * There was event pending but before user space handled it
          * some other event was introduced which canceled existing
          * setup.  If this state is set read/write on ep0 return
-         * -EIDRM.  This state is only set when adding event. */
+         * -EIDRM.  This state is only set when adding event.
+         */
         FFS_SETUP_CANCELED
 };
 
@@ -121,23 +118,29 @@ struct ffs_function;
 struct ffs_data {
         struct usb_gadget               *gadget;
 
-        /* Protect access read/write operations, only one read/write
+        /*
+         * Protect access read/write operations, only one read/write
          * at a time.  As a consequence protects ep0req and company.
          * While setup request is being processed (queued) this is
-         * held. */
+         * held.
+         */
         struct mutex                    mutex;
 
-        /* Protect access to enpoint related structures (basically
+        /*
+         * Protect access to endpoint related structures (basically
          * usb_ep_queue(), usb_ep_dequeue(), etc. calls) except for
-         * endpint zero. */
+         * endpoint zero.
+         */
         spinlock_t                      eps_lock;
 
-        /* XXX REVISIT do we need our own request? Since we are not
-         * handling setup requests immidiatelly user space may be so
+        /*
+         * XXX REVISIT do we need our own request? Since we are not
+         * handling setup requests immediately user space may be so
          * slow that another setup will be sent to the gadget but this
          * time not to us but another function and then there could be
          * a race.  Is that the case? Or maybe we can use cdev->req
-         * after all, maybe we just need some spinlock for that? */
+         * after all, maybe we just need some spinlock for that?
+         */
         struct usb_request              *ep0req;                /* P: mutex */
         struct completion               ep0req_completion;      /* P: mutex */
         int                             ep0req_status;          /* P: mutex */
@@ -151,7 +154,7 @@ struct ffs_data {
         enum ffs_state                  state;
 
         /*
-         * Possible transations:
+         * Possible transitions:
          * + FFS_NO_SETUP       -> FFS_SETUP_PENDING  -- P: ev.waitq.lock
          *               happens only in ep0 read which is P: mutex
          * + FFS_SETUP_PENDING  -> FFS_NO_SETUP       -- P: ev.waitq.lock
@@ -184,18 +187,21 @@ struct ffs_data {
         /* Active function */
         struct ffs_function             *func;
 
-        /* Device name, write once when file system is mounted.
-         * Intendet for user to read if she wants. */
+        /*
+         * Device name, write once when file system is mounted.
+         * Intended for user to read if she wants.
+         */
         const char                      *dev_name;
-        /* Private data for our user (ie. gadget).  Managed by
-         * user. */
+        /* Private data for our user (ie. gadget).  Managed by user. */
         void                            *private_data;
 
         /* filled by __ffs_data_got_descs() */
-        /* real descriptors are 16 bytes after raw_descs (so you need
+        /*
+         * Real descriptors are 16 bytes after raw_descs (so you need
          * to skip 16 bytes (ie. ffs->raw_descs + 16) to get to the
          * first full speed descriptor).  raw_descs_length and
-         * raw_fs_descs_length do not have those 16 bytes added. */
+         * raw_fs_descs_length do not have those 16 bytes added.
+         */
         const void                      *raw_descs;
         unsigned                        raw_descs_length;
         unsigned                        raw_fs_descs_length;
@@ -212,18 +218,23 @@ struct ffs_data {
         const void                      *raw_strings;
         struct usb_gadget_strings       **stringtabs;
 
-        /* File system's super block, write once when file system is mounted. */
+        /*
+         * File system's super block, write once when file system is
+         * mounted.
+         */
         struct super_block              *sb;
 
-        /* File permissions, written once when fs is mounted*/
+        /* File permissions, written once when fs is mounted */
         struct ffs_file_perms {
                 umode_t                         mode;
                 uid_t                           uid;
                 gid_t                           gid;
         }                               file_perms;
 
-        /* The endpoint files, filled by ffs_epfiles_create(),
-         * destroyed by ffs_epfiles_destroy(). */
+        /*
+         * The endpoint files, filled by ffs_epfiles_create(),
+         * destroyed by ffs_epfiles_destroy().
+         */
         struct ffs_epfile               *epfiles;
 };
 
@@ -237,7 +248,7 @@ static struct ffs_data *__must_check ffs_data_new(void) __attribute__((malloc));
 static void ffs_data_opened(struct ffs_data *ffs);
 static void ffs_data_closed(struct ffs_data *ffs);
 
-/* Called with ffs->mutex held; take over ownerrship of data. */
+/* Called with ffs->mutex held; take over ownership of data. */
 static int __must_check
 __ffs_data_got_descs(struct ffs_data *ffs, char *data, size_t len);
 static int __must_check
@@ -268,11 +279,9 @@ static struct ffs_function *ffs_func_from_usb(struct usb_function *f)
 
 static void ffs_func_free(struct ffs_function *func);
 
-
 static void ffs_func_eps_disable(struct ffs_function *func);
 static int __must_check ffs_func_eps_enable(struct ffs_function *func);
 
-
 static int ffs_func_bind(struct usb_configuration *,
                          struct usb_function *);
 static void ffs_func_unbind(struct usb_configuration *,
@@ -289,7 +298,6 @@ static int ffs_func_revmap_ep(struct ffs_function *func, u8 num);
 static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf);
 
 
-
 /* The endpoints structures *************************************************/
 
 struct ffs_ep {
@@ -322,7 +330,6 @@ struct ffs_epfile {
         unsigned char                   _pad;
 };
 
-
 static int  __must_check ffs_epfiles_create(struct ffs_data *ffs);
 static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count);
 
@@ -349,7 +356,6 @@ static void ffs_ep0_complete(struct usb_ep *ep, struct usb_request *req)
         complete_all(&ffs->ep0req_completion);
 }
 
-
 static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len)
 {
         struct usb_request *req = ffs->ep0req;
@@ -362,6 +368,14 @@ static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len)
         req->buf      = data;
         req->length   = len;
 
+        /*
+         * UDC layer requires to provide a buffer even for ZLP, but should
+         * not use it at all. Let's provide some poisoned pointer to catch
+         * possible bug in the driver.
+         */
+        if (req->buf == NULL)
+                req->buf = (void *)0xDEADBABE;
+
         INIT_COMPLETION(ffs->ep0req_completion);
 
         ret = usb_ep_queue(ffs->gadget->ep0, req, GFP_ATOMIC);
@@ -381,17 +395,16 @@ static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len)
 static int __ffs_ep0_stall(struct ffs_data *ffs)
 {
         if (ffs->ev.can_stall) {
-                FVDBG("ep0 stall\n");
+                pr_vdebug("ep0 stall\n");
                 usb_ep_set_halt(ffs->gadget->ep0);
                 ffs->setup_state = FFS_NO_SETUP;
                 return -EL2HLT;
         } else {
-                FDBG("bogus ep0 stall!\n");
+                pr_debug("bogus ep0 stall!\n");
                 return -ESRCH;
         }
 }
 
-
 static ssize_t ffs_ep0_write(struct file *file, const char __user *buf,
                              size_t len, loff_t *ptr)
 {
@@ -410,7 +423,6 @@ static ssize_t ffs_ep0_write(struct file *file, const char __user *buf,
         if (unlikely(ret < 0))
                 return ret;
 
-
         /* Check state */
         switch (ffs->state) {
         case FFS_READ_DESCRIPTORS:
@@ -422,14 +434,14 @@ static ssize_t ffs_ep0_write(struct file *file, const char __user *buf,
                 }
 
                 data = ffs_prepare_buffer(buf, len);
-                if (unlikely(IS_ERR(data))) {
+                if (IS_ERR(data)) {
                         ret = PTR_ERR(data);
                         break;
                 }
 
                 /* Handle data */
                 if (ffs->state == FFS_READ_DESCRIPTORS) {
-                        FINFO("read descriptors");
+                        pr_info("read descriptors\n");
                         ret = __ffs_data_got_descs(ffs, data, len);
                         if (unlikely(ret < 0))
                                 break;
@@ -437,7 +449,7 @@ static ssize_t ffs_ep0_write(struct file *file, const char __user *buf,
                         ffs->state = FFS_READ_STRINGS;
                         ret = len;
                 } else {
-                        FINFO("read strings");
+                        pr_info("read strings\n");
                         ret = __ffs_data_got_strings(ffs, data, len);
                         if (unlikely(ret < 0))
                                 break;
@@ -462,11 +474,12 @@ static ssize_t ffs_ep0_write(struct file *file, const char __user *buf,
                 }
                 break;
 
-
         case FFS_ACTIVE:
                 data = NULL;
-                /* We're called from user space, we can use _irq
-                 * rather then _irqsave */
+                /*
+                 * We're called from user space, we can use _irq
+                 * rather then _irqsave
+                 */
                 spin_lock_irq(&ffs->ev.waitq.lock);
                 switch (FFS_SETUP_STATE(ffs)) {
                 case FFS_SETUP_CANCELED:
@@ -494,23 +507,25 @@ static ssize_t ffs_ep0_write(struct file *file, const char __user *buf,
                 spin_unlock_irq(&ffs->ev.waitq.lock);
 
                 data = ffs_prepare_buffer(buf, len);
-                if (unlikely(IS_ERR(data))) {
+                if (IS_ERR(data)) {
                         ret = PTR_ERR(data);
                         break;
                 }
 
                 spin_lock_irq(&ffs->ev.waitq.lock);
 
-                /* We are guaranteed to be still in FFS_ACTIVE state
+                /*
+                 * We are guaranteed to be still in FFS_ACTIVE state
                  * but the state of setup could have changed from
                  * FFS_SETUP_PENDING to FFS_SETUP_CANCELED so we need
                  * to check for that.  If that happened we copied data
-                 * from user space in vain but it's unlikely. */
-                /* For sure we are not in FFS_NO_SETUP since this is
+                 * from user space in vain but it's unlikely.
+                 *
+                 * For sure we are not in FFS_NO_SETUP since this is
                  * the only place FFS_SETUP_PENDING -> FFS_NO_SETUP
                  * transition can be performed and it's protected by
-                 * mutex. */
-
+                 * mutex.
+                 */
                 if (FFS_SETUP_STATE(ffs) == FFS_SETUP_CANCELED) {
                         ret = -EIDRM;
 done_spin:
@@ -522,25 +537,22 @@ done_spin:
                 kfree(data);
                 break;
 
-
         default:
                 ret = -EBADFD;
                 break;
         }
 
-
         mutex_unlock(&ffs->mutex);
         return ret;
 }
 
-
-
 static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf,
                                      size_t n)
 {
-        /* We are holding ffs->ev.waitq.lock and ffs->mutex and we need
-         * to release them. */
-
+        /*
+         * We are holding ffs->ev.waitq.lock and ffs->mutex and we need
+         * to release them.
+         */
         struct usb_functionfs_event events[n];
         unsigned i = 0;
 
@@ -569,7 +581,6 @@ static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf,
                 ? -EFAULT : sizeof events;
 }
 
-
 static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
                             size_t len, loff_t *ptr)
 {
@@ -589,16 +600,16 @@ static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
         if (unlikely(ret < 0))
                 return ret;
 
-
         /* Check state */
         if (ffs->state != FFS_ACTIVE) {
                 ret = -EBADFD;
                 goto done_mutex;
         }
 
-
-        /* We're called from user space, we can use _irq rather then
-         * _irqsave */
+        /*
+         * We're called from user space, we can use _irq rather then
+         * _irqsave
+         */
         spin_lock_irq(&ffs->ev.waitq.lock);
 
         switch (FFS_SETUP_STATE(ffs)) {
@@ -618,7 +629,8 @@ static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
                         break;
                 }
 
-                if (unlikely(wait_event_interruptible_exclusive_locked_irq(ffs->ev.waitq, ffs->ev.count))) {
+                if (wait_event_interruptible_exclusive_locked_irq(ffs->ev.waitq,
+                                                        ffs->ev.count)) {
                         ret = -EINTR;
                         break;
                 }
@@ -626,7 +638,6 @@ static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
                 return __ffs_ep0_read_events(ffs, buf,
                                              min(n, (size_t)ffs->ev.count));
 
-
         case FFS_SETUP_PENDING:
                 if (ffs->ev.setup.bRequestType & USB_DIR_IN) {
                         spin_unlock_irq(&ffs->ev.waitq.lock);
@@ -672,8 +683,6 @@ done_mutex:
         return ret;
 }
 
-
-
 static int ffs_ep0_open(struct inode *inode, struct file *file)
 {
         struct ffs_data *ffs = inode->i_private;
@@ -689,7 +698,6 @@ static int ffs_ep0_open(struct inode *inode, struct file *file)
         return 0;
 }
 
-
 static int ffs_ep0_release(struct inode *inode, struct file *file)
 {
         struct ffs_data *ffs = file->private_data;
@@ -701,7 +709,6 @@ static int ffs_ep0_release(struct inode *inode, struct file *file)
         return 0;
 }
 
-
 static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value)
 {
         struct ffs_data *ffs = file->private_data;
@@ -722,7 +729,6 @@ static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value)
         return ret;
 }
 
-
 static const struct file_operations ffs_ep0_operations = {
         .owner =        THIS_MODULE,
         .llseek =       no_llseek,
@@ -737,7 +743,6 @@ static const struct file_operations ffs_ep0_operations = {
 
 /* "Normal" endpoints operations ********************************************/
 
-
 static void ffs_epfile_io_complete(struct usb_ep *_ep, struct usb_request *req)
 {
         ENTER();
@@ -748,7 +753,6 @@ static void ffs_epfile_io_complete(struct usb_ep *_ep, struct usb_request *req)
         }
 }
 
-
 static ssize_t ffs_epfile_io(struct file *file,
                              char __user *buf, size_t len, int read)
 {
@@ -778,8 +782,8 @@ first_try:
                                 goto error;
                         }
 
-                        if (unlikely(wait_event_interruptible
-                                     (epfile->wait, (ep = epfile->ep)))) {
+                        if (wait_event_interruptible(epfile->wait,
+                                                     (ep = epfile->ep))) {
                                 ret = -EINTR;
                                 goto error;
                         }
@@ -811,12 +815,16 @@ first_try:
                 if (unlikely(ret))
                         goto error;
 
-                /* We're called from user space, we can use _irq rather then
-                 * _irqsave */
+                /*
+                 * We're called from user space, we can use _irq rather then
+                 * _irqsave
+                 */
                 spin_lock_irq(&epfile->ffs->eps_lock);
 
-                /* While we were acquiring mutex endpoint got disabled
-                 * or changed? */
+                /*
+                 * While we were acquiring mutex endpoint got disabled
+                 * or changed?
+                 */
         } while (unlikely(epfile->ep != ep));
 
         /* Halt */
@@ -858,7 +866,6 @@ error:
         return ret;
 }
 
-
 static ssize_t
 ffs_epfile_write(struct file *file, const char __user *buf, size_t len,
                  loff_t *ptr)
@@ -904,7 +911,6 @@ ffs_epfile_release(struct inode *inode, struct file *file)
         return 0;
 }
 
-
 static long ffs_epfile_ioctl(struct file *file, unsigned code,
                              unsigned long value)
 {
@@ -943,7 +949,6 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
         return ret;
 }
 
-
 static const struct file_operations ffs_epfile_operations = {
         .owner =        THIS_MODULE,
         .llseek =       no_llseek,
@@ -956,15 +961,13 @@ static const struct file_operations ffs_epfile_operations = {
 };
 
 
-
 /* File system and super block operations ***********************************/
 
 /*
- * Mounting the filesystem creates a controller file, used first for
+ * Mounting the file system creates a controller file, used first for
  * function configuration then later for event monitoring.
  */
 
-
 static struct inode *__must_check
 ffs_sb_make_inode(struct super_block *sb, void *data,
                   const struct file_operations *fops,
@@ -980,6 +983,7 @@ ffs_sb_make_inode(struct super_block *sb, void *data,
         if (likely(inode)) {
                 struct timespec current_time = CURRENT_TIME;
 
+                inode->i_ino     = get_next_ino();
                 inode->i_mode    = perms->mode;
                 inode->i_uid     = perms->uid;
                 inode->i_gid     = perms->gid;
@@ -996,9 +1000,7 @@ ffs_sb_make_inode(struct super_block *sb, void *data,
         return inode;
 }
 
-
 /* Create "regular" file */
-
 static struct inode *ffs_sb_create_file(struct super_block *sb,
                                         const char *name, void *data,
                                         const struct file_operations *fops,
@@ -1027,9 +1029,7 @@ static struct inode *ffs_sb_create_file(struct super_block *sb,
         return inode;
 }
 
-
 /* Super block */
-
 static const struct super_operations ffs_sb_operations = {
         .statfs =       simple_statfs,
         .drop_inode =   generic_delete_inode,
@@ -1050,7 +1050,7 @@ static int ffs_sb_fill(struct super_block *sb, void *_data, int silent)
 
         ENTER();
 
-        /* Initialize data */
+        /* Initialise data */
         ffs = ffs_data_new();
         if (unlikely(!ffs))
                 goto enomem0;
@@ -1096,7 +1096,6 @@ enomem0:
         return -ENOMEM;
 }
 
-
 static int ffs_fs_parse_opts(struct ffs_sb_fill_data *data, char *opts)
 {
         ENTER();
@@ -1116,7 +1115,7 @@ static int ffs_fs_parse_opts(struct ffs_sb_fill_data *data, char *opts)
                 /* Value limit */
                 eq = strchr(opts, '=');
                 if (unlikely(!eq)) {
-                        FERR("'=' missing in %s", opts);
+                        pr_err("'=' missing in %s\n", opts);
                         return -EINVAL;
                 }
                 *eq = 0;
@@ -1124,7 +1123,7 @@ static int ffs_fs_parse_opts(struct ffs_sb_fill_data *data, char *opts)
                 /* Parse value */
                 value = simple_strtoul(eq + 1, &end, 0);
                 if (unlikely(*end != ',' && *end != 0)) {
-                        FERR("%s: invalid value: %s", opts, eq + 1);
+                        pr_err("%s: invalid value: %s\n", opts, eq + 1);
                         return -EINVAL;
                 }
 
@@ -1159,7 +1158,7 @@ static int ffs_fs_parse_opts(struct ffs_sb_fill_data *data, char *opts)
 
                 default:
 invalid:
-                        FERR("%s: invalid option", opts);
+                        pr_err("%s: invalid option\n", opts);
                         return -EINVAL;
                 }
 
@@ -1172,12 +1171,11 @@ invalid:
         return 0;
 }
 
-
 /* "mount -t functionfs dev_name /dev/function" ends up here */
 
-static int
-ffs_fs_get_sb(struct file_system_type *t, int flags,
-              const char *dev_name, void *opts, struct vfsmount *mnt)
+static struct dentry *
+ffs_fs_mount(struct file_system_type *t, int flags,
+              const char *dev_name, void *opts)
 {
         struct ffs_sb_fill_data data = {
                 .perms = {
@@ -1193,14 +1191,14 @@ ffs_fs_get_sb(struct file_system_type *t, int flags,
 
         ret = functionfs_check_dev_callback(dev_name);
         if (unlikely(ret < 0))
-                return ret;
+                return ERR_PTR(ret);
 
         ret = ffs_fs_parse_opts(&data, opts);
         if (unlikely(ret < 0))
-                return ret;
+                return ERR_PTR(ret);
 
         data.dev_name = dev_name;
-        return get_sb_single(t, flags, &data, ffs_sb_fill, mnt);
+        return mount_single(t, flags, &data, ffs_sb_fill);
 }
 
 static void
@@ -1219,15 +1217,13 @@ ffs_fs_kill_sb(struct super_block *sb)
 static struct file_system_type ffs_fs_type = {
         .owner          = THIS_MODULE,
         .name           = "functionfs",
-        .get_sb         = ffs_fs_get_sb,
+        .mount          = ffs_fs_mount,
         .kill_sb        = ffs_fs_kill_sb,
 };
 
 
-
 /* Driver's main init/cleanup functions *************************************/
 
-
 static int functionfs_init(void)
 {
         int ret;
@@ -1236,9 +1232,9 @@ static int functionfs_init(void)
 
         ret = register_filesystem(&ffs_fs_type);
         if (likely(!ret))
-                FINFO("file system registered");
+                pr_info("file system registered\n");
         else
-                FERR("failed registering file system (%d)", ret);
+                pr_err("failed registering file system (%d)\n", ret);
 
         return ret;
 }
@@ -1247,18 +1243,16 @@ static void functionfs_cleanup(void)
 {
         ENTER();
 
-        FINFO("unloading");
+        pr_info("unloading\n");
         unregister_filesystem(&ffs_fs_type);
 }
 
 
-
 /* ffs_data and ffs_function construction and destruction code **************/
 
 static void ffs_data_clear(struct ffs_data *ffs);
 static void ffs_data_reset(struct ffs_data *ffs);
 
-
 static void ffs_data_get(struct ffs_data *ffs)
 {
         ENTER();
@@ -1279,7 +1273,7 @@ static void ffs_data_put(struct ffs_data *ffs)
         ENTER();
 
         if (unlikely(atomic_dec_and_test(&ffs->ref))) {
-                FINFO("%s(): freeing", __func__);
+                pr_info("%s(): freeing\n", __func__);
                 ffs_data_clear(ffs);
                 BUG_ON(mutex_is_locked(&ffs->mutex) ||
                        spin_is_locked(&ffs->ev.waitq.lock) ||
@@ -1289,8 +1283,6 @@ static void ffs_data_put(struct ffs_data *ffs)
         }
 }
 
-
-
 static void ffs_data_closed(struct ffs_data *ffs)
 {
         ENTER();
@@ -1303,7 +1295,6 @@ static void ffs_data_closed(struct ffs_data *ffs)
         ffs_data_put(ffs);
 }
 
-
 static struct ffs_data *ffs_data_new(void)
 {
         struct ffs_data *ffs = kzalloc(sizeof *ffs, GFP_KERNEL);
@@ -1326,7 +1317,6 @@ static struct ffs_data *ffs_data_new(void)
         return ffs;
 }
 
-
 static void ffs_data_clear(struct ffs_data *ffs)
 {
         ENTER();
@@ -1344,7 +1334,6 @@ static void ffs_data_clear(struct ffs_data *ffs)
         kfree(ffs->stringtabs);
 }
 
-
 static void ffs_data_reset(struct ffs_data *ffs)
 {
         ENTER();
@@ -1407,7 +1396,6 @@ static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev)
         return 0;
 }
 
-
 static void functionfs_unbind(struct ffs_data *ffs)
 {
         ENTER();
@@ -1420,7 +1408,6 @@ static void functionfs_unbind(struct ffs_data *ffs)
         }
 }
 
-
 static int ffs_epfiles_create(struct ffs_data *ffs)
 {
         struct ffs_epfile *epfile, *epfiles;
@@ -1451,7 +1438,6 @@ static int ffs_epfiles_create(struct ffs_data *ffs)
         return 0;
 }
 
-
 static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count)
 {
         struct ffs_epfile *epfile = epfiles;
@@ -1471,7 +1457,6 @@ static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count)
         kfree(epfiles);
 }
 
-
 static int functionfs_bind_config(struct usb_composite_dev *cdev,
                                   struct usb_configuration *c,
                                   struct ffs_data *ffs)
@@ -1491,7 +1476,6 @@ static int functionfs_bind_config(struct usb_composite_dev *cdev,
         func->function.bind    = ffs_func_bind;
         func->function.unbind  = ffs_func_unbind;
         func->function.set_alt = ffs_func_set_alt;
-        /*func->function.get_alt = ffs_func_get_alt;*/
         func->function.disable = ffs_func_disable;
         func->function.setup   = ffs_func_setup;
         func->function.suspend = ffs_func_suspend;
@@ -1516,14 +1500,15 @@ static void ffs_func_free(struct ffs_function *func)
         ffs_data_put(func->ffs);
 
         kfree(func->eps);
-        /* eps and interfaces_nums are allocated in the same chunk so
+        /*
+         * eps and interfaces_nums are allocated in the same chunk so
          * only one free is required.  Descriptors are also allocated
-         * in the same chunk. */
+         * in the same chunk.
+         */
 
         kfree(func);
 }
 
-
 static void ffs_func_eps_disable(struct ffs_function *func)
 {
         struct ffs_ep *ep         = func->eps;
@@ -1581,11 +1566,12 @@ static int ffs_func_eps_enable(struct ffs_function *func)
 
 /* Parsing and building descriptors and strings *****************************/
 
-
-/* This validates if data pointed by data is a valid USB descriptor as
+/*
+ * This validates if data pointed by data is a valid USB descriptor as
  * well as record how many interfaces, endpoints and strings are
- * required by given configuration.  Returns address afther the
- * descriptor or NULL if data is invalid. */
+ * required by given configuration.  Returns address after the
+ * descriptor or NULL if data is invalid.
+ */
 
 enum ffs_entity_type {
         FFS_DESCRIPTOR, FFS_INTERFACE, FFS_STRING, FFS_ENDPOINT
@@ -1607,14 +1593,14 @@ static int __must_check ffs_do_desc(char *data, unsigned len,
 
         /* At least two bytes are required: length and type */
         if (len < 2) {
-                FVDBG("descriptor too short");
+                pr_vdebug("descriptor too short\n");
                 return -EINVAL;
         }
 
         /* If we have at least as many bytes as the descriptor takes? */
         length = _ds->bLength;
         if (len < length) {
-                FVDBG("descriptor longer then available data");
+                pr_vdebug("descriptor longer then available data\n");
                 return -EINVAL;
         }
 
@@ -1622,15 +1608,15 @@ static int __must_check ffs_do_desc(char *data, unsigned len,
 #define __entity_check_STRING(val)     (val)
 #define __entity_check_ENDPOINT(val)   ((val) & USB_ENDPOINT_NUMBER_MASK)
 #define __entity(type, val) do {                                        \
-                FVDBG("entity " #type "(%02x)", (val));                 \
+                pr_vdebug("entity " #type "(%02x)\n", (val));           \
                 if (unlikely(!__entity_check_ ##type(val))) {           \
-                        FVDBG("invalid entity's value");                \
+                        pr_vdebug("invalid entity's value\n");          \
                         return -EINVAL;                                 \
                 }                                                       \
                 ret = entity(FFS_ ##type, &val, _ds, priv);             \
                 if (unlikely(ret < 0)) {                                \
-                        FDBG("entity " #type "(%02x); ret = %d",        \
-                             (val), ret);                               \
+                        pr_debug("entity " #type "(%02x); ret = %d\n",  \
+                                 (val), ret);                           \
                         return ret;                                     \
                 }                                                       \
         } while (0)
@@ -1642,12 +1628,13 @@ static int __must_check ffs_do_desc(char *data, unsigned len,
         case USB_DT_STRING:
         case USB_DT_DEVICE_QUALIFIER:
                 /* function can't have any of those */
-                FVDBG("descriptor reserved for gadget: %d", _ds->bDescriptorType);
+                pr_vdebug("descriptor reserved for gadget: %d\n",
+                      _ds->bDescriptorType);
                 return -EINVAL;
 
         case USB_DT_INTERFACE: {
                 struct usb_interface_descriptor *ds = (void *)_ds;
-                FVDBG("interface descriptor");
+                pr_vdebug("interface descriptor\n");
                 if (length != sizeof *ds)
                         goto inv_length;
 
@@ -1659,7 +1646,7 @@ static int __must_check ffs_do_desc(char *data, unsigned len,
 
         case USB_DT_ENDPOINT: {
                 struct usb_endpoint_descriptor *ds = (void *)_ds;
-                FVDBG("endpoint descriptor");
+                pr_vdebug("endpoint descriptor\n");
                 if (length != USB_DT_ENDPOINT_SIZE &&
                     length != USB_DT_ENDPOINT_AUDIO_SIZE)
                         goto inv_length;
@@ -1674,7 +1661,7 @@ static int __must_check ffs_do_desc(char *data, unsigned len,
 
         case USB_DT_INTERFACE_ASSOCIATION: {
                 struct usb_interface_assoc_descriptor *ds = (void *)_ds;
-                FVDBG("interface association descriptor");
+                pr_vdebug("interface association descriptor\n");
                 if (length != sizeof *ds)
                         goto inv_length;
                 if (ds->iFunction)
@@ -1688,17 +1675,17 @@ static int __must_check ffs_do_desc(char *data, unsigned len,
         case USB_DT_SECURITY:
         case USB_DT_CS_RADIO_CONTROL:
                 /* TODO */
-                FVDBG("unimplemented descriptor: %d", _ds->bDescriptorType);
+                pr_vdebug("unimplemented descriptor: %d\n", _ds->bDescriptorType);
                 return -EINVAL;
 
         default:
                 /* We should never be here */
-                FVDBG("unknown descriptor: %d", _ds->bDescriptorType);
+                pr_vdebug("unknown descriptor: %d\n", _ds->bDescriptorType);
                 return -EINVAL;
 
-        inv_length:
-                FVDBG("invalid length: %d (descriptor %d)",
-                      _ds->bLength, _ds->bDescriptorType);
+inv_length:
+                pr_vdebug("invalid length: %d (descriptor %d)\n",
+                          _ds->bLength, _ds->bDescriptorType);
                 return -EINVAL;
         }
 
@@ -1711,7 +1698,6 @@ static int __must_check ffs_do_desc(char *data, unsigned len,
         return length;
 }
 
-
 static int __must_check ffs_do_descs(unsigned count, char *data, unsigned len,
                                      ffs_entity_callback entity, void *priv)
 {
@@ -1726,10 +1712,11 @@ static int __must_check ffs_do_descs(unsigned count, char *data, unsigned len,
                 if (num == count)
                         data = NULL;
 
-                /* Record "descriptor" entitny */
+                /* Record "descriptor" entity */
                 ret = entity(FFS_DESCRIPTOR, (u8 *)num, (void *)data, priv);
                 if (unlikely(ret < 0)) {
-                        FDBG("entity DESCRIPTOR(%02lx); ret = %d", num, ret);
+                        pr_debug("entity DESCRIPTOR(%02lx); ret = %d\n",
+                                 num, ret);
                         return ret;
                 }
 
@@ -1738,7 +1725,7 @@ static int __must_check ffs_do_descs(unsigned count, char *data, unsigned len,
 
                 ret = ffs_do_desc(data, len, entity, priv);
                 if (unlikely(ret < 0)) {
-                        FDBG("%s returns %d", __func__, ret);
+                        pr_debug("%s returns %d\n", __func__, ret);
                         return ret;
                 }
 
@@ -1748,7 +1735,6 @@ static int __must_check ffs_do_descs(unsigned count, char *data, unsigned len,
         }
 }
 
-
 static int __ffs_data_do_entity(enum ffs_entity_type type,
                                 u8 *valuep, struct usb_descriptor_header *desc,
                                 void *priv)
@@ -1762,16 +1748,20 @@ static int __ffs_data_do_entity(enum ffs_entity_type type,
                 break;
 
         case FFS_INTERFACE:
-                /* Interfaces are indexed from zero so if we
+                /*
+                 * Interfaces are indexed from zero so if we
                  * encountered interface "n" then there are at least
-                 * "n+1" interfaces. */
+                 * "n+1" interfaces.
+                 */
                 if (*valuep >= ffs->interfaces_count)
                         ffs->interfaces_count = *valuep + 1;
                 break;
 
         case FFS_STRING:
-                /* Strings are indexed from 1 (0 is magic ;) reserved
-                 * for languages list or some such) */
+                /*
+                 * Strings are indexed from 1 (0 is magic ;) reserved
+                 * for languages list or some such)
+                 */
                 if (*valuep > ffs->strings_count)
                         ffs->strings_count = *valuep;
                 break;
@@ -1786,7 +1776,6 @@ static int __ffs_data_do_entity(enum ffs_entity_type type,
         return 0;
 }
 
-
 static int __ffs_data_got_descs(struct ffs_data *ffs,
                                 char *const _data, size_t len)
 {
@@ -1849,8 +1838,6 @@ error:
         return ret;
 }
 
-
-
 static int __ffs_data_got_strings(struct ffs_data *ffs,
                                   char *const _data, size_t len)
 {
@@ -1876,17 +1863,17 @@ static int __ffs_data_got_strings(struct ffs_data *ffs,
         if (unlikely(str_count < needed_count))
                 goto error;
 
-        /* If we don't need any strings just return and free all
-         * memory */
+        /*
+         * If we don't need any strings just return and free all
+         * memory.
+         */
         if (!needed_count) {
                 kfree(_data);
                 return 0;
         }
 
-        /* Allocate */
+        /* Allocate everything in one chunk so there's less maintenance. */
         {
-                /* Allocate everything in one chunk so there's less
-                 * maintanance. */
                 struct {
                         struct usb_gadget_strings *stringtabs[lang_count + 1];
                         struct usb_gadget_strings stringtab[lang_count];
@@ -1937,13 +1924,17 @@ static int __ffs_data_got_strings(struct ffs_data *ffs,
                         if (unlikely(length == len))
                                 goto error_free;
 
-                        /* user may provide more strings then we need,
-                         * if that's the case we simply ingore the
-                         * rest */
+                        /*
+                         * User may provide more strings then we need,
+                         * if that's the case we simply ignore the
+                         * rest
+                         */
                         if (likely(needed)) {
-                                /* s->id will be set while adding
+                                /*
+                                 * s->id will be set while adding
                                  * function to configuration so for
-                                 * now just leave garbage here. */
+                                 * now just leave garbage here.
+                                 */
                                 s->s = data;
                                 --needed;
                                 ++s;
@@ -1977,8 +1968,6 @@ error:
 }
 
 
-
-
 /* Events handling and management *******************************************/
 
 static void __ffs_event_add(struct ffs_data *ffs,
@@ -1987,29 +1976,32 @@ static void __ffs_event_add(struct ffs_data *ffs,
         enum usb_functionfs_event_type rem_type1, rem_type2 = type;
         int neg = 0;
 
-        /* Abort any unhandled setup */
-        /* We do not need to worry about some cmpxchg() changing value
+        /*
+         * Abort any unhandled setup
+         *
+         * We do not need to worry about some cmpxchg() changing value
          * of ffs->setup_state without holding the lock because when
          * state is FFS_SETUP_PENDING cmpxchg() in several places in
-         * the source does nothing. */
+         * the source does nothing.
+         */
         if (ffs->setup_state == FFS_SETUP_PENDING)
                 ffs->setup_state = FFS_SETUP_CANCELED;
 
         switch (type) {
         case FUNCTIONFS_RESUME:
                 rem_type2 = FUNCTIONFS_SUSPEND;
-                /* FALL THGOUTH */
+                /* FALL THROUGH */
         case FUNCTIONFS_SUSPEND:
         case FUNCTIONFS_SETUP:
                 rem_type1 = type;
-                /* discard all similar events */
+                /* Discard all similar events */
                 break;
 
         case FUNCTIONFS_BIND:
         case FUNCTIONFS_UNBIND:
         case FUNCTIONFS_DISABLE:
         case FUNCTIONFS_ENABLE:
-                /* discard everything other then power management. */
+                /* Discard everything other then power management. */
                 rem_type1 = FUNCTIONFS_SUSPEND;
                 rem_type2 = FUNCTIONFS_RESUME;
                 neg = 1;
@@ -2026,11 +2018,11 @@ static void __ffs_event_add(struct ffs_data *ffs,
                         if ((*ev == rem_type1 || *ev == rem_type2) == neg)
                                 *out++ = *ev;
                         else
-                                FVDBG("purging event %d", *ev);
+                                pr_vdebug("purging event %d\n", *ev);
                 ffs->ev.count = out - ffs->ev.types;
         }
 
-        FVDBG("adding event %d", type);
+        pr_vdebug("adding event %d\n", type);
         ffs->ev.types[ffs->ev.count++] = type;
         wake_up_locked(&ffs->ev.waitq);
 }
@@ -2055,8 +2047,10 @@ static int __ffs_func_bind_do_descs(enum ffs_entity_type type, u8 *valuep,
         struct ffs_function *func = priv;
         struct ffs_ep *ffs_ep;
 
-        /* If hs_descriptors is not NULL then we are reading hs
-         * descriptors now */
+        /*
+         * If hs_descriptors is not NULL then we are reading hs
+         * descriptors now
+         */
         const int isHS = func->function.hs_descriptors != NULL;
         unsigned idx;
 
@@ -2075,9 +2069,9 @@ static int __ffs_func_bind_do_descs(enum ffs_entity_type type, u8 *valuep,
         ffs_ep = func->eps + idx;
 
         if (unlikely(ffs_ep->descs[isHS])) {
-                FVDBG("two %sspeed descriptors for EP %d",
-                      isHS ? "high" : "full",
-                      ds->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
+                pr_vdebug("two %sspeed descriptors for EP %d\n",
+                          isHS ? "high" : "full",
+                          ds->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
                 return -EINVAL;
         }
         ffs_ep->descs[isHS] = ds;
@@ -2091,11 +2085,11 @@ static int __ffs_func_bind_do_descs(enum ffs_entity_type type, u8 *valuep,
                 struct usb_request *req;
                 struct usb_ep *ep;
 
-                FVDBG("autoconfig");
+                pr_vdebug("autoconfig\n");
                 ep = usb_ep_autoconfig(func->gadget, ds);
                 if (unlikely(!ep))
                         return -ENOTSUPP;
-                ep->driver_data = func->eps + idx;;
+                ep->driver_data = func->eps + idx;
 
                 req = usb_ep_alloc_request(ep, GFP_KERNEL);
                 if (unlikely(!req))
@@ -2111,7 +2105,6 @@ static int __ffs_func_bind_do_descs(enum ffs_entity_type type, u8 *valuep,
         return 0;
 }
 
-
 static int __ffs_func_bind_do_nums(enum ffs_entity_type type, u8 *valuep,
                                    struct usb_descriptor_header *desc,
                                    void *priv)
@@ -2143,8 +2136,10 @@ static int __ffs_func_bind_do_nums(enum ffs_entity_type type, u8 *valuep,
                 break;
 
         case FFS_ENDPOINT:
-                /* USB_DT_ENDPOINT are handled in
-                 * __ffs_func_bind_do_descs(). */
+                /*
+                 * USB_DT_ENDPOINT are handled in
+                 * __ffs_func_bind_do_descs().
+                 */
                 if (desc->bDescriptorType == USB_DT_ENDPOINT)
                         return 0;
 
@@ -2160,7 +2155,7 @@ static int __ffs_func_bind_do_nums(enum ffs_entity_type type, u8 *valuep,
                 break;
         }
 
-        FVDBG("%02x -> %02x", *valuep, newValue);
+        pr_vdebug("%02x -> %02x\n", *valuep, newValue);
         *valuep = newValue;
         return 0;
 }
@@ -2211,9 +2206,11 @@ static int ffs_func_bind(struct usb_configuration *c,
         func->eps             = data->eps;
         func->interfaces_nums = data->inums;
 
-        /* Go throught all the endpoint descriptors and allocate
+        /*
+         * Go through all the endpoint descriptors and allocate
          * endpoints first, so that later we can rewrite the endpoint
-         * numbers without worying that it may be described later on. */
+         * numbers without worrying that it may be described later on.
+         */
         if (likely(full)) {
                 func->function.descriptors = data->fs_descs;
                 ret = ffs_do_descs(ffs->fs_descs_count,
@@ -2234,9 +2231,11 @@ static int ffs_func_bind(struct usb_configuration *c,
                                    __ffs_func_bind_do_descs, func);
         }
 
-        /* Now handle interface numbers allocation and interface and
-         * enpoint numbers rewritting.  We can do that in one go
-         * now. */
+        /*
+         * Now handle interface numbers allocation and interface and
+         * endpoint numbers rewriting.  We can do that in one go
+         * now.
+         */
         ret = ffs_do_descs(ffs->fs_descs_count +
                            (high ? ffs->hs_descs_count : 0),
                            data->raw_descs, sizeof data->raw_descs,
@@ -2274,7 +2273,6 @@ static void ffs_func_unbind(struct usb_configuration *c,
         ffs_func_free(func);
 }
 
-
 static int ffs_func_set_alt(struct usb_function *f,
                             unsigned interface, unsigned alt)
 {
@@ -2322,20 +2320,21 @@ static int ffs_func_setup(struct usb_function *f,
 
         ENTER();
 
-        FVDBG("creq->bRequestType = %02x", creq->bRequestType);
-        FVDBG("creq->bRequest     = %02x", creq->bRequest);
-        FVDBG("creq->wValue       = %04x", le16_to_cpu(creq->wValue));
-        FVDBG("creq->wIndex       = %04x", le16_to_cpu(creq->wIndex));
-        FVDBG("creq->wLength      = %04x", le16_to_cpu(creq->wLength));
+        pr_vdebug("creq->bRequestType = %02x\n", creq->bRequestType);
+        pr_vdebug("creq->bRequest     = %02x\n", creq->bRequest);
+        pr_vdebug("creq->wValue       = %04x\n", le16_to_cpu(creq->wValue));
+        pr_vdebug("creq->wIndex       = %04x\n", le16_to_cpu(creq->wIndex));
+        pr_vdebug("creq->wLength      = %04x\n", le16_to_cpu(creq->wLength));
 
-        /* Most requests directed to interface go throught here
+        /*
+         * Most requests directed to interface go through here
          * (notable exceptions are set/get interface) so we need to
          * handle them.  All other either handled by composite or
          * passed to usb_configuration->setup() (if one is set).  No
          * matter, we will handle requests directed to endpoint here
          * as well (as it's straightforward) but what to do with any
-         * other request? */
-
+         * other request?
+         */
         if (ffs->state != FFS_ACTIVE)
                 return -ENODEV;
 
@@ -2378,8 +2377,7 @@ static void ffs_func_resume(struct usb_function *f)
 }
 
 
-
-/* Enpoint and interface numbers reverse mapping ****************************/
+/* Endpoint and interface numbers reverse mapping ***************************/
 
 static int ffs_func_revmap_ep(struct ffs_function *func, u8 num)
 {
@@ -2410,7 +2408,6 @@ static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
                 : mutex_lock_interruptible(mutex);
 }
 
-
 static char *ffs_prepare_buffer(const char * __user buf, size_t len)
 {
         char *data;
@@ -2427,7 +2424,7 @@ static char *ffs_prepare_buffer(const char * __user buf, size_t len)
                 return ERR_PTR(-EFAULT);
         }
 
-        FVDBG("Buffer from user space:");
+        pr_vdebug("Buffer from user space:\n");
         ffs_dump_mem("", data, len);
 
         return data;
diff --git a/drivers/usb/gadget/f_hid.c b/drivers/usb/gadget/f_hid.c
index 53e120208e99..598e7e2ab80c 100644
--- a/drivers/usb/gadget/f_hid.c
+++ b/drivers/usb/gadget/f_hid.c
@@ -25,7 +25,6 @@
 #include <linux/cdev.h>
 #include <linux/mutex.h>
 #include <linux/poll.h>
-#include <linux/smp_lock.h>
 #include <linux/uaccess.h>
 #include <linux/wait.h>
 #include <linux/usb/g_hid.h>
@@ -318,8 +317,6 @@ static void hidg_set_report_complete(struct usb_ep *ep, struct usb_request *req)
         spin_unlock(&hidg->spinlock);
 
         wake_up(&hidg->read_queue);
-
-        return;
 }
 
 static int hidg_setup(struct usb_function *f,
@@ -413,8 +410,6 @@ static void hidg_disable(struct usb_function *f)
 
         usb_ep_disable(hidg->in_ep);
         hidg->in_ep->driver_data = NULL;
-
-        return;
 }
 
 static int hidg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
@@ -451,6 +446,7 @@ const struct file_operations f_hidg_fops = {
         .write          = f_hidg_write,
         .read           = f_hidg_read,
         .poll           = f_hidg_poll,
+        .llseek         = noop_llseek,
 };
 
 static int __init hidg_bind(struct usb_configuration *c, struct usb_function *f)
diff --git a/drivers/usb/gadget/f_loopback.c b/drivers/usb/gadget/f_loopback.c
index 43225879c3cd..b37960f9e753 100644
--- a/drivers/usb/gadget/f_loopback.c
+++ b/drivers/usb/gadget/f_loopback.c
@@ -324,7 +324,7 @@ static void loopback_disable(struct usb_function *f)
 
 /*-------------------------------------------------------------------------*/
 
-static int __ref loopback_bind_config(struct usb_configuration *c)
+static int __init loopback_bind_config(struct usb_configuration *c)
 {
         struct f_loopback       *loop;
         int                     status;
@@ -346,10 +346,9 @@ static int __ref loopback_bind_config(struct usb_configuration *c)
         return status;
 }
 
-static  struct usb_configuration loopback_driver = {
+static struct usb_configuration loopback_driver = {
         .label          = "loopback",
         .strings        = loopback_strings,
-        .bind           = loopback_bind_config,
         .bConfigurationValue = 2,
         .bmAttributes   = USB_CONFIG_ATT_SELFPOWER,
         /* .iConfiguration = DYNAMIC */
@@ -382,5 +381,5 @@ int __init loopback_add(struct usb_composite_dev *cdev, bool autoresume)
                 loopback_driver.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
         }
 
-        return usb_add_config(cdev, &loopback_driver);
+        return usb_add_config(cdev, &loopback_driver, loopback_bind_config);
 }
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
index 32cce029f65c..efb58f9f5aa9 100644
--- a/drivers/usb/gadget/f_mass_storage.c
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -37,7 +37,6 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 /*
  * The Mass Storage Function acts as a USB Mass Storage device,
  * appearing to the host as a disk drive or as a CD-ROM drive.  In
@@ -73,6 +72,8 @@
  *                              being removable.
  *      ->cdrom         Flag specifying that LUN shall be reported as
  *                              being a CD-ROM.
+ *      ->nofua         Flag specifying that FUA flag in SCSI WRITE(10,12)
+ *                              commands for this LUN shall be ignored.
  *
  *      lun_name_format A printf-like format for names of the LUN
  *                              devices.  This determines how the
@@ -127,6 +128,8 @@
  *                      Default true, boolean for removable media.
  *      cdrom=b[,b...]  Default false, boolean for whether to emulate
  *                              a CD-ROM drive.
+ *      nofua=b[,b...]  Default false, booleans for ignore FUA flag
+ *                              in SCSI WRITE(10,12) commands
  *      luns=N          Default N = number of filenames, number of
  *                              LUNs to support.
  *      stall           Default determined according to the type of
@@ -181,7 +184,6 @@
  * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
  */
 
-
 /*
  *                              Driver Design
  *
@@ -271,7 +273,6 @@
 /* #define VERBOSE_DEBUG */
 /* #define DUMP_MSGS */
 
-
 #include <linux/blkdev.h>
 #include <linux/completion.h>
 #include <linux/dcache.h>
@@ -292,11 +293,11 @@
 
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
+#include <linux/usb/composite.h>
 
 #include "gadget_chips.h"
 
 
-
 /*------------------------------------------------------------------------*/
 
 #define FSG_DRIVER_DESC         "Mass Storage Function"
@@ -304,7 +305,6 @@
 
 static const char fsg_string_interface[] = "Mass Storage";
 
-
 #define FSG_NO_INTR_EP 1
 #define FSG_NO_DEVICE_STRINGS    1
 #define FSG_NO_OTG               1
@@ -320,28 +320,34 @@ struct fsg_common;
 
 /* FSF callback functions */
 struct fsg_operations {
-        /* Callback function to call when thread exits.  If no
+        /*
+         * Callback function to call when thread exits.  If no
          * callback is set or it returns value lower then zero MSF
          * will force eject all LUNs it operates on (including those
          * marked as non-removable or with prevent_medium_removal flag
-         * set). */
+         * set).
+         */
         int (*thread_exits)(struct fsg_common *common);
 
-        /* Called prior to ejection.  Negative return means error,
+        /*
+         * Called prior to ejection.  Negative return means error,
          * zero means to continue with ejection, positive means not to
-         * eject. */
+         * eject.
+         */
         int (*pre_eject)(struct fsg_common *common,
                          struct fsg_lun *lun, int num);
-        /* Called after ejection.  Negative return means error, zero
-         * or positive is just a success. */
+        /*
+         * Called after ejection.  Negative return means error, zero
+         * or positive is just a success.
+         */
         int (*post_eject)(struct fsg_common *common,
                           struct fsg_lun *lun, int num);
 };
 
-
 /* Data shared by all the FSG instances. */
 struct fsg_common {
         struct usb_gadget       *gadget;
+        struct usb_composite_dev *cdev;
         struct fsg_dev          *fsg, *new_fsg;
         wait_queue_head_t       fsg_wait;
 
@@ -394,14 +400,15 @@ struct fsg_common {
         /* Gadget's private data. */
         void                    *private_data;
 
-        /* Vendor (8 chars), product (16 chars), release (4
-         * hexadecimal digits) and NUL byte */
+        /*
+         * Vendor (8 chars), product (16 chars), release (4
+         * hexadecimal digits) and NUL byte
+         */
         char inquiry_string[8 + 16 + 4 + 1];
 
         struct kref             ref;
 };
 
-
 struct fsg_config {
         unsigned nluns;
         struct fsg_lun_config {
@@ -409,6 +416,7 @@ struct fsg_config {
                 char ro;
                 char removable;
                 char cdrom;
+                char nofua;
         } luns[FSG_MAX_LUNS];
 
         const char              *lun_name_format;
@@ -426,7 +434,6 @@ struct fsg_config {
         char                    can_stall;
 };
 
-
 struct fsg_dev {
         struct usb_function     function;
         struct usb_gadget       *gadget;        /* Copy of cdev->gadget */
@@ -444,7 +451,6 @@ struct fsg_dev {
         struct usb_ep           *bulk_out;
 };
 
-
 static inline int __fsg_is_set(struct fsg_common *common,
                                const char *func, unsigned line)
 {
@@ -457,13 +463,11 @@ static inline int __fsg_is_set(struct fsg_common *common,
 
 #define fsg_is_set(common) likely(__fsg_is_set(common, __func__, __LINE__))
 
-
 static inline struct fsg_dev *fsg_from_func(struct usb_function *f)
 {
         return container_of(f, struct fsg_dev, function);
 }
 
-
 typedef void (*fsg_routine_t)(struct fsg_dev *);
 
 static int exception_in_progress(struct fsg_common *common)
@@ -473,7 +477,7 @@ static int exception_in_progress(struct fsg_common *common)
 
 /* Make bulk-out requests be divisible by the maxpacket size */
 static void set_bulk_out_req_length(struct fsg_common *common,
-                struct fsg_buffhd *bh, unsigned int length)
+                                    struct fsg_buffhd *bh, unsigned int length)
 {
         unsigned int    rem;
 
@@ -484,6 +488,7 @@ static void set_bulk_out_req_length(struct fsg_common *common,
         bh->outreq->length = length;
 }
 
+
 /*-------------------------------------------------------------------------*/
 
 static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
@@ -514,14 +519,15 @@ static void wakeup_thread(struct fsg_common *common)
                 wake_up_process(common->thread_task);
 }
 
-
 static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
 {
         unsigned long           flags;
 
-        /* Do nothing if a higher-priority exception is already in progress.
+        /*
+         * Do nothing if a higher-priority exception is already in progress.
          * If a lower-or-equal priority exception is in progress, preempt it
-         * and notify the main thread by sending it a signal. */
+         * and notify the main thread by sending it a signal.
+         */
         spin_lock_irqsave(&common->lock, flags);
         if (common->state <= new_state) {
                 common->exception_req_tag = common->ep0_req_tag;
@@ -550,10 +556,10 @@ static int ep0_queue(struct fsg_common *common)
         return rc;
 }
 
+
 /*-------------------------------------------------------------------------*/
 
-/* Bulk and interrupt endpoint completion handlers.
- * These always run in_irq. */
+/* Completion handlers. These always run in_irq. */
 
 static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
 {
@@ -562,7 +568,7 @@ static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
 
         if (req->status || req->actual != req->length)
                 DBG(common, "%s --> %d, %u/%u\n", __func__,
-                                req->status, req->actual, req->length);
+                    req->status, req->actual, req->length);
         if (req->status == -ECONNRESET)         /* Request was cancelled */
                 usb_ep_fifo_flush(ep);
 
@@ -583,8 +589,7 @@ static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
         dump_msg(common, "bulk-out", req->buf, req->actual);
         if (req->status || req->actual != bh->bulk_out_intended_length)
                 DBG(common, "%s --> %d, %u/%u\n", __func__,
-                                req->status, req->actual,
-                                bh->bulk_out_intended_length);
+                    req->status, req->actual, bh->bulk_out_intended_length);
         if (req->status == -ECONNRESET)         /* Request was cancelled */
                 usb_ep_fifo_flush(ep);
 
@@ -597,13 +602,8 @@ static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
         spin_unlock(&common->lock);
 }
 
-
-/*-------------------------------------------------------------------------*/
-
-/* Ep0 class-specific handlers.  These always run in_irq. */
-
 static int fsg_setup(struct usb_function *f,
-                const struct usb_ctrlrequest *ctrl)
+                     const struct usb_ctrlrequest *ctrl)
 {
         struct fsg_dev          *fsg = fsg_from_func(f);
         struct usb_request      *req = fsg->common->ep0req;
@@ -614,6 +614,11 @@ static int fsg_setup(struct usb_function *f,
         if (!fsg_is_set(fsg->common))
                 return -EOPNOTSUPP;
 
+        ++fsg->common->ep0_req_tag;     /* Record arrival of a new request */
+        req->context = NULL;
+        req->length = 0;
+        dump_msg(fsg, "ep0-setup", (u8 *) ctrl, sizeof(*ctrl));
+
         switch (ctrl->bRequest) {
 
         case USB_BULK_RESET_REQUEST:
@@ -623,8 +628,10 @@ static int fsg_setup(struct usb_function *f,
                 if (w_index != fsg->interface_number || w_value != 0)
                         return -EDOM;
 
-                /* Raise an exception to stop the current operation
-                 * and reinitialize our state. */
+                /*
+                 * Raise an exception to stop the current operation
+                 * and reinitialize our state.
+                 */
                 DBG(fsg, "bulk reset request\n");
                 raise_exception(fsg->common, FSG_STATE_RESET);
                 return DELAYED_STATUS;
@@ -636,7 +643,7 @@ static int fsg_setup(struct usb_function *f,
                 if (w_index != fsg->interface_number || w_value != 0)
                         return -EDOM;
                 VDBG(fsg, "get max LUN\n");
-                *(u8 *) req->buf = fsg->common->nluns - 1;
+                *(u8 *)req->buf = fsg->common->nluns - 1;
 
                 /* Respond with data/status */
                 req->length = min((u16)1, w_length);
@@ -644,8 +651,7 @@ static int fsg_setup(struct usb_function *f,
         }
 
         VDBG(fsg,
-             "unknown class-specific control req "
-             "%02x.%02x v%04x i%04x l%u\n",
+             "unknown class-specific control req %02x.%02x v%04x i%04x l%u\n",
              ctrl->bRequestType, ctrl->bRequest,
              le16_to_cpu(ctrl->wValue), w_index, w_length);
         return -EOPNOTSUPP;
@@ -656,11 +662,10 @@ static int fsg_setup(struct usb_function *f,
 
 /* All the following routines run in process context */
 
-
 /* Use this for bulk or interrupt transfers, not ep0 */
 static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
-                struct usb_request *req, int *pbusy,
-                enum fsg_buffer_state *state)
+                           struct usb_request *req, int *pbusy,
+                           enum fsg_buffer_state *state)
 {
         int     rc;
 
@@ -678,25 +683,34 @@ static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
 
                 /* We can't do much more than wait for a reset */
 
-                /* Note: currently the net2280 driver fails zero-length
-                 * submissions if DMA is enabled. */
-                if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
-                                                req->length == 0))
+                /*
+                 * Note: currently the net2280 driver fails zero-length
+                 * submissions if DMA is enabled.
+                 */
+                if (rc != -ESHUTDOWN &&
+                    !(rc == -EOPNOTSUPP && req->length == 0))
                         WARNING(fsg, "error in submission: %s --> %d\n",
-                                        ep->name, rc);
+                                ep->name, rc);
         }
 }
 
-#define START_TRANSFER_OR(common, ep_name, req, pbusy, state)           \
-        if (fsg_is_set(common))                                         \
-                start_transfer((common)->fsg, (common)->fsg->ep_name,   \
-                               req, pbusy, state);                      \
-        else
-
-#define START_TRANSFER(common, ep_name, req, pbusy, state)              \
-        START_TRANSFER_OR(common, ep_name, req, pbusy, state) (void)0
-
+static bool start_in_transfer(struct fsg_common *common, struct fsg_buffhd *bh)
+{
+        if (!fsg_is_set(common))
+                return false;
+        start_transfer(common->fsg, common->fsg->bulk_in,
+                       bh->inreq, &bh->inreq_busy, &bh->state);
+        return true;
+}
 
+static bool start_out_transfer(struct fsg_common *common, struct fsg_buffhd *bh)
+{
+        if (!fsg_is_set(common))
+                return false;
+        start_transfer(common->fsg, common->fsg->bulk_out,
+                       bh->outreq, &bh->outreq_busy, &bh->state);
+        return true;
+}
 
 static int sleep_thread(struct fsg_common *common)
 {
@@ -734,16 +748,20 @@ static int do_read(struct fsg_common *common)
         unsigned int            partial_page;
         ssize_t                 nread;
 
-        /* Get the starting Logical Block Address and check that it's
-         * not too big */
-        if (common->cmnd[0] == SC_READ_6)
+        /*
+         * Get the starting Logical Block Address and check that it's
+         * not too big.
+         */
+        if (common->cmnd[0] == READ_6)
                 lba = get_unaligned_be24(&common->cmnd[1]);
         else {
                 lba = get_unaligned_be32(&common->cmnd[2]);
 
-                /* We allow DPO (Disable Page Out = don't save data in the
+                /*
+                 * We allow DPO (Disable Page Out = don't save data in the
                  * cache) and FUA (Force Unit Access = don't read from the
-                 * cache), but we don't implement them. */
+                 * cache), but we don't implement them.
+                 */
                 if ((common->cmnd[1] & ~0x18) != 0) {
                         curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
                         return -EINVAL;
@@ -761,22 +779,23 @@ static int do_read(struct fsg_common *common)
                 return -EIO;            /* No default reply */
 
         for (;;) {
-
-                /* Figure out how much we need to read:
+                /*
+                 * Figure out how much we need to read:
                  * Try to read the remaining amount.
                  * But don't read more than the buffer size.
                  * And don't try to read past the end of the file.
                  * Finally, if we're not at a page boundary, don't read past
                  *      the next page.
                  * If this means reading 0 then we were asked to read past
-                 *      the end of file. */
+                 *      the end of file.
+                 */
                 amount = min(amount_left, FSG_BUFLEN);
-                amount = min((loff_t) amount,
-                                curlun->file_length - file_offset);
+                amount = min((loff_t)amount,
+                             curlun->file_length - file_offset);
                 partial_page = file_offset & (PAGE_CACHE_SIZE - 1);
                 if (partial_page > 0)
-                        amount = min(amount, (unsigned int) PAGE_CACHE_SIZE -
-                                        partial_page);
+                        amount = min(amount, (unsigned int)PAGE_CACHE_SIZE -
+                                             partial_page);
 
                 /* Wait for the next buffer to become available */
                 bh = common->next_buffhd_to_fill;
@@ -786,8 +805,10 @@ static int do_read(struct fsg_common *common)
                                 return rc;
                 }
 
-                /* If we were asked to read past the end of file,
-                 * end with an empty buffer. */
+                /*
+                 * If we were asked to read past the end of file,
+                 * end with an empty buffer.
+                 */
                 if (amount == 0) {
                         curlun->sense_data =
                                         SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
@@ -801,21 +822,19 @@ static int do_read(struct fsg_common *common)
                 /* Perform the read */
                 file_offset_tmp = file_offset;
                 nread = vfs_read(curlun->filp,
-                                (char __user *) bh->buf,
-                                amount, &file_offset_tmp);
+                                 (char __user *)bh->buf,
+                                 amount, &file_offset_tmp);
                 VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
-                                (unsigned long long) file_offset,
-                                (int) nread);
+                      (unsigned long long)file_offset, (int)nread);
                 if (signal_pending(current))
                         return -EINTR;
 
                 if (nread < 0) {
-                        LDBG(curlun, "error in file read: %d\n",
-                                        (int) nread);
+                        LDBG(curlun, "error in file read: %d\n", (int)nread);
                         nread = 0;
                 } else if (nread < amount) {
                         LDBG(curlun, "partial file read: %d/%u\n",
-                                        (int) nread, amount);
+                             (int)nread, amount);
                         nread -= (nread & 511); /* Round down to a block */
                 }
                 file_offset  += nread;
@@ -837,10 +856,8 @@ static int do_read(struct fsg_common *common)
 
                 /* Send this buffer and go read some more */
                 bh->inreq->zero = 0;
-                START_TRANSFER_OR(common, bulk_in, bh->inreq,
-                               &bh->inreq_busy, &bh->state)
-                        /* Don't know what to do if
-                         * common->fsg is NULL */
+                if (!start_in_transfer(common, bh))
+                        /* Don't know what to do if common->fsg is NULL */
                         return -EIO;
                 common->next_buffhd_to_fill = bh->next;
         }
@@ -872,22 +889,26 @@ static int do_write(struct fsg_common *common)
         curlun->filp->f_flags &= ~O_SYNC;       /* Default is not to wait */
         spin_unlock(&curlun->filp->f_lock);
 
-        /* Get the starting Logical Block Address and check that it's
-         * not too big */
-        if (common->cmnd[0] == SC_WRITE_6)
+        /*
+         * Get the starting Logical Block Address and check that it's
+         * not too big
+         */
+        if (common->cmnd[0] == WRITE_6)
                 lba = get_unaligned_be24(&common->cmnd[1]);
         else {
                 lba = get_unaligned_be32(&common->cmnd[2]);
 
-                /* We allow DPO (Disable Page Out = don't save data in the
+                /*
+                 * We allow DPO (Disable Page Out = don't save data in the
                  * cache) and FUA (Force Unit Access = write directly to the
                  * medium).  We don't implement DPO; we implement FUA by
-                 * performing synchronous output. */
+                 * performing synchronous output.
+                 */
                 if (common->cmnd[1] & ~0x18) {
                         curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
                         return -EINVAL;
                 }
-                if (common->cmnd[1] & 0x08) {   /* FUA */
+                if (!curlun->nofua && (common->cmnd[1] & 0x08)) { /* FUA */
                         spin_lock(&curlun->filp->f_lock);
                         curlun->filp->f_flags |= O_SYNC;
                         spin_unlock(&curlun->filp->f_lock);
@@ -910,7 +931,8 @@ static int do_write(struct fsg_common *common)
                 bh = common->next_buffhd_to_fill;
                 if (bh->state == BUF_STATE_EMPTY && get_some_more) {
 
-                        /* Figure out how much we want to get:
+                        /*
+                         * Figure out how much we want to get:
                          * Try to get the remaining amount.
                          * But don't get more than the buffer size.
                          * And don't try to go past the end of the file.
@@ -918,14 +940,15 @@ static int do_write(struct fsg_common *common)
                          *      don't go past the next page.
                          * If this means getting 0, then we were asked
                          *      to write past the end of file.
-                         * Finally, round down to a block boundary. */
+                         * Finally, round down to a block boundary.
+                         */
                         amount = min(amount_left_to_req, FSG_BUFLEN);
-                        amount = min((loff_t) amount, curlun->file_length -
-                                        usb_offset);
+                        amount = min((loff_t)amount,
+                                     curlun->file_length - usb_offset);
                         partial_page = usb_offset & (PAGE_CACHE_SIZE - 1);
                         if (partial_page > 0)
                                 amount = min(amount,
-        (unsigned int) PAGE_CACHE_SIZE - partial_page);
+        (unsigned int)PAGE_CACHE_SIZE - partial_page);
 
                         if (amount == 0) {
                                 get_some_more = 0;
@@ -935,11 +958,13 @@ static int do_write(struct fsg_common *common)
                                 curlun->info_valid = 1;
                                 continue;
                         }
-                        amount -= (amount & 511);
+                        amount -= amount & 511;
                         if (amount == 0) {
 
-                                /* Why were we were asked to transfer a
-                                 * partial block? */
+                                /*
+                                 * Why were we were asked to transfer a
+                                 * partial block?
+                                 */
                                 get_some_more = 0;
                                 continue;
                         }
@@ -951,15 +976,15 @@ static int do_write(struct fsg_common *common)
                         if (amount_left_to_req == 0)
                                 get_some_more = 0;
 
-                        /* amount is always divisible by 512, hence by
-                         * the bulk-out maxpacket size */
+                        /*
+                         * amount is always divisible by 512, hence by
+                         * the bulk-out maxpacket size
+                         */
                         bh->outreq->length = amount;
                         bh->bulk_out_intended_length = amount;
                         bh->outreq->short_not_ok = 1;
-                        START_TRANSFER_OR(common, bulk_out, bh->outreq,
-                                          &bh->outreq_busy, &bh->state)
-                                /* Don't know what to do if
-                                 * common->fsg is NULL */
+                        if (!start_out_transfer(common, bh))
+                                /* Dunno what to do if common->fsg is NULL */
                                 return -EIO;
                         common->next_buffhd_to_fill = bh->next;
                         continue;
@@ -985,30 +1010,29 @@ static int do_write(struct fsg_common *common)
                         amount = bh->outreq->actual;
                         if (curlun->file_length - file_offset < amount) {
                                 LERROR(curlun,
-        "write %u @ %llu beyond end %llu\n",
-        amount, (unsigned long long) file_offset,
-        (unsigned long long) curlun->file_length);
+                                       "write %u @ %llu beyond end %llu\n",
+                                       amount, (unsigned long long)file_offset,
+                                       (unsigned long long)curlun->file_length);
                                 amount = curlun->file_length - file_offset;
                         }
 
                         /* Perform the write */
                         file_offset_tmp = file_offset;
                         nwritten = vfs_write(curlun->filp,
-                                        (char __user *) bh->buf,
-                                        amount, &file_offset_tmp);
+                                             (char __user *)bh->buf,
+                                             amount, &file_offset_tmp);
                         VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
-                                        (unsigned long long) file_offset,
-                                        (int) nwritten);
+                              (unsigned long long)file_offset, (int)nwritten);
                         if (signal_pending(current))
                                 return -EINTR;          /* Interrupted! */
 
                         if (nwritten < 0) {
                                 LDBG(curlun, "error in file write: %d\n",
-                                                (int) nwritten);
+                                     (int)nwritten);
                                 nwritten = 0;
                         } else if (nwritten < amount) {
                                 LDBG(curlun, "partial file write: %d/%u\n",
-                                                (int) nwritten, amount);
+                                     (int)nwritten, amount);
                                 nwritten -= (nwritten & 511);
                                 /* Round down to a block */
                         }
@@ -1081,16 +1105,20 @@ static int do_verify(struct fsg_common *common)
         unsigned int            amount;
         ssize_t                 nread;
 
-        /* Get the starting Logical Block Address and check that it's
-         * not too big */
+        /*
+         * Get the starting Logical Block Address and check that it's
+         * not too big.
+         */
         lba = get_unaligned_be32(&common->cmnd[2]);
         if (lba >= curlun->num_sectors) {
                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
                 return -EINVAL;
         }
 
-        /* We allow DPO (Disable Page Out = don't save data in the
-         * cache) but we don't implement it. */
+        /*
+         * We allow DPO (Disable Page Out = don't save data in the
+         * cache) but we don't implement it.
+         */
         if (common->cmnd[1] & ~0x10) {
                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
                 return -EINVAL;
@@ -1115,16 +1143,17 @@ static int do_verify(struct fsg_common *common)
 
         /* Just try to read the requested blocks */
         while (amount_left > 0) {
-
-                /* Figure out how much we need to read:
+                /*
+                 * Figure out how much we need to read:
                  * Try to read the remaining amount, but not more than
                  * the buffer size.
                  * And don't try to read past the end of the file.
                  * If this means reading 0 then we were asked to read
-                 * past the end of file. */
+                 * past the end of file.
+                 */
                 amount = min(amount_left, FSG_BUFLEN);
-                amount = min((loff_t) amount,
-                                curlun->file_length - file_offset);
+                amount = min((loff_t)amount,
+                             curlun->file_length - file_offset);
                 if (amount == 0) {
                         curlun->sense_data =
                                         SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
@@ -1145,13 +1174,12 @@ static int do_verify(struct fsg_common *common)
                         return -EINTR;
 
                 if (nread < 0) {
-                        LDBG(curlun, "error in file verify: %d\n",
-                                        (int) nread);
+                        LDBG(curlun, "error in file verify: %d\n", (int)nread);
                         nread = 0;
                 } else if (nread < amount) {
                         LDBG(curlun, "partial file verify: %d/%u\n",
-                                        (int) nread, amount);
-                        nread -= (nread & 511); /* Round down to a sector */
+                             (int)nread, amount);
+                        nread -= nread & 511;   /* Round down to a sector */
                 }
                 if (nread == 0) {
                         curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
@@ -1181,7 +1209,7 @@ static int do_inquiry(struct fsg_common *common, struct fsg_buffhd *bh)
                 return 36;
         }
 
-        buf[0] = curlun->cdrom ? TYPE_CDROM : TYPE_DISK;
+        buf[0] = curlun->cdrom ? TYPE_ROM : TYPE_DISK;
         buf[1] = curlun->removable ? 0x80 : 0;
         buf[2] = 2;             /* ANSI SCSI level 2 */
         buf[3] = 2;             /* SCSI-2 INQUIRY data format */
@@ -1193,7 +1221,6 @@ static int do_inquiry(struct fsg_common *common, struct fsg_buffhd *bh)
         return 36;
 }
 
-
 static int do_request_sense(struct fsg_common *common, struct fsg_buffhd *bh)
 {
         struct fsg_lun  *curlun = common->curlun;
@@ -1247,13 +1274,12 @@ static int do_request_sense(struct fsg_common *common, struct fsg_buffhd *bh)
         return 18;
 }
 
-
 static int do_read_capacity(struct fsg_common *common, struct fsg_buffhd *bh)
 {
         struct fsg_lun  *curlun = common->curlun;
         u32             lba = get_unaligned_be32(&common->cmnd[2]);
         int             pmi = common->cmnd[8];
-        u8              *buf = (u8 *) bh->buf;
+        u8              *buf = (u8 *)bh->buf;
 
         /* Check the PMI and LBA fields */
         if (pmi > 1 || (pmi == 0 && lba != 0)) {
@@ -1267,13 +1293,12 @@ static int do_read_capacity(struct fsg_common *common, struct fsg_buffhd *bh)
         return 8;
 }
 
-
 static int do_read_header(struct fsg_common *common, struct fsg_buffhd *bh)
 {
         struct fsg_lun  *curlun = common->curlun;
         int             msf = common->cmnd[1] & 0x02;
         u32             lba = get_unaligned_be32(&common->cmnd[2]);
-        u8              *buf = (u8 *) bh->buf;
+        u8              *buf = (u8 *)bh->buf;
 
         if (common->cmnd[1] & ~0x02) {          /* Mask away MSF */
                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
@@ -1290,13 +1315,12 @@ static int do_read_header(struct fsg_common *common, struct fsg_buffhd *bh)
         return 8;
 }
 
-
 static int do_read_toc(struct fsg_common *common, struct fsg_buffhd *bh)
 {
         struct fsg_lun  *curlun = common->curlun;
         int             msf = common->cmnd[1] & 0x02;
         int             start_track = common->cmnd[6];
-        u8              *buf = (u8 *) bh->buf;
+        u8              *buf = (u8 *)bh->buf;
 
         if ((common->cmnd[1] & ~0x02) != 0 ||   /* Mask away MSF */
                         start_track > 1) {
@@ -1318,7 +1342,6 @@ static int do_read_toc(struct fsg_common *common, struct fsg_buffhd *bh)
         return 20;
 }
 
-
 static int do_mode_sense(struct fsg_common *common, struct fsg_buffhd *bh)
 {
         struct fsg_lun  *curlun = common->curlun;
@@ -1343,16 +1366,18 @@ static int do_mode_sense(struct fsg_common *common, struct fsg_buffhd *bh)
         changeable_values = (pc == 1);
         all_pages = (page_code == 0x3f);
 
-        /* Write the mode parameter header.  Fixed values are: default
+        /*
+         * Write the mode parameter header.  Fixed values are: default
          * medium type, no cache control (DPOFUA), and no block descriptors.
          * The only variable value is the WriteProtect bit.  We will fill in
-         * the mode data length later. */
+         * the mode data length later.
+         */
         memset(buf, 0, 8);
-        if (mscmnd == SC_MODE_SENSE_6) {
+        if (mscmnd == MODE_SENSE) {
                 buf[2] = (curlun->ro ? 0x80 : 0x00);            /* WP, DPOFUA */
                 buf += 4;
                 limit = 255;
-        } else {                        /* SC_MODE_SENSE_10 */
+        } else {                        /* MODE_SENSE_10 */
                 buf[3] = (curlun->ro ? 0x80 : 0x00);            /* WP, DPOFUA */
                 buf += 8;
                 limit = 65535;          /* Should really be FSG_BUFLEN */
@@ -1360,8 +1385,10 @@ static int do_mode_sense(struct fsg_common *common, struct fsg_buffhd *bh)
 
         /* No block descriptors */
 
-        /* The mode pages, in numerical order.  The only page we support
-         * is the Caching page. */
+        /*
+         * The mode pages, in numerical order.  The only page we support
+         * is the Caching page.
+         */
         if (page_code == 0x08 || all_pages) {
                 valid_page = 1;
                 buf[0] = 0x08;          /* Page code */
@@ -1383,8 +1410,10 @@ static int do_mode_sense(struct fsg_common *common, struct fsg_buffhd *bh)
                 buf += 12;
         }
 
-        /* Check that a valid page was requested and the mode data length
-         * isn't too long. */
+        /*
+         * Check that a valid page was requested and the mode data length
+         * isn't too long.
+         */
         len = buf - buf0;
         if (!valid_page || len > limit) {
                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
@@ -1392,14 +1421,13 @@ static int do_mode_sense(struct fsg_common *common, struct fsg_buffhd *bh)
         }
 
         /*  Store the mode data length */
-        if (mscmnd == SC_MODE_SENSE_6)
+        if (mscmnd == MODE_SENSE)
                 buf0[0] = len - 1;
         else
                 put_unaligned_be16(len - 2, buf0);
         return len;
 }
 
-
 static int do_start_stop(struct fsg_common *common)
 {
         struct fsg_lun  *curlun = common->curlun;
@@ -1419,8 +1447,10 @@ static int do_start_stop(struct fsg_common *common)
         loej  = common->cmnd[4] & 0x02;
         start = common->cmnd[4] & 0x01;
 
-        /* Our emulation doesn't support mounting; the medium is
-         * available for use as soon as it is loaded. */
+        /*
+         * Our emulation doesn't support mounting; the medium is
+         * available for use as soon as it is loaded.
+         */
         if (start) {
                 if (!fsg_lun_is_open(curlun)) {
                         curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
@@ -1461,7 +1491,6 @@ static int do_start_stop(struct fsg_common *common)
                 : 0;
 }
 
-
 static int do_prevent_allow(struct fsg_common *common)
 {
         struct fsg_lun  *curlun = common->curlun;
@@ -1486,7 +1515,6 @@ static int do_prevent_allow(struct fsg_common *common)
         return 0;
 }
 
-
 static int do_read_format_capacities(struct fsg_common *common,
                         struct fsg_buffhd *bh)
 {
@@ -1504,7 +1532,6 @@ static int do_read_format_capacities(struct fsg_common *common,
         return 12;
 }
 
-
 static int do_mode_select(struct fsg_common *common, struct fsg_buffhd *bh)
 {
         struct fsg_lun  *curlun = common->curlun;
@@ -1563,37 +1590,6 @@ static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
         return rc;
 }
 
-static int pad_with_zeros(struct fsg_dev *fsg)
-{
-        struct fsg_buffhd       *bh = fsg->common->next_buffhd_to_fill;
-        u32                     nkeep = bh->inreq->length;
-        u32                     nsend;
-        int                     rc;
-
-        bh->state = BUF_STATE_EMPTY;            /* For the first iteration */
-        fsg->common->usb_amount_left = nkeep + fsg->common->residue;
-        while (fsg->common->usb_amount_left > 0) {
-
-                /* Wait for the next buffer to be free */
-                while (bh->state != BUF_STATE_EMPTY) {
-                        rc = sleep_thread(fsg->common);
-                        if (rc)
-                                return rc;
-                }
-
-                nsend = min(fsg->common->usb_amount_left, FSG_BUFLEN);
-                memset(bh->buf + nkeep, 0, nsend - nkeep);
-                bh->inreq->length = nsend;
-                bh->inreq->zero = 0;
-                start_transfer(fsg, fsg->bulk_in, bh->inreq,
-                                &bh->inreq_busy, &bh->state);
-                bh = fsg->common->next_buffhd_to_fill = bh->next;
-                fsg->common->usb_amount_left -= nsend;
-                nkeep = 0;
-        }
-        return 0;
-}
-
 static int throw_away_data(struct fsg_common *common)
 {
         struct fsg_buffhd       *bh;
@@ -1612,7 +1608,7 @@ static int throw_away_data(struct fsg_common *common)
 
                         /* A short packet or an error ends everything */
                         if (bh->outreq->actual != bh->outreq->length ||
-                                        bh->outreq->status != 0) {
+                            bh->outreq->status != 0) {
                                 raise_exception(common,
                                                 FSG_STATE_ABORT_BULK_OUT);
                                 return -EINTR;
@@ -1626,15 +1622,15 @@ static int throw_away_data(struct fsg_common *common)
                  && common->usb_amount_left > 0) {
                         amount = min(common->usb_amount_left, FSG_BUFLEN);
 
-                        /* amount is always divisible by 512, hence by
-                         * the bulk-out maxpacket size */
+                        /*
+                         * amount is always divisible by 512, hence by
+                         * the bulk-out maxpacket size.
+                         */
                         bh->outreq->length = amount;
                         bh->bulk_out_intended_length = amount;
                         bh->outreq->short_not_ok = 1;
-                        START_TRANSFER_OR(common, bulk_out, bh->outreq,
-                                          &bh->outreq_busy, &bh->state)
-                                /* Don't know what to do if
-                                 * common->fsg is NULL */
+                        if (!start_out_transfer(common, bh))
+                                /* Dunno what to do if common->fsg is NULL */
                                 return -EIO;
                         common->next_buffhd_to_fill = bh->next;
                         common->usb_amount_left -= amount;
@@ -1649,7 +1645,6 @@ static int throw_away_data(struct fsg_common *common)
         return 0;
 }
 
-
 static int finish_reply(struct fsg_common *common)
 {
         struct fsg_buffhd       *bh = common->next_buffhd_to_fill;
@@ -1659,10 +1654,12 @@ static int finish_reply(struct fsg_common *common)
         case DATA_DIR_NONE:
                 break;                  /* Nothing to send */
 
-        /* If we don't know whether the host wants to read or write,
+        /*
+         * If we don't know whether the host wants to read or write,
          * this must be CB or CBI with an unknown command.  We mustn't
          * try to send or receive any data.  So stall both bulk pipes
-         * if we can and wait for a reset. */
+         * if we can and wait for a reset.
+         */
         case DATA_DIR_UNKNOWN:
                 if (!common->can_stall) {
                         /* Nothing */
@@ -1680,37 +1677,38 @@ static int finish_reply(struct fsg_common *common)
                 if (common->data_size == 0) {
                         /* Nothing to send */
 
+                /* Don't know what to do if common->fsg is NULL */
+                } else if (!fsg_is_set(common)) {
+                        rc = -EIO;
+
                 /* If there's no residue, simply send the last buffer */
                 } else if (common->residue == 0) {
                         bh->inreq->zero = 0;
-                        START_TRANSFER_OR(common, bulk_in, bh->inreq,
-                                          &bh->inreq_busy, &bh->state)
+                        if (!start_in_transfer(common, bh))
                                 return -EIO;
                         common->next_buffhd_to_fill = bh->next;
 
-                /* For Bulk-only, if we're allowed to stall then send the
-                 * short packet and halt the bulk-in endpoint.  If we can't
-                 * stall, pad out the remaining data with 0's. */
-                } else if (common->can_stall) {
+                /*
+                 * For Bulk-only, mark the end of the data with a short
+                 * packet.  If we are allowed to stall, halt the bulk-in
+                 * endpoint.  (Note: This violates the Bulk-Only Transport
+                 * specification, which requires us to pad the data if we
+                 * don't halt the endpoint.  Presumably nobody will mind.)
+                 */
+                } else {
                         bh->inreq->zero = 1;
-                        START_TRANSFER_OR(common, bulk_in, bh->inreq,
-                                          &bh->inreq_busy, &bh->state)
-                                /* Don't know what to do if
-                                 * common->fsg is NULL */
+                        if (!start_in_transfer(common, bh))
                                 rc = -EIO;
                         common->next_buffhd_to_fill = bh->next;
-                        if (common->fsg)
+                        if (common->can_stall)
                                 rc = halt_bulk_in_endpoint(common->fsg);
-                } else if (fsg_is_set(common)) {
-                        rc = pad_with_zeros(common->fsg);
-                } else {
-                        /* Don't know what to do if common->fsg is NULL */
-                        rc = -EIO;
                 }
                 break;
 
-        /* We have processed all we want from the data the host has sent.
-         * There may still be outstanding bulk-out requests. */
+        /*
+         * We have processed all we want from the data the host has sent.
+         * There may still be outstanding bulk-out requests.
+         */
         case DATA_DIR_FROM_HOST:
                 if (common->residue == 0) {
                         /* Nothing to receive */
@@ -1720,12 +1718,14 @@ static int finish_reply(struct fsg_common *common)
                         raise_exception(common, FSG_STATE_ABORT_BULK_OUT);
                         rc = -EINTR;
 
-                /* We haven't processed all the incoming data.  Even though
+                /*
+                 * We haven't processed all the incoming data.  Even though
                  * we may be allowed to stall, doing so would cause a race.
                  * The controller may already have ACK'ed all the remaining
                  * bulk-out packets, in which case the host wouldn't see a
                  * STALL.  Not realizing the endpoint was halted, it wouldn't
-                 * clear the halt -- leading to problems later on. */
+                 * clear the halt -- leading to problems later on.
+                 */
 #if 0
                 } else if (common->can_stall) {
                         if (fsg_is_set(common))
@@ -1735,8 +1735,10 @@ static int finish_reply(struct fsg_common *common)
                         rc = -EINTR;
 #endif
 
-                /* We can't stall.  Read in the excess data and throw it
-                 * all away. */
+                /*
+                 * We can't stall.  Read in the excess data and throw it
+                 * all away.
+                 */
                 } else {
                         rc = throw_away_data(common);
                 }
@@ -1745,7 +1747,6 @@ static int finish_reply(struct fsg_common *common)
         return rc;
 }
 
-
 static int send_status(struct fsg_common *common)
 {
         struct fsg_lun          *curlun = common->curlun;
@@ -1793,8 +1794,7 @@ static int send_status(struct fsg_common *common)
 
         bh->inreq->length = USB_BULK_CS_WRAP_LEN;
         bh->inreq->zero = 0;
-        START_TRANSFER_OR(common, bulk_in, bh->inreq,
-                          &bh->inreq_busy, &bh->state)
+        if (!start_in_transfer(common, bh))
                 /* Don't know what to do if common->fsg is NULL */
                 return -EIO;
 
@@ -1805,11 +1805,13 @@ static int send_status(struct fsg_common *common)
 
 /*-------------------------------------------------------------------------*/
 
-/* Check whether the command is properly formed and whether its data size
- * and direction agree with the values we already have. */
+/*
+ * Check whether the command is properly formed and whether its data size
+ * and direction agree with the values we already have.
+ */
 static int check_command(struct fsg_common *common, int cmnd_size,
-                enum data_direction data_dir, unsigned int mask,
-                int needs_medium, const char *name)
+                         enum data_direction data_dir, unsigned int mask,
+                         int needs_medium, const char *name)
 {
         int                     i;
         int                     lun = common->cmnd[1] >> 5;
@@ -1820,19 +1822,23 @@ static int check_command(struct fsg_common *common, int cmnd_size,
         hdlen[0] = 0;
         if (common->data_dir != DATA_DIR_UNKNOWN)
                 sprintf(hdlen, ", H%c=%u", dirletter[(int) common->data_dir],
-                                common->data_size);
+                        common->data_size);
         VDBG(common, "SCSI command: %s;  Dc=%d, D%c=%u;  Hc=%d%s\n",
              name, cmnd_size, dirletter[(int) data_dir],
              common->data_size_from_cmnd, common->cmnd_size, hdlen);
 
-        /* We can't reply at all until we know the correct data direction
-         * and size. */
+        /*
+         * We can't reply at all until we know the correct data direction
+         * and size.
+         */
         if (common->data_size_from_cmnd == 0)
                 data_dir = DATA_DIR_NONE;
         if (common->data_size < common->data_size_from_cmnd) {
-                /* Host data size < Device data size is a phase error.
+                /*
+                 * Host data size < Device data size is a phase error.
                  * Carry out the command, but only transfer as much as
-                 * we are allowed. */
+                 * we are allowed.
+                 */
                 common->data_size_from_cmnd = common->data_size;
                 common->phase_error = 1;
         }
@@ -1840,8 +1846,7 @@ static int check_command(struct fsg_common *common, int cmnd_size,
         common->usb_amount_left = common->data_size;
 
         /* Conflicting data directions is a phase error */
-        if (common->data_dir != data_dir
-         && common->data_size_from_cmnd > 0) {
+        if (common->data_dir != data_dir && common->data_size_from_cmnd > 0) {
                 common->phase_error = 1;
                 return -EINVAL;
         }
@@ -1849,7 +1854,8 @@ static int check_command(struct fsg_common *common, int cmnd_size,
         /* Verify the length of the command itself */
         if (cmnd_size != common->cmnd_size) {
 
-                /* Special case workaround: There are plenty of buggy SCSI
+                /*
+                 * Special case workaround: There are plenty of buggy SCSI
                  * implementations. Many have issues with cbw->Length
                  * field passing a wrong command size. For those cases we
                  * always try to work around the problem by using the length
@@ -1878,10 +1884,10 @@ static int check_command(struct fsg_common *common, int cmnd_size,
                     common->lun, lun);
 
         /* Check the LUN */
-        if (common->lun >= 0 && common->lun < common->nluns) {
+        if (common->lun < common->nluns) {
                 curlun = &common->luns[common->lun];
                 common->curlun = curlun;
-                if (common->cmnd[0] != SC_REQUEST_SENSE) {
+                if (common->cmnd[0] != REQUEST_SENSE) {
                         curlun->sense_data = SS_NO_SENSE;
                         curlun->sense_data_info = 0;
                         curlun->info_valid = 0;
@@ -1891,20 +1897,24 @@ static int check_command(struct fsg_common *common, int cmnd_size,
                 curlun = NULL;
                 common->bad_lun_okay = 0;
 
-                /* INQUIRY and REQUEST SENSE commands are explicitly allowed
-                 * to use unsupported LUNs; all others may not. */
-                if (common->cmnd[0] != SC_INQUIRY &&
-                    common->cmnd[0] != SC_REQUEST_SENSE) {
+                /*
+                 * INQUIRY and REQUEST SENSE commands are explicitly allowed
+                 * to use unsupported LUNs; all others may not.
+                 */
+                if (common->cmnd[0] != INQUIRY &&
+                    common->cmnd[0] != REQUEST_SENSE) {
                         DBG(common, "unsupported LUN %d\n", common->lun);
                         return -EINVAL;
                 }
         }
 
-        /* If a unit attention condition exists, only INQUIRY and
-         * REQUEST SENSE commands are allowed; anything else must fail. */
+        /*
+         * If a unit attention condition exists, only INQUIRY and
+         * REQUEST SENSE commands are allowed; anything else must fail.
+         */
         if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
-                        common->cmnd[0] != SC_INQUIRY &&
-                        common->cmnd[0] != SC_REQUEST_SENSE) {
+            common->cmnd[0] != INQUIRY &&
+            common->cmnd[0] != REQUEST_SENSE) {
                 curlun->sense_data = curlun->unit_attention_data;
                 curlun->unit_attention_data = SS_NO_SENSE;
                 return -EINVAL;
@@ -1930,7 +1940,6 @@ static int check_command(struct fsg_common *common, int cmnd_size,
         return 0;
 }
 
-
 static int do_scsi_command(struct fsg_common *common)
 {
         struct fsg_buffhd       *bh;
@@ -1955,7 +1964,7 @@ static int do_scsi_command(struct fsg_common *common)
         down_read(&common->filesem);    /* We're using the backing file */
         switch (common->cmnd[0]) {
 
-        case SC_INQUIRY:
+        case INQUIRY:
                 common->data_size_from_cmnd = common->cmnd[4];
                 reply = check_command(common, 6, DATA_DIR_TO_HOST,
                                       (1<<4), 0,
@@ -1964,7 +1973,7 @@ static int do_scsi_command(struct fsg_common *common)
                         reply = do_inquiry(common, bh);
                 break;
 
-        case SC_MODE_SELECT_6:
+        case MODE_SELECT:
                 common->data_size_from_cmnd = common->cmnd[4];
                 reply = check_command(common, 6, DATA_DIR_FROM_HOST,
                                       (1<<1) | (1<<4), 0,
@@ -1973,7 +1982,7 @@ static int do_scsi_command(struct fsg_common *common)
                         reply = do_mode_select(common, bh);
                 break;
 
-        case SC_MODE_SELECT_10:
+        case MODE_SELECT_10:
                 common->data_size_from_cmnd =
                         get_unaligned_be16(&common->cmnd[7]);
                 reply = check_command(common, 10, DATA_DIR_FROM_HOST,
@@ -1983,7 +1992,7 @@ static int do_scsi_command(struct fsg_common *common)
                         reply = do_mode_select(common, bh);
                 break;
 
-        case SC_MODE_SENSE_6:
+        case MODE_SENSE:
                 common->data_size_from_cmnd = common->cmnd[4];
                 reply = check_command(common, 6, DATA_DIR_TO_HOST,
                                       (1<<1) | (1<<2) | (1<<4), 0,
@@ -1992,7 +2001,7 @@ static int do_scsi_command(struct fsg_common *common)
                         reply = do_mode_sense(common, bh);
                 break;
 
-        case SC_MODE_SENSE_10:
+        case MODE_SENSE_10:
                 common->data_size_from_cmnd =
                         get_unaligned_be16(&common->cmnd[7]);
                 reply = check_command(common, 10, DATA_DIR_TO_HOST,
@@ -2002,7 +2011,7 @@ static int do_scsi_command(struct fsg_common *common)
                         reply = do_mode_sense(common, bh);
                 break;
 
-        case SC_PREVENT_ALLOW_MEDIUM_REMOVAL:
+        case ALLOW_MEDIUM_REMOVAL:
                 common->data_size_from_cmnd = 0;
                 reply = check_command(common, 6, DATA_DIR_NONE,
                                       (1<<4), 0,
@@ -2011,7 +2020,7 @@ static int do_scsi_command(struct fsg_common *common)
                         reply = do_prevent_allow(common);
                 break;
 
-        case SC_READ_6:
+        case READ_6:
                 i = common->cmnd[4];
                 common->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
                 reply = check_command(common, 6, DATA_DIR_TO_HOST,
@@ -2021,7 +2030,7 @@ static int do_scsi_command(struct fsg_common *common)
                         reply = do_read(common);
                 break;
 
-        case SC_READ_10:
+        case READ_10:
                 common->data_size_from_cmnd =
                                 get_unaligned_be16(&common->cmnd[7]) << 9;
                 reply = check_command(common, 10, DATA_DIR_TO_HOST,
@@ -2031,7 +2040,7 @@ static int do_scsi_command(struct fsg_common *common)
                         reply = do_read(common);
                 break;
 
-        case SC_READ_12:
+        case READ_12:
                 common->data_size_from_cmnd =
                                 get_unaligned_be32(&common->cmnd[6]) << 9;
                 reply = check_command(common, 12, DATA_DIR_TO_HOST,
@@ -2041,7 +2050,7 @@ static int do_scsi_command(struct fsg_common *common)
                         reply = do_read(common);
                 break;
 
-        case SC_READ_CAPACITY:
+        case READ_CAPACITY:
                 common->data_size_from_cmnd = 8;
                 reply = check_command(common, 10, DATA_DIR_TO_HOST,
                                       (0xf<<2) | (1<<8), 1,
@@ -2050,7 +2059,7 @@ static int do_scsi_command(struct fsg_common *common)
                         reply = do_read_capacity(common, bh);
                 break;
 
-        case SC_READ_HEADER:
+        case READ_HEADER:
                 if (!common->curlun || !common->curlun->cdrom)
                         goto unknown_cmnd;
                 common->data_size_from_cmnd =
@@ -2062,7 +2071,7 @@ static int do_scsi_command(struct fsg_common *common)
                         reply = do_read_header(common, bh);
                 break;
 
-        case SC_READ_TOC:
+        case READ_TOC:
                 if (!common->curlun || !common->curlun->cdrom)
                         goto unknown_cmnd;
                 common->data_size_from_cmnd =
@@ -2074,7 +2083,7 @@ static int do_scsi_command(struct fsg_common *common)
                         reply = do_read_toc(common, bh);
                 break;
 
-        case SC_READ_FORMAT_CAPACITIES:
+        case READ_FORMAT_CAPACITIES:
                 common->data_size_from_cmnd =
                         get_unaligned_be16(&common->cmnd[7]);
                 reply = check_command(common, 10, DATA_DIR_TO_HOST,
@@ -2084,7 +2093,7 @@ static int do_scsi_command(struct fsg_common *common)
                         reply = do_read_format_capacities(common, bh);
                 break;
 
-        case SC_REQUEST_SENSE:
+        case REQUEST_SENSE:
                 common->data_size_from_cmnd = common->cmnd[4];
                 reply = check_command(common, 6, DATA_DIR_TO_HOST,
                                       (1<<4), 0,
@@ -2093,7 +2102,7 @@ static int do_scsi_command(struct fsg_common *common)
                         reply = do_request_sense(common, bh);
                 break;
 
-        case SC_START_STOP_UNIT:
+        case START_STOP:
                 common->data_size_from_cmnd = 0;
                 reply = check_command(common, 6, DATA_DIR_NONE,
                                       (1<<1) | (1<<4), 0,
@@ -2102,7 +2111,7 @@ static int do_scsi_command(struct fsg_common *common)
                         reply = do_start_stop(common);
                 break;
 
-        case SC_SYNCHRONIZE_CACHE:
+        case SYNCHRONIZE_CACHE:
                 common->data_size_from_cmnd = 0;
                 reply = check_command(common, 10, DATA_DIR_NONE,
                                       (0xf<<2) | (3<<7), 1,
@@ -2111,16 +2120,18 @@ static int do_scsi_command(struct fsg_common *common)
                         reply = do_synchronize_cache(common);
                 break;
 
-        case SC_TEST_UNIT_READY:
+        case TEST_UNIT_READY:
                 common->data_size_from_cmnd = 0;
                 reply = check_command(common, 6, DATA_DIR_NONE,
                                 0, 1,
                                 "TEST UNIT READY");
                 break;
 
-        /* Although optional, this command is used by MS-Windows.  We
-         * support a minimal version: BytChk must be 0. */
-        case SC_VERIFY:
+        /*
+         * Although optional, this command is used by MS-Windows.  We
+         * support a minimal version: BytChk must be 0.
+         */
+        case VERIFY:
                 common->data_size_from_cmnd = 0;
                 reply = check_command(common, 10, DATA_DIR_NONE,
                                       (1<<1) | (0xf<<2) | (3<<7), 1,
@@ -2129,7 +2140,7 @@ static int do_scsi_command(struct fsg_common *common)
                         reply = do_verify(common);
                 break;
 
-        case SC_WRITE_6:
+        case WRITE_6:
                 i = common->cmnd[4];
                 common->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
                 reply = check_command(common, 6, DATA_DIR_FROM_HOST,
@@ -2139,7 +2150,7 @@ static int do_scsi_command(struct fsg_common *common)
                         reply = do_write(common);
                 break;
 
-        case SC_WRITE_10:
+        case WRITE_10:
                 common->data_size_from_cmnd =
                                 get_unaligned_be16(&common->cmnd[7]) << 9;
                 reply = check_command(common, 10, DATA_DIR_FROM_HOST,
@@ -2149,7 +2160,7 @@ static int do_scsi_command(struct fsg_common *common)
                         reply = do_write(common);
                 break;
 
-        case SC_WRITE_12:
+        case WRITE_12:
                 common->data_size_from_cmnd =
                                 get_unaligned_be32(&common->cmnd[6]) << 9;
                 reply = check_command(common, 12, DATA_DIR_FROM_HOST,
@@ -2159,14 +2170,16 @@ static int do_scsi_command(struct fsg_common *common)
                         reply = do_write(common);
                 break;
 
-        /* Some mandatory commands that we recognize but don't implement.
+        /*
+         * Some mandatory commands that we recognize but don't implement.
          * They don't mean much in this setting.  It's left as an exercise
          * for anyone interested to implement RESERVE and RELEASE in terms
-         * of Posix locks. */
-        case SC_FORMAT_UNIT:
-        case SC_RELEASE:
-        case SC_RESERVE:
-        case SC_SEND_DIAGNOSTIC:
+         * of Posix locks.
+         */
+        case FORMAT_UNIT:
+        case RELEASE:
+        case RESERVE:
+        case SEND_DIAGNOSTIC:
                 /* Fall through */
 
         default:
@@ -2190,7 +2203,7 @@ unknown_cmnd:
         if (reply == -EINVAL)
                 reply = 0;              /* Error reply length */
         if (reply >= 0 && common->data_dir == DATA_DIR_TO_HOST) {
-                reply = min((u32) reply, common->data_size_from_cmnd);
+                reply = min((u32)reply, common->data_size_from_cmnd);
                 bh->inreq->length = reply;
                 bh->state = BUF_STATE_FULL;
                 common->residue -= reply;
@@ -2220,7 +2233,8 @@ static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
                                 req->actual,
                                 le32_to_cpu(cbw->Signature));
 
-                /* The Bulk-only spec says we MUST stall the IN endpoint
+                /*
+                 * The Bulk-only spec says we MUST stall the IN endpoint
                  * (6.6.1), so it's unavoidable.  It also says we must
                  * retain this state until the next reset, but there's
                  * no way to tell the controller driver it should ignore
@@ -2228,7 +2242,8 @@ static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
                  *
                  * We aren't required to halt the OUT endpoint; instead
                  * we can simply accept and discard any data received
-                 * until the next reset. */
+                 * until the next reset.
+                 */
                 wedge_bulk_in_endpoint(fsg);
                 set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
                 return -EINVAL;
@@ -2241,8 +2256,10 @@ static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
                                 "cmdlen %u\n",
                                 cbw->Lun, cbw->Flags, cbw->Length);
 
-                /* We can do anything we want here, so let's stall the
-                 * bulk pipes if we are allowed to. */
+                /*
+                 * We can do anything we want here, so let's stall the
+                 * bulk pipes if we are allowed to.
+                 */
                 if (common->can_stall) {
                         fsg_set_halt(fsg, fsg->bulk_out);
                         halt_bulk_in_endpoint(fsg);
@@ -2265,7 +2282,6 @@ static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
         return 0;
 }
 
-
 static int get_next_command(struct fsg_common *common)
 {
         struct fsg_buffhd       *bh;
@@ -2282,14 +2298,15 @@ static int get_next_command(struct fsg_common *common)
         /* Queue a request to read a Bulk-only CBW */
         set_bulk_out_req_length(common, bh, USB_BULK_CB_WRAP_LEN);
         bh->outreq->short_not_ok = 1;
-        START_TRANSFER_OR(common, bulk_out, bh->outreq,
-                          &bh->outreq_busy, &bh->state)
+        if (!start_out_transfer(common, bh))
                 /* Don't know what to do if common->fsg is NULL */
                 return -EIO;
 
-        /* We will drain the buffer in software, which means we
+        /*
+         * We will drain the buffer in software, which means we
          * can reuse it for the next filling.  No need to advance
-         * next_buffhd_to_fill. */
+         * next_buffhd_to_fill.
+         */
 
         /* Wait for the CBW to arrive */
         while (bh->state != BUF_STATE_FULL) {
@@ -2420,13 +2437,12 @@ reset:
 
 /****************************** ALT CONFIGS ******************************/
 
-
 static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 {
         struct fsg_dev *fsg = fsg_from_func(f);
         fsg->common->new_fsg = fsg;
         raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
-        return 0;
+        return USB_GADGET_DELAYED_STATUS;
 }
 
 static void fsg_disable(struct usb_function *f)
@@ -2448,8 +2464,10 @@ static void handle_exception(struct fsg_common *common)
         struct fsg_lun          *curlun;
         unsigned int            exception_req_tag;
 
-        /* Clear the existing signals.  Anything but SIGUSR1 is converted
-         * into a high-priority EXIT exception. */
+        /*
+         * Clear the existing signals.  Anything but SIGUSR1 is converted
+         * into a high-priority EXIT exception.
+         */
         for (;;) {
                 int sig =
                         dequeue_signal_lock(current, &current->blocked, &info);
@@ -2493,8 +2511,10 @@ static void handle_exception(struct fsg_common *common)
                         usb_ep_fifo_flush(common->fsg->bulk_out);
         }
 
-        /* Reset the I/O buffer states and pointers, the SCSI
-         * state, and the exception.  Then invoke the handler. */
+        /*
+         * Reset the I/O buffer states and pointers, the SCSI
+         * state, and the exception.  Then invoke the handler.
+         */
         spin_lock_irq(&common->lock);
 
         for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
@@ -2532,9 +2552,11 @@ static void handle_exception(struct fsg_common *common)
                 break;
 
         case FSG_STATE_RESET:
-                /* In case we were forced against our will to halt a
+                /*
+                 * In case we were forced against our will to halt a
                  * bulk endpoint, clear the halt now.  (The SuperH UDC
-                 * requires this.) */
+                 * requires this.)
+                 */
                 if (!fsg_is_set(common))
                         break;
                 if (test_and_clear_bit(IGNORE_BULK_OUT,
@@ -2544,9 +2566,11 @@ static void handle_exception(struct fsg_common *common)
                 if (common->ep0_req_tag == exception_req_tag)
                         ep0_queue(common);      /* Complete the status stage */
 
-                /* Technically this should go here, but it would only be
+                /*
+                 * Technically this should go here, but it would only be
                  * a waste of time.  Ditto for the INTERFACE_CHANGE and
-                 * CONFIG_CHANGE cases. */
+                 * CONFIG_CHANGE cases.
+                 */
                 /* for (i = 0; i < common->nluns; ++i) */
                 /*      common->luns[i].unit_attention_data = */
                 /*              SS_RESET_OCCURRED;  */
@@ -2554,6 +2578,8 @@ static void handle_exception(struct fsg_common *common)
 
         case FSG_STATE_CONFIG_CHANGE:
                 do_set_interface(common, common->new_fsg);
+                if (common->new_fsg)
+                        usb_composite_setup_continue(common->cdev);
                 break;
 
         case FSG_STATE_EXIT:
@@ -2581,8 +2607,10 @@ static int fsg_main_thread(void *common_)
 {
         struct fsg_common       *common = common_;
 
-        /* Allow the thread to be killed by a signal, but set the signal mask
-         * to block everything but INT, TERM, KILL, and USR1. */
+        /*
+         * Allow the thread to be killed by a signal, but set the signal mask
+         * to block everything but INT, TERM, KILL, and USR1.
+         */
         allow_signal(SIGINT);
         allow_signal(SIGTERM);
         allow_signal(SIGKILL);
@@ -2591,9 +2619,11 @@ static int fsg_main_thread(void *common_)
         /* Allow the thread to be frozen */
         set_freezable();
 
-        /* Arrange for userspace references to be interpreted as kernel
+        /*
+         * Arrange for userspace references to be interpreted as kernel
          * pointers.  That way we can pass a kernel pointer to a routine
-         * that expects a __user pointer and it will work okay. */
+         * that expects a __user pointer and it will work okay.
+         */
         set_fs(get_ds());
 
         /* The main loop */
@@ -2653,7 +2683,7 @@ static int fsg_main_thread(void *common_)
                 up_write(&common->filesem);
         }
 
-        /* Let the unbind and cleanup routines know the thread has exited */
+        /* Let fsg_unbind() know the thread has exited */
         complete_and_exit(&common->thread_notifier, 0);
 }
 
@@ -2662,6 +2692,7 @@ static int fsg_main_thread(void *common_)
 
 /* Write permission is checked per LUN in store_*() functions. */
 static DEVICE_ATTR(ro, 0644, fsg_show_ro, fsg_store_ro);
+static DEVICE_ATTR(nofua, 0644, fsg_show_nofua, fsg_store_nofua);
 static DEVICE_ATTR(file, 0644, fsg_show_file, fsg_store_file);
 
 
@@ -2684,7 +2715,6 @@ static inline void fsg_common_put(struct fsg_common *common)
         kref_put(&common->ref, fsg_common_release);
 }
 
-
 static struct fsg_common *fsg_common_init(struct fsg_common *common,
                                           struct usb_composite_dev *cdev,
                                           struct fsg_config *cfg)
@@ -2710,7 +2740,7 @@ static struct fsg_common *fsg_common_init(struct fsg_common *common,
                         return ERR_PTR(-ENOMEM);
                 common->free_storage_on_release = 1;
         } else {
-                memset(common, 0, sizeof common);
+                memset(common, 0, sizeof *common);
                 common->free_storage_on_release = 0;
         }
 
@@ -2720,6 +2750,7 @@ static struct fsg_common *fsg_common_init(struct fsg_common *common,
         common->gadget = gadget;
         common->ep0 = gadget->ep0;
         common->ep0req = cdev->req;
+        common->cdev = cdev;
 
         /* Maybe allocate device-global string IDs, and patch descriptors */
         if (fsg_strings[FSG_STRING_INTERFACE].id == 0) {
@@ -2730,8 +2761,10 @@ static struct fsg_common *fsg_common_init(struct fsg_common *common,
                 fsg_intf_desc.iInterface = rc;
         }
 
-        /* Create the LUNs, open their backing files, and register the
-         * LUN devices in sysfs. */
+        /*
+         * Create the LUNs, open their backing files, and register the
+         * LUN devices in sysfs.
+         */
         curlun = kzalloc(nluns * sizeof *curlun, GFP_KERNEL);
         if (unlikely(!curlun)) {
                 rc = -ENOMEM;
@@ -2744,6 +2777,7 @@ static struct fsg_common *fsg_common_init(struct fsg_common *common,
         for (i = 0, lcfg = cfg->luns; i < nluns; ++i, ++curlun, ++lcfg) {
                 curlun->cdrom = !!lcfg->cdrom;
                 curlun->ro = lcfg->cdrom || lcfg->ro;
+                curlun->initially_ro = curlun->ro;
                 curlun->removable = lcfg->removable;
                 curlun->dev.release = fsg_lun_release;
                 curlun->dev.parent = &gadget->dev;
@@ -2759,6 +2793,7 @@ static struct fsg_common *fsg_common_init(struct fsg_common *common,
                 if (rc) {
                         INFO(common, "failed to register LUN%d: %d\n", i, rc);
                         common->nluns = i;
+                        put_device(&curlun->dev);
                         goto error_release;
                 }
 
@@ -2768,6 +2803,9 @@ static struct fsg_common *fsg_common_init(struct fsg_common *common,
                 rc = device_create_file(&curlun->dev, &dev_attr_file);
                 if (rc)
                         goto error_luns;
+                rc = device_create_file(&curlun->dev, &dev_attr_nofua);
+                if (rc)
+                        goto error_luns;
 
                 if (lcfg->filename) {
                         rc = fsg_lun_open(curlun, lcfg->filename);
@@ -2781,7 +2819,6 @@ static struct fsg_common *fsg_common_init(struct fsg_common *common,
         }
         common->nluns = nluns;
 
-
         /* Data buffers cyclic list */
         bh = common->buffhds;
         i = FSG_NUM_BUFFERS;
@@ -2798,7 +2835,6 @@ buffhds_first_it:
         } while (--i);
         bh->next = common->buffhds;
 
-
         /* Prepare inquiryString */
         if (cfg->release != 0xffff) {
                 i = cfg->release;
@@ -2812,41 +2848,35 @@ buffhds_first_it:
                         i = 0x0399;
                 }
         }
-#define OR(x, y) ((x) ? (x) : (y))
         snprintf(common->inquiry_string, sizeof common->inquiry_string,
-                 "%-8s%-16s%04x",
-                 OR(cfg->vendor_name, "Linux   "),
+                 "%-8s%-16s%04x", cfg->vendor_name ?: "Linux",
                  /* Assume product name dependent on the first LUN */
-                 OR(cfg->product_name, common->luns->cdrom
+                 cfg->product_name ?: (common->luns->cdrom
                                      ? "File-Stor Gadget"
-                                     : "File-CD Gadget  "),
+                                     : "File-CD Gadget"),
                  i);
 
-
-        /* Some peripheral controllers are known not to be able to
+        /*
+         * Some peripheral controllers are known not to be able to
          * halt bulk endpoints correctly.  If one of them is present,
          * disable stalls.
          */
         common->can_stall = cfg->can_stall &&
                 !(gadget_is_at91(common->gadget));
 
-
         spin_lock_init(&common->lock);
         kref_init(&common->ref);
 
-
         /* Tell the thread to start working */
         common->thread_task =
                 kthread_create(fsg_main_thread, common,
-                               OR(cfg->thread_name, "file-storage"));
+                               cfg->thread_name ?: "file-storage");
         if (IS_ERR(common->thread_task)) {
                 rc = PTR_ERR(common->thread_task);
                 goto error_release;
         }
         init_completion(&common->thread_notifier);
         init_waitqueue_head(&common->fsg_wait);
-#undef OR
-
 
         /* Information */
         INFO(common, FSG_DRIVER_DESC ", version: " FSG_DRIVER_VERSION "\n");
@@ -2880,18 +2910,15 @@ buffhds_first_it:
 
         return common;
 
-
 error_luns:
         common->nluns = i + 1;
 error_release:
         common->state = FSG_STATE_TERMINATED;   /* The thread is dead */
-        /* Call fsg_common_release() directly, ref might be not
-         * initialised */
+        /* Call fsg_common_release() directly, ref might be not initialised. */
         fsg_common_release(&common->ref);
         return ERR_PTR(rc);
 }
 
-
 static void fsg_common_release(struct kref *ref)
 {
         struct fsg_common *common = container_of(ref, struct fsg_common, ref);
@@ -2900,9 +2927,6 @@ static void fsg_common_release(struct kref *ref)
         if (common->state != FSG_STATE_TERMINATED) {
                 raise_exception(common, FSG_STATE_EXIT);
                 wait_for_completion(&common->thread_notifier);
-
-                /* The cleanup routine waits for this completion also */
-                complete(&common->thread_notifier);
         }
 
         if (likely(common->luns)) {
@@ -2911,6 +2935,7 @@ static void fsg_common_release(struct kref *ref)
 
                 /* In error recovery common->nluns may be zero. */
                 for (; i; --i, ++lun) {
+                        device_remove_file(&lun->dev, &dev_attr_nofua);
                         device_remove_file(&lun->dev, &dev_attr_ro);
                         device_remove_file(&lun->dev, &dev_attr_file);
                         fsg_lun_close(lun);
@@ -2935,7 +2960,6 @@ static void fsg_common_release(struct kref *ref)
 
 /*-------------------------------------------------------------------------*/
 
-
 static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
 {
         struct fsg_dev          *fsg = fsg_from_func(f);
@@ -2955,7 +2979,6 @@ static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
         kfree(fsg);
 }
 
-
 static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
 {
         struct fsg_dev          *fsg = fsg_from_func(f);
@@ -3038,11 +3061,13 @@ static int fsg_bind_config(struct usb_composite_dev *cdev,
         fsg->function.disable     = fsg_disable;
 
         fsg->common               = common;
-        /* Our caller holds a reference to common structure so we
+        /*
+         * Our caller holds a reference to common structure so we
          * don't have to be worry about it being freed until we return
          * from this function.  So instead of incrementing counter now
          * and decrement in error recovery we increment it only when
-         * call to usb_add_function() was successful. */
+         * call to usb_add_function() was successful.
+         */
 
         rc = usb_add_function(c, &fsg->function);
         if (unlikely(rc))
@@ -3053,8 +3078,7 @@ static int fsg_bind_config(struct usb_composite_dev *cdev,
 }
 
 static inline int __deprecated __maybe_unused
-fsg_add(struct usb_composite_dev *cdev,
-        struct usb_configuration *c,
+fsg_add(struct usb_composite_dev *cdev, struct usb_configuration *c,
         struct fsg_common *common)
 {
         return fsg_bind_config(cdev, c, common);
@@ -3063,19 +3087,19 @@ fsg_add(struct usb_composite_dev *cdev,
 
 /************************* Module parameters *************************/
 
-
 struct fsg_module_parameters {
         char            *file[FSG_MAX_LUNS];
         int             ro[FSG_MAX_LUNS];
         int             removable[FSG_MAX_LUNS];
         int             cdrom[FSG_MAX_LUNS];
+        int             nofua[FSG_MAX_LUNS];
 
         unsigned int    file_count, ro_count, removable_count, cdrom_count;
+        unsigned int    nofua_count;
         unsigned int    luns;   /* nluns */
         int             stall;  /* can_stall */
 };
 
-
 #define _FSG_MODULE_PARAM_ARRAY(prefix, params, name, type, desc)       \
         module_param_array_named(prefix ## name, params.name, type,     \
                                  &prefix ## params.name ## _count,      \
@@ -3096,12 +3120,13 @@ struct fsg_module_parameters {
                                 "true to simulate removable media");    \
         _FSG_MODULE_PARAM_ARRAY(prefix, params, cdrom, bool,            \
                                 "true to simulate CD-ROM instead of disk"); \
+        _FSG_MODULE_PARAM_ARRAY(prefix, params, nofua, bool,            \
+                                "true to ignore SCSI WRITE(10,12) FUA bit"); \
         _FSG_MODULE_PARAM(prefix, params, luns, uint,                   \
                           "number of LUNs");                            \
         _FSG_MODULE_PARAM(prefix, params, stall, bool,                  \
                           "false to prevent bulk stalls")
 
-
 static void
 fsg_config_from_params(struct fsg_config *cfg,
                        const struct fsg_module_parameters *params)
diff --git a/drivers/usb/gadget/f_ncm.c b/drivers/usb/gadget/f_ncm.c
new file mode 100644
index 000000000000..86902a60bcdb
--- /dev/null
+++ b/drivers/usb/gadget/f_ncm.c
@@ -0,0 +1,1407 @@
+/*
+ * f_ncm.c -- USB CDC Network (NCM) link function driver
+ *
+ * Copyright (C) 2010 Nokia Corporation
+ * Contact: Yauheni Kaliuta <yauheni.kaliuta@nokia.com>
+ *
+ * The driver borrows from f_ecm.c which is:
+ *
+ * Copyright (C) 2003-2005,2008 David Brownell
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/etherdevice.h>
+#include <linux/crc32.h>
+
+#include <linux/usb/cdc.h>
+
+#include "u_ether.h"
+
+/*
+ * This function is a "CDC Network Control Model" (CDC NCM) Ethernet link.
+ * NCM is intended to be used with high-speed network attachments.
+ *
+ * Note that NCM requires the use of "alternate settings" for its data
+ * interface.  This means that the set_alt() method has real work to do,
+ * and also means that a get_alt() method is required.
+ */
+
+/* to trigger crc/non-crc ndp signature */
+
+#define NCM_NDP_HDR_CRC_MASK    0x01000000
+#define NCM_NDP_HDR_CRC         0x01000000
+#define NCM_NDP_HDR_NOCRC       0x00000000
+
+struct ncm_ep_descs {
+        struct usb_endpoint_descriptor  *in;
+        struct usb_endpoint_descriptor  *out;
+        struct usb_endpoint_descriptor  *notify;
+};
+
+enum ncm_notify_state {
+        NCM_NOTIFY_NONE,                /* don't notify */
+        NCM_NOTIFY_CONNECT,             /* issue CONNECT next */
+        NCM_NOTIFY_SPEED,               /* issue SPEED_CHANGE next */
+};
+
+struct f_ncm {
+        struct gether                   port;
+        u8                              ctrl_id, data_id;
+
+        char                            ethaddr[14];
+
+        struct ncm_ep_descs             fs;
+        struct ncm_ep_descs             hs;
+
+        struct usb_ep                   *notify;
+        struct usb_endpoint_descriptor  *notify_desc;
+        struct usb_request              *notify_req;
+        u8                              notify_state;
+        bool                            is_open;
+
+        struct ndp_parser_opts          *parser_opts;
+        bool                            is_crc;
+
+        /*
+         * for notification, it is accessed from both
+         * callback and ethernet open/close
+         */
+        spinlock_t                      lock;
+};
+
+static inline struct f_ncm *func_to_ncm(struct usb_function *f)
+{
+        return container_of(f, struct f_ncm, port.func);
+}
+
+/* peak (theoretical) bulk transfer rate in bits-per-second */
+static inline unsigned ncm_bitrate(struct usb_gadget *g)
+{
+        if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
+                return 13 * 512 * 8 * 1000 * 8;
+        else
+                return 19 *  64 * 1 * 1000 * 8;
+}
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * We cannot group frames so use just the minimal size which ok to put
+ * one max-size ethernet frame.
+ * If the host can group frames, allow it to do that, 16K is selected,
+ * because it's used by default by the current linux host driver
+ */
+#define NTB_DEFAULT_IN_SIZE     USB_CDC_NCM_NTB_MIN_IN_SIZE
+#define NTB_OUT_SIZE            16384
+
+/*
+ * skbs of size less than that will not be aligned
+ * to NCM's dwNtbInMaxSize to save bus bandwidth
+ */
+
+#define MAX_TX_NONFIXED         (512 * 3)
+
+#define FORMATS_SUPPORTED       (USB_CDC_NCM_NTB16_SUPPORTED |  \
+                                 USB_CDC_NCM_NTB32_SUPPORTED)
+
+static struct usb_cdc_ncm_ntb_parameters ntb_parameters = {
+        .wLength = sizeof ntb_parameters,
+        .bmNtbFormatsSupported = cpu_to_le16(FORMATS_SUPPORTED),
+        .dwNtbInMaxSize = cpu_to_le32(NTB_DEFAULT_IN_SIZE),
+        .wNdpInDivisor = cpu_to_le16(4),
+        .wNdpInPayloadRemainder = cpu_to_le16(0),
+        .wNdpInAlignment = cpu_to_le16(4),
+
+        .dwNtbOutMaxSize = cpu_to_le32(NTB_OUT_SIZE),
+        .wNdpOutDivisor = cpu_to_le16(4),
+        .wNdpOutPayloadRemainder = cpu_to_le16(0),
+        .wNdpOutAlignment = cpu_to_le16(4),
+};
+
+/*
+ * Use wMaxPacketSize big enough to fit CDC_NOTIFY_SPEED_CHANGE in one
+ * packet, to simplify cancellation; and a big transfer interval, to
+ * waste less bandwidth.
+ */
+
+#define LOG2_STATUS_INTERVAL_MSEC       5       /* 1 << 5 == 32 msec */
+#define NCM_STATUS_BYTECOUNT            16      /* 8 byte header + data */
+
+static struct usb_interface_assoc_descriptor ncm_iad_desc __initdata = {
+        .bLength =              sizeof ncm_iad_desc,
+        .bDescriptorType =      USB_DT_INTERFACE_ASSOCIATION,
+
+        /* .bFirstInterface =   DYNAMIC, */
+        .bInterfaceCount =      2,      /* control + data */
+        .bFunctionClass =       USB_CLASS_COMM,
+        .bFunctionSubClass =    USB_CDC_SUBCLASS_NCM,
+        .bFunctionProtocol =    USB_CDC_PROTO_NONE,
+        /* .iFunction =         DYNAMIC */
+};
+
+/* interface descriptor: */
+
+static struct usb_interface_descriptor ncm_control_intf __initdata = {
+        .bLength =              sizeof ncm_control_intf,
+        .bDescriptorType =      USB_DT_INTERFACE,
+
+        /* .bInterfaceNumber = DYNAMIC */
+        .bNumEndpoints =        1,
+        .bInterfaceClass =      USB_CLASS_COMM,
+        .bInterfaceSubClass =   USB_CDC_SUBCLASS_NCM,
+        .bInterfaceProtocol =   USB_CDC_PROTO_NONE,
+        /* .iInterface = DYNAMIC */
+};
+
+static struct usb_cdc_header_desc ncm_header_desc __initdata = {
+        .bLength =              sizeof ncm_header_desc,
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubType =   USB_CDC_HEADER_TYPE,
+
+        .bcdCDC =               cpu_to_le16(0x0110),
+};
+
+static struct usb_cdc_union_desc ncm_union_desc __initdata = {
+        .bLength =              sizeof(ncm_union_desc),
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubType =   USB_CDC_UNION_TYPE,
+        /* .bMasterInterface0 = DYNAMIC */
+        /* .bSlaveInterface0 =  DYNAMIC */
+};
+
+static struct usb_cdc_ether_desc ecm_desc __initdata = {
+        .bLength =              sizeof ecm_desc,
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubType =   USB_CDC_ETHERNET_TYPE,
+
+        /* this descriptor actually adds value, surprise! */
+        /* .iMACAddress = DYNAMIC */
+        .bmEthernetStatistics = cpu_to_le32(0), /* no statistics */
+        .wMaxSegmentSize =      cpu_to_le16(ETH_FRAME_LEN),
+        .wNumberMCFilters =     cpu_to_le16(0),
+        .bNumberPowerFilters =  0,
+};
+
+#define NCAPS   (USB_CDC_NCM_NCAP_ETH_FILTER | USB_CDC_NCM_NCAP_CRC_MODE)
+
+static struct usb_cdc_ncm_desc ncm_desc __initdata = {
+        .bLength =              sizeof ncm_desc,
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubType =   USB_CDC_NCM_TYPE,
+
+        .bcdNcmVersion =        cpu_to_le16(0x0100),
+        /* can process SetEthernetPacketFilter */
+        .bmNetworkCapabilities = NCAPS,
+};
+
+/* the default data interface has no endpoints ... */
+
+static struct usb_interface_descriptor ncm_data_nop_intf __initdata = {
+        .bLength =              sizeof ncm_data_nop_intf,
+        .bDescriptorType =      USB_DT_INTERFACE,
+
+        .bInterfaceNumber =     1,
+        .bAlternateSetting =    0,
+        .bNumEndpoints =        0,
+        .bInterfaceClass =      USB_CLASS_CDC_DATA,
+        .bInterfaceSubClass =   0,
+        .bInterfaceProtocol =   USB_CDC_NCM_PROTO_NTB,
+        /* .iInterface = DYNAMIC */
+};
+
+/* ... but the "real" data interface has two bulk endpoints */
+
+static struct usb_interface_descriptor ncm_data_intf __initdata = {
+        .bLength =              sizeof ncm_data_intf,
+        .bDescriptorType =      USB_DT_INTERFACE,
+
+        .bInterfaceNumber =     1,
+        .bAlternateSetting =    1,
+        .bNumEndpoints =        2,
+        .bInterfaceClass =      USB_CLASS_CDC_DATA,
+        .bInterfaceSubClass =   0,
+        .bInterfaceProtocol =   USB_CDC_NCM_PROTO_NTB,
+        /* .iInterface = DYNAMIC */
+};
+
+/* full speed support: */
+
+static struct usb_endpoint_descriptor fs_ncm_notify_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_INT,
+        .wMaxPacketSize =       cpu_to_le16(NCM_STATUS_BYTECOUNT),
+        .bInterval =            1 << LOG2_STATUS_INTERVAL_MSEC,
+};
+
+static struct usb_endpoint_descriptor fs_ncm_in_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_endpoint_descriptor fs_ncm_out_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_OUT,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_descriptor_header *ncm_fs_function[] __initdata = {
+        (struct usb_descriptor_header *) &ncm_iad_desc,
+        /* CDC NCM control descriptors */
+        (struct usb_descriptor_header *) &ncm_control_intf,
+        (struct usb_descriptor_header *) &ncm_header_desc,
+        (struct usb_descriptor_header *) &ncm_union_desc,
+        (struct usb_descriptor_header *) &ecm_desc,
+        (struct usb_descriptor_header *) &ncm_desc,
+        (struct usb_descriptor_header *) &fs_ncm_notify_desc,
+        /* data interface, altsettings 0 and 1 */
+        (struct usb_descriptor_header *) &ncm_data_nop_intf,
+        (struct usb_descriptor_header *) &ncm_data_intf,
+        (struct usb_descriptor_header *) &fs_ncm_in_desc,
+        (struct usb_descriptor_header *) &fs_ncm_out_desc,
+        NULL,
+};
+
+/* high speed support: */
+
+static struct usb_endpoint_descriptor hs_ncm_notify_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_INT,
+        .wMaxPacketSize =       cpu_to_le16(NCM_STATUS_BYTECOUNT),
+        .bInterval =            LOG2_STATUS_INTERVAL_MSEC + 4,
+};
+static struct usb_endpoint_descriptor hs_ncm_in_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize =       cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor hs_ncm_out_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_OUT,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize =       cpu_to_le16(512),
+};
+
+static struct usb_descriptor_header *ncm_hs_function[] __initdata = {
+        (struct usb_descriptor_header *) &ncm_iad_desc,
+        /* CDC NCM control descriptors */
+        (struct usb_descriptor_header *) &ncm_control_intf,
+        (struct usb_descriptor_header *) &ncm_header_desc,
+        (struct usb_descriptor_header *) &ncm_union_desc,
+        (struct usb_descriptor_header *) &ecm_desc,
+        (struct usb_descriptor_header *) &ncm_desc,
+        (struct usb_descriptor_header *) &hs_ncm_notify_desc,
+        /* data interface, altsettings 0 and 1 */
+        (struct usb_descriptor_header *) &ncm_data_nop_intf,
+        (struct usb_descriptor_header *) &ncm_data_intf,
+        (struct usb_descriptor_header *) &hs_ncm_in_desc,
+        (struct usb_descriptor_header *) &hs_ncm_out_desc,
+        NULL,
+};
+
+/* string descriptors: */
+
+#define STRING_CTRL_IDX 0
+#define STRING_MAC_IDX  1
+#define STRING_DATA_IDX 2
+#define STRING_IAD_IDX  3
+
+static struct usb_string ncm_string_defs[] = {
+        [STRING_CTRL_IDX].s = "CDC Network Control Model (NCM)",
+        [STRING_MAC_IDX].s = NULL /* DYNAMIC */,
+        [STRING_DATA_IDX].s = "CDC Network Data",
+        [STRING_IAD_IDX].s = "CDC NCM",
+        {  } /* end of list */
+};
+
+static struct usb_gadget_strings ncm_string_table = {
+        .language =             0x0409, /* en-us */
+        .strings =              ncm_string_defs,
+};
+
+static struct usb_gadget_strings *ncm_strings[] = {
+        &ncm_string_table,
+        NULL,
+};
+
+/*
+ * Here are options for NCM Datagram Pointer table (NDP) parser.
+ * There are 2 different formats: NDP16 and NDP32 in the spec (ch. 3),
+ * in NDP16 offsets and sizes fields are 1 16bit word wide,
+ * in NDP32 -- 2 16bit words wide. Also signatures are different.
+ * To make the parser code the same, put the differences in the structure,
+ * and switch pointers to the structures when the format is changed.
+ */
+
+struct ndp_parser_opts {
+        u32             nth_sign;
+        u32             ndp_sign;
+        unsigned        nth_size;
+        unsigned        ndp_size;
+        unsigned        ndplen_align;
+        /* sizes in u16 units */
+        unsigned        dgram_item_len; /* index or length */
+        unsigned        block_length;
+        unsigned        fp_index;
+        unsigned        reserved1;
+        unsigned        reserved2;
+        unsigned        next_fp_index;
+};
+
+#define INIT_NDP16_OPTS {                                       \
+                .nth_sign = USB_CDC_NCM_NTH16_SIGN,             \
+                .ndp_sign = USB_CDC_NCM_NDP16_NOCRC_SIGN,       \
+                .nth_size = sizeof(struct usb_cdc_ncm_nth16),   \
+                .ndp_size = sizeof(struct usb_cdc_ncm_ndp16),   \
+                .ndplen_align = 4,                              \
+                .dgram_item_len = 1,                            \
+                .block_length = 1,                              \
+                .fp_index = 1,                                  \
+                .reserved1 = 0,                                 \
+                .reserved2 = 0,                                 \
+                .next_fp_index = 1,                             \
+        }
+
+
+#define INIT_NDP32_OPTS {                                       \
+                .nth_sign = USB_CDC_NCM_NTH32_SIGN,             \
+                .ndp_sign = USB_CDC_NCM_NDP32_NOCRC_SIGN,       \
+                .nth_size = sizeof(struct usb_cdc_ncm_nth32),   \
+                .ndp_size = sizeof(struct usb_cdc_ncm_ndp32),   \
+                .ndplen_align = 8,                              \
+                .dgram_item_len = 2,                            \
+                .block_length = 2,                              \
+                .fp_index = 2,                                  \
+                .reserved1 = 1,                                 \
+                .reserved2 = 2,                                 \
+                .next_fp_index = 2,                             \
+        }
+
+static struct ndp_parser_opts ndp16_opts = INIT_NDP16_OPTS;
+static struct ndp_parser_opts ndp32_opts = INIT_NDP32_OPTS;
+
+static inline void put_ncm(__le16 **p, unsigned size, unsigned val)
+{
+        switch (size) {
+        case 1:
+                put_unaligned_le16((u16)val, *p);
+                break;
+        case 2:
+                put_unaligned_le32((u32)val, *p);
+
+                break;
+        default:
+                BUG();
+        }
+
+        *p += size;
+}
+
+static inline unsigned get_ncm(__le16 **p, unsigned size)
+{
+        unsigned tmp;
+
+        switch (size) {
+        case 1:
+                tmp = get_unaligned_le16(*p);
+                break;
+        case 2:
+                tmp = get_unaligned_le32(*p);
+                break;
+        default:
+                BUG();
+        }
+
+        *p += size;
+        return tmp;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static inline void ncm_reset_values(struct f_ncm *ncm)
+{
+        ncm->parser_opts = &ndp16_opts;
+        ncm->is_crc = false;
+        ncm->port.cdc_filter = DEFAULT_FILTER;
+
+        /* doesn't make sense for ncm, fixed size used */
+        ncm->port.header_len = 0;
+
+        ncm->port.fixed_out_len = le32_to_cpu(ntb_parameters.dwNtbOutMaxSize);
+        ncm->port.fixed_in_len = NTB_DEFAULT_IN_SIZE;
+}
+
+/*
+ * Context: ncm->lock held
+ */
+static void ncm_do_notify(struct f_ncm *ncm)
+{
+        struct usb_request              *req = ncm->notify_req;
+        struct usb_cdc_notification     *event;
+        struct usb_composite_dev        *cdev = ncm->port.func.config->cdev;
+        __le32                          *data;
+        int                             status;
+
+        /* notification already in flight? */
+        if (!req)
+                return;
+
+        event = req->buf;
+        switch (ncm->notify_state) {
+        case NCM_NOTIFY_NONE:
+                return;
+
+        case NCM_NOTIFY_CONNECT:
+                event->bNotificationType = USB_CDC_NOTIFY_NETWORK_CONNECTION;
+                if (ncm->is_open)
+                        event->wValue = cpu_to_le16(1);
+                else
+                        event->wValue = cpu_to_le16(0);
+                event->wLength = 0;
+                req->length = sizeof *event;
+
+                DBG(cdev, "notify connect %s\n",
+                                ncm->is_open ? "true" : "false");
+                ncm->notify_state = NCM_NOTIFY_NONE;
+                break;
+
+        case NCM_NOTIFY_SPEED:
+                event->bNotificationType = USB_CDC_NOTIFY_SPEED_CHANGE;
+                event->wValue = cpu_to_le16(0);
+                event->wLength = cpu_to_le16(8);
+                req->length = NCM_STATUS_BYTECOUNT;
+
+                /* SPEED_CHANGE data is up/down speeds in bits/sec */
+                data = req->buf + sizeof *event;
+                data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));
+                data[1] = data[0];
+
+                DBG(cdev, "notify speed %d\n", ncm_bitrate(cdev->gadget));
+                ncm->notify_state = NCM_NOTIFY_CONNECT;
+                break;
+        }
+        event->bmRequestType = 0xA1;
+        event->wIndex = cpu_to_le16(ncm->ctrl_id);
+
+        ncm->notify_req = NULL;
+        /*
+         * In double buffering if there is a space in FIFO,
+         * completion callback can be called right after the call,
+         * so unlocking
+         */
+        spin_unlock(&ncm->lock);
+        status = usb_ep_queue(ncm->notify, req, GFP_ATOMIC);
+        spin_lock(&ncm->lock);
+        if (status < 0) {
+                ncm->notify_req = req;
+                DBG(cdev, "notify --> %d\n", status);
+        }
+}
+
+/*
+ * Context: ncm->lock held
+ */
+static void ncm_notify(struct f_ncm *ncm)
+{
+        /*
+         * NOTE on most versions of Linux, host side cdc-ethernet
+         * won't listen for notifications until its netdevice opens.
+         * The first notification then sits in the FIFO for a long
+         * time, and the second one is queued.
+         *
+         * If ncm_notify() is called before the second (CONNECT)
+         * notification is sent, then it will reset to send the SPEED
+         * notificaion again (and again, and again), but it's not a problem
+         */
+        ncm->notify_state = NCM_NOTIFY_SPEED;
+        ncm_do_notify(ncm);
+}
+
+static void ncm_notify_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        struct f_ncm                    *ncm = req->context;
+        struct usb_composite_dev        *cdev = ncm->port.func.config->cdev;
+        struct usb_cdc_notification     *event = req->buf;
+
+        spin_lock(&ncm->lock);
+        switch (req->status) {
+        case 0:
+                VDBG(cdev, "Notification %02x sent\n",
+                     event->bNotificationType);
+                break;
+        case -ECONNRESET:
+        case -ESHUTDOWN:
+                ncm->notify_state = NCM_NOTIFY_NONE;
+                break;
+        default:
+                DBG(cdev, "event %02x --> %d\n",
+                        event->bNotificationType, req->status);
+                break;
+        }
+        ncm->notify_req = req;
+        ncm_do_notify(ncm);
+        spin_unlock(&ncm->lock);
+}
+
+static void ncm_ep0out_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        /* now for SET_NTB_INPUT_SIZE only */
+        unsigned                in_size;
+        struct usb_function     *f = req->context;
+        struct f_ncm            *ncm = func_to_ncm(f);
+        struct usb_composite_dev *cdev = ep->driver_data;
+
+        req->context = NULL;
+        if (req->status || req->actual != req->length) {
+                DBG(cdev, "Bad control-OUT transfer\n");
+                goto invalid;
+        }
+
+        in_size = get_unaligned_le32(req->buf);
+        if (in_size < USB_CDC_NCM_NTB_MIN_IN_SIZE ||
+            in_size > le32_to_cpu(ntb_parameters.dwNtbInMaxSize)) {
+                DBG(cdev, "Got wrong INPUT SIZE (%d) from host\n", in_size);
+                goto invalid;
+        }
+
+        ncm->port.fixed_in_len = in_size;
+        VDBG(cdev, "Set NTB INPUT SIZE %d\n", in_size);
+        return;
+
+invalid:
+        usb_ep_set_halt(ep);
+        return;
+}
+
+static int ncm_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
+{
+        struct f_ncm            *ncm = func_to_ncm(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+        struct usb_request      *req = cdev->req;
+        int                     value = -EOPNOTSUPP;
+        u16                     w_index = le16_to_cpu(ctrl->wIndex);
+        u16                     w_value = le16_to_cpu(ctrl->wValue);
+        u16                     w_length = le16_to_cpu(ctrl->wLength);
+
+        /*
+         * composite driver infrastructure handles everything except
+         * CDC class messages; interface activation uses set_alt().
+         */
+        switch ((ctrl->bRequestType << 8) | ctrl->bRequest) {
+        case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
+                        | USB_CDC_SET_ETHERNET_PACKET_FILTER:
+                /*
+                 * see 6.2.30: no data, wIndex = interface,
+                 * wValue = packet filter bitmap
+                 */
+                if (w_length != 0 || w_index != ncm->ctrl_id)
+                        goto invalid;
+                DBG(cdev, "packet filter %02x\n", w_value);
+                /*
+                 * REVISIT locking of cdc_filter.  This assumes the UDC
+                 * driver won't have a concurrent packet TX irq running on
+                 * another CPU; or that if it does, this write is atomic...
+                 */
+                ncm->port.cdc_filter = w_value;
+                value = 0;
+                break;
+        /*
+         * and optionally:
+         * case USB_CDC_SEND_ENCAPSULATED_COMMAND:
+         * case USB_CDC_GET_ENCAPSULATED_RESPONSE:
+         * case USB_CDC_SET_ETHERNET_MULTICAST_FILTERS:
+         * case USB_CDC_SET_ETHERNET_PM_PATTERN_FILTER:
+         * case USB_CDC_GET_ETHERNET_PM_PATTERN_FILTER:
+         * case USB_CDC_GET_ETHERNET_STATISTIC:
+         */
+
+        case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
+                | USB_CDC_GET_NTB_PARAMETERS:
+
+                if (w_length == 0 || w_value != 0 || w_index != ncm->ctrl_id)
+                        goto invalid;
+                value = w_length > sizeof ntb_parameters ?
+                        sizeof ntb_parameters : w_length;
+                memcpy(req->buf, &ntb_parameters, value);
+                VDBG(cdev, "Host asked NTB parameters\n");
+                break;
+
+        case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
+                | USB_CDC_GET_NTB_INPUT_SIZE:
+
+                if (w_length < 4 || w_value != 0 || w_index != ncm->ctrl_id)
+                        goto invalid;
+                put_unaligned_le32(ncm->port.fixed_in_len, req->buf);
+                value = 4;
+                VDBG(cdev, "Host asked INPUT SIZE, sending %d\n",
+                     ncm->port.fixed_in_len);
+                break;
+
+        case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
+                | USB_CDC_SET_NTB_INPUT_SIZE:
+        {
+                if (w_length != 4 || w_value != 0 || w_index != ncm->ctrl_id)
+                        goto invalid;
+                req->complete = ncm_ep0out_complete;
+                req->length = w_length;
+                req->context = f;
+
+                value = req->length;
+                break;
+        }
+
+        case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
+                | USB_CDC_GET_NTB_FORMAT:
+        {
+                uint16_t format;
+
+                if (w_length < 2 || w_value != 0 || w_index != ncm->ctrl_id)
+                        goto invalid;
+                format = (ncm->parser_opts == &ndp16_opts) ? 0x0000 : 0x0001;
+                put_unaligned_le16(format, req->buf);
+                value = 2;
+                VDBG(cdev, "Host asked NTB FORMAT, sending %d\n", format);
+                break;
+        }
+
+        case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
+                | USB_CDC_SET_NTB_FORMAT:
+        {
+                if (w_length != 0 || w_index != ncm->ctrl_id)
+                        goto invalid;
+                switch (w_value) {
+                case 0x0000:
+                        ncm->parser_opts = &ndp16_opts;
+                        DBG(cdev, "NCM16 selected\n");
+                        break;
+                case 0x0001:
+                        ncm->parser_opts = &ndp32_opts;
+                        DBG(cdev, "NCM32 selected\n");
+                        break;
+                default:
+                        goto invalid;
+                }
+                value = 0;
+                break;
+        }
+        case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
+                | USB_CDC_GET_CRC_MODE:
+        {
+                uint16_t is_crc;
+
+                if (w_length < 2 || w_value != 0 || w_index != ncm->ctrl_id)
+                        goto invalid;
+                is_crc = ncm->is_crc ? 0x0001 : 0x0000;
+                put_unaligned_le16(is_crc, req->buf);
+                value = 2;
+                VDBG(cdev, "Host asked CRC MODE, sending %d\n", is_crc);
+                break;
+        }
+
+        case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
+                | USB_CDC_SET_CRC_MODE:
+        {
+                int ndp_hdr_crc = 0;
+
+                if (w_length != 0 || w_index != ncm->ctrl_id)
+                        goto invalid;
+                switch (w_value) {
+                case 0x0000:
+                        ncm->is_crc = false;
+                        ndp_hdr_crc = NCM_NDP_HDR_NOCRC;
+                        DBG(cdev, "non-CRC mode selected\n");
+                        break;
+                case 0x0001:
+                        ncm->is_crc = true;
+                        ndp_hdr_crc = NCM_NDP_HDR_CRC;
+                        DBG(cdev, "CRC mode selected\n");
+                        break;
+                default:
+                        goto invalid;
+                }
+                ncm->parser_opts->ndp_sign &= ~NCM_NDP_HDR_CRC_MASK;
+                ncm->parser_opts->ndp_sign |= ndp_hdr_crc;
+                value = 0;
+                break;
+        }
+
+        /* and disabled in ncm descriptor: */
+        /* case USB_CDC_GET_NET_ADDRESS: */
+        /* case USB_CDC_SET_NET_ADDRESS: */
+        /* case USB_CDC_GET_MAX_DATAGRAM_SIZE: */
+        /* case USB_CDC_SET_MAX_DATAGRAM_SIZE: */
+
+        default:
+invalid:
+                DBG(cdev, "invalid control req%02x.%02x v%04x i%04x l%d\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, w_length);
+        }
+
+        /* respond with data transfer or status phase? */
+        if (value >= 0) {
+                DBG(cdev, "ncm req%02x.%02x v%04x i%04x l%d\n",
+                        ctrl->bRequestType, ctrl->bRequest,
+                        w_value, w_index, w_length);
+                req->zero = 0;
+                req->length = value;
+                value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
+                if (value < 0)
+                        ERROR(cdev, "ncm req %02x.%02x response err %d\n",
+                                        ctrl->bRequestType, ctrl->bRequest,
+                                        value);
+        }
+
+        /* device either stalls (value < 0) or reports success */
+        return value;
+}
+
+
+static int ncm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
+{
+        struct f_ncm            *ncm = func_to_ncm(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+
+        /* Control interface has only altsetting 0 */
+        if (intf == ncm->ctrl_id) {
+                if (alt != 0)
+                        goto fail;
+
+                if (ncm->notify->driver_data) {
+                        DBG(cdev, "reset ncm control %d\n", intf);
+                        usb_ep_disable(ncm->notify);
+                } else {
+                        DBG(cdev, "init ncm ctrl %d\n", intf);
+                        ncm->notify_desc = ep_choose(cdev->gadget,
+                                        ncm->hs.notify,
+                                        ncm->fs.notify);
+                }
+                usb_ep_enable(ncm->notify, ncm->notify_desc);
+                ncm->notify->driver_data = ncm;
+
+        /* Data interface has two altsettings, 0 and 1 */
+        } else if (intf == ncm->data_id) {
+                if (alt > 1)
+                        goto fail;
+
+                if (ncm->port.in_ep->driver_data) {
+                        DBG(cdev, "reset ncm\n");
+                        gether_disconnect(&ncm->port);
+                        ncm_reset_values(ncm);
+                }
+
+                /*
+                 * CDC Network only sends data in non-default altsettings.
+                 * Changing altsettings resets filters, statistics, etc.
+                 */
+                if (alt == 1) {
+                        struct net_device       *net;
+
+                        if (!ncm->port.in) {
+                                DBG(cdev, "init ncm\n");
+                                ncm->port.in = ep_choose(cdev->gadget,
+                                                         ncm->hs.in,
+                                                         ncm->fs.in);
+                                ncm->port.out = ep_choose(cdev->gadget,
+                                                          ncm->hs.out,
+                                                          ncm->fs.out);
+                        }
+
+                        /* TODO */
+                        /* Enable zlps by default for NCM conformance;
+                         * override for musb_hdrc (avoids txdma ovhead)
+                         */
+                        ncm->port.is_zlp_ok = !(
+                                gadget_is_musbhdrc(cdev->gadget)
+                                );
+                        ncm->port.cdc_filter = DEFAULT_FILTER;
+                        DBG(cdev, "activate ncm\n");
+                        net = gether_connect(&ncm->port);
+                        if (IS_ERR(net))
+                                return PTR_ERR(net);
+                }
+
+                spin_lock(&ncm->lock);
+                ncm_notify(ncm);
+                spin_unlock(&ncm->lock);
+        } else
+                goto fail;
+
+        return 0;
+fail:
+        return -EINVAL;
+}
+
+/*
+ * Because the data interface supports multiple altsettings,
+ * this NCM function *MUST* implement a get_alt() method.
+ */
+static int ncm_get_alt(struct usb_function *f, unsigned intf)
+{
+        struct f_ncm            *ncm = func_to_ncm(f);
+
+        if (intf == ncm->ctrl_id)
+                return 0;
+        return ncm->port.in_ep->driver_data ? 1 : 0;
+}
+
+static struct sk_buff *ncm_wrap_ntb(struct gether *port,
+                                    struct sk_buff *skb)
+{
+        struct f_ncm    *ncm = func_to_ncm(&port->func);
+        struct sk_buff  *skb2;
+        int             ncb_len = 0;
+        __le16          *tmp;
+        int             div = ntb_parameters.wNdpInDivisor;
+        int             rem = ntb_parameters.wNdpInPayloadRemainder;
+        int             pad;
+        int             ndp_align = ntb_parameters.wNdpInAlignment;
+        int             ndp_pad;
+        unsigned        max_size = ncm->port.fixed_in_len;
+        struct ndp_parser_opts *opts = ncm->parser_opts;
+        unsigned        crc_len = ncm->is_crc ? sizeof(uint32_t) : 0;
+
+        ncb_len += opts->nth_size;
+        ndp_pad = ALIGN(ncb_len, ndp_align) - ncb_len;
+        ncb_len += ndp_pad;
+        ncb_len += opts->ndp_size;
+        ncb_len += 2 * 2 * opts->dgram_item_len; /* Datagram entry */
+        ncb_len += 2 * 2 * opts->dgram_item_len; /* Zero datagram entry */
+        pad = ALIGN(ncb_len, div) + rem - ncb_len;
+        ncb_len += pad;
+
+        if (ncb_len + skb->len + crc_len > max_size) {
+                dev_kfree_skb_any(skb);
+                return NULL;
+        }
+
+        skb2 = skb_copy_expand(skb, ncb_len,
+                               max_size - skb->len - ncb_len - crc_len,
+                               GFP_ATOMIC);
+        dev_kfree_skb_any(skb);
+        if (!skb2)
+                return NULL;
+
+        skb = skb2;
+
+        tmp = (void *) skb_push(skb, ncb_len);
+        memset(tmp, 0, ncb_len);
+
+        put_unaligned_le32(opts->nth_sign, tmp); /* dwSignature */
+        tmp += 2;
+        /* wHeaderLength */
+        put_unaligned_le16(opts->nth_size, tmp++);
+        tmp++; /* skip wSequence */
+        put_ncm(&tmp, opts->block_length, skb->len); /* (d)wBlockLength */
+        /* (d)wFpIndex */
+        /* the first pointer is right after the NTH + align */
+        put_ncm(&tmp, opts->fp_index, opts->nth_size + ndp_pad);
+
+        tmp = (void *)tmp + ndp_pad;
+
+        /* NDP */
+        put_unaligned_le32(opts->ndp_sign, tmp); /* dwSignature */
+        tmp += 2;
+        /* wLength */
+        put_unaligned_le16(ncb_len - opts->nth_size - pad, tmp++);
+
+        tmp += opts->reserved1;
+        tmp += opts->next_fp_index; /* skip reserved (d)wNextFpIndex */
+        tmp += opts->reserved2;
+
+        if (ncm->is_crc) {
+                uint32_t crc;
+
+                crc = ~crc32_le(~0,
+                                skb->data + ncb_len,
+                                skb->len - ncb_len);
+                put_unaligned_le32(crc, skb->data + skb->len);
+                skb_put(skb, crc_len);
+        }
+
+        /* (d)wDatagramIndex[0] */
+        put_ncm(&tmp, opts->dgram_item_len, ncb_len);
+        /* (d)wDatagramLength[0] */
+        put_ncm(&tmp, opts->dgram_item_len, skb->len - ncb_len);
+        /* (d)wDatagramIndex[1] and  (d)wDatagramLength[1] already zeroed */
+
+        if (skb->len > MAX_TX_NONFIXED)
+                memset(skb_put(skb, max_size - skb->len),
+                       0, max_size - skb->len);
+
+        return skb;
+}
+
+static int ncm_unwrap_ntb(struct gether *port,
+                          struct sk_buff *skb,
+                          struct sk_buff_head *list)
+{
+        struct f_ncm    *ncm = func_to_ncm(&port->func);
+        __le16          *tmp = (void *) skb->data;
+        unsigned        index, index2;
+        unsigned        dg_len, dg_len2;
+        unsigned        ndp_len;
+        struct sk_buff  *skb2;
+        int             ret = -EINVAL;
+        unsigned        max_size = le32_to_cpu(ntb_parameters.dwNtbOutMaxSize);
+        struct ndp_parser_opts *opts = ncm->parser_opts;
+        unsigned        crc_len = ncm->is_crc ? sizeof(uint32_t) : 0;
+        int             dgram_counter;
+
+        /* dwSignature */
+        if (get_unaligned_le32(tmp) != opts->nth_sign) {
+                INFO(port->func.config->cdev, "Wrong NTH SIGN, skblen %d\n",
+                        skb->len);
+                print_hex_dump(KERN_INFO, "HEAD:", DUMP_PREFIX_ADDRESS, 32, 1,
+                               skb->data, 32, false);
+
+                goto err;
+        }
+        tmp += 2;
+        /* wHeaderLength */
+        if (get_unaligned_le16(tmp++) != opts->nth_size) {
+                INFO(port->func.config->cdev, "Wrong NTB headersize\n");
+                goto err;
+        }
+        tmp++; /* skip wSequence */
+
+        /* (d)wBlockLength */
+        if (get_ncm(&tmp, opts->block_length) > max_size) {
+                INFO(port->func.config->cdev, "OUT size exceeded\n");
+                goto err;
+        }
+
+        index = get_ncm(&tmp, opts->fp_index);
+        /* NCM 3.2 */
+        if (((index % 4) != 0) && (index < opts->nth_size)) {
+                INFO(port->func.config->cdev, "Bad index: %x\n",
+                        index);
+                goto err;
+        }
+
+        /* walk through NDP */
+        tmp = ((void *)skb->data) + index;
+        if (get_unaligned_le32(tmp) != opts->ndp_sign) {
+                INFO(port->func.config->cdev, "Wrong NDP SIGN\n");
+                goto err;
+        }
+        tmp += 2;
+
+        ndp_len = get_unaligned_le16(tmp++);
+        /*
+         * NCM 3.3.1
+         * entry is 2 items
+         * item size is 16/32 bits, opts->dgram_item_len * 2 bytes
+         * minimal: struct usb_cdc_ncm_ndpX + normal entry + zero entry
+         */
+        if ((ndp_len < opts->ndp_size + 2 * 2 * (opts->dgram_item_len * 2))
+            || (ndp_len % opts->ndplen_align != 0)) {
+                INFO(port->func.config->cdev, "Bad NDP length: %x\n", ndp_len);
+                goto err;
+        }
+        tmp += opts->reserved1;
+        tmp += opts->next_fp_index; /* skip reserved (d)wNextFpIndex */
+        tmp += opts->reserved2;
+
+        ndp_len -= opts->ndp_size;
+        index2 = get_ncm(&tmp, opts->dgram_item_len);
+        dg_len2 = get_ncm(&tmp, opts->dgram_item_len);
+        dgram_counter = 0;
+
+        do {
+                index = index2;
+                dg_len = dg_len2;
+                if (dg_len < 14 + crc_len) { /* ethernet header + crc */
+                        INFO(port->func.config->cdev, "Bad dgram length: %x\n",
+                             dg_len);
+                        goto err;
+                }
+                if (ncm->is_crc) {
+                        uint32_t crc, crc2;
+
+                        crc = get_unaligned_le32(skb->data +
+                                                 index + dg_len - crc_len);
+                        crc2 = ~crc32_le(~0,
+                                         skb->data + index,
+                                         dg_len - crc_len);
+                        if (crc != crc2) {
+                                INFO(port->func.config->cdev, "Bad CRC\n");
+                                goto err;
+                        }
+                }
+
+                index2 = get_ncm(&tmp, opts->dgram_item_len);
+                dg_len2 = get_ncm(&tmp, opts->dgram_item_len);
+
+                if (index2 == 0 || dg_len2 == 0) {
+                        skb2 = skb;
+                } else {
+                        skb2 = skb_clone(skb, GFP_ATOMIC);
+                        if (skb2 == NULL)
+                                goto err;
+                }
+
+                if (!skb_pull(skb2, index)) {
+                        ret = -EOVERFLOW;
+                        goto err;
+                }
+
+                skb_trim(skb2, dg_len - crc_len);
+                skb_queue_tail(list, skb2);
+
+                ndp_len -= 2 * (opts->dgram_item_len * 2);
+
+                dgram_counter++;
+
+                if (index2 == 0 || dg_len2 == 0)
+                        break;
+        } while (ndp_len > 2 * (opts->dgram_item_len * 2)); /* zero entry */
+
+        VDBG(port->func.config->cdev,
+             "Parsed NTB with %d frames\n", dgram_counter);
+        return 0;
+err:
+        skb_queue_purge(list);
+        dev_kfree_skb_any(skb);
+        return ret;
+}
+
+static void ncm_disable(struct usb_function *f)
+{
+        struct f_ncm            *ncm = func_to_ncm(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+
+        DBG(cdev, "ncm deactivated\n");
+
+        if (ncm->port.in_ep->driver_data)
+                gether_disconnect(&ncm->port);
+
+        if (ncm->notify->driver_data) {
+                usb_ep_disable(ncm->notify);
+                ncm->notify->driver_data = NULL;
+                ncm->notify_desc = NULL;
+        }
+}
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * Callbacks let us notify the host about connect/disconnect when the
+ * net device is opened or closed.
+ *
+ * For testing, note that link states on this side include both opened
+ * and closed variants of:
+ *
+ *   - disconnected/unconfigured
+ *   - configured but inactive (data alt 0)
+ *   - configured and active (data alt 1)
+ *
+ * Each needs to be tested with unplug, rmmod, SET_CONFIGURATION, and
+ * SET_INTERFACE (altsetting).  Remember also that "configured" doesn't
+ * imply the host is actually polling the notification endpoint, and
+ * likewise that "active" doesn't imply it's actually using the data
+ * endpoints for traffic.
+ */
+
+static void ncm_open(struct gether *geth)
+{
+        struct f_ncm            *ncm = func_to_ncm(&geth->func);
+
+        DBG(ncm->port.func.config->cdev, "%s\n", __func__);
+
+        spin_lock(&ncm->lock);
+        ncm->is_open = true;
+        ncm_notify(ncm);
+        spin_unlock(&ncm->lock);
+}
+
+static void ncm_close(struct gether *geth)
+{
+        struct f_ncm            *ncm = func_to_ncm(&geth->func);
+
+        DBG(ncm->port.func.config->cdev, "%s\n", __func__);
+
+        spin_lock(&ncm->lock);
+        ncm->is_open = false;
+        ncm_notify(ncm);
+        spin_unlock(&ncm->lock);
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* ethernet function driver setup/binding */
+
+static int __init
+ncm_bind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct usb_composite_dev *cdev = c->cdev;
+        struct f_ncm            *ncm = func_to_ncm(f);
+        int                     status;
+        struct usb_ep           *ep;
+
+        /* allocate instance-specific interface IDs */
+        status = usb_interface_id(c, f);
+        if (status < 0)
+                goto fail;
+        ncm->ctrl_id = status;
+        ncm_iad_desc.bFirstInterface = status;
+
+        ncm_control_intf.bInterfaceNumber = status;
+        ncm_union_desc.bMasterInterface0 = status;
+
+        status = usb_interface_id(c, f);
+        if (status < 0)
+                goto fail;
+        ncm->data_id = status;
+
+        ncm_data_nop_intf.bInterfaceNumber = status;
+        ncm_data_intf.bInterfaceNumber = status;
+        ncm_union_desc.bSlaveInterface0 = status;
+
+        status = -ENODEV;
+
+        /* allocate instance-specific endpoints */
+        ep = usb_ep_autoconfig(cdev->gadget, &fs_ncm_in_desc);
+        if (!ep)
+                goto fail;
+        ncm->port.in_ep = ep;
+        ep->driver_data = cdev; /* claim */
+
+        ep = usb_ep_autoconfig(cdev->gadget, &fs_ncm_out_desc);
+        if (!ep)
+                goto fail;
+        ncm->port.out_ep = ep;
+        ep->driver_data = cdev; /* claim */
+
+        ep = usb_ep_autoconfig(cdev->gadget, &fs_ncm_notify_desc);
+        if (!ep)
+                goto fail;
+        ncm->notify = ep;
+        ep->driver_data = cdev; /* claim */
+
+        status = -ENOMEM;
+
+        /* allocate notification request and buffer */
+        ncm->notify_req = usb_ep_alloc_request(ep, GFP_KERNEL);
+        if (!ncm->notify_req)
+                goto fail;
+        ncm->notify_req->buf = kmalloc(NCM_STATUS_BYTECOUNT, GFP_KERNEL);
+        if (!ncm->notify_req->buf)
+                goto fail;
+        ncm->notify_req->context = ncm;
+        ncm->notify_req->complete = ncm_notify_complete;
+
+        /* copy descriptors, and track endpoint copies */
+        f->descriptors = usb_copy_descriptors(ncm_fs_function);
+        if (!f->descriptors)
+                goto fail;
+
+        ncm->fs.in = usb_find_endpoint(ncm_fs_function,
+                        f->descriptors, &fs_ncm_in_desc);
+        ncm->fs.out = usb_find_endpoint(ncm_fs_function,
+                        f->descriptors, &fs_ncm_out_desc);
+        ncm->fs.notify = usb_find_endpoint(ncm_fs_function,
+                        f->descriptors, &fs_ncm_notify_desc);
+
+        /*
+         * support all relevant hardware speeds... we expect that when
+         * hardware is dual speed, all bulk-capable endpoints work at
+         * both speeds
+         */
+        if (gadget_is_dualspeed(c->cdev->gadget)) {
+                hs_ncm_in_desc.bEndpointAddress =
+                                fs_ncm_in_desc.bEndpointAddress;
+                hs_ncm_out_desc.bEndpointAddress =
+                                fs_ncm_out_desc.bEndpointAddress;
+                hs_ncm_notify_desc.bEndpointAddress =
+                                fs_ncm_notify_desc.bEndpointAddress;
+
+                /* copy descriptors, and track endpoint copies */
+                f->hs_descriptors = usb_copy_descriptors(ncm_hs_function);
+                if (!f->hs_descriptors)
+                        goto fail;
+
+                ncm->hs.in = usb_find_endpoint(ncm_hs_function,
+                                f->hs_descriptors, &hs_ncm_in_desc);
+                ncm->hs.out = usb_find_endpoint(ncm_hs_function,
+                                f->hs_descriptors, &hs_ncm_out_desc);
+                ncm->hs.notify = usb_find_endpoint(ncm_hs_function,
+                                f->hs_descriptors, &hs_ncm_notify_desc);
+        }
+
+        /*
+         * NOTE:  all that is done without knowing or caring about
+         * the network link ... which is unavailable to this code
+         * until we're activated via set_alt().
+         */
+
+        ncm->port.open = ncm_open;
+        ncm->port.close = ncm_close;
+
+        DBG(cdev, "CDC Network: %s speed IN/%s OUT/%s NOTIFY/%s\n",
+                        gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
+                        ncm->port.in_ep->name, ncm->port.out_ep->name,
+                        ncm->notify->name);
+        return 0;
+
+fail:
+        if (f->descriptors)
+                usb_free_descriptors(f->descriptors);
+
+        if (ncm->notify_req) {
+                kfree(ncm->notify_req->buf);
+                usb_ep_free_request(ncm->notify, ncm->notify_req);
+        }
+
+        /* we might as well release our claims on endpoints */
+        if (ncm->notify)
+                ncm->notify->driver_data = NULL;
+        if (ncm->port.out)
+                ncm->port.out_ep->driver_data = NULL;
+        if (ncm->port.in)
+                ncm->port.in_ep->driver_data = NULL;
+
+        ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
+
+        return status;
+}
+
+static void
+ncm_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct f_ncm            *ncm = func_to_ncm(f);
+
+        DBG(c->cdev, "ncm unbind\n");
+
+        if (gadget_is_dualspeed(c->cdev->gadget))
+                usb_free_descriptors(f->hs_descriptors);
+        usb_free_descriptors(f->descriptors);
+
+        kfree(ncm->notify_req->buf);
+        usb_ep_free_request(ncm->notify, ncm->notify_req);
+
+        ncm_string_defs[1].s = NULL;
+        kfree(ncm);
+}
+
+/**
+ * ncm_bind_config - add CDC Network link to a configuration
+ * @c: the configuration to support the network link
+ * @ethaddr: a buffer in which the ethernet address of the host side
+ *      side of the link was recorded
+ * Context: single threaded during gadget setup
+ *
+ * Returns zero on success, else negative errno.
+ *
+ * Caller must have called @gether_setup().  Caller is also responsible
+ * for calling @gether_cleanup() before module unload.
+ */
+int __init ncm_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN])
+{
+        struct f_ncm    *ncm;
+        int             status;
+
+        if (!can_support_ecm(c->cdev->gadget) || !ethaddr)
+                return -EINVAL;
+
+        /* maybe allocate device-global string IDs */
+        if (ncm_string_defs[0].id == 0) {
+
+                /* control interface label */
+                status = usb_string_id(c->cdev);
+                if (status < 0)
+                        return status;
+                ncm_string_defs[STRING_CTRL_IDX].id = status;
+                ncm_control_intf.iInterface = status;
+
+                /* data interface label */
+                status = usb_string_id(c->cdev);
+                if (status < 0)
+                        return status;
+                ncm_string_defs[STRING_DATA_IDX].id = status;
+                ncm_data_nop_intf.iInterface = status;
+                ncm_data_intf.iInterface = status;
+
+                /* MAC address */
+                status = usb_string_id(c->cdev);
+                if (status < 0)
+                        return status;
+                ncm_string_defs[STRING_MAC_IDX].id = status;
+                ecm_desc.iMACAddress = status;
+
+                /* IAD */
+                status = usb_string_id(c->cdev);
+                if (status < 0)
+                        return status;
+                ncm_string_defs[STRING_IAD_IDX].id = status;
+                ncm_iad_desc.iFunction = status;
+        }
+
+        /* allocate and initialize one new instance */
+        ncm = kzalloc(sizeof *ncm, GFP_KERNEL);
+        if (!ncm)
+                return -ENOMEM;
+
+        /* export host's Ethernet address in CDC format */
+        snprintf(ncm->ethaddr, sizeof ncm->ethaddr,
+                "%02X%02X%02X%02X%02X%02X",
+                ethaddr[0], ethaddr[1], ethaddr[2],
+                ethaddr[3], ethaddr[4], ethaddr[5]);
+        ncm_string_defs[1].s = ncm->ethaddr;
+
+        spin_lock_init(&ncm->lock);
+        ncm_reset_values(ncm);
+        ncm->port.is_fixed = true;
+
+        ncm->port.func.name = "cdc_network";
+        ncm->port.func.strings = ncm_strings;
+        /* descriptors are per-instance copies */
+        ncm->port.func.bind = ncm_bind;
+        ncm->port.func.unbind = ncm_unbind;
+        ncm->port.func.set_alt = ncm_set_alt;
+        ncm->port.func.get_alt = ncm_get_alt;
+        ncm->port.func.setup = ncm_setup;
+        ncm->port.func.disable = ncm_disable;
+
+        ncm->port.wrap = ncm_wrap_ntb;
+        ncm->port.unwrap = ncm_unwrap_ntb;
+
+        status = usb_add_function(c, &ncm->port.func);
+        if (status) {
+                ncm_string_defs[1].s = NULL;
+                kfree(ncm);
+        }
+        return status;
+}
diff --git a/drivers/usb/gadget/f_phonet.c b/drivers/usb/gadget/f_phonet.c
index 3c6e1a058745..5e1495097ec3 100644
--- a/drivers/usb/gadget/f_phonet.c
+++ b/drivers/usb/gadget/f_phonet.c
@@ -346,14 +346,19 @@ static void pn_rx_complete(struct usb_ep *ep, struct usb_request *req)
 
                 if (unlikely(!skb))
                         break;
-                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, 0,
-                                req->actual);
-                page = NULL;
 
-                if (req->actual < req->length) { /* Last fragment */
+                if (skb->len == 0) { /* First fragment */
                         skb->protocol = htons(ETH_P_PHONET);
                         skb_reset_mac_header(skb);
-                        pskb_pull(skb, 1);
+                        /* Can't use pskb_pull() on page in IRQ */
+                        memcpy(skb_put(skb, 1), page_address(page), 1);
+                }
+
+                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
+                                skb->len == 0, req->actual);
+                page = NULL;
+
+                if (req->actual < req->length) { /* Last fragment */
                         skb->dev = dev;
                         dev->stats.rx_packets++;
                         dev->stats.rx_bytes += skb->len;
diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
index 882484a40398..fa12ec8364ef 100644
--- a/drivers/usb/gadget/f_rndis.c
+++ b/drivers/usb/gadget/f_rndis.c
@@ -420,8 +420,7 @@ rndis_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
          */
         case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
                         | USB_CDC_SEND_ENCAPSULATED_COMMAND:
-                if (w_length > req->length || w_value
-                                || w_index != rndis->ctrl_id)
+                if (w_value || w_index != rndis->ctrl_id)
                         goto invalid;
                 /* read the request; process it later */
                 value = w_length;
diff --git a/drivers/usb/gadget/f_sourcesink.c b/drivers/usb/gadget/f_sourcesink.c
index 685d768f336e..e403a534dd55 100644
--- a/drivers/usb/gadget/f_sourcesink.c
+++ b/drivers/usb/gadget/f_sourcesink.c
@@ -404,7 +404,7 @@ static void sourcesink_disable(struct usb_function *f)
 
 /*-------------------------------------------------------------------------*/
 
-static int __ref sourcesink_bind_config(struct usb_configuration *c)
+static int __init sourcesink_bind_config(struct usb_configuration *c)
 {
         struct f_sourcesink     *ss;
         int                     status;
@@ -498,7 +498,6 @@ unknown:
 static struct usb_configuration sourcesink_driver = {
         .label          = "source/sink",
         .strings        = sourcesink_strings,
-        .bind           = sourcesink_bind_config,
         .setup          = sourcesink_setup,
         .bConfigurationValue = 3,
         .bmAttributes   = USB_CONFIG_ATT_SELFPOWER,
@@ -532,5 +531,5 @@ int __init sourcesink_add(struct usb_composite_dev *cdev, bool autoresume)
                 sourcesink_driver.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
         }
 
-        return usb_add_config(cdev, &sourcesink_driver);
+        return usb_add_config(cdev, &sourcesink_driver, sourcesink_bind_config);
 }
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
index a857b7ac238c..0360f56221ea 100644
--- a/drivers/usb/gadget/file_storage.c
+++ b/drivers/usb/gadget/file_storage.c
@@ -89,6 +89,7 @@
  *                              Required if "removable" is not set, names of
  *                                      the files or block devices used for
  *                                      backing storage
+ *      serial=HHHH...          Required serial number (string of hex chars)
  *      ro=b[,b...]             Default false, booleans for read-only access
  *      removable               Default false, boolean for removable media
  *      luns=N                  Default N = number of filenames, number of
@@ -108,12 +109,11 @@
  *      vendor=0xVVVV           Default 0x0525 (NetChip), USB Vendor ID
  *      product=0xPPPP          Default 0xa4a5 (FSG), USB Product ID
  *      release=0xRRRR          Override the USB release number (bcdDevice)
- *      serial=HHHH...          Override serial number (string of hex chars)
  *      buflen=N                Default N=16384, buffer size used (will be
  *                                      rounded down to a multiple of
  *                                      PAGE_CACHE_SIZE)
  *
- * If CONFIG_USB_FILE_STORAGE_TEST is not set, only the "file", "ro",
+ * If CONFIG_USB_FILE_STORAGE_TEST is not set, only the "file", "serial", "ro",
  * "removable", "luns", "nofua", "stall", and "cdrom" options are available;
  * default values are used for everything else.
  *
@@ -273,13 +273,10 @@
 
 #define DRIVER_DESC             "File-backed Storage Gadget"
 #define DRIVER_NAME             "g_file_storage"
-/* DRIVER_VERSION must be at least 6 characters long, as it is used
- * to generate a fallback serial number. */
-#define DRIVER_VERSION          "20 November 2008"
+#define DRIVER_VERSION          "1 September 2010"
 
 static       char fsg_string_manufacturer[64];
 static const char fsg_string_product[] = DRIVER_DESC;
-static       char fsg_string_serial[13];
 static const char fsg_string_config[] = "Self-powered";
 static const char fsg_string_interface[] = "Mass Storage";
 
@@ -305,6 +302,7 @@ MODULE_LICENSE("Dual BSD/GPL");
 
 static struct {
         char            *file[FSG_MAX_LUNS];
+        char            *serial;
         int             ro[FSG_MAX_LUNS];
         int             nofua[FSG_MAX_LUNS];
         unsigned int    num_filenames;
@@ -321,7 +319,6 @@ static struct {
         unsigned short  vendor;
         unsigned short  product;
         unsigned short  release;
-        char            *serial;
         unsigned int    buflen;
 
         int             transport_type;
@@ -346,6 +343,9 @@ module_param_array_named(file, mod_data.file, charp, &mod_data.num_filenames,
                 S_IRUGO);
 MODULE_PARM_DESC(file, "names of backing files or devices");
 
+module_param_named(serial, mod_data.serial, charp, S_IRUGO);
+MODULE_PARM_DESC(serial, "USB serial number");
+
 module_param_array_named(ro, mod_data.ro, bool, &mod_data.num_ros, S_IRUGO);
 MODULE_PARM_DESC(ro, "true to force read-only");
 
@@ -365,9 +365,6 @@ MODULE_PARM_DESC(stall, "false to prevent bulk stalls");
 module_param_named(cdrom, mod_data.cdrom, bool, S_IRUGO);
 MODULE_PARM_DESC(cdrom, "true to emulate cdrom instead of disk");
 
-module_param_named(serial, mod_data.serial, charp, S_IRUGO);
-MODULE_PARM_DESC(serial, "USB serial number");
-
 /* In the non-TEST version, only the module parameters listed above
  * are available. */
 #ifdef CONFIG_USB_FILE_STORAGE_TEST
@@ -786,7 +783,7 @@ static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
 {
         struct usb_request      *req = fsg->ep0req;
         static u8               cbi_reset_cmnd[6] = {
-                        SC_SEND_DIAGNOSTIC, 4, 0xff, 0xff, 0xff, 0xff};
+                        SEND_DIAGNOSTIC, 4, 0xff, 0xff, 0xff, 0xff};
 
         /* Error in command transfer? */
         if (req->status || req->length != req->actual ||
@@ -1138,7 +1135,7 @@ static int do_read(struct fsg_dev *fsg)
 
         /* Get the starting Logical Block Address and check that it's
          * not too big */
-        if (fsg->cmnd[0] == SC_READ_6)
+        if (fsg->cmnd[0] == READ_6)
                 lba = get_unaligned_be24(&fsg->cmnd[1]);
         else {
                 lba = get_unaligned_be32(&fsg->cmnd[2]);
@@ -1273,7 +1270,7 @@ static int do_write(struct fsg_dev *fsg)
 
         /* Get the starting Logical Block Address and check that it's
          * not too big */
-        if (fsg->cmnd[0] == SC_WRITE_6)
+        if (fsg->cmnd[0] == WRITE_6)
                 lba = get_unaligned_be24(&fsg->cmnd[1]);
         else {
                 lba = get_unaligned_be32(&fsg->cmnd[2]);
@@ -1581,7 +1578,7 @@ static int do_inquiry(struct fsg_dev *fsg, struct fsg_buffhd *bh)
         }
 
         memset(buf, 0, 8);
-        buf[0] = (mod_data.cdrom ? TYPE_CDROM : TYPE_DISK);
+        buf[0] = (mod_data.cdrom ? TYPE_ROM : TYPE_DISK);
         if (mod_data.removable)
                 buf[1] = 0x80;
         buf[2] = 2;             // ANSI SCSI level 2
@@ -1750,11 +1747,11 @@ static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
          * The only variable value is the WriteProtect bit.  We will fill in
          * the mode data length later. */
         memset(buf, 0, 8);
-        if (mscmnd == SC_MODE_SENSE_6) {
+        if (mscmnd == MODE_SENSE) {
                 buf[2] = (curlun->ro ? 0x80 : 0x00);            // WP, DPOFUA
                 buf += 4;
                 limit = 255;
-        } else {                        // SC_MODE_SENSE_10
+        } else {                        // MODE_SENSE_10
                 buf[3] = (curlun->ro ? 0x80 : 0x00);            // WP, DPOFUA
                 buf += 8;
                 limit = 65535;          // Should really be mod_data.buflen
@@ -1794,7 +1791,7 @@ static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
         }
 
         /*  Store the mode data length */
-        if (mscmnd == SC_MODE_SENSE_6)
+        if (mscmnd == MODE_SENSE)
                 buf0[0] = len - 1;
         else
                 put_unaligned_be16(len - 2, buf0);
@@ -1950,37 +1947,6 @@ static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
         return rc;
 }
 
-static int pad_with_zeros(struct fsg_dev *fsg)
-{
-        struct fsg_buffhd       *bh = fsg->next_buffhd_to_fill;
-        u32                     nkeep = bh->inreq->length;
-        u32                     nsend;
-        int                     rc;
-
-        bh->state = BUF_STATE_EMPTY;            // For the first iteration
-        fsg->usb_amount_left = nkeep + fsg->residue;
-        while (fsg->usb_amount_left > 0) {
-
-                /* Wait for the next buffer to be free */
-                while (bh->state != BUF_STATE_EMPTY) {
-                        rc = sleep_thread(fsg);
-                        if (rc)
-                                return rc;
-                }
-
-                nsend = min(fsg->usb_amount_left, (u32) mod_data.buflen);
-                memset(bh->buf + nkeep, 0, nsend - nkeep);
-                bh->inreq->length = nsend;
-                bh->inreq->zero = 0;
-                start_transfer(fsg, fsg->bulk_in, bh->inreq,
-                                &bh->inreq_busy, &bh->state);
-                bh = fsg->next_buffhd_to_fill = bh->next;
-                fsg->usb_amount_left -= nsend;
-                nkeep = 0;
-        }
-        return 0;
-}
-
 static int throw_away_data(struct fsg_dev *fsg)
 {
         struct fsg_buffhd       *bh;
@@ -2085,18 +2051,20 @@ static int finish_reply(struct fsg_dev *fsg)
                         }
                 }
 
-                /* For Bulk-only, if we're allowed to stall then send the
-                 * short packet and halt the bulk-in endpoint.  If we can't
-                 * stall, pad out the remaining data with 0's. */
+                /*
+                 * For Bulk-only, mark the end of the data with a short
+                 * packet.  If we are allowed to stall, halt the bulk-in
+                 * endpoint.  (Note: This violates the Bulk-Only Transport
+                 * specification, which requires us to pad the data if we
+                 * don't halt the endpoint.  Presumably nobody will mind.)
+                 */
                 else {
-                        if (mod_data.can_stall) {
-                                bh->inreq->zero = 1;
-                                start_transfer(fsg, fsg->bulk_in, bh->inreq,
-                                                &bh->inreq_busy, &bh->state);
-                                fsg->next_buffhd_to_fill = bh->next;
+                        bh->inreq->zero = 1;
+                        start_transfer(fsg, fsg->bulk_in, bh->inreq,
+                                        &bh->inreq_busy, &bh->state);
+                        fsg->next_buffhd_to_fill = bh->next;
+                        if (mod_data.can_stall)
                                 rc = halt_bulk_in_endpoint(fsg);
-                        } else
-                                rc = pad_with_zeros(fsg);
                 }
                 break;
 
@@ -2317,9 +2285,9 @@ static int check_command(struct fsg_dev *fsg, int cmnd_size,
                 fsg->lun = lun;         // Use LUN from the command
 
         /* Check the LUN */
-        if (fsg->lun >= 0 && fsg->lun < fsg->nluns) {
+        if (fsg->lun < fsg->nluns) {
                 fsg->curlun = curlun = &fsg->luns[fsg->lun];
-                if (fsg->cmnd[0] != SC_REQUEST_SENSE) {
+                if (fsg->cmnd[0] != REQUEST_SENSE) {
                         curlun->sense_data = SS_NO_SENSE;
                         curlun->sense_data_info = 0;
                         curlun->info_valid = 0;
@@ -2330,8 +2298,8 @@ static int check_command(struct fsg_dev *fsg, int cmnd_size,
 
                 /* INQUIRY and REQUEST SENSE commands are explicitly allowed
                  * to use unsupported LUNs; all others may not. */
-                if (fsg->cmnd[0] != SC_INQUIRY &&
-                                fsg->cmnd[0] != SC_REQUEST_SENSE) {
+                if (fsg->cmnd[0] != INQUIRY &&
+                                fsg->cmnd[0] != REQUEST_SENSE) {
                         DBG(fsg, "unsupported LUN %d\n", fsg->lun);
                         return -EINVAL;
                 }
@@ -2340,8 +2308,8 @@ static int check_command(struct fsg_dev *fsg, int cmnd_size,
         /* If a unit attention condition exists, only INQUIRY and
          * REQUEST SENSE commands are allowed; anything else must fail. */
         if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
-                        fsg->cmnd[0] != SC_INQUIRY &&
-                        fsg->cmnd[0] != SC_REQUEST_SENSE) {
+                        fsg->cmnd[0] != INQUIRY &&
+                        fsg->cmnd[0] != REQUEST_SENSE) {
                 curlun->sense_data = curlun->unit_attention_data;
                 curlun->unit_attention_data = SS_NO_SENSE;
                 return -EINVAL;
@@ -2391,7 +2359,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
         down_read(&fsg->filesem);       // We're using the backing file
         switch (fsg->cmnd[0]) {
 
-        case SC_INQUIRY:
+        case INQUIRY:
                 fsg->data_size_from_cmnd = fsg->cmnd[4];
                 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
                                 (1<<4), 0,
@@ -2399,7 +2367,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
                         reply = do_inquiry(fsg, bh);
                 break;
 
-        case SC_MODE_SELECT_6:
+        case MODE_SELECT:
                 fsg->data_size_from_cmnd = fsg->cmnd[4];
                 if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
                                 (1<<1) | (1<<4), 0,
@@ -2407,7 +2375,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
                         reply = do_mode_select(fsg, bh);
                 break;
 
-        case SC_MODE_SELECT_10:
+        case MODE_SELECT_10:
                 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
                 if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
                                 (1<<1) | (3<<7), 0,
@@ -2415,7 +2383,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
                         reply = do_mode_select(fsg, bh);
                 break;
 
-        case SC_MODE_SENSE_6:
+        case MODE_SENSE:
                 fsg->data_size_from_cmnd = fsg->cmnd[4];
                 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
                                 (1<<1) | (1<<2) | (1<<4), 0,
@@ -2423,7 +2391,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
                         reply = do_mode_sense(fsg, bh);
                 break;
 
-        case SC_MODE_SENSE_10:
+        case MODE_SENSE_10:
                 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
                 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
                                 (1<<1) | (1<<2) | (3<<7), 0,
@@ -2431,7 +2399,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
                         reply = do_mode_sense(fsg, bh);
                 break;
 
-        case SC_PREVENT_ALLOW_MEDIUM_REMOVAL:
+        case ALLOW_MEDIUM_REMOVAL:
                 fsg->data_size_from_cmnd = 0;
                 if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
                                 (1<<4), 0,
@@ -2439,7 +2407,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
                         reply = do_prevent_allow(fsg);
                 break;
 
-        case SC_READ_6:
+        case READ_6:
                 i = fsg->cmnd[4];
                 fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
                 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
@@ -2448,7 +2416,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
                         reply = do_read(fsg);
                 break;
 
-        case SC_READ_10:
+        case READ_10:
                 fsg->data_size_from_cmnd =
                                 get_unaligned_be16(&fsg->cmnd[7]) << 9;
                 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
@@ -2457,7 +2425,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
                         reply = do_read(fsg);
                 break;
 
-        case SC_READ_12:
+        case READ_12:
                 fsg->data_size_from_cmnd =
                                 get_unaligned_be32(&fsg->cmnd[6]) << 9;
                 if ((reply = check_command(fsg, 12, DATA_DIR_TO_HOST,
@@ -2466,7 +2434,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
                         reply = do_read(fsg);
                 break;
 
-        case SC_READ_CAPACITY:
+        case READ_CAPACITY:
                 fsg->data_size_from_cmnd = 8;
                 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
                                 (0xf<<2) | (1<<8), 1,
@@ -2474,7 +2442,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
                         reply = do_read_capacity(fsg, bh);
                 break;
 
-        case SC_READ_HEADER:
+        case READ_HEADER:
                 if (!mod_data.cdrom)
                         goto unknown_cmnd;
                 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
@@ -2484,7 +2452,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
                         reply = do_read_header(fsg, bh);
                 break;
 
-        case SC_READ_TOC:
+        case READ_TOC:
                 if (!mod_data.cdrom)
                         goto unknown_cmnd;
                 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
@@ -2494,7 +2462,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
                         reply = do_read_toc(fsg, bh);
                 break;
 
-        case SC_READ_FORMAT_CAPACITIES:
+        case READ_FORMAT_CAPACITIES:
                 fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
                 if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
                                 (3<<7), 1,
@@ -2502,7 +2470,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
                         reply = do_read_format_capacities(fsg, bh);
                 break;
 
-        case SC_REQUEST_SENSE:
+        case REQUEST_SENSE:
                 fsg->data_size_from_cmnd = fsg->cmnd[4];
                 if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
                                 (1<<4), 0,
@@ -2510,7 +2478,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
                         reply = do_request_sense(fsg, bh);
                 break;
 
-        case SC_START_STOP_UNIT:
+        case START_STOP:
                 fsg->data_size_from_cmnd = 0;
                 if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
                                 (1<<1) | (1<<4), 0,
@@ -2518,7 +2486,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
                         reply = do_start_stop(fsg);
                 break;
 
-        case SC_SYNCHRONIZE_CACHE:
+        case SYNCHRONIZE_CACHE:
                 fsg->data_size_from_cmnd = 0;
                 if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
                                 (0xf<<2) | (3<<7), 1,
@@ -2526,7 +2494,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
                         reply = do_synchronize_cache(fsg);
                 break;
 
-        case SC_TEST_UNIT_READY:
+        case TEST_UNIT_READY:
                 fsg->data_size_from_cmnd = 0;
                 reply = check_command(fsg, 6, DATA_DIR_NONE,
                                 0, 1,
@@ -2535,7 +2503,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
 
         /* Although optional, this command is used by MS-Windows.  We
          * support a minimal version: BytChk must be 0. */
-        case SC_VERIFY:
+        case VERIFY:
                 fsg->data_size_from_cmnd = 0;
                 if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
                                 (1<<1) | (0xf<<2) | (3<<7), 1,
@@ -2543,7 +2511,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
                         reply = do_verify(fsg);
                 break;
 
-        case SC_WRITE_6:
+        case WRITE_6:
                 i = fsg->cmnd[4];
                 fsg->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
                 if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
@@ -2552,7 +2520,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
                         reply = do_write(fsg);
                 break;
 
-        case SC_WRITE_10:
+        case WRITE_10:
                 fsg->data_size_from_cmnd =
                                 get_unaligned_be16(&fsg->cmnd[7]) << 9;
                 if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
@@ -2561,7 +2529,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
                         reply = do_write(fsg);
                 break;
 
-        case SC_WRITE_12:
+        case WRITE_12:
                 fsg->data_size_from_cmnd =
                                 get_unaligned_be32(&fsg->cmnd[6]) << 9;
                 if ((reply = check_command(fsg, 12, DATA_DIR_FROM_HOST,
@@ -2574,10 +2542,10 @@ static int do_scsi_command(struct fsg_dev *fsg)
          * They don't mean much in this setting.  It's left as an exercise
          * for anyone interested to implement RESERVE and RELEASE in terms
          * of Posix locks. */
-        case SC_FORMAT_UNIT:
-        case SC_RELEASE:
-        case SC_RESERVE:
-        case SC_SEND_DIAGNOSTIC:
+        case FORMAT_UNIT:
+        case RELEASE:
+        case RESERVE:
+        case SEND_DIAGNOSTIC:
                 // Fall through
 
         default:
@@ -3178,6 +3146,7 @@ static void /* __init_or_exit */ fsg_unbind(struct usb_gadget *gadget)
         for (i = 0; i < fsg->nluns; ++i) {
                 curlun = &fsg->luns[i];
                 if (curlun->registered) {
+                        device_remove_file(&curlun->dev, &dev_attr_nofua);
                         device_remove_file(&curlun->dev, &dev_attr_ro);
                         device_remove_file(&curlun->dev, &dev_attr_file);
                         fsg_lun_close(curlun);
@@ -3213,7 +3182,6 @@ static int __init check_parameters(struct fsg_dev *fsg)
 {
         int     prot;
         int     gcnum;
-        int     i;
 
         /* Store the default values */
         mod_data.transport_type = USB_PR_BULK;
@@ -3309,45 +3277,29 @@ static int __init check_parameters(struct fsg_dev *fsg)
                         if ((*ch < '0' || *ch > '9') &&
                             (*ch < 'A' || *ch > 'F')) { /* not uppercase hex */
                                 WARNING(fsg,
-                                        "Invalid serial string character: %c; "
-                                        "Failing back to default\n",
+                                        "Invalid serial string character: %c\n",
                                         *ch);
-                                goto fill_serial;
+                                goto no_serial;
                         }
                 }
                 if (len > 126 ||
                     (mod_data.transport_type == USB_PR_BULK && len < 12) ||
                     (mod_data.transport_type != USB_PR_BULK && len > 12)) {
-                        WARNING(fsg,
-                                "Invalid serial string length; "
-                                "Failing back to default\n");
-                        goto fill_serial;
+                        WARNING(fsg, "Invalid serial string length!\n");
+                        goto no_serial;
                 }
                 fsg_strings[FSG_STRING_SERIAL - 1].s = mod_data.serial;
         } else {
-                WARNING(fsg,
-                        "Userspace failed to provide serial number; "
-                        "Failing back to default\n");
-fill_serial:
-                /* Serial number not specified or invalid, make our own.
-                 * We just encode it from the driver version string,
-                 * 12 characters to comply with both CB[I] and BBB spec.
-                 * Warning : Two devices running the same kernel will have
-                 * the same fallback serial number. */
-                for (i = 0; i < 12; i += 2) {
-                        unsigned char   c = DRIVER_VERSION[i / 2];
-
-                        if (!c)
-                                break;
-                        sprintf(&fsg_string_serial[i], "%02X", c);
-                }
+                WARNING(fsg, "No serial-number string provided!\n");
+ no_serial:
+                device_desc.iSerialNumber = 0;
         }
 
         return 0;
 }
 
 
-static int __ref fsg_bind(struct usb_gadget *gadget)
+static int __init fsg_bind(struct usb_gadget *gadget)
 {
         struct fsg_dev          *fsg = the_fsg;
         int                     rc;
@@ -3411,25 +3363,28 @@ static int __ref fsg_bind(struct usb_gadget *gadget)
                 dev_set_name(&curlun->dev,"%s-lun%d",
                              dev_name(&gadget->dev), i);
 
-                if ((rc = device_register(&curlun->dev)) != 0) {
+                kref_get(&fsg->ref);
+                rc = device_register(&curlun->dev);
+                if (rc) {
                         INFO(fsg, "failed to register LUN%d: %d\n", i, rc);
-                        goto out;
-                }
-                if ((rc = device_create_file(&curlun->dev,
-                                        &dev_attr_ro)) != 0 ||
-                                (rc = device_create_file(&curlun->dev,
-                                        &dev_attr_nofua)) != 0 ||
-                                (rc = device_create_file(&curlun->dev,
-                                        &dev_attr_file)) != 0) {
-                        device_unregister(&curlun->dev);
+                        put_device(&curlun->dev);
                         goto out;
                 }
                 curlun->registered = 1;
-                kref_get(&fsg->ref);
+
+                rc = device_create_file(&curlun->dev, &dev_attr_ro);
+                if (rc)
+                        goto out;
+                rc = device_create_file(&curlun->dev, &dev_attr_nofua);
+                if (rc)
+                        goto out;
+                rc = device_create_file(&curlun->dev, &dev_attr_file);
+                if (rc)
+                        goto out;
 
                 if (mod_data.file[i] && *mod_data.file[i]) {
-                        if ((rc = fsg_lun_open(curlun,
-                                        mod_data.file[i])) != 0)
+                        rc = fsg_lun_open(curlun, mod_data.file[i]);
+                        if (rc)
                                 goto out;
                 } else if (!mod_data.removable) {
                         ERROR(fsg, "no file given for LUN%d\n", i);
@@ -3607,7 +3562,6 @@ static struct usb_gadget_driver		fsg_driver = {
         .speed          = USB_SPEED_FULL,
 #endif
         .function       = (char *) fsg_string_product,
-        .bind           = fsg_bind,
         .unbind         = fsg_unbind,
         .disconnect     = fsg_disconnect,
         .setup          = fsg_setup,
@@ -3649,7 +3603,7 @@ static int __init fsg_init(void)
         if ((rc = fsg_alloc()) != 0)
                 return rc;
         fsg = the_fsg;
-        if ((rc = usb_gadget_register_driver(&fsg_driver)) != 0)
+        if ((rc = usb_gadget_probe_driver(&fsg_driver, fsg_bind)) != 0)
                 kref_put(&fsg->ref, fsg_release);
         return rc;
 }
diff --git a/drivers/usb/gadget/fsl_mxc_udc.c b/drivers/usb/gadget/fsl_mxc_udc.c
index eafa6d2c5ed7..43a49ecc1f36 100644
--- a/drivers/usb/gadget/fsl_mxc_udc.c
+++ b/drivers/usb/gadget/fsl_mxc_udc.c
@@ -22,6 +22,10 @@
 static struct clk *mxc_ahb_clk;
 static struct clk *mxc_usb_clk;
 
+/* workaround ENGcm09152 for i.MX35 */
+#define USBPHYCTRL_OTGBASE_OFFSET       0x608
+#define USBPHYCTRL_EVDO                 (1 << 23)
+
 int fsl_udc_clk_init(struct platform_device *pdev)
 {
         struct fsl_usb2_platform_data *pdata;
@@ -84,6 +88,20 @@ eenahb:
 void fsl_udc_clk_finalize(struct platform_device *pdev)
 {
         struct fsl_usb2_platform_data *pdata = pdev->dev.platform_data;
+#if defined(CONFIG_SOC_IMX35)
+        if (cpu_is_mx35()) {
+                unsigned int v;
+
+                /* workaround ENGcm09152 for i.MX35 */
+                if (pdata->workaround & FLS_USB2_WORKAROUND_ENGCM09152) {
+                        v = readl(MX35_IO_ADDRESS(MX35_USB_BASE_ADDR +
+                                        USBPHYCTRL_OTGBASE_OFFSET));
+                        writel(v | USBPHYCTRL_EVDO,
+                                MX35_IO_ADDRESS(MX35_USB_BASE_ADDR +
+                                        USBPHYCTRL_OTGBASE_OFFSET));
+                }
+        }
+#endif
 
         /* ULPI transceivers don't need usbpll */
         if (pdata->phy_mode == FSL_USB2_PHY_ULPI) {
diff --git a/drivers/usb/gadget/fsl_qe_udc.c b/drivers/usb/gadget/fsl_qe_udc.c
index a5ea2c1d8c93..3a68e09309f7 100644
--- a/drivers/usb/gadget/fsl_qe_udc.c
+++ b/drivers/usb/gadget/fsl_qe_udc.c
@@ -1148,6 +1148,12 @@ static int qe_ep_tx(struct qe_ep *ep, struct qe_frame *frame)
 static int txcomplete(struct qe_ep *ep, unsigned char restart)
 {
         if (ep->tx_req != NULL) {
+                struct qe_req *req = ep->tx_req;
+                unsigned zlp = 0, last_len = 0;
+
+                last_len = min_t(unsigned, req->req.length - ep->sent,
+                                ep->ep.maxpacket);
+
                 if (!restart) {
                         int asent = ep->last;
                         ep->sent += asent;
@@ -1156,9 +1162,18 @@ static int txcomplete(struct qe_ep *ep, unsigned char restart)
                         ep->last = 0;
                 }
 
+                /* zlp needed when req->re.zero is set */
+                if (req->req.zero) {
+                        if (last_len == 0 ||
+                                (req->req.length % ep->ep.maxpacket) != 0)
+                                zlp = 0;
+                        else
+                                zlp = 1;
+                } else
+                        zlp = 0;
+
                 /* a request already were transmitted completely */
-                if ((ep->tx_req->req.length - ep->sent) <= 0) {
-                        ep->tx_req->req.actual = (unsigned int)ep->sent;
+                if (((ep->tx_req->req.length - ep->sent) <= 0) && !zlp) {
                         done(ep, ep->tx_req, 0);
                         ep->tx_req = NULL;
                         ep->last = 0;
@@ -1191,6 +1206,7 @@ static int qe_usb_senddata(struct qe_ep *ep, struct qe_frame *frame)
         buf = (u8 *)ep->tx_req->req.buf + ep->sent;
         if (buf && size) {
                 ep->last = size;
+                ep->tx_req->req.actual += size;
                 frame_set_data(frame, buf);
                 frame_set_length(frame, size);
                 frame_set_status(frame, FRAME_OK);
@@ -2302,9 +2318,10 @@ static irqreturn_t qe_udc_irq(int irq, void *_udc)
 }
 
 /*-------------------------------------------------------------------------
-        Gadget driver register and unregister.
+        Gadget driver probe and unregister.
  --------------------------------------------------------------------------*/
-int usb_gadget_register_driver(struct usb_gadget_driver *driver)
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
 {
         int retval;
         unsigned long flags = 0;
@@ -2315,8 +2332,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
 
         if (!driver || (driver->speed != USB_SPEED_FULL
                         && driver->speed != USB_SPEED_HIGH)
-                        || !driver->bind || !driver->disconnect
-                        || !driver->setup)
+                        || !bind || !driver->disconnect || !driver->setup)
                 return -EINVAL;
 
         if (udc_controller->driver)
@@ -2332,7 +2348,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
         udc_controller->gadget.speed = (enum usb_device_speed)(driver->speed);
         spin_unlock_irqrestore(&udc_controller->lock, flags);
 
-        retval = driver->bind(&udc_controller->gadget);
+        retval = bind(&udc_controller->gadget);
         if (retval) {
                 dev_err(udc_controller->dev, "bind to %s --> %d",
                                 driver->driver.name, retval);
@@ -2353,7 +2369,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
                 udc_controller->gadget.name, driver->driver.name);
         return 0;
 }
-EXPORT_SYMBOL(usb_gadget_register_driver);
+EXPORT_SYMBOL(usb_gadget_probe_driver);
 
 int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
 {
@@ -2523,15 +2539,20 @@ static void qe_udc_release(struct device *dev)
 }
 
 /* Driver probe functions */
-static int __devinit qe_udc_probe(struct platform_device *ofdev,
-                        const struct of_device_id *match)
+static const struct of_device_id qe_udc_match[];
+static int __devinit qe_udc_probe(struct platform_device *ofdev)
 {
+        const struct of_device_id *match;
         struct device_node *np = ofdev->dev.of_node;
         struct qe_ep *ep;
         unsigned int ret = 0;
         unsigned int i;
         const void *prop;
 
+        match = of_match_device(qe_udc_match, &ofdev->dev);
+        if (!match)
+                return -EINVAL;
+
         prop = of_get_property(np, "mode", NULL);
         if (!prop || strcmp(prop, "peripheral"))
                 return -ENODEV;
@@ -2768,7 +2789,7 @@ static const struct of_device_id qe_udc_match[] __devinitconst = {
 
 MODULE_DEVICE_TABLE(of, qe_udc_match);
 
-static struct of_platform_driver udc_driver = {
+static struct platform_driver udc_driver = {
         .driver = {
                 .name = (char *)driver_name,
                 .owner = THIS_MODULE,
@@ -2786,12 +2807,12 @@ static int __init qe_udc_init(void)
 {
         printk(KERN_INFO "%s: %s, %s\n", driver_name, driver_desc,
                         DRIVER_VERSION);
-        return of_register_platform_driver(&udc_driver);
+        return platform_driver_register(&udc_driver);
 }
 
 static void __exit qe_udc_exit(void)
 {
-        of_unregister_platform_driver(&udc_driver);
+        platform_driver_unregister(&udc_driver);
 }
 
 module_init(qe_udc_init);
diff --git a/drivers/usb/gadget/fsl_qe_udc.h b/drivers/usb/gadget/fsl_qe_udc.h
index bea5b827bebe..1da5fb03d218 100644
--- a/drivers/usb/gadget/fsl_qe_udc.h
+++ b/drivers/usb/gadget/fsl_qe_udc.h
@@ -207,15 +207,15 @@ struct qe_frame{
 
 /* Frame status field */
 /* Receive side */
-#define FRAME_OK               0x00000000 /* Frame tranmitted or received OK */
-#define FRAME_ERROR            0x80000000 /* Error occured on frame */
+#define FRAME_OK               0x00000000 /* Frame transmitted or received OK */
+#define FRAME_ERROR            0x80000000 /* Error occurred on frame */
 #define START_FRAME_LOST       0x40000000 /* START_FRAME_LOST */
 #define END_FRAME_LOST         0x20000000 /* END_FRAME_LOST */
 #define RX_ER_NONOCT           0x10000000 /* Rx Non Octet Aligned Packet */
 #define RX_ER_BITSTUFF         0x08000000 /* Frame Aborted --Received packet
                                              with bit stuff error */
 #define RX_ER_CRC              0x04000000 /* Received packet with CRC error */
-#define RX_ER_OVERUN           0x02000000 /* Over-run occured on reception */
+#define RX_ER_OVERUN           0x02000000 /* Over-run occurred on reception */
 #define RX_ER_PID              0x01000000 /* Wrong PID received */
 /* Tranmit side */
 #define TX_ER_NAK              0x00800000 /* Received NAK handshake */
@@ -379,7 +379,7 @@ struct qe_udc {
 #define T_LSP         0x01000000         /* Low-speed transaction */
 #define T_PID         0x00c00000         /* packet id */
 #define T_NAK         0x00100000         /* No ack. */
-#define T_STAL        0x00080000         /* Stall recieved */
+#define T_STAL        0x00080000         /* Stall received */
 #define T_TO          0x00040000         /* time out */
 #define T_UN          0x00020000         /* underrun */
 
diff --git a/drivers/usb/gadget/fsl_udc_core.c b/drivers/usb/gadget/fsl_udc_core.c
index 08a9a62a39e3..4e4833168087 100644
--- a/drivers/usb/gadget/fsl_udc_core.c
+++ b/drivers/usb/gadget/fsl_udc_core.c
@@ -1,12 +1,13 @@
 /*
- * Copyright (C) 2004-2007 Freescale Semicondutor, Inc. All rights reserved.
+ * Copyright (C) 2004-2007,2011 Freescale Semiconductor, Inc.
+ * All rights reserved.
  *
  * Author: Li Yang <leoli@freescale.com>
  *         Jiang Bo <tanya.jiang@freescale.com>
  *
  * Description:
  * Freescale high-speed USB SOC DR module device controller driver.
- * This can be found on MPC8349E/MPC8313E cpus.
+ * This can be found on MPC8349E/MPC8313E/MPC5121E cpus.
  * The driver is previously named as mpc_udc.  Based on bare board
  * code from Dave Liu and Shlomi Gridish.
  *
@@ -77,12 +78,77 @@ fsl_ep0_desc = {
 static void fsl_ep_fifo_flush(struct usb_ep *_ep);
 
 #ifdef CONFIG_PPC32
-#define fsl_readl(addr)         in_le32(addr)
-#define fsl_writel(val32, addr) out_le32(addr, val32)
-#else
+/*
+ * On some SoCs, the USB controller registers can be big or little endian,
+ * depending on the version of the chip. In order to be able to run the
+ * same kernel binary on 2 different versions of an SoC, the BE/LE decision
+ * must be made at run time. _fsl_readl and fsl_writel are pointers to the
+ * BE or LE readl() and writel() functions, and fsl_readl() and fsl_writel()
+ * call through those pointers. Platform code for SoCs that have BE USB
+ * registers should set pdata->big_endian_mmio flag.
+ *
+ * This also applies to controller-to-cpu accessors for the USB descriptors,
+ * since their endianness is also SoC dependant. Platform code for SoCs that
+ * have BE USB descriptors should set pdata->big_endian_desc flag.
+ */
+static u32 _fsl_readl_be(const unsigned __iomem *p)
+{
+        return in_be32(p);
+}
+
+static u32 _fsl_readl_le(const unsigned __iomem *p)
+{
+        return in_le32(p);
+}
+
+static void _fsl_writel_be(u32 v, unsigned __iomem *p)
+{
+        out_be32(p, v);
+}
+
+static void _fsl_writel_le(u32 v, unsigned __iomem *p)
+{
+        out_le32(p, v);
+}
+
+static u32 (*_fsl_readl)(const unsigned __iomem *p);
+static void (*_fsl_writel)(u32 v, unsigned __iomem *p);
+
+#define fsl_readl(p)            (*_fsl_readl)((p))
+#define fsl_writel(v, p)        (*_fsl_writel)((v), (p))
+
+static inline void fsl_set_accessors(struct fsl_usb2_platform_data *pdata)
+{
+        if (pdata->big_endian_mmio) {
+                _fsl_readl = _fsl_readl_be;
+                _fsl_writel = _fsl_writel_be;
+        } else {
+                _fsl_readl = _fsl_readl_le;
+                _fsl_writel = _fsl_writel_le;
+        }
+}
+
+static inline u32 cpu_to_hc32(const u32 x)
+{
+        return udc_controller->pdata->big_endian_desc
+                ? (__force u32)cpu_to_be32(x)
+                : (__force u32)cpu_to_le32(x);
+}
+
+static inline u32 hc32_to_cpu(const u32 x)
+{
+        return udc_controller->pdata->big_endian_desc
+                ? be32_to_cpu((__force __be32)x)
+                : le32_to_cpu((__force __le32)x);
+}
+#else /* !CONFIG_PPC32 */
+static inline void fsl_set_accessors(struct fsl_usb2_platform_data *pdata) {}
+
 #define fsl_readl(addr)         readl(addr)
 #define fsl_writel(val32, addr) writel(val32, addr)
-#endif
+#define cpu_to_hc32(x)          cpu_to_le32(x)
+#define hc32_to_cpu(x)          le32_to_cpu(x)
+#endif /* CONFIG_PPC32 */
 
 /********************************************************************
  *      Internal Used Function
@@ -177,7 +243,8 @@ static void nuke(struct fsl_ep *ep, int status)
 
 static int dr_controller_setup(struct fsl_udc *udc)
 {
-        unsigned int tmp, portctrl;
+        unsigned int tmp, portctrl, ep_num;
+        unsigned int max_no_of_ep;
 #ifndef CONFIG_ARCH_MXC
         unsigned int ctrl;
 #endif
@@ -226,9 +293,12 @@ static int dr_controller_setup(struct fsl_udc *udc)
 
         /* Set the controller as device mode */
         tmp = fsl_readl(&dr_regs->usbmode);
+        tmp &= ~USB_MODE_CTRL_MODE_MASK;        /* clear mode bits */
         tmp |= USB_MODE_CTRL_MODE_DEVICE;
         /* Disable Setup Lockout */
         tmp |= USB_MODE_SETUP_LOCK_OFF;
+        if (udc->pdata->es)
+                tmp |= USB_MODE_ES;
         fsl_writel(tmp, &dr_regs->usbmode);
 
         /* Clear the setup status */
@@ -242,22 +312,34 @@ static int dr_controller_setup(struct fsl_udc *udc)
                 udc->ep_qh, (int)tmp,
                 fsl_readl(&dr_regs->endpointlistaddr));
 
+        max_no_of_ep = (0x0000001F & fsl_readl(&dr_regs->dccparams));
+        for (ep_num = 1; ep_num < max_no_of_ep; ep_num++) {
+                tmp = fsl_readl(&dr_regs->endptctrl[ep_num]);
+                tmp &= ~(EPCTRL_TX_TYPE | EPCTRL_RX_TYPE);
+                tmp |= (EPCTRL_EP_TYPE_BULK << EPCTRL_TX_EP_TYPE_SHIFT)
+                | (EPCTRL_EP_TYPE_BULK << EPCTRL_RX_EP_TYPE_SHIFT);
+                fsl_writel(tmp, &dr_regs->endptctrl[ep_num]);
+        }
         /* Config control enable i/o output, cpu endian register */
 #ifndef CONFIG_ARCH_MXC
-        ctrl = __raw_readl(&usb_sys_regs->control);
-        ctrl |= USB_CTRL_IOENB;
-        __raw_writel(ctrl, &usb_sys_regs->control);
+        if (udc->pdata->have_sysif_regs) {
+                ctrl = __raw_readl(&usb_sys_regs->control);
+                ctrl |= USB_CTRL_IOENB;
+                __raw_writel(ctrl, &usb_sys_regs->control);
+        }
 #endif
 
 #if defined(CONFIG_PPC32) && !defined(CONFIG_NOT_COHERENT_CACHE)
         /* Turn on cache snooping hardware, since some PowerPC platforms
          * wholly rely on hardware to deal with cache coherent. */
 
-        /* Setup Snooping for all the 4GB space */
-        tmp = SNOOP_SIZE_2GB;   /* starts from 0x0, size 2G */
-        __raw_writel(tmp, &usb_sys_regs->snoop1);
-        tmp |= 0x80000000;      /* starts from 0x8000000, size 2G */
-        __raw_writel(tmp, &usb_sys_regs->snoop2);
+        if (udc->pdata->have_sysif_regs) {
+                /* Setup Snooping for all the 4GB space */
+                tmp = SNOOP_SIZE_2GB;   /* starts from 0x0, size 2G */
+                __raw_writel(tmp, &usb_sys_regs->snoop1);
+                tmp |= 0x80000000;      /* starts from 0x8000000, size 2G */
+                __raw_writel(tmp, &usb_sys_regs->snoop2);
+        }
 #endif
 
         return 0;
@@ -287,14 +369,25 @@ static void dr_controller_run(struct fsl_udc *udc)
         temp = fsl_readl(&dr_regs->usbcmd);
         temp |= USB_CMD_RUN_STOP;
         fsl_writel(temp, &dr_regs->usbcmd);
-
-        return;
 }
 
 static void dr_controller_stop(struct fsl_udc *udc)
 {
         unsigned int tmp;
 
+        pr_debug("%s\n", __func__);
+
+        /* if we're in OTG mode, and the Host is currently using the port,
+         * stop now and don't rip the controller out from under the
+         * ehci driver
+         */
+        if (udc->gadget.is_otg) {
+                if (!(fsl_readl(&dr_regs->otgsc) & OTGSC_STS_USB_ID)) {
+                        pr_debug("udc: Leaving early\n");
+                        return;
+                }
+        }
+
         /* disable all INTR */
         fsl_writel(0, &dr_regs->usbintr);
 
@@ -308,8 +401,6 @@ static void dr_controller_stop(struct fsl_udc *udc)
         tmp = fsl_readl(&dr_regs->usbcmd);
         tmp &= ~USB_CMD_RUN_STOP;
         fsl_writel(tmp, &dr_regs->usbcmd);
-
-        return;
 }
 
 static void dr_ep_setup(unsigned char ep_num, unsigned char dir,
@@ -322,12 +413,14 @@ static void dr_ep_setup(unsigned char ep_num, unsigned char dir,
                 if (ep_num)
                         tmp_epctrl |= EPCTRL_TX_DATA_TOGGLE_RST;
                 tmp_epctrl |= EPCTRL_TX_ENABLE;
+                tmp_epctrl &= ~EPCTRL_TX_TYPE;
                 tmp_epctrl |= ((unsigned int)(ep_type)
                                 << EPCTRL_TX_EP_TYPE_SHIFT);
         } else {
                 if (ep_num)
                         tmp_epctrl |= EPCTRL_RX_DATA_TOGGLE_RST;
                 tmp_epctrl |= EPCTRL_RX_ENABLE;
+                tmp_epctrl &= ~EPCTRL_RX_TYPE;
                 tmp_epctrl |= ((unsigned int)(ep_type)
                                 << EPCTRL_RX_EP_TYPE_SHIFT);
         }
@@ -413,11 +506,9 @@ static void struct_ep_qh_setup(struct fsl_udc *udc, unsigned char ep_num,
         if (zlt)
                 tmp |= EP_QUEUE_HEAD_ZLT_SEL;
 
-        p_QH->max_pkt_length = cpu_to_le32(tmp);
+        p_QH->max_pkt_length = cpu_to_hc32(tmp);
         p_QH->next_dtd_ptr = 1;
         p_QH->size_ioc_int_sts = 0;
-
-        return;
 }
 
 /* Setup qh structure and ep register for ep0. */
@@ -470,7 +561,7 @@ static int fsl_ep_enable(struct usb_ep *_ep,
 
         max = le16_to_cpu(desc->wMaxPacketSize);
 
-        /* Disable automatic zlp generation.  Driver is reponsible to indicate
+        /* Disable automatic zlp generation.  Driver is responsible to indicate
          * explicitly through req->req.zero.  This is needed to enable multi-td
          * request. */
         zlt = 1;
@@ -552,10 +643,13 @@ static int fsl_ep_disable(struct usb_ep *_ep)
         /* disable ep on controller */
         ep_num = ep_index(ep);
         epctrl = fsl_readl(&dr_regs->endptctrl[ep_num]);
-        if (ep_is_in(ep))
-                epctrl &= ~EPCTRL_TX_ENABLE;
-        else
-                epctrl &= ~EPCTRL_RX_ENABLE;
+        if (ep_is_in(ep)) {
+                epctrl &= ~(EPCTRL_TX_ENABLE | EPCTRL_TX_TYPE);
+                epctrl |= EPCTRL_EP_TYPE_BULK << EPCTRL_TX_EP_TYPE_SHIFT;
+        } else {
+                epctrl &= ~(EPCTRL_RX_ENABLE | EPCTRL_TX_TYPE);
+                epctrl |= EPCTRL_EP_TYPE_BULK << EPCTRL_RX_EP_TYPE_SHIFT;
+        }
         fsl_writel(epctrl, &dr_regs->endptctrl[ep_num]);
 
         udc = (struct fsl_udc *)ep->udc;
@@ -622,7 +716,7 @@ static void fsl_queue_td(struct fsl_ep *ep, struct fsl_req *req)
                 struct fsl_req *lastreq;
                 lastreq = list_entry(ep->queue.prev, struct fsl_req, queue);
                 lastreq->tail->next_td_ptr =
-                        cpu_to_le32(req->head->td_dma & DTD_ADDR_MASK);
+                        cpu_to_hc32(req->head->td_dma & DTD_ADDR_MASK);
                 /* Read prime bit, if 1 goto done */
                 if (fsl_readl(&dr_regs->endpointprime) & bitmask)
                         goto out;
@@ -647,14 +741,14 @@ static void fsl_queue_td(struct fsl_ep *ep, struct fsl_req *req)
 
         /* Write dQH next pointer and terminate bit to 0 */
         temp = req->head->td_dma & EP_QUEUE_HEAD_NEXT_POINTER_MASK;
-        dQH->next_dtd_ptr = cpu_to_le32(temp);
+        dQH->next_dtd_ptr = cpu_to_hc32(temp);
 
         /* Clear active and halt bit */
-        temp = cpu_to_le32(~(EP_QUEUE_HEAD_STATUS_ACTIVE
+        temp = cpu_to_hc32(~(EP_QUEUE_HEAD_STATUS_ACTIVE
                         | EP_QUEUE_HEAD_STATUS_HALT));
         dQH->size_ioc_int_sts &= temp;
 
-        /* Ensure that updates to the QH will occure before priming. */
+        /* Ensure that updates to the QH will occur before priming. */
         wmb();
 
         /* Prime endpoint by writing 1 to ENDPTPRIME */
@@ -688,17 +782,17 @@ static struct ep_td_struct *fsl_build_dtd(struct fsl_req *req, unsigned *length,
 
         dtd->td_dma = *dma;
         /* Clear reserved field */
-        swap_temp = cpu_to_le32(dtd->size_ioc_sts);
+        swap_temp = hc32_to_cpu(dtd->size_ioc_sts);
         swap_temp &= ~DTD_RESERVED_FIELDS;
-        dtd->size_ioc_sts = cpu_to_le32(swap_temp);
+        dtd->size_ioc_sts = cpu_to_hc32(swap_temp);
 
         /* Init all of buffer page pointers */
         swap_temp = (u32) (req->req.dma + req->req.actual);
-        dtd->buff_ptr0 = cpu_to_le32(swap_temp);
-        dtd->buff_ptr1 = cpu_to_le32(swap_temp + 0x1000);
-        dtd->buff_ptr2 = cpu_to_le32(swap_temp + 0x2000);
-        dtd->buff_ptr3 = cpu_to_le32(swap_temp + 0x3000);
-        dtd->buff_ptr4 = cpu_to_le32(swap_temp + 0x4000);
+        dtd->buff_ptr0 = cpu_to_hc32(swap_temp);
+        dtd->buff_ptr1 = cpu_to_hc32(swap_temp + 0x1000);
+        dtd->buff_ptr2 = cpu_to_hc32(swap_temp + 0x2000);
+        dtd->buff_ptr3 = cpu_to_hc32(swap_temp + 0x3000);
+        dtd->buff_ptr4 = cpu_to_hc32(swap_temp + 0x4000);
 
         req->req.actual += *length;
 
@@ -722,7 +816,7 @@ static struct ep_td_struct *fsl_build_dtd(struct fsl_req *req, unsigned *length,
         if (*is_last && !req->req.no_interrupt)
                 swap_temp |= DTD_IOC;
 
-        dtd->size_ioc_sts = cpu_to_le32(swap_temp);
+        dtd->size_ioc_sts = cpu_to_hc32(swap_temp);
 
         mb();
 
@@ -749,7 +843,7 @@ static int fsl_req_to_dtd(struct fsl_req *req)
                         is_first = 0;
                         req->head = dtd;
                 } else {
-                        last_dtd->next_td_ptr = cpu_to_le32(dma);
+                        last_dtd->next_td_ptr = cpu_to_hc32(dma);
                         last_dtd->next_td_virt = dtd;
                 }
                 last_dtd = dtd;
@@ -757,7 +851,7 @@ static int fsl_req_to_dtd(struct fsl_req *req)
                 req->dtd_count++;
         } while (!is_last);
 
-        dtd->next_td_ptr = cpu_to_le32(DTD_NEXT_TERMINATE);
+        dtd->next_td_ptr = cpu_to_hc32(DTD_NEXT_TERMINATE);
 
         req->tail = dtd;
 
@@ -772,7 +866,6 @@ fsl_ep_queue(struct usb_ep *_ep, struct usb_request *_req, gfp_t gfp_flags)
         struct fsl_req *req = container_of(_req, struct fsl_req, req);
         struct fsl_udc *udc;
         unsigned long flags;
-        int is_iso = 0;
 
         /* catch various bogus parameters */
         if (!_req || !req->req.complete || !req->req.buf
@@ -787,7 +880,6 @@ fsl_ep_queue(struct usb_ep *_ep, struct usb_request *_req, gfp_t gfp_flags)
         if (ep->desc->bmAttributes == USB_ENDPOINT_XFER_ISOC) {
                 if (req->req.length > ep->ep.maxpacket)
                         return -EMSGSIZE;
-                is_iso = 1;
         }
 
         udc = ep->udc;
@@ -970,6 +1062,36 @@ out:
         return status;
 }
 
+static int fsl_ep_fifo_status(struct usb_ep *_ep)
+{
+        struct fsl_ep *ep;
+        struct fsl_udc *udc;
+        int size = 0;
+        u32 bitmask;
+        struct ep_queue_head *d_qh;
+
+        ep = container_of(_ep, struct fsl_ep, ep);
+        if (!_ep || (!ep->desc && ep_index(ep) != 0))
+                return -ENODEV;
+
+        udc = (struct fsl_udc *)ep->udc;
+
+        if (!udc->driver || udc->gadget.speed == USB_SPEED_UNKNOWN)
+                return -ESHUTDOWN;
+
+        d_qh = &ep->udc->ep_qh[ep_index(ep) * 2 + ep_is_in(ep)];
+
+        bitmask = (ep_is_in(ep)) ? (1 << (ep_index(ep) + 16)) :
+            (1 << (ep_index(ep)));
+
+        if (fsl_readl(&dr_regs->endptstatus) & bitmask)
+                size = (d_qh->size_ioc_int_sts & DTD_PACKET_SIZE)
+                    >> DTD_LENGTH_BIT_POS;
+
+        pr_debug("%s %u\n", __func__, size);
+        return size;
+}
+
 static void fsl_ep_fifo_flush(struct usb_ep *_ep)
 {
         struct fsl_ep *ep;
@@ -1022,6 +1144,7 @@ static struct usb_ep_ops fsl_ep_ops = {
         .dequeue = fsl_ep_dequeue,
 
         .set_halt = fsl_ep_set_halt,
+        .fifo_status = fsl_ep_fifo_status,
         .fifo_flush = fsl_ep_fifo_flush,        /* flush fifo */
 };
 
@@ -1166,6 +1289,11 @@ static int ep0_prime_status(struct fsl_udc *udc, int direction)
         req->req.complete = NULL;
         req->dtd_count = 0;
 
+        req->req.dma = dma_map_single(ep->udc->gadget.dev.parent,
+                        req->req.buf, req->req.length,
+                        ep_is_in(ep) ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+        req->mapped = 1;
+
         if (fsl_req_to_dtd(req) == 0)
                 fsl_queue_td(ep, req);
         else
@@ -1236,6 +1364,7 @@ static void ch9getstatus(struct fsl_udc *udc, u8 request_type, u16 value,
         req = udc->status_req;
         /* Fill in the reqest structure */
         *((u16 *) req->req.buf) = cpu_to_le16(tmp);
+
         req->ep = ep;
         req->req.length = 2;
         req->req.status = -EINPROGRESS;
@@ -1243,6 +1372,11 @@ static void ch9getstatus(struct fsl_udc *udc, u8 request_type, u16 value,
         req->req.complete = NULL;
         req->dtd_count = 0;
 
+        req->req.dma = dma_map_single(ep->udc->gadget.dev.parent,
+                                req->req.buf, req->req.length,
+                                ep_is_in(ep) ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+        req->mapped = 1;
+
         /* prime the data phase */
         if ((fsl_req_to_dtd(req) == 0))
                 fsl_queue_td(ep, req);
@@ -1288,6 +1422,7 @@ static void setup_received_irq(struct fsl_udc *udc,
                 /* Status phase from udc */
         {
                 int rc = -EOPNOTSUPP;
+                u16 ptc = 0;
 
                 if ((setup->bRequestType & (USB_RECIP_MASK | USB_TYPE_MASK))
                                 == (USB_RECIP_ENDPOINT | USB_TYPE_STANDARD)) {
@@ -1309,17 +1444,19 @@ static void setup_received_irq(struct fsl_udc *udc,
                                 | USB_TYPE_STANDARD)) {
                         /* Note: The driver has not include OTG support yet.
                          * This will be set when OTG support is added */
-                        if (!gadget_is_otg(&udc->gadget))
-                                break;
-                        else if (setup->bRequest == USB_DEVICE_B_HNP_ENABLE)
-                                udc->gadget.b_hnp_enable = 1;
-                        else if (setup->bRequest == USB_DEVICE_A_HNP_SUPPORT)
-                                udc->gadget.a_hnp_support = 1;
-                        else if (setup->bRequest ==
-                                        USB_DEVICE_A_ALT_HNP_SUPPORT)
-                                udc->gadget.a_alt_hnp_support = 1;
-                        else
-                                break;
+                        if (wValue == USB_DEVICE_TEST_MODE)
+                                ptc = wIndex >> 8;
+                        else if (gadget_is_otg(&udc->gadget)) {
+                                if (setup->bRequest ==
+                                    USB_DEVICE_B_HNP_ENABLE)
+                                        udc->gadget.b_hnp_enable = 1;
+                                else if (setup->bRequest ==
+                                         USB_DEVICE_A_HNP_SUPPORT)
+                                        udc->gadget.a_hnp_support = 1;
+                                else if (setup->bRequest ==
+                                         USB_DEVICE_A_ALT_HNP_SUPPORT)
+                                        udc->gadget.a_alt_hnp_support = 1;
+                        }
                         rc = 0;
                 } else
                         break;
@@ -1328,6 +1465,15 @@ static void setup_received_irq(struct fsl_udc *udc,
                         if (ep0_prime_status(udc, EP_DIR_IN))
                                 ep0stall(udc);
                 }
+                if (ptc) {
+                        u32 tmp;
+
+                        mdelay(10);
+                        tmp = fsl_readl(&dr_regs->portsc1) | (ptc << 16);
+                        fsl_writel(tmp, &dr_regs->portsc1);
+                        printk(KERN_INFO "udc: switch to test mode %d.\n", ptc);
+                }
+
                 return;
         }
 
@@ -1402,6 +1548,7 @@ static void tripwire_handler(struct fsl_udc *udc, u8 ep_num, u8 *buffer_ptr)
 {
         u32 temp;
         struct ep_queue_head *qh;
+        struct fsl_usb2_platform_data *pdata = udc->pdata;
 
         qh = &udc->ep_qh[ep_num * 2 + EP_DIR_OUT];
 
@@ -1416,7 +1563,16 @@ static void tripwire_handler(struct fsl_udc *udc, u8 ep_num, u8 *buffer_ptr)
                 fsl_writel(temp | USB_CMD_SUTW, &dr_regs->usbcmd);
 
                 /* Copy the setup packet to local buffer */
-                memcpy(buffer_ptr, (u8 *) qh->setup_buffer, 8);
+                if (pdata->le_setup_buf) {
+                        u32 *p = (u32 *)buffer_ptr;
+                        u32 *s = (u32 *)qh->setup_buffer;
+
+                        /* Convert little endian setup buffer to CPU endian */
+                        *p++ = le32_to_cpu(*s++);
+                        *p = le32_to_cpu(*s);
+                } else {
+                        memcpy(buffer_ptr, (u8 *) qh->setup_buffer, 8);
+                }
         } while (!(fsl_readl(&dr_regs->usbcmd) & USB_CMD_SUTW));
 
         /* Clear Setup Tripwire */
@@ -1440,19 +1596,19 @@ static int process_ep_req(struct fsl_udc *udc, int pipe,
         actual = curr_req->req.length;
 
         for (j = 0; j < curr_req->dtd_count; j++) {
-                remaining_length = (le32_to_cpu(curr_td->size_ioc_sts)
+                remaining_length = (hc32_to_cpu(curr_td->size_ioc_sts)
                                         & DTD_PACKET_SIZE)
                                 >> DTD_LENGTH_BIT_POS;
                 actual -= remaining_length;
 
-                if ((errors = le32_to_cpu(curr_td->size_ioc_sts) &
-                                                DTD_ERROR_MASK)) {
+                errors = hc32_to_cpu(curr_td->size_ioc_sts);
+                if (errors & DTD_ERROR_MASK) {
                         if (errors & DTD_STATUS_HALTED) {
                                 ERR("dTD error %08x QH=%d\n", errors, pipe);
                                 /* Clear the errors and Halt condition */
-                                tmp = le32_to_cpu(curr_qh->size_ioc_int_sts);
+                                tmp = hc32_to_cpu(curr_qh->size_ioc_int_sts);
                                 tmp &= ~errors;
-                                curr_qh->size_ioc_int_sts = cpu_to_le32(tmp);
+                                curr_qh->size_ioc_int_sts = cpu_to_hc32(tmp);
                                 status = -EPIPE;
                                 /* FIXME: continue with next queued TD? */
 
@@ -1467,10 +1623,10 @@ static int process_ep_req(struct fsl_udc *udc, int pipe,
                                 status = -EILSEQ;
                                 break;
                         } else
-                                ERR("Unknown error has occured (0x%x)!\n",
+                                ERR("Unknown error has occurred (0x%x)!\n",
                                         errors);
 
-                } else if (le32_to_cpu(curr_td->size_ioc_sts)
+                } else if (hc32_to_cpu(curr_td->size_ioc_sts)
                                 & DTD_STATUS_ACTIVE) {
                         VDBG("Request not complete");
                         status = REQ_UNCOMPLETE;
@@ -1559,6 +1715,9 @@ static void port_change_irq(struct fsl_udc *udc)
 {
         u32 speed;
 
+        if (udc->bus_reset)
+                udc->bus_reset = 0;
+
         /* Bus resetting is finished */
         if (!(fsl_readl(&dr_regs->portsc1) & PORTSCX_PORT_RESET)) {
                 /* Get the speed */
@@ -1666,6 +1825,8 @@ static void reset_irq(struct fsl_udc *udc)
 
         if (fsl_readl(&dr_regs->portsc1) & PORTSCX_PORT_RESET) {
                 VDBG("Bus reset");
+                /* Bus is reseting */
+                udc->bus_reset = 1;
                 /* Reset all the queues, include XD, dTD, EP queue
                  * head and TR Queue */
                 reset_queues(udc);
@@ -1743,6 +1904,7 @@ static irqreturn_t fsl_udc_irq(int irq, void *_udc)
 
         /* Reset Received */
         if (irq_src & USB_STS_RESET) {
+                VDBG("reset int");
                 reset_irq(udc);
                 status = IRQ_HANDLED;
         }
@@ -1765,7 +1927,8 @@ static irqreturn_t fsl_udc_irq(int irq, void *_udc)
  * Hook to gadget drivers
  * Called by initialization code of gadget drivers
 *----------------------------------------------------------------*/
-int usb_gadget_register_driver(struct usb_gadget_driver *driver)
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
 {
         int retval = -ENODEV;
         unsigned long flags = 0;
@@ -1775,8 +1938,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
 
         if (!driver || (driver->speed != USB_SPEED_FULL
                                 && driver->speed != USB_SPEED_HIGH)
-                        || !driver->bind || !driver->disconnect
-                        || !driver->setup)
+                        || !bind || !driver->disconnect || !driver->setup)
                 return -EINVAL;
 
         if (udc_controller->driver)
@@ -1792,7 +1954,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
         spin_unlock_irqrestore(&udc_controller->lock, flags);
 
         /* bind udc driver to gadget driver */
-        retval = driver->bind(&udc_controller->gadget);
+        retval = bind(&udc_controller->gadget);
         if (retval) {
                 VDBG("bind to %s --> %d", driver->driver.name, retval);
                 udc_controller->gadget.dev.driver = NULL;
@@ -1800,11 +1962,30 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
                 goto out;
         }
 
-        /* Enable DR IRQ reg and Set usbcmd reg  Run bit */
-        dr_controller_run(udc_controller);
-        udc_controller->usb_state = USB_STATE_ATTACHED;
-        udc_controller->ep0_state = WAIT_FOR_SETUP;
-        udc_controller->ep0_dir = 0;
+        if (udc_controller->transceiver) {
+                /* Suspend the controller until OTG enable it */
+                udc_controller->stopped = 1;
+                printk(KERN_INFO "Suspend udc for OTG auto detect\n");
+
+                /* connect to bus through transceiver */
+                if (udc_controller->transceiver) {
+                        retval = otg_set_peripheral(udc_controller->transceiver,
+                                                    &udc_controller->gadget);
+                        if (retval < 0) {
+                                ERR("can't bind to transceiver\n");
+                                driver->unbind(&udc_controller->gadget);
+                                udc_controller->gadget.dev.driver = 0;
+                                udc_controller->driver = 0;
+                                return retval;
+                        }
+                }
+        } else {
+                /* Enable DR IRQ reg and set USBCMD reg Run bit */
+                dr_controller_run(udc_controller);
+                udc_controller->usb_state = USB_STATE_ATTACHED;
+                udc_controller->ep0_state = WAIT_FOR_SETUP;
+                udc_controller->ep0_dir = 0;
+        }
         printk(KERN_INFO "%s: bind to driver %s\n",
                         udc_controller->gadget.name, driver->driver.name);
 
@@ -1814,7 +1995,7 @@ out:
                        retval);
         return retval;
 }
-EXPORT_SYMBOL(usb_gadget_register_driver);
+EXPORT_SYMBOL(usb_gadget_probe_driver);
 
 /* Disconnect from gadget driver */
 int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
@@ -2052,16 +2233,18 @@ static int fsl_proc_read(char *page, char **start, off_t off, int count,
         next += t;
 
 #ifndef CONFIG_ARCH_MXC
-        tmp_reg = usb_sys_regs->snoop1;
-        t = scnprintf(next, size, "Snoop1 Reg : = [0x%x]\n\n", tmp_reg);
-        size -= t;
-        next += t;
+        if (udc->pdata->have_sysif_regs) {
+                tmp_reg = usb_sys_regs->snoop1;
+                t = scnprintf(next, size, "Snoop1 Reg : = [0x%x]\n\n", tmp_reg);
+                size -= t;
+                next += t;
 
-        tmp_reg = usb_sys_regs->control;
-        t = scnprintf(next, size, "General Control Reg : = [0x%x]\n\n",
-                        tmp_reg);
-        size -= t;
-        next += t;
+                tmp_reg = usb_sys_regs->control;
+                t = scnprintf(next, size, "General Control Reg : = [0x%x]\n\n",
+                                tmp_reg);
+                size -= t;
+                next += t;
+        }
 #endif
 
         /* ------fsl_udc, fsl_ep, fsl_request structure information ----- */
@@ -2190,7 +2373,6 @@ static int __init struct_udc_setup(struct fsl_udc *udc,
                         struct fsl_req, req);
         /* allocate a small amount of memory to get valid address */
         udc->status_req->req.buf = kmalloc(8, GFP_KERNEL);
-        udc->status_req->req.dma = virt_to_phys(udc->status_req->req.buf);
 
         udc->resume_state = USB_STATE_NOTATTACHED;
         udc->usb_state = USB_STATE_POWERED;
@@ -2241,6 +2423,7 @@ static int __init struct_ep_setup(struct fsl_udc *udc, unsigned char index,
  */
 static int __init fsl_udc_probe(struct platform_device *pdev)
 {
+        struct fsl_usb2_platform_data *pdata;
         struct resource *res;
         int ret = -ENODEV;
         unsigned int i;
@@ -2257,20 +2440,35 @@ static int __init fsl_udc_probe(struct platform_device *pdev)
                 return -ENOMEM;
         }
 
+        pdata = pdev->dev.platform_data;
+        udc_controller->pdata = pdata;
         spin_lock_init(&udc_controller->lock);
         udc_controller->stopped = 1;
 
+#ifdef CONFIG_USB_OTG
+        if (pdata->operating_mode == FSL_USB2_DR_OTG) {
+                udc_controller->transceiver = otg_get_transceiver();
+                if (!udc_controller->transceiver) {
+                        ERR("Can't find OTG driver!\n");
+                        ret = -ENODEV;
+                        goto err_kfree;
+                }
+        }
+#endif
+
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (!res) {
                 ret = -ENXIO;
                 goto err_kfree;
         }
 
-        if (!request_mem_region(res->start, res->end - res->start + 1,
-                                driver_name)) {
-                ERR("request mem region for %s failed\n", pdev->name);
-                ret = -EBUSY;
-                goto err_kfree;
+        if (pdata->operating_mode == FSL_USB2_DR_DEVICE) {
+                if (!request_mem_region(res->start, res->end - res->start + 1,
+                                        driver_name)) {
+                        ERR("request mem region for %s failed\n", pdev->name);
+                        ret = -EBUSY;
+                        goto err_kfree;
+                }
         }
 
         dr_regs = ioremap(res->start, resource_size(res));
@@ -2279,9 +2477,23 @@ static int __init fsl_udc_probe(struct platform_device *pdev)
                 goto err_release_mem_region;
         }
 
+        pdata->regs = (void *)dr_regs;
+
+        /*
+         * do platform specific init: check the clock, grab/config pins, etc.
+         */
+        if (pdata->init && pdata->init(pdev)) {
+                ret = -ENODEV;
+                goto err_iounmap_noclk;
+        }
+
+        /* Set accessors only after pdata->init() ! */
+        fsl_set_accessors(pdata);
+
 #ifndef CONFIG_ARCH_MXC
-        usb_sys_regs = (struct usb_sys_interface *)
-                        ((u32)dr_regs + USB_DR_SYS_OFFSET);
+        if (pdata->have_sysif_regs)
+                usb_sys_regs = (struct usb_sys_interface *)
+                                ((u32)dr_regs + USB_DR_SYS_OFFSET);
 #endif
 
         /* Initialize USB clocks */
@@ -2321,9 +2533,11 @@ static int __init fsl_udc_probe(struct platform_device *pdev)
                 goto err_free_irq;
         }
 
-        /* initialize usb hw reg except for regs for EP,
-         * leave usbintr reg untouched */
-        dr_controller_setup(udc_controller);
+        if (!udc_controller->transceiver) {
+                /* initialize usb hw reg except for regs for EP,
+                 * leave usbintr reg untouched */
+                dr_controller_setup(udc_controller);
+        }
 
         fsl_udc_clk_finalize(pdev);
 
@@ -2343,6 +2557,9 @@ static int __init fsl_udc_probe(struct platform_device *pdev)
         if (ret < 0)
                 goto err_free_irq;
 
+        if (udc_controller->transceiver)
+                udc_controller->gadget.is_otg = 1;
+
         /* setup QH and epctrl for ep0 */
         ep0_setup(udc_controller);
 
@@ -2381,11 +2598,14 @@ err_unregister:
 err_free_irq:
         free_irq(udc_controller->irq, udc_controller);
 err_iounmap:
+        if (pdata->exit)
+                pdata->exit(pdev);
         fsl_udc_clk_release();
 err_iounmap_noclk:
         iounmap(dr_regs);
 err_release_mem_region:
-        release_mem_region(res->start, res->end - res->start + 1);
+        if (pdata->operating_mode == FSL_USB2_DR_DEVICE)
+                release_mem_region(res->start, res->end - res->start + 1);
 err_kfree:
         kfree(udc_controller);
         udc_controller = NULL;
@@ -2398,6 +2618,7 @@ err_kfree:
 static int __exit fsl_udc_remove(struct platform_device *pdev)
 {
         struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        struct fsl_usb2_platform_data *pdata = pdev->dev.platform_data;
 
         DECLARE_COMPLETION(done);
 
@@ -2418,12 +2639,20 @@ static int __exit fsl_udc_remove(struct platform_device *pdev)
         dma_pool_destroy(udc_controller->td_pool);
         free_irq(udc_controller->irq, udc_controller);
         iounmap(dr_regs);
-        release_mem_region(res->start, res->end - res->start + 1);
+        if (pdata->operating_mode == FSL_USB2_DR_DEVICE)
+                release_mem_region(res->start, res->end - res->start + 1);
 
         device_unregister(&udc_controller->gadget.dev);
         /* free udc --wait for the release() finished */
         wait_for_completion(&done);
 
+        /*
+         * do platform specific un-initialization:
+         * release iomux pins, etc.
+         */
+        if (pdata->exit)
+                pdata->exit(pdev);
+
         return 0;
 }
 
@@ -2454,6 +2683,62 @@ static int fsl_udc_resume(struct platform_device *pdev)
         return 0;
 }
 
+static int fsl_udc_otg_suspend(struct device *dev, pm_message_t state)
+{
+        struct fsl_udc *udc = udc_controller;
+        u32 mode, usbcmd;
+
+        mode = fsl_readl(&dr_regs->usbmode) & USB_MODE_CTRL_MODE_MASK;
+
+        pr_debug("%s(): mode 0x%x stopped %d\n", __func__, mode, udc->stopped);
+
+        /*
+         * If the controller is already stopped, then this must be a
+         * PM suspend.  Remember this fact, so that we will leave the
+         * controller stopped at PM resume time.
+         */
+        if (udc->stopped) {
+                pr_debug("gadget already stopped, leaving early\n");
+                udc->already_stopped = 1;
+                return 0;
+        }
+
+        if (mode != USB_MODE_CTRL_MODE_DEVICE) {
+                pr_debug("gadget not in device mode, leaving early\n");
+                return 0;
+        }
+
+        /* stop the controller */
+        usbcmd = fsl_readl(&dr_regs->usbcmd) & ~USB_CMD_RUN_STOP;
+        fsl_writel(usbcmd, &dr_regs->usbcmd);
+
+        udc->stopped = 1;
+
+        pr_info("USB Gadget suspended\n");
+
+        return 0;
+}
+
+static int fsl_udc_otg_resume(struct device *dev)
+{
+        pr_debug("%s(): stopped %d  already_stopped %d\n", __func__,
+                 udc_controller->stopped, udc_controller->already_stopped);
+
+        /*
+         * If the controller was stopped at suspend time, then
+         * don't resume it now.
+         */
+        if (udc_controller->already_stopped) {
+                udc_controller->already_stopped = 0;
+                pr_debug("gadget was already stopped, leaving early\n");
+                return 0;
+        }
+
+        pr_info("USB Gadget resume\n");
+
+        return fsl_udc_resume(NULL);
+}
+
 /*-------------------------------------------------------------------------
         Register entry point for the peripheral controller driver
 --------------------------------------------------------------------------*/
@@ -2466,6 +2751,9 @@ static struct platform_driver udc_driver = {
         .driver  = {
                 .name = (char *)driver_name,
                 .owner = THIS_MODULE,
+                /* udc suspend/resume called from OTG driver */
+                .suspend = fsl_udc_otg_suspend,
+                .resume  = fsl_udc_otg_resume,
         },
 };
 
diff --git a/drivers/usb/gadget/fsl_usb2_udc.h b/drivers/usb/gadget/fsl_usb2_udc.h
index 20aeceed48c7..1d51be83fda8 100644
--- a/drivers/usb/gadget/fsl_usb2_udc.h
+++ b/drivers/usb/gadget/fsl_usb2_udc.h
@@ -15,7 +15,7 @@ struct usb_dr_device {
         u8 res1[256];
         u16 caplength;          /* Capability Register Length */
         u16 hciversion;         /* Host Controller Interface Version */
-        u32 hcsparams;          /* Host Controller Structual Parameters */
+        u32 hcsparams;          /* Host Controller Structural Parameters */
         u32 hccparams;          /* Host Controller Capability Parameters */
         u8 res2[20];
         u32 dciversion;         /* Device Controller Interface Version */
@@ -52,7 +52,7 @@ struct usb_dr_host {
         u8 res1[256];
         u16 caplength;          /* Capability Register Length */
         u16 hciversion;         /* Host Controller Interface Version */
-        u32 hcsparams;          /* Host Controller Structual Parameters */
+        u32 hcsparams;          /* Host Controller Structural Parameters */
         u32 hccparams;          /* Host Controller Capability Parameters */
         u8 res2[20];
         u32 dciversion;         /* Device Controller Interface Version */
@@ -275,7 +275,9 @@ struct usb_sys_interface {
 #define  USB_MODE_CTRL_MODE_IDLE              0x00000000
 #define  USB_MODE_CTRL_MODE_DEVICE            0x00000002
 #define  USB_MODE_CTRL_MODE_HOST              0x00000003
+#define  USB_MODE_CTRL_MODE_MASK              0x00000003
 #define  USB_MODE_CTRL_MODE_RSV               0x00000001
+#define  USB_MODE_ES                          0x00000004 /* Endian Select */
 #define  USB_MODE_SETUP_LOCK_OFF              0x00000008
 #define  USB_MODE_STREAM_DISABLE              0x00000010
 /* Endpoint Flush Register */
@@ -461,6 +463,7 @@ struct fsl_ep {
 struct fsl_udc {
         struct usb_gadget gadget;
         struct usb_gadget_driver *driver;
+        struct fsl_usb2_platform_data *pdata;
         struct completion *done;        /* to make sure release() is done */
         struct fsl_ep *eps;
         unsigned int max_ep;
@@ -473,6 +476,8 @@ struct fsl_udc {
         unsigned vbus_active:1;
         unsigned stopped:1;
         unsigned remote_wakeup:1;
+        unsigned already_stopped:1;
+        unsigned big_endian_desc:1;
 
         struct ep_queue_head *ep_qh;    /* Endpoints Queue-Head */
         struct fsl_req *status_req;     /* ep0 status request */
@@ -483,6 +488,7 @@ struct fsl_udc {
         dma_addr_t ep_qh_dma;           /* dma address of QH */
 
         u32 max_pipes;          /* Device max pipes */
+        u32 bus_reset;          /* Device is bus resetting */
         u32 resume_state;       /* USB state to resume */
         u32 usb_state;          /* USB current state */
         u32 ep0_state;          /* Endpoint zero state */
diff --git a/drivers/usb/gadget/fusb300_udc.c b/drivers/usb/gadget/fusb300_udc.c
new file mode 100644
index 000000000000..763d462454b9
--- /dev/null
+++ b/drivers/usb/gadget/fusb300_udc.c
@@ -0,0 +1,1744 @@
+/*
+ * Fusb300 UDC (USB gadget)
+ *
+ * Copyright (C) 2010 Faraday Technology Corp.
+ *
+ * Author : Yuan-hsin Chen <yhchen@faraday-tech.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+#include <linux/dma-mapping.h>
+#include <linux/err.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/platform_device.h>
+#include <linux/usb/ch9.h>
+#include <linux/usb/gadget.h>
+
+#include "fusb300_udc.h"
+
+MODULE_DESCRIPTION("FUSB300  USB gadget driver");
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Yuan Hsin Chen <yhchen@faraday-tech.com>");
+MODULE_ALIAS("platform:fusb300_udc");
+
+#define DRIVER_VERSION  "20 October 2010"
+
+static const char udc_name[] = "fusb300_udc";
+static const char * const fusb300_ep_name[] = {
+        "ep0", "ep1", "ep2", "ep3", "ep4", "ep5", "ep6", "ep7", "ep8", "ep9",
+        "ep10", "ep11", "ep12", "ep13", "ep14", "ep15"
+};
+
+static void done(struct fusb300_ep *ep, struct fusb300_request *req,
+                 int status);
+
+static void fusb300_enable_bit(struct fusb300 *fusb300, u32 offset,
+                               u32 value)
+{
+        u32 reg = ioread32(fusb300->reg + offset);
+
+        reg |= value;
+        iowrite32(reg, fusb300->reg + offset);
+}
+
+static void fusb300_disable_bit(struct fusb300 *fusb300, u32 offset,
+                                u32 value)
+{
+        u32 reg = ioread32(fusb300->reg + offset);
+
+        reg &= ~value;
+        iowrite32(reg, fusb300->reg + offset);
+}
+
+
+static void fusb300_ep_setting(struct fusb300_ep *ep,
+                               struct fusb300_ep_info info)
+{
+        ep->epnum = info.epnum;
+        ep->type = info.type;
+}
+
+static int fusb300_ep_release(struct fusb300_ep *ep)
+{
+        if (!ep->epnum)
+                return 0;
+        ep->epnum = 0;
+        ep->stall = 0;
+        ep->wedged = 0;
+        return 0;
+}
+
+static void fusb300_set_fifo_entry(struct fusb300 *fusb300,
+                                   u32 ep)
+{
+        u32 val = ioread32(fusb300->reg + FUSB300_OFFSET_EPSET1(ep));
+
+        val &= ~FUSB300_EPSET1_FIFOENTRY_MSK;
+        val |= FUSB300_EPSET1_FIFOENTRY(FUSB300_FIFO_ENTRY_NUM);
+        iowrite32(val, fusb300->reg + FUSB300_OFFSET_EPSET1(ep));
+}
+
+static void fusb300_set_start_entry(struct fusb300 *fusb300,
+                                    u8 ep)
+{
+        u32 reg = ioread32(fusb300->reg + FUSB300_OFFSET_EPSET1(ep));
+        u32 start_entry = fusb300->fifo_entry_num * FUSB300_FIFO_ENTRY_NUM;
+
+        reg &= ~FUSB300_EPSET1_START_ENTRY_MSK  ;
+        reg |= FUSB300_EPSET1_START_ENTRY(start_entry);
+        iowrite32(reg, fusb300->reg + FUSB300_OFFSET_EPSET1(ep));
+        if (fusb300->fifo_entry_num == FUSB300_MAX_FIFO_ENTRY) {
+                fusb300->fifo_entry_num = 0;
+                fusb300->addrofs = 0;
+                pr_err("fifo entry is over the maximum number!\n");
+        } else
+                fusb300->fifo_entry_num++;
+}
+
+/* set fusb300_set_start_entry first before fusb300_set_epaddrofs */
+static void fusb300_set_epaddrofs(struct fusb300 *fusb300,
+                                  struct fusb300_ep_info info)
+{
+        u32 reg = ioread32(fusb300->reg + FUSB300_OFFSET_EPSET2(info.epnum));
+
+        reg &= ~FUSB300_EPSET2_ADDROFS_MSK;
+        reg |= FUSB300_EPSET2_ADDROFS(fusb300->addrofs);
+        iowrite32(reg, fusb300->reg + FUSB300_OFFSET_EPSET2(info.epnum));
+        fusb300->addrofs += (info.maxpacket + 7) / 8 * FUSB300_FIFO_ENTRY_NUM;
+}
+
+static void ep_fifo_setting(struct fusb300 *fusb300,
+                            struct fusb300_ep_info info)
+{
+        fusb300_set_fifo_entry(fusb300, info.epnum);
+        fusb300_set_start_entry(fusb300, info.epnum);
+        fusb300_set_epaddrofs(fusb300, info);
+}
+
+static void fusb300_set_eptype(struct fusb300 *fusb300,
+                               struct fusb300_ep_info info)
+{
+        u32 reg = ioread32(fusb300->reg + FUSB300_OFFSET_EPSET1(info.epnum));
+
+        reg &= ~FUSB300_EPSET1_TYPE_MSK;
+        reg |= FUSB300_EPSET1_TYPE(info.type);
+        iowrite32(reg, fusb300->reg + FUSB300_OFFSET_EPSET1(info.epnum));
+}
+
+static void fusb300_set_epdir(struct fusb300 *fusb300,
+                              struct fusb300_ep_info info)
+{
+        u32 reg;
+
+        if (!info.dir_in)
+                return;
+        reg = ioread32(fusb300->reg + FUSB300_OFFSET_EPSET1(info.epnum));
+        reg &= ~FUSB300_EPSET1_DIR_MSK;
+        reg |= FUSB300_EPSET1_DIRIN;
+        iowrite32(reg, fusb300->reg + FUSB300_OFFSET_EPSET1(info.epnum));
+}
+
+static void fusb300_set_ep_active(struct fusb300 *fusb300,
+                          u8 ep)
+{
+        u32 reg = ioread32(fusb300->reg + FUSB300_OFFSET_EPSET1(ep));
+
+        reg |= FUSB300_EPSET1_ACTEN;
+        iowrite32(reg, fusb300->reg + FUSB300_OFFSET_EPSET1(ep));
+}
+
+static void fusb300_set_epmps(struct fusb300 *fusb300,
+                              struct fusb300_ep_info info)
+{
+        u32 reg = ioread32(fusb300->reg + FUSB300_OFFSET_EPSET2(info.epnum));
+
+        reg &= ~FUSB300_EPSET2_MPS_MSK;
+        reg |= FUSB300_EPSET2_MPS(info.maxpacket);
+        iowrite32(reg, fusb300->reg + FUSB300_OFFSET_EPSET2(info.epnum));
+}
+
+static void fusb300_set_interval(struct fusb300 *fusb300,
+                                 struct fusb300_ep_info info)
+{
+        u32 reg = ioread32(fusb300->reg + FUSB300_OFFSET_EPSET1(info.epnum));
+
+        reg &= ~FUSB300_EPSET1_INTERVAL(0x7);
+        reg |= FUSB300_EPSET1_INTERVAL(info.interval);
+        iowrite32(reg, fusb300->reg + FUSB300_OFFSET_EPSET1(info.epnum));
+}
+
+static void fusb300_set_bwnum(struct fusb300 *fusb300,
+                              struct fusb300_ep_info info)
+{
+        u32 reg = ioread32(fusb300->reg + FUSB300_OFFSET_EPSET1(info.epnum));
+
+        reg &= ~FUSB300_EPSET1_BWNUM(0x3);
+        reg |= FUSB300_EPSET1_BWNUM(info.bw_num);
+        iowrite32(reg, fusb300->reg + FUSB300_OFFSET_EPSET1(info.epnum));
+}
+
+static void set_ep_reg(struct fusb300 *fusb300,
+                      struct fusb300_ep_info info)
+{
+        fusb300_set_eptype(fusb300, info);
+        fusb300_set_epdir(fusb300, info);
+        fusb300_set_epmps(fusb300, info);
+
+        if (info.interval)
+                fusb300_set_interval(fusb300, info);
+
+        if (info.bw_num)
+                fusb300_set_bwnum(fusb300, info);
+
+        fusb300_set_ep_active(fusb300, info.epnum);
+}
+
+static int config_ep(struct fusb300_ep *ep,
+                     const struct usb_endpoint_descriptor *desc)
+{
+        struct fusb300 *fusb300 = ep->fusb300;
+        struct fusb300_ep_info info;
+
+        ep->desc = desc;
+
+        info.interval = 0;
+        info.addrofs = 0;
+        info.bw_num = 0;
+
+        info.type = desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK;
+        info.dir_in = (desc->bEndpointAddress & USB_ENDPOINT_DIR_MASK) ? 1 : 0;
+        info.maxpacket = le16_to_cpu(desc->wMaxPacketSize);
+        info.epnum = desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
+
+        if ((info.type == USB_ENDPOINT_XFER_INT) ||
+           (info.type == USB_ENDPOINT_XFER_ISOC)) {
+                info.interval = desc->bInterval;
+                if (info.type == USB_ENDPOINT_XFER_ISOC)
+                        info.bw_num = ((desc->wMaxPacketSize & 0x1800) >> 11);
+        }
+
+        ep_fifo_setting(fusb300, info);
+
+        set_ep_reg(fusb300, info);
+
+        fusb300_ep_setting(ep, info);
+
+        fusb300->ep[info.epnum] = ep;
+
+        return 0;
+}
+
+static int fusb300_enable(struct usb_ep *_ep,
+                          const struct usb_endpoint_descriptor *desc)
+{
+        struct fusb300_ep *ep;
+
+        ep = container_of(_ep, struct fusb300_ep, ep);
+
+        if (ep->fusb300->reenum) {
+                ep->fusb300->fifo_entry_num = 0;
+                ep->fusb300->addrofs = 0;
+                ep->fusb300->reenum = 0;
+        }
+
+        return config_ep(ep, desc);
+}
+
+static int fusb300_disable(struct usb_ep *_ep)
+{
+        struct fusb300_ep *ep;
+        struct fusb300_request *req;
+        unsigned long flags;
+
+        ep = container_of(_ep, struct fusb300_ep, ep);
+
+        BUG_ON(!ep);
+
+        while (!list_empty(&ep->queue)) {
+                req = list_entry(ep->queue.next, struct fusb300_request, queue);
+                spin_lock_irqsave(&ep->fusb300->lock, flags);
+                done(ep, req, -ECONNRESET);
+                spin_unlock_irqrestore(&ep->fusb300->lock, flags);
+        }
+
+        return fusb300_ep_release(ep);
+}
+
+static struct usb_request *fusb300_alloc_request(struct usb_ep *_ep,
+                                                gfp_t gfp_flags)
+{
+        struct fusb300_request *req;
+
+        req = kzalloc(sizeof(struct fusb300_request), gfp_flags);
+        if (!req)
+                return NULL;
+        INIT_LIST_HEAD(&req->queue);
+
+        return &req->req;
+}
+
+static void fusb300_free_request(struct usb_ep *_ep, struct usb_request *_req)
+{
+        struct fusb300_request *req;
+
+        req = container_of(_req, struct fusb300_request, req);
+        kfree(req);
+}
+
+static int enable_fifo_int(struct fusb300_ep *ep)
+{
+        struct fusb300 *fusb300 = ep->fusb300;
+
+        if (ep->epnum) {
+                fusb300_enable_bit(fusb300, FUSB300_OFFSET_IGER0,
+                        FUSB300_IGER0_EEPn_FIFO_INT(ep->epnum));
+        } else {
+                pr_err("can't enable_fifo_int ep0\n");
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int disable_fifo_int(struct fusb300_ep *ep)
+{
+        struct fusb300 *fusb300 = ep->fusb300;
+
+        if (ep->epnum) {
+                fusb300_disable_bit(fusb300, FUSB300_OFFSET_IGER0,
+                        FUSB300_IGER0_EEPn_FIFO_INT(ep->epnum));
+        } else {
+                pr_err("can't disable_fifo_int ep0\n");
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static void fusb300_set_cxlen(struct fusb300 *fusb300, u32 length)
+{
+        u32 reg;
+
+        reg = ioread32(fusb300->reg + FUSB300_OFFSET_CSR);
+        reg &= ~FUSB300_CSR_LEN_MSK;
+        reg |= FUSB300_CSR_LEN(length);
+        iowrite32(reg, fusb300->reg + FUSB300_OFFSET_CSR);
+}
+
+/* write data to cx fifo */
+static void fusb300_wrcxf(struct fusb300_ep *ep,
+                   struct fusb300_request *req)
+{
+        int i = 0;
+        u8 *tmp;
+        u32 data;
+        struct fusb300 *fusb300 = ep->fusb300;
+        u32 length = req->req.length - req->req.actual;
+
+        tmp = req->req.buf + req->req.actual;
+
+        if (length > SS_CTL_MAX_PACKET_SIZE) {
+                fusb300_set_cxlen(fusb300, SS_CTL_MAX_PACKET_SIZE);
+                for (i = (SS_CTL_MAX_PACKET_SIZE >> 2); i > 0; i--) {
+                        data = *tmp | *(tmp + 1) << 8 | *(tmp + 2) << 16 |
+                                *(tmp + 3) << 24;
+                        iowrite32(data, fusb300->reg + FUSB300_OFFSET_CXPORT);
+                        tmp += 4;
+                }
+                req->req.actual += SS_CTL_MAX_PACKET_SIZE;
+        } else { /* length is less than max packet size */
+                fusb300_set_cxlen(fusb300, length);
+                for (i = length >> 2; i > 0; i--) {
+                        data = *tmp | *(tmp + 1) << 8 | *(tmp + 2) << 16 |
+                                *(tmp + 3) << 24;
+                        printk(KERN_DEBUG "    0x%x\n", data);
+                        iowrite32(data, fusb300->reg + FUSB300_OFFSET_CXPORT);
+                        tmp = tmp + 4;
+                }
+                switch (length % 4) {
+                case 1:
+                        data = *tmp;
+                        printk(KERN_DEBUG "    0x%x\n", data);
+                        iowrite32(data, fusb300->reg + FUSB300_OFFSET_CXPORT);
+                        break;
+                case 2:
+                        data = *tmp | *(tmp + 1) << 8;
+                        printk(KERN_DEBUG "    0x%x\n", data);
+                        iowrite32(data, fusb300->reg + FUSB300_OFFSET_CXPORT);
+                        break;
+                case 3:
+                        data = *tmp | *(tmp + 1) << 8 | *(tmp + 2) << 16;
+                        printk(KERN_DEBUG "    0x%x\n", data);
+                        iowrite32(data, fusb300->reg + FUSB300_OFFSET_CXPORT);
+                        break;
+                default:
+                        break;
+                }
+                req->req.actual += length;
+        }
+}
+
+static void fusb300_set_epnstall(struct fusb300 *fusb300, u8 ep)
+{
+        fusb300_enable_bit(fusb300, FUSB300_OFFSET_EPSET0(ep),
+                FUSB300_EPSET0_STL);
+}
+
+static void fusb300_clear_epnstall(struct fusb300 *fusb300, u8 ep)
+{
+        u32 reg = ioread32(fusb300->reg + FUSB300_OFFSET_EPSET0(ep));
+
+        if (reg & FUSB300_EPSET0_STL) {
+                printk(KERN_DEBUG "EP%d stall... Clear!!\n", ep);
+                reg &= ~FUSB300_EPSET0_STL;
+                iowrite32(reg, fusb300->reg + FUSB300_OFFSET_EPSET0(ep));
+        }
+}
+
+static void ep0_queue(struct fusb300_ep *ep, struct fusb300_request *req)
+{
+        if (ep->fusb300->ep0_dir) { /* if IN */
+                if (req->req.length) {
+                        fusb300_wrcxf(ep, req);
+                } else
+                        printk(KERN_DEBUG "%s : req->req.length = 0x%x\n",
+                                __func__, req->req.length);
+                if ((req->req.length == req->req.actual) ||
+                    (req->req.actual < ep->ep.maxpacket))
+                        done(ep, req, 0);
+        } else { /* OUT */
+                if (!req->req.length)
+                        done(ep, req, 0);
+                else
+                        fusb300_enable_bit(ep->fusb300, FUSB300_OFFSET_IGER1,
+                                FUSB300_IGER1_CX_OUT_INT);
+        }
+}
+
+static int fusb300_queue(struct usb_ep *_ep, struct usb_request *_req,
+                         gfp_t gfp_flags)
+{
+        struct fusb300_ep *ep;
+        struct fusb300_request *req;
+        unsigned long flags;
+        int request  = 0;
+
+        ep = container_of(_ep, struct fusb300_ep, ep);
+        req = container_of(_req, struct fusb300_request, req);
+
+        if (ep->fusb300->gadget.speed == USB_SPEED_UNKNOWN)
+                return -ESHUTDOWN;
+
+        spin_lock_irqsave(&ep->fusb300->lock, flags);
+
+        if (list_empty(&ep->queue))
+                request = 1;
+
+        list_add_tail(&req->queue, &ep->queue);
+
+        req->req.actual = 0;
+        req->req.status = -EINPROGRESS;
+
+        if (ep->desc == NULL) /* ep0 */
+                ep0_queue(ep, req);
+        else if (request && !ep->stall)
+                enable_fifo_int(ep);
+
+        spin_unlock_irqrestore(&ep->fusb300->lock, flags);
+
+        return 0;
+}
+
+static int fusb300_dequeue(struct usb_ep *_ep, struct usb_request *_req)
+{
+        struct fusb300_ep *ep;
+        struct fusb300_request *req;
+        unsigned long flags;
+
+        ep = container_of(_ep, struct fusb300_ep, ep);
+        req = container_of(_req, struct fusb300_request, req);
+
+        spin_lock_irqsave(&ep->fusb300->lock, flags);
+        if (!list_empty(&ep->queue))
+                done(ep, req, -ECONNRESET);
+        spin_unlock_irqrestore(&ep->fusb300->lock, flags);
+
+        return 0;
+}
+
+static int fusb300_set_halt_and_wedge(struct usb_ep *_ep, int value, int wedge)
+{
+        struct fusb300_ep *ep;
+        struct fusb300 *fusb300;
+        unsigned long flags;
+        int ret = 0;
+
+        ep = container_of(_ep, struct fusb300_ep, ep);
+
+        fusb300 = ep->fusb300;
+
+        spin_lock_irqsave(&ep->fusb300->lock, flags);
+
+        if (!list_empty(&ep->queue)) {
+                ret = -EAGAIN;
+                goto out;
+        }
+
+        if (value) {
+                fusb300_set_epnstall(fusb300, ep->epnum);
+                ep->stall = 1;
+                if (wedge)
+                        ep->wedged = 1;
+        } else {
+                fusb300_clear_epnstall(fusb300, ep->epnum);
+                ep->stall = 0;
+                ep->wedged = 0;
+        }
+
+out:
+        spin_unlock_irqrestore(&ep->fusb300->lock, flags);
+        return ret;
+}
+
+static int fusb300_set_halt(struct usb_ep *_ep, int value)
+{
+        return fusb300_set_halt_and_wedge(_ep, value, 0);
+}
+
+static int fusb300_set_wedge(struct usb_ep *_ep)
+{
+        return fusb300_set_halt_and_wedge(_ep, 1, 1);
+}
+
+static void fusb300_fifo_flush(struct usb_ep *_ep)
+{
+}
+
+static struct usb_ep_ops fusb300_ep_ops = {
+        .enable         = fusb300_enable,
+        .disable        = fusb300_disable,
+
+        .alloc_request  = fusb300_alloc_request,
+        .free_request   = fusb300_free_request,
+
+        .queue          = fusb300_queue,
+        .dequeue        = fusb300_dequeue,
+
+        .set_halt       = fusb300_set_halt,
+        .fifo_flush     = fusb300_fifo_flush,
+        .set_wedge      = fusb300_set_wedge,
+};
+
+/*****************************************************************************/
+static void fusb300_clear_int(struct fusb300 *fusb300, u32 offset,
+                       u32 value)
+{
+        iowrite32(value, fusb300->reg + offset);
+}
+
+static void fusb300_reset(void)
+{
+}
+
+static void fusb300_set_cxstall(struct fusb300 *fusb300)
+{
+        fusb300_enable_bit(fusb300, FUSB300_OFFSET_CSR,
+                           FUSB300_CSR_STL);
+}
+
+static void fusb300_set_cxdone(struct fusb300 *fusb300)
+{
+        fusb300_enable_bit(fusb300, FUSB300_OFFSET_CSR,
+                           FUSB300_CSR_DONE);
+}
+
+/* read data from cx fifo */
+void fusb300_rdcxf(struct fusb300 *fusb300,
+                   u8 *buffer, u32 length)
+{
+        int i = 0;
+        u8 *tmp;
+        u32 data;
+
+        tmp = buffer;
+
+        for (i = (length >> 2); i > 0; i--) {
+                data = ioread32(fusb300->reg + FUSB300_OFFSET_CXPORT);
+                printk(KERN_DEBUG "    0x%x\n", data);
+                *tmp = data & 0xFF;
+                *(tmp + 1) = (data >> 8) & 0xFF;
+                *(tmp + 2) = (data >> 16) & 0xFF;
+                *(tmp + 3) = (data >> 24) & 0xFF;
+                tmp = tmp + 4;
+        }
+
+        switch (length % 4) {
+        case 1:
+                data = ioread32(fusb300->reg + FUSB300_OFFSET_CXPORT);
+                printk(KERN_DEBUG "    0x%x\n", data);
+                *tmp = data & 0xFF;
+                break;
+        case 2:
+                data = ioread32(fusb300->reg + FUSB300_OFFSET_CXPORT);
+                printk(KERN_DEBUG "    0x%x\n", data);
+                *tmp = data & 0xFF;
+                *(tmp + 1) = (data >> 8) & 0xFF;
+                break;
+        case 3:
+                data = ioread32(fusb300->reg + FUSB300_OFFSET_CXPORT);
+                printk(KERN_DEBUG "    0x%x\n", data);
+                *tmp = data & 0xFF;
+                *(tmp + 1) = (data >> 8) & 0xFF;
+                *(tmp + 2) = (data >> 16) & 0xFF;
+                break;
+        default:
+                break;
+        }
+}
+
+#if 0
+static void fusb300_dbg_fifo(struct fusb300_ep *ep,
+                                u8 entry, u16 length)
+{
+        u32 reg;
+        u32 i = 0;
+        u32 j = 0;
+
+        reg = ioread32(ep->fusb300->reg + FUSB300_OFFSET_GTM);
+        reg &= ~(FUSB300_GTM_TST_EP_ENTRY(0xF) |
+                FUSB300_GTM_TST_EP_NUM(0xF) | FUSB300_GTM_TST_FIFO_DEG);
+        reg |= (FUSB300_GTM_TST_EP_ENTRY(entry) |
+                FUSB300_GTM_TST_EP_NUM(ep->epnum) | FUSB300_GTM_TST_FIFO_DEG);
+        iowrite32(reg, ep->fusb300->reg + FUSB300_OFFSET_GTM);
+
+        for (i = 0; i < (length >> 2); i++) {
+                if (i * 4 == 1024)
+                        break;
+                reg = ioread32(ep->fusb300->reg +
+                        FUSB300_OFFSET_BUFDBG_START + i * 4);
+                printk(KERN_DEBUG"  0x%-8x", reg);
+                j++;
+                if ((j % 4)  == 0)
+                        printk(KERN_DEBUG "\n");
+        }
+
+        if (length % 4) {
+                reg = ioread32(ep->fusb300->reg +
+                        FUSB300_OFFSET_BUFDBG_START + i * 4);
+                printk(KERN_DEBUG "  0x%x\n", reg);
+        }
+
+        if ((j % 4)  != 0)
+                printk(KERN_DEBUG "\n");
+
+        fusb300_disable_bit(ep->fusb300, FUSB300_OFFSET_GTM,
+                FUSB300_GTM_TST_FIFO_DEG);
+}
+
+static void fusb300_cmp_dbg_fifo(struct fusb300_ep *ep,
+                                u8 entry, u16 length, u8 *golden)
+{
+        u32 reg;
+        u32 i = 0;
+        u32 golden_value;
+        u8 *tmp;
+
+        tmp = golden;
+
+        printk(KERN_DEBUG "fusb300_cmp_dbg_fifo (entry %d) : start\n", entry);
+
+        reg = ioread32(ep->fusb300->reg + FUSB300_OFFSET_GTM);
+        reg &= ~(FUSB300_GTM_TST_EP_ENTRY(0xF) |
+                FUSB300_GTM_TST_EP_NUM(0xF) | FUSB300_GTM_TST_FIFO_DEG);
+        reg |= (FUSB300_GTM_TST_EP_ENTRY(entry) |
+                FUSB300_GTM_TST_EP_NUM(ep->epnum) | FUSB300_GTM_TST_FIFO_DEG);
+        iowrite32(reg, ep->fusb300->reg + FUSB300_OFFSET_GTM);
+
+        for (i = 0; i < (length >> 2); i++) {
+                if (i * 4 == 1024)
+                        break;
+                golden_value = *tmp | *(tmp + 1) << 8 |
+                                *(tmp + 2) << 16 | *(tmp + 3) << 24;
+
+                reg = ioread32(ep->fusb300->reg +
+                        FUSB300_OFFSET_BUFDBG_START + i*4);
+
+                if (reg != golden_value) {
+                        printk(KERN_DEBUG "0x%x  :  ", (u32)(ep->fusb300->reg +
+                                FUSB300_OFFSET_BUFDBG_START + i*4));
+                        printk(KERN_DEBUG "    golden = 0x%x, reg = 0x%x\n",
+                                golden_value, reg);
+                }
+                tmp += 4;
+        }
+
+        switch (length % 4) {
+        case 1:
+                golden_value = *tmp;
+        case 2:
+                golden_value = *tmp | *(tmp + 1) << 8;
+        case 3:
+                golden_value = *tmp | *(tmp + 1) << 8 | *(tmp + 2) << 16;
+        default:
+                break;
+
+        reg = ioread32(ep->fusb300->reg + FUSB300_OFFSET_BUFDBG_START + i*4);
+        if (reg != golden_value) {
+                printk(KERN_DEBUG "0x%x:", (u32)(ep->fusb300->reg +
+                        FUSB300_OFFSET_BUFDBG_START + i*4));
+                printk(KERN_DEBUG "  golden = 0x%x, reg = 0x%x\n",
+                        golden_value, reg);
+        }
+        }
+
+        printk(KERN_DEBUG "fusb300_cmp_dbg_fifo : end\n");
+        fusb300_disable_bit(ep->fusb300, FUSB300_OFFSET_GTM,
+                FUSB300_GTM_TST_FIFO_DEG);
+}
+#endif
+
+static void fusb300_rdfifo(struct fusb300_ep *ep,
+                          struct fusb300_request *req,
+                          u32 length)
+{
+        int i = 0;
+        u8 *tmp;
+        u32 data, reg;
+        struct fusb300 *fusb300 = ep->fusb300;
+
+        tmp = req->req.buf + req->req.actual;
+        req->req.actual += length;
+
+        if (req->req.actual > req->req.length)
+                printk(KERN_DEBUG "req->req.actual > req->req.length\n");
+
+        for (i = (length >> 2); i > 0; i--) {
+                data = ioread32(fusb300->reg +
+                        FUSB300_OFFSET_EPPORT(ep->epnum));
+                *tmp = data & 0xFF;
+                *(tmp + 1) = (data >> 8) & 0xFF;
+                *(tmp + 2) = (data >> 16) & 0xFF;
+                *(tmp + 3) = (data >> 24) & 0xFF;
+                tmp = tmp + 4;
+        }
+
+        switch (length % 4) {
+        case 1:
+                data = ioread32(fusb300->reg +
+                        FUSB300_OFFSET_EPPORT(ep->epnum));
+                *tmp = data & 0xFF;
+                break;
+        case 2:
+                data = ioread32(fusb300->reg +
+                        FUSB300_OFFSET_EPPORT(ep->epnum));
+                *tmp = data & 0xFF;
+                *(tmp + 1) = (data >> 8) & 0xFF;
+                break;
+        case 3:
+                data = ioread32(fusb300->reg +
+                        FUSB300_OFFSET_EPPORT(ep->epnum));
+                *tmp = data & 0xFF;
+                *(tmp + 1) = (data >> 8) & 0xFF;
+                *(tmp + 2) = (data >> 16) & 0xFF;
+                break;
+        default:
+                break;
+        }
+
+        do {
+                reg = ioread32(fusb300->reg + FUSB300_OFFSET_IGR1);
+                reg &= FUSB300_IGR1_SYNF0_EMPTY_INT;
+                if (i)
+                        printk(KERN_INFO "sync fifo is not empty!\n");
+                i++;
+        } while (!reg);
+}
+
+/* write data to fifo */
+static void fusb300_wrfifo(struct fusb300_ep *ep,
+                           struct fusb300_request *req)
+{
+        int i = 0;
+        u8 *tmp;
+        u32 data, reg;
+        struct fusb300 *fusb300 = ep->fusb300;
+
+        tmp = req->req.buf;
+        req->req.actual = req->req.length;
+
+        for (i = (req->req.length >> 2); i > 0; i--) {
+                data = *tmp | *(tmp + 1) << 8 |
+                        *(tmp + 2) << 16 | *(tmp + 3) << 24;
+
+                iowrite32(data, fusb300->reg +
+                        FUSB300_OFFSET_EPPORT(ep->epnum));
+                tmp += 4;
+        }
+
+        switch (req->req.length % 4) {
+        case 1:
+                data = *tmp;
+                iowrite32(data, fusb300->reg +
+                        FUSB300_OFFSET_EPPORT(ep->epnum));
+                break;
+        case 2:
+                data = *tmp | *(tmp + 1) << 8;
+                iowrite32(data, fusb300->reg +
+                        FUSB300_OFFSET_EPPORT(ep->epnum));
+                break;
+        case 3:
+                data = *tmp | *(tmp + 1) << 8 | *(tmp + 2) << 16;
+                iowrite32(data, fusb300->reg +
+                        FUSB300_OFFSET_EPPORT(ep->epnum));
+                break;
+        default:
+                break;
+        }
+
+        do {
+                reg = ioread32(fusb300->reg + FUSB300_OFFSET_IGR1);
+                reg &= FUSB300_IGR1_SYNF0_EMPTY_INT;
+                if (i)
+                        printk(KERN_INFO"sync fifo is not empty!\n");
+                i++;
+        } while (!reg);
+}
+
+static u8 fusb300_get_epnstall(struct fusb300 *fusb300, u8 ep)
+{
+        u8 value;
+        u32 reg = ioread32(fusb300->reg + FUSB300_OFFSET_EPSET0(ep));
+
+        value = reg & FUSB300_EPSET0_STL;
+
+        return value;
+}
+
+static u8 fusb300_get_cxstall(struct fusb300 *fusb300)
+{
+        u8 value;
+        u32 reg = ioread32(fusb300->reg + FUSB300_OFFSET_CSR);
+
+        value = (reg & FUSB300_CSR_STL) >> 1;
+
+        return value;
+}
+
+static void request_error(struct fusb300 *fusb300)
+{
+        fusb300_set_cxstall(fusb300);
+        printk(KERN_DEBUG "request error!!\n");
+}
+
+static void get_status(struct fusb300 *fusb300, struct usb_ctrlrequest *ctrl)
+__releases(fusb300->lock)
+__acquires(fusb300->lock)
+{
+        u8 ep;
+        u16 status = 0;
+        u16 w_index = ctrl->wIndex;
+
+        switch (ctrl->bRequestType & USB_RECIP_MASK) {
+        case USB_RECIP_DEVICE:
+                status = 1 << USB_DEVICE_SELF_POWERED;
+                break;
+        case USB_RECIP_INTERFACE:
+                status = 0;
+                break;
+        case USB_RECIP_ENDPOINT:
+                ep = w_index & USB_ENDPOINT_NUMBER_MASK;
+                if (ep) {
+                        if (fusb300_get_epnstall(fusb300, ep))
+                                status = 1 << USB_ENDPOINT_HALT;
+                } else {
+                        if (fusb300_get_cxstall(fusb300))
+                                status = 0;
+                }
+                break;
+
+        default:
+                request_error(fusb300);
+                return;         /* exit */
+        }
+
+        fusb300->ep0_data = cpu_to_le16(status);
+        fusb300->ep0_req->buf = &fusb300->ep0_data;
+        fusb300->ep0_req->length = 2;
+
+        spin_unlock(&fusb300->lock);
+        fusb300_queue(fusb300->gadget.ep0, fusb300->ep0_req, GFP_KERNEL);
+        spin_lock(&fusb300->lock);
+}
+
+static void set_feature(struct fusb300 *fusb300, struct usb_ctrlrequest *ctrl)
+{
+        u8 ep;
+
+        switch (ctrl->bRequestType & USB_RECIP_MASK) {
+        case USB_RECIP_DEVICE:
+                fusb300_set_cxdone(fusb300);
+                break;
+        case USB_RECIP_INTERFACE:
+                fusb300_set_cxdone(fusb300);
+                break;
+        case USB_RECIP_ENDPOINT: {
+                u16 w_index = le16_to_cpu(ctrl->wIndex);
+
+                ep = w_index & USB_ENDPOINT_NUMBER_MASK;
+                if (ep)
+                        fusb300_set_epnstall(fusb300, ep);
+                else
+                        fusb300_set_cxstall(fusb300);
+                fusb300_set_cxdone(fusb300);
+                }
+                break;
+        default:
+                request_error(fusb300);
+                break;
+        }
+}
+
+static void fusb300_clear_seqnum(struct fusb300 *fusb300, u8 ep)
+{
+        fusb300_enable_bit(fusb300, FUSB300_OFFSET_EPSET0(ep),
+                            FUSB300_EPSET0_CLRSEQNUM);
+}
+
+static void clear_feature(struct fusb300 *fusb300, struct usb_ctrlrequest *ctrl)
+{
+        struct fusb300_ep *ep =
+                fusb300->ep[ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK];
+
+        switch (ctrl->bRequestType & USB_RECIP_MASK) {
+        case USB_RECIP_DEVICE:
+                fusb300_set_cxdone(fusb300);
+                break;
+        case USB_RECIP_INTERFACE:
+                fusb300_set_cxdone(fusb300);
+                break;
+        case USB_RECIP_ENDPOINT:
+                if (ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK) {
+                        if (ep->wedged) {
+                                fusb300_set_cxdone(fusb300);
+                                break;
+                        }
+                        if (ep->stall) {
+                                ep->stall = 0;
+                                fusb300_clear_seqnum(fusb300, ep->epnum);
+                                fusb300_clear_epnstall(fusb300, ep->epnum);
+                                if (!list_empty(&ep->queue))
+                                        enable_fifo_int(ep);
+                        }
+                }
+                fusb300_set_cxdone(fusb300);
+                break;
+        default:
+                request_error(fusb300);
+                break;
+        }
+}
+
+static void fusb300_set_dev_addr(struct fusb300 *fusb300, u16 addr)
+{
+        u32 reg = ioread32(fusb300->reg + FUSB300_OFFSET_DAR);
+
+        reg &= ~FUSB300_DAR_DRVADDR_MSK;
+        reg |= FUSB300_DAR_DRVADDR(addr);
+
+        iowrite32(reg, fusb300->reg + FUSB300_OFFSET_DAR);
+}
+
+static void set_address(struct fusb300 *fusb300, struct usb_ctrlrequest *ctrl)
+{
+        if (ctrl->wValue >= 0x0100)
+                request_error(fusb300);
+        else {
+                fusb300_set_dev_addr(fusb300, ctrl->wValue);
+                fusb300_set_cxdone(fusb300);
+        }
+}
+
+#define UVC_COPY_DESCRIPTORS(mem, src) \
+        do { \
+                const struct usb_descriptor_header * const *__src; \
+                for (__src = src; *__src; ++__src) { \
+                        memcpy(mem, *__src, (*__src)->bLength); \
+                        mem += (*__src)->bLength; \
+                } \
+        } while (0)
+
+static void fusb300_ep0_complete(struct usb_ep *ep,
+                                struct usb_request *req)
+{
+}
+
+static int setup_packet(struct fusb300 *fusb300, struct usb_ctrlrequest *ctrl)
+{
+        u8 *p = (u8 *)ctrl;
+        u8 ret = 0;
+        u8 i = 0;
+
+        fusb300_rdcxf(fusb300, p, 8);
+        fusb300->ep0_dir = ctrl->bRequestType & USB_DIR_IN;
+        fusb300->ep0_length = ctrl->wLength;
+
+        /* check request */
+        if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD) {
+                switch (ctrl->bRequest) {
+                case USB_REQ_GET_STATUS:
+                        get_status(fusb300, ctrl);
+                        break;
+                case USB_REQ_CLEAR_FEATURE:
+                        clear_feature(fusb300, ctrl);
+                        break;
+                case USB_REQ_SET_FEATURE:
+                        set_feature(fusb300, ctrl);
+                        break;
+                case USB_REQ_SET_ADDRESS:
+                        set_address(fusb300, ctrl);
+                        break;
+                case USB_REQ_SET_CONFIGURATION:
+                        fusb300_enable_bit(fusb300, FUSB300_OFFSET_DAR,
+                                           FUSB300_DAR_SETCONFG);
+                        /* clear sequence number */
+                        for (i = 1; i <= FUSB300_MAX_NUM_EP; i++)
+                                fusb300_clear_seqnum(fusb300, i);
+                        fusb300->reenum = 1;
+                        ret = 1;
+                        break;
+                default:
+                        ret = 1;
+                        break;
+                }
+        } else
+                ret = 1;
+
+        return ret;
+}
+
+static void fusb300_set_ep_bycnt(struct fusb300_ep *ep, u32 bycnt)
+{
+        struct fusb300 *fusb300 = ep->fusb300;
+        u32 reg = ioread32(fusb300->reg + FUSB300_OFFSET_EPFFR(ep->epnum));
+
+        reg &= ~FUSB300_FFR_BYCNT;
+        reg |= bycnt & FUSB300_FFR_BYCNT;
+
+        iowrite32(reg, fusb300->reg + FUSB300_OFFSET_EPFFR(ep->epnum));
+}
+
+static void done(struct fusb300_ep *ep, struct fusb300_request *req,
+                 int status)
+{
+        list_del_init(&req->queue);
+
+        /* don't modify queue heads during completion callback */
+        if (ep->fusb300->gadget.speed == USB_SPEED_UNKNOWN)
+                req->req.status = -ESHUTDOWN;
+        else
+                req->req.status = status;
+
+        spin_unlock(&ep->fusb300->lock);
+        req->req.complete(&ep->ep, &req->req);
+        spin_lock(&ep->fusb300->lock);
+
+        if (ep->epnum) {
+                disable_fifo_int(ep);
+                if (!list_empty(&ep->queue))
+                        enable_fifo_int(ep);
+        } else
+                fusb300_set_cxdone(ep->fusb300);
+}
+
+void fusb300_fill_idma_prdtbl(struct fusb300_ep *ep,
+                        struct fusb300_request *req)
+{
+        u32 value;
+        u32 reg;
+
+        /* wait SW owner */
+        do {
+                reg = ioread32(ep->fusb300->reg +
+                        FUSB300_OFFSET_EPPRD_W0(ep->epnum));
+                reg &= FUSB300_EPPRD0_H;
+        } while (reg);
+
+        iowrite32((u32) req->req.buf, ep->fusb300->reg +
+                FUSB300_OFFSET_EPPRD_W1(ep->epnum));
+
+        value = FUSB300_EPPRD0_BTC(req->req.length) | FUSB300_EPPRD0_H |
+                FUSB300_EPPRD0_F | FUSB300_EPPRD0_L | FUSB300_EPPRD0_I;
+        iowrite32(value, ep->fusb300->reg + FUSB300_OFFSET_EPPRD_W0(ep->epnum));
+
+        iowrite32(0x0, ep->fusb300->reg + FUSB300_OFFSET_EPPRD_W2(ep->epnum));
+
+        fusb300_enable_bit(ep->fusb300, FUSB300_OFFSET_EPPRDRDY,
+                FUSB300_EPPRDR_EP_PRD_RDY(ep->epnum));
+}
+
+static void fusb300_wait_idma_finished(struct fusb300_ep *ep)
+{
+        u32 reg;
+
+        do {
+                reg = ioread32(ep->fusb300->reg + FUSB300_OFFSET_IGR1);
+                if ((reg & FUSB300_IGR1_VBUS_CHG_INT) ||
+                    (reg & FUSB300_IGR1_WARM_RST_INT) ||
+                    (reg & FUSB300_IGR1_HOT_RST_INT) ||
+                    (reg & FUSB300_IGR1_USBRST_INT)
+                )
+                        goto IDMA_RESET;
+                reg = ioread32(ep->fusb300->reg + FUSB300_OFFSET_IGR0);
+                reg &= FUSB300_IGR0_EPn_PRD_INT(ep->epnum);
+        } while (!reg);
+
+        fusb300_clear_int(ep->fusb300, FUSB300_OFFSET_IGR0,
+                FUSB300_IGR0_EPn_PRD_INT(ep->epnum));
+IDMA_RESET:
+        fusb300_clear_int(ep->fusb300, FUSB300_OFFSET_IGER0,
+                FUSB300_IGER0_EEPn_PRD_INT(ep->epnum));
+}
+
+static void  fusb300_set_idma(struct fusb300_ep *ep,
+                        struct fusb300_request *req)
+{
+        dma_addr_t d;
+        u8 *tmp = NULL;
+
+        d = dma_map_single(NULL, req->req.buf, req->req.length, DMA_TO_DEVICE);
+
+        if (dma_mapping_error(NULL, d)) {
+                kfree(req->req.buf);
+                printk(KERN_DEBUG "dma_mapping_error\n");
+        }
+
+        dma_sync_single_for_device(NULL, d, req->req.length, DMA_TO_DEVICE);
+
+        fusb300_enable_bit(ep->fusb300, FUSB300_OFFSET_IGER0,
+                FUSB300_IGER0_EEPn_PRD_INT(ep->epnum));
+
+        tmp = req->req.buf;
+        req->req.buf = (u8 *)d;
+
+        fusb300_fill_idma_prdtbl(ep, req);
+        /* check idma is done */
+        fusb300_wait_idma_finished(ep);
+
+        req->req.buf = tmp;
+
+        if (d)
+                dma_unmap_single(NULL, d, req->req.length, DMA_TO_DEVICE);
+}
+
+static void in_ep_fifo_handler(struct fusb300_ep *ep)
+{
+        struct fusb300_request *req = list_entry(ep->queue.next,
+                                        struct fusb300_request, queue);
+
+        if (req->req.length) {
+#if 0
+                fusb300_set_ep_bycnt(ep, req->req.length);
+                fusb300_wrfifo(ep, req);
+#else
+                fusb300_set_idma(ep, req);
+#endif
+        }
+        done(ep, req, 0);
+}
+
+static void out_ep_fifo_handler(struct fusb300_ep *ep)
+{
+        struct fusb300 *fusb300 = ep->fusb300;
+        struct fusb300_request *req = list_entry(ep->queue.next,
+                                                 struct fusb300_request, queue);
+        u32 reg = ioread32(fusb300->reg + FUSB300_OFFSET_EPFFR(ep->epnum));
+        u32 length = reg & FUSB300_FFR_BYCNT;
+
+        fusb300_rdfifo(ep, req, length);
+
+        /* finish out transfer */
+        if ((req->req.length == req->req.actual) || (length < ep->ep.maxpacket))
+                done(ep, req, 0);
+}
+
+static void check_device_mode(struct fusb300 *fusb300)
+{
+        u32 reg = ioread32(fusb300->reg + FUSB300_OFFSET_GCR);
+
+        switch (reg & FUSB300_GCR_DEVEN_MSK) {
+        case FUSB300_GCR_DEVEN_SS:
+                fusb300->gadget.speed = USB_SPEED_SUPER;
+                break;
+        case FUSB300_GCR_DEVEN_HS:
+                fusb300->gadget.speed = USB_SPEED_HIGH;
+                break;
+        case FUSB300_GCR_DEVEN_FS:
+                fusb300->gadget.speed = USB_SPEED_FULL;
+                break;
+        default:
+                fusb300->gadget.speed = USB_SPEED_UNKNOWN;
+                break;
+        }
+        printk(KERN_INFO "dev_mode = %d\n", (reg & FUSB300_GCR_DEVEN_MSK));
+}
+
+
+static void fusb300_ep0out(struct fusb300 *fusb300)
+{
+        struct fusb300_ep *ep = fusb300->ep[0];
+        u32 reg;
+
+        if (!list_empty(&ep->queue)) {
+                struct fusb300_request *req;
+
+                req = list_first_entry(&ep->queue,
+                        struct fusb300_request, queue);
+                if (req->req.length)
+                        fusb300_rdcxf(ep->fusb300, req->req.buf,
+                                req->req.length);
+                done(ep, req, 0);
+                reg = ioread32(fusb300->reg + FUSB300_OFFSET_IGER1);
+                reg &= ~FUSB300_IGER1_CX_OUT_INT;
+                iowrite32(reg, fusb300->reg + FUSB300_OFFSET_IGER1);
+        } else
+                pr_err("%s : empty queue\n", __func__);
+}
+
+static void fusb300_ep0in(struct fusb300 *fusb300)
+{
+        struct fusb300_request *req;
+        struct fusb300_ep *ep = fusb300->ep[0];
+
+        if ((!list_empty(&ep->queue)) && (fusb300->ep0_dir)) {
+                req = list_entry(ep->queue.next,
+                                struct fusb300_request, queue);
+                if (req->req.length)
+                        fusb300_wrcxf(ep, req);
+                if ((req->req.length - req->req.actual) < ep->ep.maxpacket)
+                        done(ep, req, 0);
+        } else
+                fusb300_set_cxdone(fusb300);
+}
+
+static void fusb300_grp2_handler(void)
+{
+}
+
+static void fusb300_grp3_handler(void)
+{
+}
+
+static void fusb300_grp4_handler(void)
+{
+}
+
+static void fusb300_grp5_handler(void)
+{
+}
+
+static irqreturn_t fusb300_irq(int irq, void *_fusb300)
+{
+        struct fusb300 *fusb300 = _fusb300;
+        u32 int_grp1 = ioread32(fusb300->reg + FUSB300_OFFSET_IGR1);
+        u32 int_grp1_en = ioread32(fusb300->reg + FUSB300_OFFSET_IGER1);
+        u32 int_grp0 = ioread32(fusb300->reg + FUSB300_OFFSET_IGR0);
+        u32 int_grp0_en = ioread32(fusb300->reg + FUSB300_OFFSET_IGER0);
+        struct usb_ctrlrequest ctrl;
+        u8 in;
+        u32 reg;
+        int i;
+
+        spin_lock(&fusb300->lock);
+
+        int_grp1 &= int_grp1_en;
+        int_grp0 &= int_grp0_en;
+
+        if (int_grp1 & FUSB300_IGR1_WARM_RST_INT) {
+                fusb300_clear_int(fusb300, FUSB300_OFFSET_IGR1,
+                                  FUSB300_IGR1_WARM_RST_INT);
+                printk(KERN_INFO"fusb300_warmreset\n");
+                fusb300_reset();
+        }
+
+        if (int_grp1 & FUSB300_IGR1_HOT_RST_INT) {
+                fusb300_clear_int(fusb300, FUSB300_OFFSET_IGR1,
+                                  FUSB300_IGR1_HOT_RST_INT);
+                printk(KERN_INFO"fusb300_hotreset\n");
+                fusb300_reset();
+        }
+
+        if (int_grp1 & FUSB300_IGR1_USBRST_INT) {
+                fusb300_clear_int(fusb300, FUSB300_OFFSET_IGR1,
+                                  FUSB300_IGR1_USBRST_INT);
+                fusb300_reset();
+        }
+        /* COMABT_INT has a highest priority */
+
+        if (int_grp1 & FUSB300_IGR1_CX_COMABT_INT) {
+                fusb300_clear_int(fusb300, FUSB300_OFFSET_IGR1,
+                                  FUSB300_IGR1_CX_COMABT_INT);
+                printk(KERN_INFO"fusb300_ep0abt\n");
+        }
+
+        if (int_grp1 & FUSB300_IGR1_VBUS_CHG_INT) {
+                fusb300_clear_int(fusb300, FUSB300_OFFSET_IGR1,
+                                  FUSB300_IGR1_VBUS_CHG_INT);
+                printk(KERN_INFO"fusb300_vbus_change\n");
+        }
+
+        if (int_grp1 & FUSB300_IGR1_U3_EXIT_FAIL_INT) {
+                fusb300_clear_int(fusb300, FUSB300_OFFSET_IGR1,
+                                  FUSB300_IGR1_U3_EXIT_FAIL_INT);
+        }
+
+        if (int_grp1 & FUSB300_IGR1_U2_EXIT_FAIL_INT) {
+                fusb300_clear_int(fusb300, FUSB300_OFFSET_IGR1,
+                                  FUSB300_IGR1_U2_EXIT_FAIL_INT);
+        }
+
+        if (int_grp1 & FUSB300_IGR1_U1_EXIT_FAIL_INT) {
+                fusb300_clear_int(fusb300, FUSB300_OFFSET_IGR1,
+                                  FUSB300_IGR1_U1_EXIT_FAIL_INT);
+        }
+
+        if (int_grp1 & FUSB300_IGR1_U2_ENTRY_FAIL_INT) {
+                fusb300_clear_int(fusb300, FUSB300_OFFSET_IGR1,
+                                  FUSB300_IGR1_U2_ENTRY_FAIL_INT);
+        }
+
+        if (int_grp1 & FUSB300_IGR1_U1_ENTRY_FAIL_INT) {
+                fusb300_clear_int(fusb300, FUSB300_OFFSET_IGR1,
+                                  FUSB300_IGR1_U1_ENTRY_FAIL_INT);
+        }
+
+        if (int_grp1 & FUSB300_IGR1_U3_EXIT_INT) {
+                fusb300_clear_int(fusb300, FUSB300_OFFSET_IGR1,
+                                  FUSB300_IGR1_U3_EXIT_INT);
+                printk(KERN_INFO "FUSB300_IGR1_U3_EXIT_INT\n");
+        }
+
+        if (int_grp1 & FUSB300_IGR1_U2_EXIT_INT) {
+                fusb300_clear_int(fusb300, FUSB300_OFFSET_IGR1,
+                                  FUSB300_IGR1_U2_EXIT_INT);
+                printk(KERN_INFO "FUSB300_IGR1_U2_EXIT_INT\n");
+        }
+
+        if (int_grp1 & FUSB300_IGR1_U1_EXIT_INT) {
+                fusb300_clear_int(fusb300, FUSB300_OFFSET_IGR1,
+                                  FUSB300_IGR1_U1_EXIT_INT);
+                printk(KERN_INFO "FUSB300_IGR1_U1_EXIT_INT\n");
+        }
+
+        if (int_grp1 & FUSB300_IGR1_U3_ENTRY_INT) {
+                fusb300_clear_int(fusb300, FUSB300_OFFSET_IGR1,
+                                  FUSB300_IGR1_U3_ENTRY_INT);
+                printk(KERN_INFO "FUSB300_IGR1_U3_ENTRY_INT\n");
+                fusb300_enable_bit(fusb300, FUSB300_OFFSET_SSCR1,
+                                   FUSB300_SSCR1_GO_U3_DONE);
+        }
+
+        if (int_grp1 & FUSB300_IGR1_U2_ENTRY_INT) {
+                fusb300_clear_int(fusb300, FUSB300_OFFSET_IGR1,
+                                  FUSB300_IGR1_U2_ENTRY_INT);
+                printk(KERN_INFO "FUSB300_IGR1_U2_ENTRY_INT\n");
+        }
+
+        if (int_grp1 & FUSB300_IGR1_U1_ENTRY_INT) {
+                fusb300_clear_int(fusb300, FUSB300_OFFSET_IGR1,
+                                  FUSB300_IGR1_U1_ENTRY_INT);
+                printk(KERN_INFO "FUSB300_IGR1_U1_ENTRY_INT\n");
+        }
+
+        if (int_grp1 & FUSB300_IGR1_RESM_INT) {
+                fusb300_clear_int(fusb300, FUSB300_OFFSET_IGR1,
+                                  FUSB300_IGR1_RESM_INT);
+                printk(KERN_INFO "fusb300_resume\n");
+        }
+
+        if (int_grp1 & FUSB300_IGR1_SUSP_INT) {
+                fusb300_clear_int(fusb300, FUSB300_OFFSET_IGR1,
+                                  FUSB300_IGR1_SUSP_INT);
+                printk(KERN_INFO "fusb300_suspend\n");
+        }
+
+        if (int_grp1 & FUSB300_IGR1_HS_LPM_INT) {
+                fusb300_clear_int(fusb300, FUSB300_OFFSET_IGR1,
+                                  FUSB300_IGR1_HS_LPM_INT);
+                printk(KERN_INFO "fusb300_HS_LPM_INT\n");
+        }
+
+        if (int_grp1 & FUSB300_IGR1_DEV_MODE_CHG_INT) {
+                fusb300_clear_int(fusb300, FUSB300_OFFSET_IGR1,
+                                  FUSB300_IGR1_DEV_MODE_CHG_INT);
+                check_device_mode(fusb300);
+        }
+
+        if (int_grp1 & FUSB300_IGR1_CX_COMFAIL_INT) {
+                fusb300_set_cxstall(fusb300);
+                printk(KERN_INFO "fusb300_ep0fail\n");
+        }
+
+        if (int_grp1 & FUSB300_IGR1_CX_SETUP_INT) {
+                printk(KERN_INFO "fusb300_ep0setup\n");
+                if (setup_packet(fusb300, &ctrl)) {
+                        spin_unlock(&fusb300->lock);
+                        if (fusb300->driver->setup(&fusb300->gadget, &ctrl) < 0)
+                                fusb300_set_cxstall(fusb300);
+                        spin_lock(&fusb300->lock);
+                }
+        }
+
+        if (int_grp1 & FUSB300_IGR1_CX_CMDEND_INT)
+                printk(KERN_INFO "fusb300_cmdend\n");
+
+
+        if (int_grp1 & FUSB300_IGR1_CX_OUT_INT) {
+                printk(KERN_INFO "fusb300_cxout\n");
+                fusb300_ep0out(fusb300);
+        }
+
+        if (int_grp1 & FUSB300_IGR1_CX_IN_INT) {
+                printk(KERN_INFO "fusb300_cxin\n");
+                fusb300_ep0in(fusb300);
+        }
+
+        if (int_grp1 & FUSB300_IGR1_INTGRP5)
+                fusb300_grp5_handler();
+
+        if (int_grp1 & FUSB300_IGR1_INTGRP4)
+                fusb300_grp4_handler();
+
+        if (int_grp1 & FUSB300_IGR1_INTGRP3)
+                fusb300_grp3_handler();
+
+        if (int_grp1 & FUSB300_IGR1_INTGRP2)
+                fusb300_grp2_handler();
+
+        if (int_grp0) {
+                for (i = 1; i < FUSB300_MAX_NUM_EP; i++) {
+                        if (int_grp0 & FUSB300_IGR0_EPn_FIFO_INT(i)) {
+                                reg = ioread32(fusb300->reg +
+                                        FUSB300_OFFSET_EPSET1(i));
+                                in = (reg & FUSB300_EPSET1_DIRIN) ? 1 : 0;
+                                if (in)
+                                        in_ep_fifo_handler(fusb300->ep[i]);
+                                else
+                                        out_ep_fifo_handler(fusb300->ep[i]);
+                        }
+                }
+        }
+
+        spin_unlock(&fusb300->lock);
+
+        return IRQ_HANDLED;
+}
+
+static void fusb300_set_u2_timeout(struct fusb300 *fusb300,
+                                   u32 time)
+{
+        u32 reg;
+
+        reg = ioread32(fusb300->reg + FUSB300_OFFSET_TT);
+        reg &= ~0xff;
+        reg |= FUSB300_SSCR2_U2TIMEOUT(time);
+
+        iowrite32(reg, fusb300->reg + FUSB300_OFFSET_TT);
+}
+
+static void fusb300_set_u1_timeout(struct fusb300 *fusb300,
+                                   u32 time)
+{
+        u32 reg;
+
+        reg = ioread32(fusb300->reg + FUSB300_OFFSET_TT);
+        reg &= ~(0xff << 8);
+        reg |= FUSB300_SSCR2_U1TIMEOUT(time);
+
+        iowrite32(reg, fusb300->reg + FUSB300_OFFSET_TT);
+}
+
+static void init_controller(struct fusb300 *fusb300)
+{
+        u32 reg;
+        u32 mask = 0;
+        u32 val = 0;
+
+        /* split on */
+        mask = val = FUSB300_AHBBCR_S0_SPLIT_ON | FUSB300_AHBBCR_S1_SPLIT_ON;
+        reg = ioread32(fusb300->reg + FUSB300_OFFSET_AHBCR);
+        reg &= ~mask;
+        reg |= val;
+        iowrite32(reg, fusb300->reg + FUSB300_OFFSET_AHBCR);
+
+        /* enable high-speed LPM */
+        mask = val = FUSB300_HSCR_HS_LPM_PERMIT;
+        reg = ioread32(fusb300->reg + FUSB300_OFFSET_HSCR);
+        reg &= ~mask;
+        reg |= val;
+        iowrite32(reg, fusb300->reg + FUSB300_OFFSET_HSCR);
+
+        /*set u1 u2 timmer*/
+        fusb300_set_u2_timeout(fusb300, 0xff);
+        fusb300_set_u1_timeout(fusb300, 0xff);
+
+        /* enable all grp1 interrupt */
+        iowrite32(0xcfffff9f, fusb300->reg + FUSB300_OFFSET_IGER1);
+}
+/*------------------------------------------------------------------------*/
+static struct fusb300 *the_controller;
+
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
+{
+        struct fusb300 *fusb300 = the_controller;
+        int retval;
+
+        if (!driver
+                        || driver->speed < USB_SPEED_FULL
+                        || !bind
+                        || !driver->setup)
+                return -EINVAL;
+
+        if (!fusb300)
+                return -ENODEV;
+
+        if (fusb300->driver)
+                return -EBUSY;
+
+        /* hook up the driver */
+        driver->driver.bus = NULL;
+        fusb300->driver = driver;
+        fusb300->gadget.dev.driver = &driver->driver;
+
+        retval = device_add(&fusb300->gadget.dev);
+        if (retval) {
+                pr_err("device_add error (%d)\n", retval);
+                goto error;
+        }
+
+        retval = bind(&fusb300->gadget);
+        if (retval) {
+                pr_err("bind to driver error (%d)\n", retval);
+                device_del(&fusb300->gadget.dev);
+                goto error;
+        }
+
+        return 0;
+
+error:
+        fusb300->driver = NULL;
+        fusb300->gadget.dev.driver = NULL;
+
+        return retval;
+}
+EXPORT_SYMBOL(usb_gadget_probe_driver);
+
+int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
+{
+        struct fusb300 *fusb300 = the_controller;
+
+        if (driver != fusb300->driver || !driver->unbind)
+                return -EINVAL;
+
+        driver->unbind(&fusb300->gadget);
+        fusb300->gadget.dev.driver = NULL;
+
+        init_controller(fusb300);
+        device_del(&fusb300->gadget.dev);
+        fusb300->driver = NULL;
+
+        return 0;
+}
+EXPORT_SYMBOL(usb_gadget_unregister_driver);
+/*--------------------------------------------------------------------------*/
+
+static int fusb300_udc_pullup(struct usb_gadget *_gadget, int is_active)
+{
+        return 0;
+}
+
+static struct usb_gadget_ops fusb300_gadget_ops = {
+        .pullup         = fusb300_udc_pullup,
+};
+
+static int __exit fusb300_remove(struct platform_device *pdev)
+{
+        struct fusb300 *fusb300 = dev_get_drvdata(&pdev->dev);
+
+        iounmap(fusb300->reg);
+        free_irq(platform_get_irq(pdev, 0), fusb300);
+
+        fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req);
+        kfree(fusb300);
+
+        return 0;
+}
+
+static int __init fusb300_probe(struct platform_device *pdev)
+{
+        struct resource *res, *ires, *ires1;
+        void __iomem *reg = NULL;
+        struct fusb300 *fusb300 = NULL;
+        struct fusb300_ep *_ep[FUSB300_MAX_NUM_EP];
+        int ret = 0;
+        int i;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                ret = -ENODEV;
+                pr_err("platform_get_resource error.\n");
+                goto clean_up;
+        }
+
+        ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (!ires) {
+                ret = -ENODEV;
+                dev_err(&pdev->dev,
+                        "platform_get_resource IORESOURCE_IRQ error.\n");
+                goto clean_up;
+        }
+
+        ires1 = platform_get_resource(pdev, IORESOURCE_IRQ, 1);
+        if (!ires1) {
+                ret = -ENODEV;
+                dev_err(&pdev->dev,
+                        "platform_get_resource IORESOURCE_IRQ 1 error.\n");
+                goto clean_up;
+        }
+
+        reg = ioremap(res->start, resource_size(res));
+        if (reg == NULL) {
+                ret = -ENOMEM;
+                pr_err("ioremap error.\n");
+                goto clean_up;
+        }
+
+        /* initialize udc */
+        fusb300 = kzalloc(sizeof(struct fusb300), GFP_KERNEL);
+        if (fusb300 == NULL) {
+                pr_err("kzalloc error\n");
+                goto clean_up;
+        }
+
+        for (i = 0; i < FUSB300_MAX_NUM_EP; i++) {
+                _ep[i] = kzalloc(sizeof(struct fusb300_ep), GFP_KERNEL);
+                if (_ep[i] == NULL) {
+                        pr_err("_ep kzalloc error\n");
+                        goto clean_up;
+                }
+                fusb300->ep[i] = _ep[i];
+        }
+
+        spin_lock_init(&fusb300->lock);
+
+        dev_set_drvdata(&pdev->dev, fusb300);
+
+        fusb300->gadget.ops = &fusb300_gadget_ops;
+
+        device_initialize(&fusb300->gadget.dev);
+
+        dev_set_name(&fusb300->gadget.dev, "gadget");
+
+        fusb300->gadget.is_dualspeed = 1;
+        fusb300->gadget.dev.parent = &pdev->dev;
+        fusb300->gadget.dev.dma_mask = pdev->dev.dma_mask;
+        fusb300->gadget.dev.release = pdev->dev.release;
+        fusb300->gadget.name = udc_name;
+        fusb300->reg = reg;
+
+        ret = request_irq(ires->start, fusb300_irq, IRQF_DISABLED | IRQF_SHARED,
+                          udc_name, fusb300);
+        if (ret < 0) {
+                pr_err("request_irq error (%d)\n", ret);
+                goto clean_up;
+        }
+
+        ret = request_irq(ires1->start, fusb300_irq,
+                        IRQF_DISABLED | IRQF_SHARED, udc_name, fusb300);
+        if (ret < 0) {
+                pr_err("request_irq1 error (%d)\n", ret);
+                goto clean_up;
+        }
+
+        INIT_LIST_HEAD(&fusb300->gadget.ep_list);
+
+        for (i = 0; i < FUSB300_MAX_NUM_EP ; i++) {
+                struct fusb300_ep *ep = fusb300->ep[i];
+
+                if (i != 0) {
+                        INIT_LIST_HEAD(&fusb300->ep[i]->ep.ep_list);
+                        list_add_tail(&fusb300->ep[i]->ep.ep_list,
+                                     &fusb300->gadget.ep_list);
+                }
+                ep->fusb300 = fusb300;
+                INIT_LIST_HEAD(&ep->queue);
+                ep->ep.name = fusb300_ep_name[i];
+                ep->ep.ops = &fusb300_ep_ops;
+                ep->ep.maxpacket = HS_BULK_MAX_PACKET_SIZE;
+        }
+        fusb300->ep[0]->ep.maxpacket = HS_CTL_MAX_PACKET_SIZE;
+        fusb300->ep[0]->epnum = 0;
+        fusb300->gadget.ep0 = &fusb300->ep[0]->ep;
+        INIT_LIST_HEAD(&fusb300->gadget.ep0->ep_list);
+
+        the_controller = fusb300;
+
+        fusb300->ep0_req = fusb300_alloc_request(&fusb300->ep[0]->ep,
+                                GFP_KERNEL);
+        if (fusb300->ep0_req == NULL)
+                goto clean_up3;
+
+        init_controller(fusb300);
+        dev_info(&pdev->dev, "version %s\n", DRIVER_VERSION);
+
+        return 0;
+
+clean_up3:
+        free_irq(ires->start, fusb300);
+
+clean_up:
+        if (fusb300) {
+                if (fusb300->ep0_req)
+                        fusb300_free_request(&fusb300->ep[0]->ep,
+                                fusb300->ep0_req);
+                kfree(fusb300);
+        }
+        if (reg)
+                iounmap(reg);
+
+        return ret;
+}
+
+static struct platform_driver fusb300_driver = {
+        .remove =       __exit_p(fusb300_remove),
+        .driver         = {
+                .name = (char *) udc_name,
+                .owner  = THIS_MODULE,
+        },
+};
+
+static int __init fusb300_udc_init(void)
+{
+        return platform_driver_probe(&fusb300_driver, fusb300_probe);
+}
+
+module_init(fusb300_udc_init);
+
+static void __exit fusb300_udc_cleanup(void)
+{
+        platform_driver_unregister(&fusb300_driver);
+}
+module_exit(fusb300_udc_cleanup);
diff --git a/drivers/usb/gadget/fusb300_udc.h b/drivers/usb/gadget/fusb300_udc.h
new file mode 100644
index 000000000000..f51aa2ef1f90
--- /dev/null
+++ b/drivers/usb/gadget/fusb300_udc.h
@@ -0,0 +1,687 @@
+/*
+ * Fusb300 UDC (USB gadget)
+ *
+ * Copyright (C) 2010 Faraday Technology Corp.
+ *
+ * Author : Yuan-hsin Chen <yhchen@faraday-tech.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+
+#ifndef __FUSB300_UDC_H__
+#define __FUSB300_UDC_H_
+
+#include <linux/kernel.h>
+
+#define FUSB300_OFFSET_GCR              0x00
+#define FUSB300_OFFSET_GTM              0x04
+#define FUSB300_OFFSET_DAR              0x08
+#define FUSB300_OFFSET_CSR              0x0C
+#define FUSB300_OFFSET_CXPORT           0x10
+#define FUSB300_OFFSET_EPSET0(n)        (0x20 + (n - 1) * 0x30)
+#define FUSB300_OFFSET_EPSET1(n)        (0x24 + (n - 1) * 0x30)
+#define FUSB300_OFFSET_EPSET2(n)        (0x28 + (n - 1) * 0x30)
+#define FUSB300_OFFSET_EPFFR(n)         (0x2c + (n - 1) * 0x30)
+#define FUSB300_OFFSET_EPSTRID(n)       (0x40 + (n - 1) * 0x30)
+#define FUSB300_OFFSET_HSPTM            0x300
+#define FUSB300_OFFSET_HSCR             0x304
+#define FUSB300_OFFSET_SSCR0            0x308
+#define FUSB300_OFFSET_SSCR1            0x30C
+#define FUSB300_OFFSET_TT               0x310
+#define FUSB300_OFFSET_DEVNOTF          0x314
+#define FUSB300_OFFSET_DNC1             0x318
+#define FUSB300_OFFSET_CS               0x31C
+#define FUSB300_OFFSET_SOF              0x324
+#define FUSB300_OFFSET_EFCS             0x328
+#define FUSB300_OFFSET_IGR0             0x400
+#define FUSB300_OFFSET_IGR1             0x404
+#define FUSB300_OFFSET_IGR2             0x408
+#define FUSB300_OFFSET_IGR3             0x40C
+#define FUSB300_OFFSET_IGR4             0x410
+#define FUSB300_OFFSET_IGR5             0x414
+#define FUSB300_OFFSET_IGER0            0x420
+#define FUSB300_OFFSET_IGER1            0x424
+#define FUSB300_OFFSET_IGER2            0x428
+#define FUSB300_OFFSET_IGER3            0x42C
+#define FUSB300_OFFSET_IGER4            0x430
+#define FUSB300_OFFSET_IGER5            0x434
+#define FUSB300_OFFSET_DMAHMER          0x500
+#define FUSB300_OFFSET_EPPRDRDY         0x504
+#define FUSB300_OFFSET_DMAEPMR          0x508
+#define FUSB300_OFFSET_DMAENR           0x50C
+#define FUSB300_OFFSET_DMAAPR           0x510
+#define FUSB300_OFFSET_AHBCR            0x514
+#define FUSB300_OFFSET_EPPRD_W0(n)      (0x520 + (n - 1) * 0x10)
+#define FUSB300_OFFSET_EPPRD_W1(n)      (0x524 + (n - 1) * 0x10)
+#define FUSB300_OFFSET_EPPRD_W2(n)      (0x528 + (n - 1) * 0x10)
+#define FUSB300_OFFSET_EPRD_PTR(n)      (0x52C + (n - 1) * 0x10)
+#define FUSB300_OFFSET_BUFDBG_START     0x800
+#define FUSB300_OFFSET_BUFDBG_END       0xBFC
+#define FUSB300_OFFSET_EPPORT(n)        (0x1010 + (n - 1) * 0x10)
+
+/*
+ * *    Global Control Register (offset = 000H)
+ * */
+#define FUSB300_GCR_SF_RST              (1 << 8)
+#define FUSB300_GCR_VBUS_STATUS         (1 << 7)
+#define FUSB300_GCR_FORCE_HS_SUSP       (1 << 6)
+#define FUSB300_GCR_SYNC_FIFO1_CLR      (1 << 5)
+#define FUSB300_GCR_SYNC_FIFO0_CLR      (1 << 4)
+#define FUSB300_GCR_FIFOCLR             (1 << 3)
+#define FUSB300_GCR_GLINTEN             (1 << 2)
+#define FUSB300_GCR_DEVEN_FS            0x3
+#define FUSB300_GCR_DEVEN_HS            0x2
+#define FUSB300_GCR_DEVEN_SS            0x1
+#define FUSB300_GCR_DEVDIS              0x0
+#define FUSB300_GCR_DEVEN_MSK           0x3
+
+
+/*
+ * *Global Test Mode (offset = 004H)
+ * */
+#define FUSB300_GTM_TST_DIS_SOFGEN      (1 << 16)
+#define FUSB300_GTM_TST_CUR_EP_ENTRY(n) ((n & 0xF) << 12)
+#define FUSB300_GTM_TST_EP_ENTRY(n)     ((n & 0xF) << 8)
+#define FUSB300_GTM_TST_EP_NUM(n)       ((n & 0xF) << 4)
+#define FUSB300_GTM_TST_FIFO_DEG        (1 << 1)
+#define FUSB300_GTM_TSTMODE             (1 << 0)
+
+/*
+ * * Device Address Register (offset = 008H)
+ * */
+#define FUSB300_DAR_SETCONFG    (1 << 7)
+#define FUSB300_DAR_DRVADDR(x)  (x & 0x7F)
+#define FUSB300_DAR_DRVADDR_MSK 0x7F
+
+/*
+ * *Control Transfer Configuration and Status Register
+ * (CX_Config_Status, offset = 00CH)
+ * */
+#define FUSB300_CSR_LEN(x)      ((x & 0xFFFF) << 8)
+#define FUSB300_CSR_LEN_MSK     (0xFFFF << 8)
+#define FUSB300_CSR_EMP         (1 << 4)
+#define FUSB300_CSR_FUL         (1 << 3)
+#define FUSB300_CSR_CLR         (1 << 2)
+#define FUSB300_CSR_STL         (1 << 1)
+#define FUSB300_CSR_DONE        (1 << 0)
+
+/*
+ * * EPn Setting 0 (EPn_SET0, offset = 020H+(n-1)*30H, n=1~15 )
+ * */
+#define FUSB300_EPSET0_CLRSEQNUM        (1 << 2)
+#define FUSB300_EPSET0_EPn_TX0BYTE      (1 << 1)
+#define FUSB300_EPSET0_STL              (1 << 0)
+
+/*
+ * * EPn Setting 1 (EPn_SET1, offset = 024H+(n-1)*30H, n=1~15)
+ * */
+#define FUSB300_EPSET1_START_ENTRY(x)   ((x & 0xFF) << 24)
+#define FUSB300_EPSET1_START_ENTRY_MSK  (0xFF << 24)
+#define FUSB300_EPSET1_FIFOENTRY(x)     ((x & 0x1F) << 12)
+#define FUSB300_EPSET1_FIFOENTRY_MSK    (0x1f << 12)
+#define FUSB300_EPSET1_INTERVAL(x)      ((x & 0x7) << 6)
+#define FUSB300_EPSET1_BWNUM(x)         ((x & 0x3) << 4)
+#define FUSB300_EPSET1_TYPEISO          (1 << 2)
+#define FUSB300_EPSET1_TYPEBLK          (2 << 2)
+#define FUSB300_EPSET1_TYPEINT          (3 << 2)
+#define FUSB300_EPSET1_TYPE(x)          ((x & 0x3) << 2)
+#define FUSB300_EPSET1_TYPE_MSK         (0x3 << 2)
+#define FUSB300_EPSET1_DIROUT           (0 << 1)
+#define FUSB300_EPSET1_DIRIN            (1 << 1)
+#define FUSB300_EPSET1_DIR(x)           ((x & 0x1) << 1)
+#define FUSB300_EPSET1_DIRIN            (1 << 1)
+#define FUSB300_EPSET1_DIR_MSK          ((0x1) << 1)
+#define FUSB300_EPSET1_ACTDIS           0
+#define FUSB300_EPSET1_ACTEN            1
+
+/*
+ * *EPn Setting 2 (EPn_SET2, offset = 028H+(n-1)*30H, n=1~15)
+ * */
+#define FUSB300_EPSET2_ADDROFS(x)       ((x & 0x7FFF) << 16)
+#define FUSB300_EPSET2_ADDROFS_MSK      (0x7fff << 16)
+#define FUSB300_EPSET2_MPS(x)           (x & 0x7FF)
+#define FUSB300_EPSET2_MPS_MSK          0x7FF
+
+/*
+ * * EPn FIFO Register (offset = 2cH+(n-1)*30H)
+ * */
+#define FUSB300_FFR_RST         (1 << 31)
+#define FUSB300_FF_FUL          (1 << 30)
+#define FUSB300_FF_EMPTY        (1 << 29)
+#define FUSB300_FFR_BYCNT       0x1FFFF
+
+/*
+ * *EPn Stream ID (EPn_STR_ID, offset = 040H+(n-1)*30H, n=1~15)
+ * */
+#define FUSB300_STRID_STREN     (1 << 16)
+#define FUSB300_STRID_STRID(x)  (x & 0xFFFF)
+
+/*
+ * *HS PHY Test Mode (offset = 300H)
+ * */
+#define FUSB300_HSPTM_TSTPKDONE         (1 << 4)
+#define FUSB300_HSPTM_TSTPKT            (1 << 3)
+#define FUSB300_HSPTM_TSTSET0NAK        (1 << 2)
+#define FUSB300_HSPTM_TSTKSTA           (1 << 1)
+#define FUSB300_HSPTM_TSTJSTA           (1 << 0)
+
+/*
+ * *HS Control Register (offset = 304H)
+ * */
+#define FUSB300_HSCR_HS_LPM_PERMIT      (1 << 8)
+#define FUSB300_HSCR_HS_LPM_RMWKUP      (1 << 7)
+#define FUSB300_HSCR_CAP_LPM_RMWKUP     (1 << 6)
+#define FUSB300_HSCR_HS_GOSUSP          (1 << 5)
+#define FUSB300_HSCR_HS_GORMWKU         (1 << 4)
+#define FUSB300_HSCR_CAP_RMWKUP         (1 << 3)
+#define FUSB300_HSCR_IDLECNT_0MS        0
+#define FUSB300_HSCR_IDLECNT_1MS        1
+#define FUSB300_HSCR_IDLECNT_2MS        2
+#define FUSB300_HSCR_IDLECNT_3MS        3
+#define FUSB300_HSCR_IDLECNT_4MS        4
+#define FUSB300_HSCR_IDLECNT_5MS        5
+#define FUSB300_HSCR_IDLECNT_6MS        6
+#define FUSB300_HSCR_IDLECNT_7MS        7
+
+/*
+ * * SS Controller Register 0 (offset = 308H)
+ * */
+#define FUSB300_SSCR0_MAX_INTERVAL(x)   ((x & 0x7) << 4)
+#define FUSB300_SSCR0_U2_FUN_EN         (1 << 1)
+#define FUSB300_SSCR0_U1_FUN_EN         (1 << 0)
+
+/*
+ * * SS Controller Register 1 (offset = 30CH)
+ * */
+#define FUSB300_SSCR1_GO_U3_DONE        (1 << 8)
+#define FUSB300_SSCR1_TXDEEMPH_LEVEL    (1 << 7)
+#define FUSB300_SSCR1_DIS_SCRMB         (1 << 6)
+#define FUSB300_SSCR1_FORCE_RECOVERY    (1 << 5)
+#define FUSB300_SSCR1_U3_WAKEUP_EN      (1 << 4)
+#define FUSB300_SSCR1_U2_EXIT_EN        (1 << 3)
+#define FUSB300_SSCR1_U1_EXIT_EN        (1 << 2)
+#define FUSB300_SSCR1_U2_ENTRY_EN       (1 << 1)
+#define FUSB300_SSCR1_U1_ENTRY_EN       (1 << 0)
+
+/*
+ * *SS Controller Register 2  (offset = 310H)
+ * */
+#define FUSB300_SSCR2_SS_TX_SWING               (1 << 25)
+#define FUSB300_SSCR2_FORCE_LINKPM_ACCEPT       (1 << 24)
+#define FUSB300_SSCR2_U2_INACT_TIMEOUT(x)       ((x & 0xFF) << 16)
+#define FUSB300_SSCR2_U1TIMEOUT(x)              ((x & 0xFF) << 8)
+#define FUSB300_SSCR2_U2TIMEOUT(x)              (x & 0xFF)
+
+/*
+ * *SS Device Notification Control (DEV_NOTF, offset = 314H)
+ * */
+#define FUSB300_DEVNOTF_CONTEXT0(x)             ((x & 0xFFFFFF) << 8)
+#define FUSB300_DEVNOTF_TYPE_DIS                0
+#define FUSB300_DEVNOTF_TYPE_FUNCWAKE           1
+#define FUSB300_DEVNOTF_TYPE_LTM                2
+#define FUSB300_DEVNOTF_TYPE_BUSINT_ADJMSG      3
+
+/*
+ * *BFM Arbiter Priority Register (BFM_ARB offset = 31CH)
+ * */
+#define FUSB300_BFMARB_ARB_M1   (1 << 3)
+#define FUSB300_BFMARB_ARB_M0   (1 << 2)
+#define FUSB300_BFMARB_ARB_S1   (1 << 1)
+#define FUSB300_BFMARB_ARB_S0   1
+
+/*
+ * *Vendor Specific IO Control Register (offset = 320H)
+ * */
+#define FUSB300_VSIC_VCTLOAD_N  (1 << 8)
+#define FUSB300_VSIC_VCTL(x)    (x & 0x3F)
+
+/*
+ * *SOF Mask Timer (offset = 324H)
+ * */
+#define FUSB300_SOF_MASK_TIMER_HS       0x044c
+#define FUSB300_SOF_MASK_TIMER_FS       0x2710
+
+/*
+ * *Error Flag and Control Status (offset = 328H)
+ * */
+#define FUSB300_EFCS_PM_STATE_U3        3
+#define FUSB300_EFCS_PM_STATE_U2        2
+#define FUSB300_EFCS_PM_STATE_U1        1
+#define FUSB300_EFCS_PM_STATE_U0        0
+
+/*
+ * *Interrupt Group 0 Register (offset = 400H)
+ * */
+#define FUSB300_IGR0_EP15_PRD_INT       (1 << 31)
+#define FUSB300_IGR0_EP14_PRD_INT       (1 << 30)
+#define FUSB300_IGR0_EP13_PRD_INT       (1 << 29)
+#define FUSB300_IGR0_EP12_PRD_INT       (1 << 28)
+#define FUSB300_IGR0_EP11_PRD_INT       (1 << 27)
+#define FUSB300_IGR0_EP10_PRD_INT       (1 << 26)
+#define FUSB300_IGR0_EP9_PRD_INT        (1 << 25)
+#define FUSB300_IGR0_EP8_PRD_INT        (1 << 24)
+#define FUSB300_IGR0_EP7_PRD_INT        (1 << 23)
+#define FUSB300_IGR0_EP6_PRD_INT        (1 << 22)
+#define FUSB300_IGR0_EP5_PRD_INT        (1 << 21)
+#define FUSB300_IGR0_EP4_PRD_INT        (1 << 20)
+#define FUSB300_IGR0_EP3_PRD_INT        (1 << 19)
+#define FUSB300_IGR0_EP2_PRD_INT        (1 << 18)
+#define FUSB300_IGR0_EP1_PRD_INT        (1 << 17)
+#define FUSB300_IGR0_EPn_PRD_INT(n)     (1 << (n + 16))
+
+#define FUSB300_IGR0_EP15_FIFO_INT      (1 << 15)
+#define FUSB300_IGR0_EP14_FIFO_INT      (1 << 14)
+#define FUSB300_IGR0_EP13_FIFO_INT      (1 << 13)
+#define FUSB300_IGR0_EP12_FIFO_INT      (1 << 12)
+#define FUSB300_IGR0_EP11_FIFO_INT      (1 << 11)
+#define FUSB300_IGR0_EP10_FIFO_INT      (1 << 10)
+#define FUSB300_IGR0_EP9_FIFO_INT       (1 << 9)
+#define FUSB300_IGR0_EP8_FIFO_INT       (1 << 8)
+#define FUSB300_IGR0_EP7_FIFO_INT       (1 << 7)
+#define FUSB300_IGR0_EP6_FIFO_INT       (1 << 6)
+#define FUSB300_IGR0_EP5_FIFO_INT       (1 << 5)
+#define FUSB300_IGR0_EP4_FIFO_INT       (1 << 4)
+#define FUSB300_IGR0_EP3_FIFO_INT       (1 << 3)
+#define FUSB300_IGR0_EP2_FIFO_INT       (1 << 2)
+#define FUSB300_IGR0_EP1_FIFO_INT       (1 << 1)
+#define FUSB300_IGR0_EPn_FIFO_INT(n)    (1 << n)
+
+/*
+ * *Interrupt Group 1 Register (offset = 404H)
+ * */
+#define FUSB300_IGR1_INTGRP5            (1 << 31)
+#define FUSB300_IGR1_VBUS_CHG_INT       (1 << 30)
+#define FUSB300_IGR1_SYNF1_EMPTY_INT    (1 << 29)
+#define FUSB300_IGR1_SYNF0_EMPTY_INT    (1 << 28)
+#define FUSB300_IGR1_U3_EXIT_FAIL_INT   (1 << 27)
+#define FUSB300_IGR1_U2_EXIT_FAIL_INT   (1 << 26)
+#define FUSB300_IGR1_U1_EXIT_FAIL_INT   (1 << 25)
+#define FUSB300_IGR1_U2_ENTRY_FAIL_INT  (1 << 24)
+#define FUSB300_IGR1_U1_ENTRY_FAIL_INT  (1 << 23)
+#define FUSB300_IGR1_U3_EXIT_INT        (1 << 22)
+#define FUSB300_IGR1_U2_EXIT_INT        (1 << 21)
+#define FUSB300_IGR1_U1_EXIT_INT        (1 << 20)
+#define FUSB300_IGR1_U3_ENTRY_INT       (1 << 19)
+#define FUSB300_IGR1_U2_ENTRY_INT       (1 << 18)
+#define FUSB300_IGR1_U1_ENTRY_INT       (1 << 17)
+#define FUSB300_IGR1_HOT_RST_INT        (1 << 16)
+#define FUSB300_IGR1_WARM_RST_INT       (1 << 15)
+#define FUSB300_IGR1_RESM_INT           (1 << 14)
+#define FUSB300_IGR1_SUSP_INT           (1 << 13)
+#define FUSB300_IGR1_HS_LPM_INT         (1 << 12)
+#define FUSB300_IGR1_USBRST_INT         (1 << 11)
+#define FUSB300_IGR1_DEV_MODE_CHG_INT   (1 << 9)
+#define FUSB300_IGR1_CX_COMABT_INT      (1 << 8)
+#define FUSB300_IGR1_CX_COMFAIL_INT     (1 << 7)
+#define FUSB300_IGR1_CX_CMDEND_INT      (1 << 6)
+#define FUSB300_IGR1_CX_OUT_INT         (1 << 5)
+#define FUSB300_IGR1_CX_IN_INT          (1 << 4)
+#define FUSB300_IGR1_CX_SETUP_INT       (1 << 3)
+#define FUSB300_IGR1_INTGRP4            (1 << 2)
+#define FUSB300_IGR1_INTGRP3            (1 << 1)
+#define FUSB300_IGR1_INTGRP2            (1 << 0)
+
+/*
+ * *Interrupt Group 2 Register (offset = 408H)
+ * */
+#define FUSB300_IGR2_EP6_STR_ACCEPT_INT         (1 << 29)
+#define FUSB300_IGR2_EP6_STR_RESUME_INT         (1 << 28)
+#define FUSB300_IGR2_EP6_STR_REQ_INT            (1 << 27)
+#define FUSB300_IGR2_EP6_STR_NOTRDY_INT         (1 << 26)
+#define FUSB300_IGR2_EP6_STR_PRIME_INT          (1 << 25)
+#define FUSB300_IGR2_EP5_STR_ACCEPT_INT         (1 << 24)
+#define FUSB300_IGR2_EP5_STR_RESUME_INT         (1 << 23)
+#define FUSB300_IGR2_EP5_STR_REQ_INT            (1 << 22)
+#define FUSB300_IGR2_EP5_STR_NOTRDY_INT         (1 << 21)
+#define FUSB300_IGR2_EP5_STR_PRIME_INT          (1 << 20)
+#define FUSB300_IGR2_EP4_STR_ACCEPT_INT         (1 << 19)
+#define FUSB300_IGR2_EP4_STR_RESUME_INT         (1 << 18)
+#define FUSB300_IGR2_EP4_STR_REQ_INT            (1 << 17)
+#define FUSB300_IGR2_EP4_STR_NOTRDY_INT         (1 << 16)
+#define FUSB300_IGR2_EP4_STR_PRIME_INT          (1 << 15)
+#define FUSB300_IGR2_EP3_STR_ACCEPT_INT         (1 << 14)
+#define FUSB300_IGR2_EP3_STR_RESUME_INT         (1 << 13)
+#define FUSB300_IGR2_EP3_STR_REQ_INT            (1 << 12)
+#define FUSB300_IGR2_EP3_STR_NOTRDY_INT         (1 << 11)
+#define FUSB300_IGR2_EP3_STR_PRIME_INT          (1 << 10)
+#define FUSB300_IGR2_EP2_STR_ACCEPT_INT         (1 << 9)
+#define FUSB300_IGR2_EP2_STR_RESUME_INT         (1 << 8)
+#define FUSB300_IGR2_EP2_STR_REQ_INT            (1 << 7)
+#define FUSB300_IGR2_EP2_STR_NOTRDY_INT         (1 << 6)
+#define FUSB300_IGR2_EP2_STR_PRIME_INT          (1 << 5)
+#define FUSB300_IGR2_EP1_STR_ACCEPT_INT         (1 << 4)
+#define FUSB300_IGR2_EP1_STR_RESUME_INT         (1 << 3)
+#define FUSB300_IGR2_EP1_STR_REQ_INT            (1 << 2)
+#define FUSB300_IGR2_EP1_STR_NOTRDY_INT         (1 << 1)
+#define FUSB300_IGR2_EP1_STR_PRIME_INT          (1 << 0)
+
+#define FUSB300_IGR2_EP_STR_ACCEPT_INT(n)       (1 << (5 * n - 1))
+#define FUSB300_IGR2_EP_STR_RESUME_INT(n)       (1 << (5 * n - 2))
+#define FUSB300_IGR2_EP_STR_REQ_INT(n)          (1 << (5 * n - 3))
+#define FUSB300_IGR2_EP_STR_NOTRDY_INT(n)       (1 << (5 * n - 4))
+#define FUSB300_IGR2_EP_STR_PRIME_INT(n)        (1 << (5 * n - 5))
+
+/*
+ * *Interrupt Group 3 Register (offset = 40CH)
+ * */
+#define FUSB300_IGR3_EP12_STR_ACCEPT_INT        (1 << 29)
+#define FUSB300_IGR3_EP12_STR_RESUME_INT        (1 << 28)
+#define FUSB300_IGR3_EP12_STR_REQ_INT           (1 << 27)
+#define FUSB300_IGR3_EP12_STR_NOTRDY_INT        (1 << 26)
+#define FUSB300_IGR3_EP12_STR_PRIME_INT         (1 << 25)
+#define FUSB300_IGR3_EP11_STR_ACCEPT_INT        (1 << 24)
+#define FUSB300_IGR3_EP11_STR_RESUME_INT        (1 << 23)
+#define FUSB300_IGR3_EP11_STR_REQ_INT           (1 << 22)
+#define FUSB300_IGR3_EP11_STR_NOTRDY_INT        (1 << 21)
+#define FUSB300_IGR3_EP11_STR_PRIME_INT         (1 << 20)
+#define FUSB300_IGR3_EP10_STR_ACCEPT_INT        (1 << 19)
+#define FUSB300_IGR3_EP10_STR_RESUME_INT        (1 << 18)
+#define FUSB300_IGR3_EP10_STR_REQ_INT           (1 << 17)
+#define FUSB300_IGR3_EP10_STR_NOTRDY_INT        (1 << 16)
+#define FUSB300_IGR3_EP10_STR_PRIME_INT         (1 << 15)
+#define FUSB300_IGR3_EP9_STR_ACCEPT_INT         (1 << 14)
+#define FUSB300_IGR3_EP9_STR_RESUME_INT         (1 << 13)
+#define FUSB300_IGR3_EP9_STR_REQ_INT            (1 << 12)
+#define FUSB300_IGR3_EP9_STR_NOTRDY_INT         (1 << 11)
+#define FUSB300_IGR3_EP9_STR_PRIME_INT          (1 << 10)
+#define FUSB300_IGR3_EP8_STR_ACCEPT_INT         (1 << 9)
+#define FUSB300_IGR3_EP8_STR_RESUME_INT         (1 << 8)
+#define FUSB300_IGR3_EP8_STR_REQ_INT            (1 << 7)
+#define FUSB300_IGR3_EP8_STR_NOTRDY_INT         (1 << 6)
+#define FUSB300_IGR3_EP8_STR_PRIME_INT          (1 << 5)
+#define FUSB300_IGR3_EP7_STR_ACCEPT_INT         (1 << 4)
+#define FUSB300_IGR3_EP7_STR_RESUME_INT         (1 << 3)
+#define FUSB300_IGR3_EP7_STR_REQ_INT            (1 << 2)
+#define FUSB300_IGR3_EP7_STR_NOTRDY_INT         (1 << 1)
+#define FUSB300_IGR3_EP7_STR_PRIME_INT          (1 << 0)
+
+#define FUSB300_IGR3_EP_STR_ACCEPT_INT(n)       (1 << (5 * (n - 6) - 1))
+#define FUSB300_IGR3_EP_STR_RESUME_INT(n)       (1 << (5 * (n - 6) - 2))
+#define FUSB300_IGR3_EP_STR_REQ_INT(n)          (1 << (5 * (n - 6) - 3))
+#define FUSB300_IGR3_EP_STR_NOTRDY_INT(n)       (1 << (5 * (n - 6) - 4))
+#define FUSB300_IGR3_EP_STR_PRIME_INT(n)        (1 << (5 * (n - 6) - 5))
+
+/*
+ * *Interrupt Group 4 Register (offset = 410H)
+ * */
+#define FUSB300_IGR4_EP15_RX0_INT               (1 << 31)
+#define FUSB300_IGR4_EP14_RX0_INT               (1 << 30)
+#define FUSB300_IGR4_EP13_RX0_INT               (1 << 29)
+#define FUSB300_IGR4_EP12_RX0_INT               (1 << 28)
+#define FUSB300_IGR4_EP11_RX0_INT               (1 << 27)
+#define FUSB300_IGR4_EP10_RX0_INT               (1 << 26)
+#define FUSB300_IGR4_EP9_RX0_INT                (1 << 25)
+#define FUSB300_IGR4_EP8_RX0_INT                (1 << 24)
+#define FUSB300_IGR4_EP7_RX0_INT                (1 << 23)
+#define FUSB300_IGR4_EP6_RX0_INT                (1 << 22)
+#define FUSB300_IGR4_EP5_RX0_INT                (1 << 21)
+#define FUSB300_IGR4_EP4_RX0_INT                (1 << 20)
+#define FUSB300_IGR4_EP3_RX0_INT                (1 << 19)
+#define FUSB300_IGR4_EP2_RX0_INT                (1 << 18)
+#define FUSB300_IGR4_EP1_RX0_INT                (1 << 17)
+#define FUSB300_IGR4_EP_RX0_INT(x)              (1 << (x + 16))
+#define FUSB300_IGR4_EP15_STR_ACCEPT_INT        (1 << 14)
+#define FUSB300_IGR4_EP15_STR_RESUME_INT        (1 << 13)
+#define FUSB300_IGR4_EP15_STR_REQ_INT           (1 << 12)
+#define FUSB300_IGR4_EP15_STR_NOTRDY_INT        (1 << 11)
+#define FUSB300_IGR4_EP15_STR_PRIME_INT         (1 << 10)
+#define FUSB300_IGR4_EP14_STR_ACCEPT_INT        (1 << 9)
+#define FUSB300_IGR4_EP14_STR_RESUME_INT        (1 << 8)
+#define FUSB300_IGR4_EP14_STR_REQ_INT           (1 << 7)
+#define FUSB300_IGR4_EP14_STR_NOTRDY_INT        (1 << 6)
+#define FUSB300_IGR4_EP14_STR_PRIME_INT         (1 << 5)
+#define FUSB300_IGR4_EP13_STR_ACCEPT_INT        (1 << 4)
+#define FUSB300_IGR4_EP13_STR_RESUME_INT        (1 << 3)
+#define FUSB300_IGR4_EP13_STR_REQ_INT           (1 << 2)
+#define FUSB300_IGR4_EP13_STR_NOTRDY_INT        (1 << 1)
+#define FUSB300_IGR4_EP13_STR_PRIME_INT         (1 << 0)
+
+#define FUSB300_IGR4_EP_STR_ACCEPT_INT(n)       (1 << (5 * (n - 12) - 1))
+#define FUSB300_IGR4_EP_STR_RESUME_INT(n)       (1 << (5 * (n - 12) - 2))
+#define FUSB300_IGR4_EP_STR_REQ_INT(n)          (1 << (5 * (n - 12) - 3))
+#define FUSB300_IGR4_EP_STR_NOTRDY_INT(n)       (1 << (5 * (n - 12) - 4))
+#define FUSB300_IGR4_EP_STR_PRIME_INT(n)        (1 << (5 * (n - 12) - 5))
+
+/*
+ * *Interrupt Group 5 Register (offset = 414H)
+ * */
+#define FUSB300_IGR5_EP_STL_INT(n)      (1 << n)
+
+/*
+ * *Interrupt Enable Group 0 Register (offset = 420H)
+ * */
+#define FUSB300_IGER0_EEP15_PRD_INT     (1 << 31)
+#define FUSB300_IGER0_EEP14_PRD_INT     (1 << 30)
+#define FUSB300_IGER0_EEP13_PRD_INT     (1 << 29)
+#define FUSB300_IGER0_EEP12_PRD_INT     (1 << 28)
+#define FUSB300_IGER0_EEP11_PRD_INT     (1 << 27)
+#define FUSB300_IGER0_EEP10_PRD_INT     (1 << 26)
+#define FUSB300_IGER0_EEP9_PRD_INT      (1 << 25)
+#define FUSB300_IGER0_EP8_PRD_INT       (1 << 24)
+#define FUSB300_IGER0_EEP7_PRD_INT      (1 << 23)
+#define FUSB300_IGER0_EEP6_PRD_INT      (1 << 22)
+#define FUSB300_IGER0_EEP5_PRD_INT      (1 << 21)
+#define FUSB300_IGER0_EEP4_PRD_INT      (1 << 20)
+#define FUSB300_IGER0_EEP3_PRD_INT      (1 << 19)
+#define FUSB300_IGER0_EEP2_PRD_INT      (1 << 18)
+#define FUSB300_IGER0_EEP1_PRD_INT      (1 << 17)
+#define FUSB300_IGER0_EEPn_PRD_INT(n)   (1 << (n + 16))
+
+#define FUSB300_IGER0_EEP15_FIFO_INT    (1 << 15)
+#define FUSB300_IGER0_EEP14_FIFO_INT    (1 << 14)
+#define FUSB300_IGER0_EEP13_FIFO_INT    (1 << 13)
+#define FUSB300_IGER0_EEP12_FIFO_INT    (1 << 12)
+#define FUSB300_IGER0_EEP11_FIFO_INT    (1 << 11)
+#define FUSB300_IGER0_EEP10_FIFO_INT    (1 << 10)
+#define FUSB300_IGER0_EEP9_FIFO_INT     (1 << 9)
+#define FUSB300_IGER0_EEP8_FIFO_INT     (1 << 8)
+#define FUSB300_IGER0_EEP7_FIFO_INT     (1 << 7)
+#define FUSB300_IGER0_EEP6_FIFO_INT     (1 << 6)
+#define FUSB300_IGER0_EEP5_FIFO_INT     (1 << 5)
+#define FUSB300_IGER0_EEP4_FIFO_INT     (1 << 4)
+#define FUSB300_IGER0_EEP3_FIFO_INT     (1 << 3)
+#define FUSB300_IGER0_EEP2_FIFO_INT     (1 << 2)
+#define FUSB300_IGER0_EEP1_FIFO_INT     (1 << 1)
+#define FUSB300_IGER0_EEPn_FIFO_INT(n)  (1 << n)
+
+/*
+ * *Interrupt Enable Group 1 Register (offset = 424H)
+ * */
+#define FUSB300_IGER1_EINT_GRP5         (1 << 31)
+#define FUSB300_IGER1_VBUS_CHG_INT      (1 << 30)
+#define FUSB300_IGER1_SYNF1_EMPTY_INT   (1 << 29)
+#define FUSB300_IGER1_SYNF0_EMPTY_INT   (1 << 28)
+#define FUSB300_IGER1_U3_EXIT_FAIL_INT  (1 << 27)
+#define FUSB300_IGER1_U2_EXIT_FAIL_INT  (1 << 26)
+#define FUSB300_IGER1_U1_EXIT_FAIL_INT  (1 << 25)
+#define FUSB300_IGER1_U2_ENTRY_FAIL_INT (1 << 24)
+#define FUSB300_IGER1_U1_ENTRY_FAIL_INT (1 << 23)
+#define FUSB300_IGER1_U3_EXIT_INT       (1 << 22)
+#define FUSB300_IGER1_U2_EXIT_INT       (1 << 21)
+#define FUSB300_IGER1_U1_EXIT_INT       (1 << 20)
+#define FUSB300_IGER1_U3_ENTRY_INT      (1 << 19)
+#define FUSB300_IGER1_U2_ENTRY_INT      (1 << 18)
+#define FUSB300_IGER1_U1_ENTRY_INT      (1 << 17)
+#define FUSB300_IGER1_HOT_RST_INT       (1 << 16)
+#define FUSB300_IGER1_WARM_RST_INT      (1 << 15)
+#define FUSB300_IGER1_RESM_INT          (1 << 14)
+#define FUSB300_IGER1_SUSP_INT          (1 << 13)
+#define FUSB300_IGER1_LPM_INT           (1 << 12)
+#define FUSB300_IGER1_HS_RST_INT        (1 << 11)
+#define FUSB300_IGER1_EDEV_MODE_CHG_INT (1 << 9)
+#define FUSB300_IGER1_CX_COMABT_INT     (1 << 8)
+#define FUSB300_IGER1_CX_COMFAIL_INT    (1 << 7)
+#define FUSB300_IGER1_CX_CMDEND_INT     (1 << 6)
+#define FUSB300_IGER1_CX_OUT_INT        (1 << 5)
+#define FUSB300_IGER1_CX_IN_INT         (1 << 4)
+#define FUSB300_IGER1_CX_SETUP_INT      (1 << 3)
+#define FUSB300_IGER1_INTGRP4           (1 << 2)
+#define FUSB300_IGER1_INTGRP3           (1 << 1)
+#define FUSB300_IGER1_INTGRP2           (1 << 0)
+
+/*
+ * *Interrupt Enable Group 2 Register (offset = 428H)
+ * */
+#define FUSB300_IGER2_EEP_STR_ACCEPT_INT(n)     (1 << (5 * n - 1))
+#define FUSB300_IGER2_EEP_STR_RESUME_INT(n)     (1 << (5 * n - 2))
+#define FUSB300_IGER2_EEP_STR_REQ_INT(n)        (1 << (5 * n - 3))
+#define FUSB300_IGER2_EEP_STR_NOTRDY_INT(n)     (1 << (5 * n - 4))
+#define FUSB300_IGER2_EEP_STR_PRIME_INT(n)      (1 << (5 * n - 5))
+
+/*
+ * *Interrupt Enable Group 3 Register (offset = 42CH)
+ * */
+
+#define FUSB300_IGER3_EEP_STR_ACCEPT_INT(n)     (1 << (5 * (n - 6) - 1))
+#define FUSB300_IGER3_EEP_STR_RESUME_INT(n)     (1 << (5 * (n - 6) - 2))
+#define FUSB300_IGER3_EEP_STR_REQ_INT(n)        (1 << (5 * (n - 6) - 3))
+#define FUSB300_IGER3_EEP_STR_NOTRDY_INT(n)     (1 << (5 * (n - 6) - 4))
+#define FUSB300_IGER3_EEP_STR_PRIME_INT(n)      (1 << (5 * (n - 6) - 5))
+
+/*
+ * *Interrupt Enable Group 4 Register (offset = 430H)
+ * */
+
+#define FUSB300_IGER4_EEP_RX0_INT(n)            (1 << (n + 16))
+#define FUSB300_IGER4_EEP_STR_ACCEPT_INT(n)     (1 << (5 * (n - 6) - 1))
+#define FUSB300_IGER4_EEP_STR_RESUME_INT(n)     (1 << (5 * (n - 6) - 2))
+#define FUSB300_IGER4_EEP_STR_REQ_INT(n)        (1 << (5 * (n - 6) - 3))
+#define FUSB300_IGER4_EEP_STR_NOTRDY_INT(n)     (1 << (5 * (n - 6) - 4))
+#define FUSB300_IGER4_EEP_STR_PRIME_INT(n)      (1 << (5 * (n - 6) - 5))
+
+/* EP PRD Ready (EP_PRD_RDY, offset = 504H) */
+
+#define FUSB300_EPPRDR_EP15_PRD_RDY             (1 << 15)
+#define FUSB300_EPPRDR_EP14_PRD_RDY             (1 << 14)
+#define FUSB300_EPPRDR_EP13_PRD_RDY             (1 << 13)
+#define FUSB300_EPPRDR_EP12_PRD_RDY             (1 << 12)
+#define FUSB300_EPPRDR_EP11_PRD_RDY             (1 << 11)
+#define FUSB300_EPPRDR_EP10_PRD_RDY             (1 << 10)
+#define FUSB300_EPPRDR_EP9_PRD_RDY              (1 << 9)
+#define FUSB300_EPPRDR_EP8_PRD_RDY              (1 << 8)
+#define FUSB300_EPPRDR_EP7_PRD_RDY              (1 << 7)
+#define FUSB300_EPPRDR_EP6_PRD_RDY              (1 << 6)
+#define FUSB300_EPPRDR_EP5_PRD_RDY              (1 << 5)
+#define FUSB300_EPPRDR_EP4_PRD_RDY              (1 << 4)
+#define FUSB300_EPPRDR_EP3_PRD_RDY              (1 << 3)
+#define FUSB300_EPPRDR_EP2_PRD_RDY              (1 << 2)
+#define FUSB300_EPPRDR_EP1_PRD_RDY              (1 << 1)
+#define FUSB300_EPPRDR_EP_PRD_RDY(n)            (1 << n)
+
+/* AHB Bus Control Register (offset = 514H) */
+#define FUSB300_AHBBCR_S1_SPLIT_ON              (1 << 17)
+#define FUSB300_AHBBCR_S0_SPLIT_ON              (1 << 16)
+#define FUSB300_AHBBCR_S1_1entry                (0 << 12)
+#define FUSB300_AHBBCR_S1_4entry                (3 << 12)
+#define FUSB300_AHBBCR_S1_8entry                (5 << 12)
+#define FUSB300_AHBBCR_S1_16entry               (7 << 12)
+#define FUSB300_AHBBCR_S0_1entry                (0 << 8)
+#define FUSB300_AHBBCR_S0_4entry                (3 << 8)
+#define FUSB300_AHBBCR_S0_8entry                (5 << 8)
+#define FUSB300_AHBBCR_S0_16entry               (7 << 8)
+#define FUSB300_AHBBCR_M1_BURST_SINGLE          (0 << 4)
+#define FUSB300_AHBBCR_M1_BURST_INCR            (1 << 4)
+#define FUSB300_AHBBCR_M1_BURST_INCR4           (3 << 4)
+#define FUSB300_AHBBCR_M1_BURST_INCR8           (5 << 4)
+#define FUSB300_AHBBCR_M1_BURST_INCR16          (7 << 4)
+#define FUSB300_AHBBCR_M0_BURST_SINGLE          0
+#define FUSB300_AHBBCR_M0_BURST_INCR            1
+#define FUSB300_AHBBCR_M0_BURST_INCR4           3
+#define FUSB300_AHBBCR_M0_BURST_INCR8           5
+#define FUSB300_AHBBCR_M0_BURST_INCR16          7
+#define FUSB300_IGER5_EEP_STL_INT(n)            (1 << n)
+
+/* WORD 0 Data Structure of PRD Table */
+#define FUSB300_EPPRD0_M                        (1 << 30)
+#define FUSB300_EPPRD0_O                        (1 << 29)
+/* The finished prd */
+#define FUSB300_EPPRD0_F                        (1 << 28)
+#define FUSB300_EPPRD0_I                        (1 << 27)
+#define FUSB300_EPPRD0_A                        (1 << 26)
+/* To decide HW point to first prd at next time */
+#define FUSB300_EPPRD0_L                        (1 << 25)
+#define FUSB300_EPPRD0_H                        (1 << 24)
+#define FUSB300_EPPRD0_BTC(n)                   (n & 0xFFFFFF)
+
+/*----------------------------------------------------------------------*/
+#define FUSB300_MAX_NUM_EP              16
+
+#define FUSB300_FIFO_ENTRY_NUM          8
+#define FUSB300_MAX_FIFO_ENTRY          8
+
+#define SS_CTL_MAX_PACKET_SIZE          0x200
+#define SS_BULK_MAX_PACKET_SIZE         0x400
+#define SS_INT_MAX_PACKET_SIZE          0x400
+#define SS_ISO_MAX_PACKET_SIZE          0x400
+
+#define HS_BULK_MAX_PACKET_SIZE         0x200
+#define HS_CTL_MAX_PACKET_SIZE          0x40
+#define HS_INT_MAX_PACKET_SIZE          0x400
+#define HS_ISO_MAX_PACKET_SIZE          0x400
+
+struct fusb300_ep_info {
+        u8      epnum;
+        u8      type;
+        u8      interval;
+        u8      dir_in;
+        u16     maxpacket;
+        u16     addrofs;
+        u16     bw_num;
+};
+
+struct fusb300_request {
+
+        struct usb_request      req;
+        struct list_head        queue;
+};
+
+
+struct fusb300_ep {
+        struct usb_ep           ep;
+        struct fusb300          *fusb300;
+
+        struct list_head        queue;
+        unsigned                stall:1;
+        unsigned                wedged:1;
+        unsigned                use_dma:1;
+
+        unsigned char           epnum;
+        unsigned char           type;
+        const struct usb_endpoint_descriptor    *desc;
+};
+
+struct fusb300 {
+        spinlock_t              lock;
+        void __iomem            *reg;
+
+        unsigned long           irq_trigger;
+
+        struct usb_gadget               gadget;
+        struct usb_gadget_driver        *driver;
+
+        struct fusb300_ep       *ep[FUSB300_MAX_NUM_EP];
+
+        struct usb_request      *ep0_req;       /* for internal request */
+        __le16                  ep0_data;
+        u32                     ep0_length;     /* for internal request */
+        u8                      ep0_dir;        /* 0/0x80  out/in */
+
+        u8                      fifo_entry_num; /* next start fifo entry */
+        u32                     addrofs;        /* next fifo address offset */
+        u8                      reenum;         /* if re-enumeration */
+};
+
+#endif
diff --git a/drivers/usb/gadget/g_ffs.c b/drivers/usb/gadget/g_ffs.c
index a9474f8d5325..ebf6970a10bf 100644
--- a/drivers/usb/gadget/g_ffs.c
+++ b/drivers/usb/gadget/g_ffs.c
@@ -1,7 +1,29 @@
+/*
+ * g_ffs.c -- user mode file system API for USB composite function controllers
+ *
+ * Copyright (C) 2010 Samsung Electronics
+ * Author: Michal Nazarewicz <m.nazarewicz@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#define pr_fmt(fmt) "g_ffs: " fmt
+
 #include <linux/module.h>
 #include <linux/utsname.h>
 
-
 /*
  * kbuild is not very cooperative with respect to linking separately
  * compiled library objects into one module.  So for now we won't use
@@ -43,7 +65,6 @@ static int eth_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN]);
 
 #include "f_fs.c"
 
-
 #define DRIVER_NAME     "g_ffs"
 #define DRIVER_DESC     "USB Function Filesystem"
 #define DRIVER_VERSION  "24 Aug 2004"
@@ -52,9 +73,8 @@ MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_AUTHOR("Michal Nazarewicz");
 MODULE_LICENSE("GPL");
 
-
-static unsigned short gfs_vendor_id    = 0x0525;        /* XXX NetChip */
-static unsigned short gfs_product_id   = 0xa4ac;        /* XXX */
+#define GFS_VENDOR_ID   0x1d6b  /* Linux Foundation */
+#define GFS_PRODUCT_ID  0x0105  /* FunctionFS Gadget */
 
 static struct usb_device_descriptor gfs_dev_desc = {
         .bLength                = sizeof gfs_dev_desc,
@@ -63,31 +83,16 @@ static struct usb_device_descriptor gfs_dev_desc = {
         .bcdUSB                 = cpu_to_le16(0x0200),
         .bDeviceClass           = USB_CLASS_PER_INTERFACE,
 
-        /* Vendor and product id can be overridden by module parameters.  */
-        /* .idVendor            = cpu_to_le16(gfs_vendor_id), */
-        /* .idProduct           = cpu_to_le16(gfs_product_id), */
-        /* .bcdDevice           = f(hardware) */
-        /* .iManufacturer       = DYNAMIC */
-        /* .iProduct            = DYNAMIC */
-        /* NO SERIAL NUMBER */
-        .bNumConfigurations     = 1,
+        .idVendor               = cpu_to_le16(GFS_VENDOR_ID),
+        .idProduct              = cpu_to_le16(GFS_PRODUCT_ID),
 };
 
-#define GFS_MODULE_PARAM_DESC(name, field) \
-        MODULE_PARM_DESC(name, "Value of the " #field " field of the device descriptor sent to the host.  Takes effect only prior to the user-space driver registering to the FunctionFS.")
-
-module_param_named(usb_class,    gfs_dev_desc.bDeviceClass,    byte,   0644);
-GFS_MODULE_PARAM_DESC(usb_class, bDeviceClass);
-module_param_named(usb_subclass, gfs_dev_desc.bDeviceSubClass, byte,   0644);
-GFS_MODULE_PARAM_DESC(usb_subclass, bDeviceSubClass);
-module_param_named(usb_protocol, gfs_dev_desc.bDeviceProtocol, byte,   0644);
-GFS_MODULE_PARAM_DESC(usb_protocol, bDeviceProtocol);
-module_param_named(usb_vendor,   gfs_vendor_id,                ushort, 0644);
-GFS_MODULE_PARAM_DESC(usb_vendor, idVendor);
-module_param_named(usb_product,  gfs_product_id,               ushort, 0644);
-GFS_MODULE_PARAM_DESC(usb_product, idProduct);
-
-
+module_param_named(bDeviceClass,    gfs_dev_desc.bDeviceClass,    byte,   0644);
+MODULE_PARM_DESC(bDeviceClass, "USB Device class");
+module_param_named(bDeviceSubClass, gfs_dev_desc.bDeviceSubClass, byte,   0644);
+MODULE_PARM_DESC(bDeviceSubClass, "USB Device subclass");
+module_param_named(bDeviceProtocol, gfs_dev_desc.bDeviceProtocol, byte,   0644);
+MODULE_PARM_DESC(bDeviceProtocol, "USB Device protocol");
 
 static const struct usb_descriptor_header *gfs_otg_desc[] = {
         (const struct usb_descriptor_header *)
@@ -95,29 +100,18 @@ static const struct usb_descriptor_header *gfs_otg_desc[] = {
                 .bLength                = sizeof(struct usb_otg_descriptor),
                 .bDescriptorType        = USB_DT_OTG,
 
-                /* REVISIT SRP-only hardware is possible, although
-                 * it would not be called "OTG" ... */
+                /*
+                 * REVISIT SRP-only hardware is possible, although
+                 * it would not be called "OTG" ...
+                 */
                 .bmAttributes           = USB_OTG_SRP | USB_OTG_HNP,
         },
 
         NULL
 };
 
-/* string IDs are assigned dynamically */
-
-enum {
-        GFS_STRING_MANUFACTURER_IDX,
-        GFS_STRING_PRODUCT_IDX,
-        GFS_STRING_FIRST_CONFIG_IDX,
-};
-
-static       char gfs_manufacturer[50];
-static const char gfs_driver_desc[] = DRIVER_DESC;
-static const char gfs_short_name[]  = DRIVER_NAME;
-
+/* String IDs are assigned dynamically */
 static struct usb_string gfs_strings[] = {
-        [GFS_STRING_MANUFACTURER_IDX].s = gfs_manufacturer,
-        [GFS_STRING_PRODUCT_IDX].s = gfs_driver_desc,
 #ifdef CONFIG_USB_FUNCTIONFS_RNDIS
         { .s = "FunctionFS + RNDIS" },
 #endif
@@ -138,8 +132,6 @@ static struct usb_gadget_strings *gfs_dev_strings[] = {
         NULL,
 };
 
-
-
 struct gfs_configuration {
         struct usb_configuration c;
         int (*eth)(struct usb_configuration *c, u8 *ethaddr);
@@ -162,24 +154,21 @@ struct gfs_configuration {
 #endif
 };
 
-
 static int gfs_bind(struct usb_composite_dev *cdev);
 static int gfs_unbind(struct usb_composite_dev *cdev);
 static int gfs_do_config(struct usb_configuration *c);
 
 static struct usb_composite_driver gfs_driver = {
-        .name           = gfs_short_name,
+        .name           = DRIVER_NAME,
         .dev            = &gfs_dev_desc,
         .strings        = gfs_dev_strings,
-        .bind           = gfs_bind,
         .unbind         = gfs_unbind,
+        .iProduct       = DRIVER_DESC,
 };
 
-
 static struct ffs_data *gfs_ffs_data;
 static unsigned long gfs_registered;
 
-
 static int  gfs_init(void)
 {
         ENTER();
@@ -199,7 +188,6 @@ static void  gfs_exit(void)
 }
 module_exit(gfs_exit);
 
-
 static int functionfs_ready_callback(struct ffs_data *ffs)
 {
         int ret;
@@ -210,7 +198,7 @@ static int functionfs_ready_callback(struct ffs_data *ffs)
                 return -EBUSY;
 
         gfs_ffs_data = ffs;
-        ret = usb_composite_register(&gfs_driver);
+        ret = usb_composite_probe(&gfs_driver, gfs_bind);
         if (unlikely(ret < 0))
                 clear_bit(0, &gfs_registered);
         return ret;
@@ -224,14 +212,11 @@ static void functionfs_closed_callback(struct ffs_data *ffs)
                 usb_composite_unregister(&gfs_driver);
 }
 
-
 static int functionfs_check_dev_callback(const char *dev_name)
 {
         return 0;
 }
 
-
-
 static int gfs_bind(struct usb_composite_dev *cdev)
 {
         int ret, i;
@@ -245,20 +230,10 @@ static int gfs_bind(struct usb_composite_dev *cdev)
         if (unlikely(ret < 0))
                 goto error_quick;
 
-        gfs_dev_desc.idVendor  = cpu_to_le16(gfs_vendor_id);
-        gfs_dev_desc.idProduct = cpu_to_le16(gfs_product_id);
-
-        snprintf(gfs_manufacturer, sizeof gfs_manufacturer, "%s %s with %s",
-                 init_utsname()->sysname, init_utsname()->release,
-                 cdev->gadget->name);
-
         ret = usb_string_ids_tab(cdev, gfs_strings);
         if (unlikely(ret < 0))
                 goto error;
 
-        gfs_dev_desc.iManufacturer = gfs_strings[GFS_STRING_MANUFACTURER_IDX].id;
-        gfs_dev_desc.iProduct      = gfs_strings[GFS_STRING_PRODUCT_IDX].id;
-
         ret = functionfs_bind(gfs_ffs_data, cdev);
         if (unlikely(ret < 0))
                 goto error;
@@ -266,14 +241,12 @@ static int gfs_bind(struct usb_composite_dev *cdev)
         for (i = 0; i < ARRAY_SIZE(gfs_configurations); ++i) {
                 struct gfs_configuration *c = gfs_configurations + i;
 
-                ret = GFS_STRING_FIRST_CONFIG_IDX + i;
-                c->c.label                      = gfs_strings[ret].s;
-                c->c.iConfiguration             = gfs_strings[ret].id;
-                c->c.bind                       = gfs_do_config;
+                c->c.label                      = gfs_strings[i].s;
+                c->c.iConfiguration             = gfs_strings[i].id;
                 c->c.bConfigurationValue        = 1 + i;
                 c->c.bmAttributes               = USB_CONFIG_ATT_SELFPOWER;
 
-                ret = usb_add_config(cdev, &c->c);
+                ret = usb_add_config(cdev, &c->c, gfs_do_config);
                 if (unlikely(ret < 0))
                         goto error_unbind;
         }
@@ -293,13 +266,14 @@ static int gfs_unbind(struct usb_composite_dev *cdev)
 {
         ENTER();
 
-        /* We may have been called in an error recovery frem
+        /*
+         * We may have been called in an error recovery from
          * composite_bind() after gfs_unbind() failure so we need to
          * check if gfs_ffs_data is not NULL since gfs_bind() handles
          * all error recovery itself.  I'd rather we werent called
          * from composite on orror recovery, but what you're gonna
-         * do...? */
-
+         * do...?
+         */
         if (gfs_ffs_data) {
                 gether_cleanup();
                 functionfs_unbind(gfs_ffs_data);
@@ -309,7 +283,6 @@ static int gfs_unbind(struct usb_composite_dev *cdev)
         return 0;
 }
 
-
 static int gfs_do_config(struct usb_configuration *c)
 {
         struct gfs_configuration *gc =
@@ -334,26 +307,29 @@ static int gfs_do_config(struct usb_configuration *c)
         if (unlikely(ret < 0))
                 return ret;
 
-        /* After previous do_configs there may be some invalid
+        /*
+         * After previous do_configs there may be some invalid
          * pointers in c->interface array.  This happens every time
          * a user space function with fewer interfaces than a user
          * space function that was run before the new one is run.  The
          * compasit's set_config() assumes that if there is no more
          * then MAX_CONFIG_INTERFACES interfaces in a configuration
          * then there is a NULL pointer after the last interface in
-         * c->interface array.  We need to make sure this is true. */
+         * c->interface array.  We need to make sure this is true.
+         */
         if (c->next_interface_id < ARRAY_SIZE(c->interface))
                 c->interface[c->next_interface_id] = NULL;
 
         return 0;
 }
 
-
 #ifdef CONFIG_USB_FUNCTIONFS_ETH
+
 static int eth_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN])
 {
         return can_support_ecm(c->cdev->gadget)
                 ? ecm_bind_config(c, ethaddr)
                 : geth_bind_config(c, ethaddr);
 }
+
 #endif
diff --git a/drivers/usb/gadget/gadget_chips.h b/drivers/usb/gadget/gadget_chips.h
index e511fec9f26d..bcdac7c73e89 100644
--- a/drivers/usb/gadget/gadget_chips.h
+++ b/drivers/usb/gadget/gadget_chips.h
@@ -45,12 +45,6 @@
 #define gadget_is_goku(g)       0
 #endif
 
-#ifdef CONFIG_USB_GADGET_LH7A40X
-#define gadget_is_lh7a40x(g)    !strcmp("lh7a40x_udc", (g)->name)
-#else
-#define gadget_is_lh7a40x(g)    0
-#endif
-
 #ifdef CONFIG_USB_GADGET_OMAP
 #define gadget_is_omap(g)       !strcmp("omap_udc", (g)->name)
 #else
@@ -96,7 +90,7 @@
 
 /* Mentor high speed "dual role" controller, in peripheral role */
 #ifdef CONFIG_USB_GADGET_MUSB_HDRC
-#define gadget_is_musbhdrc(g)   !strcmp("musb_hdrc", (g)->name)
+#define gadget_is_musbhdrc(g)   !strcmp("musb-hdrc", (g)->name)
 #else
 #define gadget_is_musbhdrc(g)   0
 #endif
@@ -120,10 +114,10 @@
 #define gadget_is_fsl_qe(g)     0
 #endif
 
-#ifdef CONFIG_USB_GADGET_CI13XXX
-#define gadget_is_ci13xxx(g)    (!strcmp("ci13xxx_udc", (g)->name))
+#ifdef CONFIG_USB_GADGET_CI13XXX_PCI
+#define gadget_is_ci13xxx_pci(g)        (!strcmp("ci13xxx_pci", (g)->name))
 #else
-#define gadget_is_ci13xxx(g)    0
+#define gadget_is_ci13xxx_pci(g)        0
 #endif
 
 // CONFIG_USB_GADGET_SX2
@@ -142,6 +136,29 @@
 #define gadget_is_s3c_hsotg(g)    0
 #endif
 
+#ifdef CONFIG_USB_S3C_HSUDC
+#define gadget_is_s3c_hsudc(g) (!strcmp("s3c-hsudc", (g)->name))
+#else
+#define gadget_is_s3c_hsudc(g) 0
+#endif
+
+#ifdef CONFIG_USB_GADGET_EG20T
+#define gadget_is_pch(g)        (!strcmp("pch_udc", (g)->name))
+#else
+#define gadget_is_pch(g)        0
+#endif
+
+#ifdef CONFIG_USB_GADGET_CI13XXX_MSM
+#define gadget_is_ci13xxx_msm(g)        (!strcmp("ci13xxx_msm", (g)->name))
+#else
+#define gadget_is_ci13xxx_msm(g)        0
+#endif
+
+#ifdef CONFIG_USB_GADGET_RENESAS_USBHS
+#define gadget_is_renesas_usbhs(g) (!strcmp("renesas_usbhs_udc", (g)->name))
+#else
+#define gadget_is_renesas_usbhs(g) 0
+#endif
 
 /**
  * usb_gadget_controller_number - support bcdDevice id convention
@@ -170,8 +187,6 @@ static inline int usb_gadget_controller_number(struct usb_gadget *gadget)
                 return 0x06;
         else if (gadget_is_omap(gadget))
                 return 0x08;
-        else if (gadget_is_lh7a40x(gadget))
-                return 0x09;
         else if (gadget_is_pxa27x(gadget))
                 return 0x11;
         else if (gadget_is_s3c2410(gadget))
@@ -192,7 +207,7 @@ static inline int usb_gadget_controller_number(struct usb_gadget *gadget)
                 return 0x21;
         else if (gadget_is_fsl_qe(gadget))
                 return 0x22;
-        else if (gadget_is_ci13xxx(gadget))
+        else if (gadget_is_ci13xxx_pci(gadget))
                 return 0x23;
         else if (gadget_is_langwell(gadget))
                 return 0x24;
@@ -200,6 +215,15 @@ static inline int usb_gadget_controller_number(struct usb_gadget *gadget)
                 return 0x25;
         else if (gadget_is_s3c_hsotg(gadget))
                 return 0x26;
+        else if (gadget_is_pch(gadget))
+                return 0x27;
+        else if (gadget_is_ci13xxx_msm(gadget))
+                return 0x28;
+        else if (gadget_is_renesas_usbhs(gadget))
+                return 0x29;
+        else if (gadget_is_s3c_hsudc(gadget))
+                return 0x30;
+
         return -ENOENT;
 }
 
diff --git a/drivers/usb/gadget/gmidi.c b/drivers/usb/gadget/gmidi.c
index 1b413a5cc3f6..47b86b99d449 100644
--- a/drivers/usb/gadget/gmidi.c
+++ b/drivers/usb/gadget/gmidi.c
@@ -67,7 +67,7 @@ MODULE_PARM_DESC(index, "Index value for the USB MIDI Gadget adapter.");
 module_param(id, charp, 0444);
 MODULE_PARM_DESC(id, "ID string for the USB MIDI Gadget adapter.");
 
-/* Some systems will want different product identifers published in the
+/* Some systems will want different product identifiers published in the
  * device descriptor, either numbers or strings or both.  These string
  * parameters are in UTF-8 (superset of ASCII's 7 bit characters).
  */
@@ -1157,7 +1157,7 @@ fail:
 /*
  * Creates an output endpoint, and initializes output ports.
  */
-static int __ref gmidi_bind(struct usb_gadget *gadget)
+static int __init gmidi_bind(struct usb_gadget *gadget)
 {
         struct gmidi_device *dev;
         struct usb_ep *in_ep, *out_ep;
@@ -1292,7 +1292,6 @@ static void gmidi_resume(struct usb_gadget *gadget)
 static struct usb_gadget_driver gmidi_driver = {
         .speed          = USB_SPEED_FULL,
         .function       = (char *)longname,
-        .bind           = gmidi_bind,
         .unbind         = gmidi_unbind,
 
         .setup          = gmidi_setup,
@@ -1309,7 +1308,7 @@ static struct usb_gadget_driver gmidi_driver = {
 
 static int __init gmidi_init(void)
 {
-        return usb_gadget_register_driver(&gmidi_driver);
+        return usb_gadget_probe_driver(&gmidi_driver, gmidi_bind);
 }
 module_init(gmidi_init);
 
diff --git a/drivers/usb/gadget/goku_udc.c b/drivers/usb/gadget/goku_udc.c
index 1088d08c7ed8..bf6e11c758d5 100644
--- a/drivers/usb/gadget/goku_udc.c
+++ b/drivers/usb/gadget/goku_udc.c
@@ -38,6 +38,7 @@
 #include <linux/device.h>
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
+#include <linux/prefetch.h>
 
 #include <asm/byteorder.h>
 #include <asm/io.h>
@@ -1343,14 +1344,15 @@ static struct goku_udc	*the_controller;
  * disconnect is reported.  then a host may connect again, or
  * the driver might get unbound.
  */
-int usb_gadget_register_driver(struct usb_gadget_driver *driver)
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
 {
         struct goku_udc *dev = the_controller;
         int                     retval;
 
         if (!driver
                         || driver->speed < USB_SPEED_FULL
-                        || !driver->bind
+                        || !bind
                         || !driver->disconnect
                         || !driver->setup)
                 return -EINVAL;
@@ -1363,7 +1365,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
         driver->driver.bus = NULL;
         dev->driver = driver;
         dev->gadget.dev.driver = &driver->driver;
-        retval = driver->bind(&dev->gadget);
+        retval = bind(&dev->gadget);
         if (retval) {
                 DBG(dev, "bind to driver %s --> error %d\n",
                                 driver->driver.name, retval);
@@ -1380,7 +1382,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
         DBG(dev, "registered gadget driver '%s'\n", driver->driver.name);
         return 0;
 }
-EXPORT_SYMBOL(usb_gadget_register_driver);
+EXPORT_SYMBOL(usb_gadget_probe_driver);
 
 static void
 stop_activity(struct goku_udc *dev, struct usb_gadget_driver *driver)
@@ -1744,7 +1746,8 @@ static void goku_remove(struct pci_dev *pdev)
                                 pci_resource_len (pdev, 0));
         if (dev->enabled)
                 pci_disable_device(pdev);
-        device_unregister(&dev->gadget.dev);
+        if (dev->registered)
+                device_unregister(&dev->gadget.dev);
 
         pci_set_drvdata(pdev, NULL);
         dev->regs = NULL;
@@ -1774,7 +1777,7 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         if (!pdev->irq) {
                 printk(KERN_ERR "Check PCI %s IRQ setup!\n", pci_name(pdev));
                 retval = -ENODEV;
-                goto done;
+                goto err;
         }
 
         /* alloc, and start init */
@@ -1782,7 +1785,7 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         if (dev == NULL){
                 pr_debug("enomem %s\n", pci_name(pdev));
                 retval = -ENOMEM;
-                goto done;
+                goto err;
         }
 
         spin_lock_init(&dev->lock);
@@ -1800,7 +1803,7 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         retval = pci_enable_device(pdev);
         if (retval < 0) {
                 DBG(dev, "can't enable, %d\n", retval);
-                goto done;
+                goto err;
         }
         dev->enabled = 1;
 
@@ -1809,7 +1812,7 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         if (!request_mem_region(resource, len, driver_name)) {
                 DBG(dev, "controller already in use\n");
                 retval = -EBUSY;
-                goto done;
+                goto err;
         }
         dev->got_region = 1;
 
@@ -1817,7 +1820,7 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         if (base == NULL) {
                 DBG(dev, "can't map memory\n");
                 retval = -EFAULT;
-                goto done;
+                goto err;
         }
         dev->regs = (struct goku_udc_regs __iomem *) base;
 
@@ -1833,7 +1836,7 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                         driver_name, dev) != 0) {
                 DBG(dev, "request interrupt %d failed\n", pdev->irq);
                 retval = -EBUSY;
-                goto done;
+                goto err;
         }
         dev->got_irq = 1;
         if (use_dma)
@@ -1844,13 +1847,16 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         create_proc_read_entry(proc_node_name, 0, NULL, udc_proc_read, dev);
 #endif
 
-        /* done */
         the_controller = dev;
         retval = device_register(&dev->gadget.dev);
-        if (retval == 0)
-                return 0;
+        if (retval) {
+                put_device(&dev->gadget.dev);
+                goto err;
+        }
+        dev->registered = 1;
+        return 0;
 
-done:
+err:
         if (dev)
                 goku_remove (pdev);
         return retval;
diff --git a/drivers/usb/gadget/goku_udc.h b/drivers/usb/gadget/goku_udc.h
index 566cb2319056..e7e0c69d3b1f 100644
--- a/drivers/usb/gadget/goku_udc.h
+++ b/drivers/usb/gadget/goku_udc.h
@@ -251,7 +251,8 @@ struct goku_udc {
                                         got_region:1,
                                         req_config:1,
                                         configured:1,
-                                        enabled:1;
+                                        enabled:1,
+                                        registered:1;
 
         /* pci state used to access those endpoints */
         struct pci_dev                  *pdev;
diff --git a/drivers/usb/gadget/hid.c b/drivers/usb/gadget/hid.c
index 735495bf8411..2523e54097bd 100644
--- a/drivers/usb/gadget/hid.c
+++ b/drivers/usb/gadget/hid.c
@@ -127,7 +127,7 @@ static struct usb_gadget_strings *dev_strings[] = {
 
 /****************************** Configurations ******************************/
 
-static int __ref do_config(struct usb_configuration *c)
+static int __init do_config(struct usb_configuration *c)
 {
         struct hidg_func_node *e;
         int func = 0, status = 0;
@@ -148,7 +148,6 @@ static int __ref do_config(struct usb_configuration *c)
 
 static struct usb_configuration config_driver = {
         .label                  = "HID Gadget",
-        .bind                   = do_config,
         .bConfigurationValue    = 1,
         /* .iConfiguration = DYNAMIC */
         .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
@@ -156,7 +155,7 @@ static struct usb_configuration config_driver = {
 
 /****************************** Gadget Bind ******************************/
 
-static int __ref hid_bind(struct usb_composite_dev *cdev)
+static int __init hid_bind(struct usb_composite_dev *cdev)
 {
         struct usb_gadget *gadget = cdev->gadget;
         struct list_head *tmp;
@@ -201,7 +200,7 @@ static int __ref hid_bind(struct usb_composite_dev *cdev)
         device_desc.iProduct = status;
 
         /* register our configuration */
-        status = usb_add_config(cdev, &config_driver);
+        status = usb_add_config(cdev, &config_driver, do_config);
         if (status < 0)
                 return status;
 
@@ -256,7 +255,6 @@ static struct usb_composite_driver hidg_driver = {
         .name           = "g_hid",
         .dev            = &device_desc,
         .strings        = dev_strings,
-        .bind           = hid_bind,
         .unbind         = __exit_p(hid_unbind),
 };
 
@@ -282,7 +280,7 @@ static int __init hidg_init(void)
         if (status < 0)
                 return status;
 
-        status = usb_composite_register(&hidg_driver);
+        status = usb_composite_probe(&hidg_driver, hid_bind);
         if (status < 0)
                 platform_driver_unregister(&hidg_plat_driver);
 
diff --git a/drivers/usb/gadget/imx_udc.c b/drivers/usb/gadget/imx_udc.c
index e743122fcd93..ade40066decf 100644
--- a/drivers/usb/gadget/imx_udc.c
+++ b/drivers/usb/gadget/imx_udc.c
@@ -30,6 +30,7 @@
 #include <linux/delay.h>
 #include <linux/timer.h>
 #include <linux/slab.h>
+#include <linux/prefetch.h>
 
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
@@ -1191,13 +1192,17 @@ static irqreturn_t imx_udc_ctrl_irq(int irq, void *dev)
         return IRQ_HANDLED;
 }
 
+#ifndef MX1_INT_USBD0
+#define MX1_INT_USBD0 MX1_USBD_INT0
+#endif
+
 static irqreturn_t imx_udc_bulk_irq(int irq, void *dev)
 {
         struct imx_udc_struct *imx_usb = dev;
-        struct imx_ep_struct *imx_ep = &imx_usb->imx_ep[irq - USBD_INT0];
+        struct imx_ep_struct *imx_ep = &imx_usb->imx_ep[irq - MX1_INT_USBD0];
         int intr = __raw_readl(imx_usb->base + USB_EP_INTR(EP_NO(imx_ep)));
 
-        dump_ep_intr(__func__, irq - USBD_INT0, intr, imx_usb->dev);
+        dump_ep_intr(__func__, irq - MX1_INT_USBD0, intr, imx_usb->dev);
 
         if (!imx_usb->driver) {
                 __raw_writel(intr, imx_usb->base + USB_EP_INTR(EP_NO(imx_ep)));
@@ -1316,17 +1321,18 @@ static struct imx_udc_struct controller = {
 };
 
 /*******************************************************************************
- * USB gadged driver functions
+ * USB gadget driver functions
  *******************************************************************************
  */
-int usb_gadget_register_driver(struct usb_gadget_driver *driver)
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
 {
         struct imx_udc_struct *imx_usb = &controller;
         int retval;
 
         if (!driver
                 || driver->speed < USB_SPEED_FULL
-                || !driver->bind
+                || !bind
                 || !driver->disconnect
                 || !driver->setup)
                         return -EINVAL;
@@ -1342,7 +1348,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
         retval = device_add(&imx_usb->gadget.dev);
         if (retval)
                 goto fail;
-        retval = driver->bind(&imx_usb->gadget);
+        retval = bind(&imx_usb->gadget);
         if (retval) {
                 D_ERR(imx_usb->dev, "<%s> bind to driver %s --> error %d\n",
                         __func__, driver->driver.name, retval);
@@ -1362,7 +1368,7 @@ fail:
         imx_usb->gadget.dev.driver = NULL;
         return retval;
 }
-EXPORT_SYMBOL(usb_gadget_register_driver);
+EXPORT_SYMBOL(usb_gadget_probe_driver);
 
 int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
 {
diff --git a/drivers/usb/gadget/imx_udc.h b/drivers/usb/gadget/imx_udc.h
index b48ad59603d1..7136c242b4ec 100644
--- a/drivers/usb/gadget/imx_udc.h
+++ b/drivers/usb/gadget/imx_udc.h
@@ -23,9 +23,6 @@
 /* Helper macros */
 #define EP_NO(ep)       ((ep->bEndpointAddress) & ~USB_DIR_IN) /* IN:1, OUT:0 */
 #define EP_DIR(ep)      ((ep->bEndpointAddress) & USB_DIR_IN ? 1 : 0)
-#define irq_to_ep(irq)  (((irq) >= USBD_INT0) || ((irq) <= USBD_INT6) \
-                ? ((irq) - USBD_INT0) : (USBD_INT6)) /*should not happen*/
-#define ep_to_irq(ep)   (EP_NO((ep)) + USBD_INT0)
 #define IMX_USB_NB_EP   6
 
 /* Driver structures */
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index fc35406fc80c..a56876aaf76c 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -33,7 +33,6 @@
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/poll.h>
-#include <linux/smp_lock.h>
 
 #include <linux/device.h>
 #include <linux/moduleparam.h>
@@ -387,8 +386,10 @@ ep_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
 
         /* halt any endpoint by doing a "wrong direction" i/o call */
         if (usb_endpoint_dir_in(&data->desc)) {
-                if (usb_endpoint_xfer_isoc(&data->desc))
+                if (usb_endpoint_xfer_isoc(&data->desc)) {
+                        mutex_unlock(&data->lock);
                         return -EINVAL;
+                }
                 DBG (data->dev, "%s halt\n", data->name);
                 spin_lock_irq (&data->dev->lock);
                 if (likely (data->ep != NULL))
@@ -430,8 +431,10 @@ ep_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
 
         /* halt any endpoint by doing a "wrong direction" i/o call */
         if (!usb_endpoint_dir_in(&data->desc)) {
-                if (usb_endpoint_xfer_isoc(&data->desc))
+                if (usb_endpoint_xfer_isoc(&data->desc)) {
+                        mutex_unlock(&data->lock);
                         return -EINVAL;
+                }
                 DBG (data->dev, "%s halt\n", data->name);
                 spin_lock_irq (&data->dev->lock);
                 if (likely (data->ep != NULL))
@@ -1775,7 +1778,6 @@ static struct usb_gadget_driver gadgetfs_driver = {
         .speed          = USB_SPEED_FULL,
 #endif
         .function       = (char *) driver_desc,
-        .bind           = gadgetfs_bind,
         .unbind         = gadgetfs_unbind,
         .setup          = gadgetfs_setup,
         .disconnect     = gadgetfs_disconnect,
@@ -1798,7 +1800,6 @@ static int gadgetfs_probe (struct usb_gadget *gadget)
 
 static struct usb_gadget_driver probe_driver = {
         .speed          = USB_SPEED_HIGH,
-        .bind           = gadgetfs_probe,
         .unbind         = gadgetfs_nop,
         .setup          = (void *)gadgetfs_nop,
         .disconnect     = gadgetfs_nop,
@@ -1908,7 +1909,7 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
 
         /* triggers gadgetfs_bind(); then we can enumerate. */
         spin_unlock_irq (&dev->lock);
-        value = usb_gadget_register_driver (&gadgetfs_driver);
+        value = usb_gadget_probe_driver(&gadgetfs_driver, gadgetfs_bind);
         if (value != 0) {
                 kfree (dev->buf);
                 dev->buf = NULL;
@@ -1994,6 +1995,7 @@ gadgetfs_make_inode (struct super_block *sb,
         struct inode *inode = new_inode (sb);
 
         if (inode) {
+                inode->i_ino = get_next_ino();
                 inode->i_mode = mode;
                 inode->i_uid = default_uid;
                 inode->i_gid = default_gid;
@@ -2047,7 +2049,7 @@ gadgetfs_fill_super (struct super_block *sb, void *opts, int silent)
                 return -ESRCH;
 
         /* fake probe to determine $CHIP */
-        (void) usb_gadget_register_driver (&probe_driver);
+        (void) usb_gadget_probe_driver(&probe_driver, gadgetfs_probe);
         if (!CHIP)
                 return -ENODEV;
 
@@ -2099,11 +2101,11 @@ enomem0:
 }
 
 /* "mount -t gadgetfs path /dev/gadget" ends up here */
-static int
-gadgetfs_get_sb (struct file_system_type *t, int flags,
-                const char *path, void *opts, struct vfsmount *mnt)
+static struct dentry *
+gadgetfs_mount (struct file_system_type *t, int flags,
+                const char *path, void *opts)
 {
-        return get_sb_single (t, flags, opts, gadgetfs_fill_super, mnt);
+        return mount_single (t, flags, opts, gadgetfs_fill_super);
 }
 
 static void
@@ -2121,7 +2123,7 @@ gadgetfs_kill_sb (struct super_block *sb)
 static struct file_system_type gadgetfs_type = {
         .owner          = THIS_MODULE,
         .name           = shortname,
-        .get_sb         = gadgetfs_get_sb,
+        .mount          = gadgetfs_mount,
         .kill_sb        = gadgetfs_kill_sb,
 };
 
diff --git a/drivers/usb/gadget/langwell_udc.c b/drivers/usb/gadget/langwell_udc.c
index c2d2a201f84b..9cee88a43a73 100644
--- a/drivers/usb/gadget/langwell_udc.c
+++ b/drivers/usb/gadget/langwell_udc.c
@@ -19,7 +19,7 @@
 
 
 /* #undef       DEBUG */
-/* #undef       VERBOSE */
+/* #undef       VERBOSE_DEBUG */
 
 #if defined(CONFIG_USB_LANGWELL_OTG)
 #define OTG_TRANSCEIVER
@@ -77,141 +77,110 @@ langwell_ep0_desc = {
 /*-------------------------------------------------------------------------*/
 /* debugging */
 
-#ifdef  DEBUG
-#define DBG(dev, fmt, args...) \
-        pr_debug("%s %s: " fmt , driver_name, \
-                        pci_name(dev->pdev), ## args)
-#else
-#define DBG(dev, fmt, args...) \
-        do { } while (0)
-#endif /* DEBUG */
-
-
-#ifdef  VERBOSE
-#define VDBG DBG
-#else
-#define VDBG(dev, fmt, args...) \
-        do { } while (0)
-#endif  /* VERBOSE */
-
-
-#define ERROR(dev, fmt, args...) \
-        pr_err("%s %s: " fmt , driver_name, \
-                        pci_name(dev->pdev), ## args)
-
-#define WARNING(dev, fmt, args...) \
-        pr_warning("%s %s: " fmt , driver_name, \
-                        pci_name(dev->pdev), ## args)
-
-#define INFO(dev, fmt, args...) \
-        pr_info("%s %s: " fmt , driver_name, \
-                        pci_name(dev->pdev), ## args)
-
-
-#ifdef  VERBOSE
+#ifdef  VERBOSE_DEBUG
 static inline void print_all_registers(struct langwell_udc *dev)
 {
         int     i;
 
         /* Capability Registers */
-        printk(KERN_DEBUG "Capability Registers (offset: "
-                        "0x%04x, length: 0x%08x)\n",
-                        CAP_REG_OFFSET,
-                        (u32)sizeof(struct langwell_cap_regs));
-        printk(KERN_DEBUG "caplength=0x%02x\n",
+        dev_dbg(&dev->pdev->dev,
+                "Capability Registers (offset: 0x%04x, length: 0x%08x)\n",
+                CAP_REG_OFFSET, (u32)sizeof(struct langwell_cap_regs));
+        dev_dbg(&dev->pdev->dev, "caplength=0x%02x\n",
                         readb(&dev->cap_regs->caplength));
-        printk(KERN_DEBUG "hciversion=0x%04x\n",
+        dev_dbg(&dev->pdev->dev, "hciversion=0x%04x\n",
                         readw(&dev->cap_regs->hciversion));
-        printk(KERN_DEBUG "hcsparams=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "hcsparams=0x%08x\n",
                         readl(&dev->cap_regs->hcsparams));
-        printk(KERN_DEBUG "hccparams=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "hccparams=0x%08x\n",
                         readl(&dev->cap_regs->hccparams));
-        printk(KERN_DEBUG "dciversion=0x%04x\n",
+        dev_dbg(&dev->pdev->dev, "dciversion=0x%04x\n",
                         readw(&dev->cap_regs->dciversion));
-        printk(KERN_DEBUG "dccparams=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "dccparams=0x%08x\n",
                         readl(&dev->cap_regs->dccparams));
 
         /* Operational Registers */
-        printk(KERN_DEBUG "Operational Registers (offset: "
-                        "0x%04x, length: 0x%08x)\n",
-                        OP_REG_OFFSET,
-                        (u32)sizeof(struct langwell_op_regs));
-        printk(KERN_DEBUG "extsts=0x%08x\n",
+        dev_dbg(&dev->pdev->dev,
+                "Operational Registers (offset: 0x%04x, length: 0x%08x)\n",
+                OP_REG_OFFSET, (u32)sizeof(struct langwell_op_regs));
+        dev_dbg(&dev->pdev->dev, "extsts=0x%08x\n",
                         readl(&dev->op_regs->extsts));
-        printk(KERN_DEBUG "extintr=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "extintr=0x%08x\n",
                         readl(&dev->op_regs->extintr));
-        printk(KERN_DEBUG "usbcmd=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "usbcmd=0x%08x\n",
                         readl(&dev->op_regs->usbcmd));
-        printk(KERN_DEBUG "usbsts=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "usbsts=0x%08x\n",
                         readl(&dev->op_regs->usbsts));
-        printk(KERN_DEBUG "usbintr=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "usbintr=0x%08x\n",
                         readl(&dev->op_regs->usbintr));
-        printk(KERN_DEBUG "frindex=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "frindex=0x%08x\n",
                         readl(&dev->op_regs->frindex));
-        printk(KERN_DEBUG "ctrldssegment=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "ctrldssegment=0x%08x\n",
                         readl(&dev->op_regs->ctrldssegment));
-        printk(KERN_DEBUG "deviceaddr=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "deviceaddr=0x%08x\n",
                         readl(&dev->op_regs->deviceaddr));
-        printk(KERN_DEBUG "endpointlistaddr=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "endpointlistaddr=0x%08x\n",
                         readl(&dev->op_regs->endpointlistaddr));
-        printk(KERN_DEBUG "ttctrl=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "ttctrl=0x%08x\n",
                         readl(&dev->op_regs->ttctrl));
-        printk(KERN_DEBUG "burstsize=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "burstsize=0x%08x\n",
                         readl(&dev->op_regs->burstsize));
-        printk(KERN_DEBUG "txfilltuning=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "txfilltuning=0x%08x\n",
                         readl(&dev->op_regs->txfilltuning));
-        printk(KERN_DEBUG "txttfilltuning=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "txttfilltuning=0x%08x\n",
                         readl(&dev->op_regs->txttfilltuning));
-        printk(KERN_DEBUG "ic_usb=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "ic_usb=0x%08x\n",
                         readl(&dev->op_regs->ic_usb));
-        printk(KERN_DEBUG "ulpi_viewport=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "ulpi_viewport=0x%08x\n",
                         readl(&dev->op_regs->ulpi_viewport));
-        printk(KERN_DEBUG "configflag=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "configflag=0x%08x\n",
                         readl(&dev->op_regs->configflag));
-        printk(KERN_DEBUG "portsc1=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "portsc1=0x%08x\n",
                         readl(&dev->op_regs->portsc1));
-        printk(KERN_DEBUG "devlc=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "devlc=0x%08x\n",
                         readl(&dev->op_regs->devlc));
-        printk(KERN_DEBUG "otgsc=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "otgsc=0x%08x\n",
                         readl(&dev->op_regs->otgsc));
-        printk(KERN_DEBUG "usbmode=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "usbmode=0x%08x\n",
                         readl(&dev->op_regs->usbmode));
-        printk(KERN_DEBUG "endptnak=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "endptnak=0x%08x\n",
                         readl(&dev->op_regs->endptnak));
-        printk(KERN_DEBUG "endptnaken=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "endptnaken=0x%08x\n",
                         readl(&dev->op_regs->endptnaken));
-        printk(KERN_DEBUG "endptsetupstat=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "endptsetupstat=0x%08x\n",
                         readl(&dev->op_regs->endptsetupstat));
-        printk(KERN_DEBUG "endptprime=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "endptprime=0x%08x\n",
                         readl(&dev->op_regs->endptprime));
-        printk(KERN_DEBUG "endptflush=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "endptflush=0x%08x\n",
                         readl(&dev->op_regs->endptflush));
-        printk(KERN_DEBUG "endptstat=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "endptstat=0x%08x\n",
                         readl(&dev->op_regs->endptstat));
-        printk(KERN_DEBUG "endptcomplete=0x%08x\n",
+        dev_dbg(&dev->pdev->dev, "endptcomplete=0x%08x\n",
                         readl(&dev->op_regs->endptcomplete));
 
         for (i = 0; i < dev->ep_max / 2; i++) {
-                printk(KERN_DEBUG "endptctrl[%d]=0x%08x\n",
+                dev_dbg(&dev->pdev->dev, "endptctrl[%d]=0x%08x\n",
                                 i, readl(&dev->op_regs->endptctrl[i]));
         }
 }
-#endif /* VERBOSE */
+#else
+
+#define print_all_registers(dev)        do { } while (0)
+
+#endif /* VERBOSE_DEBUG */
 
 
 /*-------------------------------------------------------------------------*/
 
-#define DIR_STRING(bAddress)    (((bAddress) & USB_DIR_IN) ? "in" : "out")
+#define is_in(ep)       (((ep)->ep_num == 0) ? ((ep)->dev->ep0_dir ==   \
+                        USB_DIR_IN) : (usb_endpoint_dir_in((ep)->desc)))
 
-#define is_in(ep)       (((ep)->ep_num == 0) ? ((ep)->dev->ep0_dir == \
-                        USB_DIR_IN) : ((ep)->desc->bEndpointAddress \
-                        & USB_DIR_IN) == USB_DIR_IN)
+#define DIR_STRING(ep)  (is_in(ep) ? "in" : "out")
 
 
-#ifdef  DEBUG
-static char *type_string(u8 bmAttributes)
+static char *type_string(const struct usb_endpoint_descriptor *desc)
 {
-        switch ((bmAttributes) & USB_ENDPOINT_XFERTYPE_MASK) {
+        switch (usb_endpoint_type(desc)) {
         case USB_ENDPOINT_XFER_BULK:
                 return "bulk";
         case USB_ENDPOINT_XFER_ISOC:
@@ -222,7 +191,6 @@ static char *type_string(u8 bmAttributes)
 
         return "control";
 }
-#endif
 
 
 /* configure endpoint control registers */
@@ -233,7 +201,7 @@ static void ep_reset(struct langwell_ep *ep, unsigned char ep_num,
         u32                     endptctrl;
 
         dev = ep->dev;
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         endptctrl = readl(&dev->op_regs->endptctrl[ep_num]);
         if (is_in) {    /* TX */
@@ -250,7 +218,7 @@ static void ep_reset(struct langwell_ep *ep, unsigned char ep_num,
 
         writel(endptctrl, &dev->op_regs->endptctrl[ep_num]);
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 
@@ -260,7 +228,7 @@ static void ep0_reset(struct langwell_udc *dev)
         struct langwell_ep      *ep;
         int                     i;
 
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         /* ep0 in and out */
         for (i = 0; i < 2; i++) {
@@ -274,17 +242,18 @@ static void ep0_reset(struct langwell_udc *dev)
                 ep->dqh->dqh_ios = 1;
                 ep->dqh->dqh_mpl = EP0_MAX_PKT_SIZE;
 
-                /* FIXME: enable ep0-in HW zero length termination select */
+                /* enable ep0-in HW zero length termination select */
                 if (is_in(ep))
                         ep->dqh->dqh_zlt = 0;
                 ep->dqh->dqh_mult = 0;
 
+                ep->dqh->dtd_next = DTD_TERM;
+
                 /* configure ep0 control registers */
                 ep_reset(&dev->ep[0], 0, i, USB_ENDPOINT_XFER_CONTROL);
         }
 
-        VDBG(dev, "<--- %s()\n", __func__);
-        return;
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 
@@ -300,12 +269,12 @@ static int langwell_ep_enable(struct usb_ep *_ep,
         struct langwell_ep      *ep;
         u16                     max = 0;
         unsigned long           flags;
-        int                     retval = 0;
+        int                     i, retval = 0;
         unsigned char           zlt, ios = 0, mult = 0;
 
         ep = container_of(_ep, struct langwell_ep, ep);
         dev = ep->dev;
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         if (!_ep || !desc || ep->desc
                         || desc->bDescriptorType != USB_DT_ENDPOINT)
@@ -326,7 +295,7 @@ static int langwell_ep_enable(struct usb_ep *_ep,
          * sanity check type, direction, address, and then
          * initialize the endpoint capabilities fields in dQH
          */
-        switch (desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
+        switch (usb_endpoint_type(desc)) {
         case USB_ENDPOINT_XFER_CONTROL:
                 ios = 1;
                 break;
@@ -386,33 +355,36 @@ static int langwell_ep_enable(struct usb_ep *_ep,
 
         spin_lock_irqsave(&dev->lock, flags);
 
-        /* configure endpoint capabilities in dQH */
-        ep->dqh->dqh_ios = ios;
-        ep->dqh->dqh_mpl = cpu_to_le16(max);
-        ep->dqh->dqh_zlt = zlt;
-        ep->dqh->dqh_mult = mult;
-
         ep->ep.maxpacket = max;
         ep->desc = desc;
         ep->stopped = 0;
-        ep->ep_num = desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
+        ep->ep_num = usb_endpoint_num(desc);
 
         /* ep_type */
-        ep->ep_type = desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK;
+        ep->ep_type = usb_endpoint_type(desc);
 
         /* configure endpoint control registers */
         ep_reset(ep, ep->ep_num, is_in(ep), ep->ep_type);
 
-        DBG(dev, "enabled %s (ep%d%s-%s), max %04x\n",
+        /* configure endpoint capabilities in dQH */
+        i = ep->ep_num * 2 + is_in(ep);
+        ep->dqh = &dev->ep_dqh[i];
+        ep->dqh->dqh_ios = ios;
+        ep->dqh->dqh_mpl = cpu_to_le16(max);
+        ep->dqh->dqh_zlt = zlt;
+        ep->dqh->dqh_mult = mult;
+        ep->dqh->dtd_next = DTD_TERM;
+
+        dev_dbg(&dev->pdev->dev, "enabled %s (ep%d%s-%s), max %04x\n",
                         _ep->name,
                         ep->ep_num,
-                        DIR_STRING(desc->bEndpointAddress),
-                        type_string(desc->bmAttributes),
+                        DIR_STRING(ep),
+                        type_string(desc),
                         max);
 
         spin_unlock_irqrestore(&dev->lock, flags);
 done:
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return retval;
 }
 
@@ -428,7 +400,7 @@ static void done(struct langwell_ep *ep, struct langwell_request *req,
         struct langwell_dtd     *curr_dtd, *next_dtd;
         int                     i;
 
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         /* remove the req from ep->queue */
         list_del_init(&req->queue);
@@ -448,7 +420,8 @@ static void done(struct langwell_ep *ep, struct langwell_request *req,
         }
 
         if (req->mapped) {
-                dma_unmap_single(&dev->pdev->dev, req->req.dma, req->req.length,
+                dma_unmap_single(&dev->pdev->dev,
+                        req->req.dma, req->req.length,
                         is_in(ep) ? PCI_DMA_TODEVICE : PCI_DMA_FROMDEVICE);
                 req->req.dma = DMA_ADDR_INVALID;
                 req->mapped = 0;
@@ -458,9 +431,10 @@ static void done(struct langwell_ep *ep, struct langwell_request *req,
                                 is_in(ep) ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
 
         if (status != -ESHUTDOWN)
-                DBG(dev, "complete %s, req %p, stat %d, len %u/%u\n",
-                        ep->ep.name, &req->req, status,
-                        req->req.actual, req->req.length);
+                dev_dbg(&dev->pdev->dev,
+                                "complete %s, req %p, stat %d, len %u/%u\n",
+                                ep->ep.name, &req->req, status,
+                                req->req.actual, req->req.length);
 
         /* don't modify queue heads during completion callback */
         ep->stopped = 1;
@@ -473,7 +447,7 @@ static void done(struct langwell_ep *ep, struct langwell_request *req,
         spin_lock(&dev->lock);
         ep->stopped = stopped;
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 
@@ -511,7 +485,7 @@ static int langwell_ep_disable(struct usb_ep *_ep)
 
         ep = container_of(_ep, struct langwell_ep, ep);
         dev = ep->dev;
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         if (!_ep || !ep->desc)
                 return -EINVAL;
@@ -535,8 +509,8 @@ static int langwell_ep_disable(struct usb_ep *_ep)
 
         spin_unlock_irqrestore(&dev->lock, flags);
 
-        DBG(dev, "disabled %s\n", _ep->name);
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "disabled %s\n", _ep->name);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 
         return 0;
 }
@@ -555,7 +529,7 @@ static struct usb_request *langwell_alloc_request(struct usb_ep *_ep,
 
         ep = container_of(_ep, struct langwell_ep, ep);
         dev = ep->dev;
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         req = kzalloc(sizeof(*req), gfp_flags);
         if (!req)
@@ -564,8 +538,8 @@ static struct usb_request *langwell_alloc_request(struct usb_ep *_ep,
         req->req.dma = DMA_ADDR_INVALID;
         INIT_LIST_HEAD(&req->queue);
 
-        VDBG(dev, "alloc request for %s\n", _ep->name);
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "alloc request for %s\n", _ep->name);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return &req->req;
 }
 
@@ -580,7 +554,7 @@ static void langwell_free_request(struct usb_ep *_ep,
 
         ep = container_of(_ep, struct langwell_ep, ep);
         dev = ep->dev;
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         if (!_ep || !_req)
                 return;
@@ -591,8 +565,8 @@ static void langwell_free_request(struct usb_ep *_ep,
         if (_req)
                 kfree(req);
 
-        VDBG(dev, "free request for %s\n", _ep->name);
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "free request for %s\n", _ep->name);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 
@@ -608,23 +582,24 @@ static int queue_dtd(struct langwell_ep *ep, struct langwell_request *req)
         struct langwell_udc     *dev;
 
         dev = ep->dev;
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         i = ep->ep_num * 2 + is_in(ep);
         dqh = &dev->ep_dqh[i];
 
         if (ep->ep_num)
-                VDBG(dev, "%s\n", ep->name);
+                dev_vdbg(&dev->pdev->dev, "%s\n", ep->name);
         else
                 /* ep0 */
-                VDBG(dev, "%s-%s\n", ep->name, is_in(ep) ? "in" : "out");
+                dev_vdbg(&dev->pdev->dev, "%s-%s\n", ep->name, DIR_STRING(ep));
 
-        VDBG(dev, "ep_dqh[%d] addr: 0x%08x\n", i, (u32)&(dev->ep_dqh[i]));
+        dev_vdbg(&dev->pdev->dev, "ep_dqh[%d] addr: 0x%08x\n",
+                        i, (u32)&(dev->ep_dqh[i]));
 
         bit_mask = is_in(ep) ?
                 (1 << (ep->ep_num + 16)) : (1 << (ep->ep_num));
 
-        VDBG(dev, "bit_mask = 0x%08x\n", bit_mask);
+        dev_vdbg(&dev->pdev->dev, "bit_mask = 0x%08x\n", bit_mask);
 
         /* check if the pipe is empty */
         if (!(list_empty(&ep->queue))) {
@@ -665,14 +640,17 @@ static int queue_dtd(struct langwell_ep *ep, struct langwell_request *req)
         /* clear active and halt bit */
         dtd_status = (u8) ~(DTD_STS_ACTIVE | DTD_STS_HALTED);
         dqh->dtd_status &= dtd_status;
-        VDBG(dev, "dqh->dtd_status = 0x%x\n", dqh->dtd_status);
+        dev_vdbg(&dev->pdev->dev, "dqh->dtd_status = 0x%x\n", dqh->dtd_status);
+
+        /* ensure that updates to the dQH will occur before priming */
+        wmb();
 
         /* write 1 to endptprime register to PRIME endpoint */
         bit_mask = is_in(ep) ? (1 << (ep->ep_num + 16)) : (1 << ep->ep_num);
-        VDBG(dev, "endprime bit_mask = 0x%08x\n", bit_mask);
+        dev_vdbg(&dev->pdev->dev, "endprime bit_mask = 0x%08x\n", bit_mask);
         writel(bit_mask, &dev->op_regs->endptprime);
 out:
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return 0;
 }
 
@@ -687,7 +665,7 @@ static struct langwell_dtd *build_dtd(struct langwell_request *req,
         int                     i;
 
         dev = req->ep->dev;
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         /* the maximum transfer length, up to 16k bytes */
         *length = min(req->req.length - req->req.actual,
@@ -708,7 +686,7 @@ static struct langwell_dtd *build_dtd(struct langwell_request *req,
 
         /* fill in total bytes with transfer size */
         dtd->dtd_total = cpu_to_le16(*length);
-        VDBG(dev, "dtd->dtd_total = %d\n", dtd->dtd_total);
+        dev_vdbg(&dev->pdev->dev, "dtd->dtd_total = %d\n", dtd->dtd_total);
 
         /* set is_last flag if req->req.zero is set or not */
         if (req->req.zero) {
@@ -722,7 +700,7 @@ static struct langwell_dtd *build_dtd(struct langwell_request *req,
                 *is_last = 0;
 
         if (*is_last == 0)
-                VDBG(dev, "multi-dtd request!\n");
+                dev_vdbg(&dev->pdev->dev, "multi-dtd request!\n");
 
         /* set interrupt on complete bit for the last dTD */
         if (*is_last && !req->req.no_interrupt)
@@ -733,10 +711,12 @@ static struct langwell_dtd *build_dtd(struct langwell_request *req,
 
         /* set the active bit of status field to 1 */
         dtd->dtd_status = DTD_STS_ACTIVE;
-        VDBG(dev, "dtd->dtd_status = 0x%02x\n", dtd->dtd_status);
+        dev_vdbg(&dev->pdev->dev, "dtd->dtd_status = 0x%02x\n",
+                        dtd->dtd_status);
 
-        VDBG(dev, "length = %d, dma addr= 0x%08x\n", *length, (int)*dma);
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "length = %d, dma addr= 0x%08x\n",
+                        *length, (int)*dma);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return dtd;
 }
 
@@ -751,7 +731,7 @@ static int req_to_dtd(struct langwell_request *req)
         dma_addr_t              dma;
 
         dev = req->ep->dev;
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
         do {
                 dtd = build_dtd(req, &count, &dma, &is_last);
                 if (dtd == NULL)
@@ -773,7 +753,7 @@ static int req_to_dtd(struct langwell_request *req)
 
         req->tail = dtd;
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return 0;
 }
 
@@ -803,9 +783,9 @@ static int langwell_ep_queue(struct usb_ep *_ep, struct usb_request *_req,
 
         dev = ep->dev;
         req->ep = ep;
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
-        if (ep->desc->bmAttributes == USB_ENDPOINT_XFER_ISOC) {
+        if (usb_endpoint_xfer_isoc(ep->desc)) {
                 if (req->req.length > ep->ep.maxpacket)
                         return -EMSGSIZE;
                 is_iso = 1;
@@ -818,7 +798,7 @@ static int langwell_ep_queue(struct usb_ep *_ep, struct usb_request *_req,
         if (_req->dma == DMA_ADDR_INVALID) {
                 /* WORKAROUND: WARN_ON(size == 0) */
                 if (_req->length == 0) {
-                        VDBG(dev, "req->length: 0->1\n");
+                        dev_vdbg(&dev->pdev->dev, "req->length: 0->1\n");
                         zlflag = 1;
                         _req->length++;
                 }
@@ -827,24 +807,25 @@ static int langwell_ep_queue(struct usb_ep *_ep, struct usb_request *_req,
                                 _req->buf, _req->length,
                                 is_in(ep) ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
                 if (zlflag && (_req->length == 1)) {
-                        VDBG(dev, "req->length: 1->0\n");
+                        dev_vdbg(&dev->pdev->dev, "req->length: 1->0\n");
                         zlflag = 0;
                         _req->length = 0;
                 }
 
                 req->mapped = 1;
-                VDBG(dev, "req->mapped = 1\n");
+                dev_vdbg(&dev->pdev->dev, "req->mapped = 1\n");
         } else {
                 dma_sync_single_for_device(&dev->pdev->dev,
                                 _req->dma, _req->length,
                                 is_in(ep) ?  DMA_TO_DEVICE : DMA_FROM_DEVICE);
                 req->mapped = 0;
-                VDBG(dev, "req->mapped = 0\n");
+                dev_vdbg(&dev->pdev->dev, "req->mapped = 0\n");
         }
 
-        DBG(dev, "%s queue req %p, len %u, buf %p, dma 0x%08llx\n",
-            _ep->name,
-            _req, _req->length, _req->buf, (unsigned long long)_req->dma);
+        dev_dbg(&dev->pdev->dev,
+                        "%s queue req %p, len %u, buf %p, dma 0x%08x\n",
+                        _ep->name,
+                        _req, _req->length, _req->buf, (int)_req->dma);
 
         _req->status = -EINPROGRESS;
         _req->actual = 0;
@@ -866,12 +847,12 @@ static int langwell_ep_queue(struct usb_ep *_ep, struct usb_request *_req,
 
         if (likely(req != NULL)) {
                 list_add_tail(&req->queue, &ep->queue);
-                VDBG(dev, "list_add_tail() \n");
+                dev_vdbg(&dev->pdev->dev, "list_add_tail()\n");
         }
 
         spin_unlock_irqrestore(&dev->lock, flags);
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return 0;
 }
 
@@ -888,7 +869,7 @@ static int langwell_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
 
         ep = container_of(_ep, struct langwell_ep, ep);
         dev = ep->dev;
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         if (!_ep || !ep->desc || !_req)
                 return -EINVAL;
@@ -924,7 +905,7 @@ static int langwell_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
 
         /* queue head may be partially complete. */
         if (ep->queue.next == &req->queue) {
-                DBG(dev, "unlink (%s) dma\n", _ep->name);
+                dev_dbg(&dev->pdev->dev, "unlink (%s) dma\n", _ep->name);
                 _req->status = -ECONNRESET;
                 langwell_ep_fifo_flush(&ep->ep);
 
@@ -963,7 +944,7 @@ done:
         ep->stopped = stopped;
         spin_unlock_irqrestore(&dev->lock, flags);
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return retval;
 }
 
@@ -976,7 +957,7 @@ static void ep_set_halt(struct langwell_ep *ep, int value)
         u32                     endptctrl = 0;
         int                     ep_num;
         struct langwell_udc     *dev = ep->dev;
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         ep_num = ep->ep_num;
         endptctrl = readl(&dev->op_regs->endptctrl[ep_num]);
@@ -1001,7 +982,7 @@ static void ep_set_halt(struct langwell_ep *ep, int value)
 
         writel(endptctrl, &dev->op_regs->endptctrl[ep_num]);
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 
@@ -1016,7 +997,7 @@ static int langwell_ep_set_halt(struct usb_ep *_ep, int value)
         ep = container_of(_ep, struct langwell_ep, ep);
         dev = ep->dev;
 
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         if (!_ep || !ep->desc)
                 return -EINVAL;
@@ -1024,8 +1005,7 @@ static int langwell_ep_set_halt(struct usb_ep *_ep, int value)
         if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)
                 return -ESHUTDOWN;
 
-        if (ep->desc && (ep->desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
-                        == USB_ENDPOINT_XFER_ISOC)
+        if (usb_endpoint_xfer_isoc(ep->desc))
                 return  -EOPNOTSUPP;
 
         spin_lock_irqsave(&dev->lock, flags);
@@ -1036,7 +1016,7 @@ static int langwell_ep_set_halt(struct usb_ep *_ep, int value)
          */
         if (!list_empty(&ep->queue) && is_in(ep) && value) {
                 /* IN endpoint FIFO holds bytes */
-                DBG(dev, "%s FIFO holds bytes\n", _ep->name);
+                dev_dbg(&dev->pdev->dev, "%s FIFO holds bytes\n", _ep->name);
                 retval = -EAGAIN;
                 goto done;
         }
@@ -1050,8 +1030,9 @@ static int langwell_ep_set_halt(struct usb_ep *_ep, int value)
         }
 done:
         spin_unlock_irqrestore(&dev->lock, flags);
-        DBG(dev, "%s %s halt\n", _ep->name, value ? "set" : "clear");
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "%s %s halt\n",
+                        _ep->name, value ? "set" : "clear");
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return retval;
 }
 
@@ -1065,12 +1046,12 @@ static int langwell_ep_set_wedge(struct usb_ep *_ep)
         ep = container_of(_ep, struct langwell_ep, ep);
         dev = ep->dev;
 
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         if (!_ep || !ep->desc)
                 return -EINVAL;
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return usb_ep_set_halt(_ep);
 }
 
@@ -1086,15 +1067,16 @@ static void langwell_ep_fifo_flush(struct usb_ep *_ep)
         ep = container_of(_ep, struct langwell_ep, ep);
         dev = ep->dev;
 
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         if (!_ep || !ep->desc) {
-                VDBG(dev, "ep or ep->desc is NULL\n");
-                VDBG(dev, "<--- %s()\n", __func__);
+                dev_vdbg(&dev->pdev->dev, "ep or ep->desc is NULL\n");
+                dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
                 return;
         }
 
-        VDBG(dev, "%s-%s fifo flush\n", _ep->name, is_in(ep) ? "in" : "out");
+        dev_vdbg(&dev->pdev->dev, "%s-%s fifo flush\n",
+                        _ep->name, DIR_STRING(ep));
 
         /* flush endpoint buffer */
         if (ep->ep_num == 0)
@@ -1110,14 +1092,14 @@ static void langwell_ep_fifo_flush(struct usb_ep *_ep)
                 writel(flush_bit, &dev->op_regs->endptflush);
                 while (readl(&dev->op_regs->endptflush)) {
                         if (time_after(jiffies, timeout)) {
-                                ERROR(dev, "ep flush timeout\n");
+                                dev_err(&dev->pdev->dev, "ep flush timeout\n");
                                 goto done;
                         }
                         cpu_relax();
                 }
         } while (readl(&dev->op_regs->endptstat) & flush_bit);
 done:
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 
@@ -1167,31 +1149,59 @@ static int langwell_get_frame(struct usb_gadget *_gadget)
                 return -ENODEV;
 
         dev = container_of(_gadget, struct langwell_udc, gadget);
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         retval = readl(&dev->op_regs->frindex) & FRINDEX_MASK;
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return retval;
 }
 
 
+/* enter or exit PHY low power state */
+static void langwell_phy_low_power(struct langwell_udc *dev, bool flag)
+{
+        u32             devlc;
+        u8              devlc_byte2;
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        devlc = readl(&dev->op_regs->devlc);
+        dev_vdbg(&dev->pdev->dev, "devlc = 0x%08x\n", devlc);
+
+        if (flag)
+                devlc |= LPM_PHCD;
+        else
+                devlc &= ~LPM_PHCD;
+
+        /* FIXME: workaround for Langwell A1/A2/A3 sighting */
+        devlc_byte2 = (devlc >> 16) & 0xff;
+        writeb(devlc_byte2, (u8 *)&dev->op_regs->devlc + 2);
+
+        devlc = readl(&dev->op_regs->devlc);
+        dev_vdbg(&dev->pdev->dev,
+                        "%s PHY low power suspend, devlc = 0x%08x\n",
+                        flag ? "enter" : "exit", devlc);
+}
+
+
 /* tries to wake up the host connected to this gadget */
 static int langwell_wakeup(struct usb_gadget *_gadget)
 {
         struct langwell_udc     *dev;
-        u32                     portsc1, devlc;
-        unsigned long           flags;
+        u32                     portsc1;
+        unsigned long           flags;
 
         if (!_gadget)
                 return 0;
 
         dev = container_of(_gadget, struct langwell_udc, gadget);
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
-        /* Remote Wakeup feature not enabled by host */
-        if (!dev->remote_wakeup)
+        /* remote wakeup feature not enabled by host */
+        if (!dev->remote_wakeup) {
+                dev_info(&dev->pdev->dev, "remote wakeup is disabled\n");
                 return -ENOTSUPP;
+        }
 
         spin_lock_irqsave(&dev->lock, flags);
 
@@ -1201,27 +1211,23 @@ static int langwell_wakeup(struct usb_gadget *_gadget)
                 return 0;
         }
 
-        /* LPM L1 to L0, remote wakeup */
-        if (dev->lpm && dev->lpm_state == LPM_L1) {
-                portsc1 |= PORTS_SLP;
-                writel(portsc1, &dev->op_regs->portsc1);
-        }
-
-        /* force port resume */
-        if (dev->usb_state == USB_STATE_SUSPENDED) {
-                portsc1 |= PORTS_FPR;
-                writel(portsc1, &dev->op_regs->portsc1);
-        }
+        /* LPM L1 to L0 or legacy remote wakeup */
+        if (dev->lpm && dev->lpm_state == LPM_L1)
+                dev_info(&dev->pdev->dev, "LPM L1 to L0 remote wakeup\n");
+        else
+                dev_info(&dev->pdev->dev, "device remote wakeup\n");
 
         /* exit PHY low power suspend */
-        devlc = readl(&dev->op_regs->devlc);
-        VDBG(dev, "devlc = 0x%08x\n", devlc);
-        devlc &= ~LPM_PHCD;
-        writel(devlc, &dev->op_regs->devlc);
+        if (dev->pdev->device != 0x0829)
+                langwell_phy_low_power(dev, 0);
+
+        /* force port resume */
+        portsc1 |= PORTS_FPR;
+        writel(portsc1, &dev->op_regs->portsc1);
 
         spin_unlock_irqrestore(&dev->lock, flags);
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return 0;
 }
 
@@ -1231,16 +1237,17 @@ static int langwell_vbus_session(struct usb_gadget *_gadget, int is_active)
 {
         struct langwell_udc     *dev;
         unsigned long           flags;
-        u32                     usbcmd;
+        u32                     usbcmd;
 
         if (!_gadget)
                 return -ENODEV;
 
         dev = container_of(_gadget, struct langwell_udc, gadget);
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         spin_lock_irqsave(&dev->lock, flags);
-        VDBG(dev, "VBUS status: %s\n", is_active ? "on" : "off");
+        dev_vdbg(&dev->pdev->dev, "VBUS status: %s\n",
+                        is_active ? "on" : "off");
 
         dev->vbus_active = (is_active != 0);
         if (dev->driver && dev->softconnected && dev->vbus_active) {
@@ -1255,7 +1262,7 @@ static int langwell_vbus_session(struct usb_gadget *_gadget, int is_active)
 
         spin_unlock_irqrestore(&dev->lock, flags);
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return 0;
 }
 
@@ -1269,15 +1276,15 @@ static int langwell_vbus_draw(struct usb_gadget *_gadget, unsigned mA)
                 return -ENODEV;
 
         dev = container_of(_gadget, struct langwell_udc, gadget);
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         if (dev->transceiver) {
-                VDBG(dev, "otg_set_power\n");
-                VDBG(dev, "<--- %s()\n", __func__);
+                dev_vdbg(&dev->pdev->dev, "otg_set_power\n");
+                dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
                 return otg_set_power(dev->transceiver, mA);
         }
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return -ENOTSUPP;
 }
 
@@ -1286,15 +1293,15 @@ static int langwell_vbus_draw(struct usb_gadget *_gadget, unsigned mA)
 static int langwell_pullup(struct usb_gadget *_gadget, int is_on)
 {
         struct langwell_udc     *dev;
-        u32                     usbcmd;
-        unsigned long           flags;
+        u32                     usbcmd;
+        unsigned long           flags;
 
         if (!_gadget)
                 return -ENODEV;
 
         dev = container_of(_gadget, struct langwell_udc, gadget);
 
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         spin_lock_irqsave(&dev->lock, flags);
         dev->softconnected = (is_on != 0);
@@ -1310,7 +1317,7 @@ static int langwell_pullup(struct usb_gadget *_gadget, int is_on)
         }
         spin_unlock_irqrestore(&dev->lock, flags);
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return 0;
 }
 
@@ -1346,12 +1353,13 @@ static const struct usb_gadget_ops langwell_ops = {
 static int langwell_udc_reset(struct langwell_udc *dev)
 {
         u32             usbcmd, usbmode, devlc, endpointlistaddr;
+        u8              devlc_byte0, devlc_byte2;
         unsigned long   timeout;
 
         if (!dev)
                 return -EINVAL;
 
-        DBG(dev, "---> %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         /* set controller to stop state */
         usbcmd = readl(&dev->op_regs->usbcmd);
@@ -1367,7 +1375,7 @@ static int langwell_udc_reset(struct langwell_udc *dev)
         timeout = jiffies + RESET_TIMEOUT;
         while (readl(&dev->op_regs->usbcmd) & CMD_RST) {
                 if (time_after(jiffies, timeout)) {
-                        ERROR(dev, "device reset timeout\n");
+                        dev_err(&dev->pdev->dev, "device reset timeout\n");
                         return -ETIMEDOUT;
                 }
                 cpu_relax();
@@ -1382,7 +1390,7 @@ static int langwell_udc_reset(struct langwell_udc *dev)
 
         writel(usbmode, &dev->op_regs->usbmode);
         usbmode = readl(&dev->op_regs->usbmode);
-        VDBG(dev, "usbmode=0x%08x\n", usbmode);
+        dev_vdbg(&dev->pdev->dev, "usbmode=0x%08x\n", usbmode);
 
         /* Write-Clear setup status */
         writel(0, &dev->op_regs->usbsts);
@@ -1390,9 +1398,17 @@ static int langwell_udc_reset(struct langwell_udc *dev)
         /* if support USB LPM, ACK all LPM token */
         if (dev->lpm) {
                 devlc = readl(&dev->op_regs->devlc);
+                dev_vdbg(&dev->pdev->dev, "devlc = 0x%08x\n", devlc);
+                /* FIXME: workaround for Langwell A1/A2/A3 sighting */
                 devlc &= ~LPM_STL;      /* don't STALL LPM token */
                 devlc &= ~LPM_NYT_ACK;  /* ACK LPM token */
-                writel(devlc, &dev->op_regs->devlc);
+                devlc_byte0 = devlc & 0xff;
+                devlc_byte2 = (devlc >> 16) & 0xff;
+                writeb(devlc_byte0, (u8 *)&dev->op_regs->devlc);
+                writeb(devlc_byte2, (u8 *)&dev->op_regs->devlc + 2);
+                devlc = readl(&dev->op_regs->devlc);
+                dev_vdbg(&dev->pdev->dev,
+                                "ACK LPM token, devlc = 0x%08x\n", devlc);
         }
 
         /* fill endpointlistaddr register */
@@ -1400,10 +1416,11 @@ static int langwell_udc_reset(struct langwell_udc *dev)
         endpointlistaddr &= ENDPOINTLISTADDR_MASK;
         writel(endpointlistaddr, &dev->op_regs->endpointlistaddr);
 
-        VDBG(dev, "dQH base (vir: %p, phy: 0x%08x), endpointlistaddr=0x%08x\n",
-                        dev->ep_dqh, endpointlistaddr,
-                        readl(&dev->op_regs->endpointlistaddr));
-        DBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev,
+                "dQH base (vir: %p, phy: 0x%08x), endpointlistaddr=0x%08x\n",
+                dev->ep_dqh, endpointlistaddr,
+                readl(&dev->op_regs->endpointlistaddr));
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return 0;
 }
 
@@ -1415,7 +1432,7 @@ static int eps_reinit(struct langwell_udc *dev)
         char                    name[14];
         int                     i;
 
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         /* initialize ep0 */
         ep = &dev->ep[0];
@@ -1449,11 +1466,9 @@ static int eps_reinit(struct langwell_udc *dev)
 
                 INIT_LIST_HEAD(&ep->queue);
                 list_add_tail(&ep->ep.ep_list, &dev->gadget.ep_list);
-
-                ep->dqh = &dev->ep_dqh[i];
         }
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return 0;
 }
 
@@ -1462,7 +1477,7 @@ static int eps_reinit(struct langwell_udc *dev)
 static void langwell_udc_start(struct langwell_udc *dev)
 {
         u32     usbintr, usbcmd;
-        DBG(dev, "---> %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         /* enable interrupts */
         usbintr = INTR_ULPIE    /* ULPI */
@@ -1485,8 +1500,7 @@ static void langwell_udc_start(struct langwell_udc *dev)
         usbcmd |= CMD_RUNSTOP;
         writel(usbcmd, &dev->op_regs->usbcmd);
 
-        DBG(dev, "<--- %s()\n", __func__);
-        return;
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 
@@ -1495,7 +1509,7 @@ static void langwell_udc_stop(struct langwell_udc *dev)
 {
         u32     usbcmd;
 
-        DBG(dev, "---> %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         /* disable all interrupts */
         writel(0, &dev->op_regs->usbintr);
@@ -1508,8 +1522,7 @@ static void langwell_udc_stop(struct langwell_udc *dev)
         usbcmd &= ~CMD_RUNSTOP;
         writel(usbcmd, &dev->op_regs->usbcmd);
 
-        DBG(dev, "<--- %s()\n", __func__);
-        return;
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 
@@ -1518,7 +1531,7 @@ static void stop_activity(struct langwell_udc *dev,
                 struct usb_gadget_driver *driver)
 {
         struct langwell_ep      *ep;
-        DBG(dev, "---> %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         nuke(&dev->ep[0], -ESHUTDOWN);
 
@@ -1533,7 +1546,7 @@ static void stop_activity(struct langwell_udc *dev,
                 spin_lock(&dev->lock);
         }
 
-        DBG(dev, "<--- %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 
@@ -1659,13 +1672,15 @@ static ssize_t show_langwell_udc(struct device *_dev,
                 "Over-current Change: %s\n"
                 "Port Enable/Disable Change: %s\n"
                 "Port Enabled/Disabled: %s\n"
-                "Current Connect Status: %s\n\n",
+                "Current Connect Status: %s\n"
+                "LPM Suspend Status: %s\n\n",
                 (tmp_reg & PORTS_PR) ? "Reset" : "Not Reset",
                 (tmp_reg & PORTS_SUSP) ? "Suspend " : "Not Suspend",
                 (tmp_reg & PORTS_OCC) ? "Detected" : "No",
                 (tmp_reg & PORTS_PEC) ? "Changed" : "Not Changed",
                 (tmp_reg & PORTS_PE) ? "Enable" : "Not Correct",
-                (tmp_reg & PORTS_CCS) ?  "Attached" : "Not Attached");
+                (tmp_reg & PORTS_CCS) ?  "Attached" : "Not Attached",
+                (tmp_reg & PORTS_SLP) ? "LPM L1" : "LPM L0");
         size -= t;
         next += t;
 
@@ -1676,7 +1691,7 @@ static ssize_t show_langwell_udc(struct device *_dev,
                 "Serial Transceiver : %d\n"
                 "Port Speed: %s\n"
                 "Port Force Full Speed Connenct: %s\n"
-                "PHY Low Power Suspend Clock Disable: %s\n"
+                "PHY Low Power Suspend Clock: %s\n"
                 "BmAttributes: %d\n\n",
                 LPM_PTS(tmp_reg),
                 (tmp_reg & LPM_STS) ? 1 : 0,
@@ -1797,6 +1812,36 @@ static ssize_t show_langwell_udc(struct device *_dev,
 static DEVICE_ATTR(langwell_udc, S_IRUGO, show_langwell_udc, NULL);
 
 
+/* device "remote_wakeup" sysfs attribute file */
+static ssize_t store_remote_wakeup(struct device *_dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct langwell_udc     *dev = the_controller;
+        unsigned long           flags;
+        ssize_t                 rc = count;
+
+        if (count > 2)
+                return -EINVAL;
+
+        if (count > 0 && buf[count-1] == '\n')
+                ((char *) buf)[count-1] = 0;
+
+        if (buf[0] != '1')
+                return -EINVAL;
+
+        /* force remote wakeup enabled in case gadget driver doesn't support */
+        spin_lock_irqsave(&dev->lock, flags);
+        dev->remote_wakeup = 1;
+        dev->dev_status |= (1 << USB_DEVICE_REMOTE_WAKEUP);
+        spin_unlock_irqrestore(&dev->lock, flags);
+
+        langwell_wakeup(&dev->gadget);
+
+        return rc;
+}
+static DEVICE_ATTR(remote_wakeup, S_IWUSR, NULL, store_remote_wakeup);
+
+
 /*-------------------------------------------------------------------------*/
 
 /*
@@ -1807,7 +1852,8 @@ static DEVICE_ATTR(langwell_udc, S_IRUGO, show_langwell_udc, NULL);
  * the driver might get unbound.
  */
 
-int usb_gadget_register_driver(struct usb_gadget_driver *driver)
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
 {
         struct langwell_udc     *dev = the_controller;
         unsigned long           flags;
@@ -1816,7 +1862,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
         if (!dev)
                 return -ENODEV;
 
-        DBG(dev, "---> %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         if (dev->driver)
                 return -EBUSY;
@@ -1830,9 +1876,9 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
 
         spin_unlock_irqrestore(&dev->lock, flags);
 
-        retval = driver->bind(&dev->gadget);
+        retval = bind(&dev->gadget);
         if (retval) {
-                DBG(dev, "bind to driver %s --> %d\n",
+                dev_dbg(&dev->pdev->dev, "bind to driver %s --> %d\n",
                                 driver->driver.name, retval);
                 dev->driver = NULL;
                 dev->gadget.dev.driver = NULL;
@@ -1851,13 +1897,13 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
         if (dev->got_irq)
                 langwell_udc_start(dev);
 
-        VDBG(dev, "After langwell_udc_start(), print all registers:\n");
-#ifdef  VERBOSE
+        dev_vdbg(&dev->pdev->dev,
+                        "After langwell_udc_start(), print all registers:\n");
         print_all_registers(dev);
-#endif
 
-        INFO(dev, "register driver: %s\n", driver->driver.name);
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_info(&dev->pdev->dev, "register driver: %s\n",
+                        driver->driver.name);
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return 0;
 
 err_unbind:
@@ -1865,10 +1911,10 @@ err_unbind:
         dev->gadget.dev.driver = NULL;
         dev->driver = NULL;
 
-        DBG(dev, "<--- %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return retval;
 }
-EXPORT_SYMBOL(usb_gadget_register_driver);
+EXPORT_SYMBOL(usb_gadget_probe_driver);
 
 
 /* unregister gadget driver */
@@ -1880,11 +1926,15 @@ int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
         if (!dev)
                 return -ENODEV;
 
-        DBG(dev, "---> %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
-        if (unlikely(!driver || !driver->bind || !driver->unbind))
+        if (unlikely(!driver || !driver->unbind))
                 return -EINVAL;
 
+        /* exit PHY low power suspend */
+        if (dev->pdev->device != 0x0829)
+                langwell_phy_low_power(dev, 0);
+
         /* unbind OTG transceiver */
         if (dev->transceiver)
                 (void)otg_set_peripheral(dev->transceiver, 0);
@@ -1910,8 +1960,9 @@ int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
 
         device_remove_file(&dev->pdev->dev, &dev_attr_function);
 
-        INFO(dev, "unregistered driver '%s'\n", driver->driver.name);
-        DBG(dev, "<--- %s()\n", __func__);
+        dev_info(&dev->pdev->dev, "unregistered driver '%s'\n",
+                        driver->driver.name);
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return 0;
 }
 EXPORT_SYMBOL(usb_gadget_unregister_driver);
@@ -1930,7 +1981,7 @@ static void setup_tripwire(struct langwell_udc *dev)
         unsigned long           timeout;
         struct langwell_dqh     *dqh;
 
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         /* ep0 OUT dQH */
         dqh = &dev->ep_dqh[EP_DIR_OUT];
@@ -1943,7 +1994,7 @@ static void setup_tripwire(struct langwell_udc *dev)
         timeout = jiffies + SETUPSTAT_TIMEOUT;
         while (readl(&dev->op_regs->endptsetupstat)) {
                 if (time_after(jiffies, timeout)) {
-                        ERROR(dev, "setup_tripwire timeout\n");
+                        dev_err(&dev->pdev->dev, "setup_tripwire timeout\n");
                         break;
                 }
                 cpu_relax();
@@ -1963,7 +2014,7 @@ static void setup_tripwire(struct langwell_udc *dev)
         usbcmd = readl(&dev->op_regs->usbcmd);
         writel(usbcmd & ~CMD_SUTW, &dev->op_regs->usbcmd);
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 
@@ -1972,7 +2023,7 @@ static void ep0_stall(struct langwell_udc *dev)
 {
         u32     endptctrl;
 
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         /* set TX and RX to stall */
         endptctrl = readl(&dev->op_regs->endptctrl[0]);
@@ -1983,7 +2034,7 @@ static void ep0_stall(struct langwell_udc *dev)
         dev->ep0_state = WAIT_FOR_SETUP;
         dev->ep0_dir = USB_DIR_OUT;
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 
@@ -1994,7 +2045,7 @@ static int prime_status_phase(struct langwell_udc *dev, int dir)
         struct langwell_ep      *ep;
         int                     status = 0;
 
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         if (dir == EP_DIR_IN)
                 dev->ep0_dir = USB_DIR_IN;
@@ -2019,11 +2070,11 @@ static int prime_status_phase(struct langwell_udc *dev, int dir)
                 return -ENOMEM;
 
         if (status)
-                ERROR(dev, "can't queue ep0 status request\n");
+                dev_err(&dev->pdev->dev, "can't queue ep0 status request\n");
 
         list_add_tail(&req->queue, &ep->queue);
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return status;
 }
 
@@ -2032,11 +2083,11 @@ static int prime_status_phase(struct langwell_udc *dev, int dir)
 static void set_address(struct langwell_udc *dev, u16 value,
                 u16 index, u16 length)
 {
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         /* save the new address to device struct */
         dev->dev_addr = (u8) value;
-        VDBG(dev, "dev->dev_addr = %d\n", dev->dev_addr);
+        dev_vdbg(&dev->pdev->dev, "dev->dev_addr = %d\n", dev->dev_addr);
 
         /* update usb state */
         dev->usb_state = USB_STATE_ADDRESS;
@@ -2045,7 +2096,7 @@ static void set_address(struct langwell_udc *dev, u16 value,
         if (prime_status_phase(dev, EP_DIR_IN))
                 ep0_stall(dev);
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 
@@ -2054,7 +2105,7 @@ static struct langwell_ep *get_ep_by_windex(struct langwell_udc *dev,
                 u16 wIndex)
 {
         struct langwell_ep              *ep;
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         if ((wIndex & USB_ENDPOINT_NUMBER_MASK) == 0)
                 return &dev->ep[0];
@@ -2073,7 +2124,7 @@ static struct langwell_ep *get_ep_by_windex(struct langwell_udc *dev,
                         return ep;
         }
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return NULL;
 }
 
@@ -2085,7 +2136,7 @@ static int ep_is_stall(struct langwell_ep *ep)
         u32                     endptctrl;
         int                     retval;
 
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         endptctrl = readl(&dev->op_regs->endptctrl[ep->ep_num]);
         if (is_in(ep))
@@ -2093,7 +2144,7 @@ static int ep_is_stall(struct langwell_ep *ep)
         else
                 retval = endptctrl & EPCTRL_RXS ? 1 : 0;
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return retval;
 }
 
@@ -2107,14 +2158,13 @@ static void get_status(struct langwell_udc *dev, u8 request_type, u16 value,
         u16     status_data = 0;        /* 16 bits cpu view status data */
         int     status = 0;
 
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         ep = &dev->ep[0];
 
         if ((request_type & USB_RECIP_MASK) == USB_RECIP_DEVICE) {
                 /* get device status */
-                status_data = 1 << USB_DEVICE_SELF_POWERED;
-                status_data |= dev->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP;
+                status_data = dev->dev_status;
         } else if ((request_type & USB_RECIP_MASK) == USB_RECIP_INTERFACE) {
                 /* get interface status */
                 status_data = 0;
@@ -2129,6 +2179,8 @@ static void get_status(struct langwell_udc *dev, u8 request_type, u16 value,
                 status_data = ep_is_stall(epn) << USB_ENDPOINT_HALT;
         }
 
+        dev_dbg(&dev->pdev->dev, "get status data: 0x%04x\n", status_data);
+
         dev->ep0_dir = USB_DIR_IN;
 
         /* borrow the per device status_req */
@@ -2150,18 +2202,19 @@ static void get_status(struct langwell_udc *dev, u8 request_type, u16 value,
                 goto stall;
 
         if (status) {
-                ERROR(dev, "response error on GET_STATUS request\n");
+                dev_err(&dev->pdev->dev,
+                                "response error on GET_STATUS request\n");
                 goto stall;
         }
 
         list_add_tail(&req->queue, &ep->queue);
         dev->ep0_state = DATA_STATE_XMIT;
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return;
 stall:
         ep0_stall(dev);
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 
@@ -2172,13 +2225,14 @@ static void handle_setup_packet(struct langwell_udc *dev,
         u16     wValue = le16_to_cpu(setup->wValue);
         u16     wIndex = le16_to_cpu(setup->wIndex);
         u16     wLength = le16_to_cpu(setup->wLength);
+        u32     portsc1;
 
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         /* ep0 fifo flush */
         nuke(&dev->ep[0], -ESHUTDOWN);
 
-        DBG(dev, "SETUP %02x.%02x v%04x i%04x l%04x\n",
+        dev_dbg(&dev->pdev->dev, "SETUP %02x.%02x v%04x i%04x l%04x\n",
                         setup->bRequestType, setup->bRequest,
                         wValue, wIndex, wLength);
 
@@ -2197,7 +2251,7 @@ static void handle_setup_packet(struct langwell_udc *dev,
         /* We process some stardard setup requests here */
         switch (setup->bRequest) {
         case USB_REQ_GET_STATUS:
-                DBG(dev, "SETUP: USB_REQ_GET_STATUS\n");
+                dev_dbg(&dev->pdev->dev, "SETUP: USB_REQ_GET_STATUS\n");
                 /* get status, DATA and STATUS phase */
                 if ((setup->bRequestType & (USB_DIR_IN | USB_TYPE_MASK))
                                         != (USB_DIR_IN | USB_TYPE_STANDARD))
@@ -2206,7 +2260,7 @@ static void handle_setup_packet(struct langwell_udc *dev,
                 goto end;
 
         case USB_REQ_SET_ADDRESS:
-                DBG(dev, "SETUP: USB_REQ_SET_ADDRESS\n");
+                dev_dbg(&dev->pdev->dev, "SETUP: USB_REQ_SET_ADDRESS\n");
                 /* STATUS phase */
                 if (setup->bRequestType != (USB_DIR_OUT | USB_TYPE_STANDARD
                                                 | USB_RECIP_DEVICE))
@@ -2220,9 +2274,11 @@ static void handle_setup_packet(struct langwell_udc *dev,
         {
                 int rc = -EOPNOTSUPP;
                 if (setup->bRequest == USB_REQ_SET_FEATURE)
-                        DBG(dev, "SETUP: USB_REQ_SET_FEATURE\n");
+                        dev_dbg(&dev->pdev->dev,
+                                        "SETUP: USB_REQ_SET_FEATURE\n");
                 else if (setup->bRequest == USB_REQ_CLEAR_FEATURE)
-                        DBG(dev, "SETUP: USB_REQ_CLEAR_FEATURE\n");
+                        dev_dbg(&dev->pdev->dev,
+                                        "SETUP: USB_REQ_CLEAR_FEATURE\n");
 
                 if ((setup->bRequestType & (USB_RECIP_MASK | USB_TYPE_MASK))
                                 == (USB_RECIP_ENDPOINT | USB_TYPE_STANDARD)) {
@@ -2240,13 +2296,51 @@ static void handle_setup_packet(struct langwell_udc *dev,
 
                         spin_unlock(&dev->lock);
                         rc = langwell_ep_set_halt(&epn->ep,
-                                        (setup->bRequest == USB_REQ_SET_FEATURE)
-                                                ? 1 : 0);
+                                (setup->bRequest == USB_REQ_SET_FEATURE)
+                                ? 1 : 0);
                         spin_lock(&dev->lock);
 
                 } else if ((setup->bRequestType & (USB_RECIP_MASK
                                 | USB_TYPE_MASK)) == (USB_RECIP_DEVICE
                                 | USB_TYPE_STANDARD)) {
+                        rc = 0;
+                        switch (wValue) {
+                        case USB_DEVICE_REMOTE_WAKEUP:
+                                if (setup->bRequest == USB_REQ_SET_FEATURE) {
+                                        dev->remote_wakeup = 1;
+                                        dev->dev_status |= (1 << wValue);
+                                } else {
+                                        dev->remote_wakeup = 0;
+                                        dev->dev_status &= ~(1 << wValue);
+                                }
+                                break;
+                        case USB_DEVICE_TEST_MODE:
+                                dev_dbg(&dev->pdev->dev, "SETUP: TEST MODE\n");
+                                if ((wIndex & 0xff) ||
+                                        (dev->gadget.speed != USB_SPEED_HIGH))
+                                        ep0_stall(dev);
+
+                                switch (wIndex >> 8) {
+                                case TEST_J:
+                                case TEST_K:
+                                case TEST_SE0_NAK:
+                                case TEST_PACKET:
+                                case TEST_FORCE_EN:
+                                        if (prime_status_phase(dev, EP_DIR_IN))
+                                                ep0_stall(dev);
+                                        portsc1 = readl(&dev->op_regs->portsc1);
+                                        portsc1 |= (wIndex & 0xf00) << 8;
+                                        writel(portsc1, &dev->op_regs->portsc1);
+                                        goto end;
+                                default:
+                                        rc = -EOPNOTSUPP;
+                                }
+                                break;
+                        default:
+                                rc = -EOPNOTSUPP;
+                                break;
+                        }
+
                         if (!gadget_is_otg(&dev->gadget))
                                 break;
                         else if (setup->bRequest == USB_DEVICE_B_HNP_ENABLE) {
@@ -2262,7 +2356,6 @@ static void handle_setup_packet(struct langwell_udc *dev,
                                 dev->gadget.a_alt_hnp_support = 1;
                         else
                                 break;
-                        rc = 0;
                 } else
                         break;
 
@@ -2274,31 +2367,38 @@ static void handle_setup_packet(struct langwell_udc *dev,
         }
 
         case USB_REQ_GET_DESCRIPTOR:
-                DBG(dev, "SETUP: USB_REQ_GET_DESCRIPTOR\n");
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_GET_DESCRIPTOR\n");
                 goto delegate;
 
         case USB_REQ_SET_DESCRIPTOR:
-                DBG(dev, "SETUP: USB_REQ_SET_DESCRIPTOR unsupported\n");
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_SET_DESCRIPTOR unsupported\n");
                 goto delegate;
 
         case USB_REQ_GET_CONFIGURATION:
-                DBG(dev, "SETUP: USB_REQ_GET_CONFIGURATION\n");
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_GET_CONFIGURATION\n");
                 goto delegate;
 
         case USB_REQ_SET_CONFIGURATION:
-                DBG(dev, "SETUP: USB_REQ_SET_CONFIGURATION\n");
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_SET_CONFIGURATION\n");
                 goto delegate;
 
         case USB_REQ_GET_INTERFACE:
-                DBG(dev, "SETUP: USB_REQ_GET_INTERFACE\n");
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_GET_INTERFACE\n");
                 goto delegate;
 
         case USB_REQ_SET_INTERFACE:
-                DBG(dev, "SETUP: USB_REQ_SET_INTERFACE\n");
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_SET_INTERFACE\n");
                 goto delegate;
 
         case USB_REQ_SYNCH_FRAME:
-                DBG(dev, "SETUP: USB_REQ_SYNCH_FRAME unsupported\n");
+                dev_dbg(&dev->pdev->dev,
+                                "SETUP: USB_REQ_SYNCH_FRAME unsupported\n");
                 goto delegate;
 
         default:
@@ -2310,7 +2410,8 @@ delegate:
                         /* DATA phase from gadget, STATUS phase from udc */
                         dev->ep0_dir = (setup->bRequestType & USB_DIR_IN)
                                         ?  USB_DIR_IN : USB_DIR_OUT;
-                        VDBG(dev, "dev->ep0_dir = 0x%x, wLength = %d\n",
+                        dev_vdbg(&dev->pdev->dev,
+                                        "dev->ep0_dir = 0x%x, wLength = %d\n",
                                         dev->ep0_dir, wLength);
                         spin_unlock(&dev->lock);
                         if (dev->driver->setup(&dev->gadget,
@@ -2322,7 +2423,8 @@ delegate:
                 } else {
                         /* no DATA phase, IN STATUS phase from gadget */
                         dev->ep0_dir = USB_DIR_IN;
-                        VDBG(dev, "dev->ep0_dir = 0x%x, wLength = %d\n",
+                        dev_vdbg(&dev->pdev->dev,
+                                        "dev->ep0_dir = 0x%x, wLength = %d\n",
                                         dev->ep0_dir, wLength);
                         spin_unlock(&dev->lock);
                         if (dev->driver->setup(&dev->gadget,
@@ -2334,8 +2436,7 @@ delegate:
                 break;
         }
 end:
-        VDBG(dev, "<--- %s()\n", __func__);
-        return;
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 
@@ -2359,23 +2460,27 @@ static int process_ep_req(struct langwell_udc *dev, int index,
         td_complete = 0;
         actual = curr_req->req.length;
 
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         for (i = 0; i < curr_req->dtd_count; i++) {
-                remaining_length = le16_to_cpu(curr_dtd->dtd_total);
-                actual -= remaining_length;
 
                 /* command execution states by dTD */
                 dtd_status = curr_dtd->dtd_status;
 
+                barrier();
+                remaining_length = le16_to_cpu(curr_dtd->dtd_total);
+                actual -= remaining_length;
+
                 if (!dtd_status) {
                         /* transfers completed successfully */
                         if (!remaining_length) {
                                 td_complete++;
-                                VDBG(dev, "dTD transmitted successfully\n");
+                                dev_vdbg(&dev->pdev->dev,
+                                        "dTD transmitted successfully\n");
                         } else {
                                 if (dir) {
-                                        VDBG(dev, "TX dTD remains data\n");
+                                        dev_vdbg(&dev->pdev->dev,
+                                                "TX dTD remains data\n");
                                         retval = -EPROTO;
                                         break;
 
@@ -2387,27 +2492,32 @@ static int process_ep_req(struct langwell_udc *dev, int index,
                 } else {
                         /* transfers completed with errors */
                         if (dtd_status & DTD_STS_ACTIVE) {
-                                DBG(dev, "request not completed\n");
+                                dev_dbg(&dev->pdev->dev,
+                                        "dTD status ACTIVE dQH[%d]\n", index);
                                 retval = 1;
                                 return retval;
                         } else if (dtd_status & DTD_STS_HALTED) {
-                                ERROR(dev, "dTD error %08x dQH[%d]\n",
-                                                dtd_status, index);
+                                dev_err(&dev->pdev->dev,
+                                        "dTD error %08x dQH[%d]\n",
+                                        dtd_status, index);
                                 /* clear the errors and halt condition */
                                 curr_dqh->dtd_status = 0;
                                 retval = -EPIPE;
                                 break;
                         } else if (dtd_status & DTD_STS_DBE) {
-                                DBG(dev, "data buffer (overflow) error\n");
+                                dev_dbg(&dev->pdev->dev,
+                                        "data buffer (overflow) error\n");
                                 retval = -EPROTO;
                                 break;
                         } else if (dtd_status & DTD_STS_TRE) {
-                                DBG(dev, "transaction(ISO) error\n");
+                                dev_dbg(&dev->pdev->dev,
+                                        "transaction(ISO) error\n");
                                 retval = -EILSEQ;
                                 break;
                         } else
-                                ERROR(dev, "unknown error (0x%x)!\n",
-                                                dtd_status);
+                                dev_err(&dev->pdev->dev,
+                                        "unknown error (0x%x)!\n",
+                                        dtd_status);
                 }
 
                 if (i != curr_req->dtd_count - 1)
@@ -2420,7 +2530,7 @@ static int process_ep_req(struct langwell_udc *dev, int index,
 
         curr_req->req.actual = actual;
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return 0;
 }
 
@@ -2430,7 +2540,7 @@ static void ep0_req_complete(struct langwell_udc *dev,
                 struct langwell_ep *ep0, struct langwell_request *req)
 {
         u32     new_addr;
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         if (dev->usb_state == USB_STATE_ADDRESS) {
                 /* set the new address */
@@ -2438,7 +2548,7 @@ static void ep0_req_complete(struct langwell_udc *dev,
                 writel(new_addr << USBADR_SHIFT, &dev->op_regs->deviceaddr);
 
                 new_addr = USBADR(readl(&dev->op_regs->deviceaddr));
-                VDBG(dev, "new_addr = %d\n", new_addr);
+                dev_vdbg(&dev->pdev->dev, "new_addr = %d\n", new_addr);
         }
 
         done(ep0, req, 0);
@@ -2458,14 +2568,14 @@ static void ep0_req_complete(struct langwell_udc *dev,
                 dev->ep0_state = WAIT_FOR_SETUP;
                 break;
         case WAIT_FOR_SETUP:
-                ERROR(dev, "unexpect ep0 packets\n");
+                dev_err(&dev->pdev->dev, "unexpect ep0 packets\n");
                 break;
         default:
                 ep0_stall(dev);
                 break;
         }
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 
@@ -2477,16 +2587,17 @@ static void handle_trans_complete(struct langwell_udc *dev)
         struct langwell_ep      *epn;
         struct langwell_request *curr_req, *temp_req;
 
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         complete_bits = readl(&dev->op_regs->endptcomplete);
-        VDBG(dev, "endptcomplete register: 0x%08x\n", complete_bits);
+        dev_vdbg(&dev->pdev->dev, "endptcomplete register: 0x%08x\n",
+                        complete_bits);
 
         /* Write-Clear the bits in endptcomplete register */
         writel(complete_bits, &dev->op_regs->endptcomplete);
 
         if (!complete_bits) {
-                DBG(dev, "complete_bits = 0\n");
+                dev_dbg(&dev->pdev->dev, "complete_bits = 0\n");
                 goto done;
         }
 
@@ -2506,23 +2617,25 @@ static void handle_trans_complete(struct langwell_udc *dev)
                         epn = &dev->ep[i];
 
                 if (epn->name == NULL) {
-                        WARNING(dev, "invalid endpoint\n");
+                        dev_warn(&dev->pdev->dev, "invalid endpoint\n");
                         continue;
                 }
 
                 if (i < 2)
                         /* ep0 in and out */
-                        DBG(dev, "%s-%s transfer completed\n",
+                        dev_dbg(&dev->pdev->dev, "%s-%s transfer completed\n",
                                         epn->name,
                                         is_in(epn) ? "in" : "out");
                 else
-                        DBG(dev, "%s transfer completed\n", epn->name);
+                        dev_dbg(&dev->pdev->dev, "%s transfer completed\n",
+                                        epn->name);
 
                 /* process the req queue until an uncomplete request */
                 list_for_each_entry_safe(curr_req, temp_req,
                                 &epn->queue, queue) {
                         status = process_ep_req(dev, i, curr_req);
-                        VDBG(dev, "%s req status: %d\n", epn->name, status);
+                        dev_vdbg(&dev->pdev->dev, "%s req status: %d\n",
+                                        epn->name, status);
 
                         if (status)
                                 break;
@@ -2540,8 +2653,7 @@ static void handle_trans_complete(struct langwell_udc *dev)
                 }
         }
 done:
-        VDBG(dev, "<--- %s()\n", __func__);
-        return;
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 
@@ -2551,14 +2663,14 @@ static void handle_port_change(struct langwell_udc *dev)
         u32     portsc1, devlc;
         u32     speed;
 
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         if (dev->bus_reset)
                 dev->bus_reset = 0;
 
         portsc1 = readl(&dev->op_regs->portsc1);
         devlc = readl(&dev->op_regs->devlc);
-        VDBG(dev, "portsc1 = 0x%08x, devlc = 0x%08x\n",
+        dev_vdbg(&dev->pdev->dev, "portsc1 = 0x%08x, devlc = 0x%08x\n",
                         portsc1, devlc);
 
         /* bus reset is finished */
@@ -2579,25 +2691,22 @@ static void handle_port_change(struct langwell_udc *dev)
                         dev->gadget.speed = USB_SPEED_UNKNOWN;
                         break;
                 }
-                VDBG(dev, "speed = %d, dev->gadget.speed = %d\n",
+                dev_vdbg(&dev->pdev->dev,
+                                "speed = %d, dev->gadget.speed = %d\n",
                                 speed, dev->gadget.speed);
         }
 
         /* LPM L0 to L1 */
         if (dev->lpm && dev->lpm_state == LPM_L0)
                 if (portsc1 & PORTS_SUSP && portsc1 & PORTS_SLP) {
-                                INFO(dev, "LPM L0 to L1\n");
-                                dev->lpm_state = LPM_L1;
+                        dev_info(&dev->pdev->dev, "LPM L0 to L1\n");
+                        dev->lpm_state = LPM_L1;
                 }
 
         /* LPM L1 to L0, force resume or remote wakeup finished */
         if (dev->lpm && dev->lpm_state == LPM_L1)
                 if (!(portsc1 & PORTS_SUSP)) {
-                        if (portsc1 & PORTS_SLP)
-                                INFO(dev, "LPM L1 to L0, force resume\n");
-                        else
-                                INFO(dev, "LPM L1 to L0, remote wakeup\n");
-
+                        dev_info(&dev->pdev->dev, "LPM L1 to L0\n");
                         dev->lpm_state = LPM_L0;
                 }
 
@@ -2605,7 +2714,7 @@ static void handle_port_change(struct langwell_udc *dev)
         if (!dev->resume_state)
                 dev->usb_state = USB_STATE_DEFAULT;
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 
@@ -2617,7 +2726,7 @@ static void handle_usb_reset(struct langwell_udc *dev)
                         endptcomplete;
         unsigned long   timeout;
 
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         /* Write-Clear the device address */
         deviceaddr = readl(&dev->op_regs->deviceaddr);
@@ -2634,7 +2743,10 @@ static void handle_usb_reset(struct langwell_udc *dev)
 
         dev->ep0_dir = USB_DIR_OUT;
         dev->ep0_state = WAIT_FOR_SETUP;
-        dev->remote_wakeup = 0;         /* default to 0 on reset */
+
+        /* remote wakeup reset to 0 when the device is reset */
+        dev->remote_wakeup = 0;
+        dev->dev_status = 1 << USB_DEVICE_SELF_POWERED;
         dev->gadget.b_hnp_enable = 0;
         dev->gadget.a_hnp_support = 0;
         dev->gadget.a_alt_hnp_support = 0;
@@ -2651,7 +2763,7 @@ static void handle_usb_reset(struct langwell_udc *dev)
         timeout = jiffies + PRIME_TIMEOUT;
         while (readl(&dev->op_regs->endptprime)) {
                 if (time_after(jiffies, timeout)) {
-                        ERROR(dev, "USB reset timeout\n");
+                        dev_err(&dev->pdev->dev, "USB reset timeout\n");
                         break;
                 }
                 cpu_relax();
@@ -2661,7 +2773,7 @@ static void handle_usb_reset(struct langwell_udc *dev)
         writel((u32) ~0, &dev->op_regs->endptflush);
 
         if (readl(&dev->op_regs->portsc1) & PORTS_PR) {
-                VDBG(dev, "USB bus reset\n");
+                dev_vdbg(&dev->pdev->dev, "USB bus reset\n");
                 /* bus is reseting */
                 dev->bus_reset = 1;
 
@@ -2669,7 +2781,7 @@ static void handle_usb_reset(struct langwell_udc *dev)
                 stop_activity(dev, dev->driver);
                 dev->usb_state = USB_STATE_DEFAULT;
         } else {
-                VDBG(dev, "device controller reset\n");
+                dev_vdbg(&dev->pdev->dev, "device controller reset\n");
                 /* controller reset */
                 langwell_udc_reset(dev);
 
@@ -2691,15 +2803,14 @@ static void handle_usb_reset(struct langwell_udc *dev)
                 dev->lotg->hsm.b_hnp_enable = 0;
 #endif
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 
 /* USB bus suspend/resume interrupt */
 static void handle_bus_suspend(struct langwell_udc *dev)
 {
-        u32             devlc;
-        DBG(dev, "---> %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         dev->resume_state = dev->usb_state;
         dev->usb_state = USB_STATE_SUSPENDED;
@@ -2733,33 +2844,29 @@ static void handle_bus_suspend(struct langwell_udc *dev)
                         spin_unlock(&dev->lock);
                         dev->driver->suspend(&dev->gadget);
                         spin_lock(&dev->lock);
-                        DBG(dev, "suspend %s\n", dev->driver->driver.name);
+                        dev_dbg(&dev->pdev->dev, "suspend %s\n",
+                                        dev->driver->driver.name);
                 }
         }
 
         /* enter PHY low power suspend */
-        devlc = readl(&dev->op_regs->devlc);
-        VDBG(dev, "devlc = 0x%08x\n", devlc);
-        devlc |= LPM_PHCD;
-        writel(devlc, &dev->op_regs->devlc);
+        if (dev->pdev->device != 0x0829)
+                langwell_phy_low_power(dev, 0);
 
-        DBG(dev, "<--- %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 
 static void handle_bus_resume(struct langwell_udc *dev)
 {
-        u32             devlc;
-        DBG(dev, "---> %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         dev->usb_state = dev->resume_state;
         dev->resume_state = 0;
 
         /* exit PHY low power suspend */
-        devlc = readl(&dev->op_regs->devlc);
-        VDBG(dev, "devlc = 0x%08x\n", devlc);
-        devlc &= ~LPM_PHCD;
-        writel(devlc, &dev->op_regs->devlc);
+        if (dev->pdev->device != 0x0829)
+                langwell_phy_low_power(dev, 0);
 
 #ifdef  OTG_TRANSCEIVER
         if (dev->lotg->otg.default_a == 0)
@@ -2772,11 +2879,12 @@ static void handle_bus_resume(struct langwell_udc *dev)
                         spin_unlock(&dev->lock);
                         dev->driver->resume(&dev->gadget);
                         spin_lock(&dev->lock);
-                        DBG(dev, "resume %s\n", dev->driver->driver.name);
+                        dev_dbg(&dev->pdev->dev, "resume %s\n",
+                                        dev->driver->driver.name);
                 }
         }
 
-        DBG(dev, "<--- %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 
@@ -2789,11 +2897,11 @@ static irqreturn_t langwell_irq(int irq, void *_dev)
                                 irq_sts,
                                 portsc1;
 
-        VDBG(dev, "---> %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         if (dev->stopped) {
-                VDBG(dev, "handle IRQ_NONE\n");
-                VDBG(dev, "<--- %s()\n", __func__);
+                dev_vdbg(&dev->pdev->dev, "handle IRQ_NONE\n");
+                dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
                 return IRQ_NONE;
         }
 
@@ -2806,12 +2914,13 @@ static irqreturn_t langwell_irq(int irq, void *_dev)
         usbintr = readl(&dev->op_regs->usbintr);
 
         irq_sts = usbsts & usbintr;
-        VDBG(dev, "usbsts = 0x%08x, usbintr = 0x%08x, irq_sts = 0x%08x\n",
+        dev_vdbg(&dev->pdev->dev,
+                        "usbsts = 0x%08x, usbintr = 0x%08x, irq_sts = 0x%08x\n",
                         usbsts, usbintr, irq_sts);
 
         if (!irq_sts) {
-                VDBG(dev, "handle IRQ_NONE\n");
-                VDBG(dev, "<--- %s()\n", __func__);
+                dev_vdbg(&dev->pdev->dev, "handle IRQ_NONE\n");
+                dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
                 spin_unlock(&dev->lock);
                 return IRQ_NONE;
         }
@@ -2827,12 +2936,13 @@ static irqreturn_t langwell_irq(int irq, void *_dev)
 
         /* USB interrupt */
         if (irq_sts & STS_UI) {
-                VDBG(dev, "USB interrupt\n");
+                dev_vdbg(&dev->pdev->dev, "USB interrupt\n");
 
                 /* setup packet received from ep0 */
                 if (readl(&dev->op_regs->endptsetupstat)
                                 & EP0SETUPSTAT_MASK) {
-                        VDBG(dev, "USB SETUP packet received interrupt\n");
+                        dev_vdbg(&dev->pdev->dev,
+                                "USB SETUP packet received interrupt\n");
                         /* setup tripwire semaphone */
                         setup_tripwire(dev);
                         handle_setup_packet(dev, &dev->local_setup_buff);
@@ -2840,7 +2950,8 @@ static irqreturn_t langwell_irq(int irq, void *_dev)
 
                 /* USB transfer completion */
                 if (readl(&dev->op_regs->endptcomplete)) {
-                        VDBG(dev, "USB transfer completion interrupt\n");
+                        dev_vdbg(&dev->pdev->dev,
+                                "USB transfer completion interrupt\n");
                         handle_trans_complete(dev);
                 }
         }
@@ -2848,36 +2959,36 @@ static irqreturn_t langwell_irq(int irq, void *_dev)
         /* SOF received interrupt (for ISO transfer) */
         if (irq_sts & STS_SRI) {
                 /* FIXME */
-                /* VDBG(dev, "SOF received interrupt\n"); */
+                /* dev_vdbg(&dev->pdev->dev, "SOF received interrupt\n"); */
         }
 
         /* port change detect interrupt */
         if (irq_sts & STS_PCI) {
-                VDBG(dev, "port change detect interrupt\n");
+                dev_vdbg(&dev->pdev->dev, "port change detect interrupt\n");
                 handle_port_change(dev);
         }
 
         /* suspend interrrupt */
         if (irq_sts & STS_SLI) {
-                VDBG(dev, "suspend interrupt\n");
+                dev_vdbg(&dev->pdev->dev, "suspend interrupt\n");
                 handle_bus_suspend(dev);
         }
 
         /* USB reset interrupt */
         if (irq_sts & STS_URI) {
-                VDBG(dev, "USB reset interrupt\n");
+                dev_vdbg(&dev->pdev->dev, "USB reset interrupt\n");
                 handle_usb_reset(dev);
         }
 
         /* USB error or system error interrupt */
         if (irq_sts & (STS_UEI | STS_SEI)) {
                 /* FIXME */
-                WARNING(dev, "error IRQ, irq_sts: %x\n", irq_sts);
+                dev_warn(&dev->pdev->dev, "error IRQ, irq_sts: %x\n", irq_sts);
         }
 
         spin_unlock(&dev->lock);
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return IRQ_HANDLED;
 }
 
@@ -2889,15 +3000,59 @@ static void gadget_release(struct device *_dev)
 {
         struct langwell_udc     *dev = the_controller;
 
-        DBG(dev, "---> %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         complete(dev->done);
 
-        DBG(dev, "<--- %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         kfree(dev);
 }
 
 
+/* enable SRAM caching if SRAM detected */
+static void sram_init(struct langwell_udc *dev)
+{
+        struct pci_dev          *pdev = dev->pdev;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        dev->sram_addr = pci_resource_start(pdev, 1);
+        dev->sram_size = pci_resource_len(pdev, 1);
+        dev_info(&dev->pdev->dev, "Found private SRAM at %x size:%x\n",
+                        dev->sram_addr, dev->sram_size);
+        dev->got_sram = 1;
+
+        if (pci_request_region(pdev, 1, kobject_name(&pdev->dev.kobj))) {
+                dev_warn(&dev->pdev->dev, "SRAM request failed\n");
+                dev->got_sram = 0;
+        } else if (!dma_declare_coherent_memory(&pdev->dev, dev->sram_addr,
+                        dev->sram_addr, dev->sram_size, DMA_MEMORY_MAP)) {
+                dev_warn(&dev->pdev->dev, "SRAM DMA declare failed\n");
+                pci_release_region(pdev, 1);
+                dev->got_sram = 0;
+        }
+
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
+/* release SRAM caching */
+static void sram_deinit(struct langwell_udc *dev)
+{
+        struct pci_dev *pdev = dev->pdev;
+
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
+
+        dma_release_declared_memory(&pdev->dev);
+        pci_release_region(pdev, 1);
+
+        dev->got_sram = 0;
+
+        dev_info(&dev->pdev->dev, "release SRAM caching\n");
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
+}
+
+
 /* tear down the binding between this driver and the pci device */
 static void langwell_udc_remove(struct pci_dev *pdev)
 {
@@ -2906,26 +3061,32 @@ static void langwell_udc_remove(struct pci_dev *pdev)
         DECLARE_COMPLETION(done);
 
         BUG_ON(dev->driver);
-        DBG(dev, "---> %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         dev->done = &done;
 
-        /* free memory allocated in probe */
+#ifndef OTG_TRANSCEIVER
+        /* free dTD dma_pool and dQH */
         if (dev->dtd_pool)
                 dma_pool_destroy(dev->dtd_pool);
 
+        if (dev->ep_dqh)
+                dma_free_coherent(&pdev->dev, dev->ep_dqh_size,
+                        dev->ep_dqh, dev->ep_dqh_dma);
+
+        /* release SRAM caching */
+        if (dev->has_sram && dev->got_sram)
+                sram_deinit(dev);
+#endif
+
         if (dev->status_req) {
                 kfree(dev->status_req->req.buf);
                 kfree(dev->status_req);
         }
 
-        if (dev->ep_dqh)
-                dma_free_coherent(&pdev->dev, dev->ep_dqh_size,
-                        dev->ep_dqh, dev->ep_dqh_dma);
-
         kfree(dev->ep);
 
-        /* diable IRQ handler */
+        /* disable IRQ handler */
         if (dev->got_irq)
                 free_irq(pdev->irq, dev);
 
@@ -2949,11 +3110,12 @@ static void langwell_udc_remove(struct pci_dev *pdev)
 
         dev->cap_regs = NULL;
 
-        INFO(dev, "unbind\n");
-        DBG(dev, "<--- %s()\n", __func__);
+        dev_info(&dev->pdev->dev, "unbind\n");
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 
         device_unregister(&dev->gadget.dev);
         device_remove_file(&pdev->dev, &dev_attr_langwell_udc);
+        device_remove_file(&pdev->dev, &dev_attr_remote_wakeup);
 
 #ifndef OTG_TRANSCEIVER
         pci_set_drvdata(pdev, NULL);
@@ -2997,7 +3159,7 @@ static int langwell_udc_probe(struct pci_dev *pdev,
         spin_lock_init(&dev->lock);
 
         dev->pdev = pdev;
-        DBG(dev, "---> %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
 #ifdef  OTG_TRANSCEIVER
         /* PCI device is already enabled by otg_transceiver driver */
@@ -3022,7 +3184,7 @@ static int langwell_udc_probe(struct pci_dev *pdev,
         resource = pci_resource_start(pdev, 0);
         len = pci_resource_len(pdev, 0);
         if (!request_mem_region(resource, len, driver_name)) {
-                ERROR(dev, "controller already in use\n");
+                dev_err(&dev->pdev->dev, "controller already in use\n");
                 retval = -EBUSY;
                 goto error;
         }
@@ -3031,33 +3193,43 @@ static int langwell_udc_probe(struct pci_dev *pdev,
         base = ioremap_nocache(resource, len);
 #endif
         if (base == NULL) {
-                ERROR(dev, "can't map memory\n");
+                dev_err(&dev->pdev->dev, "can't map memory\n");
                 retval = -EFAULT;
                 goto error;
         }
 
         dev->cap_regs = (struct langwell_cap_regs __iomem *) base;
-        VDBG(dev, "dev->cap_regs: %p\n", dev->cap_regs);
+        dev_vdbg(&dev->pdev->dev, "dev->cap_regs: %p\n", dev->cap_regs);
         dev->op_regs = (struct langwell_op_regs __iomem *)
                 (base + OP_REG_OFFSET);
-        VDBG(dev, "dev->op_regs: %p\n", dev->op_regs);
+        dev_vdbg(&dev->pdev->dev, "dev->op_regs: %p\n", dev->op_regs);
 
         /* irq setup after old hardware is cleaned up */
         if (!pdev->irq) {
-                ERROR(dev, "No IRQ. Check PCI setup!\n");
+                dev_err(&dev->pdev->dev, "No IRQ. Check PCI setup!\n");
                 retval = -ENODEV;
                 goto error;
         }
 
+        dev->has_sram = 1;
+        dev->got_sram = 0;
+        dev_vdbg(&dev->pdev->dev, "dev->has_sram: %d\n", dev->has_sram);
+
 #ifndef OTG_TRANSCEIVER
-        INFO(dev, "irq %d, io mem: 0x%08lx, len: 0x%08lx, pci mem 0x%p\n",
+        /* enable SRAM caching if detected */
+        if (dev->has_sram && !dev->got_sram)
+                sram_init(dev);
+
+        dev_info(&dev->pdev->dev,
+                        "irq %d, io mem: 0x%08lx, len: 0x%08lx, pci mem 0x%p\n",
                         pdev->irq, resource, len, base);
         /* enables bus-mastering for device dev */
         pci_set_master(pdev);
 
         if (request_irq(pdev->irq, langwell_irq, IRQF_SHARED,
                                 driver_name, dev) != 0) {
-                ERROR(dev, "request interrupt %d failed\n", pdev->irq);
+                dev_err(&dev->pdev->dev,
+                                "request interrupt %d failed\n", pdev->irq);
                 retval = -EBUSY;
                 goto error;
         }
@@ -3071,32 +3243,34 @@ static int langwell_udc_probe(struct pci_dev *pdev,
         dev->lpm = (readl(&dev->cap_regs->hccparams) & HCC_LEN) ? 1 : 0;
         dev->dciversion = readw(&dev->cap_regs->dciversion);
         dev->devcap = (readl(&dev->cap_regs->dccparams) & DEVCAP) ? 1 : 0;
-        VDBG(dev, "dev->lpm: %d\n", dev->lpm);
-        VDBG(dev, "dev->dciversion: 0x%04x\n", dev->dciversion);
-        VDBG(dev, "dccparams: 0x%08x\n", readl(&dev->cap_regs->dccparams));
-        VDBG(dev, "dev->devcap: %d\n", dev->devcap);
+        dev_vdbg(&dev->pdev->dev, "dev->lpm: %d\n", dev->lpm);
+        dev_vdbg(&dev->pdev->dev, "dev->dciversion: 0x%04x\n",
+                        dev->dciversion);
+        dev_vdbg(&dev->pdev->dev, "dccparams: 0x%08x\n",
+                        readl(&dev->cap_regs->dccparams));
+        dev_vdbg(&dev->pdev->dev, "dev->devcap: %d\n", dev->devcap);
         if (!dev->devcap) {
-                ERROR(dev, "can't support device mode\n");
+                dev_err(&dev->pdev->dev, "can't support device mode\n");
                 retval = -ENODEV;
                 goto error;
         }
 
         /* a pair of endpoints (out/in) for each address */
         dev->ep_max = DEN(readl(&dev->cap_regs->dccparams)) * 2;
-        VDBG(dev, "dev->ep_max: %d\n", dev->ep_max);
+        dev_vdbg(&dev->pdev->dev, "dev->ep_max: %d\n", dev->ep_max);
 
         /* allocate endpoints memory */
         dev->ep = kzalloc(sizeof(struct langwell_ep) * dev->ep_max,
                         GFP_KERNEL);
         if (!dev->ep) {
-                ERROR(dev, "allocate endpoints memory failed\n");
+                dev_err(&dev->pdev->dev, "allocate endpoints memory failed\n");
                 retval = -ENOMEM;
                 goto error;
         }
 
         /* allocate device dQH memory */
         size = dev->ep_max * sizeof(struct langwell_dqh);
-        VDBG(dev, "orig size = %d\n", size);
+        dev_vdbg(&dev->pdev->dev, "orig size = %d\n", size);
         if (size < DQH_ALIGNMENT)
                 size = DQH_ALIGNMENT;
         else if ((size % DQH_ALIGNMENT) != 0) {
@@ -3106,17 +3280,18 @@ static int langwell_udc_probe(struct pci_dev *pdev,
         dev->ep_dqh = dma_alloc_coherent(&pdev->dev, size,
                                         &dev->ep_dqh_dma, GFP_KERNEL);
         if (!dev->ep_dqh) {
-                ERROR(dev, "allocate dQH memory failed\n");
+                dev_err(&dev->pdev->dev, "allocate dQH memory failed\n");
                 retval = -ENOMEM;
                 goto error;
         }
         dev->ep_dqh_size = size;
-        VDBG(dev, "ep_dqh_size = %d\n", dev->ep_dqh_size);
+        dev_vdbg(&dev->pdev->dev, "ep_dqh_size = %d\n", dev->ep_dqh_size);
 
         /* initialize ep0 status request structure */
         dev->status_req = kzalloc(sizeof(struct langwell_request), GFP_KERNEL);
         if (!dev->status_req) {
-                ERROR(dev, "allocate status_req memory failed\n");
+                dev_err(&dev->pdev->dev,
+                                "allocate status_req memory failed\n");
                 retval = -ENOMEM;
                 goto error;
         }
@@ -3129,7 +3304,10 @@ static int langwell_udc_probe(struct pci_dev *pdev,
         dev->resume_state = USB_STATE_NOTATTACHED;
         dev->usb_state = USB_STATE_POWERED;
         dev->ep0_dir = USB_DIR_OUT;
-        dev->remote_wakeup = 0; /* default to 0 on reset */
+
+        /* remote wakeup reset to 0 when the device is reset */
+        dev->remote_wakeup = 0;
+        dev->dev_status = 1 << USB_DEVICE_SELF_POWERED;
 
 #ifndef OTG_TRANSCEIVER
         /* reset device controller */
@@ -3174,18 +3352,20 @@ static int langwell_udc_probe(struct pci_dev *pdev,
         }
 
         /* done */
-        INFO(dev, "%s\n", driver_desc);
-        INFO(dev, "irq %d, pci mem %p\n", pdev->irq, base);
-        INFO(dev, "Driver version: " DRIVER_VERSION "\n");
-        INFO(dev, "Support (max) %d endpoints\n", dev->ep_max);
-        INFO(dev, "Device interface version: 0x%04x\n", dev->dciversion);
-        INFO(dev, "Controller mode: %s\n", dev->devcap ? "Device" : "Host");
-        INFO(dev, "Support USB LPM: %s\n", dev->lpm ? "Yes" : "No");
-
-        VDBG(dev, "After langwell_udc_probe(), print all registers:\n");
-#ifdef  VERBOSE
+        dev_info(&dev->pdev->dev, "%s\n", driver_desc);
+        dev_info(&dev->pdev->dev, "irq %d, pci mem %p\n", pdev->irq, base);
+        dev_info(&dev->pdev->dev, "Driver version: " DRIVER_VERSION "\n");
+        dev_info(&dev->pdev->dev, "Support (max) %d endpoints\n", dev->ep_max);
+        dev_info(&dev->pdev->dev, "Device interface version: 0x%04x\n",
+                        dev->dciversion);
+        dev_info(&dev->pdev->dev, "Controller mode: %s\n",
+                        dev->devcap ? "Device" : "Host");
+        dev_info(&dev->pdev->dev, "Support USB LPM: %s\n",
+                        dev->lpm ? "Yes" : "No");
+
+        dev_vdbg(&dev->pdev->dev,
+                        "After langwell_udc_probe(), print all registers:\n");
         print_all_registers(dev);
-#endif
 
         the_controller = dev;
 
@@ -3197,12 +3377,18 @@ static int langwell_udc_probe(struct pci_dev *pdev,
         if (retval)
                 goto error;
 
-        VDBG(dev, "<--- %s()\n", __func__);
+        retval = device_create_file(&pdev->dev, &dev_attr_remote_wakeup);
+        if (retval)
+                goto error_attr1;
+
+        dev_vdbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return 0;
 
+error_attr1:
+        device_remove_file(&pdev->dev, &dev_attr_langwell_udc);
 error:
         if (dev) {
-                DBG(dev, "<--- %s()\n", __func__);
+                dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
                 langwell_udc_remove(pdev);
         }
 
@@ -3214,32 +3400,45 @@ error:
 static int langwell_udc_suspend(struct pci_dev *pdev, pm_message_t state)
 {
         struct langwell_udc     *dev = the_controller;
-        u32                     devlc;
 
-        DBG(dev, "---> %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         /* disable interrupt and set controller to stop state */
         langwell_udc_stop(dev);
 
-        /* diable IRQ handler */
+        /* disable IRQ handler */
         if (dev->got_irq)
                 free_irq(pdev->irq, dev);
         dev->got_irq = 0;
 
-
         /* save PCI state */
         pci_save_state(pdev);
 
+        spin_lock_irq(&dev->lock);
+        /* stop all usb activities */
+        stop_activity(dev, dev->driver);
+        spin_unlock_irq(&dev->lock);
+
+        /* free dTD dma_pool and dQH */
+        if (dev->dtd_pool)
+                dma_pool_destroy(dev->dtd_pool);
+
+        if (dev->ep_dqh)
+                dma_free_coherent(&pdev->dev, dev->ep_dqh_size,
+                        dev->ep_dqh, dev->ep_dqh_dma);
+
+        /* release SRAM caching */
+        if (dev->has_sram && dev->got_sram)
+                sram_deinit(dev);
+
         /* set device power state */
         pci_set_power_state(pdev, PCI_D3hot);
 
         /* enter PHY low power suspend */
-        devlc = readl(&dev->op_regs->devlc);
-        VDBG(dev, "devlc = 0x%08x\n", devlc);
-        devlc |= LPM_PHCD;
-        writel(devlc, &dev->op_regs->devlc);
+        if (dev->pdev->device != 0x0829)
+                langwell_phy_low_power(dev, 1);
 
-        DBG(dev, "<--- %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return 0;
 }
 
@@ -3248,27 +3447,58 @@ static int langwell_udc_suspend(struct pci_dev *pdev, pm_message_t state)
 static int langwell_udc_resume(struct pci_dev *pdev)
 {
         struct langwell_udc     *dev = the_controller;
-        u32                     devlc;
+        size_t                  size;
 
-        DBG(dev, "---> %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         /* exit PHY low power suspend */
-        devlc = readl(&dev->op_regs->devlc);
-        VDBG(dev, "devlc = 0x%08x\n", devlc);
-        devlc &= ~LPM_PHCD;
-        writel(devlc, &dev->op_regs->devlc);
+        if (dev->pdev->device != 0x0829)
+                langwell_phy_low_power(dev, 0);
 
         /* set device D0 power state */
         pci_set_power_state(pdev, PCI_D0);
 
+        /* enable SRAM caching if detected */
+        if (dev->has_sram && !dev->got_sram)
+                sram_init(dev);
+
+        /* allocate device dQH memory */
+        size = dev->ep_max * sizeof(struct langwell_dqh);
+        dev_vdbg(&dev->pdev->dev, "orig size = %d\n", size);
+        if (size < DQH_ALIGNMENT)
+                size = DQH_ALIGNMENT;
+        else if ((size % DQH_ALIGNMENT) != 0) {
+                size += DQH_ALIGNMENT + 1;
+                size &= ~(DQH_ALIGNMENT - 1);
+        }
+        dev->ep_dqh = dma_alloc_coherent(&pdev->dev, size,
+                                        &dev->ep_dqh_dma, GFP_KERNEL);
+        if (!dev->ep_dqh) {
+                dev_err(&dev->pdev->dev, "allocate dQH memory failed\n");
+                return -ENOMEM;
+        }
+        dev->ep_dqh_size = size;
+        dev_vdbg(&dev->pdev->dev, "ep_dqh_size = %d\n", dev->ep_dqh_size);
+
+        /* create dTD dma_pool resource */
+        dev->dtd_pool = dma_pool_create("langwell_dtd",
+                        &dev->pdev->dev,
+                        sizeof(struct langwell_dtd),
+                        DTD_ALIGNMENT,
+                        DMA_BOUNDARY);
+
+        if (!dev->dtd_pool)
+                return -ENOMEM;
+
         /* restore PCI state */
         pci_restore_state(pdev);
 
         /* enable IRQ handler */
-        if (request_irq(pdev->irq, langwell_irq, IRQF_SHARED, driver_name, dev)
-                        != 0) {
-                ERROR(dev, "request interrupt %d failed\n", pdev->irq);
-                return -1;
+        if (request_irq(pdev->irq, langwell_irq, IRQF_SHARED,
+                                driver_name, dev) != 0) {
+                dev_err(&dev->pdev->dev, "request interrupt %d failed\n",
+                                pdev->irq);
+                return -EBUSY;
         }
         dev->got_irq = 1;
 
@@ -3290,7 +3520,7 @@ static int langwell_udc_resume(struct pci_dev *pdev)
         dev->ep0_state = WAIT_FOR_SETUP;
         dev->ep0_dir = USB_DIR_OUT;
 
-        DBG(dev, "<--- %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
         return 0;
 }
 
@@ -3301,15 +3531,15 @@ static void langwell_udc_shutdown(struct pci_dev *pdev)
         struct langwell_udc     *dev = the_controller;
         u32                     usbmode;
 
-        DBG(dev, "---> %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
 
         /* reset controller mode to IDLE */
         usbmode = readl(&dev->op_regs->usbmode);
-        DBG(dev, "usbmode = 0x%08x\n", usbmode);
+        dev_dbg(&dev->pdev->dev, "usbmode = 0x%08x\n", usbmode);
         usbmode &= (~3 | MODE_IDLE);
         writel(usbmode, &dev->op_regs->usbmode);
 
-        DBG(dev, "<--- %s()\n", __func__);
+        dev_dbg(&dev->pdev->dev, "<--- %s()\n", __func__);
 }
 
 /*-------------------------------------------------------------------------*/
@@ -3324,7 +3554,6 @@ static const struct pci_device_id pci_ids[] = { {
 }, { /* end: all zeroes */ }
 };
 
-
 MODULE_DEVICE_TABLE(pci, pci_ids);
 
 
@@ -3343,12 +3572,6 @@ static struct pci_driver langwell_pci_driver = {
 };
 
 
-MODULE_DESCRIPTION(DRIVER_DESC);
-MODULE_AUTHOR("Xiaochen Shen <xiaochen.shen@intel.com>");
-MODULE_VERSION(DRIVER_VERSION);
-MODULE_LICENSE("GPL");
-
-
 static int __init init(void)
 {
 #ifdef  OTG_TRANSCEIVER
@@ -3370,3 +3593,9 @@ static void __exit cleanup(void)
 }
 module_exit(cleanup);
 
+
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_AUTHOR("Xiaochen Shen <xiaochen.shen@intel.com>");
+MODULE_VERSION(DRIVER_VERSION);
+MODULE_LICENSE("GPL");
+
diff --git a/drivers/usb/gadget/langwell_udc.h b/drivers/usb/gadget/langwell_udc.h
index 9719934e1c08..f1d9c1bb04f3 100644
--- a/drivers/usb/gadget/langwell_udc.h
+++ b/drivers/usb/gadget/langwell_udc.h
@@ -18,11 +18,7 @@
  */
 
 #include <linux/usb/langwell_udc.h>
-
-#if defined(CONFIG_USB_LANGWELL_OTG)
 #include <linux/usb/langwell_otg.h>
-#endif
-
 
 /*-------------------------------------------------------------------------*/
 
@@ -199,7 +195,9 @@ struct langwell_udc {
                                 vbus_active:1,
                                 suspended:1,
                                 stopped:1,
-                                lpm:1;  /* LPM capability */
+                                lpm:1,          /* LPM capability */
+                                has_sram:1,     /* SRAM caching */
+                                got_sram:1;
 
         /* pci state used to access those endpoints */
         struct pci_dev          *pdev;
@@ -224,5 +222,12 @@ struct langwell_udc {
 
         /* make sure release() is done */
         struct completion       *done;
+
+        /* for private SRAM caching */
+        unsigned int            sram_addr;
+        unsigned int            sram_size;
+
+        /* device status data for get_status request */
+        u16                     dev_status;
 };
 
diff --git a/drivers/usb/gadget/lh7a40x_udc.c b/drivers/usb/gadget/lh7a40x_udc.c
deleted file mode 100644
index fded3fca793b..000000000000
--- a/drivers/usb/gadget/lh7a40x_udc.c
+++ /dev/null
@@ -1,2152 +0,0 @@
-/*
- * linux/drivers/usb/gadget/lh7a40x_udc.c
- * Sharp LH7A40x on-chip full speed USB device controllers
- *
- * Copyright (C) 2004 Mikko Lahteenmaki, Nordic ID
- * Copyright (C) 2004 Bo Henriksen, Nordic ID
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- */
-
-#include <linux/platform_device.h>
-#include <linux/slab.h>
-
-#include "lh7a40x_udc.h"
-
-//#define DEBUG printk
-//#define DEBUG_EP0 printk
-//#define DEBUG_SETUP printk
-
-#ifndef DEBUG_EP0
-# define DEBUG_EP0(fmt,args...)
-#endif
-#ifndef DEBUG_SETUP
-# define DEBUG_SETUP(fmt,args...)
-#endif
-#ifndef DEBUG
-# define NO_STATES
-# define DEBUG(fmt,args...)
-#endif
-
-#define DRIVER_DESC                     "LH7A40x USB Device Controller"
-#define DRIVER_VERSION          __DATE__
-
-#ifndef _BIT                    /* FIXME - what happended to _BIT in 2.6.7bk18? */
-#define _BIT(x) (1<<(x))
-#endif
-
-struct lh7a40x_udc *the_controller;
-
-static const char driver_name[] = "lh7a40x_udc";
-static const char driver_desc[] = DRIVER_DESC;
-static const char ep0name[] = "ep0-control";
-
-/*
-  Local definintions.
-*/
-
-#ifndef NO_STATES
-static char *state_names[] = {
-        "WAIT_FOR_SETUP",
-        "DATA_STATE_XMIT",
-        "DATA_STATE_NEED_ZLP",
-        "WAIT_FOR_OUT_STATUS",
-        "DATA_STATE_RECV"
-};
-#endif
-
-/*
-  Local declarations.
-*/
-static int lh7a40x_ep_enable(struct usb_ep *ep,
-                             const struct usb_endpoint_descriptor *);
-static int lh7a40x_ep_disable(struct usb_ep *ep);
-static struct usb_request *lh7a40x_alloc_request(struct usb_ep *ep, gfp_t);
-static void lh7a40x_free_request(struct usb_ep *ep, struct usb_request *);
-static int lh7a40x_queue(struct usb_ep *ep, struct usb_request *, gfp_t);
-static int lh7a40x_dequeue(struct usb_ep *ep, struct usb_request *);
-static int lh7a40x_set_halt(struct usb_ep *ep, int);
-static int lh7a40x_fifo_status(struct usb_ep *ep);
-static void lh7a40x_fifo_flush(struct usb_ep *ep);
-static void lh7a40x_ep0_kick(struct lh7a40x_udc *dev, struct lh7a40x_ep *ep);
-static void lh7a40x_handle_ep0(struct lh7a40x_udc *dev, u32 intr);
-
-static void done(struct lh7a40x_ep *ep, struct lh7a40x_request *req,
-                 int status);
-static void pio_irq_enable(int bEndpointAddress);
-static void pio_irq_disable(int bEndpointAddress);
-static void stop_activity(struct lh7a40x_udc *dev,
-                          struct usb_gadget_driver *driver);
-static void flush(struct lh7a40x_ep *ep);
-static void udc_enable(struct lh7a40x_udc *dev);
-static void udc_set_address(struct lh7a40x_udc *dev, unsigned char address);
-
-static struct usb_ep_ops lh7a40x_ep_ops = {
-        .enable = lh7a40x_ep_enable,
-        .disable = lh7a40x_ep_disable,
-
-        .alloc_request = lh7a40x_alloc_request,
-        .free_request = lh7a40x_free_request,
-
-        .queue = lh7a40x_queue,
-        .dequeue = lh7a40x_dequeue,
-
-        .set_halt = lh7a40x_set_halt,
-        .fifo_status = lh7a40x_fifo_status,
-        .fifo_flush = lh7a40x_fifo_flush,
-};
-
-/* Inline code */
-
-static __inline__ int write_packet(struct lh7a40x_ep *ep,
-                                   struct lh7a40x_request *req, int max)
-{
-        u8 *buf;
-        int length, count;
-        volatile u32 *fifo = (volatile u32 *)ep->fifo;
-
-        buf = req->req.buf + req->req.actual;
-        prefetch(buf);
-
-        length = req->req.length - req->req.actual;
-        length = min(length, max);
-        req->req.actual += length;
-
-        DEBUG("Write %d (max %d), fifo %p\n", length, max, fifo);
-
-        count = length;
-        while (count--) {
-                *fifo = *buf++;
-        }
-
-        return length;
-}
-
-static __inline__ void usb_set_index(u32 ep)
-{
-        *(volatile u32 *)io_p2v(USB_INDEX) = ep;
-}
-
-static __inline__ u32 usb_read(u32 port)
-{
-        return *(volatile u32 *)io_p2v(port);
-}
-
-static __inline__ void usb_write(u32 val, u32 port)
-{
-        *(volatile u32 *)io_p2v(port) = val;
-}
-
-static __inline__ void usb_set(u32 val, u32 port)
-{
-        volatile u32 *ioport = (volatile u32 *)io_p2v(port);
-        u32 after = (*ioport) | val;
-        *ioport = after;
-}
-
-static __inline__ void usb_clear(u32 val, u32 port)
-{
-        volatile u32 *ioport = (volatile u32 *)io_p2v(port);
-        u32 after = (*ioport) & ~val;
-        *ioport = after;
-}
-
-/*-------------------------------------------------------------------------*/
-
-#define GPIO_PORTC_DR   (0x80000E08)
-#define GPIO_PORTC_DDR  (0x80000E18)
-#define GPIO_PORTC_PDR  (0x80000E70)
-
-/* get port C pin data register */
-#define get_portc_pdr(bit)              ((usb_read(GPIO_PORTC_PDR) & _BIT(bit)) != 0)
-/* get port C data direction register */
-#define get_portc_ddr(bit)              ((usb_read(GPIO_PORTC_DDR) & _BIT(bit)) != 0)
-/* set port C data register */
-#define set_portc_dr(bit, val)  (val ? usb_set(_BIT(bit), GPIO_PORTC_DR) : usb_clear(_BIT(bit), GPIO_PORTC_DR))
-/* set port C data direction register */
-#define set_portc_ddr(bit, val) (val ? usb_set(_BIT(bit), GPIO_PORTC_DDR) : usb_clear(_BIT(bit), GPIO_PORTC_DDR))
-
-/*
- * LPD7A404 GPIO's:
- * Port C bit 1 = USB Port 1 Power Enable
- * Port C bit 2 = USB Port 1 Data Carrier Detect
- */
-#define is_usb_connected()              get_portc_pdr(2)
-
-#ifdef CONFIG_USB_GADGET_DEBUG_FILES
-
-static const char proc_node_name[] = "driver/udc";
-
-static int
-udc_proc_read(char *page, char **start, off_t off, int count,
-              int *eof, void *_dev)
-{
-        char *buf = page;
-        struct lh7a40x_udc *dev = _dev;
-        char *next = buf;
-        unsigned size = count;
-        unsigned long flags;
-        int t;
-
-        if (off != 0)
-                return 0;
-
-        local_irq_save(flags);
-
-        /* basic device status */
-        t = scnprintf(next, size,
-                      DRIVER_DESC "\n"
-                      "%s version: %s\n"
-                      "Gadget driver: %s\n"
-                      "Host: %s\n\n",
-                      driver_name, DRIVER_VERSION,
-                      dev->driver ? dev->driver->driver.name : "(none)",
-                      is_usb_connected()? "full speed" : "disconnected");
-        size -= t;
-        next += t;
-
-        t = scnprintf(next, size,
-                      "GPIO:\n"
-                      " Port C bit 1: %d, dir %d\n"
-                      " Port C bit 2: %d, dir %d\n\n",
-                      get_portc_pdr(1), get_portc_ddr(1),
-                      get_portc_pdr(2), get_portc_ddr(2)
-            );
-        size -= t;
-        next += t;
-
-        t = scnprintf(next, size,
-                      "DCP pullup: %d\n\n",
-                      (usb_read(USB_PM) & PM_USB_DCP) != 0);
-        size -= t;
-        next += t;
-
-        local_irq_restore(flags);
-        *eof = 1;
-        return count - size;
-}
-
-#define create_proc_files()     create_proc_read_entry(proc_node_name, 0, NULL, udc_proc_read, dev)
-#define remove_proc_files()     remove_proc_entry(proc_node_name, NULL)
-
-#else   /* !CONFIG_USB_GADGET_DEBUG_FILES */
-
-#define create_proc_files() do {} while (0)
-#define remove_proc_files() do {} while (0)
-
-#endif  /* CONFIG_USB_GADGET_DEBUG_FILES */
-
-/*
- *      udc_disable - disable USB device controller
- */
-static void udc_disable(struct lh7a40x_udc *dev)
-{
-        DEBUG("%s, %p\n", __func__, dev);
-
-        udc_set_address(dev, 0);
-
-        /* Disable interrupts */
-        usb_write(0, USB_IN_INT_EN);
-        usb_write(0, USB_OUT_INT_EN);
-        usb_write(0, USB_INT_EN);
-
-        /* Disable the USB */
-        usb_write(0, USB_PM);
-
-#ifdef CONFIG_ARCH_LH7A404
-        /* Disable USB power */
-        set_portc_dr(1, 0);
-#endif
-
-        /* if hardware supports it, disconnect from usb */
-        /* make_usb_disappear(); */
-
-        dev->ep0state = WAIT_FOR_SETUP;
-        dev->gadget.speed = USB_SPEED_UNKNOWN;
-        dev->usb_address = 0;
-}
-
-/*
- *      udc_reinit - initialize software state
- */
-static void udc_reinit(struct lh7a40x_udc *dev)
-{
-        u32 i;
-
-        DEBUG("%s, %p\n", __func__, dev);
-
-        /* device/ep0 records init */
-        INIT_LIST_HEAD(&dev->gadget.ep_list);
-        INIT_LIST_HEAD(&dev->gadget.ep0->ep_list);
-        dev->ep0state = WAIT_FOR_SETUP;
-
-        /* basic endpoint records init */
-        for (i = 0; i < UDC_MAX_ENDPOINTS; i++) {
-                struct lh7a40x_ep *ep = &dev->ep[i];
-
-                if (i != 0)
-                        list_add_tail(&ep->ep.ep_list, &dev->gadget.ep_list);
-
-                ep->desc = 0;
-                ep->stopped = 0;
-                INIT_LIST_HEAD(&ep->queue);
-                ep->pio_irqs = 0;
-        }
-
-        /* the rest was statically initialized, and is read-only */
-}
-
-#define BYTES2MAXP(x)   (x / 8)
-#define MAXP2BYTES(x)   (x * 8)
-
-/* until it's enabled, this UDC should be completely invisible
- * to any USB host.
- */
-static void udc_enable(struct lh7a40x_udc *dev)
-{
-        int ep;
-
-        DEBUG("%s, %p\n", __func__, dev);
-
-        dev->gadget.speed = USB_SPEED_UNKNOWN;
-
-#ifdef CONFIG_ARCH_LH7A404
-        /* Set Port C bit 1 & 2 as output */
-        set_portc_ddr(1, 1);
-        set_portc_ddr(2, 1);
-
-        /* Enable USB power */
-        set_portc_dr(1, 0);
-#endif
-
-        /*
-         * C.f Chapter 18.1.3.1 Initializing the USB
-         */
-
-        /* Disable the USB */
-        usb_clear(PM_USB_ENABLE, USB_PM);
-
-        /* Reset APB & I/O sides of the USB */
-        usb_set(USB_RESET_APB | USB_RESET_IO, USB_RESET);
-        mdelay(5);
-        usb_clear(USB_RESET_APB | USB_RESET_IO, USB_RESET);
-
-        /* Set MAXP values for each */
-        for (ep = 0; ep < UDC_MAX_ENDPOINTS; ep++) {
-                struct lh7a40x_ep *ep_reg = &dev->ep[ep];
-                u32 csr;
-
-                usb_set_index(ep);
-
-                switch (ep_reg->ep_type) {
-                case ep_bulk_in:
-                case ep_interrupt:
-                        usb_clear(USB_IN_CSR2_USB_DMA_EN | USB_IN_CSR2_AUTO_SET,
-                                  ep_reg->csr2);
-                        /* Fall through */
-                case ep_control:
-                        usb_write(BYTES2MAXP(ep_maxpacket(ep_reg)),
-                                  USB_IN_MAXP);
-                        break;
-                case ep_bulk_out:
-                        usb_clear(USB_OUT_CSR2_USB_DMA_EN |
-                                  USB_OUT_CSR2_AUTO_CLR, ep_reg->csr2);
-                        usb_write(BYTES2MAXP(ep_maxpacket(ep_reg)),
-                                  USB_OUT_MAXP);
-                        break;
-                }
-
-                /* Read & Write CSR1, just in case */
-                csr = usb_read(ep_reg->csr1);
-                usb_write(csr, ep_reg->csr1);
-
-                flush(ep_reg);
-        }
-
-        /* Disable interrupts */
-        usb_write(0, USB_IN_INT_EN);
-        usb_write(0, USB_OUT_INT_EN);
-        usb_write(0, USB_INT_EN);
-
-        /* Enable interrupts */
-        usb_set(USB_IN_INT_EP0, USB_IN_INT_EN);
-        usb_set(USB_INT_RESET_INT | USB_INT_RESUME_INT, USB_INT_EN);
-        /* Dont enable rest of the interrupts */
-        /* usb_set(USB_IN_INT_EP3 | USB_IN_INT_EP1 | USB_IN_INT_EP0, USB_IN_INT_EN);
-           usb_set(USB_OUT_INT_EP2, USB_OUT_INT_EN); */
-
-        /* Enable SUSPEND */
-        usb_set(PM_ENABLE_SUSPEND, USB_PM);
-
-        /* Enable the USB */
-        usb_set(PM_USB_ENABLE, USB_PM);
-
-#ifdef CONFIG_ARCH_LH7A404
-        /* NOTE: DOES NOT WORK! */
-        /* Let host detect UDC:
-         * Software must write a 0 to the PMR:DCP_CTRL bit to turn this
-         * transistor on and pull the USBDP pin HIGH.
-         */
-        /* usb_clear(PM_USB_DCP, USB_PM);
-           usb_set(PM_USB_DCP, USB_PM); */
-#endif
-}
-
-/*
-  Register entry point for the peripheral controller driver.
-*/
-int usb_gadget_register_driver(struct usb_gadget_driver *driver)
-{
-        struct lh7a40x_udc *dev = the_controller;
-        int retval;
-
-        DEBUG("%s: %s\n", __func__, driver->driver.name);
-
-        if (!driver
-                        || driver->speed != USB_SPEED_FULL
-                        || !driver->bind
-                        || !driver->disconnect
-                        || !driver->setup)
-                return -EINVAL;
-        if (!dev)
-                return -ENODEV;
-        if (dev->driver)
-                return -EBUSY;
-
-        /* first hook up the driver ... */
-        dev->driver = driver;
-        dev->gadget.dev.driver = &driver->driver;
-
-        device_add(&dev->gadget.dev);
-        retval = driver->bind(&dev->gadget);
-        if (retval) {
-                printk(KERN_WARNING "%s: bind to driver %s --> error %d\n",
-                       dev->gadget.name, driver->driver.name, retval);
-                device_del(&dev->gadget.dev);
-
-                dev->driver = 0;
-                dev->gadget.dev.driver = 0;
-                return retval;
-        }
-
-        /* ... then enable host detection and ep0; and we're ready
-         * for set_configuration as well as eventual disconnect.
-         * NOTE:  this shouldn't power up until later.
-         */
-        printk(KERN_WARNING "%s: registered gadget driver '%s'\n",
-               dev->gadget.name, driver->driver.name);
-
-        udc_enable(dev);
-
-        return 0;
-}
-
-EXPORT_SYMBOL(usb_gadget_register_driver);
-
-/*
-  Unregister entry point for the peripheral controller driver.
-*/
-int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
-{
-        struct lh7a40x_udc *dev = the_controller;
-        unsigned long flags;
-
-        if (!dev)
-                return -ENODEV;
-        if (!driver || driver != dev->driver || !driver->unbind)
-                return -EINVAL;
-
-        spin_lock_irqsave(&dev->lock, flags);
-        dev->driver = 0;
-        stop_activity(dev, driver);
-        spin_unlock_irqrestore(&dev->lock, flags);
-
-        driver->unbind(&dev->gadget);
-        dev->gadget.dev.driver = NULL;
-        device_del(&dev->gadget.dev);
-
-        udc_disable(dev);
-
-        DEBUG("unregistered gadget driver '%s'\n", driver->driver.name);
-        return 0;
-}
-
-EXPORT_SYMBOL(usb_gadget_unregister_driver);
-
-/*-------------------------------------------------------------------------*/
-
-/** Write request to FIFO (max write == maxp size)
- *  Return:  0 = still running, 1 = completed, negative = errno
- *  NOTE: INDEX register must be set for EP
- */
-static int write_fifo(struct lh7a40x_ep *ep, struct lh7a40x_request *req)
-{
-        u32 max;
-        u32 csr;
-
-        max = le16_to_cpu(ep->desc->wMaxPacketSize);
-
-        csr = usb_read(ep->csr1);
-        DEBUG("CSR: %x %d\n", csr, csr & USB_IN_CSR1_FIFO_NOT_EMPTY);
-
-        if (!(csr & USB_IN_CSR1_FIFO_NOT_EMPTY)) {
-                unsigned count;
-                int is_last, is_short;
-
-                count = write_packet(ep, req, max);
-                usb_set(USB_IN_CSR1_IN_PKT_RDY, ep->csr1);
-
-                /* last packet is usually short (or a zlp) */
-                if (unlikely(count != max))
-                        is_last = is_short = 1;
-                else {
-                        if (likely(req->req.length != req->req.actual)
-                            || req->req.zero)
-                                is_last = 0;
-                        else
-                                is_last = 1;
-                        /* interrupt/iso maxpacket may not fill the fifo */
-                        is_short = unlikely(max < ep_maxpacket(ep));
-                }
-
-                DEBUG("%s: wrote %s %d bytes%s%s %d left %p\n", __func__,
-                      ep->ep.name, count,
-                      is_last ? "/L" : "", is_short ? "/S" : "",
-                      req->req.length - req->req.actual, req);
-
-                /* requests complete when all IN data is in the FIFO */
-                if (is_last) {
-                        done(ep, req, 0);
-                        if (list_empty(&ep->queue)) {
-                                pio_irq_disable(ep_index(ep));
-                        }
-                        return 1;
-                }
-        } else {
-                DEBUG("Hmm.. %d ep FIFO is not empty!\n", ep_index(ep));
-        }
-
-        return 0;
-}
-
-/** Read to request from FIFO (max read == bytes in fifo)
- *  Return:  0 = still running, 1 = completed, negative = errno
- *  NOTE: INDEX register must be set for EP
- */
-static int read_fifo(struct lh7a40x_ep *ep, struct lh7a40x_request *req)
-{
-        u32 csr;
-        u8 *buf;
-        unsigned bufferspace, count, is_short;
-        volatile u32 *fifo = (volatile u32 *)ep->fifo;
-
-        /* make sure there's a packet in the FIFO. */
-        csr = usb_read(ep->csr1);
-        if (!(csr & USB_OUT_CSR1_OUT_PKT_RDY)) {
-                DEBUG("%s: Packet NOT ready!\n", __func__);
-                return -EINVAL;
-        }
-
-        buf = req->req.buf + req->req.actual;
-        prefetchw(buf);
-        bufferspace = req->req.length - req->req.actual;
-
-        /* read all bytes from this packet */
-        count = usb_read(USB_OUT_FIFO_WC1);
-        req->req.actual += min(count, bufferspace);
-
-        is_short = (count < ep->ep.maxpacket);
-        DEBUG("read %s %02x, %d bytes%s req %p %d/%d\n",
-              ep->ep.name, csr, count,
-              is_short ? "/S" : "", req, req->req.actual, req->req.length);
-
-        while (likely(count-- != 0)) {
-                u8 byte = (u8) (*fifo & 0xff);
-
-                if (unlikely(bufferspace == 0)) {
-                        /* this happens when the driver's buffer
-                         * is smaller than what the host sent.
-                         * discard the extra data.
-                         */
-                        if (req->req.status != -EOVERFLOW)
-                                printk(KERN_WARNING "%s overflow %d\n",
-                                       ep->ep.name, count);
-                        req->req.status = -EOVERFLOW;
-                } else {
-                        *buf++ = byte;
-                        bufferspace--;
-                }
-        }
-
-        usb_clear(USB_OUT_CSR1_OUT_PKT_RDY, ep->csr1);
-
-        /* completion */
-        if (is_short || req->req.actual == req->req.length) {
-                done(ep, req, 0);
-                usb_set(USB_OUT_CSR1_FIFO_FLUSH, ep->csr1);
-
-                if (list_empty(&ep->queue))
-                        pio_irq_disable(ep_index(ep));
-                return 1;
-        }
-
-        /* finished that packet.  the next one may be waiting... */
-        return 0;
-}
-
-/*
- *      done - retire a request; caller blocked irqs
- *  INDEX register is preserved to keep same
- */
-static void done(struct lh7a40x_ep *ep, struct lh7a40x_request *req, int status)
-{
-        unsigned int stopped = ep->stopped;
-        u32 index;
-
-        DEBUG("%s, %p\n", __func__, ep);
-        list_del_init(&req->queue);
-
-        if (likely(req->req.status == -EINPROGRESS))
-                req->req.status = status;
-        else
-                status = req->req.status;
-
-        if (status && status != -ESHUTDOWN)
-                DEBUG("complete %s req %p stat %d len %u/%u\n",
-                      ep->ep.name, &req->req, status,
-                      req->req.actual, req->req.length);
-
-        /* don't modify queue heads during completion callback */
-        ep->stopped = 1;
-        /* Read current index (completion may modify it) */
-        index = usb_read(USB_INDEX);
-
-        spin_unlock(&ep->dev->lock);
-        req->req.complete(&ep->ep, &req->req);
-        spin_lock(&ep->dev->lock);
-
-        /* Restore index */
-        usb_set_index(index);
-        ep->stopped = stopped;
-}
-
-/** Enable EP interrupt */
-static void pio_irq_enable(int ep)
-{
-        DEBUG("%s: %d\n", __func__, ep);
-
-        switch (ep) {
-        case 1:
-                usb_set(USB_IN_INT_EP1, USB_IN_INT_EN);
-                break;
-        case 2:
-                usb_set(USB_OUT_INT_EP2, USB_OUT_INT_EN);
-                break;
-        case 3:
-                usb_set(USB_IN_INT_EP3, USB_IN_INT_EN);
-                break;
-        default:
-                DEBUG("Unknown endpoint: %d\n", ep);
-                break;
-        }
-}
-
-/** Disable EP interrupt */
-static void pio_irq_disable(int ep)
-{
-        DEBUG("%s: %d\n", __func__, ep);
-
-        switch (ep) {
-        case 1:
-                usb_clear(USB_IN_INT_EP1, USB_IN_INT_EN);
-                break;
-        case 2:
-                usb_clear(USB_OUT_INT_EP2, USB_OUT_INT_EN);
-                break;
-        case 3:
-                usb_clear(USB_IN_INT_EP3, USB_IN_INT_EN);
-                break;
-        default:
-                DEBUG("Unknown endpoint: %d\n", ep);
-                break;
-        }
-}
-
-/*
- *      nuke - dequeue ALL requests
- */
-void nuke(struct lh7a40x_ep *ep, int status)
-{
-        struct lh7a40x_request *req;
-
-        DEBUG("%s, %p\n", __func__, ep);
-
-        /* Flush FIFO */
-        flush(ep);
-
-        /* called with irqs blocked */
-        while (!list_empty(&ep->queue)) {
-                req = list_entry(ep->queue.next, struct lh7a40x_request, queue);
-                done(ep, req, status);
-        }
-
-        /* Disable IRQ if EP is enabled (has descriptor) */
-        if (ep->desc)
-                pio_irq_disable(ep_index(ep));
-}
-
-/*
-void nuke_all(struct lh7a40x_udc *dev)
-{
-        int n;
-        for(n=0; n<UDC_MAX_ENDPOINTS; n++) {
-                struct lh7a40x_ep *ep = &dev->ep[n];
-                usb_set_index(n);
-                nuke(ep, 0);
-        }
-}*/
-
-/*
-static void flush_all(struct lh7a40x_udc *dev)
-{
-        int n;
-    for (n = 0; n < UDC_MAX_ENDPOINTS; n++)
-    {
-                struct lh7a40x_ep *ep = &dev->ep[n];
-                flush(ep);
-    }
-}
-*/
-
-/** Flush EP
- * NOTE: INDEX register must be set before this call
- */
-static void flush(struct lh7a40x_ep *ep)
-{
-        DEBUG("%s, %p\n", __func__, ep);
-
-        switch (ep->ep_type) {
-        case ep_control:
-                /* check, by implication c.f. 15.1.2.11 */
-                break;
-
-        case ep_bulk_in:
-        case ep_interrupt:
-                /* if(csr & USB_IN_CSR1_IN_PKT_RDY) */
-                usb_set(USB_IN_CSR1_FIFO_FLUSH, ep->csr1);
-                break;
-
-        case ep_bulk_out:
-                /* if(csr & USB_OUT_CSR1_OUT_PKT_RDY) */
-                usb_set(USB_OUT_CSR1_FIFO_FLUSH, ep->csr1);
-                break;
-        }
-}
-
-/**
- * lh7a40x_in_epn - handle IN interrupt
- */
-static void lh7a40x_in_epn(struct lh7a40x_udc *dev, u32 ep_idx, u32 intr)
-{
-        u32 csr;
-        struct lh7a40x_ep *ep = &dev->ep[ep_idx];
-        struct lh7a40x_request *req;
-
-        usb_set_index(ep_idx);
-
-        csr = usb_read(ep->csr1);
-        DEBUG("%s: %d, csr %x\n", __func__, ep_idx, csr);
-
-        if (csr & USB_IN_CSR1_SENT_STALL) {
-                DEBUG("USB_IN_CSR1_SENT_STALL\n");
-                usb_set(USB_IN_CSR1_SENT_STALL /*|USB_IN_CSR1_SEND_STALL */ ,
-                        ep->csr1);
-                return;
-        }
-
-        if (!ep->desc) {
-                DEBUG("%s: NO EP DESC\n", __func__);
-                return;
-        }
-
-        if (list_empty(&ep->queue))
-                req = 0;
-        else
-                req = list_entry(ep->queue.next, struct lh7a40x_request, queue);
-
-        DEBUG("req: %p\n", req);
-
-        if (!req)
-                return;
-
-        write_fifo(ep, req);
-}
-
-/* ********************************************************************************************* */
-/* Bulk OUT (recv)
- */
-
-static void lh7a40x_out_epn(struct lh7a40x_udc *dev, u32 ep_idx, u32 intr)
-{
-        struct lh7a40x_ep *ep = &dev->ep[ep_idx];
-        struct lh7a40x_request *req;
-
-        DEBUG("%s: %d\n", __func__, ep_idx);
-
-        usb_set_index(ep_idx);
-
-        if (ep->desc) {
-                u32 csr;
-                csr = usb_read(ep->csr1);
-
-                while ((csr =
-                        usb_read(ep->
-                                 csr1)) & (USB_OUT_CSR1_OUT_PKT_RDY |
-                                           USB_OUT_CSR1_SENT_STALL)) {
-                        DEBUG("%s: %x\n", __func__, csr);
-
-                        if (csr & USB_OUT_CSR1_SENT_STALL) {
-                                DEBUG("%s: stall sent, flush fifo\n",
-                                      __func__);
-                                /* usb_set(USB_OUT_CSR1_FIFO_FLUSH, ep->csr1); */
-                                flush(ep);
-                        } else if (csr & USB_OUT_CSR1_OUT_PKT_RDY) {
-                                if (list_empty(&ep->queue))
-                                        req = 0;
-                                else
-                                        req =
-                                            list_entry(ep->queue.next,
-                                                       struct lh7a40x_request,
-                                                       queue);
-
-                                if (!req) {
-                                        printk(KERN_WARNING
-                                               "%s: NULL REQ %d\n",
-                                               __func__, ep_idx);
-                                        flush(ep);
-                                        break;
-                                } else {
-                                        read_fifo(ep, req);
-                                }
-                        }
-
-                }
-
-        } else {
-                /* Throw packet away.. */
-                printk(KERN_WARNING "%s: No descriptor?!?\n", __func__);
-                flush(ep);
-        }
-}
-
-static void stop_activity(struct lh7a40x_udc *dev,
-                          struct usb_gadget_driver *driver)
-{
-        int i;
-
-        /* don't disconnect drivers more than once */
-        if (dev->gadget.speed == USB_SPEED_UNKNOWN)
-                driver = 0;
-        dev->gadget.speed = USB_SPEED_UNKNOWN;
-
-        /* prevent new request submissions, kill any outstanding requests  */
-        for (i = 0; i < UDC_MAX_ENDPOINTS; i++) {
-                struct lh7a40x_ep *ep = &dev->ep[i];
-                ep->stopped = 1;
-
-                usb_set_index(i);
-                nuke(ep, -ESHUTDOWN);
-        }
-
-        /* report disconnect; the driver is already quiesced */
-        if (driver) {
-                spin_unlock(&dev->lock);
-                driver->disconnect(&dev->gadget);
-                spin_lock(&dev->lock);
-        }
-
-        /* re-init driver-visible data structures */
-        udc_reinit(dev);
-}
-
-/** Handle USB RESET interrupt
- */
-static void lh7a40x_reset_intr(struct lh7a40x_udc *dev)
-{
-#if 0                           /* def CONFIG_ARCH_LH7A404 */
-        /* Does not work always... */
-
-        DEBUG("%s: %d\n", __func__, dev->usb_address);
-
-        if (!dev->usb_address) {
-                /*usb_set(USB_RESET_IO, USB_RESET);
-                   mdelay(5);
-                   usb_clear(USB_RESET_IO, USB_RESET); */
-                return;
-        }
-        /* Put the USB controller into reset. */
-        usb_set(USB_RESET_IO, USB_RESET);
-
-        /* Set Device ID to 0 */
-        udc_set_address(dev, 0);
-
-        /* Let PLL2 settle down */
-        mdelay(5);
-
-        /* Release the USB controller from reset */
-        usb_clear(USB_RESET_IO, USB_RESET);
-
-        /* Re-enable UDC */
-        udc_enable(dev);
-
-#endif
-        dev->gadget.speed = USB_SPEED_FULL;
-}
-
-/*
- *      lh7a40x usb client interrupt handler.
- */
-static irqreturn_t lh7a40x_udc_irq(int irq, void *_dev)
-{
-        struct lh7a40x_udc *dev = _dev;
-
-        DEBUG("\n\n");
-
-        spin_lock(&dev->lock);
-
-        for (;;) {
-                u32 intr_in = usb_read(USB_IN_INT);
-                u32 intr_out = usb_read(USB_OUT_INT);
-                u32 intr_int = usb_read(USB_INT);
-
-                /* Test also against enable bits.. (lh7a40x errata).. Sigh.. */
-                u32 in_en = usb_read(USB_IN_INT_EN);
-                u32 out_en = usb_read(USB_OUT_INT_EN);
-
-                if (!intr_out && !intr_in && !intr_int)
-                        break;
-
-                DEBUG("%s (on state %s)\n", __func__,
-                      state_names[dev->ep0state]);
-                DEBUG("intr_out = %x\n", intr_out);
-                DEBUG("intr_in  = %x\n", intr_in);
-                DEBUG("intr_int = %x\n", intr_int);
-
-                if (intr_in) {
-                        usb_write(intr_in, USB_IN_INT);
-
-                        if ((intr_in & USB_IN_INT_EP1)
-                            && (in_en & USB_IN_INT_EP1)) {
-                                DEBUG("USB_IN_INT_EP1\n");
-                                lh7a40x_in_epn(dev, 1, intr_in);
-                        }
-                        if ((intr_in & USB_IN_INT_EP3)
-                            && (in_en & USB_IN_INT_EP3)) {
-                                DEBUG("USB_IN_INT_EP3\n");
-                                lh7a40x_in_epn(dev, 3, intr_in);
-                        }
-                        if (intr_in & USB_IN_INT_EP0) {
-                                DEBUG("USB_IN_INT_EP0 (control)\n");
-                                lh7a40x_handle_ep0(dev, intr_in);
-                        }
-                }
-
-                if (intr_out) {
-                        usb_write(intr_out, USB_OUT_INT);
-
-                        if ((intr_out & USB_OUT_INT_EP2)
-                            && (out_en & USB_OUT_INT_EP2)) {
-                                DEBUG("USB_OUT_INT_EP2\n");
-                                lh7a40x_out_epn(dev, 2, intr_out);
-                        }
-                }
-
-                if (intr_int) {
-                        usb_write(intr_int, USB_INT);
-
-                        if (intr_int & USB_INT_RESET_INT) {
-                                lh7a40x_reset_intr(dev);
-                        }
-
-                        if (intr_int & USB_INT_RESUME_INT) {
-                                DEBUG("USB resume\n");
-
-                                if (dev->gadget.speed != USB_SPEED_UNKNOWN
-                                    && dev->driver
-                                    && dev->driver->resume
-                                    && is_usb_connected()) {
-                                        dev->driver->resume(&dev->gadget);
-                                }
-                        }
-
-                        if (intr_int & USB_INT_SUSPEND_INT) {
-                                DEBUG("USB suspend%s\n",
-                                      is_usb_connected()? "" : "+disconnect");
-                                if (!is_usb_connected()) {
-                                        stop_activity(dev, dev->driver);
-                                } else if (dev->gadget.speed !=
-                                           USB_SPEED_UNKNOWN && dev->driver
-                                           && dev->driver->suspend) {
-                                        dev->driver->suspend(&dev->gadget);
-                                }
-                        }
-
-                }
-        }
-
-        spin_unlock(&dev->lock);
-
-        return IRQ_HANDLED;
-}
-
-static int lh7a40x_ep_enable(struct usb_ep *_ep,
-                             const struct usb_endpoint_descriptor *desc)
-{
-        struct lh7a40x_ep *ep;
-        struct lh7a40x_udc *dev;
-        unsigned long flags;
-
-        DEBUG("%s, %p\n", __func__, _ep);
-
-        ep = container_of(_ep, struct lh7a40x_ep, ep);
-        if (!_ep || !desc || ep->desc || _ep->name == ep0name
-            || desc->bDescriptorType != USB_DT_ENDPOINT
-            || ep->bEndpointAddress != desc->bEndpointAddress
-            || ep_maxpacket(ep) < le16_to_cpu(desc->wMaxPacketSize)) {
-                DEBUG("%s, bad ep or descriptor\n", __func__);
-                return -EINVAL;
-        }
-
-        /* xfer types must match, except that interrupt ~= bulk */
-        if (ep->bmAttributes != desc->bmAttributes
-            && ep->bmAttributes != USB_ENDPOINT_XFER_BULK
-            && desc->bmAttributes != USB_ENDPOINT_XFER_INT) {
-                DEBUG("%s, %s type mismatch\n", __func__, _ep->name);
-                return -EINVAL;
-        }
-
-        /* hardware _could_ do smaller, but driver doesn't */
-        if ((desc->bmAttributes == USB_ENDPOINT_XFER_BULK
-             && le16_to_cpu(desc->wMaxPacketSize) != ep_maxpacket(ep))
-            || !desc->wMaxPacketSize) {
-                DEBUG("%s, bad %s maxpacket\n", __func__, _ep->name);
-                return -ERANGE;
-        }
-
-        dev = ep->dev;
-        if (!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN) {
-                DEBUG("%s, bogus device state\n", __func__);
-                return -ESHUTDOWN;
-        }
-
-        spin_lock_irqsave(&ep->dev->lock, flags);
-
-        ep->stopped = 0;
-        ep->desc = desc;
-        ep->pio_irqs = 0;
-        ep->ep.maxpacket = le16_to_cpu(desc->wMaxPacketSize);
-
-        spin_unlock_irqrestore(&ep->dev->lock, flags);
-
-        /* Reset halt state (does flush) */
-        lh7a40x_set_halt(_ep, 0);
-
-        DEBUG("%s: enabled %s\n", __func__, _ep->name);
-        return 0;
-}
-
-/** Disable EP
- *  NOTE: Sets INDEX register
- */
-static int lh7a40x_ep_disable(struct usb_ep *_ep)
-{
-        struct lh7a40x_ep *ep;
-        unsigned long flags;
-
-        DEBUG("%s, %p\n", __func__, _ep);
-
-        ep = container_of(_ep, struct lh7a40x_ep, ep);
-        if (!_ep || !ep->desc) {
-                DEBUG("%s, %s not enabled\n", __func__,
-                      _ep ? ep->ep.name : NULL);
-                return -EINVAL;
-        }
-
-        spin_lock_irqsave(&ep->dev->lock, flags);
-
-        usb_set_index(ep_index(ep));
-
-        /* Nuke all pending requests (does flush) */
-        nuke(ep, -ESHUTDOWN);
-
-        /* Disable ep IRQ */
-        pio_irq_disable(ep_index(ep));
-
-        ep->desc = 0;
-        ep->stopped = 1;
-
-        spin_unlock_irqrestore(&ep->dev->lock, flags);
-
-        DEBUG("%s: disabled %s\n", __func__, _ep->name);
-        return 0;
-}
-
-static struct usb_request *lh7a40x_alloc_request(struct usb_ep *ep,
-                                                 gfp_t gfp_flags)
-{
-        struct lh7a40x_request *req;
-
-        DEBUG("%s, %p\n", __func__, ep);
-
-        req = kzalloc(sizeof(*req), gfp_flags);
-        if (!req)
-                return 0;
-
-        INIT_LIST_HEAD(&req->queue);
-
-        return &req->req;
-}
-
-static void lh7a40x_free_request(struct usb_ep *ep, struct usb_request *_req)
-{
-        struct lh7a40x_request *req;
-
-        DEBUG("%s, %p\n", __func__, ep);
-
-        req = container_of(_req, struct lh7a40x_request, req);
-        WARN_ON(!list_empty(&req->queue));
-        kfree(req);
-}
-
-/** Queue one request
- *  Kickstart transfer if needed
- *  NOTE: Sets INDEX register
- */
-static int lh7a40x_queue(struct usb_ep *_ep, struct usb_request *_req,
-                         gfp_t gfp_flags)
-{
-        struct lh7a40x_request *req;
-        struct lh7a40x_ep *ep;
-        struct lh7a40x_udc *dev;
-        unsigned long flags;
-
-        DEBUG("\n\n\n%s, %p\n", __func__, _ep);
-
-        req = container_of(_req, struct lh7a40x_request, req);
-        if (unlikely
-            (!_req || !_req->complete || !_req->buf
-             || !list_empty(&req->queue))) {
-                DEBUG("%s, bad params\n", __func__);
-                return -EINVAL;
-        }
-
-        ep = container_of(_ep, struct lh7a40x_ep, ep);
-        if (unlikely(!_ep || (!ep->desc && ep->ep.name != ep0name))) {
-                DEBUG("%s, bad ep\n", __func__);
-                return -EINVAL;
-        }
-
-        dev = ep->dev;
-        if (unlikely(!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)) {
-                DEBUG("%s, bogus device state %p\n", __func__, dev->driver);
-                return -ESHUTDOWN;
-        }
-
-        DEBUG("%s queue req %p, len %d buf %p\n", _ep->name, _req, _req->length,
-              _req->buf);
-
-        spin_lock_irqsave(&dev->lock, flags);
-
-        _req->status = -EINPROGRESS;
-        _req->actual = 0;
-
-        /* kickstart this i/o queue? */
-        DEBUG("Add to %d Q %d %d\n", ep_index(ep), list_empty(&ep->queue),
-              ep->stopped);
-        if (list_empty(&ep->queue) && likely(!ep->stopped)) {
-                u32 csr;
-
-                if (unlikely(ep_index(ep) == 0)) {
-                        /* EP0 */
-                        list_add_tail(&req->queue, &ep->queue);
-                        lh7a40x_ep0_kick(dev, ep);
-                        req = 0;
-                } else if (ep_is_in(ep)) {
-                        /* EP1 & EP3 */
-                        usb_set_index(ep_index(ep));
-                        csr = usb_read(ep->csr1);
-                        pio_irq_enable(ep_index(ep));
-                        if ((csr & USB_IN_CSR1_FIFO_NOT_EMPTY) == 0) {
-                                if (write_fifo(ep, req) == 1)
-                                        req = 0;
-                        }
-                } else {
-                        /* EP2 */
-                        usb_set_index(ep_index(ep));
-                        csr = usb_read(ep->csr1);
-                        pio_irq_enable(ep_index(ep));
-                        if (!(csr & USB_OUT_CSR1_FIFO_FULL)) {
-                                if (read_fifo(ep, req) == 1)
-                                        req = 0;
-                        }
-                }
-        }
-
-        /* pio or dma irq handler advances the queue. */
-        if (likely(req != 0))
-                list_add_tail(&req->queue, &ep->queue);
-
-        spin_unlock_irqrestore(&dev->lock, flags);
-
-        return 0;
-}
-
-/* dequeue JUST ONE request */
-static int lh7a40x_dequeue(struct usb_ep *_ep, struct usb_request *_req)
-{
-        struct lh7a40x_ep *ep;
-        struct lh7a40x_request *req;
-        unsigned long flags;
-
-        DEBUG("%s, %p\n", __func__, _ep);
-
-        ep = container_of(_ep, struct lh7a40x_ep, ep);
-        if (!_ep || ep->ep.name == ep0name)
-                return -EINVAL;
-
-        spin_lock_irqsave(&ep->dev->lock, flags);
-
-        /* make sure it's actually queued on this endpoint */
-        list_for_each_entry(req, &ep->queue, queue) {
-                if (&req->req == _req)
-                        break;
-        }
-        if (&req->req != _req) {
-                spin_unlock_irqrestore(&ep->dev->lock, flags);
-                return -EINVAL;
-        }
-
-        done(ep, req, -ECONNRESET);
-
-        spin_unlock_irqrestore(&ep->dev->lock, flags);
-        return 0;
-}
-
-/** Halt specific EP
- *  Return 0 if success
- *  NOTE: Sets INDEX register to EP !
- */
-static int lh7a40x_set_halt(struct usb_ep *_ep, int value)
-{
-        struct lh7a40x_ep *ep;
-        unsigned long flags;
-
-        ep = container_of(_ep, struct lh7a40x_ep, ep);
-        if (unlikely(!_ep || (!ep->desc && ep->ep.name != ep0name))) {
-                DEBUG("%s, bad ep\n", __func__);
-                return -EINVAL;
-        }
-
-        usb_set_index(ep_index(ep));
-
-        DEBUG("%s, ep %d, val %d\n", __func__, ep_index(ep), value);
-
-        spin_lock_irqsave(&ep->dev->lock, flags);
-
-        if (ep_index(ep) == 0) {
-                /* EP0 */
-                usb_set(EP0_SEND_STALL, ep->csr1);
-        } else if (ep_is_in(ep)) {
-                u32 csr = usb_read(ep->csr1);
-                if (value && ((csr & USB_IN_CSR1_FIFO_NOT_EMPTY)
-                              || !list_empty(&ep->queue))) {
-                        /*
-                         * Attempts to halt IN endpoints will fail (returning -EAGAIN)
-                         * if any transfer requests are still queued, or if the controller
-                         * FIFO still holds bytes that the host hasn't collected.
-                         */
-                        spin_unlock_irqrestore(&ep->dev->lock, flags);
-                        DEBUG
-                            ("Attempt to halt IN endpoint failed (returning -EAGAIN) %d %d\n",
-                             (csr & USB_IN_CSR1_FIFO_NOT_EMPTY),
-                             !list_empty(&ep->queue));
-                        return -EAGAIN;
-                }
-                flush(ep);
-                if (value)
-                        usb_set(USB_IN_CSR1_SEND_STALL, ep->csr1);
-                else {
-                        usb_clear(USB_IN_CSR1_SEND_STALL, ep->csr1);
-                        usb_set(USB_IN_CSR1_CLR_DATA_TOGGLE, ep->csr1);
-                }
-
-        } else {
-
-                flush(ep);
-                if (value)
-                        usb_set(USB_OUT_CSR1_SEND_STALL, ep->csr1);
-                else {
-                        usb_clear(USB_OUT_CSR1_SEND_STALL, ep->csr1);
-                        usb_set(USB_OUT_CSR1_CLR_DATA_REG, ep->csr1);
-                }
-        }
-
-        if (value) {
-                ep->stopped = 1;
-        } else {
-                ep->stopped = 0;
-        }
-
-        spin_unlock_irqrestore(&ep->dev->lock, flags);
-
-        DEBUG("%s %s halted\n", _ep->name, value == 0 ? "NOT" : "IS");
-
-        return 0;
-}
-
-/** Return bytes in EP FIFO
- *  NOTE: Sets INDEX register to EP
- */
-static int lh7a40x_fifo_status(struct usb_ep *_ep)
-{
-        u32 csr;
-        int count = 0;
-        struct lh7a40x_ep *ep;
-
-        ep = container_of(_ep, struct lh7a40x_ep, ep);
-        if (!_ep) {
-                DEBUG("%s, bad ep\n", __func__);
-                return -ENODEV;
-        }
-
-        DEBUG("%s, %d\n", __func__, ep_index(ep));
-
-        /* LPD can't report unclaimed bytes from IN fifos */
-        if (ep_is_in(ep))
-                return -EOPNOTSUPP;
-
-        usb_set_index(ep_index(ep));
-
-        csr = usb_read(ep->csr1);
-        if (ep->dev->gadget.speed != USB_SPEED_UNKNOWN ||
-            csr & USB_OUT_CSR1_OUT_PKT_RDY) {
-                count = usb_read(USB_OUT_FIFO_WC1);
-        }
-
-        return count;
-}
-
-/** Flush EP FIFO
- *  NOTE: Sets INDEX register to EP
- */
-static void lh7a40x_fifo_flush(struct usb_ep *_ep)
-{
-        struct lh7a40x_ep *ep;
-
-        ep = container_of(_ep, struct lh7a40x_ep, ep);
-        if (unlikely(!_ep || (!ep->desc && ep->ep.name != ep0name))) {
-                DEBUG("%s, bad ep\n", __func__);
-                return;
-        }
-
-        usb_set_index(ep_index(ep));
-        flush(ep);
-}
-
-/****************************************************************/
-/* End Point 0 related functions                                */
-/****************************************************************/
-
-/* return:  0 = still running, 1 = completed, negative = errno */
-static int write_fifo_ep0(struct lh7a40x_ep *ep, struct lh7a40x_request *req)
-{
-        u32 max;
-        unsigned count;
-        int is_last;
-
-        max = ep_maxpacket(ep);
-
-        DEBUG_EP0("%s\n", __func__);
-
-        count = write_packet(ep, req, max);
-
-        /* last packet is usually short (or a zlp) */
-        if (unlikely(count != max))
-                is_last = 1;
-        else {
-                if (likely(req->req.length != req->req.actual) || req->req.zero)
-                        is_last = 0;
-                else
-                        is_last = 1;
-        }
-
-        DEBUG_EP0("%s: wrote %s %d bytes%s %d left %p\n", __func__,
-                  ep->ep.name, count,
-                  is_last ? "/L" : "", req->req.length - req->req.actual, req);
-
-        /* requests complete when all IN data is in the FIFO */
-        if (is_last) {
-                done(ep, req, 0);
-                return 1;
-        }
-
-        return 0;
-}
-
-static __inline__ int lh7a40x_fifo_read(struct lh7a40x_ep *ep,
-                                        unsigned char *cp, int max)
-{
-        int bytes;
-        int count = usb_read(USB_OUT_FIFO_WC1);
-        volatile u32 *fifo = (volatile u32 *)ep->fifo;
-
-        if (count > max)
-                count = max;
-        bytes = count;
-        while (count--)
-                *cp++ = *fifo & 0xFF;
-        return bytes;
-}
-
-static __inline__ void lh7a40x_fifo_write(struct lh7a40x_ep *ep,
-                                          unsigned char *cp, int count)
-{
-        volatile u32 *fifo = (volatile u32 *)ep->fifo;
-        DEBUG_EP0("fifo_write: %d %d\n", ep_index(ep), count);
-        while (count--)
-                *fifo = *cp++;
-}
-
-static int read_fifo_ep0(struct lh7a40x_ep *ep, struct lh7a40x_request *req)
-{
-        u32 csr;
-        u8 *buf;
-        unsigned bufferspace, count, is_short;
-        volatile u32 *fifo = (volatile u32 *)ep->fifo;
-
-        DEBUG_EP0("%s\n", __func__);
-
-        csr = usb_read(USB_EP0_CSR);
-        if (!(csr & USB_OUT_CSR1_OUT_PKT_RDY))
-                return 0;
-
-        buf = req->req.buf + req->req.actual;
-        prefetchw(buf);
-        bufferspace = req->req.length - req->req.actual;
-
-        /* read all bytes from this packet */
-        if (likely(csr & EP0_OUT_PKT_RDY)) {
-                count = usb_read(USB_OUT_FIFO_WC1);
-                req->req.actual += min(count, bufferspace);
-        } else                  /* zlp */
-                count = 0;
-
-        is_short = (count < ep->ep.maxpacket);
-        DEBUG_EP0("read %s %02x, %d bytes%s req %p %d/%d\n",
-                  ep->ep.name, csr, count,
-                  is_short ? "/S" : "", req, req->req.actual, req->req.length);
-
-        while (likely(count-- != 0)) {
-                u8 byte = (u8) (*fifo & 0xff);
-
-                if (unlikely(bufferspace == 0)) {
-                        /* this happens when the driver's buffer
-                         * is smaller than what the host sent.
-                         * discard the extra data.
-                         */
-                        if (req->req.status != -EOVERFLOW)
-                                DEBUG_EP0("%s overflow %d\n", ep->ep.name,
-                                          count);
-                        req->req.status = -EOVERFLOW;
-                } else {
-                        *buf++ = byte;
-                        bufferspace--;
-                }
-        }
-
-        /* completion */
-        if (is_short || req->req.actual == req->req.length) {
-                done(ep, req, 0);
-                return 1;
-        }
-
-        /* finished that packet.  the next one may be waiting... */
-        return 0;
-}
-
-/**
- * udc_set_address - set the USB address for this device
- * @address:
- *
- * Called from control endpoint function after it decodes a set address setup packet.
- */
-static void udc_set_address(struct lh7a40x_udc *dev, unsigned char address)
-{
-        DEBUG_EP0("%s: %d\n", __func__, address);
-        /* c.f. 15.1.2.2 Table 15-4 address will be used after DATA_END is set */
-        dev->usb_address = address;
-        usb_set((address & USB_FA_FUNCTION_ADDR), USB_FA);
-        usb_set(USB_FA_ADDR_UPDATE | (address & USB_FA_FUNCTION_ADDR), USB_FA);
-        /* usb_read(USB_FA); */
-}
-
-/*
- * DATA_STATE_RECV (OUT_PKT_RDY)
- *      - if error
- *              set EP0_CLR_OUT | EP0_DATA_END | EP0_SEND_STALL bits
- *      - else
- *              set EP0_CLR_OUT bit
-                                if last set EP0_DATA_END bit
- */
-static void lh7a40x_ep0_out(struct lh7a40x_udc *dev, u32 csr)
-{
-        struct lh7a40x_request *req;
-        struct lh7a40x_ep *ep = &dev->ep[0];
-        int ret;
-
-        DEBUG_EP0("%s: %x\n", __func__, csr);
-
-        if (list_empty(&ep->queue))
-                req = 0;
-        else
-                req = list_entry(ep->queue.next, struct lh7a40x_request, queue);
-
-        if (req) {
-
-                if (req->req.length == 0) {
-                        DEBUG_EP0("ZERO LENGTH OUT!\n");
-                        usb_set((EP0_CLR_OUT | EP0_DATA_END), USB_EP0_CSR);
-                        dev->ep0state = WAIT_FOR_SETUP;
-                        return;
-                }
-                ret = read_fifo_ep0(ep, req);
-                if (ret) {
-                        /* Done! */
-                        DEBUG_EP0("%s: finished, waiting for status\n",
-                                  __func__);
-
-                        usb_set((EP0_CLR_OUT | EP0_DATA_END), USB_EP0_CSR);
-                        dev->ep0state = WAIT_FOR_SETUP;
-                } else {
-                        /* Not done yet.. */
-                        DEBUG_EP0("%s: not finished\n", __func__);
-                        usb_set(EP0_CLR_OUT, USB_EP0_CSR);
-                }
-        } else {
-                DEBUG_EP0("NO REQ??!\n");
-        }
-}
-
-/*
- * DATA_STATE_XMIT
- */
-static int lh7a40x_ep0_in(struct lh7a40x_udc *dev, u32 csr)
-{
-        struct lh7a40x_request *req;
-        struct lh7a40x_ep *ep = &dev->ep[0];
-        int ret, need_zlp = 0;
-
-        DEBUG_EP0("%s: %x\n", __func__, csr);
-
-        if (list_empty(&ep->queue))
-                req = 0;
-        else
-                req = list_entry(ep->queue.next, struct lh7a40x_request, queue);
-
-        if (!req) {
-                DEBUG_EP0("%s: NULL REQ\n", __func__);
-                return 0;
-        }
-
-        if (req->req.length == 0) {
-
-                usb_set((EP0_IN_PKT_RDY | EP0_DATA_END), USB_EP0_CSR);
-                dev->ep0state = WAIT_FOR_SETUP;
-                return 1;
-        }
-
-        if (req->req.length - req->req.actual == EP0_PACKETSIZE) {
-                /* Next write will end with the packet size, */
-                /* so we need Zero-length-packet */
-                need_zlp = 1;
-        }
-
-        ret = write_fifo_ep0(ep, req);
-
-        if (ret == 1 && !need_zlp) {
-                /* Last packet */
-                DEBUG_EP0("%s: finished, waiting for status\n", __func__);
-
-                usb_set((EP0_IN_PKT_RDY | EP0_DATA_END), USB_EP0_CSR);
-                dev->ep0state = WAIT_FOR_SETUP;
-        } else {
-                DEBUG_EP0("%s: not finished\n", __func__);
-                usb_set(EP0_IN_PKT_RDY, USB_EP0_CSR);
-        }
-
-        if (need_zlp) {
-                DEBUG_EP0("%s: Need ZLP!\n", __func__);
-                usb_set(EP0_IN_PKT_RDY, USB_EP0_CSR);
-                dev->ep0state = DATA_STATE_NEED_ZLP;
-        }
-
-        return 1;
-}
-
-static int lh7a40x_handle_get_status(struct lh7a40x_udc *dev,
-                                     struct usb_ctrlrequest *ctrl)
-{
-        struct lh7a40x_ep *ep0 = &dev->ep[0];
-        struct lh7a40x_ep *qep;
-        int reqtype = (ctrl->bRequestType & USB_RECIP_MASK);
-        u16 val = 0;
-
-        if (reqtype == USB_RECIP_INTERFACE) {
-                /* This is not supported.
-                 * And according to the USB spec, this one does nothing..
-                 * Just return 0
-                 */
-                DEBUG_SETUP("GET_STATUS: USB_RECIP_INTERFACE\n");
-        } else if (reqtype == USB_RECIP_DEVICE) {
-                DEBUG_SETUP("GET_STATUS: USB_RECIP_DEVICE\n");
-                val |= (1 << 0);        /* Self powered */
-                /*val |= (1<<1); *//* Remote wakeup */
-        } else if (reqtype == USB_RECIP_ENDPOINT) {
-                int ep_num = (ctrl->wIndex & ~USB_DIR_IN);
-
-                DEBUG_SETUP
-                    ("GET_STATUS: USB_RECIP_ENDPOINT (%d), ctrl->wLength = %d\n",
-                     ep_num, ctrl->wLength);
-
-                if (ctrl->wLength > 2 || ep_num > 3)
-                        return -EOPNOTSUPP;
-
-                qep = &dev->ep[ep_num];
-                if (ep_is_in(qep) != ((ctrl->wIndex & USB_DIR_IN) ? 1 : 0)
-                    && ep_index(qep) != 0) {
-                        return -EOPNOTSUPP;
-                }
-
-                usb_set_index(ep_index(qep));
-
-                /* Return status on next IN token */
-                switch (qep->ep_type) {
-                case ep_control:
-                        val =
-                            (usb_read(qep->csr1) & EP0_SEND_STALL) ==
-                            EP0_SEND_STALL;
-                        break;
-                case ep_bulk_in:
-                case ep_interrupt:
-                        val =
-                            (usb_read(qep->csr1) & USB_IN_CSR1_SEND_STALL) ==
-                            USB_IN_CSR1_SEND_STALL;
-                        break;
-                case ep_bulk_out:
-                        val =
-                            (usb_read(qep->csr1) & USB_OUT_CSR1_SEND_STALL) ==
-                            USB_OUT_CSR1_SEND_STALL;
-                        break;
-                }
-
-                /* Back to EP0 index */
-                usb_set_index(0);
-
-                DEBUG_SETUP("GET_STATUS, ep: %d (%x), val = %d\n", ep_num,
-                            ctrl->wIndex, val);
-        } else {
-                DEBUG_SETUP("Unknown REQ TYPE: %d\n", reqtype);
-                return -EOPNOTSUPP;
-        }
-
-        /* Clear "out packet ready" */
-        usb_set((EP0_CLR_OUT), USB_EP0_CSR);
-        /* Put status to FIFO */
-        lh7a40x_fifo_write(ep0, (u8 *) & val, sizeof(val));
-        /* Issue "In packet ready" */
-        usb_set((EP0_IN_PKT_RDY | EP0_DATA_END), USB_EP0_CSR);
-
-        return 0;
-}
-
-/*
- * WAIT_FOR_SETUP (OUT_PKT_RDY)
- *      - read data packet from EP0 FIFO
- *      - decode command
- *      - if error
- *              set EP0_CLR_OUT | EP0_DATA_END | EP0_SEND_STALL bits
- *      - else
- *              set EP0_CLR_OUT | EP0_DATA_END bits
- */
-static void lh7a40x_ep0_setup(struct lh7a40x_udc *dev, u32 csr)
-{
-        struct lh7a40x_ep *ep = &dev->ep[0];
-        struct usb_ctrlrequest ctrl;
-        int i, bytes, is_in;
-
-        DEBUG_SETUP("%s: %x\n", __func__, csr);
-
-        /* Nuke all previous transfers */
-        nuke(ep, -EPROTO);
-
-        /* read control req from fifo (8 bytes) */
-        bytes = lh7a40x_fifo_read(ep, (unsigned char *)&ctrl, 8);
-
-        DEBUG_SETUP("Read CTRL REQ %d bytes\n", bytes);
-        DEBUG_SETUP("CTRL.bRequestType = %d (is_in %d)\n", ctrl.bRequestType,
-                    ctrl.bRequestType == USB_DIR_IN);
-        DEBUG_SETUP("CTRL.bRequest = %d\n", ctrl.bRequest);
-        DEBUG_SETUP("CTRL.wLength = %d\n", ctrl.wLength);
-        DEBUG_SETUP("CTRL.wValue = %d (%d)\n", ctrl.wValue, ctrl.wValue >> 8);
-        DEBUG_SETUP("CTRL.wIndex = %d\n", ctrl.wIndex);
-
-        /* Set direction of EP0 */
-        if (likely(ctrl.bRequestType & USB_DIR_IN)) {
-                ep->bEndpointAddress |= USB_DIR_IN;
-                is_in = 1;
-        } else {
-                ep->bEndpointAddress &= ~USB_DIR_IN;
-                is_in = 0;
-        }
-
-        dev->req_pending = 1;
-
-        /* Handle some SETUP packets ourselves */
-        switch (ctrl.bRequest) {
-        case USB_REQ_SET_ADDRESS:
-                if (ctrl.bRequestType != (USB_TYPE_STANDARD | USB_RECIP_DEVICE))
-                        break;
-
-                DEBUG_SETUP("USB_REQ_SET_ADDRESS (%d)\n", ctrl.wValue);
-                udc_set_address(dev, ctrl.wValue);
-                usb_set((EP0_CLR_OUT | EP0_DATA_END), USB_EP0_CSR);
-                return;
-
-        case USB_REQ_GET_STATUS:{
-                        if (lh7a40x_handle_get_status(dev, &ctrl) == 0)
-                                return;
-
-        case USB_REQ_CLEAR_FEATURE:
-        case USB_REQ_SET_FEATURE:
-                        if (ctrl.bRequestType == USB_RECIP_ENDPOINT) {
-                                struct lh7a40x_ep *qep;
-                                int ep_num = (ctrl.wIndex & 0x0f);
-
-                                /* Support only HALT feature */
-                                if (ctrl.wValue != 0 || ctrl.wLength != 0
-                                    || ep_num > 3 || ep_num < 1)
-                                        break;
-
-                                qep = &dev->ep[ep_num];
-                                spin_unlock(&dev->lock);
-                                if (ctrl.bRequest == USB_REQ_SET_FEATURE) {
-                                        DEBUG_SETUP("SET_FEATURE (%d)\n",
-                                                    ep_num);
-                                        lh7a40x_set_halt(&qep->ep, 1);
-                                } else {
-                                        DEBUG_SETUP("CLR_FEATURE (%d)\n",
-                                                    ep_num);
-                                        lh7a40x_set_halt(&qep->ep, 0);
-                                }
-                                spin_lock(&dev->lock);
-                                usb_set_index(0);
-
-                                /* Reply with a ZLP on next IN token */
-                                usb_set((EP0_CLR_OUT | EP0_DATA_END),
-                                        USB_EP0_CSR);
-                                return;
-                        }
-                        break;
-                }
-
-        default:
-                break;
-        }
-
-        if (likely(dev->driver)) {
-                /* device-2-host (IN) or no data setup command, process immediately */
-                spin_unlock(&dev->lock);
-                i = dev->driver->setup(&dev->gadget, &ctrl);
-                spin_lock(&dev->lock);
-
-                if (i < 0) {
-                        /* setup processing failed, force stall */
-                        DEBUG_SETUP
-                            ("  --> ERROR: gadget setup FAILED (stalling), setup returned %d\n",
-                             i);
-                        usb_set_index(0);
-                        usb_set((EP0_CLR_OUT | EP0_DATA_END | EP0_SEND_STALL),
-                                USB_EP0_CSR);
-
-                        /* ep->stopped = 1; */
-                        dev->ep0state = WAIT_FOR_SETUP;
-                }
-        }
-}
-
-/*
- * DATA_STATE_NEED_ZLP
- */
-static void lh7a40x_ep0_in_zlp(struct lh7a40x_udc *dev, u32 csr)
-{
-        DEBUG_EP0("%s: %x\n", __func__, csr);
-
-        /* c.f. Table 15-14 */
-        usb_set((EP0_IN_PKT_RDY | EP0_DATA_END), USB_EP0_CSR);
-        dev->ep0state = WAIT_FOR_SETUP;
-}
-
-/*
- * handle ep0 interrupt
- */
-static void lh7a40x_handle_ep0(struct lh7a40x_udc *dev, u32 intr)
-{
-        struct lh7a40x_ep *ep = &dev->ep[0];
-        u32 csr;
-
-        /* Set index 0 */
-        usb_set_index(0);
-        csr = usb_read(USB_EP0_CSR);
-
-        DEBUG_EP0("%s: csr = %x\n", __func__, csr);
-
-        /*
-         * For overview of what we should be doing see c.f. Chapter 18.1.2.4
-         * We will follow that outline here modified by our own global state
-         * indication which provides hints as to what we think should be
-         * happening..
-         */
-
-        /*
-         * if SENT_STALL is set
-         *      - clear the SENT_STALL bit
-         */
-        if (csr & EP0_SENT_STALL) {
-                DEBUG_EP0("%s: EP0_SENT_STALL is set: %x\n", __func__, csr);
-                usb_clear((EP0_SENT_STALL | EP0_SEND_STALL), USB_EP0_CSR);
-                nuke(ep, -ECONNABORTED);
-                dev->ep0state = WAIT_FOR_SETUP;
-                return;
-        }
-
-        /*
-         * if a transfer is in progress && IN_PKT_RDY and OUT_PKT_RDY are clear
-         *      - fill EP0 FIFO
-         *      - if last packet
-         *      -       set IN_PKT_RDY | DATA_END
-         *      - else
-         *              set IN_PKT_RDY
-         */
-        if (!(csr & (EP0_IN_PKT_RDY | EP0_OUT_PKT_RDY))) {
-                DEBUG_EP0("%s: IN_PKT_RDY and OUT_PKT_RDY are clear\n",
-                          __func__);
-
-                switch (dev->ep0state) {
-                case DATA_STATE_XMIT:
-                        DEBUG_EP0("continue with DATA_STATE_XMIT\n");
-                        lh7a40x_ep0_in(dev, csr);
-                        return;
-                case DATA_STATE_NEED_ZLP:
-                        DEBUG_EP0("continue with DATA_STATE_NEED_ZLP\n");
-                        lh7a40x_ep0_in_zlp(dev, csr);
-                        return;
-                default:
-                        /* Stall? */
-                        DEBUG_EP0("Odd state!! state = %s\n",
-                                  state_names[dev->ep0state]);
-                        dev->ep0state = WAIT_FOR_SETUP;
-                        /* nuke(ep, 0); */
-                        /* usb_set(EP0_SEND_STALL, ep->csr1); */
-                        break;
-                }
-        }
-
-        /*
-         * if SETUP_END is set
-         *      - abort the last transfer
-         *      - set SERVICED_SETUP_END_BIT
-         */
-        if (csr & EP0_SETUP_END) {
-                DEBUG_EP0("%s: EP0_SETUP_END is set: %x\n", __func__, csr);
-
-                usb_set(EP0_CLR_SETUP_END, USB_EP0_CSR);
-
-                nuke(ep, 0);
-                dev->ep0state = WAIT_FOR_SETUP;
-        }
-
-        /*
-         * if EP0_OUT_PKT_RDY is set
-         *      - read data packet from EP0 FIFO
-         *      - decode command
-         *      - if error
-         *              set SERVICED_OUT_PKT_RDY | DATA_END bits | SEND_STALL
-         *      - else
-         *              set SERVICED_OUT_PKT_RDY | DATA_END bits
-         */
-        if (csr & EP0_OUT_PKT_RDY) {
-
-                DEBUG_EP0("%s: EP0_OUT_PKT_RDY is set: %x\n", __func__,
-                          csr);
-
-                switch (dev->ep0state) {
-                case WAIT_FOR_SETUP:
-                        DEBUG_EP0("WAIT_FOR_SETUP\n");
-                        lh7a40x_ep0_setup(dev, csr);
-                        break;
-
-                case DATA_STATE_RECV:
-                        DEBUG_EP0("DATA_STATE_RECV\n");
-                        lh7a40x_ep0_out(dev, csr);
-                        break;
-
-                default:
-                        /* send stall? */
-                        DEBUG_EP0("strange state!! 2. send stall? state = %d\n",
-                                  dev->ep0state);
-                        break;
-                }
-        }
-}
-
-static void lh7a40x_ep0_kick(struct lh7a40x_udc *dev, struct lh7a40x_ep *ep)
-{
-        u32 csr;
-
-        usb_set_index(0);
-        csr = usb_read(USB_EP0_CSR);
-
-        DEBUG_EP0("%s: %x\n", __func__, csr);
-
-        /* Clear "out packet ready" */
-        usb_set(EP0_CLR_OUT, USB_EP0_CSR);
-
-        if (ep_is_in(ep)) {
-                dev->ep0state = DATA_STATE_XMIT;
-                lh7a40x_ep0_in(dev, csr);
-        } else {
-                dev->ep0state = DATA_STATE_RECV;
-                lh7a40x_ep0_out(dev, csr);
-        }
-}
-
-/* ---------------------------------------------------------------------------
- *      device-scoped parts of the api to the usb controller hardware
- * ---------------------------------------------------------------------------
- */
-
-static int lh7a40x_udc_get_frame(struct usb_gadget *_gadget)
-{
-        u32 frame1 = usb_read(USB_FRM_NUM1);    /* Least significant 8 bits */
-        u32 frame2 = usb_read(USB_FRM_NUM2);    /* Most significant 3 bits */
-        DEBUG("%s, %p\n", __func__, _gadget);
-        return ((frame2 & 0x07) << 8) | (frame1 & 0xff);
-}
-
-static int lh7a40x_udc_wakeup(struct usb_gadget *_gadget)
-{
-        /* host may not have enabled remote wakeup */
-        /*if ((UDCCS0 & UDCCS0_DRWF) == 0)
-           return -EHOSTUNREACH;
-           udc_set_mask_UDCCR(UDCCR_RSM); */
-        return -ENOTSUPP;
-}
-
-static const struct usb_gadget_ops lh7a40x_udc_ops = {
-        .get_frame = lh7a40x_udc_get_frame,
-        .wakeup = lh7a40x_udc_wakeup,
-        /* current versions must always be self-powered */
-};
-
-static void nop_release(struct device *dev)
-{
-        DEBUG("%s %s\n", __func__, dev_name(dev));
-}
-
-static struct lh7a40x_udc memory = {
-        .usb_address = 0,
-
-        .gadget = {
-                   .ops = &lh7a40x_udc_ops,
-                   .ep0 = &memory.ep[0].ep,
-                   .name = driver_name,
-                   .dev = {
-                           .init_name = "gadget",
-                           .release = nop_release,
-                           },
-                   },
-
-        /* control endpoint */
-        .ep[0] = {
-                  .ep = {
-                         .name = ep0name,
-                         .ops = &lh7a40x_ep_ops,
-                         .maxpacket = EP0_PACKETSIZE,
-                         },
-                  .dev = &memory,
-
-                  .bEndpointAddress = 0,
-                  .bmAttributes = 0,
-
-                  .ep_type = ep_control,
-                  .fifo = io_p2v(USB_EP0_FIFO),
-                  .csr1 = USB_EP0_CSR,
-                  .csr2 = USB_EP0_CSR,
-                  },
-
-        /* first group of endpoints */
-        .ep[1] = {
-                  .ep = {
-                         .name = "ep1in-bulk",
-                         .ops = &lh7a40x_ep_ops,
-                         .maxpacket = 64,
-                         },
-                  .dev = &memory,
-
-                  .bEndpointAddress = USB_DIR_IN | 1,
-                  .bmAttributes = USB_ENDPOINT_XFER_BULK,
-
-                  .ep_type = ep_bulk_in,
-                  .fifo = io_p2v(USB_EP1_FIFO),
-                  .csr1 = USB_IN_CSR1,
-                  .csr2 = USB_IN_CSR2,
-                  },
-
-        .ep[2] = {
-                  .ep = {
-                         .name = "ep2out-bulk",
-                         .ops = &lh7a40x_ep_ops,
-                         .maxpacket = 64,
-                         },
-                  .dev = &memory,
-
-                  .bEndpointAddress = 2,
-                  .bmAttributes = USB_ENDPOINT_XFER_BULK,
-
-                  .ep_type = ep_bulk_out,
-                  .fifo = io_p2v(USB_EP2_FIFO),
-                  .csr1 = USB_OUT_CSR1,
-                  .csr2 = USB_OUT_CSR2,
-                  },
-
-        .ep[3] = {
-                  .ep = {
-                         .name = "ep3in-int",
-                         .ops = &lh7a40x_ep_ops,
-                         .maxpacket = 64,
-                         },
-                  .dev = &memory,
-
-                  .bEndpointAddress = USB_DIR_IN | 3,
-                  .bmAttributes = USB_ENDPOINT_XFER_INT,
-
-                  .ep_type = ep_interrupt,
-                  .fifo = io_p2v(USB_EP3_FIFO),
-                  .csr1 = USB_IN_CSR1,
-                  .csr2 = USB_IN_CSR2,
-                  },
-};
-
-/*
- *      probe - binds to the platform device
- */
-static int lh7a40x_udc_probe(struct platform_device *pdev)
-{
-        struct lh7a40x_udc *dev = &memory;
-        int retval;
-
-        DEBUG("%s: %p\n", __func__, pdev);
-
-        spin_lock_init(&dev->lock);
-        dev->dev = &pdev->dev;
-
-        device_initialize(&dev->gadget.dev);
-        dev->gadget.dev.parent = &pdev->dev;
-
-        the_controller = dev;
-        platform_set_drvdata(pdev, dev);
-
-        udc_disable(dev);
-        udc_reinit(dev);
-
-        /* irq setup after old hardware state is cleaned up */
-        retval =
-            request_irq(IRQ_USBINTR, lh7a40x_udc_irq, IRQF_DISABLED, driver_name,
-                        dev);
-        if (retval != 0) {
-                DEBUG(KERN_ERR "%s: can't get irq %i, err %d\n", driver_name,
-                      IRQ_USBINTR, retval);
-                return -EBUSY;
-        }
-
-        create_proc_files();
-
-        return retval;
-}
-
-static int lh7a40x_udc_remove(struct platform_device *pdev)
-{
-        struct lh7a40x_udc *dev = platform_get_drvdata(pdev);
-
-        DEBUG("%s: %p\n", __func__, pdev);
-
-        if (dev->driver)
-                return -EBUSY;
-
-        udc_disable(dev);
-        remove_proc_files();
-
-        free_irq(IRQ_USBINTR, dev);
-
-        platform_set_drvdata(pdev, 0);
-
-        the_controller = 0;
-
-        return 0;
-}
-
-/*-------------------------------------------------------------------------*/
-
-static struct platform_driver udc_driver = {
-        .probe = lh7a40x_udc_probe,
-        .remove = lh7a40x_udc_remove,
-            /* FIXME power management support */
-            /* .suspend = ... disable UDC */
-            /* .resume = ... re-enable UDC */
-        .driver = {
-                .name = (char *)driver_name,
-                .owner = THIS_MODULE,
-        },
-};
-
-static int __init udc_init(void)
-{
-        DEBUG("%s: %s version %s\n", __func__, driver_name, DRIVER_VERSION);
-        return platform_driver_register(&udc_driver);
-}
-
-static void __exit udc_exit(void)
-{
-        platform_driver_unregister(&udc_driver);
-}
-
-module_init(udc_init);
-module_exit(udc_exit);
-
-MODULE_DESCRIPTION(DRIVER_DESC);
-MODULE_AUTHOR("Mikko Lahteenmaki, Bo Henriksen");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:lh7a40x_udc");
diff --git a/drivers/usb/gadget/lh7a40x_udc.h b/drivers/usb/gadget/lh7a40x_udc.h
deleted file mode 100644
index ca861203a301..000000000000
--- a/drivers/usb/gadget/lh7a40x_udc.h
+++ /dev/null
@@ -1,259 +0,0 @@
-/*
- * linux/drivers/usb/gadget/lh7a40x_udc.h
- * Sharp LH7A40x on-chip full speed USB device controllers
- *
- * Copyright (C) 2004 Mikko Lahteenmaki, Nordic ID
- * Copyright (C) 2004 Bo Henriksen, Nordic ID
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- */
-
-#ifndef __LH7A40X_H_
-#define __LH7A40X_H_
-
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/ioport.h>
-#include <linux/types.h>
-#include <linux/errno.h>
-#include <linux/delay.h>
-#include <linux/sched.h>
-#include <linux/slab.h>
-#include <linux/init.h>
-#include <linux/timer.h>
-#include <linux/list.h>
-#include <linux/interrupt.h>
-#include <linux/proc_fs.h>
-#include <linux/mm.h>
-#include <linux/device.h>
-#include <linux/dma-mapping.h>
-
-#include <asm/byteorder.h>
-#include <asm/dma.h>
-#include <asm/io.h>
-#include <asm/irq.h>
-#include <asm/system.h>
-#include <asm/unaligned.h>
-#include <mach/hardware.h>
-
-#include <linux/usb/ch9.h>
-#include <linux/usb/gadget.h>
-
-/*
- * Memory map
- */
-
-#define USB_FA                                  0x80000200      // function address register
-#define USB_PM                                  0x80000204      // power management register
-
-#define USB_IN_INT                              0x80000208      // IN interrupt register bank (EP0-EP3)
-#define USB_OUT_INT                             0x80000210      // OUT interrupt register bank (EP2)
-#define USB_INT                                 0x80000218      // interrupt register bank
-
-#define USB_IN_INT_EN                   0x8000021C      // IN interrupt enable register bank
-#define USB_OUT_INT_EN                  0x80000224      // OUT interrupt enable register bank
-#define USB_INT_EN                              0x8000022C      // USB interrupt enable register bank
-
-#define USB_FRM_NUM1                    0x80000230      // Frame number1 register
-#define USB_FRM_NUM2                    0x80000234      // Frame number2 register
-#define USB_INDEX                               0x80000238      // index register
-
-#define USB_IN_MAXP                             0x80000240      // IN MAXP register
-#define USB_IN_CSR1                             0x80000244      // IN CSR1 register/EP0 CSR register
-#define USB_EP0_CSR                             0x80000244      // IN CSR1 register/EP0 CSR register
-#define USB_IN_CSR2                             0x80000248      // IN CSR2 register
-#define USB_OUT_MAXP                    0x8000024C      // OUT MAXP register
-
-#define USB_OUT_CSR1                    0x80000250      // OUT CSR1 register
-#define USB_OUT_CSR2                    0x80000254      // OUT CSR2 register
-#define USB_OUT_FIFO_WC1                0x80000258      // OUT FIFO write count1 register
-#define USB_OUT_FIFO_WC2                0x8000025C      // OUT FIFO write count2 register
-
-#define USB_RESET                               0x8000044C      // USB reset register
-
-#define USB_EP0_FIFO                    0x80000280
-#define USB_EP1_FIFO                    0x80000284
-#define USB_EP2_FIFO                    0x80000288
-#define USB_EP3_FIFO                    0x8000028c
-
-/*
- * USB reset register
- */
-#define USB_RESET_APB                   (1<<1)  //resets USB APB control side WRITE
-#define USB_RESET_IO                    (1<<0)  //resets USB IO side WRITE
-
-/*
- * USB function address register
- */
-#define USB_FA_ADDR_UPDATE              (1<<7)
-#define USB_FA_FUNCTION_ADDR    (0x7F)
-
-/*
- * Power Management register
- */
-#define PM_USB_DCP                              (1<<5)
-#define PM_USB_ENABLE                   (1<<4)
-#define PM_USB_RESET                    (1<<3)
-#define PM_UC_RESUME                    (1<<2)
-#define PM_SUSPEND_MODE                 (1<<1)
-#define PM_ENABLE_SUSPEND               (1<<0)
-
-/*
- * IN interrupt register
- */
-#define USB_IN_INT_EP3                          (1<<3)
-#define USB_IN_INT_EP1                          (1<<1)
-#define USB_IN_INT_EP0                          (1<<0)
-
-/*
- * OUT interrupt register
- */
-#define USB_OUT_INT_EP2                         (1<<2)
-
-/*
- * USB interrupt register
- */
-#define USB_INT_RESET_INT                       (1<<2)
-#define USB_INT_RESUME_INT                      (1<<1)
-#define USB_INT_SUSPEND_INT                     (1<<0)
-
-/*
- * USB interrupt enable register
- */
-#define USB_INT_EN_USB_RESET_INTER              (1<<2)
-#define USB_INT_EN_RESUME_INTER                 (1<<1)
-#define USB_INT_EN_SUSPEND_INTER                (1<<0)
-
-/*
- * INCSR1 register
- */
-#define USB_IN_CSR1_CLR_DATA_TOGGLE             (1<<6)
-#define USB_IN_CSR1_SENT_STALL                  (1<<5)
-#define USB_IN_CSR1_SEND_STALL                  (1<<4)
-#define USB_IN_CSR1_FIFO_FLUSH                  (1<<3)
-#define USB_IN_CSR1_FIFO_NOT_EMPTY              (1<<1)
-#define USB_IN_CSR1_IN_PKT_RDY                  (1<<0)
-
-/*
- * INCSR2 register
- */
-#define USB_IN_CSR2_AUTO_SET                    (1<<7)
-#define USB_IN_CSR2_USB_DMA_EN                  (1<<4)
-
-/*
- * OUT CSR1 register
- */
-#define USB_OUT_CSR1_CLR_DATA_REG               (1<<7)
-#define USB_OUT_CSR1_SENT_STALL                 (1<<6)
-#define USB_OUT_CSR1_SEND_STALL                 (1<<5)
-#define USB_OUT_CSR1_FIFO_FLUSH                 (1<<4)
-#define USB_OUT_CSR1_FIFO_FULL                  (1<<1)
-#define USB_OUT_CSR1_OUT_PKT_RDY                (1<<0)
-
-/*
- * OUT CSR2 register
- */
-#define USB_OUT_CSR2_AUTO_CLR                   (1<<7)
-#define USB_OUT_CSR2_USB_DMA_EN                 (1<<4)
-
-/*
- * EP0 CSR
- */
-#define EP0_CLR_SETUP_END               (1<<7)  /* Clear "Setup Ends" Bit (w) */
-#define EP0_CLR_OUT                             (1<<6)  /* Clear "Out packet ready" Bit (w) */
-#define EP0_SEND_STALL                  (1<<5)  /* Send STALL Handshake (rw) */
-#define EP0_SETUP_END                   (1<<4)  /* Setup Ends (r) */
-
-#define EP0_DATA_END                    (1<<3)  /* Data end (rw) */
-#define EP0_SENT_STALL                  (1<<2)  /* Sent Stall Handshake (r) */
-#define EP0_IN_PKT_RDY                  (1<<1)  /* In packet ready (rw) */
-#define EP0_OUT_PKT_RDY                 (1<<0)  /* Out packet ready (r) */
-
-/* general CSR */
-#define OUT_PKT_RDY             (1<<0)
-#define IN_PKT_RDY              (1<<0)
-
-/*
- * IN/OUT MAXP register
- */
-#define USB_OUT_MAXP_MAXP                       (0xF)
-#define USB_IN_MAXP_MAXP                        (0xF)
-
-// Max packet size
-//#define EP0_PACKETSIZE        0x10
-#define EP0_PACKETSIZE          0x8
-#define EP0_MAXPACKETSIZE       0x10
-
-#define UDC_MAX_ENDPOINTS       4
-
-#define WAIT_FOR_SETUP          0
-#define DATA_STATE_XMIT         1
-#define DATA_STATE_NEED_ZLP     2
-#define WAIT_FOR_OUT_STATUS     3
-#define DATA_STATE_RECV         4
-
-/* ********************************************************************************************* */
-/* IO
- */
-
-typedef enum ep_type {
-        ep_control, ep_bulk_in, ep_bulk_out, ep_interrupt
-} ep_type_t;
-
-struct lh7a40x_ep {
-        struct usb_ep ep;
-        struct lh7a40x_udc *dev;
-
-        const struct usb_endpoint_descriptor *desc;
-        struct list_head queue;
-        unsigned long pio_irqs;
-
-        u8 stopped;
-        u8 bEndpointAddress;
-        u8 bmAttributes;
-
-        ep_type_t ep_type;
-        u32 fifo;
-        u32 csr1;
-        u32 csr2;
-};
-
-struct lh7a40x_request {
-        struct usb_request req;
-        struct list_head queue;
-};
-
-struct lh7a40x_udc {
-        struct usb_gadget gadget;
-        struct usb_gadget_driver *driver;
-        struct device *dev;
-        spinlock_t lock;
-
-        int ep0state;
-        struct lh7a40x_ep ep[UDC_MAX_ENDPOINTS];
-
-        unsigned char usb_address;
-
-        unsigned req_pending:1, req_std:1, req_config:1;
-};
-
-extern struct lh7a40x_udc *the_controller;
-
-#define ep_is_in(EP)            (((EP)->bEndpointAddress&USB_DIR_IN)==USB_DIR_IN)
-#define ep_index(EP)            ((EP)->bEndpointAddress&0xF)
-#define ep_maxpacket(EP)        ((EP)->ep.maxpacket)
-
-#endif
diff --git a/drivers/usb/gadget/m66592-udc.c b/drivers/usb/gadget/m66592-udc.c
index e03058fe23cb..084aa080a2d5 100644
--- a/drivers/usb/gadget/m66592-udc.c
+++ b/drivers/usb/gadget/m66592-udc.c
@@ -258,7 +258,7 @@ static int pipe_buffer_setting(struct m66592 *m66592,
                 break;
         case M66592_BULK:
                 /* isochronous pipes may be used as bulk pipes */
-                if (info->pipe > M66592_BASE_PIPENUM_BULK)
+                if (info->pipe >= M66592_BASE_PIPENUM_BULK)
                         bufnum = info->pipe - M66592_BASE_PIPENUM_BULK;
                 else
                         bufnum = info->pipe - M66592_BASE_PIPENUM_ISOC;
@@ -1454,14 +1454,15 @@ static struct usb_ep_ops m66592_ep_ops = {
 /*-------------------------------------------------------------------------*/
 static struct m66592 *the_controller;
 
-int usb_gadget_register_driver(struct usb_gadget_driver *driver)
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
 {
         struct m66592 *m66592 = the_controller;
         int retval;
 
         if (!driver
                         || driver->speed != USB_SPEED_HIGH
-                        || !driver->bind
+                        || !bind
                         || !driver->setup)
                 return -EINVAL;
         if (!m66592)
@@ -1480,7 +1481,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
                 goto error;
         }
 
-        retval = driver->bind (&m66592->gadget);
+        retval = bind(&m66592->gadget);
         if (retval) {
                 pr_err("bind to driver error (%d)\n", retval);
                 device_del(&m66592->gadget.dev);
@@ -1505,7 +1506,7 @@ error:
 
         return retval;
 }
-EXPORT_SYMBOL(usb_gadget_register_driver);
+EXPORT_SYMBOL(usb_gadget_probe_driver);
 
 int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
 {
diff --git a/drivers/usb/gadget/mass_storage.c b/drivers/usb/gadget/mass_storage.c
index 585f2559484d..01822422c3e8 100644
--- a/drivers/usb/gadget/mass_storage.c
+++ b/drivers/usb/gadget/mass_storage.c
@@ -75,10 +75,6 @@ static struct usb_device_descriptor msg_device_desc = {
         /* Vendor and product id can be overridden by module parameters.  */
         .idVendor =             cpu_to_le16(FSG_VENDOR_ID),
         .idProduct =            cpu_to_le16(FSG_PRODUCT_ID),
-        /* .bcdDevice = f(hardware) */
-        /* .iManufacturer = DYNAMIC */
-        /* .iProduct = DYNAMIC */
-        /* NO SERIAL NUMBER */
         .bNumConfigurations =   1,
 };
 
@@ -86,7 +82,8 @@ static struct usb_otg_descriptor otg_descriptor = {
         .bLength =              sizeof otg_descriptor,
         .bDescriptorType =      USB_DT_OTG,
 
-        /* REVISIT SRP-only hardware is possible, although
+        /*
+         * REVISIT SRP-only hardware is possible, although
          * it would not be called "OTG" ...
          */
         .bmAttributes =         USB_OTG_SRP | USB_OTG_HNP,
@@ -98,33 +95,6 @@ static const struct usb_descriptor_header *otg_desc[] = {
 };
 
 
-/* string IDs are assigned dynamically */
-
-#define STRING_MANUFACTURER_IDX         0
-#define STRING_PRODUCT_IDX              1
-#define STRING_CONFIGURATION_IDX        2
-
-static char manufacturer[50];
-
-static struct usb_string strings_dev[] = {
-        [STRING_MANUFACTURER_IDX].s = manufacturer,
-        [STRING_PRODUCT_IDX].s = DRIVER_DESC,
-        [STRING_CONFIGURATION_IDX].s = "Self Powered",
-        {  } /* end of list */
-};
-
-static struct usb_gadget_strings stringtab_dev = {
-        .language       = 0x0409,       /* en-us */
-        .strings        = strings_dev,
-};
-
-static struct usb_gadget_strings *dev_strings[] = {
-        &stringtab_dev,
-        NULL,
-};
-
-
-
 /****************************** Configurations ******************************/
 
 static struct fsg_module_parameters mod_data = {
@@ -132,7 +102,7 @@ static struct fsg_module_parameters mod_data = {
 };
 FSG_MODULE_PARAMETERS(/* no prefix */, mod_data);
 
-static unsigned long msg_registered = 0;
+static unsigned long msg_registered;
 static void msg_cleanup(void);
 
 static int msg_thread_exits(struct fsg_common *common)
@@ -141,7 +111,7 @@ static int msg_thread_exits(struct fsg_common *common)
         return 0;
 }
 
-static int __ref msg_do_config(struct usb_configuration *c)
+static int __init msg_do_config(struct usb_configuration *c)
 {
         static const struct fsg_operations ops = {
                 .thread_exits = msg_thread_exits,
@@ -171,54 +141,23 @@ static int __ref msg_do_config(struct usb_configuration *c)
 
 static struct usb_configuration msg_config_driver = {
         .label                  = "Linux File-Backed Storage",
-        .bind                   = msg_do_config,
         .bConfigurationValue    = 1,
-        /* .iConfiguration = DYNAMIC */
         .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
 };
 
 
-
 /****************************** Gadget Bind ******************************/
 
-
-static int __ref msg_bind(struct usb_composite_dev *cdev)
+static int __init msg_bind(struct usb_composite_dev *cdev)
 {
-        struct usb_gadget *gadget = cdev->gadget;
         int status;
 
-        /* Allocate string descriptor numbers ... note that string
-         * contents can be overridden by the composite_dev glue.
-         */
-
-        /* device descriptor strings: manufacturer, product */
-        snprintf(manufacturer, sizeof manufacturer, "%s %s with %s",
-                 init_utsname()->sysname, init_utsname()->release,
-                 gadget->name);
-        status = usb_string_id(cdev);
+        status = usb_add_config(cdev, &msg_config_driver, msg_do_config);
         if (status < 0)
                 return status;
-        strings_dev[STRING_MANUFACTURER_IDX].id = status;
-        msg_device_desc.iManufacturer = status;
 
-        status = usb_string_id(cdev);
-        if (status < 0)
-                return status;
-        strings_dev[STRING_PRODUCT_IDX].id = status;
-        msg_device_desc.iProduct = status;
-
-        status = usb_string_id(cdev);
-        if (status < 0)
-                return status;
-        strings_dev[STRING_CONFIGURATION_IDX].id = status;
-        msg_config_driver.iConfiguration = status;
-
-        /* register our second configuration */
-        status = usb_add_config(cdev, &msg_config_driver);
-        if (status < 0)
-                return status;
-
-        dev_info(&gadget->dev, DRIVER_DESC ", version: " DRIVER_VERSION "\n");
+        dev_info(&cdev->gadget->dev,
+                 DRIVER_DESC ", version: " DRIVER_VERSION "\n");
         set_bit(0, &msg_registered);
         return 0;
 }
@@ -226,12 +165,11 @@ static int __ref msg_bind(struct usb_composite_dev *cdev)
 
 /****************************** Some noise ******************************/
 
-
 static struct usb_composite_driver msg_driver = {
         .name           = "g_mass_storage",
         .dev            = &msg_device_desc,
-        .strings        = dev_strings,
-        .bind           = msg_bind,
+        .iProduct       = DRIVER_DESC,
+        .needs_serial   = 1,
 };
 
 MODULE_DESCRIPTION(DRIVER_DESC);
@@ -240,7 +178,7 @@ MODULE_LICENSE("GPL");
 
 static int __init msg_init(void)
 {
-        return usb_composite_register(&msg_driver);
+        return usb_composite_probe(&msg_driver, msg_bind);
 }
 module_init(msg_init);
 
diff --git a/drivers/usb/gadget/multi.c b/drivers/usb/gadget/multi.c
index 795d76232167..d9feced348e3 100644
--- a/drivers/usb/gadget/multi.c
+++ b/drivers/usb/gadget/multi.c
@@ -74,8 +74,8 @@ MODULE_LICENSE("GPL");
 
 /***************************** Device Descriptor ****************************/
 
-#define MULTI_VENDOR_NUM        0x0525  /* XXX NetChip */
-#define MULTI_PRODUCT_NUM       0xa4ab  /* XXX */
+#define MULTI_VENDOR_NUM        0x1d6b  /* Linux Foundation */
+#define MULTI_PRODUCT_NUM       0x0104  /* Multifunction Composite Gadget */
 
 
 enum {
@@ -121,8 +121,6 @@ static const struct usb_descriptor_header *otg_desc[] = {
 
 
 enum {
-        MULTI_STRING_MANUFACTURER_IDX,
-        MULTI_STRING_PRODUCT_IDX,
 #ifdef CONFIG_USB_G_MULTI_RNDIS
         MULTI_STRING_RNDIS_CONFIG_IDX,
 #endif
@@ -131,11 +129,7 @@ enum {
 #endif
 };
 
-static char manufacturer[50];
-
 static struct usb_string strings_dev[] = {
-        [MULTI_STRING_MANUFACTURER_IDX].s = manufacturer,
-        [MULTI_STRING_PRODUCT_IDX].s      = DRIVER_DESC,
 #ifdef CONFIG_USB_G_MULTI_RNDIS
         [MULTI_STRING_RNDIS_CONFIG_IDX].s = "Multifunction with RNDIS",
 #endif
@@ -170,7 +164,7 @@ static u8 hostaddr[ETH_ALEN];
 
 #ifdef USB_ETH_RNDIS
 
-static __ref int rndis_do_config(struct usb_configuration *c)
+static __init int rndis_do_config(struct usb_configuration *c)
 {
         int ret;
 
@@ -197,7 +191,6 @@ static __ref int rndis_do_config(struct usb_configuration *c)
 static int rndis_config_register(struct usb_composite_dev *cdev)
 {
         static struct usb_configuration config = {
-                .bind                   = rndis_do_config,
                 .bConfigurationValue    = MULTI_RNDIS_CONFIG_NUM,
                 .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
         };
@@ -205,7 +198,7 @@ static int rndis_config_register(struct usb_composite_dev *cdev)
         config.label          = strings_dev[MULTI_STRING_RNDIS_CONFIG_IDX].s;
         config.iConfiguration = strings_dev[MULTI_STRING_RNDIS_CONFIG_IDX].id;
 
-        return usb_add_config(cdev, &config);
+        return usb_add_config(cdev, &config, rndis_do_config);
 }
 
 #else
@@ -222,7 +215,7 @@ static int rndis_config_register(struct usb_composite_dev *cdev)
 
 #ifdef CONFIG_USB_G_MULTI_CDC
 
-static __ref int cdc_do_config(struct usb_configuration *c)
+static __init int cdc_do_config(struct usb_configuration *c)
 {
         int ret;
 
@@ -249,7 +242,6 @@ static __ref int cdc_do_config(struct usb_configuration *c)
 static int cdc_config_register(struct usb_composite_dev *cdev)
 {
         static struct usb_configuration config = {
-                .bind                   = cdc_do_config,
                 .bConfigurationValue    = MULTI_CDC_CONFIG_NUM,
                 .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
         };
@@ -257,7 +249,7 @@ static int cdc_config_register(struct usb_composite_dev *cdev)
         config.label          = strings_dev[MULTI_STRING_CDC_CONFIG_IDX].s;
         config.iConfiguration = strings_dev[MULTI_STRING_CDC_CONFIG_IDX].id;
 
-        return usb_add_config(cdev, &config);
+        return usb_add_config(cdev, &config, cdc_do_config);
 }
 
 #else
@@ -314,20 +306,11 @@ static int __ref multi_bind(struct usb_composite_dev *cdev)
                 device_desc.bcdDevice = cpu_to_le16(0x0300 | 0x0099);
         }
 
-        /* allocate string descriptor numbers */
-        snprintf(manufacturer, sizeof manufacturer, "%s %s with %s",
-                 init_utsname()->sysname, init_utsname()->release,
-                 gadget->name);
-
+        /* allocate string IDs */
         status = usb_string_ids_tab(cdev, strings_dev);
         if (unlikely(status < 0))
                 goto fail2;
 
-        device_desc.iManufacturer =
-                strings_dev[MULTI_STRING_MANUFACTURER_IDX].id;
-        device_desc.iProduct      =
-                strings_dev[MULTI_STRING_PRODUCT_IDX].id;
-
         /* register configurations */
         status = rndis_config_register(cdev);
         if (unlikely(status < 0))
@@ -368,14 +351,15 @@ static struct usb_composite_driver multi_driver = {
         .name           = "g_multi",
         .dev            = &device_desc,
         .strings        = dev_strings,
-        .bind           = multi_bind,
         .unbind         = __exit_p(multi_unbind),
+        .iProduct       = DRIVER_DESC,
+        .needs_serial   = 1,
 };
 
 
 static int __init multi_init(void)
 {
-        return usb_composite_register(&multi_driver);
+        return usb_composite_probe(&multi_driver, multi_bind);
 }
 module_init(multi_init);
 
diff --git a/drivers/usb/gadget/mv_udc.h b/drivers/usb/gadget/mv_udc.h
new file mode 100644
index 000000000000..65f1f7c3bd4e
--- /dev/null
+++ b/drivers/usb/gadget/mv_udc.h
@@ -0,0 +1,294 @@
+
+#ifndef __MV_UDC_H
+#define __MV_UDC_H
+
+#define VUSBHS_MAX_PORTS        8
+
+#define DQH_ALIGNMENT           2048
+#define DTD_ALIGNMENT           64
+#define DMA_BOUNDARY            4096
+
+#define EP_DIR_IN       1
+#define EP_DIR_OUT      0
+
+#define DMA_ADDR_INVALID        (~(dma_addr_t)0)
+
+#define EP0_MAX_PKT_SIZE        64
+/* ep0 transfer state */
+#define WAIT_FOR_SETUP          0
+#define DATA_STATE_XMIT         1
+#define DATA_STATE_NEED_ZLP     2
+#define WAIT_FOR_OUT_STATUS     3
+#define DATA_STATE_RECV         4
+
+#define CAPLENGTH_MASK          (0xff)
+#define DCCPARAMS_DEN_MASK      (0x1f)
+
+#define HCSPARAMS_PPC           (0x10)
+
+/* Frame Index Register Bit Masks */
+#define USB_FRINDEX_MASKS       0x3fff
+
+/* Command Register Bit Masks */
+#define USBCMD_RUN_STOP                         (0x00000001)
+#define USBCMD_CTRL_RESET                       (0x00000002)
+#define USBCMD_SETUP_TRIPWIRE_SET               (0x00002000)
+#define USBCMD_SETUP_TRIPWIRE_CLEAR             (~USBCMD_SETUP_TRIPWIRE_SET)
+
+#define USBCMD_ATDTW_TRIPWIRE_SET               (0x00004000)
+#define USBCMD_ATDTW_TRIPWIRE_CLEAR             (~USBCMD_ATDTW_TRIPWIRE_SET)
+
+/* bit 15,3,2 are for frame list size */
+#define USBCMD_FRAME_SIZE_1024                  (0x00000000) /* 000 */
+#define USBCMD_FRAME_SIZE_512                   (0x00000004) /* 001 */
+#define USBCMD_FRAME_SIZE_256                   (0x00000008) /* 010 */
+#define USBCMD_FRAME_SIZE_128                   (0x0000000C) /* 011 */
+#define USBCMD_FRAME_SIZE_64                    (0x00008000) /* 100 */
+#define USBCMD_FRAME_SIZE_32                    (0x00008004) /* 101 */
+#define USBCMD_FRAME_SIZE_16                    (0x00008008) /* 110 */
+#define USBCMD_FRAME_SIZE_8                     (0x0000800C) /* 111 */
+
+#define EPCTRL_TX_ALL_MASK                      (0xFFFF0000)
+#define EPCTRL_RX_ALL_MASK                      (0x0000FFFF)
+
+#define EPCTRL_TX_DATA_TOGGLE_RST               (0x00400000)
+#define EPCTRL_TX_EP_STALL                      (0x00010000)
+#define EPCTRL_RX_EP_STALL                      (0x00000001)
+#define EPCTRL_RX_DATA_TOGGLE_RST               (0x00000040)
+#define EPCTRL_RX_ENABLE                        (0x00000080)
+#define EPCTRL_TX_ENABLE                        (0x00800000)
+#define EPCTRL_CONTROL                          (0x00000000)
+#define EPCTRL_ISOCHRONOUS                      (0x00040000)
+#define EPCTRL_BULK                             (0x00080000)
+#define EPCTRL_INT                              (0x000C0000)
+#define EPCTRL_TX_TYPE                          (0x000C0000)
+#define EPCTRL_RX_TYPE                          (0x0000000C)
+#define EPCTRL_DATA_TOGGLE_INHIBIT              (0x00000020)
+#define EPCTRL_TX_EP_TYPE_SHIFT                 (18)
+#define EPCTRL_RX_EP_TYPE_SHIFT                 (2)
+
+#define EPCOMPLETE_MAX_ENDPOINTS                (16)
+
+/* endpoint list address bit masks */
+#define USB_EP_LIST_ADDRESS_MASK              0xfffff800
+
+#define PORTSCX_W1C_BITS                        0x2a
+#define PORTSCX_PORT_RESET                      0x00000100
+#define PORTSCX_PORT_POWER                      0x00001000
+#define PORTSCX_FORCE_FULL_SPEED_CONNECT        0x01000000
+#define PORTSCX_PAR_XCVR_SELECT                 0xC0000000
+#define PORTSCX_PORT_FORCE_RESUME               0x00000040
+#define PORTSCX_PORT_SUSPEND                    0x00000080
+#define PORTSCX_PORT_SPEED_FULL                 0x00000000
+#define PORTSCX_PORT_SPEED_LOW                  0x04000000
+#define PORTSCX_PORT_SPEED_HIGH                 0x08000000
+#define PORTSCX_PORT_SPEED_MASK                 0x0C000000
+
+/* USB MODE Register Bit Masks */
+#define USBMODE_CTRL_MODE_IDLE                  0x00000000
+#define USBMODE_CTRL_MODE_DEVICE                0x00000002
+#define USBMODE_CTRL_MODE_HOST                  0x00000003
+#define USBMODE_CTRL_MODE_RSV                   0x00000001
+#define USBMODE_SETUP_LOCK_OFF                  0x00000008
+#define USBMODE_STREAM_DISABLE                  0x00000010
+
+/* USB STS Register Bit Masks */
+#define USBSTS_INT                      0x00000001
+#define USBSTS_ERR                      0x00000002
+#define USBSTS_PORT_CHANGE              0x00000004
+#define USBSTS_FRM_LST_ROLL             0x00000008
+#define USBSTS_SYS_ERR                  0x00000010
+#define USBSTS_IAA                      0x00000020
+#define USBSTS_RESET                    0x00000040
+#define USBSTS_SOF                      0x00000080
+#define USBSTS_SUSPEND                  0x00000100
+#define USBSTS_HC_HALTED                0x00001000
+#define USBSTS_RCL                      0x00002000
+#define USBSTS_PERIODIC_SCHEDULE        0x00004000
+#define USBSTS_ASYNC_SCHEDULE           0x00008000
+
+
+/* Interrupt Enable Register Bit Masks */
+#define USBINTR_INT_EN                          (0x00000001)
+#define USBINTR_ERR_INT_EN                      (0x00000002)
+#define USBINTR_PORT_CHANGE_DETECT_EN           (0x00000004)
+
+#define USBINTR_ASYNC_ADV_AAE                   (0x00000020)
+#define USBINTR_ASYNC_ADV_AAE_ENABLE            (0x00000020)
+#define USBINTR_ASYNC_ADV_AAE_DISABLE           (0xFFFFFFDF)
+
+#define USBINTR_RESET_EN                        (0x00000040)
+#define USBINTR_SOF_UFRAME_EN                   (0x00000080)
+#define USBINTR_DEVICE_SUSPEND                  (0x00000100)
+
+#define USB_DEVICE_ADDRESS_MASK                 (0xfe000000)
+#define USB_DEVICE_ADDRESS_BIT_SHIFT            (25)
+
+struct mv_cap_regs {
+        u32     caplength_hciversion;
+        u32     hcsparams;      /* HC structural parameters */
+        u32     hccparams;      /* HC Capability Parameters*/
+        u32     reserved[5];
+        u32     dciversion;     /* DC version number and reserved 16 bits */
+        u32     dccparams;      /* DC Capability Parameters */
+};
+
+struct mv_op_regs {
+        u32     usbcmd;         /* Command register */
+        u32     usbsts;         /* Status register */
+        u32     usbintr;        /* Interrupt enable */
+        u32     frindex;        /* Frame index */
+        u32     reserved1[1];
+        u32     deviceaddr;     /* Device Address */
+        u32     eplistaddr;     /* Endpoint List Address */
+        u32     ttctrl;         /* HOST TT status and control */
+        u32     burstsize;      /* Programmable Burst Size */
+        u32     txfilltuning;   /* Host Transmit Pre-Buffer Packet Tuning */
+        u32     reserved[4];
+        u32     epnak;          /* Endpoint NAK */
+        u32     epnaken;        /* Endpoint NAK Enable */
+        u32     configflag;     /* Configured Flag register */
+        u32     portsc[VUSBHS_MAX_PORTS]; /* Port Status/Control x, x = 1..8 */
+        u32     otgsc;
+        u32     usbmode;        /* USB Host/Device mode */
+        u32     epsetupstat;    /* Endpoint Setup Status */
+        u32     epprime;        /* Endpoint Initialize */
+        u32     epflush;        /* Endpoint De-initialize */
+        u32     epstatus;       /* Endpoint Status */
+        u32     epcomplete;     /* Endpoint Interrupt On Complete */
+        u32     epctrlx[16];    /* Endpoint Control, where x = 0.. 15 */
+        u32     mcr;            /* Mux Control */
+        u32     isr;            /* Interrupt Status */
+        u32     ier;            /* Interrupt Enable */
+};
+
+struct mv_udc {
+        struct usb_gadget               gadget;
+        struct usb_gadget_driver        *driver;
+        spinlock_t                      lock;
+        struct completion               *done;
+        struct platform_device          *dev;
+        int                             irq;
+
+        struct mv_cap_regs __iomem      *cap_regs;
+        struct mv_op_regs __iomem       *op_regs;
+        unsigned int                    phy_regs;
+        unsigned int                    max_eps;
+        struct mv_dqh                   *ep_dqh;
+        size_t                          ep_dqh_size;
+        dma_addr_t                      ep_dqh_dma;
+
+        struct dma_pool                 *dtd_pool;
+        struct mv_ep                    *eps;
+
+        struct mv_dtd                   *dtd_head;
+        struct mv_dtd                   *dtd_tail;
+        unsigned int                    dtd_entries;
+
+        struct mv_req                   *status_req;
+        struct usb_ctrlrequest          local_setup_buff;
+
+        unsigned int            resume_state;   /* USB state to resume */
+        unsigned int            usb_state;      /* USB current state */
+        unsigned int            ep0_state;      /* Endpoint zero state */
+        unsigned int            ep0_dir;
+
+        unsigned int            dev_addr;
+
+        int                     errors;
+        unsigned                softconnect:1,
+                                vbus_active:1,
+                                remote_wakeup:1,
+                                softconnected:1,
+                                force_fs:1;
+        struct clk              *clk;
+};
+
+/* endpoint data structure */
+struct mv_ep {
+        struct usb_ep           ep;
+        struct mv_udc           *udc;
+        struct list_head        queue;
+        struct mv_dqh           *dqh;
+        const struct usb_endpoint_descriptor    *desc;
+        u32                     direction;
+        char                    name[14];
+        unsigned                stopped:1,
+                                wedge:1,
+                                ep_type:2,
+                                ep_num:8;
+};
+
+/* request data structure */
+struct mv_req {
+        struct usb_request      req;
+        struct mv_dtd           *dtd, *head, *tail;
+        struct mv_ep            *ep;
+        struct list_head        queue;
+        unsigned                dtd_count;
+        unsigned                mapped:1;
+};
+
+#define EP_QUEUE_HEAD_MULT_POS                  30
+#define EP_QUEUE_HEAD_ZLT_SEL                   0x20000000
+#define EP_QUEUE_HEAD_MAX_PKT_LEN_POS           16
+#define EP_QUEUE_HEAD_MAX_PKT_LEN(ep_info)      (((ep_info)>>16)&0x07ff)
+#define EP_QUEUE_HEAD_IOS                       0x00008000
+#define EP_QUEUE_HEAD_NEXT_TERMINATE            0x00000001
+#define EP_QUEUE_HEAD_IOC                       0x00008000
+#define EP_QUEUE_HEAD_MULTO                     0x00000C00
+#define EP_QUEUE_HEAD_STATUS_HALT               0x00000040
+#define EP_QUEUE_HEAD_STATUS_ACTIVE             0x00000080
+#define EP_QUEUE_CURRENT_OFFSET_MASK            0x00000FFF
+#define EP_QUEUE_HEAD_NEXT_POINTER_MASK         0xFFFFFFE0
+#define EP_QUEUE_FRINDEX_MASK                   0x000007FF
+#define EP_MAX_LENGTH_TRANSFER                  0x4000
+
+struct mv_dqh {
+        /* Bits 16..26 Bit 15 is Interrupt On Setup */
+        u32     max_packet_length;
+        u32     curr_dtd_ptr;           /* Current dTD Pointer */
+        u32     next_dtd_ptr;           /* Next dTD Pointer */
+        /* Total bytes (16..30), IOC (15), INT (8), STS (0-7) */
+        u32     size_ioc_int_sts;
+        u32     buff_ptr0;              /* Buffer pointer Page 0 (12-31) */
+        u32     buff_ptr1;              /* Buffer pointer Page 1 (12-31) */
+        u32     buff_ptr2;              /* Buffer pointer Page 2 (12-31) */
+        u32     buff_ptr3;              /* Buffer pointer Page 3 (12-31) */
+        u32     buff_ptr4;              /* Buffer pointer Page 4 (12-31) */
+        u32     reserved1;
+        /* 8 bytes of setup data that follows the Setup PID */
+        u8      setup_buffer[8];
+        u32     reserved2[4];
+};
+
+
+#define DTD_NEXT_TERMINATE              (0x00000001)
+#define DTD_IOC                         (0x00008000)
+#define DTD_STATUS_ACTIVE               (0x00000080)
+#define DTD_STATUS_HALTED               (0x00000040)
+#define DTD_STATUS_DATA_BUFF_ERR        (0x00000020)
+#define DTD_STATUS_TRANSACTION_ERR      (0x00000008)
+#define DTD_RESERVED_FIELDS             (0x00007F00)
+#define DTD_ERROR_MASK                  (0x68)
+#define DTD_ADDR_MASK                   (0xFFFFFFE0)
+#define DTD_PACKET_SIZE                 0x7FFF0000
+#define DTD_LENGTH_BIT_POS              (16)
+
+struct mv_dtd {
+        u32     dtd_next;
+        u32     size_ioc_sts;
+        u32     buff_ptr0;              /* Buffer pointer Page 0 */
+        u32     buff_ptr1;              /* Buffer pointer Page 1 */
+        u32     buff_ptr2;              /* Buffer pointer Page 2 */
+        u32     buff_ptr3;              /* Buffer pointer Page 3 */
+        u32     buff_ptr4;              /* Buffer pointer Page 4 */
+        u32     scratch_ptr;
+        /* 32 bytes */
+        dma_addr_t td_dma;              /* dma address for this td */
+        struct mv_dtd *next_dtd_virt;
+};
+
+extern int mv_udc_phy_init(unsigned int base);
+
+#endif
diff --git a/drivers/usb/gadget/mv_udc_core.c b/drivers/usb/gadget/mv_udc_core.c
new file mode 100644
index 000000000000..b1a8146b9d50
--- /dev/null
+++ b/drivers/usb/gadget/mv_udc_core.c
@@ -0,0 +1,2149 @@
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/dma-mapping.h>
+#include <linux/dmapool.h>
+#include <linux/kernel.h>
+#include <linux/delay.h>
+#include <linux/ioport.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/timer.h>
+#include <linux/list.h>
+#include <linux/interrupt.h>
+#include <linux/moduleparam.h>
+#include <linux/device.h>
+#include <linux/usb/ch9.h>
+#include <linux/usb/gadget.h>
+#include <linux/usb/otg.h>
+#include <linux/pm.h>
+#include <linux/io.h>
+#include <linux/irq.h>
+#include <linux/platform_device.h>
+#include <linux/clk.h>
+#include <asm/system.h>
+#include <asm/unaligned.h>
+
+#include "mv_udc.h"
+
+#define DRIVER_DESC             "Marvell PXA USB Device Controller driver"
+#define DRIVER_VERSION          "8 Nov 2010"
+
+#define ep_dir(ep)      (((ep)->ep_num == 0) ? \
+                                ((ep)->udc->ep0_dir) : ((ep)->direction))
+
+/* timeout value -- usec */
+#define RESET_TIMEOUT           10000
+#define FLUSH_TIMEOUT           10000
+#define EPSTATUS_TIMEOUT        10000
+#define PRIME_TIMEOUT           10000
+#define READSAFE_TIMEOUT        1000
+#define DTD_TIMEOUT             1000
+
+#define LOOPS_USEC_SHIFT        4
+#define LOOPS_USEC              (1 << LOOPS_USEC_SHIFT)
+#define LOOPS(timeout)          ((timeout) >> LOOPS_USEC_SHIFT)
+
+static const char driver_name[] = "mv_udc";
+static const char driver_desc[] = DRIVER_DESC;
+
+/* controller device global variable */
+static struct mv_udc    *the_controller;
+int mv_usb_otgsc;
+
+static void nuke(struct mv_ep *ep, int status);
+
+/* for endpoint 0 operations */
+static const struct usb_endpoint_descriptor mv_ep0_desc = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+        .bEndpointAddress =     0,
+        .bmAttributes =         USB_ENDPOINT_XFER_CONTROL,
+        .wMaxPacketSize =       EP0_MAX_PKT_SIZE,
+};
+
+static void ep0_reset(struct mv_udc *udc)
+{
+        struct mv_ep *ep;
+        u32 epctrlx;
+        int i = 0;
+
+        /* ep0 in and out */
+        for (i = 0; i < 2; i++) {
+                ep = &udc->eps[i];
+                ep->udc = udc;
+
+                /* ep0 dQH */
+                ep->dqh = &udc->ep_dqh[i];
+
+                /* configure ep0 endpoint capabilities in dQH */
+                ep->dqh->max_packet_length =
+                        (EP0_MAX_PKT_SIZE << EP_QUEUE_HEAD_MAX_PKT_LEN_POS)
+                        | EP_QUEUE_HEAD_IOS;
+
+                epctrlx = readl(&udc->op_regs->epctrlx[0]);
+                if (i) {        /* TX */
+                        epctrlx |= EPCTRL_TX_ENABLE | EPCTRL_TX_DATA_TOGGLE_RST
+                                | (USB_ENDPOINT_XFER_CONTROL
+                                        << EPCTRL_TX_EP_TYPE_SHIFT);
+
+                } else {        /* RX */
+                        epctrlx |= EPCTRL_RX_ENABLE | EPCTRL_RX_DATA_TOGGLE_RST
+                                | (USB_ENDPOINT_XFER_CONTROL
+                                        << EPCTRL_RX_EP_TYPE_SHIFT);
+                }
+
+                writel(epctrlx, &udc->op_regs->epctrlx[0]);
+        }
+}
+
+/* protocol ep0 stall, will automatically be cleared on new transaction */
+static void ep0_stall(struct mv_udc *udc)
+{
+        u32     epctrlx;
+
+        /* set TX and RX to stall */
+        epctrlx = readl(&udc->op_regs->epctrlx[0]);
+        epctrlx |= EPCTRL_RX_EP_STALL | EPCTRL_TX_EP_STALL;
+        writel(epctrlx, &udc->op_regs->epctrlx[0]);
+
+        /* update ep0 state */
+        udc->ep0_state = WAIT_FOR_SETUP;
+        udc->ep0_dir = EP_DIR_OUT;
+}
+
+static int process_ep_req(struct mv_udc *udc, int index,
+        struct mv_req *curr_req)
+{
+        struct mv_dtd   *curr_dtd;
+        struct mv_dqh   *curr_dqh;
+        int td_complete, actual, remaining_length;
+        int i, direction;
+        int retval = 0;
+        u32 errors;
+
+        curr_dqh = &udc->ep_dqh[index];
+        direction = index % 2;
+
+        curr_dtd = curr_req->head;
+        td_complete = 0;
+        actual = curr_req->req.length;
+
+        for (i = 0; i < curr_req->dtd_count; i++) {
+                if (curr_dtd->size_ioc_sts & DTD_STATUS_ACTIVE) {
+                        dev_dbg(&udc->dev->dev, "%s, dTD not completed\n",
+                                udc->eps[index].name);
+                        return 1;
+                }
+
+                errors = curr_dtd->size_ioc_sts & DTD_ERROR_MASK;
+                if (!errors) {
+                        remaining_length +=
+                                (curr_dtd->size_ioc_sts & DTD_PACKET_SIZE)
+                                        >> DTD_LENGTH_BIT_POS;
+                        actual -= remaining_length;
+                } else {
+                        dev_info(&udc->dev->dev,
+                                "complete_tr error: ep=%d %s: error = 0x%x\n",
+                                index >> 1, direction ? "SEND" : "RECV",
+                                errors);
+                        if (errors & DTD_STATUS_HALTED) {
+                                /* Clear the errors and Halt condition */
+                                curr_dqh->size_ioc_int_sts &= ~errors;
+                                retval = -EPIPE;
+                        } else if (errors & DTD_STATUS_DATA_BUFF_ERR) {
+                                retval = -EPROTO;
+                        } else if (errors & DTD_STATUS_TRANSACTION_ERR) {
+                                retval = -EILSEQ;
+                        }
+                }
+                if (i != curr_req->dtd_count - 1)
+                        curr_dtd = (struct mv_dtd *)curr_dtd->next_dtd_virt;
+        }
+        if (retval)
+                return retval;
+
+        curr_req->req.actual = actual;
+
+        return 0;
+}
+
+/*
+ * done() - retire a request; caller blocked irqs
+ * @status : request status to be set, only works when
+ * request is still in progress.
+ */
+static void done(struct mv_ep *ep, struct mv_req *req, int status)
+{
+        struct mv_udc *udc = NULL;
+        unsigned char stopped = ep->stopped;
+        struct mv_dtd *curr_td, *next_td;
+        int j;
+
+        udc = (struct mv_udc *)ep->udc;
+        /* Removed the req from fsl_ep->queue */
+        list_del_init(&req->queue);
+
+        /* req.status should be set as -EINPROGRESS in ep_queue() */
+        if (req->req.status == -EINPROGRESS)
+                req->req.status = status;
+        else
+                status = req->req.status;
+
+        /* Free dtd for the request */
+        next_td = req->head;
+        for (j = 0; j < req->dtd_count; j++) {
+                curr_td = next_td;
+                if (j != req->dtd_count - 1)
+                        next_td = curr_td->next_dtd_virt;
+                dma_pool_free(udc->dtd_pool, curr_td, curr_td->td_dma);
+        }
+
+        if (req->mapped) {
+                dma_unmap_single(ep->udc->gadget.dev.parent,
+                        req->req.dma, req->req.length,
+                        ((ep_dir(ep) == EP_DIR_IN) ?
+                                DMA_TO_DEVICE : DMA_FROM_DEVICE));
+                req->req.dma = DMA_ADDR_INVALID;
+                req->mapped = 0;
+        } else
+                dma_sync_single_for_cpu(ep->udc->gadget.dev.parent,
+                        req->req.dma, req->req.length,
+                        ((ep_dir(ep) == EP_DIR_IN) ?
+                                DMA_TO_DEVICE : DMA_FROM_DEVICE));
+
+        if (status && (status != -ESHUTDOWN))
+                dev_info(&udc->dev->dev, "complete %s req %p stat %d len %u/%u",
+                        ep->ep.name, &req->req, status,
+                        req->req.actual, req->req.length);
+
+        ep->stopped = 1;
+
+        spin_unlock(&ep->udc->lock);
+        /*
+         * complete() is from gadget layer,
+         * eg fsg->bulk_in_complete()
+         */
+        if (req->req.complete)
+                req->req.complete(&ep->ep, &req->req);
+
+        spin_lock(&ep->udc->lock);
+        ep->stopped = stopped;
+}
+
+static int queue_dtd(struct mv_ep *ep, struct mv_req *req)
+{
+        u32 tmp, epstatus, bit_pos, direction;
+        struct mv_udc *udc;
+        struct mv_dqh *dqh;
+        unsigned int loops;
+        int readsafe, retval = 0;
+
+        udc = ep->udc;
+        direction = ep_dir(ep);
+        dqh = &(udc->ep_dqh[ep->ep_num * 2 + direction]);
+        bit_pos = 1 << (((direction == EP_DIR_OUT) ? 0 : 16) + ep->ep_num);
+
+        /* check if the pipe is empty */
+        if (!(list_empty(&ep->queue))) {
+                struct mv_req *lastreq;
+                lastreq = list_entry(ep->queue.prev, struct mv_req, queue);
+                lastreq->tail->dtd_next =
+                        req->head->td_dma & EP_QUEUE_HEAD_NEXT_POINTER_MASK;
+                if (readl(&udc->op_regs->epprime) & bit_pos) {
+                        loops = LOOPS(PRIME_TIMEOUT);
+                        while (readl(&udc->op_regs->epprime) & bit_pos) {
+                                if (loops == 0) {
+                                        retval = -ETIME;
+                                        goto done;
+                                }
+                                udelay(LOOPS_USEC);
+                                loops--;
+                        }
+                        if (readl(&udc->op_regs->epstatus) & bit_pos)
+                                goto done;
+                }
+                readsafe = 0;
+                loops = LOOPS(READSAFE_TIMEOUT);
+                while (readsafe == 0) {
+                        if (loops == 0) {
+                                retval = -ETIME;
+                                goto done;
+                        }
+                        /* start with setting the semaphores */
+                        tmp = readl(&udc->op_regs->usbcmd);
+                        tmp |= USBCMD_ATDTW_TRIPWIRE_SET;
+                        writel(tmp, &udc->op_regs->usbcmd);
+
+                        /* read the endpoint status */
+                        epstatus = readl(&udc->op_regs->epstatus) & bit_pos;
+
+                        /*
+                         * Reread the ATDTW semaphore bit to check if it is
+                         * cleared. When hardware see a hazard, it will clear
+                         * the bit or else we remain set to 1 and we can
+                         * proceed with priming of endpoint if not already
+                         * primed.
+                         */
+                        if (readl(&udc->op_regs->usbcmd)
+                                & USBCMD_ATDTW_TRIPWIRE_SET) {
+                                readsafe = 1;
+                        }
+                        loops--;
+                        udelay(LOOPS_USEC);
+                }
+
+                /* Clear the semaphore */
+                tmp = readl(&udc->op_regs->usbcmd);
+                tmp &= USBCMD_ATDTW_TRIPWIRE_CLEAR;
+                writel(tmp, &udc->op_regs->usbcmd);
+
+                /* If endpoint is not active, we activate it now. */
+                if (!epstatus) {
+                        if (direction == EP_DIR_IN) {
+                                struct mv_dtd *curr_dtd = dma_to_virt(
+                                        &udc->dev->dev, dqh->curr_dtd_ptr);
+
+                                loops = LOOPS(DTD_TIMEOUT);
+                                while (curr_dtd->size_ioc_sts
+                                        & DTD_STATUS_ACTIVE) {
+                                        if (loops == 0) {
+                                                retval = -ETIME;
+                                                goto done;
+                                        }
+                                        loops--;
+                                        udelay(LOOPS_USEC);
+                                }
+                        }
+                        /* No other transfers on the queue */
+
+                        /* Write dQH next pointer and terminate bit to 0 */
+                        dqh->next_dtd_ptr = req->head->td_dma
+                                & EP_QUEUE_HEAD_NEXT_POINTER_MASK;
+                        dqh->size_ioc_int_sts = 0;
+
+                        /*
+                         * Ensure that updates to the QH will
+                         * occur before priming.
+                         */
+                        wmb();
+
+                        /* Prime the Endpoint */
+                        writel(bit_pos, &udc->op_regs->epprime);
+                }
+        } else {
+                /* Write dQH next pointer and terminate bit to 0 */
+                dqh->next_dtd_ptr = req->head->td_dma
+                        & EP_QUEUE_HEAD_NEXT_POINTER_MASK;;
+                dqh->size_ioc_int_sts = 0;
+
+                /* Ensure that updates to the QH will occur before priming. */
+                wmb();
+
+                /* Prime the Endpoint */
+                writel(bit_pos, &udc->op_regs->epprime);
+
+                if (direction == EP_DIR_IN) {
+                        /* FIXME add status check after prime the IN ep */
+                        int prime_again;
+                        u32 curr_dtd_ptr = dqh->curr_dtd_ptr;
+
+                        loops = LOOPS(DTD_TIMEOUT);
+                        prime_again = 0;
+                        while ((curr_dtd_ptr != req->head->td_dma)) {
+                                curr_dtd_ptr = dqh->curr_dtd_ptr;
+                                if (loops == 0) {
+                                        dev_err(&udc->dev->dev,
+                                                "failed to prime %s\n",
+                                                ep->name);
+                                        retval = -ETIME;
+                                        goto done;
+                                }
+                                loops--;
+                                udelay(LOOPS_USEC);
+
+                                if (loops == (LOOPS(DTD_TIMEOUT) >> 2)) {
+                                        if (prime_again)
+                                                goto done;
+                                        dev_info(&udc->dev->dev,
+                                                "prime again\n");
+                                        writel(bit_pos,
+                                                &udc->op_regs->epprime);
+                                        prime_again = 1;
+                                }
+                        }
+                }
+        }
+done:
+        return retval;;
+}
+
+static struct mv_dtd *build_dtd(struct mv_req *req, unsigned *length,
+                dma_addr_t *dma, int *is_last)
+{
+        u32 temp;
+        struct mv_dtd *dtd;
+        struct mv_udc *udc;
+
+        /* how big will this transfer be? */
+        *length = min(req->req.length - req->req.actual,
+                        (unsigned)EP_MAX_LENGTH_TRANSFER);
+
+        udc = req->ep->udc;
+
+        /*
+         * Be careful that no _GFP_HIGHMEM is set,
+         * or we can not use dma_to_virt
+         */
+        dtd = dma_pool_alloc(udc->dtd_pool, GFP_KERNEL, dma);
+        if (dtd == NULL)
+                return dtd;
+
+        dtd->td_dma = *dma;
+        /* initialize buffer page pointers */
+        temp = (u32)(req->req.dma + req->req.actual);
+        dtd->buff_ptr0 = cpu_to_le32(temp);
+        temp &= ~0xFFF;
+        dtd->buff_ptr1 = cpu_to_le32(temp + 0x1000);
+        dtd->buff_ptr2 = cpu_to_le32(temp + 0x2000);
+        dtd->buff_ptr3 = cpu_to_le32(temp + 0x3000);
+        dtd->buff_ptr4 = cpu_to_le32(temp + 0x4000);
+
+        req->req.actual += *length;
+
+        /* zlp is needed if req->req.zero is set */
+        if (req->req.zero) {
+                if (*length == 0 || (*length % req->ep->ep.maxpacket) != 0)
+                        *is_last = 1;
+                else
+                        *is_last = 0;
+        } else if (req->req.length == req->req.actual)
+                *is_last = 1;
+        else
+                *is_last = 0;
+
+        /* Fill in the transfer size; set active bit */
+        temp = ((*length << DTD_LENGTH_BIT_POS) | DTD_STATUS_ACTIVE);
+
+        /* Enable interrupt for the last dtd of a request */
+        if (*is_last && !req->req.no_interrupt)
+                temp |= DTD_IOC;
+
+        dtd->size_ioc_sts = temp;
+
+        mb();
+
+        return dtd;
+}
+
+/* generate dTD linked list for a request */
+static int req_to_dtd(struct mv_req *req)
+{
+        unsigned count;
+        int is_last, is_first = 1;
+        struct mv_dtd *dtd, *last_dtd = NULL;
+        struct mv_udc *udc;
+        dma_addr_t dma;
+
+        udc = req->ep->udc;
+
+        do {
+                dtd = build_dtd(req, &count, &dma, &is_last);
+                if (dtd == NULL)
+                        return -ENOMEM;
+
+                if (is_first) {
+                        is_first = 0;
+                        req->head = dtd;
+                } else {
+                        last_dtd->dtd_next = dma;
+                        last_dtd->next_dtd_virt = dtd;
+                }
+                last_dtd = dtd;
+                req->dtd_count++;
+        } while (!is_last);
+
+        /* set terminate bit to 1 for the last dTD */
+        dtd->dtd_next = DTD_NEXT_TERMINATE;
+
+        req->tail = dtd;
+
+        return 0;
+}
+
+static int mv_ep_enable(struct usb_ep *_ep,
+                const struct usb_endpoint_descriptor *desc)
+{
+        struct mv_udc *udc;
+        struct mv_ep *ep;
+        struct mv_dqh *dqh;
+        u16 max = 0;
+        u32 bit_pos, epctrlx, direction;
+        unsigned char zlt = 0, ios = 0, mult = 0;
+
+        ep = container_of(_ep, struct mv_ep, ep);
+        udc = ep->udc;
+
+        if (!_ep || !desc || ep->desc
+                        || desc->bDescriptorType != USB_DT_ENDPOINT)
+                return -EINVAL;
+
+        if (!udc->driver || udc->gadget.speed == USB_SPEED_UNKNOWN)
+                return -ESHUTDOWN;
+
+        direction = ep_dir(ep);
+        max = le16_to_cpu(desc->wMaxPacketSize);
+
+        /*
+         * disable HW zero length termination select
+         * driver handles zero length packet through req->req.zero
+         */
+        zlt = 1;
+
+        /* Get the endpoint queue head address */
+        dqh = (struct mv_dqh *)ep->dqh;
+
+        bit_pos = 1 << ((direction == EP_DIR_OUT ? 0 : 16) + ep->ep_num);
+
+        /* Check if the Endpoint is Primed */
+        if ((readl(&udc->op_regs->epprime) & bit_pos)
+                || (readl(&udc->op_regs->epstatus) & bit_pos)) {
+                dev_info(&udc->dev->dev,
+                        "ep=%d %s: Init ERROR: ENDPTPRIME=0x%x,"
+                        " ENDPTSTATUS=0x%x, bit_pos=0x%x\n",
+                        (unsigned)ep->ep_num, direction ? "SEND" : "RECV",
+                        (unsigned)readl(&udc->op_regs->epprime),
+                        (unsigned)readl(&udc->op_regs->epstatus),
+                        (unsigned)bit_pos);
+                goto en_done;
+        }
+        /* Set the max packet length, interrupt on Setup and Mult fields */
+        switch (desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
+        case USB_ENDPOINT_XFER_BULK:
+                zlt = 1;
+                mult = 0;
+                break;
+        case USB_ENDPOINT_XFER_CONTROL:
+                ios = 1;
+        case USB_ENDPOINT_XFER_INT:
+                mult = 0;
+                break;
+        case USB_ENDPOINT_XFER_ISOC:
+                /* Calculate transactions needed for high bandwidth iso */
+                mult = (unsigned char)(1 + ((max >> 11) & 0x03));
+                max = max & 0x8ff;      /* bit 0~10 */
+                /* 3 transactions at most */
+                if (mult > 3)
+                        goto en_done;
+                break;
+        default:
+                goto en_done;
+        }
+        dqh->max_packet_length = (max << EP_QUEUE_HEAD_MAX_PKT_LEN_POS)
+                | (mult << EP_QUEUE_HEAD_MULT_POS)
+                | (zlt ? EP_QUEUE_HEAD_ZLT_SEL : 0)
+                | (ios ? EP_QUEUE_HEAD_IOS : 0);
+        dqh->next_dtd_ptr = 1;
+        dqh->size_ioc_int_sts = 0;
+
+        ep->ep.maxpacket = max;
+        ep->desc = desc;
+        ep->stopped = 0;
+
+        /* Enable the endpoint for Rx or Tx and set the endpoint type */
+        epctrlx = readl(&udc->op_regs->epctrlx[ep->ep_num]);
+        if (direction == EP_DIR_IN) {
+                epctrlx &= ~EPCTRL_TX_ALL_MASK;
+                epctrlx |= EPCTRL_TX_ENABLE | EPCTRL_TX_DATA_TOGGLE_RST
+                        | ((desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
+                                << EPCTRL_TX_EP_TYPE_SHIFT);
+        } else {
+                epctrlx &= ~EPCTRL_RX_ALL_MASK;
+                epctrlx |= EPCTRL_RX_ENABLE | EPCTRL_RX_DATA_TOGGLE_RST
+                        | ((desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
+                                << EPCTRL_RX_EP_TYPE_SHIFT);
+        }
+        writel(epctrlx, &udc->op_regs->epctrlx[ep->ep_num]);
+
+        /*
+         * Implement Guideline (GL# USB-7) The unused endpoint type must
+         * be programmed to bulk.
+         */
+        epctrlx = readl(&udc->op_regs->epctrlx[ep->ep_num]);
+        if ((epctrlx & EPCTRL_RX_ENABLE) == 0) {
+                epctrlx |= ((desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
+                                << EPCTRL_RX_EP_TYPE_SHIFT);
+                writel(epctrlx, &udc->op_regs->epctrlx[ep->ep_num]);
+        }
+
+        epctrlx = readl(&udc->op_regs->epctrlx[ep->ep_num]);
+        if ((epctrlx & EPCTRL_TX_ENABLE) == 0) {
+                epctrlx |= ((desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
+                                << EPCTRL_TX_EP_TYPE_SHIFT);
+                writel(epctrlx, &udc->op_regs->epctrlx[ep->ep_num]);
+        }
+
+        return 0;
+en_done:
+        return -EINVAL;
+}
+
+static int  mv_ep_disable(struct usb_ep *_ep)
+{
+        struct mv_udc *udc;
+        struct mv_ep *ep;
+        struct mv_dqh *dqh;
+        u32 bit_pos, epctrlx, direction;
+
+        ep = container_of(_ep, struct mv_ep, ep);
+        if ((_ep == NULL) || !ep->desc)
+                return -EINVAL;
+
+        udc = ep->udc;
+
+        /* Get the endpoint queue head address */
+        dqh = ep->dqh;
+
+        direction = ep_dir(ep);
+        bit_pos = 1 << ((direction == EP_DIR_OUT ? 0 : 16) + ep->ep_num);
+
+        /* Reset the max packet length and the interrupt on Setup */
+        dqh->max_packet_length = 0;
+
+        /* Disable the endpoint for Rx or Tx and reset the endpoint type */
+        epctrlx = readl(&udc->op_regs->epctrlx[ep->ep_num]);
+        epctrlx &= ~((direction == EP_DIR_IN)
+                        ? (EPCTRL_TX_ENABLE | EPCTRL_TX_TYPE)
+                        : (EPCTRL_RX_ENABLE | EPCTRL_RX_TYPE));
+        writel(epctrlx, &udc->op_regs->epctrlx[ep->ep_num]);
+
+        /* nuke all pending requests (does flush) */
+        nuke(ep, -ESHUTDOWN);
+
+        ep->desc = NULL;
+        ep->stopped = 1;
+        return 0;
+}
+
+static struct usb_request *
+mv_alloc_request(struct usb_ep *_ep, gfp_t gfp_flags)
+{
+        struct mv_req *req = NULL;
+
+        req = kzalloc(sizeof *req, gfp_flags);
+        if (!req)
+                return NULL;
+
+        req->req.dma = DMA_ADDR_INVALID;
+        INIT_LIST_HEAD(&req->queue);
+
+        return &req->req;
+}
+
+static void mv_free_request(struct usb_ep *_ep, struct usb_request *_req)
+{
+        struct mv_req *req = NULL;
+
+        req = container_of(_req, struct mv_req, req);
+
+        if (_req)
+                kfree(req);
+}
+
+static void mv_ep_fifo_flush(struct usb_ep *_ep)
+{
+        struct mv_udc *udc;
+        u32 bit_pos, direction;
+        struct mv_ep *ep = container_of(_ep, struct mv_ep, ep);
+        unsigned int loops;
+
+        udc = ep->udc;
+        direction = ep_dir(ep);
+        bit_pos = 1 << ((direction == EP_DIR_OUT ? 0 : 16) + ep->ep_num);
+        /*
+         * Flushing will halt the pipe
+         * Write 1 to the Flush register
+         */
+        writel(bit_pos, &udc->op_regs->epflush);
+
+        /* Wait until flushing completed */
+        loops = LOOPS(FLUSH_TIMEOUT);
+        while (readl(&udc->op_regs->epflush) & bit_pos) {
+                /*
+                 * ENDPTFLUSH bit should be cleared to indicate this
+                 * operation is complete
+                 */
+                if (loops == 0) {
+                        dev_err(&udc->dev->dev,
+                                "TIMEOUT for ENDPTFLUSH=0x%x, bit_pos=0x%x\n",
+                                (unsigned)readl(&udc->op_regs->epflush),
+                                (unsigned)bit_pos);
+                        return;
+                }
+                loops--;
+                udelay(LOOPS_USEC);
+        }
+        loops = LOOPS(EPSTATUS_TIMEOUT);
+        while (readl(&udc->op_regs->epstatus) & bit_pos) {
+                unsigned int inter_loops;
+
+                if (loops == 0) {
+                        dev_err(&udc->dev->dev,
+                                "TIMEOUT for ENDPTSTATUS=0x%x, bit_pos=0x%x\n",
+                                (unsigned)readl(&udc->op_regs->epstatus),
+                                (unsigned)bit_pos);
+                        return;
+                }
+                /* Write 1 to the Flush register */
+                writel(bit_pos, &udc->op_regs->epflush);
+
+                /* Wait until flushing completed */
+                inter_loops = LOOPS(FLUSH_TIMEOUT);
+                while (readl(&udc->op_regs->epflush) & bit_pos) {
+                        /*
+                         * ENDPTFLUSH bit should be cleared to indicate this
+                         * operation is complete
+                         */
+                        if (inter_loops == 0) {
+                                dev_err(&udc->dev->dev,
+                                        "TIMEOUT for ENDPTFLUSH=0x%x,"
+                                        "bit_pos=0x%x\n",
+                                        (unsigned)readl(&udc->op_regs->epflush),
+                                        (unsigned)bit_pos);
+                                return;
+                        }
+                        inter_loops--;
+                        udelay(LOOPS_USEC);
+                }
+                loops--;
+        }
+}
+
+/* queues (submits) an I/O request to an endpoint */
+static int
+mv_ep_queue(struct usb_ep *_ep, struct usb_request *_req, gfp_t gfp_flags)
+{
+        struct mv_ep *ep = container_of(_ep, struct mv_ep, ep);
+        struct mv_req *req = container_of(_req, struct mv_req, req);
+        struct mv_udc *udc = ep->udc;
+        unsigned long flags;
+
+        /* catch various bogus parameters */
+        if (!_req || !req->req.complete || !req->req.buf
+                        || !list_empty(&req->queue)) {
+                dev_err(&udc->dev->dev, "%s, bad params", __func__);
+                return -EINVAL;
+        }
+        if (unlikely(!_ep || !ep->desc)) {
+                dev_err(&udc->dev->dev, "%s, bad ep", __func__);
+                return -EINVAL;
+        }
+        if (ep->desc->bmAttributes == USB_ENDPOINT_XFER_ISOC) {
+                if (req->req.length > ep->ep.maxpacket)
+                        return -EMSGSIZE;
+        }
+
+        udc = ep->udc;
+        if (!udc->driver || udc->gadget.speed == USB_SPEED_UNKNOWN)
+                return -ESHUTDOWN;
+
+        req->ep = ep;
+
+        /* map virtual address to hardware */
+        if (req->req.dma == DMA_ADDR_INVALID) {
+                req->req.dma = dma_map_single(ep->udc->gadget.dev.parent,
+                                        req->req.buf,
+                                        req->req.length, ep_dir(ep)
+                                                ? DMA_TO_DEVICE
+                                                : DMA_FROM_DEVICE);
+                req->mapped = 1;
+        } else {
+                dma_sync_single_for_device(ep->udc->gadget.dev.parent,
+                                        req->req.dma, req->req.length,
+                                        ep_dir(ep)
+                                                ? DMA_TO_DEVICE
+                                                : DMA_FROM_DEVICE);
+                req->mapped = 0;
+        }
+
+        req->req.status = -EINPROGRESS;
+        req->req.actual = 0;
+        req->dtd_count = 0;
+
+        spin_lock_irqsave(&udc->lock, flags);
+
+        /* build dtds and push them to device queue */
+        if (!req_to_dtd(req)) {
+                int retval;
+                retval = queue_dtd(ep, req);
+                if (retval) {
+                        spin_unlock_irqrestore(&udc->lock, flags);
+                        return retval;
+                }
+        } else {
+                spin_unlock_irqrestore(&udc->lock, flags);
+                return -ENOMEM;
+        }
+
+        /* Update ep0 state */
+        if (ep->ep_num == 0)
+                udc->ep0_state = DATA_STATE_XMIT;
+
+        /* irq handler advances the queue */
+        if (req != NULL)
+                list_add_tail(&req->queue, &ep->queue);
+        spin_unlock_irqrestore(&udc->lock, flags);
+
+        return 0;
+}
+
+/* dequeues (cancels, unlinks) an I/O request from an endpoint */
+static int mv_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
+{
+        struct mv_ep *ep = container_of(_ep, struct mv_ep, ep);
+        struct mv_req *req;
+        struct mv_udc *udc = ep->udc;
+        unsigned long flags;
+        int stopped, ret = 0;
+        u32 epctrlx;
+
+        if (!_ep || !_req)
+                return -EINVAL;
+
+        spin_lock_irqsave(&ep->udc->lock, flags);
+        stopped = ep->stopped;
+
+        /* Stop the ep before we deal with the queue */
+        ep->stopped = 1;
+        epctrlx = readl(&udc->op_regs->epctrlx[ep->ep_num]);
+        if (ep_dir(ep) == EP_DIR_IN)
+                epctrlx &= ~EPCTRL_TX_ENABLE;
+        else
+                epctrlx &= ~EPCTRL_RX_ENABLE;
+        writel(epctrlx, &udc->op_regs->epctrlx[ep->ep_num]);
+
+        /* make sure it's actually queued on this endpoint */
+        list_for_each_entry(req, &ep->queue, queue) {
+                if (&req->req == _req)
+                        break;
+        }
+        if (&req->req != _req) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        /* The request is in progress, or completed but not dequeued */
+        if (ep->queue.next == &req->queue) {
+                _req->status = -ECONNRESET;
+                mv_ep_fifo_flush(_ep);  /* flush current transfer */
+
+                /* The request isn't the last request in this ep queue */
+                if (req->queue.next != &ep->queue) {
+                        struct mv_dqh *qh;
+                        struct mv_req *next_req;
+
+                        qh = ep->dqh;
+                        next_req = list_entry(req->queue.next, struct mv_req,
+                                        queue);
+
+                        /* Point the QH to the first TD of next request */
+                        writel((u32) next_req->head, &qh->curr_dtd_ptr);
+                } else {
+                        struct mv_dqh *qh;
+
+                        qh = ep->dqh;
+                        qh->next_dtd_ptr = 1;
+                        qh->size_ioc_int_sts = 0;
+                }
+
+                /* The request hasn't been processed, patch up the TD chain */
+        } else {
+                struct mv_req *prev_req;
+
+                prev_req = list_entry(req->queue.prev, struct mv_req, queue);
+                writel(readl(&req->tail->dtd_next),
+                                &prev_req->tail->dtd_next);
+
+        }
+
+        done(ep, req, -ECONNRESET);
+
+        /* Enable EP */
+out:
+        epctrlx = readl(&udc->op_regs->epctrlx[ep->ep_num]);
+        if (ep_dir(ep) == EP_DIR_IN)
+                epctrlx |= EPCTRL_TX_ENABLE;
+        else
+                epctrlx |= EPCTRL_RX_ENABLE;
+        writel(epctrlx, &udc->op_regs->epctrlx[ep->ep_num]);
+        ep->stopped = stopped;
+
+        spin_unlock_irqrestore(&ep->udc->lock, flags);
+        return ret;
+}
+
+static void ep_set_stall(struct mv_udc *udc, u8 ep_num, u8 direction, int stall)
+{
+        u32 epctrlx;
+
+        epctrlx = readl(&udc->op_regs->epctrlx[ep_num]);
+
+        if (stall) {
+                if (direction == EP_DIR_IN)
+                        epctrlx |= EPCTRL_TX_EP_STALL;
+                else
+                        epctrlx |= EPCTRL_RX_EP_STALL;
+        } else {
+                if (direction == EP_DIR_IN) {
+                        epctrlx &= ~EPCTRL_TX_EP_STALL;
+                        epctrlx |= EPCTRL_TX_DATA_TOGGLE_RST;
+                } else {
+                        epctrlx &= ~EPCTRL_RX_EP_STALL;
+                        epctrlx |= EPCTRL_RX_DATA_TOGGLE_RST;
+                }
+        }
+        writel(epctrlx, &udc->op_regs->epctrlx[ep_num]);
+}
+
+static int ep_is_stall(struct mv_udc *udc, u8 ep_num, u8 direction)
+{
+        u32 epctrlx;
+
+        epctrlx = readl(&udc->op_regs->epctrlx[ep_num]);
+
+        if (direction == EP_DIR_OUT)
+                return (epctrlx & EPCTRL_RX_EP_STALL) ? 1 : 0;
+        else
+                return (epctrlx & EPCTRL_TX_EP_STALL) ? 1 : 0;
+}
+
+static int mv_ep_set_halt_wedge(struct usb_ep *_ep, int halt, int wedge)
+{
+        struct mv_ep *ep;
+        unsigned long flags = 0;
+        int status = 0;
+        struct mv_udc *udc;
+
+        ep = container_of(_ep, struct mv_ep, ep);
+        udc = ep->udc;
+        if (!_ep || !ep->desc) {
+                status = -EINVAL;
+                goto out;
+        }
+
+        if (ep->desc->bmAttributes == USB_ENDPOINT_XFER_ISOC) {
+                status = -EOPNOTSUPP;
+                goto out;
+        }
+
+        /*
+         * Attempt to halt IN ep will fail if any transfer requests
+         * are still queue
+         */
+        if (halt && (ep_dir(ep) == EP_DIR_IN) && !list_empty(&ep->queue)) {
+                status = -EAGAIN;
+                goto out;
+        }
+
+        spin_lock_irqsave(&ep->udc->lock, flags);
+        ep_set_stall(udc, ep->ep_num, ep_dir(ep), halt);
+        if (halt && wedge)
+                ep->wedge = 1;
+        else if (!halt)
+                ep->wedge = 0;
+        spin_unlock_irqrestore(&ep->udc->lock, flags);
+
+        if (ep->ep_num == 0) {
+                udc->ep0_state = WAIT_FOR_SETUP;
+                udc->ep0_dir = EP_DIR_OUT;
+        }
+out:
+        return status;
+}
+
+static int mv_ep_set_halt(struct usb_ep *_ep, int halt)
+{
+        return mv_ep_set_halt_wedge(_ep, halt, 0);
+}
+
+static int mv_ep_set_wedge(struct usb_ep *_ep)
+{
+        return mv_ep_set_halt_wedge(_ep, 1, 1);
+}
+
+static struct usb_ep_ops mv_ep_ops = {
+        .enable         = mv_ep_enable,
+        .disable        = mv_ep_disable,
+
+        .alloc_request  = mv_alloc_request,
+        .free_request   = mv_free_request,
+
+        .queue          = mv_ep_queue,
+        .dequeue        = mv_ep_dequeue,
+
+        .set_wedge      = mv_ep_set_wedge,
+        .set_halt       = mv_ep_set_halt,
+        .fifo_flush     = mv_ep_fifo_flush,     /* flush fifo */
+};
+
+static void udc_stop(struct mv_udc *udc)
+{
+        u32 tmp;
+
+        /* Disable interrupts */
+        tmp = readl(&udc->op_regs->usbintr);
+        tmp &= ~(USBINTR_INT_EN | USBINTR_ERR_INT_EN |
+                USBINTR_PORT_CHANGE_DETECT_EN | USBINTR_RESET_EN);
+        writel(tmp, &udc->op_regs->usbintr);
+
+        /* Reset the Run the bit in the command register to stop VUSB */
+        tmp = readl(&udc->op_regs->usbcmd);
+        tmp &= ~USBCMD_RUN_STOP;
+        writel(tmp, &udc->op_regs->usbcmd);
+}
+
+static void udc_start(struct mv_udc *udc)
+{
+        u32 usbintr;
+
+        usbintr = USBINTR_INT_EN | USBINTR_ERR_INT_EN
+                | USBINTR_PORT_CHANGE_DETECT_EN
+                | USBINTR_RESET_EN | USBINTR_DEVICE_SUSPEND;
+        /* Enable interrupts */
+        writel(usbintr, &udc->op_regs->usbintr);
+
+        /* Set the Run bit in the command register */
+        writel(USBCMD_RUN_STOP, &udc->op_regs->usbcmd);
+}
+
+static int udc_reset(struct mv_udc *udc)
+{
+        unsigned int loops;
+        u32 tmp, portsc;
+
+        /* Stop the controller */
+        tmp = readl(&udc->op_regs->usbcmd);
+        tmp &= ~USBCMD_RUN_STOP;
+        writel(tmp, &udc->op_regs->usbcmd);
+
+        /* Reset the controller to get default values */
+        writel(USBCMD_CTRL_RESET, &udc->op_regs->usbcmd);
+
+        /* wait for reset to complete */
+        loops = LOOPS(RESET_TIMEOUT);
+        while (readl(&udc->op_regs->usbcmd) & USBCMD_CTRL_RESET) {
+                if (loops == 0) {
+                        dev_err(&udc->dev->dev,
+                                "Wait for RESET completed TIMEOUT\n");
+                        return -ETIMEDOUT;
+                }
+                loops--;
+                udelay(LOOPS_USEC);
+        }
+
+        /* set controller to device mode */
+        tmp = readl(&udc->op_regs->usbmode);
+        tmp |= USBMODE_CTRL_MODE_DEVICE;
+
+        /* turn setup lockout off, require setup tripwire in usbcmd */
+        tmp |= USBMODE_SETUP_LOCK_OFF | USBMODE_STREAM_DISABLE;
+
+        writel(tmp, &udc->op_regs->usbmode);
+
+        writel(0x0, &udc->op_regs->epsetupstat);
+
+        /* Configure the Endpoint List Address */
+        writel(udc->ep_dqh_dma & USB_EP_LIST_ADDRESS_MASK,
+                &udc->op_regs->eplistaddr);
+
+        portsc = readl(&udc->op_regs->portsc[0]);
+        if (readl(&udc->cap_regs->hcsparams) & HCSPARAMS_PPC)
+                portsc &= (~PORTSCX_W1C_BITS | ~PORTSCX_PORT_POWER);
+
+        if (udc->force_fs)
+                portsc |= PORTSCX_FORCE_FULL_SPEED_CONNECT;
+        else
+                portsc &= (~PORTSCX_FORCE_FULL_SPEED_CONNECT);
+
+        writel(portsc, &udc->op_regs->portsc[0]);
+
+        tmp = readl(&udc->op_regs->epctrlx[0]);
+        tmp &= ~(EPCTRL_TX_EP_STALL | EPCTRL_RX_EP_STALL);
+        writel(tmp, &udc->op_regs->epctrlx[0]);
+
+        return 0;
+}
+
+static int mv_udc_get_frame(struct usb_gadget *gadget)
+{
+        struct mv_udc *udc;
+        u16     retval;
+
+        if (!gadget)
+                return -ENODEV;
+
+        udc = container_of(gadget, struct mv_udc, gadget);
+
+        retval = readl(udc->op_regs->frindex) & USB_FRINDEX_MASKS;
+
+        return retval;
+}
+
+/* Tries to wake up the host connected to this gadget */
+static int mv_udc_wakeup(struct usb_gadget *gadget)
+{
+        struct mv_udc *udc = container_of(gadget, struct mv_udc, gadget);
+        u32 portsc;
+
+        /* Remote wakeup feature not enabled by host */
+        if (!udc->remote_wakeup)
+                return -ENOTSUPP;
+
+        portsc = readl(&udc->op_regs->portsc);
+        /* not suspended? */
+        if (!(portsc & PORTSCX_PORT_SUSPEND))
+                return 0;
+        /* trigger force resume */
+        portsc |= PORTSCX_PORT_FORCE_RESUME;
+        writel(portsc, &udc->op_regs->portsc[0]);
+        return 0;
+}
+
+static int mv_udc_pullup(struct usb_gadget *gadget, int is_on)
+{
+        struct mv_udc *udc;
+        unsigned long flags;
+
+        udc = container_of(gadget, struct mv_udc, gadget);
+        spin_lock_irqsave(&udc->lock, flags);
+
+        udc->softconnect = (is_on != 0);
+        if (udc->driver && udc->softconnect)
+                udc_start(udc);
+        else
+                udc_stop(udc);
+
+        spin_unlock_irqrestore(&udc->lock, flags);
+        return 0;
+}
+
+/* device controller usb_gadget_ops structure */
+static const struct usb_gadget_ops mv_ops = {
+
+        /* returns the current frame number */
+        .get_frame      = mv_udc_get_frame,
+
+        /* tries to wake up the host connected to this gadget */
+        .wakeup         = mv_udc_wakeup,
+
+        /* D+ pullup, software-controlled connect/disconnect to USB host */
+        .pullup         = mv_udc_pullup,
+};
+
+static void mv_udc_testmode(struct mv_udc *udc, u16 index, bool enter)
+{
+        dev_info(&udc->dev->dev, "Test Mode is not support yet\n");
+}
+
+static int eps_init(struct mv_udc *udc)
+{
+        struct mv_ep    *ep;
+        char name[14];
+        int i;
+
+        /* initialize ep0 */
+        ep = &udc->eps[0];
+        ep->udc = udc;
+        strncpy(ep->name, "ep0", sizeof(ep->name));
+        ep->ep.name = ep->name;
+        ep->ep.ops = &mv_ep_ops;
+        ep->wedge = 0;
+        ep->stopped = 0;
+        ep->ep.maxpacket = EP0_MAX_PKT_SIZE;
+        ep->ep_num = 0;
+        ep->desc = &mv_ep0_desc;
+        INIT_LIST_HEAD(&ep->queue);
+
+        ep->ep_type = USB_ENDPOINT_XFER_CONTROL;
+
+        /* initialize other endpoints */
+        for (i = 2; i < udc->max_eps * 2; i++) {
+                ep = &udc->eps[i];
+                if (i % 2) {
+                        snprintf(name, sizeof(name), "ep%din", i / 2);
+                        ep->direction = EP_DIR_IN;
+                } else {
+                        snprintf(name, sizeof(name), "ep%dout", i / 2);
+                        ep->direction = EP_DIR_OUT;
+                }
+                ep->udc = udc;
+                strncpy(ep->name, name, sizeof(ep->name));
+                ep->ep.name = ep->name;
+
+                ep->ep.ops = &mv_ep_ops;
+                ep->stopped = 0;
+                ep->ep.maxpacket = (unsigned short) ~0;
+                ep->ep_num = i / 2;
+
+                INIT_LIST_HEAD(&ep->queue);
+                list_add_tail(&ep->ep.ep_list, &udc->gadget.ep_list);
+
+                ep->dqh = &udc->ep_dqh[i];
+        }
+
+        return 0;
+}
+
+/* delete all endpoint requests, called with spinlock held */
+static void nuke(struct mv_ep *ep, int status)
+{
+        /* called with spinlock held */
+        ep->stopped = 1;
+
+        /* endpoint fifo flush */
+        mv_ep_fifo_flush(&ep->ep);
+
+        while (!list_empty(&ep->queue)) {
+                struct mv_req *req = NULL;
+                req = list_entry(ep->queue.next, struct mv_req, queue);
+                done(ep, req, status);
+        }
+}
+
+/* stop all USB activities */
+static void stop_activity(struct mv_udc *udc, struct usb_gadget_driver *driver)
+{
+        struct mv_ep    *ep;
+
+        nuke(&udc->eps[0], -ESHUTDOWN);
+
+        list_for_each_entry(ep, &udc->gadget.ep_list, ep.ep_list) {
+                nuke(ep, -ESHUTDOWN);
+        }
+
+        /* report disconnect; the driver is already quiesced */
+        if (driver) {
+                spin_unlock(&udc->lock);
+                driver->disconnect(&udc->gadget);
+                spin_lock(&udc->lock);
+        }
+}
+
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
+{
+        struct mv_udc *udc = the_controller;
+        int retval = 0;
+        unsigned long flags;
+
+        if (!udc)
+                return -ENODEV;
+
+        if (udc->driver)
+                return -EBUSY;
+
+        spin_lock_irqsave(&udc->lock, flags);
+
+        /* hook up the driver ... */
+        driver->driver.bus = NULL;
+        udc->driver = driver;
+        udc->gadget.dev.driver = &driver->driver;
+
+        udc->usb_state = USB_STATE_ATTACHED;
+        udc->ep0_state = WAIT_FOR_SETUP;
+        udc->ep0_dir = USB_DIR_OUT;
+
+        spin_unlock_irqrestore(&udc->lock, flags);
+
+        retval = bind(&udc->gadget);
+        if (retval) {
+                dev_err(&udc->dev->dev, "bind to driver %s --> %d\n",
+                                driver->driver.name, retval);
+                udc->driver = NULL;
+                udc->gadget.dev.driver = NULL;
+                return retval;
+        }
+        udc_reset(udc);
+        ep0_reset(udc);
+        udc_start(udc);
+
+        return 0;
+}
+EXPORT_SYMBOL(usb_gadget_probe_driver);
+
+int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
+{
+        struct mv_udc *udc = the_controller;
+        unsigned long flags;
+
+        if (!udc)
+                return -ENODEV;
+
+        udc_stop(udc);
+
+        spin_lock_irqsave(&udc->lock, flags);
+
+        /* stop all usb activities */
+        udc->gadget.speed = USB_SPEED_UNKNOWN;
+        stop_activity(udc, driver);
+        spin_unlock_irqrestore(&udc->lock, flags);
+
+        /* unbind gadget driver */
+        driver->unbind(&udc->gadget);
+        udc->gadget.dev.driver = NULL;
+        udc->driver = NULL;
+
+        return 0;
+}
+EXPORT_SYMBOL(usb_gadget_unregister_driver);
+
+static int
+udc_prime_status(struct mv_udc *udc, u8 direction, u16 status, bool empty)
+{
+        int retval = 0;
+        struct mv_req *req;
+        struct mv_ep *ep;
+
+        ep = &udc->eps[0];
+        udc->ep0_dir = direction;
+
+        req = udc->status_req;
+
+        /* fill in the reqest structure */
+        if (empty == false) {
+                *((u16 *) req->req.buf) = cpu_to_le16(status);
+                req->req.length = 2;
+        } else
+                req->req.length = 0;
+
+        req->ep = ep;
+        req->req.status = -EINPROGRESS;
+        req->req.actual = 0;
+        req->req.complete = NULL;
+        req->dtd_count = 0;
+
+        /* prime the data phase */
+        if (!req_to_dtd(req))
+                retval = queue_dtd(ep, req);
+        else{   /* no mem */
+                retval = -ENOMEM;
+                goto out;
+        }
+
+        if (retval) {
+                dev_err(&udc->dev->dev, "response error on GET_STATUS request\n");
+                goto out;
+        }
+
+        list_add_tail(&req->queue, &ep->queue);
+
+        return 0;
+out:
+        return retval;
+}
+
+static void ch9setaddress(struct mv_udc *udc, struct usb_ctrlrequest *setup)
+{
+        udc->dev_addr = (u8)setup->wValue;
+
+        /* update usb state */
+        udc->usb_state = USB_STATE_ADDRESS;
+
+        if (udc_prime_status(udc, EP_DIR_IN, 0, true))
+                ep0_stall(udc);
+}
+
+static void ch9getstatus(struct mv_udc *udc, u8 ep_num,
+        struct usb_ctrlrequest *setup)
+{
+        u16 status;
+        int retval;
+
+        if ((setup->bRequestType & (USB_DIR_IN | USB_TYPE_MASK))
+                != (USB_DIR_IN | USB_TYPE_STANDARD))
+                return;
+
+        if ((setup->bRequestType & USB_RECIP_MASK) == USB_RECIP_DEVICE) {
+                status = 1 << USB_DEVICE_SELF_POWERED;
+                status |= udc->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP;
+        } else if ((setup->bRequestType & USB_RECIP_MASK)
+                        == USB_RECIP_INTERFACE) {
+                /* get interface status */
+                status = 0;
+        } else if ((setup->bRequestType & USB_RECIP_MASK)
+                        == USB_RECIP_ENDPOINT) {
+                u8 ep_num, direction;
+
+                ep_num = setup->wIndex & USB_ENDPOINT_NUMBER_MASK;
+                direction = (setup->wIndex & USB_ENDPOINT_DIR_MASK)
+                                ? EP_DIR_IN : EP_DIR_OUT;
+                status = ep_is_stall(udc, ep_num, direction)
+                                << USB_ENDPOINT_HALT;
+        }
+
+        retval = udc_prime_status(udc, EP_DIR_IN, status, false);
+        if (retval)
+                ep0_stall(udc);
+}
+
+static void ch9clearfeature(struct mv_udc *udc, struct usb_ctrlrequest *setup)
+{
+        u8 ep_num;
+        u8 direction;
+        struct mv_ep *ep;
+
+        if ((setup->bRequestType & (USB_TYPE_MASK | USB_RECIP_MASK))
+                == ((USB_TYPE_STANDARD | USB_RECIP_DEVICE))) {
+                switch (setup->wValue) {
+                case USB_DEVICE_REMOTE_WAKEUP:
+                        udc->remote_wakeup = 0;
+                        break;
+                case USB_DEVICE_TEST_MODE:
+                        mv_udc_testmode(udc, 0, false);
+                        break;
+                default:
+                        goto out;
+                }
+        } else if ((setup->bRequestType & (USB_TYPE_MASK | USB_RECIP_MASK))
+                == ((USB_TYPE_STANDARD | USB_RECIP_ENDPOINT))) {
+                switch (setup->wValue) {
+                case USB_ENDPOINT_HALT:
+                        ep_num = setup->wIndex & USB_ENDPOINT_NUMBER_MASK;
+                        direction = (setup->wIndex & USB_ENDPOINT_DIR_MASK)
+                                ? EP_DIR_IN : EP_DIR_OUT;
+                        if (setup->wValue != 0 || setup->wLength != 0
+                                || ep_num > udc->max_eps)
+                                goto out;
+                        ep = &udc->eps[ep_num * 2 + direction];
+                        if (ep->wedge == 1)
+                                break;
+                        spin_unlock(&udc->lock);
+                        ep_set_stall(udc, ep_num, direction, 0);
+                        spin_lock(&udc->lock);
+                        break;
+                default:
+                        goto out;
+                }
+        } else
+                goto out;
+
+        if (udc_prime_status(udc, EP_DIR_IN, 0, true))
+                ep0_stall(udc);
+        else
+                udc->ep0_state = DATA_STATE_XMIT;
+out:
+        return;
+}
+
+static void ch9setfeature(struct mv_udc *udc, struct usb_ctrlrequest *setup)
+{
+        u8 ep_num;
+        u8 direction;
+
+        if ((setup->bRequestType & (USB_TYPE_MASK | USB_RECIP_MASK))
+                == ((USB_TYPE_STANDARD | USB_RECIP_DEVICE))) {
+                switch (setup->wValue) {
+                case USB_DEVICE_REMOTE_WAKEUP:
+                        udc->remote_wakeup = 1;
+                        break;
+                case USB_DEVICE_TEST_MODE:
+                        if (setup->wIndex & 0xFF
+                                && udc->gadget.speed != USB_SPEED_HIGH)
+                                goto out;
+                        if (udc->usb_state == USB_STATE_CONFIGURED
+                                || udc->usb_state == USB_STATE_ADDRESS
+                                || udc->usb_state == USB_STATE_DEFAULT)
+                                mv_udc_testmode(udc,
+                                        setup->wIndex & 0xFF00, true);
+                        else
+                                goto out;
+                        break;
+                default:
+                        goto out;
+                }
+        } else if ((setup->bRequestType & (USB_TYPE_MASK | USB_RECIP_MASK))
+                == ((USB_TYPE_STANDARD | USB_RECIP_ENDPOINT))) {
+                switch (setup->wValue) {
+                case USB_ENDPOINT_HALT:
+                        ep_num = setup->wIndex & USB_ENDPOINT_NUMBER_MASK;
+                        direction = (setup->wIndex & USB_ENDPOINT_DIR_MASK)
+                                ? EP_DIR_IN : EP_DIR_OUT;
+                        if (setup->wValue != 0 || setup->wLength != 0
+                                || ep_num > udc->max_eps)
+                                goto out;
+                        spin_unlock(&udc->lock);
+                        ep_set_stall(udc, ep_num, direction, 1);
+                        spin_lock(&udc->lock);
+                        break;
+                default:
+                        goto out;
+                }
+        } else
+                goto out;
+
+        if (udc_prime_status(udc, EP_DIR_IN, 0, true))
+                ep0_stall(udc);
+out:
+        return;
+}
+
+static void handle_setup_packet(struct mv_udc *udc, u8 ep_num,
+        struct usb_ctrlrequest *setup)
+{
+        bool delegate = false;
+
+        nuke(&udc->eps[ep_num * 2 + EP_DIR_OUT], -ESHUTDOWN);
+
+        dev_dbg(&udc->dev->dev, "SETUP %02x.%02x v%04x i%04x l%04x\n",
+                        setup->bRequestType, setup->bRequest,
+                        setup->wValue, setup->wIndex, setup->wLength);
+        /* We process some stardard setup requests here */
+        if ((setup->bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD) {
+                switch (setup->bRequest) {
+                case USB_REQ_GET_STATUS:
+                        ch9getstatus(udc, ep_num, setup);
+                        break;
+
+                case USB_REQ_SET_ADDRESS:
+                        ch9setaddress(udc, setup);
+                        break;
+
+                case USB_REQ_CLEAR_FEATURE:
+                        ch9clearfeature(udc, setup);
+                        break;
+
+                case USB_REQ_SET_FEATURE:
+                        ch9setfeature(udc, setup);
+                        break;
+
+                default:
+                        delegate = true;
+                }
+        } else
+                delegate = true;
+
+        /* delegate USB standard requests to the gadget driver */
+        if (delegate == true) {
+                /* USB requests handled by gadget */
+                if (setup->wLength) {
+                        /* DATA phase from gadget, STATUS phase from udc */
+                        udc->ep0_dir = (setup->bRequestType & USB_DIR_IN)
+                                        ?  EP_DIR_IN : EP_DIR_OUT;
+                        spin_unlock(&udc->lock);
+                        if (udc->driver->setup(&udc->gadget,
+                                &udc->local_setup_buff) < 0)
+                                ep0_stall(udc);
+                        spin_lock(&udc->lock);
+                        udc->ep0_state = (setup->bRequestType & USB_DIR_IN)
+                                        ?  DATA_STATE_XMIT : DATA_STATE_RECV;
+                } else {
+                        /* no DATA phase, IN STATUS phase from gadget */
+                        udc->ep0_dir = EP_DIR_IN;
+                        spin_unlock(&udc->lock);
+                        if (udc->driver->setup(&udc->gadget,
+                                &udc->local_setup_buff) < 0)
+                                ep0_stall(udc);
+                        spin_lock(&udc->lock);
+                        udc->ep0_state = WAIT_FOR_OUT_STATUS;
+                }
+        }
+}
+
+/* complete DATA or STATUS phase of ep0 prime status phase if needed */
+static void ep0_req_complete(struct mv_udc *udc,
+        struct mv_ep *ep0, struct mv_req *req)
+{
+        u32 new_addr;
+
+        if (udc->usb_state == USB_STATE_ADDRESS) {
+                /* set the new address */
+                new_addr = (u32)udc->dev_addr;
+                writel(new_addr << USB_DEVICE_ADDRESS_BIT_SHIFT,
+                        &udc->op_regs->deviceaddr);
+        }
+
+        done(ep0, req, 0);
+
+        switch (udc->ep0_state) {
+        case DATA_STATE_XMIT:
+                /* receive status phase */
+                if (udc_prime_status(udc, EP_DIR_OUT, 0, true))
+                        ep0_stall(udc);
+                break;
+        case DATA_STATE_RECV:
+                /* send status phase */
+                if (udc_prime_status(udc, EP_DIR_IN, 0 , true))
+                        ep0_stall(udc);
+                break;
+        case WAIT_FOR_OUT_STATUS:
+                udc->ep0_state = WAIT_FOR_SETUP;
+                break;
+        case WAIT_FOR_SETUP:
+                dev_err(&udc->dev->dev, "unexpect ep0 packets\n");
+                break;
+        default:
+                ep0_stall(udc);
+                break;
+        }
+}
+
+static void get_setup_data(struct mv_udc *udc, u8 ep_num, u8 *buffer_ptr)
+{
+        u32 temp;
+        struct mv_dqh *dqh;
+
+        dqh = &udc->ep_dqh[ep_num * 2 + EP_DIR_OUT];
+
+        /* Clear bit in ENDPTSETUPSTAT */
+        temp = readl(&udc->op_regs->epsetupstat);
+        writel(temp | (1 << ep_num), &udc->op_regs->epsetupstat);
+
+        /* while a hazard exists when setup package arrives */
+        do {
+                /* Set Setup Tripwire */
+                temp = readl(&udc->op_regs->usbcmd);
+                writel(temp | USBCMD_SETUP_TRIPWIRE_SET, &udc->op_regs->usbcmd);
+
+                /* Copy the setup packet to local buffer */
+                memcpy(buffer_ptr, (u8 *) dqh->setup_buffer, 8);
+        } while (!(readl(&udc->op_regs->usbcmd) & USBCMD_SETUP_TRIPWIRE_SET));
+
+        /* Clear Setup Tripwire */
+        temp = readl(&udc->op_regs->usbcmd);
+        writel(temp & ~USBCMD_SETUP_TRIPWIRE_SET, &udc->op_regs->usbcmd);
+}
+
+static void irq_process_tr_complete(struct mv_udc *udc)
+{
+        u32 tmp, bit_pos;
+        int i, ep_num = 0, direction = 0;
+        struct mv_ep    *curr_ep;
+        struct mv_req *curr_req, *temp_req;
+        int status;
+
+        /*
+         * We use separate loops for ENDPTSETUPSTAT and ENDPTCOMPLETE
+         * because the setup packets are to be read ASAP
+         */
+
+        /* Process all Setup packet received interrupts */
+        tmp = readl(&udc->op_regs->epsetupstat);
+
+        if (tmp) {
+                for (i = 0; i < udc->max_eps; i++) {
+                        if (tmp & (1 << i)) {
+                                get_setup_data(udc, i,
+                                        (u8 *)(&udc->local_setup_buff));
+                                handle_setup_packet(udc, i,
+                                        &udc->local_setup_buff);
+                        }
+                }
+        }
+
+        /* Don't clear the endpoint setup status register here.
+         * It is cleared as a setup packet is read out of the buffer
+         */
+
+        /* Process non-setup transaction complete interrupts */
+        tmp = readl(&udc->op_regs->epcomplete);
+
+        if (!tmp)
+                return;
+
+        writel(tmp, &udc->op_regs->epcomplete);
+
+        for (i = 0; i < udc->max_eps * 2; i++) {
+                ep_num = i >> 1;
+                direction = i % 2;
+
+                bit_pos = 1 << (ep_num + 16 * direction);
+
+                if (!(bit_pos & tmp))
+                        continue;
+
+                if (i == 1)
+                        curr_ep = &udc->eps[0];
+                else
+                        curr_ep = &udc->eps[i];
+                /* process the req queue until an uncomplete request */
+                list_for_each_entry_safe(curr_req, temp_req,
+                        &curr_ep->queue, queue) {
+                        status = process_ep_req(udc, i, curr_req);
+                        if (status)
+                                break;
+
+                        /* write back status to req */
+                        curr_req->req.status = status;
+
+                        /* ep0 request completion */
+                        if (ep_num == 0) {
+                                ep0_req_complete(udc, curr_ep, curr_req);
+                                break;
+                        } else {
+                                done(curr_ep, curr_req, status);
+                        }
+                }
+        }
+}
+
+void irq_process_reset(struct mv_udc *udc)
+{
+        u32 tmp;
+        unsigned int loops;
+
+        udc->ep0_dir = EP_DIR_OUT;
+        udc->ep0_state = WAIT_FOR_SETUP;
+        udc->remote_wakeup = 0;         /* default to 0 on reset */
+
+        /* The address bits are past bit 25-31. Set the address */
+        tmp = readl(&udc->op_regs->deviceaddr);
+        tmp &= ~(USB_DEVICE_ADDRESS_MASK);
+        writel(tmp, &udc->op_regs->deviceaddr);
+
+        /* Clear all the setup token semaphores */
+        tmp = readl(&udc->op_regs->epsetupstat);
+        writel(tmp, &udc->op_regs->epsetupstat);
+
+        /* Clear all the endpoint complete status bits */
+        tmp = readl(&udc->op_regs->epcomplete);
+        writel(tmp, &udc->op_regs->epcomplete);
+
+        /* wait until all endptprime bits cleared */
+        loops = LOOPS(PRIME_TIMEOUT);
+        while (readl(&udc->op_regs->epprime) & 0xFFFFFFFF) {
+                if (loops == 0) {
+                        dev_err(&udc->dev->dev,
+                                "Timeout for ENDPTPRIME = 0x%x\n",
+                                readl(&udc->op_regs->epprime));
+                        break;
+                }
+                loops--;
+                udelay(LOOPS_USEC);
+        }
+
+        /* Write 1s to the Flush register */
+        writel((u32)~0, &udc->op_regs->epflush);
+
+        if (readl(&udc->op_regs->portsc[0]) & PORTSCX_PORT_RESET) {
+                dev_info(&udc->dev->dev, "usb bus reset\n");
+                udc->usb_state = USB_STATE_DEFAULT;
+                /* reset all the queues, stop all USB activities */
+                stop_activity(udc, udc->driver);
+        } else {
+                dev_info(&udc->dev->dev, "USB reset portsc 0x%x\n",
+                        readl(&udc->op_regs->portsc));
+
+                /*
+                 * re-initialize
+                 * controller reset
+                 */
+                udc_reset(udc);
+
+                /* reset all the queues, stop all USB activities */
+                stop_activity(udc, udc->driver);
+
+                /* reset ep0 dQH and endptctrl */
+                ep0_reset(udc);
+
+                /* enable interrupt and set controller to run state */
+                udc_start(udc);
+
+                udc->usb_state = USB_STATE_ATTACHED;
+        }
+}
+
+static void handle_bus_resume(struct mv_udc *udc)
+{
+        udc->usb_state = udc->resume_state;
+        udc->resume_state = 0;
+
+        /* report resume to the driver */
+        if (udc->driver) {
+                if (udc->driver->resume) {
+                        spin_unlock(&udc->lock);
+                        udc->driver->resume(&udc->gadget);
+                        spin_lock(&udc->lock);
+                }
+        }
+}
+
+static void irq_process_suspend(struct mv_udc *udc)
+{
+        udc->resume_state = udc->usb_state;
+        udc->usb_state = USB_STATE_SUSPENDED;
+
+        if (udc->driver->suspend) {
+                spin_unlock(&udc->lock);
+                udc->driver->suspend(&udc->gadget);
+                spin_lock(&udc->lock);
+        }
+}
+
+static void irq_process_port_change(struct mv_udc *udc)
+{
+        u32 portsc;
+
+        portsc = readl(&udc->op_regs->portsc[0]);
+        if (!(portsc & PORTSCX_PORT_RESET)) {
+                /* Get the speed */
+                u32 speed = portsc & PORTSCX_PORT_SPEED_MASK;
+                switch (speed) {
+                case PORTSCX_PORT_SPEED_HIGH:
+                        udc->gadget.speed = USB_SPEED_HIGH;
+                        break;
+                case PORTSCX_PORT_SPEED_FULL:
+                        udc->gadget.speed = USB_SPEED_FULL;
+                        break;
+                case PORTSCX_PORT_SPEED_LOW:
+                        udc->gadget.speed = USB_SPEED_LOW;
+                        break;
+                default:
+                        udc->gadget.speed = USB_SPEED_UNKNOWN;
+                        break;
+                }
+        }
+
+        if (portsc & PORTSCX_PORT_SUSPEND) {
+                udc->resume_state = udc->usb_state;
+                udc->usb_state = USB_STATE_SUSPENDED;
+                if (udc->driver->suspend) {
+                        spin_unlock(&udc->lock);
+                        udc->driver->suspend(&udc->gadget);
+                        spin_lock(&udc->lock);
+                }
+        }
+
+        if (!(portsc & PORTSCX_PORT_SUSPEND)
+                && udc->usb_state == USB_STATE_SUSPENDED) {
+                handle_bus_resume(udc);
+        }
+
+        if (!udc->resume_state)
+                udc->usb_state = USB_STATE_DEFAULT;
+}
+
+static void irq_process_error(struct mv_udc *udc)
+{
+        /* Increment the error count */
+        udc->errors++;
+}
+
+static irqreturn_t mv_udc_irq(int irq, void *dev)
+{
+        struct mv_udc *udc = (struct mv_udc *)dev;
+        u32 status, intr;
+
+        spin_lock(&udc->lock);
+
+        status = readl(&udc->op_regs->usbsts);
+        intr = readl(&udc->op_regs->usbintr);
+        status &= intr;
+
+        if (status == 0) {
+                spin_unlock(&udc->lock);
+                return IRQ_NONE;
+        }
+
+        /* Clear all the interrupts occurred */
+        writel(status, &udc->op_regs->usbsts);
+
+        if (status & USBSTS_ERR)
+                irq_process_error(udc);
+
+        if (status & USBSTS_RESET)
+                irq_process_reset(udc);
+
+        if (status & USBSTS_PORT_CHANGE)
+                irq_process_port_change(udc);
+
+        if (status & USBSTS_INT)
+                irq_process_tr_complete(udc);
+
+        if (status & USBSTS_SUSPEND)
+                irq_process_suspend(udc);
+
+        spin_unlock(&udc->lock);
+
+        return IRQ_HANDLED;
+}
+
+/* release device structure */
+static void gadget_release(struct device *_dev)
+{
+        struct mv_udc *udc = the_controller;
+
+        complete(udc->done);
+        kfree(udc);
+}
+
+static int mv_udc_remove(struct platform_device *dev)
+{
+        struct mv_udc *udc = the_controller;
+
+        DECLARE_COMPLETION(done);
+
+        udc->done = &done;
+
+        /* free memory allocated in probe */
+        if (udc->dtd_pool)
+                dma_pool_destroy(udc->dtd_pool);
+
+        if (udc->ep_dqh)
+                dma_free_coherent(&dev->dev, udc->ep_dqh_size,
+                        udc->ep_dqh, udc->ep_dqh_dma);
+
+        kfree(udc->eps);
+
+        if (udc->irq)
+                free_irq(udc->irq, &dev->dev);
+
+        if (udc->cap_regs)
+                iounmap(udc->cap_regs);
+        udc->cap_regs = NULL;
+
+        if (udc->phy_regs)
+                iounmap((void *)udc->phy_regs);
+        udc->phy_regs = 0;
+
+        if (udc->status_req) {
+                kfree(udc->status_req->req.buf);
+                kfree(udc->status_req);
+        }
+
+        device_unregister(&udc->gadget.dev);
+
+        /* free dev, wait for the release() finished */
+        wait_for_completion(&done);
+
+        the_controller = NULL;
+
+        return 0;
+}
+
+int mv_udc_probe(struct platform_device *dev)
+{
+        struct mv_udc *udc;
+        int retval = 0;
+        struct resource *r;
+        size_t size;
+
+        udc = kzalloc(sizeof *udc, GFP_KERNEL);
+        if (udc == NULL) {
+                dev_err(&dev->dev, "failed to allocate memory for udc\n");
+                retval = -ENOMEM;
+                goto error;
+        }
+
+        spin_lock_init(&udc->lock);
+
+        udc->dev = dev;
+
+        udc->clk = clk_get(&dev->dev, "U2OCLK");
+        if (IS_ERR(udc->clk)) {
+                retval = PTR_ERR(udc->clk);
+                goto error;
+        }
+
+        r = platform_get_resource_byname(udc->dev, IORESOURCE_MEM, "u2o");
+        if (r == NULL) {
+                dev_err(&dev->dev, "no I/O memory resource defined\n");
+                retval = -ENODEV;
+                goto error;
+        }
+
+        udc->cap_regs = (struct mv_cap_regs __iomem *)
+                ioremap(r->start, resource_size(r));
+        if (udc->cap_regs == NULL) {
+                dev_err(&dev->dev, "failed to map I/O memory\n");
+                retval = -EBUSY;
+                goto error;
+        }
+
+        r = platform_get_resource_byname(udc->dev, IORESOURCE_MEM, "u2ophy");
+        if (r == NULL) {
+                dev_err(&dev->dev, "no phy I/O memory resource defined\n");
+                retval = -ENODEV;
+                goto error;
+        }
+
+        udc->phy_regs = (unsigned int)ioremap(r->start, resource_size(r));
+        if (udc->phy_regs == 0) {
+                dev_err(&dev->dev, "failed to map phy I/O memory\n");
+                retval = -EBUSY;
+                goto error;
+        }
+
+        /* we will acces controller register, so enable the clk */
+        clk_enable(udc->clk);
+        retval = mv_udc_phy_init(udc->phy_regs);
+        if (retval) {
+                dev_err(&dev->dev, "phy initialization error %d\n", retval);
+                goto error;
+        }
+
+        udc->op_regs = (struct mv_op_regs __iomem *)((u32)udc->cap_regs
+                + (readl(&udc->cap_regs->caplength_hciversion)
+                        & CAPLENGTH_MASK));
+        udc->max_eps = readl(&udc->cap_regs->dccparams) & DCCPARAMS_DEN_MASK;
+
+        size = udc->max_eps * sizeof(struct mv_dqh) *2;
+        size = (size + DQH_ALIGNMENT - 1) & ~(DQH_ALIGNMENT - 1);
+        udc->ep_dqh = dma_alloc_coherent(&dev->dev, size,
+                                        &udc->ep_dqh_dma, GFP_KERNEL);
+
+        if (udc->ep_dqh == NULL) {
+                dev_err(&dev->dev, "allocate dQH memory failed\n");
+                retval = -ENOMEM;
+                goto error;
+        }
+        udc->ep_dqh_size = size;
+
+        /* create dTD dma_pool resource */
+        udc->dtd_pool = dma_pool_create("mv_dtd",
+                        &dev->dev,
+                        sizeof(struct mv_dtd),
+                        DTD_ALIGNMENT,
+                        DMA_BOUNDARY);
+
+        if (!udc->dtd_pool) {
+                retval = -ENOMEM;
+                goto error;
+        }
+
+        size = udc->max_eps * sizeof(struct mv_ep) *2;
+        udc->eps = kzalloc(size, GFP_KERNEL);
+        if (udc->eps == NULL) {
+                dev_err(&dev->dev, "allocate ep memory failed\n");
+                retval = -ENOMEM;
+                goto error;
+        }
+
+        /* initialize ep0 status request structure */
+        udc->status_req = kzalloc(sizeof(struct mv_req), GFP_KERNEL);
+        if (!udc->status_req) {
+                dev_err(&dev->dev, "allocate status_req memory failed\n");
+                retval = -ENOMEM;
+                goto error;
+        }
+        INIT_LIST_HEAD(&udc->status_req->queue);
+
+        /* allocate a small amount of memory to get valid address */
+        udc->status_req->req.buf = kzalloc(8, GFP_KERNEL);
+        udc->status_req->req.dma = virt_to_phys(udc->status_req->req.buf);
+
+        udc->resume_state = USB_STATE_NOTATTACHED;
+        udc->usb_state = USB_STATE_POWERED;
+        udc->ep0_dir = EP_DIR_OUT;
+        udc->remote_wakeup = 0;
+
+        r = platform_get_resource(udc->dev, IORESOURCE_IRQ, 0);
+        if (r == NULL) {
+                dev_err(&dev->dev, "no IRQ resource defined\n");
+                retval = -ENODEV;
+                goto error;
+        }
+        udc->irq = r->start;
+        if (request_irq(udc->irq, mv_udc_irq,
+                IRQF_DISABLED | IRQF_SHARED, driver_name, udc)) {
+                dev_err(&dev->dev, "Request irq %d for UDC failed\n",
+                        udc->irq);
+                retval = -ENODEV;
+                goto error;
+        }
+
+        /* initialize gadget structure */
+        udc->gadget.ops = &mv_ops;      /* usb_gadget_ops */
+        udc->gadget.ep0 = &udc->eps[0].ep;      /* gadget ep0 */
+        INIT_LIST_HEAD(&udc->gadget.ep_list);   /* ep_list */
+        udc->gadget.speed = USB_SPEED_UNKNOWN;  /* speed */
+        udc->gadget.is_dualspeed = 1;           /* support dual speed */
+
+        /* the "gadget" abstracts/virtualizes the controller */
+        dev_set_name(&udc->gadget.dev, "gadget");
+        udc->gadget.dev.parent = &dev->dev;
+        udc->gadget.dev.dma_mask = dev->dev.dma_mask;
+        udc->gadget.dev.release = gadget_release;
+        udc->gadget.name = driver_name;         /* gadget name */
+
+        retval = device_register(&udc->gadget.dev);
+        if (retval)
+                goto error;
+
+        eps_init(udc);
+
+        the_controller = udc;
+
+        goto out;
+error:
+        if (udc)
+                mv_udc_remove(udc->dev);
+out:
+        return retval;
+}
+
+#ifdef CONFIG_PM
+static int mv_udc_suspend(struct device *_dev)
+{
+        struct mv_udc *udc = the_controller;
+
+        udc_stop(udc);
+
+        return 0;
+}
+
+static int mv_udc_resume(struct device *_dev)
+{
+        struct mv_udc *udc = the_controller;
+        int retval;
+
+        retval = mv_udc_phy_init(udc->phy_regs);
+        if (retval) {
+                dev_err(_dev, "phy initialization error %d\n", retval);
+                return retval;
+        }
+        udc_reset(udc);
+        ep0_reset(udc);
+        udc_start(udc);
+
+        return 0;
+}
+
+static const struct dev_pm_ops mv_udc_pm_ops = {
+        .suspend        = mv_udc_suspend,
+        .resume         = mv_udc_resume,
+};
+#endif
+
+static struct platform_driver udc_driver = {
+        .probe          = mv_udc_probe,
+        .remove         = __exit_p(mv_udc_remove),
+        .driver         = {
+                .owner  = THIS_MODULE,
+                .name   = "pxa-u2o",
+#ifdef CONFIG_PM
+                .pm     = &mv_udc_pm_ops,
+#endif
+        },
+};
+
+
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_AUTHOR("Chao Xie <chao.xie@marvell.com>");
+MODULE_VERSION(DRIVER_VERSION);
+MODULE_LICENSE("GPL");
+
+
+static int __init init(void)
+{
+        return platform_driver_register(&udc_driver);
+}
+module_init(init);
+
+
+static void __exit cleanup(void)
+{
+        platform_driver_unregister(&udc_driver);
+}
+module_exit(cleanup);
+
diff --git a/drivers/usb/gadget/mv_udc_phy.c b/drivers/usb/gadget/mv_udc_phy.c
new file mode 100644
index 000000000000..d4dea97e38a5
--- /dev/null
+++ b/drivers/usb/gadget/mv_udc_phy.c
@@ -0,0 +1,214 @@
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/io.h>
+#include <linux/errno.h>
+
+#include <mach/cputype.h>
+
+#ifdef CONFIG_ARCH_MMP
+
+#define UTMI_REVISION           0x0
+#define UTMI_CTRL               0x4
+#define UTMI_PLL                0x8
+#define UTMI_TX                 0xc
+#define UTMI_RX                 0x10
+#define UTMI_IVREF              0x14
+#define UTMI_T0                 0x18
+#define UTMI_T1                 0x1c
+#define UTMI_T2                 0x20
+#define UTMI_T3                 0x24
+#define UTMI_T4                 0x28
+#define UTMI_T5                 0x2c
+#define UTMI_RESERVE            0x30
+#define UTMI_USB_INT            0x34
+#define UTMI_DBG_CTL            0x38
+#define UTMI_OTG_ADDON          0x3c
+
+/* For UTMICTRL Register */
+#define UTMI_CTRL_USB_CLK_EN                    (1 << 31)
+/* pxa168 */
+#define UTMI_CTRL_SUSPEND_SET1                  (1 << 30)
+#define UTMI_CTRL_SUSPEND_SET2                  (1 << 29)
+#define UTMI_CTRL_RXBUF_PDWN                    (1 << 24)
+#define UTMI_CTRL_TXBUF_PDWN                    (1 << 11)
+
+#define UTMI_CTRL_INPKT_DELAY_SHIFT             30
+#define UTMI_CTRL_INPKT_DELAY_SOF_SHIFT         28
+#define UTMI_CTRL_PU_REF_SHIFT                  20
+#define UTMI_CTRL_ARC_PULLDN_SHIFT              12
+#define UTMI_CTRL_PLL_PWR_UP_SHIFT              1
+#define UTMI_CTRL_PWR_UP_SHIFT                  0
+/* For UTMI_PLL Register */
+#define UTMI_PLL_CLK_BLK_EN_SHIFT               24
+#define UTMI_PLL_FBDIV_SHIFT                    4
+#define UTMI_PLL_REFDIV_SHIFT                   0
+#define UTMI_PLL_FBDIV_MASK                     0x00000FF0
+#define UTMI_PLL_REFDIV_MASK                    0x0000000F
+#define UTMI_PLL_ICP_MASK                       0x00007000
+#define UTMI_PLL_KVCO_MASK                      0x00031000
+#define UTMI_PLL_PLLCALI12_SHIFT                29
+#define UTMI_PLL_PLLCALI12_MASK                 (0x3 << 29)
+#define UTMI_PLL_PLLVDD18_SHIFT                 27
+#define UTMI_PLL_PLLVDD18_MASK                  (0x3 << 27)
+#define UTMI_PLL_PLLVDD12_SHIFT                 25
+#define UTMI_PLL_PLLVDD12_MASK                  (0x3 << 25)
+#define UTMI_PLL_KVCO_SHIFT                     15
+#define UTMI_PLL_ICP_SHIFT                      12
+/* For UTMI_TX Register */
+#define UTMI_TX_REG_EXT_FS_RCAL_SHIFT           27
+#define UTMI_TX_REG_EXT_FS_RCAL_MASK            (0xf << 27)
+#define UTMI_TX_REG_EXT_FS_RCAL_EN_MASK         26
+#define UTMI_TX_REG_EXT_FS_RCAL_EN              (0x1 << 26)
+#define UTMI_TX_LOW_VDD_EN_SHIFT                11
+#define UTMI_TX_IMPCAL_VTH_SHIFT                14
+#define UTMI_TX_IMPCAL_VTH_MASK                 (0x7 << 14)
+#define UTMI_TX_CK60_PHSEL_SHIFT                17
+#define UTMI_TX_CK60_PHSEL_MASK                 (0xf << 17)
+#define UTMI_TX_TXVDD12_SHIFT                   22
+#define UTMI_TX_TXVDD12_MASK                    (0x3 << 22)
+#define UTMI_TX_AMP_SHIFT                       0
+#define UTMI_TX_AMP_MASK                        (0x7 << 0)
+/* For UTMI_RX Register */
+#define UTMI_RX_SQ_THRESH_SHIFT                 4
+#define UTMI_RX_SQ_THRESH_MASK                  (0xf << 4)
+#define UTMI_REG_SQ_LENGTH_SHIFT                15
+#define UTMI_REG_SQ_LENGTH_MASK                 (0x3 << 15)
+
+#define REG_RCAL_START                          0x00001000
+#define VCOCAL_START                            0x00200000
+#define KVCO_EXT                                0x00400000
+#define PLL_READY                               0x00800000
+#define CLK_BLK_EN                              0x01000000
+#endif
+
+static unsigned int u2o_read(unsigned int base, unsigned int offset)
+{
+        return readl(base + offset);
+}
+
+static void u2o_set(unsigned int base, unsigned int offset, unsigned int value)
+{
+        unsigned int reg;
+
+        reg = readl(base + offset);
+        reg |= value;
+        writel(reg, base + offset);
+        readl(base + offset);
+}
+
+static void u2o_clear(unsigned int base, unsigned int offset,
+        unsigned int value)
+{
+        unsigned int reg;
+
+        reg = readl(base + offset);
+        reg &= ~value;
+        writel(reg, base + offset);
+        readl(base + offset);
+}
+
+static void u2o_write(unsigned int base, unsigned int offset,
+        unsigned int value)
+{
+        writel(value, base + offset);
+        readl(base + offset);
+}
+
+#ifdef CONFIG_ARCH_MMP
+int mv_udc_phy_init(unsigned int base)
+{
+        unsigned long timeout;
+
+        /* Initialize the USB PHY power */
+        if (cpu_is_pxa910()) {
+                u2o_set(base, UTMI_CTRL, (1 << UTMI_CTRL_INPKT_DELAY_SOF_SHIFT)
+                        | (1 << UTMI_CTRL_PU_REF_SHIFT));
+        }
+
+        u2o_set(base, UTMI_CTRL, 1 << UTMI_CTRL_PLL_PWR_UP_SHIFT);
+        u2o_set(base, UTMI_CTRL, 1 << UTMI_CTRL_PWR_UP_SHIFT);
+
+        /* UTMI_PLL settings */
+        u2o_clear(base, UTMI_PLL, UTMI_PLL_PLLVDD18_MASK
+                | UTMI_PLL_PLLVDD12_MASK | UTMI_PLL_PLLCALI12_MASK
+                | UTMI_PLL_FBDIV_MASK | UTMI_PLL_REFDIV_MASK
+                | UTMI_PLL_ICP_MASK | UTMI_PLL_KVCO_MASK);
+
+        u2o_set(base, UTMI_PLL, (0xee << UTMI_PLL_FBDIV_SHIFT)
+                | (0xb << UTMI_PLL_REFDIV_SHIFT)
+                | (3 << UTMI_PLL_PLLVDD18_SHIFT)
+                | (3 << UTMI_PLL_PLLVDD12_SHIFT)
+                | (3 << UTMI_PLL_PLLCALI12_SHIFT)
+                | (1 << UTMI_PLL_ICP_SHIFT) | (3 << UTMI_PLL_KVCO_SHIFT));
+
+        /* UTMI_TX */
+        u2o_clear(base, UTMI_TX, UTMI_TX_REG_EXT_FS_RCAL_EN_MASK
+                | UTMI_TX_TXVDD12_MASK
+                | UTMI_TX_CK60_PHSEL_MASK | UTMI_TX_IMPCAL_VTH_MASK
+                | UTMI_TX_REG_EXT_FS_RCAL_MASK | UTMI_TX_AMP_MASK);
+        u2o_set(base, UTMI_TX, (3 << UTMI_TX_TXVDD12_SHIFT)
+                | (4 << UTMI_TX_CK60_PHSEL_SHIFT)
+                | (4 << UTMI_TX_IMPCAL_VTH_SHIFT)
+                | (8 << UTMI_TX_REG_EXT_FS_RCAL_SHIFT)
+                | (3 << UTMI_TX_AMP_SHIFT));
+
+        /* UTMI_RX */
+        u2o_clear(base, UTMI_RX, UTMI_RX_SQ_THRESH_MASK
+                | UTMI_REG_SQ_LENGTH_MASK);
+        if (cpu_is_pxa168())
+                u2o_set(base, UTMI_RX, (7 << UTMI_RX_SQ_THRESH_SHIFT)
+                        | (2 << UTMI_REG_SQ_LENGTH_SHIFT));
+        else
+                u2o_set(base, UTMI_RX, (0x7 << UTMI_RX_SQ_THRESH_SHIFT)
+                        | (2 << UTMI_REG_SQ_LENGTH_SHIFT));
+
+        /* UTMI_IVREF */
+        if (cpu_is_pxa168())
+                /*
+                 * fixing Microsoft Altair board interface with NEC hub issue -
+                 * Set UTMI_IVREF from 0x4a3 to 0x4bf
+                 */
+                u2o_write(base, UTMI_IVREF, 0x4bf);
+
+        /* calibrate */
+        timeout = jiffies + 100;
+        while ((u2o_read(base, UTMI_PLL) & PLL_READY) == 0) {
+                if (time_after(jiffies, timeout))
+                        return -ETIME;
+                cpu_relax();
+        }
+
+        /* toggle VCOCAL_START bit of UTMI_PLL */
+        udelay(200);
+        u2o_set(base, UTMI_PLL, VCOCAL_START);
+        udelay(40);
+        u2o_clear(base, UTMI_PLL, VCOCAL_START);
+
+        /* toggle REG_RCAL_START bit of UTMI_TX */
+        udelay(200);
+        u2o_set(base, UTMI_TX, REG_RCAL_START);
+        udelay(40);
+        u2o_clear(base, UTMI_TX, REG_RCAL_START);
+        udelay(200);
+
+        /* make sure phy is ready */
+        timeout = jiffies + 100;
+        while ((u2o_read(base, UTMI_PLL) & PLL_READY) == 0) {
+                if (time_after(jiffies, timeout))
+                        return -ETIME;
+                cpu_relax();
+        }
+
+        if (cpu_is_pxa168()) {
+                u2o_set(base, UTMI_RESERVE, 1 << 5);
+                /* Turn on UTMI PHY OTG extension */
+                u2o_write(base, UTMI_OTG_ADDON, 1);
+        }
+        return 0;
+}
+#else
+int mv_udc_phy_init(unsigned int base)
+{
+        return 0;
+}
+#endif
diff --git a/drivers/usb/gadget/ncm.c b/drivers/usb/gadget/ncm.c
new file mode 100644
index 000000000000..99c179ad729d
--- /dev/null
+++ b/drivers/usb/gadget/ncm.c
@@ -0,0 +1,248 @@
+/*
+ * ncm.c -- NCM gadget driver
+ *
+ * Copyright (C) 2010 Nokia Corporation
+ * Contact: Yauheni Kaliuta <yauheni.kaliuta@nokia.com>
+ *
+ * The driver borrows from ether.c which is:
+ *
+ * Copyright (C) 2003-2005,2008 David Brownell
+ * Copyright (C) 2003-2004 Robert Schwebel, Benedikt Spranger
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+/* #define DEBUG */
+/* #define VERBOSE_DEBUG */
+
+#include <linux/kernel.h>
+#include <linux/utsname.h>
+
+
+#include "u_ether.h"
+
+#define DRIVER_DESC             "NCM Gadget"
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * Kbuild is not very cooperative with respect to linking separately
+ * compiled library objects into one module.  So for now we won't use
+ * separate compilation ... ensuring init/exit sections work to shrink
+ * the runtime footprint, and giving us at least some parts of what
+ * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
+ */
+#include "composite.c"
+#include "usbstring.c"
+#include "config.c"
+#include "epautoconf.c"
+
+#include "f_ncm.c"
+#include "u_ether.c"
+
+/*-------------------------------------------------------------------------*/
+
+/* DO NOT REUSE THESE IDs with a protocol-incompatible driver!!  Ever!!
+ * Instead:  allocate your own, using normal USB-IF procedures.
+ */
+
+/* Thanks to NetChip Technologies for donating this product ID.
+ * It's for devices with only CDC Ethernet configurations.
+ */
+#define CDC_VENDOR_NUM          0x0525  /* NetChip */
+#define CDC_PRODUCT_NUM         0xa4a1  /* Linux-USB Ethernet Gadget */
+
+/*-------------------------------------------------------------------------*/
+
+static struct usb_device_descriptor device_desc = {
+        .bLength =              sizeof device_desc,
+        .bDescriptorType =      USB_DT_DEVICE,
+
+        .bcdUSB =               cpu_to_le16 (0x0200),
+
+        .bDeviceClass =         USB_CLASS_COMM,
+        .bDeviceSubClass =      0,
+        .bDeviceProtocol =      0,
+        /* .bMaxPacketSize0 = f(hardware) */
+
+        /* Vendor and product id defaults change according to what configs
+         * we support.  (As does bNumConfigurations.)  These values can
+         * also be overridden by module parameters.
+         */
+        .idVendor =             cpu_to_le16 (CDC_VENDOR_NUM),
+        .idProduct =            cpu_to_le16 (CDC_PRODUCT_NUM),
+        /* .bcdDevice = f(hardware) */
+        /* .iManufacturer = DYNAMIC */
+        /* .iProduct = DYNAMIC */
+        /* NO SERIAL NUMBER */
+        .bNumConfigurations =   1,
+};
+
+static struct usb_otg_descriptor otg_descriptor = {
+        .bLength =              sizeof otg_descriptor,
+        .bDescriptorType =      USB_DT_OTG,
+
+        /* REVISIT SRP-only hardware is possible, although
+         * it would not be called "OTG" ...
+         */
+        .bmAttributes =         USB_OTG_SRP | USB_OTG_HNP,
+};
+
+static const struct usb_descriptor_header *otg_desc[] = {
+        (struct usb_descriptor_header *) &otg_descriptor,
+        NULL,
+};
+
+
+/* string IDs are assigned dynamically */
+
+#define STRING_MANUFACTURER_IDX         0
+#define STRING_PRODUCT_IDX              1
+
+static char manufacturer[50];
+
+static struct usb_string strings_dev[] = {
+        [STRING_MANUFACTURER_IDX].s = manufacturer,
+        [STRING_PRODUCT_IDX].s = DRIVER_DESC,
+        {  } /* end of list */
+};
+
+static struct usb_gadget_strings stringtab_dev = {
+        .language       = 0x0409,       /* en-us */
+        .strings        = strings_dev,
+};
+
+static struct usb_gadget_strings *dev_strings[] = {
+        &stringtab_dev,
+        NULL,
+};
+
+static u8 hostaddr[ETH_ALEN];
+
+/*-------------------------------------------------------------------------*/
+
+static int __init ncm_do_config(struct usb_configuration *c)
+{
+        /* FIXME alloc iConfiguration string, set it in c->strings */
+
+        if (gadget_is_otg(c->cdev->gadget)) {
+                c->descriptors = otg_desc;
+                c->bmAttributes |= USB_CONFIG_ATT_WAKEUP;
+        }
+
+        return ncm_bind_config(c, hostaddr);
+}
+
+static struct usb_configuration ncm_config_driver = {
+        /* .label = f(hardware) */
+        .label                  = "CDC Ethernet (NCM)",
+        .bConfigurationValue    = 1,
+        /* .iConfiguration = DYNAMIC */
+        .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
+};
+
+/*-------------------------------------------------------------------------*/
+
+static int __init gncm_bind(struct usb_composite_dev *cdev)
+{
+        int                     gcnum;
+        struct usb_gadget       *gadget = cdev->gadget;
+        int                     status;
+
+        /* set up network link layer */
+        status = gether_setup(cdev->gadget, hostaddr);
+        if (status < 0)
+                return status;
+
+        gcnum = usb_gadget_controller_number(gadget);
+        if (gcnum >= 0)
+                device_desc.bcdDevice = cpu_to_le16(0x0300 | gcnum);
+        else {
+                /* We assume that can_support_ecm() tells the truth;
+                 * but if the controller isn't recognized at all then
+                 * that assumption is a bit more likely to be wrong.
+                 */
+                dev_warn(&gadget->dev,
+                         "controller '%s' not recognized; trying %s\n",
+                         gadget->name,
+                         ncm_config_driver.label);
+                device_desc.bcdDevice =
+                        cpu_to_le16(0x0300 | 0x0099);
+        }
+
+
+        /* Allocate string descriptor numbers ... note that string
+         * contents can be overridden by the composite_dev glue.
+         */
+
+        /* device descriptor strings: manufacturer, product */
+        snprintf(manufacturer, sizeof manufacturer, "%s %s with %s",
+                init_utsname()->sysname, init_utsname()->release,
+                gadget->name);
+        status = usb_string_id(cdev);
+        if (status < 0)
+                goto fail;
+        strings_dev[STRING_MANUFACTURER_IDX].id = status;
+        device_desc.iManufacturer = status;
+
+        status = usb_string_id(cdev);
+        if (status < 0)
+                goto fail;
+        strings_dev[STRING_PRODUCT_IDX].id = status;
+        device_desc.iProduct = status;
+
+        status = usb_add_config(cdev, &ncm_config_driver,
+                                ncm_do_config);
+        if (status < 0)
+                goto fail;
+
+        dev_info(&gadget->dev, "%s\n", DRIVER_DESC);
+
+        return 0;
+
+fail:
+        gether_cleanup();
+        return status;
+}
+
+static int __exit gncm_unbind(struct usb_composite_dev *cdev)
+{
+        gether_cleanup();
+        return 0;
+}
+
+static struct usb_composite_driver ncm_driver = {
+        .name           = "g_ncm",
+        .dev            = &device_desc,
+        .strings        = dev_strings,
+        .unbind         = __exit_p(gncm_unbind),
+};
+
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_AUTHOR("Yauheni Kaliuta");
+MODULE_LICENSE("GPL");
+
+static int __init init(void)
+{
+        return usb_composite_probe(&ncm_driver, gncm_bind);
+}
+module_init(init);
+
+static void __exit cleanup(void)
+{
+        usb_composite_unregister(&ncm_driver);
+}
+module_exit(cleanup);
diff --git a/drivers/usb/gadget/net2280.c b/drivers/usb/gadget/net2280.c
index 9498be87a724..476d88e1ae97 100644
--- a/drivers/usb/gadget/net2280.c
+++ b/drivers/usb/gadget/net2280.c
@@ -63,6 +63,7 @@
 #include <linux/device.h>
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
+#include <linux/prefetch.h>
 
 #include <asm/byteorder.h>
 #include <asm/io.h>
@@ -117,7 +118,7 @@ module_param (fifo_mode, ushort, 0644);
 
 /* enable_suspend -- When enabled, the driver will respond to
  * USB suspend requests by powering down the NET2280.  Otherwise,
- * USB suspend requests will be ignored.  This is acceptible for
+ * USB suspend requests will be ignored.  This is acceptable for
  * self-powered devices
  */
 static int enable_suspend = 0;
@@ -1929,7 +1930,8 @@ static void ep0_start (struct net2280 *dev)
  * disconnect is reported.  then a host may connect again, or
  * the driver might get unbound.
  */
-int usb_gadget_register_driver (struct usb_gadget_driver *driver)
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
 {
         struct net2280          *dev = the_controller;
         int                     retval;
@@ -1941,8 +1943,7 @@ int usb_gadget_register_driver (struct usb_gadget_driver *driver)
          */
         if (!driver
                         || driver->speed != USB_SPEED_HIGH
-                        || !driver->bind
-                        || !driver->setup)
+                        || !bind || !driver->setup)
                 return -EINVAL;
         if (!dev)
                 return -ENODEV;
@@ -1957,7 +1958,7 @@ int usb_gadget_register_driver (struct usb_gadget_driver *driver)
         driver->driver.bus = NULL;
         dev->driver = driver;
         dev->gadget.dev.driver = &driver->driver;
-        retval = driver->bind (&dev->gadget);
+        retval = bind(&dev->gadget);
         if (retval) {
                 DEBUG (dev, "bind to driver %s --> %d\n",
                                 driver->driver.name, retval);
@@ -1993,7 +1994,7 @@ err_unbind:
         dev->driver = NULL;
         return retval;
 }
-EXPORT_SYMBOL (usb_gadget_register_driver);
+EXPORT_SYMBOL(usb_gadget_probe_driver);
 
 static void
 stop_activity (struct net2280 *dev, struct usb_gadget_driver *driver)
diff --git a/drivers/usb/gadget/nokia.c b/drivers/usb/gadget/nokia.c
index 7d6b66a85724..55ca63ad3506 100644
--- a/drivers/usb/gadget/nokia.c
+++ b/drivers/usb/gadget/nokia.c
@@ -135,7 +135,6 @@ static int __init nokia_bind_config(struct usb_configuration *c)
 
 static struct usb_configuration nokia_config_500ma_driver = {
         .label          = "Bus Powered",
-        .bind           = nokia_bind_config,
         .bConfigurationValue = 1,
         /* .iConfiguration = DYNAMIC */
         .bmAttributes   = USB_CONFIG_ATT_ONE,
@@ -144,7 +143,6 @@ static struct usb_configuration nokia_config_500ma_driver = {
 
 static struct usb_configuration nokia_config_100ma_driver = {
         .label          = "Self Powered",
-        .bind           = nokia_bind_config,
         .bConfigurationValue = 2,
         /* .iConfiguration = DYNAMIC */
         .bmAttributes   = USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
@@ -205,12 +203,14 @@ static int __init nokia_bind(struct usb_composite_dev *cdev)
                 goto err_usb;
         }
 
-        /* finaly register the configuration */
-        status = usb_add_config(cdev, &nokia_config_500ma_driver);
+        /* finally register the configuration */
+        status = usb_add_config(cdev, &nokia_config_500ma_driver,
+                        nokia_bind_config);
         if (status < 0)
                 goto err_usb;
 
-        status = usb_add_config(cdev, &nokia_config_100ma_driver);
+        status = usb_add_config(cdev, &nokia_config_100ma_driver,
+                        nokia_bind_config);
         if (status < 0)
                 goto err_usb;
 
@@ -241,13 +241,12 @@ static struct usb_composite_driver nokia_driver = {
         .name           = "g_nokia",
         .dev            = &device_desc,
         .strings        = dev_strings,
-        .bind           = nokia_bind,
         .unbind         = __exit_p(nokia_unbind),
 };
 
 static int __init nokia_init(void)
 {
-        return usb_composite_register(&nokia_driver);
+        return usb_composite_probe(&nokia_driver, nokia_bind);
 }
 module_init(nokia_init);
 
diff --git a/drivers/usb/gadget/omap_udc.c b/drivers/usb/gadget/omap_udc.c
index f81e4f025f23..82fd24935332 100644
--- a/drivers/usb/gadget/omap_udc.c
+++ b/drivers/usb/gadget/omap_udc.c
@@ -44,6 +44,7 @@
 #include <linux/usb/otg.h>
 #include <linux/dma-mapping.h>
 #include <linux/clk.h>
+#include <linux/prefetch.h>
 
 #include <asm/byteorder.h>
 #include <asm/io.h>
@@ -54,7 +55,6 @@
 
 #include <plat/dma.h>
 #include <plat/usb.h>
-#include <plat/control.h>
 
 #include "omap_udc.h"
 
@@ -2102,7 +2102,8 @@ static inline int machine_without_vbus_sense(void)
                 );
 }
 
-int usb_gadget_register_driver (struct usb_gadget_driver *driver)
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
 {
         int             status = -ENODEV;
         struct omap_ep  *ep;
@@ -2114,8 +2115,7 @@ int usb_gadget_register_driver (struct usb_gadget_driver *driver)
         if (!driver
                         // FIXME if otg, check:  driver->is_otg
                         || driver->speed < USB_SPEED_FULL
-                        || !driver->bind
-                        || !driver->setup)
+                        || !bind || !driver->setup)
                 return -EINVAL;
 
         spin_lock_irqsave(&udc->lock, flags);
@@ -2145,7 +2145,7 @@ int usb_gadget_register_driver (struct usb_gadget_driver *driver)
         if (udc->dc_clk != NULL)
                 omap_udc_enable_clock(1);
 
-        status = driver->bind (&udc->gadget);
+        status = bind(&udc->gadget);
         if (status) {
                 DBG("bind to %s --> %d\n", driver->driver.name, status);
                 udc->gadget.dev.driver = NULL;
@@ -2186,7 +2186,7 @@ done:
                 omap_udc_enable_clock(0);
         return status;
 }
-EXPORT_SYMBOL(usb_gadget_register_driver);
+EXPORT_SYMBOL(usb_gadget_probe_driver);
 
 int usb_gadget_unregister_driver (struct usb_gadget_driver *driver)
 {
@@ -2309,21 +2309,12 @@ static char *trx_mode(unsigned m, int enabled)
 static int proc_otg_show(struct seq_file *s)
 {
         u32             tmp;
-        u32             trans;
-        char            *ctrl_name;
+        u32             trans = 0;
+        char            *ctrl_name = "(UNKNOWN)";
 
+        /* XXX This needs major revision for OMAP2+ */
         tmp = omap_readl(OTG_REV);
-        if (cpu_is_omap24xx()) {
-                /*
-                 * REVISIT: Not clear how this works on OMAP2.  trans
-                 * is ANDed to produce bits 7 and 8, which might make
-                 * sense for USB_TRANSCEIVER_CTRL on OMAP1,
-                 * but with CONTROL_DEVCONF, these bits have something to
-                 * do with the frame adjustment counter and McBSP2.
-                 */
-                ctrl_name = "control_devconf";
-                trans = omap_ctrl_readl(OMAP2_CONTROL_DEVCONF0);
-        } else {
+        if (cpu_class_is_omap1()) {
                 ctrl_name = "tranceiver_ctrl";
                 trans = omap_readw(USB_TRANSCEIVER_CTRL);
         }
diff --git a/drivers/usb/gadget/pch_udc.c b/drivers/usb/gadget/pch_udc.c
new file mode 100644
index 000000000000..68dbcc3e4cc2
--- /dev/null
+++ b/drivers/usb/gadget/pch_udc.c
@@ -0,0 +1,3004 @@
+/*
+ * Copyright (C) 2010 OKI SEMICONDUCTOR CO., LTD.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
+ */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/delay.h>
+#include <linux/errno.h>
+#include <linux/list.h>
+#include <linux/interrupt.h>
+#include <linux/usb/ch9.h>
+#include <linux/usb/gadget.h>
+
+/* Address offset of Registers */
+#define UDC_EP_REG_SHIFT        0x20    /* Offset to next EP */
+
+#define UDC_EPCTL_ADDR          0x00    /* Endpoint control */
+#define UDC_EPSTS_ADDR          0x04    /* Endpoint status */
+#define UDC_BUFIN_FRAMENUM_ADDR 0x08    /* buffer size in / frame number out */
+#define UDC_BUFOUT_MAXPKT_ADDR  0x0C    /* buffer size out / maxpkt in */
+#define UDC_SUBPTR_ADDR         0x10    /* setup buffer pointer */
+#define UDC_DESPTR_ADDR         0x14    /* Data descriptor pointer */
+#define UDC_CONFIRM_ADDR        0x18    /* Write/Read confirmation */
+
+#define UDC_DEVCFG_ADDR         0x400   /* Device configuration */
+#define UDC_DEVCTL_ADDR         0x404   /* Device control */
+#define UDC_DEVSTS_ADDR         0x408   /* Device status */
+#define UDC_DEVIRQSTS_ADDR      0x40C   /* Device irq status */
+#define UDC_DEVIRQMSK_ADDR      0x410   /* Device irq mask */
+#define UDC_EPIRQSTS_ADDR       0x414   /* Endpoint irq status */
+#define UDC_EPIRQMSK_ADDR       0x418   /* Endpoint irq mask */
+#define UDC_DEVLPM_ADDR         0x41C   /* LPM control / status */
+#define UDC_CSR_BUSY_ADDR       0x4f0   /* UDC_CSR_BUSY Status register */
+#define UDC_SRST_ADDR           0x4fc   /* SOFT RESET register */
+#define UDC_CSR_ADDR            0x500   /* USB_DEVICE endpoint register */
+
+/* Endpoint control register */
+/* Bit position */
+#define UDC_EPCTL_MRXFLUSH              (1 << 12)
+#define UDC_EPCTL_RRDY                  (1 << 9)
+#define UDC_EPCTL_CNAK                  (1 << 8)
+#define UDC_EPCTL_SNAK                  (1 << 7)
+#define UDC_EPCTL_NAK                   (1 << 6)
+#define UDC_EPCTL_P                     (1 << 3)
+#define UDC_EPCTL_F                     (1 << 1)
+#define UDC_EPCTL_S                     (1 << 0)
+#define UDC_EPCTL_ET_SHIFT              4
+/* Mask patern */
+#define UDC_EPCTL_ET_MASK               0x00000030
+/* Value for ET field */
+#define UDC_EPCTL_ET_CONTROL            0
+#define UDC_EPCTL_ET_ISO                1
+#define UDC_EPCTL_ET_BULK               2
+#define UDC_EPCTL_ET_INTERRUPT          3
+
+/* Endpoint status register */
+/* Bit position */
+#define UDC_EPSTS_XFERDONE              (1 << 27)
+#define UDC_EPSTS_RSS                   (1 << 26)
+#define UDC_EPSTS_RCS                   (1 << 25)
+#define UDC_EPSTS_TXEMPTY               (1 << 24)
+#define UDC_EPSTS_TDC                   (1 << 10)
+#define UDC_EPSTS_HE                    (1 << 9)
+#define UDC_EPSTS_MRXFIFO_EMP           (1 << 8)
+#define UDC_EPSTS_BNA                   (1 << 7)
+#define UDC_EPSTS_IN                    (1 << 6)
+#define UDC_EPSTS_OUT_SHIFT             4
+/* Mask patern */
+#define UDC_EPSTS_OUT_MASK              0x00000030
+#define UDC_EPSTS_ALL_CLR_MASK          0x1F0006F0
+/* Value for OUT field */
+#define UDC_EPSTS_OUT_SETUP             2
+#define UDC_EPSTS_OUT_DATA              1
+
+/* Device configuration register */
+/* Bit position */
+#define UDC_DEVCFG_CSR_PRG              (1 << 17)
+#define UDC_DEVCFG_SP                   (1 << 3)
+/* SPD Valee */
+#define UDC_DEVCFG_SPD_HS               0x0
+#define UDC_DEVCFG_SPD_FS               0x1
+#define UDC_DEVCFG_SPD_LS               0x2
+
+/* Device control register */
+/* Bit position */
+#define UDC_DEVCTL_THLEN_SHIFT          24
+#define UDC_DEVCTL_BRLEN_SHIFT          16
+#define UDC_DEVCTL_CSR_DONE             (1 << 13)
+#define UDC_DEVCTL_SD                   (1 << 10)
+#define UDC_DEVCTL_MODE                 (1 << 9)
+#define UDC_DEVCTL_BREN                 (1 << 8)
+#define UDC_DEVCTL_THE                  (1 << 7)
+#define UDC_DEVCTL_DU                   (1 << 4)
+#define UDC_DEVCTL_TDE                  (1 << 3)
+#define UDC_DEVCTL_RDE                  (1 << 2)
+#define UDC_DEVCTL_RES                  (1 << 0)
+
+/* Device status register */
+/* Bit position */
+#define UDC_DEVSTS_TS_SHIFT             18
+#define UDC_DEVSTS_ENUM_SPEED_SHIFT     13
+#define UDC_DEVSTS_ALT_SHIFT            8
+#define UDC_DEVSTS_INTF_SHIFT           4
+#define UDC_DEVSTS_CFG_SHIFT            0
+/* Mask patern */
+#define UDC_DEVSTS_TS_MASK              0xfffc0000
+#define UDC_DEVSTS_ENUM_SPEED_MASK      0x00006000
+#define UDC_DEVSTS_ALT_MASK             0x00000f00
+#define UDC_DEVSTS_INTF_MASK            0x000000f0
+#define UDC_DEVSTS_CFG_MASK             0x0000000f
+/* value for maximum speed for SPEED field */
+#define UDC_DEVSTS_ENUM_SPEED_FULL      1
+#define UDC_DEVSTS_ENUM_SPEED_HIGH      0
+#define UDC_DEVSTS_ENUM_SPEED_LOW       2
+#define UDC_DEVSTS_ENUM_SPEED_FULLX     3
+
+/* Device irq register */
+/* Bit position */
+#define UDC_DEVINT_RWKP                 (1 << 7)
+#define UDC_DEVINT_ENUM                 (1 << 6)
+#define UDC_DEVINT_SOF                  (1 << 5)
+#define UDC_DEVINT_US                   (1 << 4)
+#define UDC_DEVINT_UR                   (1 << 3)
+#define UDC_DEVINT_ES                   (1 << 2)
+#define UDC_DEVINT_SI                   (1 << 1)
+#define UDC_DEVINT_SC                   (1 << 0)
+/* Mask patern */
+#define UDC_DEVINT_MSK                  0x7f
+
+/* Endpoint irq register */
+/* Bit position */
+#define UDC_EPINT_IN_SHIFT              0
+#define UDC_EPINT_OUT_SHIFT             16
+#define UDC_EPINT_IN_EP0                (1 << 0)
+#define UDC_EPINT_OUT_EP0               (1 << 16)
+/* Mask patern */
+#define UDC_EPINT_MSK_DISABLE_ALL       0xffffffff
+
+/* UDC_CSR_BUSY Status register */
+/* Bit position */
+#define UDC_CSR_BUSY                    (1 << 0)
+
+/* SOFT RESET register */
+/* Bit position */
+#define UDC_PSRST                       (1 << 1)
+#define UDC_SRST                        (1 << 0)
+
+/* USB_DEVICE endpoint register */
+/* Bit position */
+#define UDC_CSR_NE_NUM_SHIFT            0
+#define UDC_CSR_NE_DIR_SHIFT            4
+#define UDC_CSR_NE_TYPE_SHIFT           5
+#define UDC_CSR_NE_CFG_SHIFT            7
+#define UDC_CSR_NE_INTF_SHIFT           11
+#define UDC_CSR_NE_ALT_SHIFT            15
+#define UDC_CSR_NE_MAX_PKT_SHIFT        19
+/* Mask patern */
+#define UDC_CSR_NE_NUM_MASK             0x0000000f
+#define UDC_CSR_NE_DIR_MASK             0x00000010
+#define UDC_CSR_NE_TYPE_MASK            0x00000060
+#define UDC_CSR_NE_CFG_MASK             0x00000780
+#define UDC_CSR_NE_INTF_MASK            0x00007800
+#define UDC_CSR_NE_ALT_MASK             0x00078000
+#define UDC_CSR_NE_MAX_PKT_MASK         0x3ff80000
+
+#define PCH_UDC_CSR(ep) (UDC_CSR_ADDR + ep*4)
+#define PCH_UDC_EPINT(in, num)\
+                (1 << (num + (in ? UDC_EPINT_IN_SHIFT : UDC_EPINT_OUT_SHIFT)))
+
+/* Index of endpoint */
+#define UDC_EP0IN_IDX           0
+#define UDC_EP0OUT_IDX          1
+#define UDC_EPIN_IDX(ep)        (ep * 2)
+#define UDC_EPOUT_IDX(ep)       (ep * 2 + 1)
+#define PCH_UDC_EP0             0
+#define PCH_UDC_EP1             1
+#define PCH_UDC_EP2             2
+#define PCH_UDC_EP3             3
+
+/* Number of endpoint */
+#define PCH_UDC_EP_NUM          32      /* Total number of EPs (16 IN,16 OUT) */
+#define PCH_UDC_USED_EP_NUM     4       /* EP number of EP's really used */
+/* Length Value */
+#define PCH_UDC_BRLEN           0x0F    /* Burst length */
+#define PCH_UDC_THLEN           0x1F    /* Threshold length */
+/* Value of EP Buffer Size */
+#define UDC_EP0IN_BUFF_SIZE     16
+#define UDC_EPIN_BUFF_SIZE      256
+#define UDC_EP0OUT_BUFF_SIZE    16
+#define UDC_EPOUT_BUFF_SIZE     256
+/* Value of EP maximum packet size */
+#define UDC_EP0IN_MAX_PKT_SIZE  64
+#define UDC_EP0OUT_MAX_PKT_SIZE 64
+#define UDC_BULK_MAX_PKT_SIZE   512
+
+/* DMA */
+#define DMA_DIR_RX              1       /* DMA for data receive */
+#define DMA_DIR_TX              2       /* DMA for data transmit */
+#define DMA_ADDR_INVALID        (~(dma_addr_t)0)
+#define UDC_DMA_MAXPACKET       65536   /* maximum packet size for DMA */
+
+/**
+ * struct pch_udc_data_dma_desc - Structure to hold DMA descriptor information
+ *                                for data
+ * @status:             Status quadlet
+ * @reserved:           Reserved
+ * @dataptr:            Buffer descriptor
+ * @next:               Next descriptor
+ */
+struct pch_udc_data_dma_desc {
+        u32 status;
+        u32 reserved;
+        u32 dataptr;
+        u32 next;
+};
+
+/**
+ * struct pch_udc_stp_dma_desc - Structure to hold DMA descriptor information
+ *                               for control data
+ * @status:     Status
+ * @reserved:   Reserved
+ * @data12:     First setup word
+ * @data34:     Second setup word
+ */
+struct pch_udc_stp_dma_desc {
+        u32 status;
+        u32 reserved;
+        struct usb_ctrlrequest request;
+} __attribute((packed));
+
+/* DMA status definitions */
+/* Buffer status */
+#define PCH_UDC_BUFF_STS        0xC0000000
+#define PCH_UDC_BS_HST_RDY      0x00000000
+#define PCH_UDC_BS_DMA_BSY      0x40000000
+#define PCH_UDC_BS_DMA_DONE     0x80000000
+#define PCH_UDC_BS_HST_BSY      0xC0000000
+/*  Rx/Tx Status */
+#define PCH_UDC_RXTX_STS        0x30000000
+#define PCH_UDC_RTS_SUCC        0x00000000
+#define PCH_UDC_RTS_DESERR      0x10000000
+#define PCH_UDC_RTS_BUFERR      0x30000000
+/* Last Descriptor Indication */
+#define PCH_UDC_DMA_LAST        0x08000000
+/* Number of Rx/Tx Bytes Mask */
+#define PCH_UDC_RXTX_BYTES      0x0000ffff
+
+/**
+ * struct pch_udc_cfg_data - Structure to hold current configuration
+ *                           and interface information
+ * @cur_cfg:    current configuration in use
+ * @cur_intf:   current interface in use
+ * @cur_alt:    current alt interface in use
+ */
+struct pch_udc_cfg_data {
+        u16 cur_cfg;
+        u16 cur_intf;
+        u16 cur_alt;
+};
+
+/**
+ * struct pch_udc_ep - Structure holding a PCH USB device Endpoint information
+ * @ep:                 embedded ep request
+ * @td_stp_phys:        for setup request
+ * @td_data_phys:       for data request
+ * @td_stp:             for setup request
+ * @td_data:            for data request
+ * @dev:                reference to device struct
+ * @offset_addr:        offset address of ep register
+ * @desc:               for this ep
+ * @queue:              queue for requests
+ * @num:                endpoint number
+ * @in:                 endpoint is IN
+ * @halted:             endpoint halted?
+ * @epsts:              Endpoint status
+ */
+struct pch_udc_ep {
+        struct usb_ep                   ep;
+        dma_addr_t                      td_stp_phys;
+        dma_addr_t                      td_data_phys;
+        struct pch_udc_stp_dma_desc     *td_stp;
+        struct pch_udc_data_dma_desc    *td_data;
+        struct pch_udc_dev              *dev;
+        unsigned long                   offset_addr;
+        const struct usb_endpoint_descriptor    *desc;
+        struct list_head                queue;
+        unsigned                        num:5,
+                                        in:1,
+                                        halted:1;
+        unsigned long                   epsts;
+};
+
+/**
+ * struct pch_udc_dev - Structure holding complete information
+ *                      of the PCH USB device
+ * @gadget:             gadget driver data
+ * @driver:             reference to gadget driver bound
+ * @pdev:               reference to the PCI device
+ * @ep:                 array of endpoints
+ * @lock:               protects all state
+ * @active:             enabled the PCI device
+ * @stall:              stall requested
+ * @prot_stall:         protcol stall requested
+ * @irq_registered:     irq registered with system
+ * @mem_region:         device memory mapped
+ * @registered:         driver regsitered with system
+ * @suspended:          driver in suspended state
+ * @connected:          gadget driver associated
+ * @set_cfg_not_acked:  pending acknowledgement 4 setup
+ * @waiting_zlp_ack:    pending acknowledgement 4 ZLP
+ * @data_requests:      DMA pool for data requests
+ * @stp_requests:       DMA pool for setup requests
+ * @dma_addr:           DMA pool for received
+ * @ep0out_buf:         Buffer for DMA
+ * @setup_data:         Received setup data
+ * @phys_addr:          of device memory
+ * @base_addr:          for mapped device memory
+ * @irq:                IRQ line for the device
+ * @cfg_data:           current cfg, intf, and alt in use
+ */
+struct pch_udc_dev {
+        struct usb_gadget               gadget;
+        struct usb_gadget_driver        *driver;
+        struct pci_dev                  *pdev;
+        struct pch_udc_ep               ep[PCH_UDC_EP_NUM];
+        spinlock_t                      lock; /* protects all state */
+        unsigned        active:1,
+                        stall:1,
+                        prot_stall:1,
+                        irq_registered:1,
+                        mem_region:1,
+                        registered:1,
+                        suspended:1,
+                        connected:1,
+                        set_cfg_not_acked:1,
+                        waiting_zlp_ack:1;
+        struct pci_pool         *data_requests;
+        struct pci_pool         *stp_requests;
+        dma_addr_t                      dma_addr;
+        void                            *ep0out_buf;
+        struct usb_ctrlrequest          setup_data;
+        unsigned long                   phys_addr;
+        void __iomem                    *base_addr;
+        unsigned                        irq;
+        struct pch_udc_cfg_data cfg_data;
+};
+
+#define PCH_UDC_PCI_BAR                 1
+#define PCI_DEVICE_ID_INTEL_EG20T_UDC   0x8808
+#define PCI_VENDOR_ID_ROHM              0x10DB
+#define PCI_DEVICE_ID_ML7213_IOH_UDC    0x801D
+
+static const char       ep0_string[] = "ep0in";
+static DEFINE_SPINLOCK(udc_stall_spinlock);     /* stall spin lock */
+struct pch_udc_dev *pch_udc;            /* pointer to device object */
+static int speed_fs;
+module_param_named(speed_fs, speed_fs, bool, S_IRUGO);
+MODULE_PARM_DESC(speed_fs, "true for Full speed operation");
+
+/**
+ * struct pch_udc_request - Structure holding a PCH USB device request packet
+ * @req:                embedded ep request
+ * @td_data_phys:       phys. address
+ * @td_data:            first dma desc. of chain
+ * @td_data_last:       last dma desc. of chain
+ * @queue:              associated queue
+ * @dma_going:          DMA in progress for request
+ * @dma_mapped:         DMA memory mapped for request
+ * @dma_done:           DMA completed for request
+ * @chain_len:          chain length
+ * @buf:                Buffer memory for align adjustment
+ * @dma:                DMA memory for align adjustment
+ */
+struct pch_udc_request {
+        struct usb_request              req;
+        dma_addr_t                      td_data_phys;
+        struct pch_udc_data_dma_desc    *td_data;
+        struct pch_udc_data_dma_desc    *td_data_last;
+        struct list_head                queue;
+        unsigned                        dma_going:1,
+                                        dma_mapped:1,
+                                        dma_done:1;
+        unsigned                        chain_len;
+        void                            *buf;
+        dma_addr_t                      dma;
+};
+
+static inline u32 pch_udc_readl(struct pch_udc_dev *dev, unsigned long reg)
+{
+        return ioread32(dev->base_addr + reg);
+}
+
+static inline void pch_udc_writel(struct pch_udc_dev *dev,
+                                    unsigned long val, unsigned long reg)
+{
+        iowrite32(val, dev->base_addr + reg);
+}
+
+static inline void pch_udc_bit_set(struct pch_udc_dev *dev,
+                                     unsigned long reg,
+                                     unsigned long bitmask)
+{
+        pch_udc_writel(dev, pch_udc_readl(dev, reg) | bitmask, reg);
+}
+
+static inline void pch_udc_bit_clr(struct pch_udc_dev *dev,
+                                     unsigned long reg,
+                                     unsigned long bitmask)
+{
+        pch_udc_writel(dev, pch_udc_readl(dev, reg) & ~(bitmask), reg);
+}
+
+static inline u32 pch_udc_ep_readl(struct pch_udc_ep *ep, unsigned long reg)
+{
+        return ioread32(ep->dev->base_addr + ep->offset_addr + reg);
+}
+
+static inline void pch_udc_ep_writel(struct pch_udc_ep *ep,
+                                    unsigned long val, unsigned long reg)
+{
+        iowrite32(val, ep->dev->base_addr + ep->offset_addr + reg);
+}
+
+static inline void pch_udc_ep_bit_set(struct pch_udc_ep *ep,
+                                     unsigned long reg,
+                                     unsigned long bitmask)
+{
+        pch_udc_ep_writel(ep, pch_udc_ep_readl(ep, reg) | bitmask, reg);
+}
+
+static inline void pch_udc_ep_bit_clr(struct pch_udc_ep *ep,
+                                     unsigned long reg,
+                                     unsigned long bitmask)
+{
+        pch_udc_ep_writel(ep, pch_udc_ep_readl(ep, reg) & ~(bitmask), reg);
+}
+
+/**
+ * pch_udc_csr_busy() - Wait till idle.
+ * @dev:        Reference to pch_udc_dev structure
+ */
+static void pch_udc_csr_busy(struct pch_udc_dev *dev)
+{
+        unsigned int count = 200;
+
+        /* Wait till idle */
+        while ((pch_udc_readl(dev, UDC_CSR_BUSY_ADDR) & UDC_CSR_BUSY)
+                && --count)
+                cpu_relax();
+        if (!count)
+                dev_err(&dev->pdev->dev, "%s: wait error\n", __func__);
+}
+
+/**
+ * pch_udc_write_csr() - Write the command and status registers.
+ * @dev:        Reference to pch_udc_dev structure
+ * @val:        value to be written to CSR register
+ * @addr:       address of CSR register
+ */
+static void pch_udc_write_csr(struct pch_udc_dev *dev, unsigned long val,
+                               unsigned int ep)
+{
+        unsigned long reg = PCH_UDC_CSR(ep);
+
+        pch_udc_csr_busy(dev);          /* Wait till idle */
+        pch_udc_writel(dev, val, reg);
+        pch_udc_csr_busy(dev);          /* Wait till idle */
+}
+
+/**
+ * pch_udc_read_csr() - Read the command and status registers.
+ * @dev:        Reference to pch_udc_dev structure
+ * @addr:       address of CSR register
+ *
+ * Return codes:        content of CSR register
+ */
+static u32 pch_udc_read_csr(struct pch_udc_dev *dev, unsigned int ep)
+{
+        unsigned long reg = PCH_UDC_CSR(ep);
+
+        pch_udc_csr_busy(dev);          /* Wait till idle */
+        pch_udc_readl(dev, reg);        /* Dummy read */
+        pch_udc_csr_busy(dev);          /* Wait till idle */
+        return pch_udc_readl(dev, reg);
+}
+
+/**
+ * pch_udc_rmt_wakeup() - Initiate for remote wakeup
+ * @dev:        Reference to pch_udc_dev structure
+ */
+static inline void pch_udc_rmt_wakeup(struct pch_udc_dev *dev)
+{
+        pch_udc_bit_set(dev, UDC_DEVCTL_ADDR, UDC_DEVCTL_RES);
+        mdelay(1);
+        pch_udc_bit_clr(dev, UDC_DEVCTL_ADDR, UDC_DEVCTL_RES);
+}
+
+/**
+ * pch_udc_get_frame() - Get the current frame from device status register
+ * @dev:        Reference to pch_udc_dev structure
+ * Retern       current frame
+ */
+static inline int pch_udc_get_frame(struct pch_udc_dev *dev)
+{
+        u32 frame = pch_udc_readl(dev, UDC_DEVSTS_ADDR);
+        return (frame & UDC_DEVSTS_TS_MASK) >> UDC_DEVSTS_TS_SHIFT;
+}
+
+/**
+ * pch_udc_clear_selfpowered() - Clear the self power control
+ * @dev:        Reference to pch_udc_regs structure
+ */
+static inline void pch_udc_clear_selfpowered(struct pch_udc_dev *dev)
+{
+        pch_udc_bit_clr(dev, UDC_DEVCFG_ADDR, UDC_DEVCFG_SP);
+}
+
+/**
+ * pch_udc_set_selfpowered() - Set the self power control
+ * @dev:        Reference to pch_udc_regs structure
+ */
+static inline void pch_udc_set_selfpowered(struct pch_udc_dev *dev)
+{
+        pch_udc_bit_set(dev, UDC_DEVCFG_ADDR, UDC_DEVCFG_SP);
+}
+
+/**
+ * pch_udc_set_disconnect() - Set the disconnect status.
+ * @dev:        Reference to pch_udc_regs structure
+ */
+static inline void pch_udc_set_disconnect(struct pch_udc_dev *dev)
+{
+        pch_udc_bit_set(dev, UDC_DEVCTL_ADDR, UDC_DEVCTL_SD);
+}
+
+/**
+ * pch_udc_clear_disconnect() - Clear the disconnect status.
+ * @dev:        Reference to pch_udc_regs structure
+ */
+static void pch_udc_clear_disconnect(struct pch_udc_dev *dev)
+{
+        /* Clear the disconnect */
+        pch_udc_bit_set(dev, UDC_DEVCTL_ADDR, UDC_DEVCTL_RES);
+        pch_udc_bit_clr(dev, UDC_DEVCTL_ADDR, UDC_DEVCTL_SD);
+        mdelay(1);
+        /* Resume USB signalling */
+        pch_udc_bit_clr(dev, UDC_DEVCTL_ADDR, UDC_DEVCTL_RES);
+}
+
+/**
+ * pch_udc_vbus_session() - set or clearr the disconnect status.
+ * @dev:        Reference to pch_udc_regs structure
+ * @is_active:  Parameter specifying the action
+ *                0:   indicating VBUS power is ending
+ *                !0:  indicating VBUS power is starting
+ */
+static inline void pch_udc_vbus_session(struct pch_udc_dev *dev,
+                                          int is_active)
+{
+        if (is_active)
+                pch_udc_clear_disconnect(dev);
+        else
+                pch_udc_set_disconnect(dev);
+}
+
+/**
+ * pch_udc_ep_set_stall() - Set the stall of endpoint
+ * @ep:         Reference to structure of type pch_udc_ep_regs
+ */
+static void pch_udc_ep_set_stall(struct pch_udc_ep *ep)
+{
+        if (ep->in) {
+                pch_udc_ep_bit_set(ep, UDC_EPCTL_ADDR, UDC_EPCTL_F);
+                pch_udc_ep_bit_set(ep, UDC_EPCTL_ADDR, UDC_EPCTL_S);
+        } else {
+                pch_udc_ep_bit_set(ep, UDC_EPCTL_ADDR, UDC_EPCTL_S);
+        }
+}
+
+/**
+ * pch_udc_ep_clear_stall() - Clear the stall of endpoint
+ * @ep:         Reference to structure of type pch_udc_ep_regs
+ */
+static inline void pch_udc_ep_clear_stall(struct pch_udc_ep *ep)
+{
+        /* Clear the stall */
+        pch_udc_ep_bit_clr(ep, UDC_EPCTL_ADDR, UDC_EPCTL_S);
+        /* Clear NAK by writing CNAK */
+        pch_udc_ep_bit_set(ep, UDC_EPCTL_ADDR, UDC_EPCTL_CNAK);
+}
+
+/**
+ * pch_udc_ep_set_trfr_type() - Set the transfer type of endpoint
+ * @ep:         Reference to structure of type pch_udc_ep_regs
+ * @type:       Type of endpoint
+ */
+static inline void pch_udc_ep_set_trfr_type(struct pch_udc_ep *ep,
+                                        u8 type)
+{
+        pch_udc_ep_writel(ep, ((type << UDC_EPCTL_ET_SHIFT) &
+                                UDC_EPCTL_ET_MASK), UDC_EPCTL_ADDR);
+}
+
+/**
+ * pch_udc_ep_set_bufsz() - Set the maximum packet size for the endpoint
+ * @ep:         Reference to structure of type pch_udc_ep_regs
+ * @buf_size:   The buffer word size
+ */
+static void pch_udc_ep_set_bufsz(struct pch_udc_ep *ep,
+                                                 u32 buf_size, u32 ep_in)
+{
+        u32 data;
+        if (ep_in) {
+                data = pch_udc_ep_readl(ep, UDC_BUFIN_FRAMENUM_ADDR);
+                data = (data & 0xffff0000) | (buf_size & 0xffff);
+                pch_udc_ep_writel(ep, data, UDC_BUFIN_FRAMENUM_ADDR);
+        } else {
+                data = pch_udc_ep_readl(ep, UDC_BUFOUT_MAXPKT_ADDR);
+                data = (buf_size << 16) | (data & 0xffff);
+                pch_udc_ep_writel(ep, data, UDC_BUFOUT_MAXPKT_ADDR);
+        }
+}
+
+/**
+ * pch_udc_ep_set_maxpkt() - Set the Max packet size for the endpoint
+ * @ep:         Reference to structure of type pch_udc_ep_regs
+ * @pkt_size:   The packet byte size
+ */
+static void pch_udc_ep_set_maxpkt(struct pch_udc_ep *ep, u32 pkt_size)
+{
+        u32 data = pch_udc_ep_readl(ep, UDC_BUFOUT_MAXPKT_ADDR);
+        data = (data & 0xffff0000) | (pkt_size & 0xffff);
+        pch_udc_ep_writel(ep, data, UDC_BUFOUT_MAXPKT_ADDR);
+}
+
+/**
+ * pch_udc_ep_set_subptr() - Set the Setup buffer pointer for the endpoint
+ * @ep:         Reference to structure of type pch_udc_ep_regs
+ * @addr:       Address of the register
+ */
+static inline void pch_udc_ep_set_subptr(struct pch_udc_ep *ep, u32 addr)
+{
+        pch_udc_ep_writel(ep, addr, UDC_SUBPTR_ADDR);
+}
+
+/**
+ * pch_udc_ep_set_ddptr() - Set the Data descriptor pointer for the endpoint
+ * @ep:         Reference to structure of type pch_udc_ep_regs
+ * @addr:       Address of the register
+ */
+static inline void pch_udc_ep_set_ddptr(struct pch_udc_ep *ep, u32 addr)
+{
+        pch_udc_ep_writel(ep, addr, UDC_DESPTR_ADDR);
+}
+
+/**
+ * pch_udc_ep_set_pd() - Set the poll demand bit for the endpoint
+ * @ep:         Reference to structure of type pch_udc_ep_regs
+ */
+static inline void pch_udc_ep_set_pd(struct pch_udc_ep *ep)
+{
+        pch_udc_ep_bit_set(ep, UDC_EPCTL_ADDR, UDC_EPCTL_P);
+}
+
+/**
+ * pch_udc_ep_set_rrdy() - Set the receive ready bit for the endpoint
+ * @ep:         Reference to structure of type pch_udc_ep_regs
+ */
+static inline void pch_udc_ep_set_rrdy(struct pch_udc_ep *ep)
+{
+        pch_udc_ep_bit_set(ep, UDC_EPCTL_ADDR, UDC_EPCTL_RRDY);
+}
+
+/**
+ * pch_udc_ep_clear_rrdy() - Clear the receive ready bit for the endpoint
+ * @ep:         Reference to structure of type pch_udc_ep_regs
+ */
+static inline void pch_udc_ep_clear_rrdy(struct pch_udc_ep *ep)
+{
+        pch_udc_ep_bit_clr(ep, UDC_EPCTL_ADDR, UDC_EPCTL_RRDY);
+}
+
+/**
+ * pch_udc_set_dma() - Set the 'TDE' or RDE bit of device control
+ *                      register depending on the direction specified
+ * @dev:        Reference to structure of type pch_udc_regs
+ * @dir:        whether Tx or Rx
+ *                DMA_DIR_RX: Receive
+ *                DMA_DIR_TX: Transmit
+ */
+static inline void pch_udc_set_dma(struct pch_udc_dev *dev, int dir)
+{
+        if (dir == DMA_DIR_RX)
+                pch_udc_bit_set(dev, UDC_DEVCTL_ADDR, UDC_DEVCTL_RDE);
+        else if (dir == DMA_DIR_TX)
+                pch_udc_bit_set(dev, UDC_DEVCTL_ADDR, UDC_DEVCTL_TDE);
+}
+
+/**
+ * pch_udc_clear_dma() - Clear the 'TDE' or RDE bit of device control
+ *                               register depending on the direction specified
+ * @dev:        Reference to structure of type pch_udc_regs
+ * @dir:        Whether Tx or Rx
+ *                DMA_DIR_RX: Receive
+ *                DMA_DIR_TX: Transmit
+ */
+static inline void pch_udc_clear_dma(struct pch_udc_dev *dev, int dir)
+{
+        if (dir == DMA_DIR_RX)
+                pch_udc_bit_clr(dev, UDC_DEVCTL_ADDR, UDC_DEVCTL_RDE);
+        else if (dir == DMA_DIR_TX)
+                pch_udc_bit_clr(dev, UDC_DEVCTL_ADDR, UDC_DEVCTL_TDE);
+}
+
+/**
+ * pch_udc_set_csr_done() - Set the device control register
+ *                              CSR done field (bit 13)
+ * @dev:        reference to structure of type pch_udc_regs
+ */
+static inline void pch_udc_set_csr_done(struct pch_udc_dev *dev)
+{
+        pch_udc_bit_set(dev, UDC_DEVCTL_ADDR, UDC_DEVCTL_CSR_DONE);
+}
+
+/**
+ * pch_udc_disable_interrupts() - Disables the specified interrupts
+ * @dev:        Reference to structure of type pch_udc_regs
+ * @mask:       Mask to disable interrupts
+ */
+static inline void pch_udc_disable_interrupts(struct pch_udc_dev *dev,
+                                            u32 mask)
+{
+        pch_udc_bit_set(dev, UDC_DEVIRQMSK_ADDR, mask);
+}
+
+/**
+ * pch_udc_enable_interrupts() - Enable the specified interrupts
+ * @dev:        Reference to structure of type pch_udc_regs
+ * @mask:       Mask to enable interrupts
+ */
+static inline void pch_udc_enable_interrupts(struct pch_udc_dev *dev,
+                                           u32 mask)
+{
+        pch_udc_bit_clr(dev, UDC_DEVIRQMSK_ADDR, mask);
+}
+
+/**
+ * pch_udc_disable_ep_interrupts() - Disable endpoint interrupts
+ * @dev:        Reference to structure of type pch_udc_regs
+ * @mask:       Mask to disable interrupts
+ */
+static inline void pch_udc_disable_ep_interrupts(struct pch_udc_dev *dev,
+                                                u32 mask)
+{
+        pch_udc_bit_set(dev, UDC_EPIRQMSK_ADDR, mask);
+}
+
+/**
+ * pch_udc_enable_ep_interrupts() - Enable endpoint interrupts
+ * @dev:        Reference to structure of type pch_udc_regs
+ * @mask:       Mask to enable interrupts
+ */
+static inline void pch_udc_enable_ep_interrupts(struct pch_udc_dev *dev,
+                                              u32 mask)
+{
+        pch_udc_bit_clr(dev, UDC_EPIRQMSK_ADDR, mask);
+}
+
+/**
+ * pch_udc_read_device_interrupts() - Read the device interrupts
+ * @dev:        Reference to structure of type pch_udc_regs
+ * Retern       The device interrupts
+ */
+static inline u32 pch_udc_read_device_interrupts(struct pch_udc_dev *dev)
+{
+        return pch_udc_readl(dev, UDC_DEVIRQSTS_ADDR);
+}
+
+/**
+ * pch_udc_write_device_interrupts() - Write device interrupts
+ * @dev:        Reference to structure of type pch_udc_regs
+ * @val:        The value to be written to interrupt register
+ */
+static inline void pch_udc_write_device_interrupts(struct pch_udc_dev *dev,
+                                                     u32 val)
+{
+        pch_udc_writel(dev, val, UDC_DEVIRQSTS_ADDR);
+}
+
+/**
+ * pch_udc_read_ep_interrupts() - Read the endpoint interrupts
+ * @dev:        Reference to structure of type pch_udc_regs
+ * Retern       The endpoint interrupt
+ */
+static inline u32 pch_udc_read_ep_interrupts(struct pch_udc_dev *dev)
+{
+        return pch_udc_readl(dev, UDC_EPIRQSTS_ADDR);
+}
+
+/**
+ * pch_udc_write_ep_interrupts() - Clear endpoint interupts
+ * @dev:        Reference to structure of type pch_udc_regs
+ * @val:        The value to be written to interrupt register
+ */
+static inline void pch_udc_write_ep_interrupts(struct pch_udc_dev *dev,
+                                             u32 val)
+{
+        pch_udc_writel(dev, val, UDC_EPIRQSTS_ADDR);
+}
+
+/**
+ * pch_udc_read_device_status() - Read the device status
+ * @dev:        Reference to structure of type pch_udc_regs
+ * Retern       The device status
+ */
+static inline u32 pch_udc_read_device_status(struct pch_udc_dev *dev)
+{
+        return pch_udc_readl(dev, UDC_DEVSTS_ADDR);
+}
+
+/**
+ * pch_udc_read_ep_control() - Read the endpoint control
+ * @ep:         Reference to structure of type pch_udc_ep_regs
+ * Retern       The endpoint control register value
+ */
+static inline u32 pch_udc_read_ep_control(struct pch_udc_ep *ep)
+{
+        return pch_udc_ep_readl(ep, UDC_EPCTL_ADDR);
+}
+
+/**
+ * pch_udc_clear_ep_control() - Clear the endpoint control register
+ * @ep:         Reference to structure of type pch_udc_ep_regs
+ * Retern       The endpoint control register value
+ */
+static inline void pch_udc_clear_ep_control(struct pch_udc_ep *ep)
+{
+        return pch_udc_ep_writel(ep, 0, UDC_EPCTL_ADDR);
+}
+
+/**
+ * pch_udc_read_ep_status() - Read the endpoint status
+ * @ep:         Reference to structure of type pch_udc_ep_regs
+ * Retern       The endpoint status
+ */
+static inline u32 pch_udc_read_ep_status(struct pch_udc_ep *ep)
+{
+        return pch_udc_ep_readl(ep, UDC_EPSTS_ADDR);
+}
+
+/**
+ * pch_udc_clear_ep_status() - Clear the endpoint status
+ * @ep:         Reference to structure of type pch_udc_ep_regs
+ * @stat:       Endpoint status
+ */
+static inline void pch_udc_clear_ep_status(struct pch_udc_ep *ep,
+                                         u32 stat)
+{
+        return pch_udc_ep_writel(ep, stat, UDC_EPSTS_ADDR);
+}
+
+/**
+ * pch_udc_ep_set_nak() - Set the bit 7 (SNAK field)
+ *                              of the endpoint control register
+ * @ep:         Reference to structure of type pch_udc_ep_regs
+ */
+static inline void pch_udc_ep_set_nak(struct pch_udc_ep *ep)
+{
+        pch_udc_ep_bit_set(ep, UDC_EPCTL_ADDR, UDC_EPCTL_SNAK);
+}
+
+/**
+ * pch_udc_ep_clear_nak() - Set the bit 8 (CNAK field)
+ *                              of the endpoint control register
+ * @ep:         reference to structure of type pch_udc_ep_regs
+ */
+static void pch_udc_ep_clear_nak(struct pch_udc_ep *ep)
+{
+        unsigned int loopcnt = 0;
+        struct pch_udc_dev *dev = ep->dev;
+
+        if (!(pch_udc_ep_readl(ep, UDC_EPCTL_ADDR) & UDC_EPCTL_NAK))
+                return;
+        if (!ep->in) {
+                loopcnt = 10000;
+                while (!(pch_udc_read_ep_status(ep) & UDC_EPSTS_MRXFIFO_EMP) &&
+                        --loopcnt)
+                        udelay(5);
+                if (!loopcnt)
+                        dev_err(&dev->pdev->dev, "%s: RxFIFO not Empty\n",
+                                __func__);
+        }
+        loopcnt = 10000;
+        while ((pch_udc_read_ep_control(ep) & UDC_EPCTL_NAK) && --loopcnt) {
+                pch_udc_ep_bit_set(ep, UDC_EPCTL_ADDR, UDC_EPCTL_CNAK);
+                udelay(5);
+        }
+        if (!loopcnt)
+                dev_err(&dev->pdev->dev, "%s: Clear NAK not set for ep%d%s\n",
+                        __func__, ep->num, (ep->in ? "in" : "out"));
+}
+
+/**
+ * pch_udc_ep_fifo_flush() - Flush the endpoint fifo
+ * @ep: reference to structure of type pch_udc_ep_regs
+ * @dir:        direction of endpoint
+ *                0:  endpoint is OUT
+ *                !0: endpoint is IN
+ */
+static void pch_udc_ep_fifo_flush(struct pch_udc_ep *ep, int dir)
+{
+        if (dir) {      /* IN ep */
+                pch_udc_ep_bit_set(ep, UDC_EPCTL_ADDR, UDC_EPCTL_F);
+                return;
+        }
+}
+
+/**
+ * pch_udc_ep_enable() - This api enables endpoint
+ * @regs:       Reference to structure pch_udc_ep_regs
+ * @desc:       endpoint descriptor
+ */
+static void pch_udc_ep_enable(struct pch_udc_ep *ep,
+                               struct pch_udc_cfg_data *cfg,
+                               const struct usb_endpoint_descriptor *desc)
+{
+        u32 val = 0;
+        u32 buff_size = 0;
+
+        pch_udc_ep_set_trfr_type(ep, desc->bmAttributes);
+        if (ep->in)
+                buff_size = UDC_EPIN_BUFF_SIZE;
+        else
+                buff_size = UDC_EPOUT_BUFF_SIZE;
+        pch_udc_ep_set_bufsz(ep, buff_size, ep->in);
+        pch_udc_ep_set_maxpkt(ep, le16_to_cpu(desc->wMaxPacketSize));
+        pch_udc_ep_set_nak(ep);
+        pch_udc_ep_fifo_flush(ep, ep->in);
+        /* Configure the endpoint */
+        val = ep->num << UDC_CSR_NE_NUM_SHIFT | ep->in << UDC_CSR_NE_DIR_SHIFT |
+              ((desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) <<
+                UDC_CSR_NE_TYPE_SHIFT) |
+              (cfg->cur_cfg << UDC_CSR_NE_CFG_SHIFT) |
+              (cfg->cur_intf << UDC_CSR_NE_INTF_SHIFT) |
+              (cfg->cur_alt << UDC_CSR_NE_ALT_SHIFT) |
+              le16_to_cpu(desc->wMaxPacketSize) << UDC_CSR_NE_MAX_PKT_SHIFT;
+
+        if (ep->in)
+                pch_udc_write_csr(ep->dev, val, UDC_EPIN_IDX(ep->num));
+        else
+                pch_udc_write_csr(ep->dev, val, UDC_EPOUT_IDX(ep->num));
+}
+
+/**
+ * pch_udc_ep_disable() - This api disables endpoint
+ * @regs:       Reference to structure pch_udc_ep_regs
+ */
+static void pch_udc_ep_disable(struct pch_udc_ep *ep)
+{
+        if (ep->in) {
+                /* flush the fifo */
+                pch_udc_ep_writel(ep, UDC_EPCTL_F, UDC_EPCTL_ADDR);
+                /* set NAK */
+                pch_udc_ep_writel(ep, UDC_EPCTL_SNAK, UDC_EPCTL_ADDR);
+                pch_udc_ep_bit_set(ep, UDC_EPSTS_ADDR, UDC_EPSTS_IN);
+        } else {
+                /* set NAK */
+                pch_udc_ep_writel(ep, UDC_EPCTL_SNAK, UDC_EPCTL_ADDR);
+        }
+        /* reset desc pointer */
+        pch_udc_ep_writel(ep, 0, UDC_DESPTR_ADDR);
+}
+
+/**
+ * pch_udc_wait_ep_stall() - Wait EP stall.
+ * @dev:        Reference to pch_udc_dev structure
+ */
+static void pch_udc_wait_ep_stall(struct pch_udc_ep *ep)
+{
+        unsigned int count = 10000;
+
+        /* Wait till idle */
+        while ((pch_udc_read_ep_control(ep) & UDC_EPCTL_S) && --count)
+                udelay(5);
+        if (!count)
+                dev_err(&ep->dev->pdev->dev, "%s: wait error\n", __func__);
+}
+
+/**
+ * pch_udc_init() - This API initializes usb device controller
+ * @dev:        Rreference to pch_udc_regs structure
+ */
+static void pch_udc_init(struct pch_udc_dev *dev)
+{
+        if (NULL == dev) {
+                pr_err("%s: Invalid address\n", __func__);
+                return;
+        }
+        /* Soft Reset and Reset PHY */
+        pch_udc_writel(dev, UDC_SRST, UDC_SRST_ADDR);
+        pch_udc_writel(dev, UDC_SRST | UDC_PSRST, UDC_SRST_ADDR);
+        mdelay(1);
+        pch_udc_writel(dev, UDC_SRST, UDC_SRST_ADDR);
+        pch_udc_writel(dev, 0x00, UDC_SRST_ADDR);
+        mdelay(1);
+        /* mask and clear all device interrupts */
+        pch_udc_bit_set(dev, UDC_DEVIRQMSK_ADDR, UDC_DEVINT_MSK);
+        pch_udc_bit_set(dev, UDC_DEVIRQSTS_ADDR, UDC_DEVINT_MSK);
+
+        /* mask and clear all ep interrupts */
+        pch_udc_bit_set(dev, UDC_EPIRQMSK_ADDR, UDC_EPINT_MSK_DISABLE_ALL);
+        pch_udc_bit_set(dev, UDC_EPIRQSTS_ADDR, UDC_EPINT_MSK_DISABLE_ALL);
+
+        /* enable dynamic CSR programmingi, self powered and device speed */
+        if (speed_fs)
+                pch_udc_bit_set(dev, UDC_DEVCFG_ADDR, UDC_DEVCFG_CSR_PRG |
+                                UDC_DEVCFG_SP | UDC_DEVCFG_SPD_FS);
+        else /* defaul high speed */
+                pch_udc_bit_set(dev, UDC_DEVCFG_ADDR, UDC_DEVCFG_CSR_PRG |
+                                UDC_DEVCFG_SP | UDC_DEVCFG_SPD_HS);
+        pch_udc_bit_set(dev, UDC_DEVCTL_ADDR,
+                        (PCH_UDC_THLEN << UDC_DEVCTL_THLEN_SHIFT) |
+                        (PCH_UDC_BRLEN << UDC_DEVCTL_BRLEN_SHIFT) |
+                        UDC_DEVCTL_MODE | UDC_DEVCTL_BREN |
+                        UDC_DEVCTL_THE);
+}
+
+/**
+ * pch_udc_exit() - This API exit usb device controller
+ * @dev:        Reference to pch_udc_regs structure
+ */
+static void pch_udc_exit(struct pch_udc_dev *dev)
+{
+        /* mask all device interrupts */
+        pch_udc_bit_set(dev, UDC_DEVIRQMSK_ADDR, UDC_DEVINT_MSK);
+        /* mask all ep interrupts */
+        pch_udc_bit_set(dev, UDC_EPIRQMSK_ADDR, UDC_EPINT_MSK_DISABLE_ALL);
+        /* put device in disconnected state */
+        pch_udc_set_disconnect(dev);
+}
+
+/**
+ * pch_udc_pcd_get_frame() - This API is invoked to get the current frame number
+ * @gadget:     Reference to the gadget driver
+ *
+ * Return codes:
+ *      0:              Success
+ *      -EINVAL:        If the gadget passed is NULL
+ */
+static int pch_udc_pcd_get_frame(struct usb_gadget *gadget)
+{
+        struct pch_udc_dev      *dev;
+
+        if (!gadget)
+                return -EINVAL;
+        dev = container_of(gadget, struct pch_udc_dev, gadget);
+        return pch_udc_get_frame(dev);
+}
+
+/**
+ * pch_udc_pcd_wakeup() - This API is invoked to initiate a remote wakeup
+ * @gadget:     Reference to the gadget driver
+ *
+ * Return codes:
+ *      0:              Success
+ *      -EINVAL:        If the gadget passed is NULL
+ */
+static int pch_udc_pcd_wakeup(struct usb_gadget *gadget)
+{
+        struct pch_udc_dev      *dev;
+        unsigned long           flags;
+
+        if (!gadget)
+                return -EINVAL;
+        dev = container_of(gadget, struct pch_udc_dev, gadget);
+        spin_lock_irqsave(&dev->lock, flags);
+        pch_udc_rmt_wakeup(dev);
+        spin_unlock_irqrestore(&dev->lock, flags);
+        return 0;
+}
+
+/**
+ * pch_udc_pcd_selfpowered() - This API is invoked to specify whether the device
+ *                              is self powered or not
+ * @gadget:     Reference to the gadget driver
+ * @value:      Specifies self powered or not
+ *
+ * Return codes:
+ *      0:              Success
+ *      -EINVAL:        If the gadget passed is NULL
+ */
+static int pch_udc_pcd_selfpowered(struct usb_gadget *gadget, int value)
+{
+        struct pch_udc_dev      *dev;
+
+        if (!gadget)
+                return -EINVAL;
+        dev = container_of(gadget, struct pch_udc_dev, gadget);
+        if (value)
+                pch_udc_set_selfpowered(dev);
+        else
+                pch_udc_clear_selfpowered(dev);
+        return 0;
+}
+
+/**
+ * pch_udc_pcd_pullup() - This API is invoked to make the device
+ *                              visible/invisible to the host
+ * @gadget:     Reference to the gadget driver
+ * @is_on:      Specifies whether the pull up is made active or inactive
+ *
+ * Return codes:
+ *      0:              Success
+ *      -EINVAL:        If the gadget passed is NULL
+ */
+static int pch_udc_pcd_pullup(struct usb_gadget *gadget, int is_on)
+{
+        struct pch_udc_dev      *dev;
+
+        if (!gadget)
+                return -EINVAL;
+        dev = container_of(gadget, struct pch_udc_dev, gadget);
+        pch_udc_vbus_session(dev, is_on);
+        return 0;
+}
+
+/**
+ * pch_udc_pcd_vbus_session() - This API is used by a driver for an external
+ *                              transceiver (or GPIO) that
+ *                              detects a VBUS power session starting/ending
+ * @gadget:     Reference to the gadget driver
+ * @is_active:  specifies whether the session is starting or ending
+ *
+ * Return codes:
+ *      0:              Success
+ *      -EINVAL:        If the gadget passed is NULL
+ */
+static int pch_udc_pcd_vbus_session(struct usb_gadget *gadget, int is_active)
+{
+        struct pch_udc_dev      *dev;
+
+        if (!gadget)
+                return -EINVAL;
+        dev = container_of(gadget, struct pch_udc_dev, gadget);
+        pch_udc_vbus_session(dev, is_active);
+        return 0;
+}
+
+/**
+ * pch_udc_pcd_vbus_draw() - This API is used by gadget drivers during
+ *                              SET_CONFIGURATION calls to
+ *                              specify how much power the device can consume
+ * @gadget:     Reference to the gadget driver
+ * @mA:         specifies the current limit in 2mA unit
+ *
+ * Return codes:
+ *      -EINVAL:        If the gadget passed is NULL
+ *      -EOPNOTSUPP:
+ */
+static int pch_udc_pcd_vbus_draw(struct usb_gadget *gadget, unsigned int mA)
+{
+        return -EOPNOTSUPP;
+}
+
+static const struct usb_gadget_ops pch_udc_ops = {
+        .get_frame = pch_udc_pcd_get_frame,
+        .wakeup = pch_udc_pcd_wakeup,
+        .set_selfpowered = pch_udc_pcd_selfpowered,
+        .pullup = pch_udc_pcd_pullup,
+        .vbus_session = pch_udc_pcd_vbus_session,
+        .vbus_draw = pch_udc_pcd_vbus_draw,
+};
+
+/**
+ * complete_req() - This API is invoked from the driver when processing
+ *                      of a request is complete
+ * @ep:         Reference to the endpoint structure
+ * @req:        Reference to the request structure
+ * @status:     Indicates the success/failure of completion
+ */
+static void complete_req(struct pch_udc_ep *ep, struct pch_udc_request *req,
+                                                                 int status)
+{
+        struct pch_udc_dev      *dev;
+        unsigned halted = ep->halted;
+
+        list_del_init(&req->queue);
+
+        /* set new status if pending */
+        if (req->req.status == -EINPROGRESS)
+                req->req.status = status;
+        else
+                status = req->req.status;
+
+        dev = ep->dev;
+        if (req->dma_mapped) {
+                if (req->dma == DMA_ADDR_INVALID) {
+                        if (ep->in)
+                                dma_unmap_single(&dev->pdev->dev, req->req.dma,
+                                                 req->req.length,
+                                                 DMA_TO_DEVICE);
+                        else
+                                dma_unmap_single(&dev->pdev->dev, req->req.dma,
+                                                 req->req.length,
+                                                 DMA_FROM_DEVICE);
+                        req->req.dma = DMA_ADDR_INVALID;
+                } else {
+                        if (ep->in)
+                                dma_unmap_single(&dev->pdev->dev, req->dma,
+                                                 req->req.length,
+                                                 DMA_TO_DEVICE);
+                        else {
+                                dma_unmap_single(&dev->pdev->dev, req->dma,
+                                                 req->req.length,
+                                                 DMA_FROM_DEVICE);
+                                memcpy(req->req.buf, req->buf, req->req.length);
+                        }
+                        kfree(req->buf);
+                        req->dma = DMA_ADDR_INVALID;
+                }
+                req->dma_mapped = 0;
+        }
+        ep->halted = 1;
+        spin_unlock(&dev->lock);
+        if (!ep->in)
+                pch_udc_ep_clear_rrdy(ep);
+        req->req.complete(&ep->ep, &req->req);
+        spin_lock(&dev->lock);
+        ep->halted = halted;
+}
+
+/**
+ * empty_req_queue() - This API empties the request queue of an endpoint
+ * @ep:         Reference to the endpoint structure
+ */
+static void empty_req_queue(struct pch_udc_ep *ep)
+{
+        struct pch_udc_request  *req;
+
+        ep->halted = 1;
+        while (!list_empty(&ep->queue)) {
+                req = list_entry(ep->queue.next, struct pch_udc_request, queue);
+                complete_req(ep, req, -ESHUTDOWN);      /* Remove from list */
+        }
+}
+
+/**
+ * pch_udc_free_dma_chain() - This function frees the DMA chain created
+ *                              for the request
+ * @dev         Reference to the driver structure
+ * @req         Reference to the request to be freed
+ *
+ * Return codes:
+ *      0: Success
+ */
+static void pch_udc_free_dma_chain(struct pch_udc_dev *dev,
+                                   struct pch_udc_request *req)
+{
+        struct pch_udc_data_dma_desc *td = req->td_data;
+        unsigned i = req->chain_len;
+
+        dma_addr_t addr2;
+        dma_addr_t addr = (dma_addr_t)td->next;
+        td->next = 0x00;
+        for (; i > 1; --i) {
+                /* do not free first desc., will be done by free for request */
+                td = phys_to_virt(addr);
+                addr2 = (dma_addr_t)td->next;
+                pci_pool_free(dev->data_requests, td, addr);
+                td->next = 0x00;
+                addr = addr2;
+        }
+        req->chain_len = 1;
+}
+
+/**
+ * pch_udc_create_dma_chain() - This function creates or reinitializes
+ *                              a DMA chain
+ * @ep:         Reference to the endpoint structure
+ * @req:        Reference to the request
+ * @buf_len:    The buffer length
+ * @gfp_flags:  Flags to be used while mapping the data buffer
+ *
+ * Return codes:
+ *      0:              success,
+ *      -ENOMEM:        pci_pool_alloc invocation fails
+ */
+static int pch_udc_create_dma_chain(struct pch_udc_ep *ep,
+                                    struct pch_udc_request *req,
+                                    unsigned long buf_len,
+                                    gfp_t gfp_flags)
+{
+        struct pch_udc_data_dma_desc *td = req->td_data, *last;
+        unsigned long bytes = req->req.length, i = 0;
+        dma_addr_t dma_addr;
+        unsigned len = 1;
+
+        if (req->chain_len > 1)
+                pch_udc_free_dma_chain(ep->dev, req);
+
+        if (req->dma == DMA_ADDR_INVALID)
+                td->dataptr = req->req.dma;
+        else
+                td->dataptr = req->dma;
+
+        td->status = PCH_UDC_BS_HST_BSY;
+        for (; ; bytes -= buf_len, ++len) {
+                td->status = PCH_UDC_BS_HST_BSY | min(buf_len, bytes);
+                if (bytes <= buf_len)
+                        break;
+                last = td;
+                td = pci_pool_alloc(ep->dev->data_requests, gfp_flags,
+                                    &dma_addr);
+                if (!td)
+                        goto nomem;
+                i += buf_len;
+                td->dataptr = req->td_data->dataptr + i;
+                last->next = dma_addr;
+        }
+
+        req->td_data_last = td;
+        td->status |= PCH_UDC_DMA_LAST;
+        td->next = req->td_data_phys;
+        req->chain_len = len;
+        return 0;
+
+nomem:
+        if (len > 1) {
+                req->chain_len = len;
+                pch_udc_free_dma_chain(ep->dev, req);
+        }
+        req->chain_len = 1;
+        return -ENOMEM;
+}
+
+/**
+ * prepare_dma() - This function creates and initializes the DMA chain
+ *                      for the request
+ * @ep:         Reference to the endpoint structure
+ * @req:        Reference to the request
+ * @gfp:        Flag to be used while mapping the data buffer
+ *
+ * Return codes:
+ *      0:              Success
+ *      Other 0:        linux error number on failure
+ */
+static int prepare_dma(struct pch_udc_ep *ep, struct pch_udc_request *req,
+                          gfp_t gfp)
+{
+        int     retval;
+
+        /* Allocate and create a DMA chain */
+        retval = pch_udc_create_dma_chain(ep, req, ep->ep.maxpacket, gfp);
+        if (retval) {
+                pr_err("%s: could not create DMA chain:%d\n", __func__, retval);
+                return retval;
+        }
+        if (ep->in)
+                req->td_data->status = (req->td_data->status &
+                                ~PCH_UDC_BUFF_STS) | PCH_UDC_BS_HST_RDY;
+        return 0;
+}
+
+/**
+ * process_zlp() - This function process zero length packets
+ *                      from the gadget driver
+ * @ep:         Reference to the endpoint structure
+ * @req:        Reference to the request
+ */
+static void process_zlp(struct pch_udc_ep *ep, struct pch_udc_request *req)
+{
+        struct pch_udc_dev      *dev = ep->dev;
+
+        /* IN zlp's are handled by hardware */
+        complete_req(ep, req, 0);
+
+        /* if set_config or set_intf is waiting for ack by zlp
+         * then set CSR_DONE
+         */
+        if (dev->set_cfg_not_acked) {
+                pch_udc_set_csr_done(dev);
+                dev->set_cfg_not_acked = 0;
+        }
+        /* setup command is ACK'ed now by zlp */
+        if (!dev->stall && dev->waiting_zlp_ack) {
+                pch_udc_ep_clear_nak(&(dev->ep[UDC_EP0IN_IDX]));
+                dev->waiting_zlp_ack = 0;
+        }
+}
+
+/**
+ * pch_udc_start_rxrequest() - This function starts the receive requirement.
+ * @ep:         Reference to the endpoint structure
+ * @req:        Reference to the request structure
+ */
+static void pch_udc_start_rxrequest(struct pch_udc_ep *ep,
+                                         struct pch_udc_request *req)
+{
+        struct pch_udc_data_dma_desc *td_data;
+
+        pch_udc_clear_dma(ep->dev, DMA_DIR_RX);
+        td_data = req->td_data;
+        /* Set the status bits for all descriptors */
+        while (1) {
+                td_data->status = (td_data->status & ~PCH_UDC_BUFF_STS) |
+                                    PCH_UDC_BS_HST_RDY;
+                if ((td_data->status & PCH_UDC_DMA_LAST) ==  PCH_UDC_DMA_LAST)
+                        break;
+                td_data = phys_to_virt(td_data->next);
+        }
+        /* Write the descriptor pointer */
+        pch_udc_ep_set_ddptr(ep, req->td_data_phys);
+        req->dma_going = 1;
+        pch_udc_enable_ep_interrupts(ep->dev, UDC_EPINT_OUT_EP0 << ep->num);
+        pch_udc_set_dma(ep->dev, DMA_DIR_RX);
+        pch_udc_ep_clear_nak(ep);
+        pch_udc_ep_set_rrdy(ep);
+}
+
+/**
+ * pch_udc_pcd_ep_enable() - This API enables the endpoint. It is called
+ *                              from gadget driver
+ * @usbep:      Reference to the USB endpoint structure
+ * @desc:       Reference to the USB endpoint descriptor structure
+ *
+ * Return codes:
+ *      0:              Success
+ *      -EINVAL:
+ *      -ESHUTDOWN:
+ */
+static int pch_udc_pcd_ep_enable(struct usb_ep *usbep,
+                                    const struct usb_endpoint_descriptor *desc)
+{
+        struct pch_udc_ep       *ep;
+        struct pch_udc_dev      *dev;
+        unsigned long           iflags;
+
+        if (!usbep || (usbep->name == ep0_string) || !desc ||
+            (desc->bDescriptorType != USB_DT_ENDPOINT) || !desc->wMaxPacketSize)
+                return -EINVAL;
+
+        ep = container_of(usbep, struct pch_udc_ep, ep);
+        dev = ep->dev;
+        if (!dev->driver || (dev->gadget.speed == USB_SPEED_UNKNOWN))
+                return -ESHUTDOWN;
+        spin_lock_irqsave(&dev->lock, iflags);
+        ep->desc = desc;
+        ep->halted = 0;
+        pch_udc_ep_enable(ep, &ep->dev->cfg_data, desc);
+        ep->ep.maxpacket = le16_to_cpu(desc->wMaxPacketSize);
+        pch_udc_enable_ep_interrupts(ep->dev, PCH_UDC_EPINT(ep->in, ep->num));
+        spin_unlock_irqrestore(&dev->lock, iflags);
+        return 0;
+}
+
+/**
+ * pch_udc_pcd_ep_disable() - This API disables endpoint and is called
+ *                              from gadget driver
+ * @usbep       Reference to the USB endpoint structure
+ *
+ * Return codes:
+ *      0:              Success
+ *      -EINVAL:
+ */
+static int pch_udc_pcd_ep_disable(struct usb_ep *usbep)
+{
+        struct pch_udc_ep       *ep;
+        struct pch_udc_dev      *dev;
+        unsigned long   iflags;
+
+        if (!usbep)
+                return -EINVAL;
+
+        ep = container_of(usbep, struct pch_udc_ep, ep);
+        dev = ep->dev;
+        if ((usbep->name == ep0_string) || !ep->desc)
+                return -EINVAL;
+
+        spin_lock_irqsave(&ep->dev->lock, iflags);
+        empty_req_queue(ep);
+        ep->halted = 1;
+        pch_udc_ep_disable(ep);
+        pch_udc_disable_ep_interrupts(ep->dev, PCH_UDC_EPINT(ep->in, ep->num));
+        ep->desc = NULL;
+        INIT_LIST_HEAD(&ep->queue);
+        spin_unlock_irqrestore(&ep->dev->lock, iflags);
+        return 0;
+}
+
+/**
+ * pch_udc_alloc_request() - This function allocates request structure.
+ *                              It is called by gadget driver
+ * @usbep:      Reference to the USB endpoint structure
+ * @gfp:        Flag to be used while allocating memory
+ *
+ * Return codes:
+ *      NULL:                   Failure
+ *      Allocated address:      Success
+ */
+static struct usb_request *pch_udc_alloc_request(struct usb_ep *usbep,
+                                                  gfp_t gfp)
+{
+        struct pch_udc_request          *req;
+        struct pch_udc_ep               *ep;
+        struct pch_udc_data_dma_desc    *dma_desc;
+        struct pch_udc_dev              *dev;
+
+        if (!usbep)
+                return NULL;
+        ep = container_of(usbep, struct pch_udc_ep, ep);
+        dev = ep->dev;
+        req = kzalloc(sizeof *req, gfp);
+        if (!req)
+                return NULL;
+        req->req.dma = DMA_ADDR_INVALID;
+        req->dma = DMA_ADDR_INVALID;
+        INIT_LIST_HEAD(&req->queue);
+        if (!ep->dev->dma_addr)
+                return &req->req;
+        /* ep0 in requests are allocated from data pool here */
+        dma_desc = pci_pool_alloc(ep->dev->data_requests, gfp,
+                                  &req->td_data_phys);
+        if (NULL == dma_desc) {
+                kfree(req);
+                return NULL;
+        }
+        /* prevent from using desc. - set HOST BUSY */
+        dma_desc->status |= PCH_UDC_BS_HST_BSY;
+        dma_desc->dataptr = __constant_cpu_to_le32(DMA_ADDR_INVALID);
+        req->td_data = dma_desc;
+        req->td_data_last = dma_desc;
+        req->chain_len = 1;
+        return &req->req;
+}
+
+/**
+ * pch_udc_free_request() - This function frees request structure.
+ *                              It is called by gadget driver
+ * @usbep:      Reference to the USB endpoint structure
+ * @usbreq:     Reference to the USB request
+ */
+static void pch_udc_free_request(struct usb_ep *usbep,
+                                  struct usb_request *usbreq)
+{
+        struct pch_udc_ep       *ep;
+        struct pch_udc_request  *req;
+        struct pch_udc_dev      *dev;
+
+        if (!usbep || !usbreq)
+                return;
+        ep = container_of(usbep, struct pch_udc_ep, ep);
+        req = container_of(usbreq, struct pch_udc_request, req);
+        dev = ep->dev;
+        if (!list_empty(&req->queue))
+                dev_err(&dev->pdev->dev, "%s: %s req=0x%p queue not empty\n",
+                        __func__, usbep->name, req);
+        if (req->td_data != NULL) {
+                if (req->chain_len > 1)
+                        pch_udc_free_dma_chain(ep->dev, req);
+                pci_pool_free(ep->dev->data_requests, req->td_data,
+                              req->td_data_phys);
+        }
+        kfree(req);
+}
+
+/**
+ * pch_udc_pcd_queue() - This function queues a request packet. It is called
+ *                      by gadget driver
+ * @usbep:      Reference to the USB endpoint structure
+ * @usbreq:     Reference to the USB request
+ * @gfp:        Flag to be used while mapping the data buffer
+ *
+ * Return codes:
+ *      0:                      Success
+ *      linux error number:     Failure
+ */
+static int pch_udc_pcd_queue(struct usb_ep *usbep, struct usb_request *usbreq,
+                                                                 gfp_t gfp)
+{
+        int retval = 0;
+        struct pch_udc_ep       *ep;
+        struct pch_udc_dev      *dev;
+        struct pch_udc_request  *req;
+        unsigned long   iflags;
+
+        if (!usbep || !usbreq || !usbreq->complete || !usbreq->buf)
+                return -EINVAL;
+        ep = container_of(usbep, struct pch_udc_ep, ep);
+        dev = ep->dev;
+        if (!ep->desc && ep->num)
+                return -EINVAL;
+        req = container_of(usbreq, struct pch_udc_request, req);
+        if (!list_empty(&req->queue))
+                return -EINVAL;
+        if (!dev->driver || (dev->gadget.speed == USB_SPEED_UNKNOWN))
+                return -ESHUTDOWN;
+        spin_lock_irqsave(&dev->lock, iflags);
+        /* map the buffer for dma */
+        if (usbreq->length &&
+            ((usbreq->dma == DMA_ADDR_INVALID) || !usbreq->dma)) {
+                if (!((unsigned long)(usbreq->buf) & 0x03)) {
+                        if (ep->in)
+                                usbreq->dma = dma_map_single(&dev->pdev->dev,
+                                                             usbreq->buf,
+                                                             usbreq->length,
+                                                             DMA_TO_DEVICE);
+                        else
+                                usbreq->dma = dma_map_single(&dev->pdev->dev,
+                                                             usbreq->buf,
+                                                             usbreq->length,
+                                                             DMA_FROM_DEVICE);
+                } else {
+                        req->buf = kzalloc(usbreq->length, GFP_ATOMIC);
+                        if (!req->buf) {
+                                retval = -ENOMEM;
+                                goto probe_end;
+                        }
+                        if (ep->in) {
+                                memcpy(req->buf, usbreq->buf, usbreq->length);
+                                req->dma = dma_map_single(&dev->pdev->dev,
+                                                          req->buf,
+                                                          usbreq->length,
+                                                          DMA_TO_DEVICE);
+                        } else
+                                req->dma = dma_map_single(&dev->pdev->dev,
+                                                          req->buf,
+                                                          usbreq->length,
+                                                          DMA_FROM_DEVICE);
+                }
+                req->dma_mapped = 1;
+        }
+        if (usbreq->length > 0) {
+                retval = prepare_dma(ep, req, GFP_ATOMIC);
+                if (retval)
+                        goto probe_end;
+        }
+        usbreq->actual = 0;
+        usbreq->status = -EINPROGRESS;
+        req->dma_done = 0;
+        if (list_empty(&ep->queue) && !ep->halted) {
+                /* no pending transfer, so start this req */
+                if (!usbreq->length) {
+                        process_zlp(ep, req);
+                        retval = 0;
+                        goto probe_end;
+                }
+                if (!ep->in) {
+                        pch_udc_start_rxrequest(ep, req);
+                } else {
+                        /*
+                        * For IN trfr the descriptors will be programmed and
+                        * P bit will be set when
+                        * we get an IN token
+                        */
+                        pch_udc_wait_ep_stall(ep);
+                        pch_udc_ep_clear_nak(ep);
+                        pch_udc_enable_ep_interrupts(ep->dev, (1 << ep->num));
+                }
+        }
+        /* Now add this request to the ep's pending requests */
+        if (req != NULL)
+                list_add_tail(&req->queue, &ep->queue);
+
+probe_end:
+        spin_unlock_irqrestore(&dev->lock, iflags);
+        return retval;
+}
+
+/**
+ * pch_udc_pcd_dequeue() - This function de-queues a request packet.
+ *                              It is called by gadget driver
+ * @usbep:      Reference to the USB endpoint structure
+ * @usbreq:     Reference to the USB request
+ *
+ * Return codes:
+ *      0:                      Success
+ *      linux error number:     Failure
+ */
+static int pch_udc_pcd_dequeue(struct usb_ep *usbep,
+                                struct usb_request *usbreq)
+{
+        struct pch_udc_ep       *ep;
+        struct pch_udc_request  *req;
+        struct pch_udc_dev      *dev;
+        unsigned long           flags;
+        int ret = -EINVAL;
+
+        ep = container_of(usbep, struct pch_udc_ep, ep);
+        dev = ep->dev;
+        if (!usbep || !usbreq || (!ep->desc && ep->num))
+                return ret;
+        req = container_of(usbreq, struct pch_udc_request, req);
+        spin_lock_irqsave(&ep->dev->lock, flags);
+        /* make sure it's still queued on this endpoint */
+        list_for_each_entry(req, &ep->queue, queue) {
+                if (&req->req == usbreq) {
+                        pch_udc_ep_set_nak(ep);
+                        if (!list_empty(&req->queue))
+                                complete_req(ep, req, -ECONNRESET);
+                        ret = 0;
+                        break;
+                }
+        }
+        spin_unlock_irqrestore(&ep->dev->lock, flags);
+        return ret;
+}
+
+/**
+ * pch_udc_pcd_set_halt() - This function Sets or clear the endpoint halt
+ *                          feature
+ * @usbep:      Reference to the USB endpoint structure
+ * @halt:       Specifies whether to set or clear the feature
+ *
+ * Return codes:
+ *      0:                      Success
+ *      linux error number:     Failure
+ */
+static int pch_udc_pcd_set_halt(struct usb_ep *usbep, int halt)
+{
+        struct pch_udc_ep       *ep;
+        struct pch_udc_dev      *dev;
+        unsigned long iflags;
+        int ret;
+
+        if (!usbep)
+                return -EINVAL;
+        ep = container_of(usbep, struct pch_udc_ep, ep);
+        dev = ep->dev;
+        if (!ep->desc && !ep->num)
+                return -EINVAL;
+        if (!ep->dev->driver || (ep->dev->gadget.speed == USB_SPEED_UNKNOWN))
+                return -ESHUTDOWN;
+        spin_lock_irqsave(&udc_stall_spinlock, iflags);
+        if (list_empty(&ep->queue)) {
+                if (halt) {
+                        if (ep->num == PCH_UDC_EP0)
+                                ep->dev->stall = 1;
+                        pch_udc_ep_set_stall(ep);
+                        pch_udc_enable_ep_interrupts(ep->dev,
+                                                     PCH_UDC_EPINT(ep->in,
+                                                                   ep->num));
+                } else {
+                        pch_udc_ep_clear_stall(ep);
+                }
+                ret = 0;
+        } else {
+                ret = -EAGAIN;
+        }
+        spin_unlock_irqrestore(&udc_stall_spinlock, iflags);
+        return ret;
+}
+
+/**
+ * pch_udc_pcd_set_wedge() - This function Sets or clear the endpoint
+ *                              halt feature
+ * @usbep:      Reference to the USB endpoint structure
+ * @halt:       Specifies whether to set or clear the feature
+ *
+ * Return codes:
+ *      0:                      Success
+ *      linux error number:     Failure
+ */
+static int pch_udc_pcd_set_wedge(struct usb_ep *usbep)
+{
+        struct pch_udc_ep       *ep;
+        struct pch_udc_dev      *dev;
+        unsigned long iflags;
+        int ret;
+
+        if (!usbep)
+                return -EINVAL;
+        ep = container_of(usbep, struct pch_udc_ep, ep);
+        dev = ep->dev;
+        if (!ep->desc && !ep->num)
+                return -EINVAL;
+        if (!ep->dev->driver || (ep->dev->gadget.speed == USB_SPEED_UNKNOWN))
+                return -ESHUTDOWN;
+        spin_lock_irqsave(&udc_stall_spinlock, iflags);
+        if (!list_empty(&ep->queue)) {
+                ret = -EAGAIN;
+        } else {
+                if (ep->num == PCH_UDC_EP0)
+                        ep->dev->stall = 1;
+                pch_udc_ep_set_stall(ep);
+                pch_udc_enable_ep_interrupts(ep->dev,
+                                             PCH_UDC_EPINT(ep->in, ep->num));
+                ep->dev->prot_stall = 1;
+                ret = 0;
+        }
+        spin_unlock_irqrestore(&udc_stall_spinlock, iflags);
+        return ret;
+}
+
+/**
+ * pch_udc_pcd_fifo_flush() - This function Flush the FIFO of specified endpoint
+ * @usbep:      Reference to the USB endpoint structure
+ */
+static void pch_udc_pcd_fifo_flush(struct usb_ep *usbep)
+{
+        struct pch_udc_ep  *ep;
+
+        if (!usbep)
+                return;
+
+        ep = container_of(usbep, struct pch_udc_ep, ep);
+        if (ep->desc || !ep->num)
+                pch_udc_ep_fifo_flush(ep, ep->in);
+}
+
+static const struct usb_ep_ops pch_udc_ep_ops = {
+        .enable         = pch_udc_pcd_ep_enable,
+        .disable        = pch_udc_pcd_ep_disable,
+        .alloc_request  = pch_udc_alloc_request,
+        .free_request   = pch_udc_free_request,
+        .queue          = pch_udc_pcd_queue,
+        .dequeue        = pch_udc_pcd_dequeue,
+        .set_halt       = pch_udc_pcd_set_halt,
+        .set_wedge      = pch_udc_pcd_set_wedge,
+        .fifo_status    = NULL,
+        .fifo_flush     = pch_udc_pcd_fifo_flush,
+};
+
+/**
+ * pch_udc_init_setup_buff() - This function initializes the SETUP buffer
+ * @td_stp:     Reference to the SETP buffer structure
+ */
+static void pch_udc_init_setup_buff(struct pch_udc_stp_dma_desc *td_stp)
+{
+        static u32      pky_marker;
+
+        if (!td_stp)
+                return;
+        td_stp->reserved = ++pky_marker;
+        memset(&td_stp->request, 0xFF, sizeof td_stp->request);
+        td_stp->status = PCH_UDC_BS_HST_RDY;
+}
+
+/**
+ * pch_udc_start_next_txrequest() - This function starts
+ *                                      the next transmission requirement
+ * @ep: Reference to the endpoint structure
+ */
+static void pch_udc_start_next_txrequest(struct pch_udc_ep *ep)
+{
+        struct pch_udc_request *req;
+        struct pch_udc_data_dma_desc *td_data;
+
+        if (pch_udc_read_ep_control(ep) & UDC_EPCTL_P)
+                return;
+
+        if (list_empty(&ep->queue))
+                return;
+
+        /* next request */
+        req = list_entry(ep->queue.next, struct pch_udc_request, queue);
+        if (req->dma_going)
+                return;
+        if (!req->td_data)
+                return;
+        pch_udc_wait_ep_stall(ep);
+        req->dma_going = 1;
+        pch_udc_ep_set_ddptr(ep, 0);
+        td_data = req->td_data;
+        while (1) {
+                td_data->status = (td_data->status & ~PCH_UDC_BUFF_STS) |
+                                   PCH_UDC_BS_HST_RDY;
+                if ((td_data->status & PCH_UDC_DMA_LAST) == PCH_UDC_DMA_LAST)
+                        break;
+                td_data = phys_to_virt(td_data->next);
+        }
+        pch_udc_ep_set_ddptr(ep, req->td_data_phys);
+        pch_udc_set_dma(ep->dev, DMA_DIR_TX);
+        pch_udc_ep_set_pd(ep);
+        pch_udc_enable_ep_interrupts(ep->dev, PCH_UDC_EPINT(ep->in, ep->num));
+        pch_udc_ep_clear_nak(ep);
+}
+
+/**
+ * pch_udc_complete_transfer() - This function completes a transfer
+ * @ep:         Reference to the endpoint structure
+ */
+static void pch_udc_complete_transfer(struct pch_udc_ep *ep)
+{
+        struct pch_udc_request *req;
+        struct pch_udc_dev *dev = ep->dev;
+
+        if (list_empty(&ep->queue))
+                return;
+        req = list_entry(ep->queue.next, struct pch_udc_request, queue);
+        if ((req->td_data_last->status & PCH_UDC_BUFF_STS) !=
+            PCH_UDC_BS_DMA_DONE)
+                return;
+        if ((req->td_data_last->status & PCH_UDC_RXTX_STS) !=
+             PCH_UDC_RTS_SUCC) {
+                dev_err(&dev->pdev->dev, "Invalid RXTX status (0x%08x) "
+                        "epstatus=0x%08x\n",
+                       (req->td_data_last->status & PCH_UDC_RXTX_STS),
+                       (int)(ep->epsts));
+                return;
+        }
+
+        req->req.actual = req->req.length;
+        req->td_data_last->status = PCH_UDC_BS_HST_BSY | PCH_UDC_DMA_LAST;
+        req->td_data->status = PCH_UDC_BS_HST_BSY | PCH_UDC_DMA_LAST;
+        complete_req(ep, req, 0);
+        req->dma_going = 0;
+        if (!list_empty(&ep->queue)) {
+                pch_udc_wait_ep_stall(ep);
+                pch_udc_ep_clear_nak(ep);
+                pch_udc_enable_ep_interrupts(ep->dev,
+                                             PCH_UDC_EPINT(ep->in, ep->num));
+        } else {
+                pch_udc_disable_ep_interrupts(ep->dev,
+                                              PCH_UDC_EPINT(ep->in, ep->num));
+        }
+}
+
+/**
+ * pch_udc_complete_receiver() - This function completes a receiver
+ * @ep:         Reference to the endpoint structure
+ */
+static void pch_udc_complete_receiver(struct pch_udc_ep *ep)
+{
+        struct pch_udc_request *req;
+        struct pch_udc_dev *dev = ep->dev;
+        unsigned int count;
+        struct pch_udc_data_dma_desc *td;
+        dma_addr_t addr;
+
+        if (list_empty(&ep->queue))
+                return;
+        /* next request */
+        req = list_entry(ep->queue.next, struct pch_udc_request, queue);
+        pch_udc_clear_dma(ep->dev, DMA_DIR_RX);
+        pch_udc_ep_set_ddptr(ep, 0);
+        if ((req->td_data_last->status & PCH_UDC_BUFF_STS) ==
+            PCH_UDC_BS_DMA_DONE)
+                td = req->td_data_last;
+        else
+                td = req->td_data;
+
+        while (1) {
+                if ((td->status & PCH_UDC_RXTX_STS) != PCH_UDC_RTS_SUCC) {
+                        dev_err(&dev->pdev->dev, "Invalid RXTX status=0x%08x "
+                                "epstatus=0x%08x\n",
+                                (req->td_data->status & PCH_UDC_RXTX_STS),
+                                (int)(ep->epsts));
+                        return;
+                }
+                if ((td->status & PCH_UDC_BUFF_STS) == PCH_UDC_BS_DMA_DONE)
+                        if (td->status | PCH_UDC_DMA_LAST) {
+                                count = td->status & PCH_UDC_RXTX_BYTES;
+                                break;
+                        }
+                if (td == req->td_data_last) {
+                        dev_err(&dev->pdev->dev, "Not complete RX descriptor");
+                        return;
+                }
+                addr = (dma_addr_t)td->next;
+                td = phys_to_virt(addr);
+        }
+        /* on 64k packets the RXBYTES field is zero */
+        if (!count && (req->req.length == UDC_DMA_MAXPACKET))
+                count = UDC_DMA_MAXPACKET;
+        req->td_data->status |= PCH_UDC_DMA_LAST;
+        td->status |= PCH_UDC_BS_HST_BSY;
+
+        req->dma_going = 0;
+        req->req.actual = count;
+        complete_req(ep, req, 0);
+        /* If there is a new/failed requests try that now */
+        if (!list_empty(&ep->queue)) {
+                req = list_entry(ep->queue.next, struct pch_udc_request, queue);
+                pch_udc_start_rxrequest(ep, req);
+        }
+}
+
+/**
+ * pch_udc_svc_data_in() - This function process endpoint interrupts
+ *                              for IN endpoints
+ * @dev:        Reference to the device structure
+ * @ep_num:     Endpoint that generated the interrupt
+ */
+static void pch_udc_svc_data_in(struct pch_udc_dev *dev, int ep_num)
+{
+        u32     epsts;
+        struct pch_udc_ep       *ep;
+
+        ep = &dev->ep[UDC_EPIN_IDX(ep_num)];
+        epsts = ep->epsts;
+        ep->epsts = 0;
+
+        if (!(epsts & (UDC_EPSTS_IN | UDC_EPSTS_BNA  | UDC_EPSTS_HE |
+                       UDC_EPSTS_TDC | UDC_EPSTS_RCS | UDC_EPSTS_TXEMPTY |
+                       UDC_EPSTS_RSS | UDC_EPSTS_XFERDONE)))
+                return;
+        if ((epsts & UDC_EPSTS_BNA))
+                return;
+        if (epsts & UDC_EPSTS_HE)
+                return;
+        if (epsts & UDC_EPSTS_RSS) {
+                pch_udc_ep_set_stall(ep);
+                pch_udc_enable_ep_interrupts(ep->dev,
+                                             PCH_UDC_EPINT(ep->in, ep->num));
+        }
+        if (epsts & UDC_EPSTS_RCS) {
+                if (!dev->prot_stall) {
+                        pch_udc_ep_clear_stall(ep);
+                } else {
+                        pch_udc_ep_set_stall(ep);
+                        pch_udc_enable_ep_interrupts(ep->dev,
+                                                PCH_UDC_EPINT(ep->in, ep->num));
+                }
+        }
+        if (epsts & UDC_EPSTS_TDC)
+                pch_udc_complete_transfer(ep);
+        /* On IN interrupt, provide data if we have any */
+        if ((epsts & UDC_EPSTS_IN) && !(epsts & UDC_EPSTS_RSS) &&
+            !(epsts & UDC_EPSTS_TDC) && !(epsts & UDC_EPSTS_TXEMPTY))
+                pch_udc_start_next_txrequest(ep);
+}
+
+/**
+ * pch_udc_svc_data_out() - Handles interrupts from OUT endpoint
+ * @dev:        Reference to the device structure
+ * @ep_num:     Endpoint that generated the interrupt
+ */
+static void pch_udc_svc_data_out(struct pch_udc_dev *dev, int ep_num)
+{
+        u32                     epsts;
+        struct pch_udc_ep               *ep;
+        struct pch_udc_request          *req = NULL;
+
+        ep = &dev->ep[UDC_EPOUT_IDX(ep_num)];
+        epsts = ep->epsts;
+        ep->epsts = 0;
+
+        if ((epsts & UDC_EPSTS_BNA) && (!list_empty(&ep->queue))) {
+                /* next request */
+                req = list_entry(ep->queue.next, struct pch_udc_request,
+                                 queue);
+                if ((req->td_data_last->status & PCH_UDC_BUFF_STS) !=
+                     PCH_UDC_BS_DMA_DONE) {
+                        if (!req->dma_going)
+                                pch_udc_start_rxrequest(ep, req);
+                        return;
+                }
+        }
+        if (epsts & UDC_EPSTS_HE)
+                return;
+        if (epsts & UDC_EPSTS_RSS) {
+                pch_udc_ep_set_stall(ep);
+                pch_udc_enable_ep_interrupts(ep->dev,
+                                             PCH_UDC_EPINT(ep->in, ep->num));
+        }
+        if (epsts & UDC_EPSTS_RCS) {
+                if (!dev->prot_stall) {
+                        pch_udc_ep_clear_stall(ep);
+                } else {
+                        pch_udc_ep_set_stall(ep);
+                        pch_udc_enable_ep_interrupts(ep->dev,
+                                                PCH_UDC_EPINT(ep->in, ep->num));
+                }
+        }
+        if (((epsts & UDC_EPSTS_OUT_MASK) >> UDC_EPSTS_OUT_SHIFT) ==
+            UDC_EPSTS_OUT_DATA) {
+                if (ep->dev->prot_stall == 1) {
+                        pch_udc_ep_set_stall(ep);
+                        pch_udc_enable_ep_interrupts(ep->dev,
+                                                PCH_UDC_EPINT(ep->in, ep->num));
+                } else {
+                        pch_udc_complete_receiver(ep);
+                }
+        }
+        if (list_empty(&ep->queue))
+                pch_udc_set_dma(dev, DMA_DIR_RX);
+}
+
+/**
+ * pch_udc_svc_control_in() - Handle Control IN endpoint interrupts
+ * @dev:        Reference to the device structure
+ */
+static void pch_udc_svc_control_in(struct pch_udc_dev *dev)
+{
+        u32     epsts;
+        struct pch_udc_ep       *ep;
+        struct pch_udc_ep       *ep_out;
+
+        ep = &dev->ep[UDC_EP0IN_IDX];
+        ep_out = &dev->ep[UDC_EP0OUT_IDX];
+        epsts = ep->epsts;
+        ep->epsts = 0;
+
+        if (!(epsts & (UDC_EPSTS_IN | UDC_EPSTS_BNA | UDC_EPSTS_HE |
+                       UDC_EPSTS_TDC | UDC_EPSTS_RCS | UDC_EPSTS_TXEMPTY |
+                       UDC_EPSTS_XFERDONE)))
+                return;
+        if ((epsts & UDC_EPSTS_BNA))
+                return;
+        if (epsts & UDC_EPSTS_HE)
+                return;
+        if ((epsts & UDC_EPSTS_TDC) && (!dev->stall)) {
+                pch_udc_complete_transfer(ep);
+                pch_udc_clear_dma(dev, DMA_DIR_RX);
+                ep_out->td_data->status = (ep_out->td_data->status &
+                                        ~PCH_UDC_BUFF_STS) |
+                                        PCH_UDC_BS_HST_RDY;
+                pch_udc_ep_clear_nak(ep_out);
+                pch_udc_set_dma(dev, DMA_DIR_RX);
+                pch_udc_ep_set_rrdy(ep_out);
+        }
+        /* On IN interrupt, provide data if we have any */
+        if ((epsts & UDC_EPSTS_IN) && !(epsts & UDC_EPSTS_TDC) &&
+             !(epsts & UDC_EPSTS_TXEMPTY))
+                pch_udc_start_next_txrequest(ep);
+}
+
+/**
+ * pch_udc_svc_control_out() - Routine that handle Control
+ *                                      OUT endpoint interrupts
+ * @dev:        Reference to the device structure
+ */
+static void pch_udc_svc_control_out(struct pch_udc_dev *dev)
+{
+        u32     stat;
+        int setup_supported;
+        struct pch_udc_ep       *ep;
+
+        ep = &dev->ep[UDC_EP0OUT_IDX];
+        stat = ep->epsts;
+        ep->epsts = 0;
+
+        /* If setup data */
+        if (((stat & UDC_EPSTS_OUT_MASK) >> UDC_EPSTS_OUT_SHIFT) ==
+            UDC_EPSTS_OUT_SETUP) {
+                dev->stall = 0;
+                dev->ep[UDC_EP0IN_IDX].halted = 0;
+                dev->ep[UDC_EP0OUT_IDX].halted = 0;
+                dev->setup_data = ep->td_stp->request;
+                pch_udc_init_setup_buff(ep->td_stp);
+                pch_udc_clear_dma(dev, DMA_DIR_RX);
+                pch_udc_ep_fifo_flush(&(dev->ep[UDC_EP0IN_IDX]),
+                                      dev->ep[UDC_EP0IN_IDX].in);
+                if ((dev->setup_data.bRequestType & USB_DIR_IN))
+                        dev->gadget.ep0 = &dev->ep[UDC_EP0IN_IDX].ep;
+                else /* OUT */
+                        dev->gadget.ep0 = &ep->ep;
+                spin_unlock(&dev->lock);
+                /* If Mass storage Reset */
+                if ((dev->setup_data.bRequestType == 0x21) &&
+                    (dev->setup_data.bRequest == 0xFF))
+                        dev->prot_stall = 0;
+                /* call gadget with setup data received */
+                setup_supported = dev->driver->setup(&dev->gadget,
+                                                     &dev->setup_data);
+                spin_lock(&dev->lock);
+
+                if (dev->setup_data.bRequestType & USB_DIR_IN) {
+                        ep->td_data->status = (ep->td_data->status &
+                                                ~PCH_UDC_BUFF_STS) |
+                                                PCH_UDC_BS_HST_RDY;
+                        pch_udc_ep_set_ddptr(ep, ep->td_data_phys);
+                }
+                /* ep0 in returns data on IN phase */
+                if (setup_supported >= 0 && setup_supported <
+                                            UDC_EP0IN_MAX_PKT_SIZE) {
+                        pch_udc_ep_clear_nak(&(dev->ep[UDC_EP0IN_IDX]));
+                        /* Gadget would have queued a request when
+                         * we called the setup */
+                        if (!(dev->setup_data.bRequestType & USB_DIR_IN)) {
+                                pch_udc_set_dma(dev, DMA_DIR_RX);
+                                pch_udc_ep_clear_nak(ep);
+                        }
+                } else if (setup_supported < 0) {
+                        /* if unsupported request, then stall */
+                        pch_udc_ep_set_stall(&(dev->ep[UDC_EP0IN_IDX]));
+                        pch_udc_enable_ep_interrupts(ep->dev,
+                                                PCH_UDC_EPINT(ep->in, ep->num));
+                        dev->stall = 0;
+                        pch_udc_set_dma(dev, DMA_DIR_RX);
+                } else {
+                        dev->waiting_zlp_ack = 1;
+                }
+        } else if ((((stat & UDC_EPSTS_OUT_MASK) >> UDC_EPSTS_OUT_SHIFT) ==
+                     UDC_EPSTS_OUT_DATA) && !dev->stall) {
+                pch_udc_clear_dma(dev, DMA_DIR_RX);
+                pch_udc_ep_set_ddptr(ep, 0);
+                if (!list_empty(&ep->queue)) {
+                        ep->epsts = stat;
+                        pch_udc_svc_data_out(dev, PCH_UDC_EP0);
+                }
+                pch_udc_set_dma(dev, DMA_DIR_RX);
+        }
+        pch_udc_ep_set_rrdy(ep);
+}
+
+
+/**
+ * pch_udc_postsvc_epinters() - This function enables end point interrupts
+ *                              and clears NAK status
+ * @dev:        Reference to the device structure
+ * @ep_num:     End point number
+ */
+static void pch_udc_postsvc_epinters(struct pch_udc_dev *dev, int ep_num)
+{
+        struct pch_udc_ep       *ep;
+        struct pch_udc_request *req;
+
+        ep = &dev->ep[UDC_EPIN_IDX(ep_num)];
+        if (!list_empty(&ep->queue)) {
+                req = list_entry(ep->queue.next, struct pch_udc_request, queue);
+                pch_udc_enable_ep_interrupts(ep->dev,
+                                             PCH_UDC_EPINT(ep->in, ep->num));
+                pch_udc_ep_clear_nak(ep);
+        }
+}
+
+/**
+ * pch_udc_read_all_epstatus() - This function read all endpoint status
+ * @dev:        Reference to the device structure
+ * @ep_intr:    Status of endpoint interrupt
+ */
+static void pch_udc_read_all_epstatus(struct pch_udc_dev *dev, u32 ep_intr)
+{
+        int i;
+        struct pch_udc_ep       *ep;
+
+        for (i = 0; i < PCH_UDC_USED_EP_NUM; i++) {
+                /* IN */
+                if (ep_intr & (0x1 << i)) {
+                        ep = &dev->ep[UDC_EPIN_IDX(i)];
+                        ep->epsts = pch_udc_read_ep_status(ep);
+                        pch_udc_clear_ep_status(ep, ep->epsts);
+                }
+                /* OUT */
+                if (ep_intr & (0x10000 << i)) {
+                        ep = &dev->ep[UDC_EPOUT_IDX(i)];
+                        ep->epsts = pch_udc_read_ep_status(ep);
+                        pch_udc_clear_ep_status(ep, ep->epsts);
+                }
+        }
+}
+
+/**
+ * pch_udc_activate_control_ep() - This function enables the control endpoints
+ *                                      for traffic after a reset
+ * @dev:        Reference to the device structure
+ */
+static void pch_udc_activate_control_ep(struct pch_udc_dev *dev)
+{
+        struct pch_udc_ep       *ep;
+        u32 val;
+
+        /* Setup the IN endpoint */
+        ep = &dev->ep[UDC_EP0IN_IDX];
+        pch_udc_clear_ep_control(ep);
+        pch_udc_ep_fifo_flush(ep, ep->in);
+        pch_udc_ep_set_bufsz(ep, UDC_EP0IN_BUFF_SIZE, ep->in);
+        pch_udc_ep_set_maxpkt(ep, UDC_EP0IN_MAX_PKT_SIZE);
+        /* Initialize the IN EP Descriptor */
+        ep->td_data      = NULL;
+        ep->td_stp       = NULL;
+        ep->td_data_phys = 0;
+        ep->td_stp_phys  = 0;
+
+        /* Setup the OUT endpoint */
+        ep = &dev->ep[UDC_EP0OUT_IDX];
+        pch_udc_clear_ep_control(ep);
+        pch_udc_ep_fifo_flush(ep, ep->in);
+        pch_udc_ep_set_bufsz(ep, UDC_EP0OUT_BUFF_SIZE, ep->in);
+        pch_udc_ep_set_maxpkt(ep, UDC_EP0OUT_MAX_PKT_SIZE);
+        val = UDC_EP0OUT_MAX_PKT_SIZE << UDC_CSR_NE_MAX_PKT_SHIFT;
+        pch_udc_write_csr(ep->dev, val, UDC_EP0OUT_IDX);
+
+        /* Initialize the SETUP buffer */
+        pch_udc_init_setup_buff(ep->td_stp);
+        /* Write the pointer address of dma descriptor */
+        pch_udc_ep_set_subptr(ep, ep->td_stp_phys);
+        /* Write the pointer address of Setup descriptor */
+        pch_udc_ep_set_ddptr(ep, ep->td_data_phys);
+
+        /* Initialize the dma descriptor */
+        ep->td_data->status  = PCH_UDC_DMA_LAST;
+        ep->td_data->dataptr = dev->dma_addr;
+        ep->td_data->next    = ep->td_data_phys;
+
+        pch_udc_ep_clear_nak(ep);
+}
+
+
+/**
+ * pch_udc_svc_ur_interrupt() - This function handles a USB reset interrupt
+ * @dev:        Reference to driver structure
+ */
+static void pch_udc_svc_ur_interrupt(struct pch_udc_dev *dev)
+{
+        struct pch_udc_ep       *ep;
+        int i;
+
+        pch_udc_clear_dma(dev, DMA_DIR_TX);
+        pch_udc_clear_dma(dev, DMA_DIR_RX);
+        /* Mask all endpoint interrupts */
+        pch_udc_disable_ep_interrupts(dev, UDC_EPINT_MSK_DISABLE_ALL);
+        /* clear all endpoint interrupts */
+        pch_udc_write_ep_interrupts(dev, UDC_EPINT_MSK_DISABLE_ALL);
+
+        for (i = 0; i < PCH_UDC_EP_NUM; i++) {
+                ep = &dev->ep[i];
+                pch_udc_clear_ep_status(ep, UDC_EPSTS_ALL_CLR_MASK);
+                pch_udc_clear_ep_control(ep);
+                pch_udc_ep_set_ddptr(ep, 0);
+                pch_udc_write_csr(ep->dev, 0x00, i);
+        }
+        dev->stall = 0;
+        dev->prot_stall = 0;
+        dev->waiting_zlp_ack = 0;
+        dev->set_cfg_not_acked = 0;
+
+        /* disable ep to empty req queue. Skip the control EP's */
+        for (i = 0; i < (PCH_UDC_USED_EP_NUM*2); i++) {
+                ep = &dev->ep[i];
+                pch_udc_ep_set_nak(ep);
+                pch_udc_ep_fifo_flush(ep, ep->in);
+                /* Complete request queue */
+                empty_req_queue(ep);
+        }
+        if (dev->driver && dev->driver->disconnect)
+                dev->driver->disconnect(&dev->gadget);
+}
+
+/**
+ * pch_udc_svc_enum_interrupt() - This function handles a USB speed enumeration
+ *                              done interrupt
+ * @dev:        Reference to driver structure
+ */
+static void pch_udc_svc_enum_interrupt(struct pch_udc_dev *dev)
+{
+        u32 dev_stat, dev_speed;
+        u32 speed = USB_SPEED_FULL;
+
+        dev_stat = pch_udc_read_device_status(dev);
+        dev_speed = (dev_stat & UDC_DEVSTS_ENUM_SPEED_MASK) >>
+                                                 UDC_DEVSTS_ENUM_SPEED_SHIFT;
+        switch (dev_speed) {
+        case UDC_DEVSTS_ENUM_SPEED_HIGH:
+                speed = USB_SPEED_HIGH;
+                break;
+        case  UDC_DEVSTS_ENUM_SPEED_FULL:
+                speed = USB_SPEED_FULL;
+                break;
+        case  UDC_DEVSTS_ENUM_SPEED_LOW:
+                speed = USB_SPEED_LOW;
+                break;
+        default:
+                BUG();
+        }
+        dev->gadget.speed = speed;
+        pch_udc_activate_control_ep(dev);
+        pch_udc_enable_ep_interrupts(dev, UDC_EPINT_IN_EP0 | UDC_EPINT_OUT_EP0);
+        pch_udc_set_dma(dev, DMA_DIR_TX);
+        pch_udc_set_dma(dev, DMA_DIR_RX);
+        pch_udc_ep_set_rrdy(&(dev->ep[UDC_EP0OUT_IDX]));
+}
+
+/**
+ * pch_udc_svc_intf_interrupt() - This function handles a set interface
+ *                                interrupt
+ * @dev:        Reference to driver structure
+ */
+static void pch_udc_svc_intf_interrupt(struct pch_udc_dev *dev)
+{
+        u32 reg, dev_stat = 0;
+        int i, ret;
+
+        dev_stat = pch_udc_read_device_status(dev);
+        dev->cfg_data.cur_intf = (dev_stat & UDC_DEVSTS_INTF_MASK) >>
+                                                         UDC_DEVSTS_INTF_SHIFT;
+        dev->cfg_data.cur_alt = (dev_stat & UDC_DEVSTS_ALT_MASK) >>
+                                                         UDC_DEVSTS_ALT_SHIFT;
+        dev->set_cfg_not_acked = 1;
+        /* Construct the usb request for gadget driver and inform it */
+        memset(&dev->setup_data, 0 , sizeof dev->setup_data);
+        dev->setup_data.bRequest = USB_REQ_SET_INTERFACE;
+        dev->setup_data.bRequestType = USB_RECIP_INTERFACE;
+        dev->setup_data.wValue = cpu_to_le16(dev->cfg_data.cur_alt);
+        dev->setup_data.wIndex = cpu_to_le16(dev->cfg_data.cur_intf);
+        /* programm the Endpoint Cfg registers */
+        /* Only one end point cfg register */
+        reg = pch_udc_read_csr(dev, UDC_EP0OUT_IDX);
+        reg = (reg & ~UDC_CSR_NE_INTF_MASK) |
+              (dev->cfg_data.cur_intf << UDC_CSR_NE_INTF_SHIFT);
+        reg = (reg & ~UDC_CSR_NE_ALT_MASK) |
+              (dev->cfg_data.cur_alt << UDC_CSR_NE_ALT_SHIFT);
+        pch_udc_write_csr(dev, reg, UDC_EP0OUT_IDX);
+        for (i = 0; i < PCH_UDC_USED_EP_NUM * 2; i++) {
+                /* clear stall bits */
+                pch_udc_ep_clear_stall(&(dev->ep[i]));
+                dev->ep[i].halted = 0;
+        }
+        dev->stall = 0;
+        spin_unlock(&dev->lock);
+        ret = dev->driver->setup(&dev->gadget, &dev->setup_data);
+        spin_lock(&dev->lock);
+}
+
+/**
+ * pch_udc_svc_cfg_interrupt() - This function handles a set configuration
+ *                              interrupt
+ * @dev:        Reference to driver structure
+ */
+static void pch_udc_svc_cfg_interrupt(struct pch_udc_dev *dev)
+{
+        int i, ret;
+        u32 reg, dev_stat = 0;
+
+        dev_stat = pch_udc_read_device_status(dev);
+        dev->set_cfg_not_acked = 1;
+        dev->cfg_data.cur_cfg = (dev_stat & UDC_DEVSTS_CFG_MASK) >>
+                                UDC_DEVSTS_CFG_SHIFT;
+        /* make usb request for gadget driver */
+        memset(&dev->setup_data, 0 , sizeof dev->setup_data);
+        dev->setup_data.bRequest = USB_REQ_SET_CONFIGURATION;
+        dev->setup_data.wValue = cpu_to_le16(dev->cfg_data.cur_cfg);
+        /* program the NE registers */
+        /* Only one end point cfg register */
+        reg = pch_udc_read_csr(dev, UDC_EP0OUT_IDX);
+        reg = (reg & ~UDC_CSR_NE_CFG_MASK) |
+              (dev->cfg_data.cur_cfg << UDC_CSR_NE_CFG_SHIFT);
+        pch_udc_write_csr(dev, reg, UDC_EP0OUT_IDX);
+        for (i = 0; i < PCH_UDC_USED_EP_NUM * 2; i++) {
+                /* clear stall bits */
+                pch_udc_ep_clear_stall(&(dev->ep[i]));
+                dev->ep[i].halted = 0;
+        }
+        dev->stall = 0;
+
+        /* call gadget zero with setup data received */
+        spin_unlock(&dev->lock);
+        ret = dev->driver->setup(&dev->gadget, &dev->setup_data);
+        spin_lock(&dev->lock);
+}
+
+/**
+ * pch_udc_dev_isr() - This function services device interrupts
+ *                      by invoking appropriate routines.
+ * @dev:        Reference to the device structure
+ * @dev_intr:   The Device interrupt status.
+ */
+static void pch_udc_dev_isr(struct pch_udc_dev *dev, u32 dev_intr)
+{
+        /* USB Reset Interrupt */
+        if (dev_intr & UDC_DEVINT_UR)
+                pch_udc_svc_ur_interrupt(dev);
+        /* Enumeration Done Interrupt */
+        if (dev_intr & UDC_DEVINT_ENUM)
+                pch_udc_svc_enum_interrupt(dev);
+        /* Set Interface Interrupt */
+        if (dev_intr & UDC_DEVINT_SI)
+                pch_udc_svc_intf_interrupt(dev);
+        /* Set Config Interrupt */
+        if (dev_intr & UDC_DEVINT_SC)
+                pch_udc_svc_cfg_interrupt(dev);
+        /* USB Suspend interrupt */
+        if (dev_intr & UDC_DEVINT_US)
+                dev_dbg(&dev->pdev->dev, "USB_SUSPEND\n");
+        /* Clear the SOF interrupt, if enabled */
+        if (dev_intr & UDC_DEVINT_SOF)
+                dev_dbg(&dev->pdev->dev, "SOF\n");
+        /* ES interrupt, IDLE > 3ms on the USB */
+        if (dev_intr & UDC_DEVINT_ES)
+                dev_dbg(&dev->pdev->dev, "ES\n");
+        /* RWKP interrupt */
+        if (dev_intr & UDC_DEVINT_RWKP)
+                dev_dbg(&dev->pdev->dev, "RWKP\n");
+}
+
+/**
+ * pch_udc_isr() - This function handles interrupts from the PCH USB Device
+ * @irq:        Interrupt request number
+ * @dev:        Reference to the device structure
+ */
+static irqreturn_t pch_udc_isr(int irq, void *pdev)
+{
+        struct pch_udc_dev *dev = (struct pch_udc_dev *) pdev;
+        u32 dev_intr, ep_intr;
+        int i;
+
+        dev_intr = pch_udc_read_device_interrupts(dev);
+        ep_intr = pch_udc_read_ep_interrupts(dev);
+
+        if (dev_intr)
+                /* Clear device interrupts */
+                pch_udc_write_device_interrupts(dev, dev_intr);
+        if (ep_intr)
+                /* Clear ep interrupts */
+                pch_udc_write_ep_interrupts(dev, ep_intr);
+        if (!dev_intr && !ep_intr)
+                return IRQ_NONE;
+        spin_lock(&dev->lock);
+        if (dev_intr)
+                pch_udc_dev_isr(dev, dev_intr);
+        if (ep_intr) {
+                pch_udc_read_all_epstatus(dev, ep_intr);
+                /* Process Control In interrupts, if present */
+                if (ep_intr & UDC_EPINT_IN_EP0) {
+                        pch_udc_svc_control_in(dev);
+                        pch_udc_postsvc_epinters(dev, 0);
+                }
+                /* Process Control Out interrupts, if present */
+                if (ep_intr & UDC_EPINT_OUT_EP0)
+                        pch_udc_svc_control_out(dev);
+                /* Process data in end point interrupts */
+                for (i = 1; i < PCH_UDC_USED_EP_NUM; i++) {
+                        if (ep_intr & (1 <<  i)) {
+                                pch_udc_svc_data_in(dev, i);
+                                pch_udc_postsvc_epinters(dev, i);
+                        }
+                }
+                /* Process data out end point interrupts */
+                for (i = UDC_EPINT_OUT_SHIFT + 1; i < (UDC_EPINT_OUT_SHIFT +
+                                                 PCH_UDC_USED_EP_NUM); i++)
+                        if (ep_intr & (1 <<  i))
+                                pch_udc_svc_data_out(dev, i -
+                                                         UDC_EPINT_OUT_SHIFT);
+        }
+        spin_unlock(&dev->lock);
+        return IRQ_HANDLED;
+}
+
+/**
+ * pch_udc_setup_ep0() - This function enables control endpoint for traffic
+ * @dev:        Reference to the device structure
+ */
+static void pch_udc_setup_ep0(struct pch_udc_dev *dev)
+{
+        /* enable ep0 interrupts */
+        pch_udc_enable_ep_interrupts(dev, UDC_EPINT_IN_EP0 |
+                                                UDC_EPINT_OUT_EP0);
+        /* enable device interrupts */
+        pch_udc_enable_interrupts(dev, UDC_DEVINT_UR | UDC_DEVINT_US |
+                                       UDC_DEVINT_ES | UDC_DEVINT_ENUM |
+                                       UDC_DEVINT_SI | UDC_DEVINT_SC);
+}
+
+/**
+ * gadget_release() - Free the gadget driver private data
+ * @pdev        reference to struct pci_dev
+ */
+static void gadget_release(struct device *pdev)
+{
+        struct pch_udc_dev *dev = dev_get_drvdata(pdev);
+
+        kfree(dev);
+}
+
+/**
+ * pch_udc_pcd_reinit() - This API initializes the endpoint structures
+ * @dev:        Reference to the driver structure
+ */
+static void pch_udc_pcd_reinit(struct pch_udc_dev *dev)
+{
+        const char *const ep_string[] = {
+                ep0_string, "ep0out", "ep1in", "ep1out", "ep2in", "ep2out",
+                "ep3in", "ep3out", "ep4in", "ep4out", "ep5in", "ep5out",
+                "ep6in", "ep6out", "ep7in", "ep7out", "ep8in", "ep8out",
+                "ep9in", "ep9out", "ep10in", "ep10out", "ep11in", "ep11out",
+                "ep12in", "ep12out", "ep13in", "ep13out", "ep14in", "ep14out",
+                "ep15in", "ep15out",
+        };
+        int i;
+
+        dev->gadget.speed = USB_SPEED_UNKNOWN;
+        INIT_LIST_HEAD(&dev->gadget.ep_list);
+
+        /* Initialize the endpoints structures */
+        memset(dev->ep, 0, sizeof dev->ep);
+        for (i = 0; i < PCH_UDC_EP_NUM; i++) {
+                struct pch_udc_ep *ep = &dev->ep[i];
+                ep->dev = dev;
+                ep->halted = 1;
+                ep->num = i / 2;
+                ep->in = ~i & 1;
+                ep->ep.name = ep_string[i];
+                ep->ep.ops = &pch_udc_ep_ops;
+                if (ep->in)
+                        ep->offset_addr = ep->num * UDC_EP_REG_SHIFT;
+                else
+                        ep->offset_addr = (UDC_EPINT_OUT_SHIFT + ep->num) *
+                                          UDC_EP_REG_SHIFT;
+                /* need to set ep->ep.maxpacket and set Default Configuration?*/
+                ep->ep.maxpacket = UDC_BULK_MAX_PKT_SIZE;
+                list_add_tail(&ep->ep.ep_list, &dev->gadget.ep_list);
+                INIT_LIST_HEAD(&ep->queue);
+        }
+        dev->ep[UDC_EP0IN_IDX].ep.maxpacket = UDC_EP0IN_MAX_PKT_SIZE;
+        dev->ep[UDC_EP0OUT_IDX].ep.maxpacket = UDC_EP0OUT_MAX_PKT_SIZE;
+
+        /* remove ep0 in and out from the list.  They have own pointer */
+        list_del_init(&dev->ep[UDC_EP0IN_IDX].ep.ep_list);
+        list_del_init(&dev->ep[UDC_EP0OUT_IDX].ep.ep_list);
+
+        dev->gadget.ep0 = &dev->ep[UDC_EP0IN_IDX].ep;
+        INIT_LIST_HEAD(&dev->gadget.ep0->ep_list);
+}
+
+/**
+ * pch_udc_pcd_init() - This API initializes the driver structure
+ * @dev:        Reference to the driver structure
+ *
+ * Return codes:
+ *      0: Success
+ */
+static int pch_udc_pcd_init(struct pch_udc_dev *dev)
+{
+        pch_udc_init(dev);
+        pch_udc_pcd_reinit(dev);
+        return 0;
+}
+
+/**
+ * init_dma_pools() - create dma pools during initialization
+ * @pdev:       reference to struct pci_dev
+ */
+static int init_dma_pools(struct pch_udc_dev *dev)
+{
+        struct pch_udc_stp_dma_desc     *td_stp;
+        struct pch_udc_data_dma_desc    *td_data;
+
+        /* DMA setup */
+        dev->data_requests = pci_pool_create("data_requests", dev->pdev,
+                sizeof(struct pch_udc_data_dma_desc), 0, 0);
+        if (!dev->data_requests) {
+                dev_err(&dev->pdev->dev, "%s: can't get request data pool\n",
+                        __func__);
+                return -ENOMEM;
+        }
+
+        /* dma desc for setup data */
+        dev->stp_requests = pci_pool_create("setup requests", dev->pdev,
+                sizeof(struct pch_udc_stp_dma_desc), 0, 0);
+        if (!dev->stp_requests) {
+                dev_err(&dev->pdev->dev, "%s: can't get setup request pool\n",
+                        __func__);
+                return -ENOMEM;
+        }
+        /* setup */
+        td_stp = pci_pool_alloc(dev->stp_requests, GFP_KERNEL,
+                                &dev->ep[UDC_EP0OUT_IDX].td_stp_phys);
+        if (!td_stp) {
+                dev_err(&dev->pdev->dev,
+                        "%s: can't allocate setup dma descriptor\n", __func__);
+                return -ENOMEM;
+        }
+        dev->ep[UDC_EP0OUT_IDX].td_stp = td_stp;
+
+        /* data: 0 packets !? */
+        td_data = pci_pool_alloc(dev->data_requests, GFP_KERNEL,
+                                &dev->ep[UDC_EP0OUT_IDX].td_data_phys);
+        if (!td_data) {
+                dev_err(&dev->pdev->dev,
+                        "%s: can't allocate data dma descriptor\n", __func__);
+                return -ENOMEM;
+        }
+        dev->ep[UDC_EP0OUT_IDX].td_data = td_data;
+        dev->ep[UDC_EP0IN_IDX].td_stp = NULL;
+        dev->ep[UDC_EP0IN_IDX].td_stp_phys = 0;
+        dev->ep[UDC_EP0IN_IDX].td_data = NULL;
+        dev->ep[UDC_EP0IN_IDX].td_data_phys = 0;
+
+        dev->ep0out_buf = kzalloc(UDC_EP0OUT_BUFF_SIZE * 4, GFP_KERNEL);
+        if (!dev->ep0out_buf)
+                return -ENOMEM;
+        dev->dma_addr = dma_map_single(&dev->pdev->dev, dev->ep0out_buf,
+                                       UDC_EP0OUT_BUFF_SIZE * 4,
+                                       DMA_FROM_DEVICE);
+        return 0;
+}
+
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+        int (*bind)(struct usb_gadget *))
+{
+        struct pch_udc_dev      *dev = pch_udc;
+        int                     retval;
+
+        if (!driver || (driver->speed == USB_SPEED_UNKNOWN) || !bind ||
+            !driver->setup || !driver->unbind || !driver->disconnect) {
+                dev_err(&dev->pdev->dev,
+                        "%s: invalid driver parameter\n", __func__);
+                return -EINVAL;
+        }
+
+        if (!dev)
+                return -ENODEV;
+
+        if (dev->driver) {
+                dev_err(&dev->pdev->dev, "%s: already bound\n", __func__);
+                return -EBUSY;
+        }
+        driver->driver.bus = NULL;
+        dev->driver = driver;
+        dev->gadget.dev.driver = &driver->driver;
+
+        /* Invoke the bind routine of the gadget driver */
+        retval = bind(&dev->gadget);
+
+        if (retval) {
+                dev_err(&dev->pdev->dev, "%s: binding to %s returning %d\n",
+                       __func__, driver->driver.name, retval);
+                dev->driver = NULL;
+                dev->gadget.dev.driver = NULL;
+                return retval;
+        }
+        /* get ready for ep0 traffic */
+        pch_udc_setup_ep0(dev);
+
+        /* clear SD */
+        pch_udc_clear_disconnect(dev);
+
+        dev->connected = 1;
+        return 0;
+}
+EXPORT_SYMBOL(usb_gadget_probe_driver);
+
+int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
+{
+        struct pch_udc_dev      *dev = pch_udc;
+
+        if (!dev)
+                return -ENODEV;
+
+        if (!driver || (driver != dev->driver)) {
+                dev_err(&dev->pdev->dev,
+                        "%s: invalid driver parameter\n", __func__);
+                return -EINVAL;
+        }
+
+        pch_udc_disable_interrupts(dev, UDC_DEVINT_MSK);
+
+        /* Assures that there are no pending requests with this driver */
+        driver->disconnect(&dev->gadget);
+        driver->unbind(&dev->gadget);
+        dev->gadget.dev.driver = NULL;
+        dev->driver = NULL;
+        dev->connected = 0;
+
+        /* set SD */
+        pch_udc_set_disconnect(dev);
+        return 0;
+}
+EXPORT_SYMBOL(usb_gadget_unregister_driver);
+
+static void pch_udc_shutdown(struct pci_dev *pdev)
+{
+        struct pch_udc_dev *dev = pci_get_drvdata(pdev);
+
+        pch_udc_disable_interrupts(dev, UDC_DEVINT_MSK);
+        pch_udc_disable_ep_interrupts(dev, UDC_EPINT_MSK_DISABLE_ALL);
+
+        /* disable the pullup so the host will think we're gone */
+        pch_udc_set_disconnect(dev);
+}
+
+static void pch_udc_remove(struct pci_dev *pdev)
+{
+        struct pch_udc_dev      *dev = pci_get_drvdata(pdev);
+
+        /* gadget driver must not be registered */
+        if (dev->driver)
+                dev_err(&pdev->dev,
+                        "%s: gadget driver still bound!!!\n", __func__);
+        /* dma pool cleanup */
+        if (dev->data_requests)
+                pci_pool_destroy(dev->data_requests);
+
+        if (dev->stp_requests) {
+                /* cleanup DMA desc's for ep0in */
+                if (dev->ep[UDC_EP0OUT_IDX].td_stp) {
+                        pci_pool_free(dev->stp_requests,
+                                dev->ep[UDC_EP0OUT_IDX].td_stp,
+                                dev->ep[UDC_EP0OUT_IDX].td_stp_phys);
+                }
+                if (dev->ep[UDC_EP0OUT_IDX].td_data) {
+                        pci_pool_free(dev->stp_requests,
+                                dev->ep[UDC_EP0OUT_IDX].td_data,
+                                dev->ep[UDC_EP0OUT_IDX].td_data_phys);
+                }
+                pci_pool_destroy(dev->stp_requests);
+        }
+
+        if (dev->dma_addr)
+                dma_unmap_single(&dev->pdev->dev, dev->dma_addr,
+                                 UDC_EP0OUT_BUFF_SIZE * 4, DMA_FROM_DEVICE);
+        kfree(dev->ep0out_buf);
+
+        pch_udc_exit(dev);
+
+        if (dev->irq_registered)
+                free_irq(pdev->irq, dev);
+        if (dev->base_addr)
+                iounmap(dev->base_addr);
+        if (dev->mem_region)
+                release_mem_region(dev->phys_addr,
+                                   pci_resource_len(pdev, PCH_UDC_PCI_BAR));
+        if (dev->active)
+                pci_disable_device(pdev);
+        if (dev->registered)
+                device_unregister(&dev->gadget.dev);
+        kfree(dev);
+        pci_set_drvdata(pdev, NULL);
+}
+
+#ifdef CONFIG_PM
+static int pch_udc_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+        struct pch_udc_dev *dev = pci_get_drvdata(pdev);
+
+        pch_udc_disable_interrupts(dev, UDC_DEVINT_MSK);
+        pch_udc_disable_ep_interrupts(dev, UDC_EPINT_MSK_DISABLE_ALL);
+
+        pci_disable_device(pdev);
+        pci_enable_wake(pdev, PCI_D3hot, 0);
+
+        if (pci_save_state(pdev)) {
+                dev_err(&pdev->dev,
+                        "%s: could not save PCI config state\n", __func__);
+                return -ENOMEM;
+        }
+        pci_set_power_state(pdev, pci_choose_state(pdev, state));
+        return 0;
+}
+
+static int pch_udc_resume(struct pci_dev *pdev)
+{
+        int ret;
+
+        pci_set_power_state(pdev, PCI_D0);
+        pci_restore_state(pdev);
+        ret = pci_enable_device(pdev);
+        if (ret) {
+                dev_err(&pdev->dev, "%s: pci_enable_device failed\n", __func__);
+                return ret;
+        }
+        pci_enable_wake(pdev, PCI_D3hot, 0);
+        return 0;
+}
+#else
+#define pch_udc_suspend NULL
+#define pch_udc_resume  NULL
+#endif /* CONFIG_PM */
+
+static int pch_udc_probe(struct pci_dev *pdev,
+                          const struct pci_device_id *id)
+{
+        unsigned long           resource;
+        unsigned long           len;
+        int                     retval;
+        struct pch_udc_dev      *dev;
+
+        /* one udc only */
+        if (pch_udc) {
+                pr_err("%s: already probed\n", __func__);
+                return -EBUSY;
+        }
+        /* init */
+        dev = kzalloc(sizeof *dev, GFP_KERNEL);
+        if (!dev) {
+                pr_err("%s: no memory for device structure\n", __func__);
+                return -ENOMEM;
+        }
+        /* pci setup */
+        if (pci_enable_device(pdev) < 0) {
+                kfree(dev);
+                pr_err("%s: pci_enable_device failed\n", __func__);
+                return -ENODEV;
+        }
+        dev->active = 1;
+        pci_set_drvdata(pdev, dev);
+
+        /* PCI resource allocation */
+        resource = pci_resource_start(pdev, 1);
+        len = pci_resource_len(pdev, 1);
+
+        if (!request_mem_region(resource, len, KBUILD_MODNAME)) {
+                dev_err(&pdev->dev, "%s: pci device used already\n", __func__);
+                retval = -EBUSY;
+                goto finished;
+        }
+        dev->phys_addr = resource;
+        dev->mem_region = 1;
+
+        dev->base_addr = ioremap_nocache(resource, len);
+        if (!dev->base_addr) {
+                pr_err("%s: device memory cannot be mapped\n", __func__);
+                retval = -ENOMEM;
+                goto finished;
+        }
+        if (!pdev->irq) {
+                dev_err(&pdev->dev, "%s: irq not set\n", __func__);
+                retval = -ENODEV;
+                goto finished;
+        }
+        pch_udc = dev;
+        /* initialize the hardware */
+        if (pch_udc_pcd_init(dev))
+                goto finished;
+        if (request_irq(pdev->irq, pch_udc_isr, IRQF_SHARED, KBUILD_MODNAME,
+                        dev)) {
+                dev_err(&pdev->dev, "%s: request_irq(%d) fail\n", __func__,
+                        pdev->irq);
+                retval = -ENODEV;
+                goto finished;
+        }
+        dev->irq = pdev->irq;
+        dev->irq_registered = 1;
+
+        pci_set_master(pdev);
+        pci_try_set_mwi(pdev);
+
+        /* device struct setup */
+        spin_lock_init(&dev->lock);
+        dev->pdev = pdev;
+        dev->gadget.ops = &pch_udc_ops;
+
+        retval = init_dma_pools(dev);
+        if (retval)
+                goto finished;
+
+        dev_set_name(&dev->gadget.dev, "gadget");
+        dev->gadget.dev.parent = &pdev->dev;
+        dev->gadget.dev.dma_mask = pdev->dev.dma_mask;
+        dev->gadget.dev.release = gadget_release;
+        dev->gadget.name = KBUILD_MODNAME;
+        dev->gadget.is_dualspeed = 1;
+
+        retval = device_register(&dev->gadget.dev);
+        if (retval)
+                goto finished;
+        dev->registered = 1;
+
+        /* Put the device in disconnected state till a driver is bound */
+        pch_udc_set_disconnect(dev);
+        return 0;
+
+finished:
+        pch_udc_remove(pdev);
+        return retval;
+}
+
+static DEFINE_PCI_DEVICE_TABLE(pch_udc_pcidev_id) = {
+        {
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_EG20T_UDC),
+                .class = (PCI_CLASS_SERIAL_USB << 8) | 0xfe,
+                .class_mask = 0xffffffff,
+        },
+        {
+                PCI_DEVICE(PCI_VENDOR_ID_ROHM, PCI_DEVICE_ID_ML7213_IOH_UDC),
+                .class = (PCI_CLASS_SERIAL_USB << 8) | 0xfe,
+                .class_mask = 0xffffffff,
+        },
+        { 0 },
+};
+
+MODULE_DEVICE_TABLE(pci, pch_udc_pcidev_id);
+
+
+static struct pci_driver pch_udc_driver = {
+        .name = KBUILD_MODNAME,
+        .id_table =     pch_udc_pcidev_id,
+        .probe =        pch_udc_probe,
+        .remove =       pch_udc_remove,
+        .suspend =      pch_udc_suspend,
+        .resume =       pch_udc_resume,
+        .shutdown =     pch_udc_shutdown,
+};
+
+static int __init pch_udc_pci_init(void)
+{
+        return pci_register_driver(&pch_udc_driver);
+}
+module_init(pch_udc_pci_init);
+
+static void __exit pch_udc_pci_exit(void)
+{
+        pci_unregister_driver(&pch_udc_driver);
+}
+module_exit(pch_udc_pci_exit);
+
+MODULE_DESCRIPTION("Intel EG20T USB Device Controller");
+MODULE_AUTHOR("OKI SEMICONDUCTOR, <toshiharu-linux@dsn.okisemi.com>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/usb/gadget/printer.c b/drivers/usb/gadget/printer.c
index cf241c371a71..271ef94668e7 100644
--- a/drivers/usb/gadget/printer.c
+++ b/drivers/usb/gadget/printer.c
@@ -126,36 +126,36 @@ static struct printer_dev usb_printer_gadget;
 #define PRINTER_VENDOR_NUM      0x0525          /* NetChip */
 #define PRINTER_PRODUCT_NUM     0xa4a8          /* Linux-USB Printer Gadget */
 
-/* Some systems will want different product identifers published in the
+/* Some systems will want different product identifiers published in the
  * device descriptor, either numbers or strings or both.  These string
  * parameters are in UTF-8 (superset of ASCII's 7 bit characters).
  */
 
-static ushort __initdata idVendor;
+static ushort idVendor;
 module_param(idVendor, ushort, S_IRUGO);
 MODULE_PARM_DESC(idVendor, "USB Vendor ID");
 
-static ushort __initdata idProduct;
+static ushort idProduct;
 module_param(idProduct, ushort, S_IRUGO);
 MODULE_PARM_DESC(idProduct, "USB Product ID");
 
-static ushort __initdata bcdDevice;
+static ushort bcdDevice;
 module_param(bcdDevice, ushort, S_IRUGO);
 MODULE_PARM_DESC(bcdDevice, "USB Device version (BCD)");
 
-static char *__initdata iManufacturer;
+static char *iManufacturer;
 module_param(iManufacturer, charp, S_IRUGO);
 MODULE_PARM_DESC(iManufacturer, "USB Manufacturer string");
 
-static char *__initdata iProduct;
+static char *iProduct;
 module_param(iProduct, charp, S_IRUGO);
 MODULE_PARM_DESC(iProduct, "USB Product string");
 
-static char *__initdata iSerialNum;
+static char *iSerialNum;
 module_param(iSerialNum, charp, S_IRUGO);
 MODULE_PARM_DESC(iSerialNum, "1");
 
-static char *__initdata iPNPstring;
+static char *iPNPstring;
 module_param(iPNPstring, charp, S_IRUGO);
 MODULE_PARM_DESC(iPNPstring, "MFG:linux;MDL:g_printer;CLS:PRINTER;SN:1;");
 
@@ -884,7 +884,8 @@ static const struct file_operations printer_io_operations = {
         .fsync =        printer_fsync,
         .poll =         printer_poll,
         .unlocked_ioctl = printer_ioctl,
-        .release =      printer_close
+        .release =      printer_close,
+        .llseek =       noop_llseek,
 };
 
 /*-------------------------------------------------------------------------*/
@@ -1188,6 +1189,8 @@ printer_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
                         else if (gadget->a_alt_hnp_support)
                                 DBG(dev, "HNP needs a different root port\n");
                         value = printer_set_config(dev, wValue);
+                        if (!value)
+                                value = set_interface(dev, PRINTER_INTERFACE);
                         break;
                 case USB_REQ_GET_CONFIGURATION:
                         if (ctrl->bRequestType != USB_DIR_IN)
@@ -1347,7 +1350,7 @@ printer_unbind(struct usb_gadget *gadget)
         set_gadget_data(gadget, NULL);
 }
 
-static int __ref
+static int __init
 printer_bind(struct usb_gadget *gadget)
 {
         struct printer_dev      *dev;
@@ -1543,7 +1546,6 @@ static struct usb_gadget_driver printer_driver = {
         .speed          = DEVSPEED,
 
         .function       = (char *) driver_desc,
-        .bind           = printer_bind,
         .unbind         = printer_unbind,
 
         .setup          = printer_setup,
@@ -1579,11 +1581,11 @@ init(void)
                 return status;
         }
 
-        status = usb_gadget_register_driver(&printer_driver);
+        status = usb_gadget_probe_driver(&printer_driver, printer_bind);
         if (status) {
                 class_destroy(usb_gadget_class);
                 unregister_chrdev_region(g_printer_devno, 1);
-                DBG(dev, "usb_gadget_register_driver %x\n", status);
+                DBG(dev, "usb_gadget_probe_driver %x\n", status);
         }
 
         return status;
@@ -1596,13 +1598,12 @@ cleanup(void)
         int status;
 
         mutex_lock(&usb_printer_gadget.lock_printer_io);
-        class_destroy(usb_gadget_class);
-        unregister_chrdev_region(g_printer_devno, 2);
-
         status = usb_gadget_unregister_driver(&printer_driver);
         if (status)
                 ERROR(dev, "usb_gadget_unregister_driver %x\n", status);
 
+        unregister_chrdev_region(g_printer_devno, 2);
+        class_destroy(usb_gadget_class);
         mutex_unlock(&usb_printer_gadget.lock_printer_io);
 }
 module_exit(cleanup);
diff --git a/drivers/usb/gadget/pxa25x_udc.c b/drivers/usb/gadget/pxa25x_udc.c
index be5fb34d9602..774545494cf2 100644
--- a/drivers/usb/gadget/pxa25x_udc.c
+++ b/drivers/usb/gadget/pxa25x_udc.c
@@ -46,6 +46,7 @@
 #include <linux/seq_file.h>
 #include <linux/debugfs.h>
 #include <linux/io.h>
+#include <linux/prefetch.h>
 
 #include <asm/byteorder.h>
 #include <asm/dma.h>
@@ -139,24 +140,6 @@ static const char ep0name [] = "ep0";
 static void pxa25x_ep_fifo_flush (struct usb_ep *ep);
 static void nuke (struct pxa25x_ep *, int status);
 
-/* one GPIO should be used to detect VBUS from the host */
-static int is_vbus_present(void)
-{
-        struct pxa2xx_udc_mach_info             *mach = the_controller->mach;
-
-        if (gpio_is_valid(mach->gpio_vbus)) {
-                int value = gpio_get_value(mach->gpio_vbus);
-
-                if (mach->gpio_vbus_inverted)
-                        return !value;
-                else
-                        return !!value;
-        }
-        if (mach->udc_is_connected)
-                return mach->udc_is_connected();
-        return 1;
-}
-
 /* one GPIO should control a D+ pullup, so host sees this device (or not) */
 static void pullup_off(void)
 {
@@ -1055,7 +1038,7 @@ udc_seq_show(struct seq_file *m, void *_d)
                 "%s version: %s\nGadget driver: %s\nHost %s\n\n",
                 driver_name, DRIVER_VERSION SIZE_STR "(pio)",
                 dev->driver ? dev->driver->driver.name : "(none)",
-                is_vbus_present() ? "full speed" : "disconnected");
+                dev->gadget.speed == USB_SPEED_FULL ? "full speed" : "disconnected");
 
         /* registers for device and ep0 */
         seq_printf(m,
@@ -1094,7 +1077,7 @@ udc_seq_show(struct seq_file *m, void *_d)
                         (tmp & UDCCFR_ACM) ? " acm" : "");
         }
 
-        if (!is_vbus_present() || !dev->driver)
+        if (dev->gadget.speed != USB_SPEED_FULL || !dev->driver)
                 goto done;
 
         seq_printf(m, "ep0 IN %lu/%lu, OUT %lu/%lu\nirqs %lu\n\n",
@@ -1280,14 +1263,15 @@ static void udc_enable (struct pxa25x_udc *dev)
  * disconnect is reported.  then a host may connect again, or
  * the driver might get unbound.
  */
-int usb_gadget_register_driver(struct usb_gadget_driver *driver)
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
 {
         struct pxa25x_udc       *dev = the_controller;
         int                     retval;
 
         if (!driver
                         || driver->speed < USB_SPEED_FULL
-                        || !driver->bind
+                        || !bind
                         || !driver->disconnect
                         || !driver->setup)
                 return -EINVAL;
@@ -1308,7 +1292,7 @@ fail:
                 dev->gadget.dev.driver = NULL;
                 return retval;
         }
-        retval = driver->bind(&dev->gadget);
+        retval = bind(&dev->gadget);
         if (retval) {
                 DMSG("bind to driver %s --> error %d\n",
                                 driver->driver.name, retval);
@@ -1338,7 +1322,7 @@ fail:
 bind_fail:
         return retval;
 }
-EXPORT_SYMBOL(usb_gadget_register_driver);
+EXPORT_SYMBOL(usb_gadget_probe_driver);
 
 static void
 stop_activity(struct pxa25x_udc *dev, struct usb_gadget_driver *driver)
@@ -1434,14 +1418,6 @@ lubbock_vbus_irq(int irq, void *_dev)
 
 #endif
 
-static irqreturn_t udc_vbus_irq(int irq, void *_dev)
-{
-        struct pxa25x_udc       *dev = _dev;
-
-        pxa25x_udc_vbus_session(&dev->gadget, is_vbus_present());
-        return IRQ_HANDLED;
-}
-
 
 /*-------------------------------------------------------------------------*/
 
@@ -1765,12 +1741,9 @@ pxa25x_udc_irq(int irq, void *_dev)
                 if (unlikely(udccr & UDCCR_SUSIR)) {
                         udc_ack_int_UDCCR(UDCCR_SUSIR);
                         handled = 1;
-                        DBG(DBG_VERBOSE, "USB suspend%s\n", is_vbus_present()
-                                ? "" : "+disconnect");
+                        DBG(DBG_VERBOSE, "USB suspend\n");
 
-                        if (!is_vbus_present())
-                                stop_activity(dev, dev->driver);
-                        else if (dev->gadget.speed != USB_SPEED_UNKNOWN
+                        if (dev->gadget.speed != USB_SPEED_UNKNOWN
                                         && dev->driver
                                         && dev->driver->suspend)
                                 dev->driver->suspend(&dev->gadget);
@@ -1785,8 +1758,7 @@ pxa25x_udc_irq(int irq, void *_dev)
 
                         if (dev->gadget.speed != USB_SPEED_UNKNOWN
                                         && dev->driver
-                                        && dev->driver->resume
-                                        && is_vbus_present())
+                                        && dev->driver->resume)
                                 dev->driver->resume(&dev->gadget);
                 }
 
@@ -2136,7 +2108,7 @@ static struct pxa25x_udc memory = {
 static int __init pxa25x_udc_probe(struct platform_device *pdev)
 {
         struct pxa25x_udc *dev = &memory;
-        int retval, vbus_irq, irq;
+        int retval, irq;
         u32 chiprev;
 
         /* insist on Intel/ARM/XScale */
@@ -2198,19 +2170,6 @@ static int __init pxa25x_udc_probe(struct platform_device *pdev)
 
         dev->transceiver = otg_get_transceiver();
 
-        if (gpio_is_valid(dev->mach->gpio_vbus)) {
-                if ((retval = gpio_request(dev->mach->gpio_vbus,
-                                "pxa25x_udc GPIO VBUS"))) {
-                        dev_dbg(&pdev->dev,
-                                "can't get vbus gpio %d, err: %d\n",
-                                dev->mach->gpio_vbus, retval);
-                        goto err_gpio_vbus;
-                }
-                gpio_direction_input(dev->mach->gpio_vbus);
-                vbus_irq = gpio_to_irq(dev->mach->gpio_vbus);
-        } else
-                vbus_irq = 0;
-
         if (gpio_is_valid(dev->mach->gpio_pullup)) {
                 if ((retval = gpio_request(dev->mach->gpio_pullup,
                                 "pca25x_udc GPIO PULLUP"))) {
@@ -2236,7 +2195,7 @@ static int __init pxa25x_udc_probe(struct platform_device *pdev)
         udc_disable(dev);
         udc_reinit(dev);
 
-        dev->vbus = !!is_vbus_present();
+        dev->vbus = 0;
 
         /* irq setup after old hardware state is cleaned up */
         retval = request_irq(irq, pxa25x_udc_irq,
@@ -2257,7 +2216,6 @@ static int __init pxa25x_udc_probe(struct platform_device *pdev)
                 if (retval != 0) {
                         pr_err("%s: can't get irq %i, err %d\n",
                                 driver_name, LUBBOCK_USB_DISC_IRQ, retval);
-lubbock_fail0:
                         goto err_irq_lub;
                 }
                 retval = request_irq(LUBBOCK_USB_IRQ,
@@ -2267,39 +2225,24 @@ lubbock_fail0:
                 if (retval != 0) {
                         pr_err("%s: can't get irq %i, err %d\n",
                                 driver_name, LUBBOCK_USB_IRQ, retval);
-                        free_irq(LUBBOCK_USB_DISC_IRQ, dev);
                         goto lubbock_fail0;
                 }
         } else
 #endif
-        if (vbus_irq) {
-                retval = request_irq(vbus_irq, udc_vbus_irq,
-                                IRQF_DISABLED | IRQF_SAMPLE_RANDOM |
-                                IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
-                                driver_name, dev);
-                if (retval != 0) {
-                        pr_err("%s: can't get irq %i, err %d\n",
-                                driver_name, vbus_irq, retval);
-                        goto err_vbus_irq;
-                }
-        }
         create_debug_files(dev);
 
         return 0;
 
- err_vbus_irq:
 #ifdef  CONFIG_ARCH_LUBBOCK
+lubbock_fail0:
         free_irq(LUBBOCK_USB_DISC_IRQ, dev);
  err_irq_lub:
-#endif
         free_irq(irq, dev);
+#endif
  err_irq1:
         if (gpio_is_valid(dev->mach->gpio_pullup))
                 gpio_free(dev->mach->gpio_pullup);
  err_gpio_pullup:
-        if (gpio_is_valid(dev->mach->gpio_vbus))
-                gpio_free(dev->mach->gpio_vbus);
- err_gpio_vbus:
         if (dev->transceiver) {
                 otg_put_transceiver(dev->transceiver);
                 dev->transceiver = NULL;
@@ -2336,10 +2279,6 @@ static int __exit pxa25x_udc_remove(struct platform_device *pdev)
                 free_irq(LUBBOCK_USB_IRQ, dev);
         }
 #endif
-        if (gpio_is_valid(dev->mach->gpio_vbus)) {
-                free_irq(gpio_to_irq(dev->mach->gpio_vbus), dev);
-                gpio_free(dev->mach->gpio_vbus);
-        }
         if (gpio_is_valid(dev->mach->gpio_pullup))
                 gpio_free(dev->mach->gpio_pullup);
 
diff --git a/drivers/usb/gadget/pxa27x_udc.c b/drivers/usb/gadget/pxa27x_udc.c
index 980762453a9c..57607696735c 100644
--- a/drivers/usb/gadget/pxa27x_udc.c
+++ b/drivers/usb/gadget/pxa27x_udc.c
@@ -32,6 +32,7 @@
 #include <linux/irq.h>
 #include <linux/gpio.h>
 #include <linux/slab.h>
+#include <linux/prefetch.h>
 
 #include <asm/byteorder.h>
 #include <mach/hardware.h>
@@ -602,7 +603,7 @@ static void inc_ep_stats_reqs(struct pxa_ep *ep, int is_in)
 /**
  * inc_ep_stats_bytes - Update ep stats counts
  * @ep: physical endpoint
- * @count: bytes transfered on endpoint
+ * @count: bytes transferred on endpoint
  * @is_in: ep direction (USB_DIR_IN or 0)
  */
 static void inc_ep_stats_bytes(struct pxa_ep *ep, int count, int is_in)
@@ -877,7 +878,7 @@ static void nuke(struct pxa_ep *ep, int status)
  * If there is less space in request than bytes received in OUT endpoint,
  * bytes are left in the OUT endpoint.
  *
- * Returns how many bytes were actually transfered
+ * Returns how many bytes were actually transferred
  */
 static int read_packet(struct pxa_ep *ep, struct pxa27x_request *req)
 {
@@ -914,7 +915,7 @@ static int read_packet(struct pxa_ep *ep, struct pxa27x_request *req)
  * endpoint. If there are no bytes to transfer, doesn't write anything
  * to physical endpoint.
  *
- * Returns how many bytes were actually transfered.
+ * Returns how many bytes were actually transferred.
  */
 static int write_packet(struct pxa_ep *ep, struct pxa27x_request *req,
                         unsigned int max)
@@ -991,7 +992,7 @@ static int read_fifo(struct pxa_ep *ep, struct pxa27x_request *req)
  * caller guarantees at least one packet buffer is ready (or a zlp).
  * Doesn't complete the request, that's the caller's job
  *
- * Returns 1 if request fully transfered, 0 if partial transfer
+ * Returns 1 if request fully transferred, 0 if partial transfer
  */
 static int write_fifo(struct pxa_ep *ep, struct pxa27x_request *req)
 {
@@ -1094,7 +1095,7 @@ static int read_ep0_fifo(struct pxa_ep *ep, struct pxa27x_request *req)
  * Sends a request (or a part of the request) to the control endpoint (ep0 in).
  * If the request doesn't fit, the remaining part will be sent from irq.
  * The request is considered fully written only if either :
- *   - last write transfered all remaining bytes, but fifo was not fully filled
+ *   - last write transferred all remaining bytes, but fifo was not fully filled
  *   - last write was a 0 length write
  *
  * Returns 1 if request fully written, 0 if request only partially sent
@@ -1394,8 +1395,6 @@ static void pxa_ep_fifo_flush(struct usb_ep *_ep)
         }
 
         spin_unlock_irqrestore(&ep->lock, flags);
-
-        return;
 }
 
 /**
@@ -1550,7 +1549,7 @@ static int pxa_udc_get_frame(struct usb_gadget *_gadget)
  * pxa_udc_wakeup - Force udc device out of suspend
  * @_gadget: usb gadget
  *
- * Returns 0 if successfull, error code otherwise
+ * Returns 0 if successful, error code otherwise
  */
 static int pxa_udc_wakeup(struct usb_gadget *_gadget)
 {
@@ -1792,8 +1791,9 @@ static void udc_enable(struct pxa_udc *udc)
 }
 
 /**
- * usb_gadget_register_driver - Register gadget driver
+ * usb_gadget_probe_driver - Register gadget driver
  * @driver: gadget driver
+ * @bind: bind function
  *
  * When a driver is successfully registered, it will receive control requests
  * including set_configuration(), which enables non-control requests.  Then
@@ -1805,12 +1805,13 @@ static void udc_enable(struct pxa_udc *udc)
  *
  * Returns 0 if no error, -EINVAL, -ENODEV, -EBUSY otherwise
  */
-int usb_gadget_register_driver(struct usb_gadget_driver *driver)
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
 {
         struct pxa_udc *udc = the_controller;
         int retval;
 
-        if (!driver || driver->speed < USB_SPEED_FULL || !driver->bind
+        if (!driver || driver->speed < USB_SPEED_FULL || !bind
                         || !driver->disconnect || !driver->setup)
                 return -EINVAL;
         if (!udc)
@@ -1828,7 +1829,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
                 dev_err(udc->dev, "device_add error %d\n", retval);
                 goto add_fail;
         }
-        retval = driver->bind(&udc->gadget);
+        retval = bind(&udc->gadget);
         if (retval) {
                 dev_err(udc->dev, "bind to driver %s --> error %d\n",
                         driver->driver.name, retval);
@@ -1859,7 +1860,7 @@ add_fail:
         udc->gadget.dev.driver = NULL;
         return retval;
 }
-EXPORT_SYMBOL(usb_gadget_register_driver);
+EXPORT_SYMBOL(usb_gadget_probe_driver);
 
 
 /**
diff --git a/drivers/usb/gadget/r8a66597-udc.c b/drivers/usb/gadget/r8a66597-udc.c
index 2456ccd9965e..6dcc1f68fa60 100644
--- a/drivers/usb/gadget/r8a66597-udc.c
+++ b/drivers/usb/gadget/r8a66597-udc.c
@@ -42,6 +42,7 @@ static const char *r8a66597_ep_name[] = {
         "ep8", "ep9",
 };
 
+static void init_controller(struct r8a66597 *r8a66597);
 static void disable_controller(struct r8a66597 *r8a66597);
 static void irq_ep0_write(struct r8a66597_ep *ep, struct r8a66597_request *req);
 static void irq_packet_write(struct r8a66597_ep *ep,
@@ -104,6 +105,8 @@ __acquires(r8a66597->lock)
         spin_lock(&r8a66597->lock);
 
         disable_controller(r8a66597);
+        init_controller(r8a66597);
+        r8a66597_bset(r8a66597, VBSE, INTENB0);
         INIT_LIST_HEAD(&r8a66597->ep[0].queue);
 }
 
@@ -255,7 +258,7 @@ static int pipe_buffer_setting(struct r8a66597 *r8a66597,
                 break;
         case R8A66597_BULK:
                 /* isochronous pipes may be used as bulk pipes */
-                if (info->pipe > R8A66597_BASE_PIPENUM_BULK)
+                if (info->pipe >= R8A66597_BASE_PIPENUM_BULK)
                         bufnum = info->pipe - R8A66597_BASE_PIPENUM_BULK;
                 else
                         bufnum = info->pipe - R8A66597_BASE_PIPENUM_ISOC;
@@ -274,7 +277,7 @@ static int pipe_buffer_setting(struct r8a66597 *r8a66597,
         }
 
         if (buf_bsize && ((bufnum + 16) >= R8A66597_MAX_BUFNUM)) {
-                pr_err(KERN_ERR "r8a66597 pipe memory is insufficient\n");
+                pr_err("r8a66597 pipe memory is insufficient\n");
                 return -ENOMEM;
         }
 
@@ -1080,7 +1083,9 @@ static void irq_device_state(struct r8a66597 *r8a66597)
 
         if (dvsq == DS_DFLT) {
                 /* bus reset */
+                spin_unlock(&r8a66597->lock);
                 r8a66597->driver->disconnect(&r8a66597->gadget);
+                spin_lock(&r8a66597->lock);
                 r8a66597_update_usb_speed(r8a66597);
         }
         if (r8a66597->old_dvsq == DS_CNFG && dvsq != DS_CNFG)
@@ -1405,14 +1410,15 @@ static struct usb_ep_ops r8a66597_ep_ops = {
 /*-------------------------------------------------------------------------*/
 static struct r8a66597 *the_controller;
 
-int usb_gadget_register_driver(struct usb_gadget_driver *driver)
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
 {
         struct r8a66597 *r8a66597 = the_controller;
         int retval;
 
         if (!driver
                         || driver->speed != USB_SPEED_HIGH
-                        || !driver->bind
+                        || !bind
                         || !driver->setup)
                 return -EINVAL;
         if (!r8a66597)
@@ -1431,7 +1437,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
                 goto error;
         }
 
-        retval = driver->bind(&r8a66597->gadget);
+        retval = bind(&r8a66597->gadget);
         if (retval) {
                 printk(KERN_ERR "bind to driver error (%d)\n", retval);
                 device_del(&r8a66597->gadget.dev);
@@ -1456,7 +1462,7 @@ error:
 
         return retval;
 }
-EXPORT_SYMBOL(usb_gadget_register_driver);
+EXPORT_SYMBOL(usb_gadget_probe_driver);
 
 int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
 {
diff --git a/drivers/usb/gadget/r8a66597-udc.h b/drivers/usb/gadget/r8a66597-udc.h
index f763b5190afa..5fc22e09a0f1 100644
--- a/drivers/usb/gadget/r8a66597-udc.h
+++ b/drivers/usb/gadget/r8a66597-udc.h
@@ -136,7 +136,7 @@ static inline void r8a66597_read_fifo(struct r8a66597 *r8a66597,
                                       int len)
 {
         void __iomem *fifoaddr = r8a66597->reg + offset;
-        unsigned int data;
+        unsigned int data = 0;
         int i;
 
         if (r8a66597->pdata->on_chip) {
diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c
index 972d5ddd1e18..d3cdffea9c8a 100644
--- a/drivers/usb/gadget/rndis.c
+++ b/drivers/usb/gadget/rndis.c
@@ -61,17 +61,17 @@ MODULE_PARM_DESC (rndis_debug, "enable debugging");
 #define RNDIS_MAX_CONFIGS       1
 
 
-static rndis_params rndis_per_dev_params [RNDIS_MAX_CONFIGS];
+static rndis_params rndis_per_dev_params[RNDIS_MAX_CONFIGS];
 
 /* Driver Version */
-static const __le32 rndis_driver_version = cpu_to_le32 (1);
+static const __le32 rndis_driver_version = cpu_to_le32(1);
 
 /* Function Prototypes */
-static rndis_resp_t *rndis_add_response (int configNr, u32 length);
+static rndis_resp_t *rndis_add_response(int configNr, u32 length);
 
 
 /* supported OIDs */
-static const u32 oid_supported_list [] =
+static const u32 oid_supported_list[] =
 {
         /* the general stuff */
         OID_GEN_SUPPORTED_LIST,
@@ -161,21 +161,20 @@ static const u32 oid_supported_list [] =
 
 
 /* NDIS Functions */
-static int
-gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
-                rndis_resp_t *r)
+static int gen_ndis_query_resp(int configNr, u32 OID, u8 *buf,
+                               unsigned buf_len, rndis_resp_t *r)
 {
-        int                     retval = -ENOTSUPP;
-        u32                     length = 4;     /* usually */
-        __le32                  *outbuf;
-        int                     i, count;
-        rndis_query_cmplt_type  *resp;
-        struct net_device       *net;
+        int retval = -ENOTSUPP;
+        u32 length = 4; /* usually */
+        __le32 *outbuf;
+        int i, count;
+        rndis_query_cmplt_type *resp;
+        struct net_device *net;
         struct rtnl_link_stats64 temp;
         const struct rtnl_link_stats64 *stats;
 
         if (!r) return -ENOMEM;
-        resp = (rndis_query_cmplt_type *) r->buf;
+        resp = (rndis_query_cmplt_type *)r->buf;
 
         if (!resp) return -ENOMEM;
 
@@ -191,8 +190,8 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         }
 
         /* response goes here, right after the header */
-        outbuf = (__le32 *) &resp[1];
-        resp->InformationBufferOffset = cpu_to_le32 (16);
+        outbuf = (__le32 *)&resp[1];
+        resp->InformationBufferOffset = cpu_to_le32(16);
 
         net = rndis_per_dev_params[configNr].dev;
         stats = dev_get_stats(net, &temp);
@@ -204,10 +203,10 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         /* mandatory */
         case OID_GEN_SUPPORTED_LIST:
                 pr_debug("%s: OID_GEN_SUPPORTED_LIST\n", __func__);
-                length = sizeof (oid_supported_list);
-                count  = length / sizeof (u32);
+                length = sizeof(oid_supported_list);
+                count  = length / sizeof(u32);
                 for (i = 0; i < count; i++)
-                        outbuf[i] = cpu_to_le32 (oid_supported_list[i]);
+                        outbuf[i] = cpu_to_le32(oid_supported_list[i]);
                 retval = 0;
                 break;
 
@@ -220,14 +219,14 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                  * reddite ergo quae sunt Caesaris Caesari
                  * et quae sunt Dei Deo!
                  */
-                *outbuf = cpu_to_le32 (0);
+                *outbuf = cpu_to_le32(0);
                 retval = 0;
                 break;
 
         /* mandatory */
         case OID_GEN_MEDIA_SUPPORTED:
                 pr_debug("%s: OID_GEN_MEDIA_SUPPORTED\n", __func__);
-                *outbuf = cpu_to_le32 (rndis_per_dev_params [configNr].medium);
+                *outbuf = cpu_to_le32(rndis_per_dev_params[configNr].medium);
                 retval = 0;
                 break;
 
@@ -235,16 +234,16 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         case OID_GEN_MEDIA_IN_USE:
                 pr_debug("%s: OID_GEN_MEDIA_IN_USE\n", __func__);
                 /* one medium, one transport... (maybe you do it better) */
-                *outbuf = cpu_to_le32 (rndis_per_dev_params [configNr].medium);
+                *outbuf = cpu_to_le32(rndis_per_dev_params[configNr].medium);
                 retval = 0;
                 break;
 
         /* mandatory */
         case OID_GEN_MAXIMUM_FRAME_SIZE:
                 pr_debug("%s: OID_GEN_MAXIMUM_FRAME_SIZE\n", __func__);
-                if (rndis_per_dev_params [configNr].dev) {
-                        *outbuf = cpu_to_le32 (
-                                rndis_per_dev_params [configNr].dev->mtu);
+                if (rndis_per_dev_params[configNr].dev) {
+                        *outbuf = cpu_to_le32(
+                                rndis_per_dev_params[configNr].dev->mtu);
                         retval = 0;
                 }
                 break;
@@ -253,21 +252,21 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         case OID_GEN_LINK_SPEED:
                 if (rndis_debug > 1)
                         pr_debug("%s: OID_GEN_LINK_SPEED\n", __func__);
-                if (rndis_per_dev_params [configNr].media_state
+                if (rndis_per_dev_params[configNr].media_state
                                 == NDIS_MEDIA_STATE_DISCONNECTED)
-                        *outbuf = cpu_to_le32 (0);
+                        *outbuf = cpu_to_le32(0);
                 else
-                        *outbuf = cpu_to_le32 (
-                                rndis_per_dev_params [configNr].speed);
+                        *outbuf = cpu_to_le32(
+                                rndis_per_dev_params[configNr].speed);
                 retval = 0;
                 break;
 
         /* mandatory */
         case OID_GEN_TRANSMIT_BLOCK_SIZE:
                 pr_debug("%s: OID_GEN_TRANSMIT_BLOCK_SIZE\n", __func__);
-                if (rndis_per_dev_params [configNr].dev) {
-                        *outbuf = cpu_to_le32 (
-                                rndis_per_dev_params [configNr].dev->mtu);
+                if (rndis_per_dev_params[configNr].dev) {
+                        *outbuf = cpu_to_le32(
+                                rndis_per_dev_params[configNr].dev->mtu);
                         retval = 0;
                 }
                 break;
@@ -275,9 +274,9 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         /* mandatory */
         case OID_GEN_RECEIVE_BLOCK_SIZE:
                 pr_debug("%s: OID_GEN_RECEIVE_BLOCK_SIZE\n", __func__);
-                if (rndis_per_dev_params [configNr].dev) {
-                        *outbuf = cpu_to_le32 (
-                                rndis_per_dev_params [configNr].dev->mtu);
+                if (rndis_per_dev_params[configNr].dev) {
+                        *outbuf = cpu_to_le32(
+                                rndis_per_dev_params[configNr].dev->mtu);
                         retval = 0;
                 }
                 break;
@@ -285,18 +284,20 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         /* mandatory */
         case OID_GEN_VENDOR_ID:
                 pr_debug("%s: OID_GEN_VENDOR_ID\n", __func__);
-                *outbuf = cpu_to_le32 (
-                        rndis_per_dev_params [configNr].vendorID);
+                *outbuf = cpu_to_le32(
+                        rndis_per_dev_params[configNr].vendorID);
                 retval = 0;
                 break;
 
         /* mandatory */
         case OID_GEN_VENDOR_DESCRIPTION:
                 pr_debug("%s: OID_GEN_VENDOR_DESCRIPTION\n", __func__);
-                if ( rndis_per_dev_params [configNr].vendorDescr ) {
-                        length = strlen (rndis_per_dev_params [configNr].vendorDescr);
-                        memcpy (outbuf,
-                                rndis_per_dev_params [configNr].vendorDescr, length);
+                if (rndis_per_dev_params[configNr].vendorDescr) {
+                        length = strlen(rndis_per_dev_params[configNr].
+                                        vendorDescr);
+                        memcpy(outbuf,
+                                rndis_per_dev_params[configNr].vendorDescr,
+                                length);
                 } else {
                         outbuf[0] = 0;
                 }
@@ -313,7 +314,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         /* mandatory */
         case OID_GEN_CURRENT_PACKET_FILTER:
                 pr_debug("%s: OID_GEN_CURRENT_PACKET_FILTER\n", __func__);
-                *outbuf = cpu_to_le32 (*rndis_per_dev_params[configNr].filter);
+                *outbuf = cpu_to_le32(*rndis_per_dev_params[configNr].filter);
                 retval = 0;
                 break;
 
@@ -328,14 +329,14 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         case OID_GEN_MEDIA_CONNECT_STATUS:
                 if (rndis_debug > 1)
                         pr_debug("%s: OID_GEN_MEDIA_CONNECT_STATUS\n", __func__);
-                *outbuf = cpu_to_le32 (rndis_per_dev_params [configNr]
+                *outbuf = cpu_to_le32(rndis_per_dev_params[configNr]
                                                 .media_state);
                 retval = 0;
                 break;
 
         case OID_GEN_PHYSICAL_MEDIUM:
                 pr_debug("%s: OID_GEN_PHYSICAL_MEDIUM\n", __func__);
-                *outbuf = cpu_to_le32 (0);
+                *outbuf = cpu_to_le32(0);
                 retval = 0;
                 break;
 
@@ -409,10 +410,10 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         /* mandatory */
         case OID_802_3_PERMANENT_ADDRESS:
                 pr_debug("%s: OID_802_3_PERMANENT_ADDRESS\n", __func__);
-                if (rndis_per_dev_params [configNr].dev) {
+                if (rndis_per_dev_params[configNr].dev) {
                         length = ETH_ALEN;
-                        memcpy (outbuf,
-                                rndis_per_dev_params [configNr].host_mac,
+                        memcpy(outbuf,
+                                rndis_per_dev_params[configNr].host_mac,
                                 length);
                         retval = 0;
                 }
@@ -421,9 +422,9 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         /* mandatory */
         case OID_802_3_CURRENT_ADDRESS:
                 pr_debug("%s: OID_802_3_CURRENT_ADDRESS\n", __func__);
-                if (rndis_per_dev_params [configNr].dev) {
+                if (rndis_per_dev_params[configNr].dev) {
                         length = ETH_ALEN;
-                        memcpy (outbuf,
+                        memcpy(outbuf,
                                 rndis_per_dev_params [configNr].host_mac,
                                 length);
                         retval = 0;
@@ -434,7 +435,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         case OID_802_3_MULTICAST_LIST:
                 pr_debug("%s: OID_802_3_MULTICAST_LIST\n", __func__);
                 /* Multicast base address only */
-                *outbuf = cpu_to_le32 (0xE0000000);
+                *outbuf = cpu_to_le32(0xE0000000);
                 retval = 0;
                 break;
 
@@ -442,7 +443,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         case OID_802_3_MAXIMUM_LIST_SIZE:
                 pr_debug("%s: OID_802_3_MAXIMUM_LIST_SIZE\n", __func__);
                 /* Multicast base address only */
-                *outbuf = cpu_to_le32 (1);
+                *outbuf = cpu_to_le32(1);
                 retval = 0;
                 break;
 
@@ -466,14 +467,14 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         /* mandatory */
         case OID_802_3_XMIT_ONE_COLLISION:
                 pr_debug("%s: OID_802_3_XMIT_ONE_COLLISION\n", __func__);
-                *outbuf = cpu_to_le32 (0);
+                *outbuf = cpu_to_le32(0);
                 retval = 0;
                 break;
 
         /* mandatory */
         case OID_802_3_XMIT_MORE_COLLISIONS:
                 pr_debug("%s: OID_802_3_XMIT_MORE_COLLISIONS\n", __func__);
-                *outbuf = cpu_to_le32 (0);
+                *outbuf = cpu_to_le32(0);
                 retval = 0;
                 break;
 
@@ -484,22 +485,22 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
         if (retval < 0)
                 length = 0;
 
-        resp->InformationBufferLength = cpu_to_le32 (length);
-        r->length = length + sizeof *resp;
-        resp->MessageLength = cpu_to_le32 (r->length);
+        resp->InformationBufferLength = cpu_to_le32(length);
+        r->length = length + sizeof(*resp);
+        resp->MessageLength = cpu_to_le32(r->length);
         return retval;
 }
 
-static int gen_ndis_set_resp (u8 configNr, u32 OID, u8 *buf, u32 buf_len,
-                        rndis_resp_t *r)
+static int gen_ndis_set_resp(u8 configNr, u32 OID, u8 *buf, u32 buf_len,
+                             rndis_resp_t *r)
 {
-        rndis_set_cmplt_type            *resp;
-        int                             i, retval = -ENOTSUPP;
-        struct rndis_params             *params;
+        rndis_set_cmplt_type *resp;
+        int i, retval = -ENOTSUPP;
+        struct rndis_params *params;
 
         if (!r)
                 return -ENOMEM;
-        resp = (rndis_set_cmplt_type *) r->buf;
+        resp = (rndis_set_cmplt_type *)r->buf;
         if (!resp)
                 return -ENOMEM;
 
@@ -514,7 +515,7 @@ static int gen_ndis_set_resp (u8 configNr, u32 OID, u8 *buf, u32 buf_len,
                 }
         }
 
-        params = &rndis_per_dev_params [configNr];
+        params = &rndis_per_dev_params[configNr];
         switch (OID) {
         case OID_GEN_CURRENT_PACKET_FILTER:
 
@@ -537,11 +538,11 @@ static int gen_ndis_set_resp (u8 configNr, u32 OID, u8 *buf, u32 buf_len,
                         params->state = RNDIS_DATA_INITIALIZED;
                         netif_carrier_on(params->dev);
                         if (netif_running(params->dev))
-                                netif_wake_queue (params->dev);
+                                netif_wake_queue(params->dev);
                 } else {
                         params->state = RNDIS_INITIALIZED;
-                        netif_carrier_off (params->dev);
-                        netif_stop_queue (params->dev);
+                        netif_carrier_off(params->dev);
+                        netif_stop_queue(params->dev);
                 }
                 break;
 
@@ -563,48 +564,47 @@ static int gen_ndis_set_resp (u8 configNr, u32 OID, u8 *buf, u32 buf_len,
  * Response Functions
  */
 
-static int rndis_init_response (int configNr, rndis_init_msg_type *buf)
+static int rndis_init_response(int configNr, rndis_init_msg_type *buf)
 {
-        rndis_init_cmplt_type   *resp;
-        rndis_resp_t            *r;
-        struct rndis_params     *params = rndis_per_dev_params + configNr;
+        rndis_init_cmplt_type *resp;
+        rndis_resp_t *r;
+        struct rndis_params *params = rndis_per_dev_params + configNr;
 
         if (!params->dev)
                 return -ENOTSUPP;
 
-        r = rndis_add_response (configNr, sizeof (rndis_init_cmplt_type));
+        r = rndis_add_response(configNr, sizeof(rndis_init_cmplt_type));
         if (!r)
                 return -ENOMEM;
-        resp = (rndis_init_cmplt_type *) r->buf;
+        resp = (rndis_init_cmplt_type *)r->buf;
 
-        resp->MessageType = cpu_to_le32 (
-                        REMOTE_NDIS_INITIALIZE_CMPLT);
-        resp->MessageLength = cpu_to_le32 (52);
+        resp->MessageType = cpu_to_le32(REMOTE_NDIS_INITIALIZE_CMPLT);
+        resp->MessageLength = cpu_to_le32(52);
         resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
-        resp->Status = cpu_to_le32 (RNDIS_STATUS_SUCCESS);
-        resp->MajorVersion = cpu_to_le32 (RNDIS_MAJOR_VERSION);
-        resp->MinorVersion = cpu_to_le32 (RNDIS_MINOR_VERSION);
-        resp->DeviceFlags = cpu_to_le32 (RNDIS_DF_CONNECTIONLESS);
-        resp->Medium = cpu_to_le32 (RNDIS_MEDIUM_802_3);
-        resp->MaxPacketsPerTransfer = cpu_to_le32 (1);
-        resp->MaxTransferSize = cpu_to_le32 (
+        resp->Status = cpu_to_le32(RNDIS_STATUS_SUCCESS);
+        resp->MajorVersion = cpu_to_le32(RNDIS_MAJOR_VERSION);
+        resp->MinorVersion = cpu_to_le32(RNDIS_MINOR_VERSION);
+        resp->DeviceFlags = cpu_to_le32(RNDIS_DF_CONNECTIONLESS);
+        resp->Medium = cpu_to_le32(RNDIS_MEDIUM_802_3);
+        resp->MaxPacketsPerTransfer = cpu_to_le32(1);
+        resp->MaxTransferSize = cpu_to_le32(
                   params->dev->mtu
-                + sizeof (struct ethhdr)
-                + sizeof (struct rndis_packet_msg_type)
+                + sizeof(struct ethhdr)
+                + sizeof(struct rndis_packet_msg_type)
                 + 22);
-        resp->PacketAlignmentFactor = cpu_to_le32 (0);
-        resp->AFListOffset = cpu_to_le32 (0);
-        resp->AFListSize = cpu_to_le32 (0);
+        resp->PacketAlignmentFactor = cpu_to_le32(0);
+        resp->AFListOffset = cpu_to_le32(0);
+        resp->AFListSize = cpu_to_le32(0);
 
         params->resp_avail(params->v);
         return 0;
 }
 
-static int rndis_query_response (int configNr, rndis_query_msg_type *buf)
+static int rndis_query_response(int configNr, rndis_query_msg_type *buf)
 {
         rndis_query_cmplt_type *resp;
-        rndis_resp_t            *r;
-        struct rndis_params     *params = rndis_per_dev_params + configNr;
+        rndis_resp_t *r;
+        struct rndis_params *params = rndis_per_dev_params + configNr;
 
         /* pr_debug("%s: OID = %08X\n", __func__, cpu_to_le32(buf->OID)); */
         if (!params->dev)
@@ -616,47 +616,46 @@ static int rndis_query_response (int configNr, rndis_query_msg_type *buf)
          * rndis_query_cmplt_type followed by data.
          * oid_supported_list is the largest data reply
          */
-        r = rndis_add_response (configNr,
-                sizeof (oid_supported_list) + sizeof(rndis_query_cmplt_type));
+        r = rndis_add_response(configNr,
+                sizeof(oid_supported_list) + sizeof(rndis_query_cmplt_type));
         if (!r)
                 return -ENOMEM;
-        resp = (rndis_query_cmplt_type *) r->buf;
+        resp = (rndis_query_cmplt_type *)r->buf;
 
-        resp->MessageType = cpu_to_le32 (REMOTE_NDIS_QUERY_CMPLT);
+        resp->MessageType = cpu_to_le32(REMOTE_NDIS_QUERY_CMPLT);
         resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
 
-        if (gen_ndis_query_resp (configNr, le32_to_cpu (buf->OID),
+        if (gen_ndis_query_resp(configNr, le32_to_cpu(buf->OID),
                         le32_to_cpu(buf->InformationBufferOffset)
-                                        + 8 + (u8 *) buf,
+                                        + 8 + (u8 *)buf,
                         le32_to_cpu(buf->InformationBufferLength),
                         r)) {
                 /* OID not supported */
-                resp->Status = cpu_to_le32 (
-                                RNDIS_STATUS_NOT_SUPPORTED);
-                resp->MessageLength = cpu_to_le32 (sizeof *resp);
-                resp->InformationBufferLength = cpu_to_le32 (0);
-                resp->InformationBufferOffset = cpu_to_le32 (0);
+                resp->Status = cpu_to_le32(RNDIS_STATUS_NOT_SUPPORTED);
+                resp->MessageLength = cpu_to_le32(sizeof *resp);
+                resp->InformationBufferLength = cpu_to_le32(0);
+                resp->InformationBufferOffset = cpu_to_le32(0);
         } else
-                resp->Status = cpu_to_le32 (RNDIS_STATUS_SUCCESS);
+                resp->Status = cpu_to_le32(RNDIS_STATUS_SUCCESS);
 
         params->resp_avail(params->v);
         return 0;
 }
 
-static int rndis_set_response (int configNr, rndis_set_msg_type *buf)
+static int rndis_set_response(int configNr, rndis_set_msg_type *buf)
 {
-        u32                     BufLength, BufOffset;
-        rndis_set_cmplt_type    *resp;
-        rndis_resp_t            *r;
-        struct rndis_params     *params = rndis_per_dev_params + configNr;
+        u32 BufLength, BufOffset;
+        rndis_set_cmplt_type *resp;
+        rndis_resp_t *r;
+        struct rndis_params *params = rndis_per_dev_params + configNr;
 
-        r = rndis_add_response (configNr, sizeof (rndis_set_cmplt_type));
+        r = rndis_add_response(configNr, sizeof(rndis_set_cmplt_type));
         if (!r)
                 return -ENOMEM;
-        resp = (rndis_set_cmplt_type *) r->buf;
+        resp = (rndis_set_cmplt_type *)r->buf;
 
-        BufLength = le32_to_cpu (buf->InformationBufferLength);
-        BufOffset = le32_to_cpu (buf->InformationBufferOffset);
+        BufLength = le32_to_cpu(buf->InformationBufferLength);
+        BufOffset = le32_to_cpu(buf->InformationBufferOffset);
 
 #ifdef  VERBOSE_DEBUG
         pr_debug("%s: Length: %d\n", __func__, BufLength);
@@ -670,59 +669,59 @@ static int rndis_set_response (int configNr, rndis_set_msg_type *buf)
         pr_debug("\n");
 #endif
 
-        resp->MessageType = cpu_to_le32 (REMOTE_NDIS_SET_CMPLT);
-        resp->MessageLength = cpu_to_le32 (16);
+        resp->MessageType = cpu_to_le32(REMOTE_NDIS_SET_CMPLT);
+        resp->MessageLength = cpu_to_le32(16);
         resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
-        if (gen_ndis_set_resp (configNr, le32_to_cpu (buf->OID),
-                        ((u8 *) buf) + 8 + BufOffset, BufLength, r))
-                resp->Status = cpu_to_le32 (RNDIS_STATUS_NOT_SUPPORTED);
+        if (gen_ndis_set_resp(configNr, le32_to_cpu(buf->OID),
+                        ((u8 *)buf) + 8 + BufOffset, BufLength, r))
+                resp->Status = cpu_to_le32(RNDIS_STATUS_NOT_SUPPORTED);
         else
-                resp->Status = cpu_to_le32 (RNDIS_STATUS_SUCCESS);
+                resp->Status = cpu_to_le32(RNDIS_STATUS_SUCCESS);
 
         params->resp_avail(params->v);
         return 0;
 }
 
-static int rndis_reset_response (int configNr, rndis_reset_msg_type *buf)
+static int rndis_reset_response(int configNr, rndis_reset_msg_type *buf)
 {
-        rndis_reset_cmplt_type  *resp;
-        rndis_resp_t            *r;
-        struct rndis_params     *params = rndis_per_dev_params + configNr;
+        rndis_reset_cmplt_type *resp;
+        rndis_resp_t *r;
+        struct rndis_params *params = rndis_per_dev_params + configNr;
 
-        r = rndis_add_response (configNr, sizeof (rndis_reset_cmplt_type));
+        r = rndis_add_response(configNr, sizeof(rndis_reset_cmplt_type));
         if (!r)
                 return -ENOMEM;
-        resp = (rndis_reset_cmplt_type *) r->buf;
+        resp = (rndis_reset_cmplt_type *)r->buf;
 
-        resp->MessageType = cpu_to_le32 (REMOTE_NDIS_RESET_CMPLT);
-        resp->MessageLength = cpu_to_le32 (16);
-        resp->Status = cpu_to_le32 (RNDIS_STATUS_SUCCESS);
+        resp->MessageType = cpu_to_le32(REMOTE_NDIS_RESET_CMPLT);
+        resp->MessageLength = cpu_to_le32(16);
+        resp->Status = cpu_to_le32(RNDIS_STATUS_SUCCESS);
         /* resent information */
-        resp->AddressingReset = cpu_to_le32 (1);
+        resp->AddressingReset = cpu_to_le32(1);
 
         params->resp_avail(params->v);
         return 0;
 }
 
-static int rndis_keepalive_response (int configNr,
-                                rndis_keepalive_msg_type *buf)
+static int rndis_keepalive_response(int configNr,
+                                    rndis_keepalive_msg_type *buf)
 {
-        rndis_keepalive_cmplt_type      *resp;
-        rndis_resp_t                    *r;
-        struct rndis_params     *params = rndis_per_dev_params + configNr;
+        rndis_keepalive_cmplt_type *resp;
+        rndis_resp_t *r;
+        struct rndis_params *params = rndis_per_dev_params + configNr;
 
         /* host "should" check only in RNDIS_DATA_INITIALIZED state */
 
-        r = rndis_add_response (configNr, sizeof (rndis_keepalive_cmplt_type));
+        r = rndis_add_response(configNr, sizeof(rndis_keepalive_cmplt_type));
         if (!r)
                 return -ENOMEM;
-        resp = (rndis_keepalive_cmplt_type *) r->buf;
+        resp = (rndis_keepalive_cmplt_type *)r->buf;
 
-        resp->MessageType = cpu_to_le32 (
+        resp->MessageType = cpu_to_le32(
                         REMOTE_NDIS_KEEPALIVE_CMPLT);
-        resp->MessageLength = cpu_to_le32 (16);
+        resp->MessageLength = cpu_to_le32(16);
         resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
-        resp->Status = cpu_to_le32 (RNDIS_STATUS_SUCCESS);
+        resp->Status = cpu_to_le32(RNDIS_STATUS_SUCCESS);
 
         params->resp_avail(params->v);
         return 0;
@@ -732,86 +731,85 @@ static int rndis_keepalive_response (int configNr,
 /*
  * Device to Host Comunication
  */
-static int rndis_indicate_status_msg (int configNr, u32 status)
+static int rndis_indicate_status_msg(int configNr, u32 status)
 {
-        rndis_indicate_status_msg_type  *resp;
-        rndis_resp_t                    *r;
-        struct rndis_params     *params = rndis_per_dev_params + configNr;
+        rndis_indicate_status_msg_type *resp;
+        rndis_resp_t *r;
+        struct rndis_params *params = rndis_per_dev_params + configNr;
 
         if (params->state == RNDIS_UNINITIALIZED)
                 return -ENOTSUPP;
 
-        r = rndis_add_response (configNr,
-                                sizeof (rndis_indicate_status_msg_type));
+        r = rndis_add_response(configNr,
+                                sizeof(rndis_indicate_status_msg_type));
         if (!r)
                 return -ENOMEM;
-        resp = (rndis_indicate_status_msg_type *) r->buf;
+        resp = (rndis_indicate_status_msg_type *)r->buf;
 
-        resp->MessageType = cpu_to_le32 (
-                        REMOTE_NDIS_INDICATE_STATUS_MSG);
-        resp->MessageLength = cpu_to_le32 (20);
-        resp->Status = cpu_to_le32 (status);
-        resp->StatusBufferLength = cpu_to_le32 (0);
-        resp->StatusBufferOffset = cpu_to_le32 (0);
+        resp->MessageType = cpu_to_le32(REMOTE_NDIS_INDICATE_STATUS_MSG);
+        resp->MessageLength = cpu_to_le32(20);
+        resp->Status = cpu_to_le32(status);
+        resp->StatusBufferLength = cpu_to_le32(0);
+        resp->StatusBufferOffset = cpu_to_le32(0);
 
         params->resp_avail(params->v);
         return 0;
 }
 
-int rndis_signal_connect (int configNr)
+int rndis_signal_connect(int configNr)
 {
-        rndis_per_dev_params [configNr].media_state
+        rndis_per_dev_params[configNr].media_state
                         = NDIS_MEDIA_STATE_CONNECTED;
-        return rndis_indicate_status_msg (configNr,
+        return rndis_indicate_status_msg(configNr,
                                           RNDIS_STATUS_MEDIA_CONNECT);
 }
 
-int rndis_signal_disconnect (int configNr)
+int rndis_signal_disconnect(int configNr)
 {
-        rndis_per_dev_params [configNr].media_state
+        rndis_per_dev_params[configNr].media_state
                         = NDIS_MEDIA_STATE_DISCONNECTED;
-        return rndis_indicate_status_msg (configNr,
+        return rndis_indicate_status_msg(configNr,
                                           RNDIS_STATUS_MEDIA_DISCONNECT);
 }
 
-void rndis_uninit (int configNr)
+void rndis_uninit(int configNr)
 {
         u8 *buf;
         u32 length;
 
         if (configNr >= RNDIS_MAX_CONFIGS)
                 return;
-        rndis_per_dev_params [configNr].state = RNDIS_UNINITIALIZED;
+        rndis_per_dev_params[configNr].state = RNDIS_UNINITIALIZED;
 
         /* drain the response queue */
         while ((buf = rndis_get_next_response(configNr, &length)))
                 rndis_free_response(configNr, buf);
 }
 
-void rndis_set_host_mac (int configNr, const u8 *addr)
+void rndis_set_host_mac(int configNr, const u8 *addr)
 {
-        rndis_per_dev_params [configNr].host_mac = addr;
+        rndis_per_dev_params[configNr].host_mac = addr;
 }
 
 /*
  * Message Parser
  */
-int rndis_msg_parser (u8 configNr, u8 *buf)
+int rndis_msg_parser(u8 configNr, u8 *buf)
 {
         u32 MsgType, MsgLength;
         __le32 *tmp;
-        struct rndis_params             *params;
+        struct rndis_params *params;
 
         if (!buf)
                 return -ENOMEM;
 
-        tmp = (__le32 *) buf;
+        tmp = (__le32 *)buf;
         MsgType   = get_unaligned_le32(tmp++);
         MsgLength = get_unaligned_le32(tmp++);
 
         if (configNr >= RNDIS_MAX_CONFIGS)
                 return -ENOTSUPP;
-        params = &rndis_per_dev_params [configNr];
+        params = &rndis_per_dev_params[configNr];
 
         /* NOTE: RNDIS is *EXTREMELY* chatty ... Windows constantly polls for
          * rx/tx statistics and link status, in addition to KEEPALIVE traffic
@@ -822,41 +820,41 @@ int rndis_msg_parser (u8 configNr, u8 *buf)
         switch (MsgType) {
         case REMOTE_NDIS_INITIALIZE_MSG:
                 pr_debug("%s: REMOTE_NDIS_INITIALIZE_MSG\n",
-                        __func__ );
+                        __func__);
                 params->state = RNDIS_INITIALIZED;
-                return  rndis_init_response (configNr,
-                                        (rndis_init_msg_type *) buf);
+                return rndis_init_response(configNr,
+                                        (rndis_init_msg_type *)buf);
 
         case REMOTE_NDIS_HALT_MSG:
                 pr_debug("%s: REMOTE_NDIS_HALT_MSG\n",
-                        __func__ );
+                        __func__);
                 params->state = RNDIS_UNINITIALIZED;
                 if (params->dev) {
-                        netif_carrier_off (params->dev);
-                        netif_stop_queue (params->dev);
+                        netif_carrier_off(params->dev);
+                        netif_stop_queue(params->dev);
                 }
                 return 0;
 
         case REMOTE_NDIS_QUERY_MSG:
-                return rndis_query_response (configNr,
-                                        (rndis_query_msg_type *) buf);
+                return rndis_query_response(configNr,
+                                        (rndis_query_msg_type *)buf);
 
         case REMOTE_NDIS_SET_MSG:
-                return rndis_set_response (configNr,
-                                        (rndis_set_msg_type *) buf);
+                return rndis_set_response(configNr,
+                                        (rndis_set_msg_type *)buf);
 
         case REMOTE_NDIS_RESET_MSG:
                 pr_debug("%s: REMOTE_NDIS_RESET_MSG\n",
-                        __func__ );
-                return rndis_reset_response (configNr,
-                                        (rndis_reset_msg_type *) buf);
+                        __func__);
+                return rndis_reset_response(configNr,
+                                        (rndis_reset_msg_type *)buf);
 
         case REMOTE_NDIS_KEEPALIVE_MSG:
                 /* For USB: host does this every 5 seconds */
                 if (rndis_debug > 1)
                         pr_debug("%s: REMOTE_NDIS_KEEPALIVE_MSG\n",
-                                __func__ );
-                return rndis_keepalive_response (configNr,
+                                __func__);
+                return rndis_keepalive_response(configNr,
                                                  (rndis_keepalive_msg_type *)
                                                  buf);
 
@@ -866,7 +864,7 @@ int rndis_msg_parser (u8 configNr, u8 *buf)
                  * suspending itself.
                  */
                 pr_warning("%s: unknown RNDIS message 0x%08X len %d\n",
-                        __func__ , MsgType, MsgLength);
+                        __func__, MsgType, MsgLength);
                 {
                         unsigned i;
                         for (i = 0; i < MsgLength; i += 16) {
@@ -901,10 +899,10 @@ int rndis_register(void (*resp_avail)(void *v), void *v)
                 return -EINVAL;
 
         for (i = 0; i < RNDIS_MAX_CONFIGS; i++) {
-                if (!rndis_per_dev_params [i].used) {
-                        rndis_per_dev_params [i].used = 1;
-                        rndis_per_dev_params [i].resp_avail = resp_avail;
-                        rndis_per_dev_params [i].v = v;
+                if (!rndis_per_dev_params[i].used) {
+                        rndis_per_dev_params[i].used = 1;
+                        rndis_per_dev_params[i].resp_avail = resp_avail;
+                        rndis_per_dev_params[i].v = v;
                         pr_debug("%s: configNr = %d\n", __func__, i);
                         return i;
                 }
@@ -914,14 +912,12 @@ int rndis_register(void (*resp_avail)(void *v), void *v)
         return -ENODEV;
 }
 
-void rndis_deregister (int configNr)
+void rndis_deregister(int configNr)
 {
-        pr_debug("%s: \n", __func__);
+        pr_debug("%s:\n", __func__);
 
         if (configNr >= RNDIS_MAX_CONFIGS) return;
-        rndis_per_dev_params [configNr].used = 0;
-
-        return;
+        rndis_per_dev_params[configNr].used = 0;
 }
 
 int rndis_set_param_dev(u8 configNr, struct net_device *dev, u16 *cdc_filter)
@@ -931,76 +927,76 @@ int rndis_set_param_dev(u8 configNr, struct net_device *dev, u16 *cdc_filter)
                 return -EINVAL;
         if (configNr >= RNDIS_MAX_CONFIGS) return -1;
 
-        rndis_per_dev_params [configNr].dev = dev;
-        rndis_per_dev_params [configNr].filter = cdc_filter;
+        rndis_per_dev_params[configNr].dev = dev;
+        rndis_per_dev_params[configNr].filter = cdc_filter;
 
         return 0;
 }
 
-int rndis_set_param_vendor (u8 configNr, u32 vendorID, const char *vendorDescr)
+int rndis_set_param_vendor(u8 configNr, u32 vendorID, const char *vendorDescr)
 {
         pr_debug("%s:\n", __func__);
         if (!vendorDescr) return -1;
         if (configNr >= RNDIS_MAX_CONFIGS) return -1;
 
-        rndis_per_dev_params [configNr].vendorID = vendorID;
-        rndis_per_dev_params [configNr].vendorDescr = vendorDescr;
+        rndis_per_dev_params[configNr].vendorID = vendorID;
+        rndis_per_dev_params[configNr].vendorDescr = vendorDescr;
 
         return 0;
 }
 
-int rndis_set_param_medium (u8 configNr, u32 medium, u32 speed)
+int rndis_set_param_medium(u8 configNr, u32 medium, u32 speed)
 {
         pr_debug("%s: %u %u\n", __func__, medium, speed);
         if (configNr >= RNDIS_MAX_CONFIGS) return -1;
 
-        rndis_per_dev_params [configNr].medium = medium;
-        rndis_per_dev_params [configNr].speed = speed;
+        rndis_per_dev_params[configNr].medium = medium;
+        rndis_per_dev_params[configNr].speed = speed;
 
         return 0;
 }
 
-void rndis_add_hdr (struct sk_buff *skb)
+void rndis_add_hdr(struct sk_buff *skb)
 {
-        struct rndis_packet_msg_type    *header;
+        struct rndis_packet_msg_type *header;
 
         if (!skb)
                 return;
-        header = (void *) skb_push (skb, sizeof *header);
-        memset (header, 0, sizeof *header);
+        header = (void *)skb_push(skb, sizeof(*header));
+        memset(header, 0, sizeof *header);
         header->MessageType = cpu_to_le32(REMOTE_NDIS_PACKET_MSG);
         header->MessageLength = cpu_to_le32(skb->len);
-        header->DataOffset = cpu_to_le32 (36);
-        header->DataLength = cpu_to_le32(skb->len - sizeof *header);
+        header->DataOffset = cpu_to_le32(36);
+        header->DataLength = cpu_to_le32(skb->len - sizeof(*header));
 }
 
-void rndis_free_response (int configNr, u8 *buf)
+void rndis_free_response(int configNr, u8 *buf)
 {
-        rndis_resp_t            *r;
-        struct list_head        *act, *tmp;
+        rndis_resp_t *r;
+        struct list_head *act, *tmp;
 
-        list_for_each_safe (act, tmp,
-                        &(rndis_per_dev_params [configNr].resp_queue))
+        list_for_each_safe(act, tmp,
+                        &(rndis_per_dev_params[configNr].resp_queue))
         {
-                r = list_entry (act, rndis_resp_t, list);
+                r = list_entry(act, rndis_resp_t, list);
                 if (r && r->buf == buf) {
-                        list_del (&r->list);
-                        kfree (r);
+                        list_del(&r->list);
+                        kfree(r);
                 }
         }
 }
 
-u8 *rndis_get_next_response (int configNr, u32 *length)
+u8 *rndis_get_next_response(int configNr, u32 *length)
 {
-        rndis_resp_t            *r;
-        struct list_head        *act, *tmp;
+        rndis_resp_t *r;
+        struct list_head *act, *tmp;
 
         if (!length) return NULL;
 
-        list_for_each_safe (act, tmp,
-                        &(rndis_per_dev_params [configNr].resp_queue))
+        list_for_each_safe(act, tmp,
+                        &(rndis_per_dev_params[configNr].resp_queue))
         {
-                r = list_entry (act, rndis_resp_t, list);
+                r = list_entry(act, rndis_resp_t, list);
                 if (!r->send) {
                         r->send = 1;
                         *length = r->length;
@@ -1011,20 +1007,20 @@ u8 *rndis_get_next_response (int configNr, u32 *length)
         return NULL;
 }
 
-static rndis_resp_t *rndis_add_response (int configNr, u32 length)
+static rndis_resp_t *rndis_add_response(int configNr, u32 length)
 {
-        rndis_resp_t    *r;
+        rndis_resp_t *r;
 
-        /* NOTE:  this gets copied into ether.c USB_BUFSIZ bytes ... */
-        r = kmalloc (sizeof (rndis_resp_t) + length, GFP_ATOMIC);
+        /* NOTE: this gets copied into ether.c USB_BUFSIZ bytes ... */
+        r = kmalloc(sizeof(rndis_resp_t) + length, GFP_ATOMIC);
         if (!r) return NULL;
 
-        r->buf = (u8 *) (r + 1);
+        r->buf = (u8 *)(r + 1);
         r->length = length;
         r->send = 0;
 
-        list_add_tail (&r->list,
-                &(rndis_per_dev_params [configNr].resp_queue));
+        list_add_tail(&r->list,
+                &(rndis_per_dev_params[configNr].resp_queue));
         return r;
 }
 
@@ -1033,7 +1029,7 @@ int rndis_rm_hdr(struct gether *port,
                         struct sk_buff_head *list)
 {
         /* tmp points to a struct rndis_packet_msg_type */
-        __le32          *tmp = (void *) skb->data;
+        __le32 *tmp = (void *)skb->data;
 
         /* MessageType, MessageLength */
         if (cpu_to_le32(REMOTE_NDIS_PACKET_MSG)
@@ -1054,7 +1050,7 @@ int rndis_rm_hdr(struct gether *port,
         return 0;
 }
 
-#ifdef  CONFIG_USB_GADGET_DEBUG_FILES
+#ifdef CONFIG_USB_GADGET_DEBUG_FILES
 
 static int rndis_proc_show(struct seq_file *m, void *v)
 {
@@ -1087,7 +1083,7 @@ static int rndis_proc_show(struct seq_file *m, void *v)
 }
 
 static ssize_t rndis_proc_write(struct file *file, const char __user *buffer,
-                size_t count, loff_t *ppos)
+                                size_t count, loff_t *ppos)
 {
         rndis_params *p = PDE(file->f_path.dentry->d_inode)->data;
         u32 speed = 0;
@@ -1109,11 +1105,11 @@ static ssize_t rndis_proc_write(struct file *file, const char __user *buffer,
                 case '8':
                 case '9':
                         fl_speed = 1;
-                        speed = speed*10 + c - '0';
+                        speed = speed * 10 + c - '0';
                         break;
                 case 'C':
                 case 'c':
-                        rndis_signal_connect (p->confignr);
+                        rndis_signal_connect(p->confignr);
                         break;
                 case 'D':
                 case 'd':
@@ -1145,11 +1141,11 @@ static const struct file_operations rndis_proc_fops = {
         .write          = rndis_proc_write,
 };
 
-#define NAME_TEMPLATE   "driver/rndis-%03d"
+#define NAME_TEMPLATE "driver/rndis-%03d"
 
 static struct proc_dir_entry *rndis_connect_state [RNDIS_MAX_CONFIGS];
 
-#endif  /* CONFIG_USB_GADGET_DEBUG_FILES */
+#endif /* CONFIG_USB_GADGET_DEBUG_FILES */
 
 
 int rndis_init(void)
@@ -1160,42 +1156,40 @@ int rndis_init(void)
 #ifdef  CONFIG_USB_GADGET_DEBUG_FILES
                 char name [20];
 
-                sprintf (name, NAME_TEMPLATE, i);
-                if (!(rndis_connect_state [i]
-                                = proc_create_data(name, 0660, NULL,
+                sprintf(name, NAME_TEMPLATE, i);
+                rndis_connect_state[i] = proc_create_data(name, 0660, NULL,
                                         &rndis_proc_fops,
-                                        (void *)(rndis_per_dev_params + i))))
-                {
-                        pr_debug("%s :remove entries", __func__);
+                                        (void *)(rndis_per_dev_params + i));
+                if (!rndis_connect_state[i]) {
+                        pr_debug("%s: remove entries", __func__);
                         while (i) {
-                                sprintf (name, NAME_TEMPLATE, --i);
-                                remove_proc_entry (name, NULL);
+                                sprintf(name, NAME_TEMPLATE, --i);
+                                remove_proc_entry(name, NULL);
                         }
                         pr_debug("\n");
                         return -EIO;
                 }
 #endif
-                rndis_per_dev_params [i].confignr = i;
-                rndis_per_dev_params [i].used = 0;
-                rndis_per_dev_params [i].state = RNDIS_UNINITIALIZED;
-                rndis_per_dev_params [i].media_state
+                rndis_per_dev_params[i].confignr = i;
+                rndis_per_dev_params[i].used = 0;
+                rndis_per_dev_params[i].state = RNDIS_UNINITIALIZED;
+                rndis_per_dev_params[i].media_state
                                 = NDIS_MEDIA_STATE_DISCONNECTED;
-                INIT_LIST_HEAD (&(rndis_per_dev_params [i].resp_queue));
+                INIT_LIST_HEAD(&(rndis_per_dev_params[i].resp_queue));
         }
 
         return 0;
 }
 
-void rndis_exit (void)
+void rndis_exit(void)
 {
-#ifdef  CONFIG_USB_GADGET_DEBUG_FILES
+#ifdef CONFIG_USB_GADGET_DEBUG_FILES
         u8 i;
-        char name [20];
+        char name[20];
 
         for (i = 0; i < RNDIS_MAX_CONFIGS; i++) {
-                sprintf (name, NAME_TEMPLATE, i);
-                remove_proc_entry (name, NULL);
+                sprintf(name, NAME_TEMPLATE, i);
+                remove_proc_entry(name, NULL);
         }
 #endif
 }
-
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index a229744a8c7d..0dfee282878a 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -1,5 +1,8 @@
 /* linux/drivers/usb/gadget/s3c-hsotg.c
  *
+ * Copyright (c) 2011 Samsung Electronics Co., Ltd.
+ *              http://www.samsung.com
+ *
  * Copyright 2008 Openmoko, Inc.
  * Copyright 2008 Simtec Electronics
  *      Ben Dooks <ben@simtec.co.uk>
@@ -41,8 +44,8 @@
 /* EP0_MPS_LIMIT
  *
  * Unfortunately there seems to be a limit of the amount of data that can
- * be transfered by IN transactions on EP0. This is either 127 bytes or 3
- * packets (which practially means 1 packet and 63 bytes of data) when the
+ * be transferred by IN transactions on EP0. This is either 127 bytes or 3
+ * packets (which practically means 1 packet and 63 bytes of data) when the
  * MPS is set to 64.
  *
  * This means if we are wanting to move >127 bytes of data, we need to
@@ -613,11 +616,10 @@ static unsigned get_ep_limit(struct s3c_hsotg_ep *hs_ep)
                 maxpkt = S3C_DxEPTSIZ_PktCnt_LIMIT + 1;
         } else {
                 maxsize = 64+64;
-                if (hs_ep->dir_in) {
+                if (hs_ep->dir_in)
                         maxpkt = S3C_DIEPTSIZ0_PktCnt_LIMIT + 1;
-                } else {
+                else
                         maxpkt = 2;
-                }
         }
 
         /* we made the constant loading easier above by using +1 */
@@ -679,6 +681,14 @@ static void s3c_hsotg_start_req(struct s3c_hsotg *hsotg,
                 __func__, readl(hsotg->regs + epctrl_reg), index,
                 hs_ep->dir_in ? "in" : "out");
 
+        /* If endpoint is stalled, we will restart request later */
+        ctrl = readl(hsotg->regs + epctrl_reg);
+
+        if (ctrl & S3C_DxEPCTL_Stall) {
+                dev_warn(hsotg->dev, "%s: ep%d is stalled\n", __func__, index);
+                return;
+        }
+
         length = ureq->length - ureq->actual;
 
         if (0)
@@ -731,18 +741,6 @@ static void s3c_hsotg_start_req(struct s3c_hsotg *hsotg,
         /* write size / packets */
         writel(epsize, hsotg->regs + epsize_reg);
 
-        ctrl = readl(hsotg->regs + epctrl_reg);
-
-        if (ctrl & S3C_DxEPCTL_Stall) {
-                dev_warn(hsotg->dev, "%s: ep%d is stalled\n", __func__, index);
-
-                /* not sure what we can do here, if it is EP0 then we should
-                 * get this cleared once the endpoint has transmitted the
-                 * STALL packet, otherwise it needs to be cleared by the
-                 * host.
-                 */
-        }
-
         if (using_dma(hsotg)) {
                 unsigned int dma_reg;
 
@@ -783,7 +781,7 @@ static void s3c_hsotg_start_req(struct s3c_hsotg *hsotg,
                        hsotg->regs + S3C_DIEPINT(index));
 
         /* Note, trying to clear the NAK here causes problems with transmit
-         * on the S3C6400 ending up with the TXFIFO becomming full. */
+         * on the S3C6400 ending up with the TXFIFO becoming full. */
 
         /* check ep is enabled */
         if (!(readl(hsotg->regs + epctrl_reg) & S3C_DxEPCTL_EPEna))
@@ -1048,6 +1046,20 @@ static int s3c_hsotg_process_req_status(struct s3c_hsotg *hsotg,
 static int s3c_hsotg_ep_sethalt(struct usb_ep *ep, int value);
 
 /**
+ * get_ep_head - return the first request on the endpoint
+ * @hs_ep: The controller endpoint to get
+ *
+ * Get the first request on the endpoint.
+ */
+static struct s3c_hsotg_req *get_ep_head(struct s3c_hsotg_ep *hs_ep)
+{
+        if (list_empty(&hs_ep->queue))
+                return NULL;
+
+        return list_first_entry(&hs_ep->queue, struct s3c_hsotg_req, queue);
+}
+
+/**
  * s3c_hsotg_process_req_featire - process request {SET,CLEAR}_FEATURE
  * @hsotg: The device state
  * @ctrl: USB control request
@@ -1055,8 +1067,12 @@ static int s3c_hsotg_ep_sethalt(struct usb_ep *ep, int value);
 static int s3c_hsotg_process_req_feature(struct s3c_hsotg *hsotg,
                                          struct usb_ctrlrequest *ctrl)
 {
+        struct s3c_hsotg_ep *ep0 = &hsotg->eps[0];
+        struct s3c_hsotg_req *hs_req;
+        bool restart;
         bool set = (ctrl->bRequest == USB_REQ_SET_FEATURE);
         struct s3c_hsotg_ep *ep;
+        int ret;
 
         dev_dbg(hsotg->dev, "%s: %s_FEATURE\n",
                 __func__, set ? "SET" : "CLEAR");
@@ -1072,6 +1088,36 @@ static int s3c_hsotg_process_req_feature(struct s3c_hsotg *hsotg,
                 switch (le16_to_cpu(ctrl->wValue)) {
                 case USB_ENDPOINT_HALT:
                         s3c_hsotg_ep_sethalt(&ep->ep, set);
+
+                        ret = s3c_hsotg_send_reply(hsotg, ep0, NULL, 0);
+                        if (ret) {
+                                dev_err(hsotg->dev,
+                                        "%s: failed to send reply\n", __func__);
+                                return ret;
+                        }
+
+                        if (!set) {
+                                /*
+                                 * If we have request in progress,
+                                 * then complete it
+                                 */
+                                if (ep->req) {
+                                        hs_req = ep->req;
+                                        ep->req = NULL;
+                                        list_del_init(&hs_req->queue);
+                                        hs_req->req.complete(&ep->ep,
+                                                             &hs_req->req);
+                                }
+
+                                /* If we have pending request, then start it */
+                                restart = !list_empty(&ep->queue);
+                                if (restart) {
+                                        hs_req = get_ep_head(ep);
+                                        s3c_hsotg_start_req(hsotg, ep,
+                                                            hs_req, false);
+                                }
+                        }
+
                         break;
 
                 default:
@@ -1148,14 +1194,6 @@ static void s3c_hsotg_process_control(struct s3c_hsotg *hsotg,
                         dev_dbg(hsotg->dev, "driver->setup() ret %d\n", ret);
         }
 
-        if (ret > 0) {
-                if (!ep0->dir_in) {
-                        /* need to generate zlp in reply or take data */
-                        /* todo - deal with any data we might be sent? */
-                        ret = s3c_hsotg_send_reply(hsotg, ep0, NULL, 0);
-                }
-        }
-
         /* the request is either unhandlable, or is not formatted correctly
          * so respond with a STALL for the status stage to indicate failure.
          */
@@ -1176,10 +1214,10 @@ static void s3c_hsotg_process_control(struct s3c_hsotg *hsotg,
                 writel(ctrl, hsotg->regs + reg);
 
                 dev_dbg(hsotg->dev,
-                        "writen DxEPCTL=0x%08x to %08x (DxEPCTL=0x%08x)\n",
+                        "written DxEPCTL=0x%08x to %08x (DxEPCTL=0x%08x)\n",
                         ctrl, reg, readl(hsotg->regs + reg));
 
-                /* don't belive we need to anything more to get the EP
+                /* don't believe we need to anything more to get the EP
                  * to reply with a STALL packet */
         }
 }
@@ -1247,20 +1285,6 @@ static void s3c_hsotg_enqueue_setup(struct s3c_hsotg *hsotg)
 }
 
 /**
- * get_ep_head - return the first request on the endpoint
- * @hs_ep: The controller endpoint to get
- *
- * Get the first request on the endpoint.
-*/
-static struct s3c_hsotg_req *get_ep_head(struct s3c_hsotg_ep *hs_ep)
-{
-        if (list_empty(&hs_ep->queue))
-                return NULL;
-
-        return list_first_entry(&hs_ep->queue, struct s3c_hsotg_req, queue);
-}
-
-/**
  * s3c_hsotg_complete_request - complete a request given to us
  * @hsotg: The device state.
  * @hs_ep: The endpoint the request was on.
@@ -1416,7 +1440,7 @@ static void s3c_hsotg_rx_data(struct s3c_hsotg *hsotg, int ep_idx, int size)
  * transaction.
  *
  * Note, since we don't write any data to the TxFIFO, then it is
- * currently belived that we do not need to wait for any space in
+ * currently believed that we do not need to wait for any space in
  * the TxFIFO.
  */
 static void s3c_hsotg_send_zlp(struct s3c_hsotg *hsotg,
@@ -1540,7 +1564,7 @@ static u32 s3c_hsotg_read_frameno(struct s3c_hsotg *hsotg)
  * that requires processing, so find out what is in there and do the
  * appropriate read.
  *
- * The RXFIFO is a true FIFO, the packets comming out are still in packet
+ * The RXFIFO is a true FIFO, the packets coming out are still in packet
  * chunks, so if you have x packets received on an endpoint you'll get x
  * FIFO events delivered, each with a packet's worth of data in it.
  *
@@ -1683,6 +1707,37 @@ bad_mps:
         dev_err(hsotg->dev, "ep%d: bad mps of %d\n", ep, mps);
 }
 
+/**
+ * s3c_hsotg_txfifo_flush - flush Tx FIFO
+ * @hsotg: The driver state
+ * @idx: The index for the endpoint (0..15)
+ */
+static void s3c_hsotg_txfifo_flush(struct s3c_hsotg *hsotg, unsigned int idx)
+{
+        int timeout;
+        int val;
+
+        writel(S3C_GRSTCTL_TxFNum(idx) | S3C_GRSTCTL_TxFFlsh,
+                hsotg->regs + S3C_GRSTCTL);
+
+        /* wait until the fifo is flushed */
+        timeout = 100;
+
+        while (1) {
+                val = readl(hsotg->regs + S3C_GRSTCTL);
+
+                if ((val & (S3C_GRSTCTL_TxFFlsh)) == 0)
+                        break;
+
+                if (--timeout == 0) {
+                        dev_err(hsotg->dev,
+                                "%s: timeout flushing fifo (GRSTCTL=%08x)\n",
+                                __func__, val);
+                }
+
+                udelay(1);
+        }
+}
 
 /**
  * s3c_hsotg_trytx - check to see if anything needs transmitting
@@ -1775,10 +1830,12 @@ static void s3c_hsotg_epint(struct s3c_hsotg *hsotg, unsigned int idx,
         u32 epctl_reg = dir_in ? S3C_DIEPCTL(idx) : S3C_DOEPCTL(idx);
         u32 epsiz_reg = dir_in ? S3C_DIEPTSIZ(idx) : S3C_DOEPTSIZ(idx);
         u32 ints;
-        u32 clear = 0;
 
         ints = readl(hsotg->regs + epint_reg);
 
+        /* Clear endpoint interrupts */
+        writel(ints, hsotg->regs + epint_reg);
+
         dev_dbg(hsotg->dev, "%s: ep%d(%s) DxEPINT=0x%08x\n",
                 __func__, idx, dir_in ? "in" : "out", ints);
 
@@ -1801,19 +1858,28 @@ static void s3c_hsotg_epint(struct s3c_hsotg *hsotg, unsigned int idx,
 
                         s3c_hsotg_handle_outdone(hsotg, idx, false);
                 }
-
-                clear |= S3C_DxEPINT_XferCompl;
         }
 
         if (ints & S3C_DxEPINT_EPDisbld) {
                 dev_dbg(hsotg->dev, "%s: EPDisbld\n", __func__);
-                clear |= S3C_DxEPINT_EPDisbld;
+
+                if (dir_in) {
+                        int epctl = readl(hsotg->regs + epctl_reg);
+
+                        s3c_hsotg_txfifo_flush(hsotg, idx);
+
+                        if ((epctl & S3C_DxEPCTL_Stall) &&
+                                (epctl & S3C_DxEPCTL_EPType_Bulk)) {
+                                int dctl = readl(hsotg->regs + S3C_DCTL);
+
+                                dctl |= S3C_DCTL_CGNPInNAK;
+                                writel(dctl, hsotg->regs + S3C_DCTL);
+                        }
+                }
         }
 
-        if (ints & S3C_DxEPINT_AHBErr) {
+        if (ints & S3C_DxEPINT_AHBErr)
                 dev_dbg(hsotg->dev, "%s: AHBErr\n", __func__);
-                clear |= S3C_DxEPINT_AHBErr;
-        }
 
         if (ints & S3C_DxEPINT_Setup) {  /* Setup or Timeout */
                 dev_dbg(hsotg->dev, "%s: Setup/Timeout\n",  __func__);
@@ -1829,14 +1895,10 @@ static void s3c_hsotg_epint(struct s3c_hsotg *hsotg, unsigned int idx,
                         else
                                 s3c_hsotg_handle_outdone(hsotg, 0, true);
                 }
-
-                clear |= S3C_DxEPINT_Setup;
         }
 
-        if (ints & S3C_DxEPINT_Back2BackSetup) {
+        if (ints & S3C_DxEPINT_Back2BackSetup)
                 dev_dbg(hsotg->dev, "%s: B2BSetup/INEPNakEff\n", __func__);
-                clear |= S3C_DxEPINT_Back2BackSetup;
-        }
 
         if (dir_in) {
                 /* not sure if this is important, but we'll clear it anyway
@@ -1844,14 +1906,12 @@ static void s3c_hsotg_epint(struct s3c_hsotg *hsotg, unsigned int idx,
                 if (ints & S3C_DIEPMSK_INTknTXFEmpMsk) {
                         dev_dbg(hsotg->dev, "%s: ep%d: INTknTXFEmpMsk\n",
                                 __func__, idx);
-                        clear |= S3C_DIEPMSK_INTknTXFEmpMsk;
                 }
 
                 /* this probably means something bad is happening */
                 if (ints & S3C_DIEPMSK_INTknEPMisMsk) {
                         dev_warn(hsotg->dev, "%s: ep%d: INTknEP\n",
                                  __func__, idx);
-                        clear |= S3C_DIEPMSK_INTknEPMisMsk;
                 }
 
                 /* FIFO has space or is empty (see GAHBCFG) */
@@ -1860,11 +1920,8 @@ static void s3c_hsotg_epint(struct s3c_hsotg *hsotg, unsigned int idx,
                         dev_dbg(hsotg->dev, "%s: ep%d: TxFIFOEmpty\n",
                                 __func__, idx);
                         s3c_hsotg_trytx(hsotg, hs_ep);
-                        clear |= S3C_DIEPMSK_TxFIFOEmpty;
                 }
         }
-
-        writel(clear, hsotg->regs + epint_reg);
 }
 
 /**
@@ -2056,7 +2113,6 @@ irq_retry:
                 dev_info(hsotg->dev, "OTGInt: %08x\n", otgint);
 
                 writel(otgint, hsotg->regs + S3C_GOTGINT);
-                writel(S3C_GINTSTS_OTGInt, hsotg->regs + S3C_GINTSTS);
         }
 
         if (gintsts & S3C_GINTSTS_DisconnInt) {
@@ -2072,8 +2128,9 @@ irq_retry:
         }
 
         if (gintsts & S3C_GINTSTS_EnumDone) {
-                s3c_hsotg_irq_enumdone(hsotg);
                 writel(S3C_GINTSTS_EnumDone, hsotg->regs + S3C_GINTSTS);
+
+                s3c_hsotg_irq_enumdone(hsotg);
         }
 
         if (gintsts & S3C_GINTSTS_ConIDStsChng) {
@@ -2101,10 +2158,6 @@ irq_retry:
                         if (daint_in & 1)
                                 s3c_hsotg_epint(hsotg, ep, 1);
                 }
-
-                writel(daint, hsotg->regs + S3C_DAINT);
-                writel(gintsts & (S3C_GINTSTS_OEPInt | S3C_GINTSTS_IEPInt),
-                       hsotg->regs + S3C_GINTSTS);
         }
 
         if (gintsts & S3C_GINTSTS_USBRst) {
@@ -2112,6 +2165,8 @@ irq_retry:
                 dev_dbg(hsotg->dev, "GNPTXSTS=%08x\n",
                         readl(hsotg->regs + S3C_GNPTXSTS));
 
+                writel(S3C_GINTSTS_USBRst, hsotg->regs + S3C_GINTSTS);
+
                 kill_all_requests(hsotg, &hsotg->eps[0], -ECONNRESET, true);
 
                 /* it seems after a reset we can end up with a situation
@@ -2123,8 +2178,6 @@ irq_retry:
                 s3c_hsotg_init_fifo(hsotg);
 
                 s3c_hsotg_enqueue_setup(hsotg);
-
-                writel(S3C_GINTSTS_USBRst, hsotg->regs + S3C_GINTSTS);
         }
 
         /* check both FIFOs */
@@ -2138,8 +2191,6 @@ irq_retry:
 
                 s3c_hsotg_disable_gsint(hsotg, S3C_GINTSTS_NPTxFEmp);
                 s3c_hsotg_irq_fifoempty(hsotg, false);
-
-                writel(S3C_GINTSTS_NPTxFEmp, hsotg->regs + S3C_GINTSTS);
         }
 
         if (gintsts & S3C_GINTSTS_PTxFEmp) {
@@ -2149,8 +2200,6 @@ irq_retry:
 
                 s3c_hsotg_disable_gsint(hsotg, S3C_GINTSTS_PTxFEmp);
                 s3c_hsotg_irq_fifoempty(hsotg, true);
-
-                writel(S3C_GINTSTS_PTxFEmp, hsotg->regs + S3C_GINTSTS);
         }
 
         if (gintsts & S3C_GINTSTS_RxFLvl) {
@@ -2159,7 +2208,6 @@ irq_retry:
                  * set. */
 
                 s3c_hsotg_handle_rx(hsotg);
-                writel(S3C_GINTSTS_RxFLvl, hsotg->regs + S3C_GINTSTS);
         }
 
         if (gintsts & S3C_GINTSTS_ModeMis) {
@@ -2188,24 +2236,22 @@ irq_retry:
 
         /* these next two seem to crop-up occasionally causing the core
          * to shutdown the USB transfer, so try clearing them and logging
-         * the occurence. */
+         * the occurrence. */
 
         if (gintsts & S3C_GINTSTS_GOUTNakEff) {
                 dev_info(hsotg->dev, "GOUTNakEff triggered\n");
 
-                s3c_hsotg_dump(hsotg);
-
                 writel(S3C_DCTL_CGOUTNak, hsotg->regs + S3C_DCTL);
-                writel(S3C_GINTSTS_GOUTNakEff, hsotg->regs + S3C_GINTSTS);
+
+                s3c_hsotg_dump(hsotg);
         }
 
         if (gintsts & S3C_GINTSTS_GINNakEff) {
                 dev_info(hsotg->dev, "GINNakEff triggered\n");
 
-                s3c_hsotg_dump(hsotg);
-
                 writel(S3C_DCTL_CGNPInNAK, hsotg->regs + S3C_DCTL);
-                writel(S3C_GINTSTS_GINNakEff, hsotg->regs + S3C_GINTSTS);
+
+                s3c_hsotg_dump(hsotg);
         }
 
         /* if we've had fifo events, we should try and go around the
@@ -2403,11 +2449,6 @@ static int s3c_hsotg_ep_dequeue(struct usb_ep *ep, struct usb_request *req)
 
         dev_info(hs->dev, "ep_dequeue(%p,%p)\n", ep, req);
 
-        if (hs_req == hs_ep->req) {
-                dev_dbg(hs->dev, "%s: already in progress\n", __func__);
-                return -EINPROGRESS;
-        }
-
         spin_lock_irqsave(&hs_ep->lock, flags);
 
         if (!on_list(hs_ep, hs_req)) {
@@ -2429,6 +2470,7 @@ static int s3c_hsotg_ep_sethalt(struct usb_ep *ep, int value)
         unsigned long irqflags;
         u32 epreg;
         u32 epctl;
+        u32 xfertype;
 
         dev_info(hs->dev, "%s(ep %p %s, %d)\n", __func__, ep, ep->name, value);
 
@@ -2439,10 +2481,17 @@ static int s3c_hsotg_ep_sethalt(struct usb_ep *ep, int value)
         epreg = S3C_DIEPCTL(index);
         epctl = readl(hs->regs + epreg);
 
-        if (value)
-                epctl |= S3C_DxEPCTL_Stall;
-        else
+        if (value) {
+                epctl |= S3C_DxEPCTL_Stall + S3C_DxEPCTL_SNAK;
+                if (epctl & S3C_DxEPCTL_EPEna)
+                        epctl |= S3C_DxEPCTL_EPDis;
+        } else {
                 epctl &= ~S3C_DxEPCTL_Stall;
+                xfertype = epctl & S3C_DxEPCTL_EPType_MASK;
+                if (xfertype == S3C_DxEPCTL_EPType_Bulk ||
+                        xfertype == S3C_DxEPCTL_EPType_Intterupt)
+                                epctl |= S3C_DxEPCTL_SetD0PID;
+        }
 
         writel(epctl, hs->regs + epreg);
 
@@ -2451,8 +2500,13 @@ static int s3c_hsotg_ep_sethalt(struct usb_ep *ep, int value)
 
         if (value)
                 epctl |= S3C_DxEPCTL_Stall;
-        else
+        else {
                 epctl &= ~S3C_DxEPCTL_Stall;
+                xfertype = epctl & S3C_DxEPCTL_EPType_MASK;
+                if (xfertype == S3C_DxEPCTL_EPType_Bulk ||
+                        xfertype == S3C_DxEPCTL_EPType_Intterupt)
+                                epctl |= S3C_DxEPCTL_SetD0PID;
+        }
 
         writel(epctl, hs->regs + epreg);
 
@@ -2469,7 +2523,7 @@ static struct usb_ep_ops s3c_hsotg_ep_ops = {
         .queue          = s3c_hsotg_ep_queue,
         .dequeue        = s3c_hsotg_ep_dequeue,
         .set_halt       = s3c_hsotg_ep_sethalt,
-        /* note, don't belive we have any call for the fifo routines */
+        /* note, don't believe we have any call for the fifo routines */
 };
 
 /**
@@ -2491,9 +2545,9 @@ static int s3c_hsotg_corereset(struct s3c_hsotg *hsotg)
         timeout = 1000;
         do {
                 grstctl = readl(hsotg->regs + S3C_GRSTCTL);
-        } while (!(grstctl & S3C_GRSTCTL_CSftRst) && timeout-- > 0);
+        } while ((grstctl & S3C_GRSTCTL_CSftRst) && timeout-- > 0);
 
-        if (!(grstctl & S3C_GRSTCTL_CSftRst)) {
+        if (grstctl & S3C_GRSTCTL_CSftRst) {
                 dev_err(hsotg->dev, "Failed to get CSftRst asserted\n");
                 return -EINVAL;
         }
@@ -2510,20 +2564,18 @@ static int s3c_hsotg_corereset(struct s3c_hsotg *hsotg)
                         return -ETIMEDOUT;
                 }
 
-                if (grstctl & S3C_GRSTCTL_CSftRst)
-                        continue;
-
                 if (!(grstctl & S3C_GRSTCTL_AHBIdle))
                         continue;
 
-                break;          /* reset done */
+                break;          /* reset done */
         }
 
         dev_dbg(hsotg->dev, "reset successful\n");
         return 0;
 }
 
-int usb_gadget_register_driver(struct usb_gadget_driver *driver)
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
 {
         struct s3c_hsotg *hsotg = our_hsotg;
         int ret;
@@ -2543,7 +2595,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
                 dev_err(hsotg->dev, "%s: bad speed\n", __func__);
         }
 
-        if (!driver->bind || !driver->setup) {
+        if (!bind || !driver->setup) {
                 dev_err(hsotg->dev, "%s: missing entry points\n", __func__);
                 return -EINVAL;
         }
@@ -2562,7 +2614,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
                 goto err;
         }
 
-        ret = driver->bind(&hsotg->gadget);
+        ret = bind(&hsotg->gadget);
         if (ret) {
                 dev_err(hsotg->dev, "failed bind %s\n", driver->driver.name);
 
@@ -2587,6 +2639,12 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
 
         writel(1 << 18 | S3C_DCFG_DevSpd_HS,  hsotg->regs + S3C_DCFG);
 
+        /* Clear any pending OTG interrupts */
+        writel(0xffffffff, hsotg->regs + S3C_GOTGINT);
+
+        /* Clear any pending interrupts */
+        writel(0xffffffff, hsotg->regs + S3C_GINTSTS);
+
         writel(S3C_GINTSTS_DisconnInt | S3C_GINTSTS_SessReqInt |
                S3C_GINTSTS_ConIDStsChng | S3C_GINTSTS_USBRst |
                S3C_GINTSTS_EnumDone | S3C_GINTSTS_OTGInt |
@@ -2622,9 +2680,9 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
 
         writel(0, hsotg->regs + S3C_DAINTMSK);
 
-        dev_info(hsotg->dev, "EP0: DIEPCTL0=0x%08x, DOEPCTL0=0x%08x\n",
-                 readl(hsotg->regs + S3C_DIEPCTL0),
-                 readl(hsotg->regs + S3C_DOEPCTL0));
+        dev_dbg(hsotg->dev, "EP0: DIEPCTL0=0x%08x, DOEPCTL0=0x%08x\n",
+                readl(hsotg->regs + S3C_DIEPCTL0),
+                readl(hsotg->regs + S3C_DOEPCTL0));
 
         /* enable in and out endpoint interrupts */
         s3c_hsotg_en_gsint(hsotg, S3C_GINTSTS_OEPInt | S3C_GINTSTS_IEPInt);
@@ -2643,7 +2701,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
         udelay(10);  /* see openiboot */
         __bic32(hsotg->regs + S3C_DCTL, S3C_DCTL_PWROnPrgDone);
 
-        dev_info(hsotg->dev, "DCTL=0x%08x\n", readl(hsotg->regs + S3C_DCTL));
+        dev_dbg(hsotg->dev, "DCTL=0x%08x\n", readl(hsotg->regs + S3C_DCTL));
 
         /* S3C_DxEPCTL_USBActEp says RO in manual, but seems to be set by
            writing to the EPCTL register.. */
@@ -2663,9 +2721,9 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
 
         s3c_hsotg_enqueue_setup(hsotg);
 
-        dev_info(hsotg->dev, "EP0: DIEPCTL0=0x%08x, DOEPCTL0=0x%08x\n",
-                 readl(hsotg->regs + S3C_DIEPCTL0),
-                 readl(hsotg->regs + S3C_DOEPCTL0));
+        dev_dbg(hsotg->dev, "EP0: DIEPCTL0=0x%08x, DOEPCTL0=0x%08x\n",
+                readl(hsotg->regs + S3C_DIEPCTL0),
+                readl(hsotg->regs + S3C_DOEPCTL0));
 
         /* clear global NAKs */
         writel(S3C_DCTL_CGOUTNak | S3C_DCTL_CGNPInNAK,
@@ -2687,7 +2745,7 @@ err:
         hsotg->gadget.dev.driver = NULL;
         return ret;
 }
-EXPORT_SYMBOL(usb_gadget_register_driver);
+EXPORT_SYMBOL(usb_gadget_probe_driver);
 
 int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
 {
@@ -2863,9 +2921,9 @@ static void s3c_hsotg_init(struct s3c_hsotg *hsotg)
 
         /* setup fifos */
 
-        dev_info(hsotg->dev, "GRXFSIZ=0x%08x, GNPTXFSIZ=0x%08x\n",
-                 readl(hsotg->regs + S3C_GRXFSIZ),
-                 readl(hsotg->regs + S3C_GNPTXFSIZ));
+        dev_dbg(hsotg->dev, "GRXFSIZ=0x%08x, GNPTXFSIZ=0x%08x\n",
+                readl(hsotg->regs + S3C_GRXFSIZ),
+                readl(hsotg->regs + S3C_GNPTXFSIZ));
 
         s3c_hsotg_init_fifo(hsotg);
 
@@ -2887,6 +2945,7 @@ static void s3c_hsotg_init(struct s3c_hsotg *hsotg)
 
 static void s3c_hsotg_dump(struct s3c_hsotg *hsotg)
 {
+#ifdef DEBUG
         struct device *dev = hsotg->dev;
         void __iomem *regs = hsotg->regs;
         u32 val;
@@ -2929,6 +2988,7 @@ static void s3c_hsotg_dump(struct s3c_hsotg *hsotg)
 
         dev_info(dev, "DVBUSDIS=0x%08x, DVBUSPULSE=%08x\n",
                  readl(regs + S3C_DVBUSDIS), readl(regs + S3C_DVBUSPULSE));
+#endif
 }
 
 
@@ -3260,7 +3320,7 @@ static int __devinit s3c_hsotg_probe(struct platform_device *pdev)
         hsotg->clk = clk_get(&pdev->dev, "otg");
         if (IS_ERR(hsotg->clk)) {
                 dev_err(dev, "cannot get otg clock\n");
-                ret = -EINVAL;
+                ret = PTR_ERR(hsotg->clk);
                 goto err_mem;
         }
 
diff --git a/drivers/usb/gadget/s3c-hsudc.c b/drivers/usb/gadget/s3c-hsudc.c
new file mode 100644
index 000000000000..d5e3e1e58626
--- /dev/null
+++ b/drivers/usb/gadget/s3c-hsudc.c
@@ -0,0 +1,1352 @@
+/* linux/drivers/usb/gadget/s3c-hsudc.c
+ *
+ * Copyright (c) 2010 Samsung Electronics Co., Ltd.
+ *              http://www.samsung.com/
+ *
+ * S3C24XX USB 2.0 High-speed USB controller gadget driver
+ *
+ * The S3C24XX USB 2.0 high-speed USB controller supports upto 9 endpoints.
+ * Each endpoint can be configured as either in or out endpoint. Endpoints
+ * can be configured for Bulk or Interrupt transfer mode.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+*/
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/spinlock.h>
+#include <linux/interrupt.h>
+#include <linux/platform_device.h>
+#include <linux/dma-mapping.h>
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/slab.h>
+#include <linux/clk.h>
+#include <linux/usb/ch9.h>
+#include <linux/usb/gadget.h>
+#include <linux/prefetch.h>
+
+#include <mach/regs-s3c2443-clock.h>
+#include <plat/udc.h>
+
+#define S3C_HSUDC_REG(x)        (x)
+
+/* Non-Indexed Registers */
+#define S3C_IR                          S3C_HSUDC_REG(0x00) /* Index Register */
+#define S3C_EIR                         S3C_HSUDC_REG(0x04) /* EP Intr Status */
+#define S3C_EIR_EP0                     (1<<0)
+#define S3C_EIER                        S3C_HSUDC_REG(0x08) /* EP Intr Enable */
+#define S3C_FAR                         S3C_HSUDC_REG(0x0c) /* Gadget Address */
+#define S3C_FNR                         S3C_HSUDC_REG(0x10) /* Frame Number */
+#define S3C_EDR                         S3C_HSUDC_REG(0x14) /* EP Direction */
+#define S3C_TR                          S3C_HSUDC_REG(0x18) /* Test Register */
+#define S3C_SSR                         S3C_HSUDC_REG(0x1c) /* System Status */
+#define S3C_SSR_DTZIEN_EN               (0xff8f)
+#define S3C_SSR_ERR                     (0xff80)
+#define S3C_SSR_VBUSON                  (1 << 8)
+#define S3C_SSR_HSP                     (1 << 4)
+#define S3C_SSR_SDE                     (1 << 3)
+#define S3C_SSR_RESUME                  (1 << 2)
+#define S3C_SSR_SUSPEND                 (1 << 1)
+#define S3C_SSR_RESET                   (1 << 0)
+#define S3C_SCR                         S3C_HSUDC_REG(0x20) /* System Control */
+#define S3C_SCR_DTZIEN_EN               (1 << 14)
+#define S3C_SCR_RRD_EN                  (1 << 5)
+#define S3C_SCR_SUS_EN                  (1 << 1)
+#define S3C_SCR_RST_EN                  (1 << 0)
+#define S3C_EP0SR                       S3C_HSUDC_REG(0x24) /* EP0 Status */
+#define S3C_EP0SR_EP0_LWO               (1 << 6)
+#define S3C_EP0SR_STALL                 (1 << 4)
+#define S3C_EP0SR_TX_SUCCESS            (1 << 1)
+#define S3C_EP0SR_RX_SUCCESS            (1 << 0)
+#define S3C_EP0CR                       S3C_HSUDC_REG(0x28) /* EP0 Control */
+#define S3C_BR(_x)                      S3C_HSUDC_REG(0x60 + (_x * 4))
+
+/* Indexed Registers */
+#define S3C_ESR                         S3C_HSUDC_REG(0x2c) /* EPn Status */
+#define S3C_ESR_FLUSH                   (1 << 6)
+#define S3C_ESR_STALL                   (1 << 5)
+#define S3C_ESR_LWO                     (1 << 4)
+#define S3C_ESR_PSIF_ONE                (1 << 2)
+#define S3C_ESR_PSIF_TWO                (2 << 2)
+#define S3C_ESR_TX_SUCCESS              (1 << 1)
+#define S3C_ESR_RX_SUCCESS              (1 << 0)
+#define S3C_ECR                         S3C_HSUDC_REG(0x30) /* EPn Control */
+#define S3C_ECR_DUEN                    (1 << 7)
+#define S3C_ECR_FLUSH                   (1 << 6)
+#define S3C_ECR_STALL                   (1 << 1)
+#define S3C_ECR_IEMS                    (1 << 0)
+#define S3C_BRCR                        S3C_HSUDC_REG(0x34) /* Read Count */
+#define S3C_BWCR                        S3C_HSUDC_REG(0x38) /* Write Count */
+#define S3C_MPR                         S3C_HSUDC_REG(0x3c) /* Max Pkt Size */
+
+#define WAIT_FOR_SETUP                  (0)
+#define DATA_STATE_XMIT                 (1)
+#define DATA_STATE_RECV                 (2)
+
+/**
+ * struct s3c_hsudc_ep - Endpoint representation used by driver.
+ * @ep: USB gadget layer representation of device endpoint.
+ * @name: Endpoint name (as required by ep autoconfiguration).
+ * @dev: Reference to the device controller to which this EP belongs.
+ * @desc: Endpoint descriptor obtained from the gadget driver.
+ * @queue: Transfer request queue for the endpoint.
+ * @stopped: Maintains state of endpoint, set if EP is halted.
+ * @bEndpointAddress: EP address (including direction bit).
+ * @fifo: Base address of EP FIFO.
+ */
+struct s3c_hsudc_ep {
+        struct usb_ep ep;
+        char name[20];
+        struct s3c_hsudc *dev;
+        const struct usb_endpoint_descriptor *desc;
+        struct list_head queue;
+        u8 stopped;
+        u8 wedge;
+        u8 bEndpointAddress;
+        void __iomem *fifo;
+};
+
+/**
+ * struct s3c_hsudc_req - Driver encapsulation of USB gadget transfer request.
+ * @req: Reference to USB gadget transfer request.
+ * @queue: Used for inserting this request to the endpoint request queue.
+ */
+struct s3c_hsudc_req {
+        struct usb_request req;
+        struct list_head queue;
+};
+
+/**
+ * struct s3c_hsudc - Driver's abstraction of the device controller.
+ * @gadget: Instance of usb_gadget which is referenced by gadget driver.
+ * @driver: Reference to currenty active gadget driver.
+ * @dev: The device reference used by probe function.
+ * @lock: Lock to synchronize the usage of Endpoints (EP's are indexed).
+ * @regs: Remapped base address of controller's register space.
+ * @mem_rsrc: Device memory resource used for remapping device register space.
+ * irq: IRQ number used by the controller.
+ * uclk: Reference to the controller clock.
+ * ep0state: Current state of EP0.
+ * ep: List of endpoints supported by the controller.
+ */
+struct s3c_hsudc {
+        struct usb_gadget gadget;
+        struct usb_gadget_driver *driver;
+        struct device *dev;
+        struct s3c24xx_hsudc_platdata *pd;
+        spinlock_t lock;
+        void __iomem *regs;
+        struct resource *mem_rsrc;
+        int irq;
+        struct clk *uclk;
+        int ep0state;
+        struct s3c_hsudc_ep ep[];
+};
+
+#define ep_maxpacket(_ep)       ((_ep)->ep.maxpacket)
+#define ep_is_in(_ep)           ((_ep)->bEndpointAddress & USB_DIR_IN)
+#define ep_index(_ep)           ((_ep)->bEndpointAddress & \
+                                        USB_ENDPOINT_NUMBER_MASK)
+
+static struct s3c_hsudc *the_controller;
+static const char driver_name[] = "s3c-udc";
+static const char ep0name[] = "ep0-control";
+
+static inline struct s3c_hsudc_req *our_req(struct usb_request *req)
+{
+        return container_of(req, struct s3c_hsudc_req, req);
+}
+
+static inline struct s3c_hsudc_ep *our_ep(struct usb_ep *ep)
+{
+        return container_of(ep, struct s3c_hsudc_ep, ep);
+}
+
+static inline struct s3c_hsudc *to_hsudc(struct usb_gadget *gadget)
+{
+        return container_of(gadget, struct s3c_hsudc, gadget);
+}
+
+static inline void set_index(struct s3c_hsudc *hsudc, int ep_addr)
+{
+        ep_addr &= USB_ENDPOINT_NUMBER_MASK;
+        writel(ep_addr, hsudc->regs + S3C_IR);
+}
+
+static inline void __orr32(void __iomem *ptr, u32 val)
+{
+        writel(readl(ptr) | val, ptr);
+}
+
+static void s3c_hsudc_init_phy(void)
+{
+        u32 cfg;
+
+        cfg = readl(S3C2443_PWRCFG) | S3C2443_PWRCFG_USBPHY;
+        writel(cfg, S3C2443_PWRCFG);
+
+        cfg = readl(S3C2443_URSTCON);
+        cfg |= (S3C2443_URSTCON_FUNCRST | S3C2443_URSTCON_PHYRST);
+        writel(cfg, S3C2443_URSTCON);
+        mdelay(1);
+
+        cfg = readl(S3C2443_URSTCON);
+        cfg &= ~(S3C2443_URSTCON_FUNCRST | S3C2443_URSTCON_PHYRST);
+        writel(cfg, S3C2443_URSTCON);
+
+        cfg = readl(S3C2443_PHYCTRL);
+        cfg &= ~(S3C2443_PHYCTRL_CLKSEL | S3C2443_PHYCTRL_DSPORT);
+        cfg |= (S3C2443_PHYCTRL_EXTCLK | S3C2443_PHYCTRL_PLLSEL);
+        writel(cfg, S3C2443_PHYCTRL);
+
+        cfg = readl(S3C2443_PHYPWR);
+        cfg &= ~(S3C2443_PHYPWR_FSUSPEND | S3C2443_PHYPWR_PLL_PWRDN |
+                S3C2443_PHYPWR_XO_ON | S3C2443_PHYPWR_PLL_REFCLK |
+                S3C2443_PHYPWR_ANALOG_PD);
+        cfg |= S3C2443_PHYPWR_COMMON_ON;
+        writel(cfg, S3C2443_PHYPWR);
+
+        cfg = readl(S3C2443_UCLKCON);
+        cfg |= (S3C2443_UCLKCON_DETECT_VBUS | S3C2443_UCLKCON_FUNC_CLKEN |
+                S3C2443_UCLKCON_TCLKEN);
+        writel(cfg, S3C2443_UCLKCON);
+}
+
+static void s3c_hsudc_uninit_phy(void)
+{
+        u32 cfg;
+
+        cfg = readl(S3C2443_PWRCFG) & ~S3C2443_PWRCFG_USBPHY;
+        writel(cfg, S3C2443_PWRCFG);
+
+        writel(S3C2443_PHYPWR_FSUSPEND, S3C2443_PHYPWR);
+
+        cfg = readl(S3C2443_UCLKCON) & ~S3C2443_UCLKCON_FUNC_CLKEN;
+        writel(cfg, S3C2443_UCLKCON);
+}
+
+/**
+ * s3c_hsudc_complete_request - Complete a transfer request.
+ * @hsep: Endpoint to which the request belongs.
+ * @hsreq: Transfer request to be completed.
+ * @status: Transfer completion status for the transfer request.
+ */
+static void s3c_hsudc_complete_request(struct s3c_hsudc_ep *hsep,
+                                struct s3c_hsudc_req *hsreq, int status)
+{
+        unsigned int stopped = hsep->stopped;
+        struct s3c_hsudc *hsudc = hsep->dev;
+
+        list_del_init(&hsreq->queue);
+        hsreq->req.status = status;
+
+        if (!ep_index(hsep)) {
+                hsudc->ep0state = WAIT_FOR_SETUP;
+                hsep->bEndpointAddress &= ~USB_DIR_IN;
+        }
+
+        hsep->stopped = 1;
+        spin_unlock(&hsudc->lock);
+        if (hsreq->req.complete != NULL)
+                hsreq->req.complete(&hsep->ep, &hsreq->req);
+        spin_lock(&hsudc->lock);
+        hsep->stopped = stopped;
+}
+
+/**
+ * s3c_hsudc_nuke_ep - Terminate all requests queued for a endpoint.
+ * @hsep: Endpoint for which queued requests have to be terminated.
+ * @status: Transfer completion status for the transfer request.
+ */
+static void s3c_hsudc_nuke_ep(struct s3c_hsudc_ep *hsep, int status)
+{
+        struct s3c_hsudc_req *hsreq;
+
+        while (!list_empty(&hsep->queue)) {
+                hsreq = list_entry(hsep->queue.next,
+                                struct s3c_hsudc_req, queue);
+                s3c_hsudc_complete_request(hsep, hsreq, status);
+        }
+}
+
+/**
+ * s3c_hsudc_stop_activity - Stop activity on all endpoints.
+ * @hsudc: Device controller for which EP activity is to be stopped.
+ * @driver: Reference to the gadget driver which is currently active.
+ *
+ * All the endpoints are stopped and any pending transfer requests if any on
+ * the endpoint are terminated.
+ */
+static void s3c_hsudc_stop_activity(struct s3c_hsudc *hsudc,
+                          struct usb_gadget_driver *driver)
+{
+        struct s3c_hsudc_ep *hsep;
+        int epnum;
+
+        hsudc->gadget.speed = USB_SPEED_UNKNOWN;
+
+        for (epnum = 0; epnum < hsudc->pd->epnum; epnum++) {
+                hsep = &hsudc->ep[epnum];
+                hsep->stopped = 1;
+                s3c_hsudc_nuke_ep(hsep, -ESHUTDOWN);
+        }
+
+        spin_unlock(&hsudc->lock);
+        driver->disconnect(&hsudc->gadget);
+        spin_lock(&hsudc->lock);
+}
+
+/**
+ * s3c_hsudc_read_setup_pkt - Read the received setup packet from EP0 fifo.
+ * @hsudc: Device controller from which setup packet is to be read.
+ * @buf: The buffer into which the setup packet is read.
+ *
+ * The setup packet received in the EP0 fifo is read and stored into a
+ * given buffer address.
+ */
+
+static void s3c_hsudc_read_setup_pkt(struct s3c_hsudc *hsudc, u16 *buf)
+{
+        int count;
+
+        count = readl(hsudc->regs + S3C_BRCR);
+        while (count--)
+                *buf++ = (u16)readl(hsudc->regs + S3C_BR(0));
+
+        writel(S3C_EP0SR_RX_SUCCESS, hsudc->regs + S3C_EP0SR);
+}
+
+/**
+ * s3c_hsudc_write_fifo - Write next chunk of transfer data to EP fifo.
+ * @hsep: Endpoint to which the data is to be written.
+ * @hsreq: Transfer request from which the next chunk of data is written.
+ *
+ * Write the next chunk of data from a transfer request to the endpoint FIFO.
+ * If the transfer request completes, 1 is returned, otherwise 0 is returned.
+ */
+static int s3c_hsudc_write_fifo(struct s3c_hsudc_ep *hsep,
+                                struct s3c_hsudc_req *hsreq)
+{
+        u16 *buf;
+        u32 max = ep_maxpacket(hsep);
+        u32 count, length;
+        bool is_last;
+        void __iomem *fifo = hsep->fifo;
+
+        buf = hsreq->req.buf + hsreq->req.actual;
+        prefetch(buf);
+
+        length = hsreq->req.length - hsreq->req.actual;
+        length = min(length, max);
+        hsreq->req.actual += length;
+
+        writel(length, hsep->dev->regs + S3C_BWCR);
+        for (count = 0; count < length; count += 2)
+                writel(*buf++, fifo);
+
+        if (count != max) {
+                is_last = true;
+        } else {
+                if (hsreq->req.length != hsreq->req.actual || hsreq->req.zero)
+                        is_last = false;
+                else
+                        is_last = true;
+        }
+
+        if (is_last) {
+                s3c_hsudc_complete_request(hsep, hsreq, 0);
+                return 1;
+        }
+
+        return 0;
+}
+
+/**
+ * s3c_hsudc_read_fifo - Read the next chunk of data from EP fifo.
+ * @hsep: Endpoint from which the data is to be read.
+ * @hsreq: Transfer request to which the next chunk of data read is written.
+ *
+ * Read the next chunk of data from the endpoint FIFO and a write it to the
+ * transfer request buffer. If the transfer request completes, 1 is returned,
+ * otherwise 0 is returned.
+ */
+static int s3c_hsudc_read_fifo(struct s3c_hsudc_ep *hsep,
+                                struct s3c_hsudc_req *hsreq)
+{
+        struct s3c_hsudc *hsudc = hsep->dev;
+        u32 csr, offset;
+        u16 *buf, word;
+        u32 buflen, rcnt, rlen;
+        void __iomem *fifo = hsep->fifo;
+        u32 is_short = 0;
+
+        offset = (ep_index(hsep)) ? S3C_ESR : S3C_EP0SR;
+        csr = readl(hsudc->regs + offset);
+        if (!(csr & S3C_ESR_RX_SUCCESS))
+                return -EINVAL;
+
+        buf = hsreq->req.buf + hsreq->req.actual;
+        prefetchw(buf);
+        buflen = hsreq->req.length - hsreq->req.actual;
+
+        rcnt = readl(hsudc->regs + S3C_BRCR);
+        rlen = (csr & S3C_ESR_LWO) ? (rcnt * 2 - 1) : (rcnt * 2);
+
+        hsreq->req.actual += min(rlen, buflen);
+        is_short = (rlen < hsep->ep.maxpacket);
+
+        while (rcnt-- != 0) {
+                word = (u16)readl(fifo);
+                if (buflen) {
+                        *buf++ = word;
+                        buflen--;
+                } else {
+                        hsreq->req.status = -EOVERFLOW;
+                }
+        }
+
+        writel(S3C_ESR_RX_SUCCESS, hsudc->regs + offset);
+
+        if (is_short || hsreq->req.actual == hsreq->req.length) {
+                s3c_hsudc_complete_request(hsep, hsreq, 0);
+                return 1;
+        }
+
+        return 0;
+}
+
+/**
+ * s3c_hsudc_epin_intr - Handle in-endpoint interrupt.
+ * @hsudc - Device controller for which the interrupt is to be handled.
+ * @ep_idx - Endpoint number on which an interrupt is pending.
+ *
+ * Handles interrupt for a in-endpoint. The interrupts that are handled are
+ * stall and data transmit complete interrupt.
+ */
+static void s3c_hsudc_epin_intr(struct s3c_hsudc *hsudc, u32 ep_idx)
+{
+        struct s3c_hsudc_ep *hsep = &hsudc->ep[ep_idx];
+        struct s3c_hsudc_req *hsreq;
+        u32 csr;
+
+        csr = readl((u32)hsudc->regs + S3C_ESR);
+        if (csr & S3C_ESR_STALL) {
+                writel(S3C_ESR_STALL, hsudc->regs + S3C_ESR);
+                return;
+        }
+
+        if (csr & S3C_ESR_TX_SUCCESS) {
+                writel(S3C_ESR_TX_SUCCESS, hsudc->regs + S3C_ESR);
+                if (list_empty(&hsep->queue))
+                        return;
+
+                hsreq = list_entry(hsep->queue.next,
+                                struct s3c_hsudc_req, queue);
+                if ((s3c_hsudc_write_fifo(hsep, hsreq) == 0) &&
+                                (csr & S3C_ESR_PSIF_TWO))
+                        s3c_hsudc_write_fifo(hsep, hsreq);
+        }
+}
+
+/**
+ * s3c_hsudc_epout_intr - Handle out-endpoint interrupt.
+ * @hsudc - Device controller for which the interrupt is to be handled.
+ * @ep_idx - Endpoint number on which an interrupt is pending.
+ *
+ * Handles interrupt for a out-endpoint. The interrupts that are handled are
+ * stall, flush and data ready interrupt.
+ */
+static void s3c_hsudc_epout_intr(struct s3c_hsudc *hsudc, u32 ep_idx)
+{
+        struct s3c_hsudc_ep *hsep = &hsudc->ep[ep_idx];
+        struct s3c_hsudc_req *hsreq;
+        u32 csr;
+
+        csr = readl((u32)hsudc->regs + S3C_ESR);
+        if (csr & S3C_ESR_STALL) {
+                writel(S3C_ESR_STALL, hsudc->regs + S3C_ESR);
+                return;
+        }
+
+        if (csr & S3C_ESR_FLUSH) {
+                __orr32(hsudc->regs + S3C_ECR, S3C_ECR_FLUSH);
+                return;
+        }
+
+        if (csr & S3C_ESR_RX_SUCCESS) {
+                if (list_empty(&hsep->queue))
+                        return;
+
+                hsreq = list_entry(hsep->queue.next,
+                                struct s3c_hsudc_req, queue);
+                if (((s3c_hsudc_read_fifo(hsep, hsreq)) == 0) &&
+                                (csr & S3C_ESR_PSIF_TWO))
+                        s3c_hsudc_read_fifo(hsep, hsreq);
+        }
+}
+
+/** s3c_hsudc_set_halt - Set or clear a endpoint halt.
+ * @_ep: Endpoint on which halt has to be set or cleared.
+ * @value: 1 for setting halt on endpoint, 0 to clear halt.
+ *
+ * Set or clear endpoint halt. If halt is set, the endpoint is stopped.
+ * If halt is cleared, for in-endpoints, if there are any pending
+ * transfer requests, transfers are started.
+ */
+static int s3c_hsudc_set_halt(struct usb_ep *_ep, int value)
+{
+        struct s3c_hsudc_ep *hsep = our_ep(_ep);
+        struct s3c_hsudc *hsudc = hsep->dev;
+        struct s3c_hsudc_req *hsreq;
+        unsigned long irqflags;
+        u32 ecr;
+        u32 offset;
+
+        if (value && ep_is_in(hsep) && !list_empty(&hsep->queue))
+                return -EAGAIN;
+
+        spin_lock_irqsave(&hsudc->lock, irqflags);
+        set_index(hsudc, ep_index(hsep));
+        offset = (ep_index(hsep)) ? S3C_ECR : S3C_EP0CR;
+        ecr = readl(hsudc->regs + offset);
+
+        if (value) {
+                ecr |= S3C_ECR_STALL;
+                if (ep_index(hsep))
+                        ecr |= S3C_ECR_FLUSH;
+                hsep->stopped = 1;
+        } else {
+                ecr &= ~S3C_ECR_STALL;
+                hsep->stopped = hsep->wedge = 0;
+        }
+        writel(ecr, hsudc->regs + offset);
+
+        if (ep_is_in(hsep) && !list_empty(&hsep->queue) && !value) {
+                hsreq = list_entry(hsep->queue.next,
+                        struct s3c_hsudc_req, queue);
+                if (hsreq)
+                        s3c_hsudc_write_fifo(hsep, hsreq);
+        }
+
+        spin_unlock_irqrestore(&hsudc->lock, irqflags);
+        return 0;
+}
+
+/** s3c_hsudc_set_wedge - Sets the halt feature with the clear requests ignored
+ * @_ep: Endpoint on which wedge has to be set.
+ *
+ * Sets the halt feature with the clear requests ignored.
+ */
+static int s3c_hsudc_set_wedge(struct usb_ep *_ep)
+{
+        struct s3c_hsudc_ep *hsep = our_ep(_ep);
+
+        if (!hsep)
+                return -EINVAL;
+
+        hsep->wedge = 1;
+        return usb_ep_set_halt(_ep);
+}
+
+/** s3c_hsudc_handle_reqfeat - Handle set feature or clear feature requests.
+ * @_ep: Device controller on which the set/clear feature needs to be handled.
+ * @ctrl: Control request as received on the endpoint 0.
+ *
+ * Handle set feature or clear feature control requests on the control endpoint.
+ */
+static int s3c_hsudc_handle_reqfeat(struct s3c_hsudc *hsudc,
+                                        struct usb_ctrlrequest *ctrl)
+{
+        struct s3c_hsudc_ep *hsep;
+        bool set = (ctrl->bRequest == USB_REQ_SET_FEATURE);
+        u8 ep_num = ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK;
+
+        if (ctrl->bRequestType == USB_RECIP_ENDPOINT) {
+                hsep = &hsudc->ep[ep_num];
+                switch (le16_to_cpu(ctrl->wValue)) {
+                case USB_ENDPOINT_HALT:
+                        if (set || (!set && !hsep->wedge))
+                                s3c_hsudc_set_halt(&hsep->ep, set);
+                        return 0;
+                }
+        }
+
+        return -ENOENT;
+}
+
+/**
+ * s3c_hsudc_process_req_status - Handle get status control request.
+ * @hsudc: Device controller on which get status request has be handled.
+ * @ctrl: Control request as received on the endpoint 0.
+ *
+ * Handle get status control request received on control endpoint.
+ */
+static void s3c_hsudc_process_req_status(struct s3c_hsudc *hsudc,
+                                        struct usb_ctrlrequest *ctrl)
+{
+        struct s3c_hsudc_ep *hsep0 = &hsudc->ep[0];
+        struct s3c_hsudc_req hsreq;
+        struct s3c_hsudc_ep *hsep;
+        __le16 reply;
+        u8 epnum;
+
+        switch (ctrl->bRequestType & USB_RECIP_MASK) {
+        case USB_RECIP_DEVICE:
+                reply = cpu_to_le16(0);
+                break;
+
+        case USB_RECIP_INTERFACE:
+                reply = cpu_to_le16(0);
+                break;
+
+        case USB_RECIP_ENDPOINT:
+                epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK;
+                hsep = &hsudc->ep[epnum];
+                reply = cpu_to_le16(hsep->stopped ? 1 : 0);
+                break;
+        }
+
+        INIT_LIST_HEAD(&hsreq.queue);
+        hsreq.req.length = 2;
+        hsreq.req.buf = &reply;
+        hsreq.req.actual = 0;
+        hsreq.req.complete = NULL;
+        s3c_hsudc_write_fifo(hsep0, &hsreq);
+}
+
+/**
+ * s3c_hsudc_process_setup - Process control request received on endpoint 0.
+ * @hsudc: Device controller on which control request has been received.
+ *
+ * Read the control request received on endpoint 0, decode it and handle
+ * the request.
+ */
+static void s3c_hsudc_process_setup(struct s3c_hsudc *hsudc)
+{
+        struct s3c_hsudc_ep *hsep = &hsudc->ep[0];
+        struct usb_ctrlrequest ctrl = {0};
+        int ret;
+
+        s3c_hsudc_nuke_ep(hsep, -EPROTO);
+        s3c_hsudc_read_setup_pkt(hsudc, (u16 *)&ctrl);
+
+        if (ctrl.bRequestType & USB_DIR_IN) {
+                hsep->bEndpointAddress |= USB_DIR_IN;
+                hsudc->ep0state = DATA_STATE_XMIT;
+        } else {
+                hsep->bEndpointAddress &= ~USB_DIR_IN;
+                hsudc->ep0state = DATA_STATE_RECV;
+        }
+
+        switch (ctrl.bRequest) {
+        case USB_REQ_SET_ADDRESS:
+                if (ctrl.bRequestType != (USB_TYPE_STANDARD | USB_RECIP_DEVICE))
+                        break;
+                hsudc->ep0state = WAIT_FOR_SETUP;
+                return;
+
+        case USB_REQ_GET_STATUS:
+                if ((ctrl.bRequestType & USB_TYPE_MASK) != USB_TYPE_STANDARD)
+                        break;
+                s3c_hsudc_process_req_status(hsudc, &ctrl);
+                return;
+
+        case USB_REQ_SET_FEATURE:
+        case USB_REQ_CLEAR_FEATURE:
+                if ((ctrl.bRequestType & USB_TYPE_MASK) != USB_TYPE_STANDARD)
+                        break;
+                s3c_hsudc_handle_reqfeat(hsudc, &ctrl);
+                hsudc->ep0state = WAIT_FOR_SETUP;
+                return;
+        }
+
+        if (hsudc->driver) {
+                spin_unlock(&hsudc->lock);
+                ret = hsudc->driver->setup(&hsudc->gadget, &ctrl);
+                spin_lock(&hsudc->lock);
+
+                if (ctrl.bRequest == USB_REQ_SET_CONFIGURATION) {
+                        hsep->bEndpointAddress &= ~USB_DIR_IN;
+                        hsudc->ep0state = WAIT_FOR_SETUP;
+                }
+
+                if (ret < 0) {
+                        dev_err(hsudc->dev, "setup failed, returned %d\n",
+                                                ret);
+                        s3c_hsudc_set_halt(&hsep->ep, 1);
+                        hsudc->ep0state = WAIT_FOR_SETUP;
+                        hsep->bEndpointAddress &= ~USB_DIR_IN;
+                }
+        }
+}
+
+/** s3c_hsudc_handle_ep0_intr - Handle endpoint 0 interrupt.
+ * @hsudc: Device controller on which endpoint 0 interrupt has occured.
+ *
+ * Handle endpoint 0 interrupt when it occurs. EP0 interrupt could occur
+ * when a stall handshake is sent to host or data is sent/received on
+ * endpoint 0.
+ */
+static void s3c_hsudc_handle_ep0_intr(struct s3c_hsudc *hsudc)
+{
+        struct s3c_hsudc_ep *hsep = &hsudc->ep[0];
+        struct s3c_hsudc_req *hsreq;
+        u32 csr = readl(hsudc->regs + S3C_EP0SR);
+        u32 ecr;
+
+        if (csr & S3C_EP0SR_STALL) {
+                ecr = readl(hsudc->regs + S3C_EP0CR);
+                ecr &= ~(S3C_ECR_STALL | S3C_ECR_FLUSH);
+                writel(ecr, hsudc->regs + S3C_EP0CR);
+
+                writel(S3C_EP0SR_STALL, hsudc->regs + S3C_EP0SR);
+                hsep->stopped = 0;
+
+                s3c_hsudc_nuke_ep(hsep, -ECONNABORTED);
+                hsudc->ep0state = WAIT_FOR_SETUP;
+                hsep->bEndpointAddress &= ~USB_DIR_IN;
+                return;
+        }
+
+        if (csr & S3C_EP0SR_TX_SUCCESS) {
+                writel(S3C_EP0SR_TX_SUCCESS, hsudc->regs + S3C_EP0SR);
+                if (ep_is_in(hsep)) {
+                        if (list_empty(&hsep->queue))
+                                return;
+
+                        hsreq = list_entry(hsep->queue.next,
+                                        struct s3c_hsudc_req, queue);
+                        s3c_hsudc_write_fifo(hsep, hsreq);
+                }
+        }
+
+        if (csr & S3C_EP0SR_RX_SUCCESS) {
+                if (hsudc->ep0state == WAIT_FOR_SETUP)
+                        s3c_hsudc_process_setup(hsudc);
+                else {
+                        if (!ep_is_in(hsep)) {
+                                if (list_empty(&hsep->queue))
+                                        return;
+                                hsreq = list_entry(hsep->queue.next,
+                                        struct s3c_hsudc_req, queue);
+                                s3c_hsudc_read_fifo(hsep, hsreq);
+                        }
+                }
+        }
+}
+
+/**
+ * s3c_hsudc_ep_enable - Enable a endpoint.
+ * @_ep: The endpoint to be enabled.
+ * @desc: Endpoint descriptor.
+ *
+ * Enables a endpoint when called from the gadget driver. Endpoint stall if
+ * any is cleared, transfer type is configured and endpoint interrupt is
+ * enabled.
+ */
+static int s3c_hsudc_ep_enable(struct usb_ep *_ep,
+                                const struct usb_endpoint_descriptor *desc)
+{
+        struct s3c_hsudc_ep *hsep;
+        struct s3c_hsudc *hsudc;
+        unsigned long flags;
+        u32 ecr = 0;
+
+        hsep = container_of(_ep, struct s3c_hsudc_ep, ep);
+        if (!_ep || !desc || hsep->desc || _ep->name == ep0name
+                || desc->bDescriptorType != USB_DT_ENDPOINT
+                || hsep->bEndpointAddress != desc->bEndpointAddress
+                || ep_maxpacket(hsep) < le16_to_cpu(desc->wMaxPacketSize))
+                return -EINVAL;
+
+        if ((desc->bmAttributes == USB_ENDPOINT_XFER_BULK
+                && le16_to_cpu(desc->wMaxPacketSize) != ep_maxpacket(hsep))
+                || !desc->wMaxPacketSize)
+                return -ERANGE;
+
+        hsudc = hsep->dev;
+        if (!hsudc->driver || hsudc->gadget.speed == USB_SPEED_UNKNOWN)
+                return -ESHUTDOWN;
+
+        spin_lock_irqsave(&hsudc->lock, flags);
+
+        set_index(hsudc, hsep->bEndpointAddress);
+        ecr |= ((usb_endpoint_xfer_int(desc)) ? S3C_ECR_IEMS : S3C_ECR_DUEN);
+        writel(ecr, hsudc->regs + S3C_ECR);
+
+        hsep->stopped = hsep->wedge = 0;
+        hsep->desc = desc;
+        hsep->ep.maxpacket = le16_to_cpu(desc->wMaxPacketSize);
+
+        s3c_hsudc_set_halt(_ep, 0);
+        __set_bit(ep_index(hsep), hsudc->regs + S3C_EIER);
+
+        spin_unlock_irqrestore(&hsudc->lock, flags);
+        return 0;
+}
+
+/**
+ * s3c_hsudc_ep_disable - Disable a endpoint.
+ * @_ep: The endpoint to be disabled.
+ * @desc: Endpoint descriptor.
+ *
+ * Disables a endpoint when called from the gadget driver.
+ */
+static int s3c_hsudc_ep_disable(struct usb_ep *_ep)
+{
+        struct s3c_hsudc_ep *hsep = our_ep(_ep);
+        struct s3c_hsudc *hsudc = hsep->dev;
+        unsigned long flags;
+
+        if (!_ep || !hsep->desc)
+                return -EINVAL;
+
+        spin_lock_irqsave(&hsudc->lock, flags);
+
+        set_index(hsudc, hsep->bEndpointAddress);
+        __clear_bit(ep_index(hsep), hsudc->regs + S3C_EIER);
+
+        s3c_hsudc_nuke_ep(hsep, -ESHUTDOWN);
+
+        hsep->desc = 0;
+        hsep->stopped = 1;
+
+        spin_unlock_irqrestore(&hsudc->lock, flags);
+        return 0;
+}
+
+/**
+ * s3c_hsudc_alloc_request - Allocate a new request.
+ * @_ep: Endpoint for which request is allocated (not used).
+ * @gfp_flags: Flags used for the allocation.
+ *
+ * Allocates a single transfer request structure when called from gadget driver.
+ */
+static struct usb_request *s3c_hsudc_alloc_request(struct usb_ep *_ep,
+                                                gfp_t gfp_flags)
+{
+        struct s3c_hsudc_req *hsreq;
+
+        hsreq = kzalloc(sizeof *hsreq, gfp_flags);
+        if (!hsreq)
+                return 0;
+
+        INIT_LIST_HEAD(&hsreq->queue);
+        return &hsreq->req;
+}
+
+/**
+ * s3c_hsudc_free_request - Deallocate a request.
+ * @ep: Endpoint for which request is deallocated (not used).
+ * @_req: Request to be deallocated.
+ *
+ * Allocates a single transfer request structure when called from gadget driver.
+ */
+static void s3c_hsudc_free_request(struct usb_ep *ep, struct usb_request *_req)
+{
+        struct s3c_hsudc_req *hsreq;
+
+        hsreq = container_of(_req, struct s3c_hsudc_req, req);
+        WARN_ON(!list_empty(&hsreq->queue));
+        kfree(hsreq);
+}
+
+/**
+ * s3c_hsudc_queue - Queue a transfer request for the endpoint.
+ * @_ep: Endpoint for which the request is queued.
+ * @_req: Request to be queued.
+ * @gfp_flags: Not used.
+ *
+ * Start or enqueue a request for a endpoint when called from gadget driver.
+ */
+static int s3c_hsudc_queue(struct usb_ep *_ep, struct usb_request *_req,
+                        gfp_t gfp_flags)
+{
+        struct s3c_hsudc_req *hsreq;
+        struct s3c_hsudc_ep *hsep;
+        struct s3c_hsudc *hsudc;
+        unsigned long flags;
+        u32 offset;
+        u32 csr;
+
+        hsreq = container_of(_req, struct s3c_hsudc_req, req);
+        if ((!_req || !_req->complete || !_req->buf ||
+                !list_empty(&hsreq->queue)))
+                return -EINVAL;
+
+        hsep = container_of(_ep, struct s3c_hsudc_ep, ep);
+        hsudc = hsep->dev;
+        if (!hsudc->driver || hsudc->gadget.speed == USB_SPEED_UNKNOWN)
+                return -ESHUTDOWN;
+
+        spin_lock_irqsave(&hsudc->lock, flags);
+        set_index(hsudc, hsep->bEndpointAddress);
+
+        _req->status = -EINPROGRESS;
+        _req->actual = 0;
+
+        if (!ep_index(hsep) && _req->length == 0) {
+                hsudc->ep0state = WAIT_FOR_SETUP;
+                s3c_hsudc_complete_request(hsep, hsreq, 0);
+                spin_unlock_irqrestore(&hsudc->lock, flags);
+                return 0;
+        }
+
+        if (list_empty(&hsep->queue) && !hsep->stopped) {
+                offset = (ep_index(hsep)) ? S3C_ESR : S3C_EP0SR;
+                if (ep_is_in(hsep)) {
+                        csr = readl((u32)hsudc->regs + offset);
+                        if (!(csr & S3C_ESR_TX_SUCCESS) &&
+                                (s3c_hsudc_write_fifo(hsep, hsreq) == 1))
+                                hsreq = 0;
+                } else {
+                        csr = readl((u32)hsudc->regs + offset);
+                        if ((csr & S3C_ESR_RX_SUCCESS)
+                                   && (s3c_hsudc_read_fifo(hsep, hsreq) == 1))
+                                hsreq = 0;
+                }
+        }
+
+        if (hsreq != 0)
+                list_add_tail(&hsreq->queue, &hsep->queue);
+
+        spin_unlock_irqrestore(&hsudc->lock, flags);
+        return 0;
+}
+
+/**
+ * s3c_hsudc_dequeue - Dequeue a transfer request from an endpoint.
+ * @_ep: Endpoint from which the request is dequeued.
+ * @_req: Request to be dequeued.
+ *
+ * Dequeue a request from a endpoint when called from gadget driver.
+ */
+static int s3c_hsudc_dequeue(struct usb_ep *_ep, struct usb_request *_req)
+{
+        struct s3c_hsudc_ep *hsep = our_ep(_ep);
+        struct s3c_hsudc *hsudc = hsep->dev;
+        struct s3c_hsudc_req *hsreq;
+        unsigned long flags;
+
+        hsep = container_of(_ep, struct s3c_hsudc_ep, ep);
+        if (!_ep || hsep->ep.name == ep0name)
+                return -EINVAL;
+
+        spin_lock_irqsave(&hsudc->lock, flags);
+
+        list_for_each_entry(hsreq, &hsep->queue, queue) {
+                if (&hsreq->req == _req)
+                        break;
+        }
+        if (&hsreq->req != _req) {
+                spin_unlock_irqrestore(&hsudc->lock, flags);
+                return -EINVAL;
+        }
+
+        set_index(hsudc, hsep->bEndpointAddress);
+        s3c_hsudc_complete_request(hsep, hsreq, -ECONNRESET);
+
+        spin_unlock_irqrestore(&hsudc->lock, flags);
+        return 0;
+}
+
+static struct usb_ep_ops s3c_hsudc_ep_ops = {
+        .enable = s3c_hsudc_ep_enable,
+        .disable = s3c_hsudc_ep_disable,
+        .alloc_request = s3c_hsudc_alloc_request,
+        .free_request = s3c_hsudc_free_request,
+        .queue = s3c_hsudc_queue,
+        .dequeue = s3c_hsudc_dequeue,
+        .set_halt = s3c_hsudc_set_halt,
+        .set_wedge = s3c_hsudc_set_wedge,
+};
+
+/**
+ * s3c_hsudc_initep - Initialize a endpoint to default state.
+ * @hsudc - Reference to the device controller.
+ * @hsep - Endpoint to be initialized.
+ * @epnum - Address to be assigned to the endpoint.
+ *
+ * Initialize a endpoint with default configuration.
+ */
+static void s3c_hsudc_initep(struct s3c_hsudc *hsudc,
+                                struct s3c_hsudc_ep *hsep, int epnum)
+{
+        char *dir;
+
+        if ((epnum % 2) == 0) {
+                dir = "out";
+        } else {
+                dir = "in";
+                hsep->bEndpointAddress = USB_DIR_IN;
+        }
+
+        hsep->bEndpointAddress |= epnum;
+        if (epnum)
+                snprintf(hsep->name, sizeof(hsep->name), "ep%d%s", epnum, dir);
+        else
+                snprintf(hsep->name, sizeof(hsep->name), "%s", ep0name);
+
+        INIT_LIST_HEAD(&hsep->queue);
+        INIT_LIST_HEAD(&hsep->ep.ep_list);
+        if (epnum)
+                list_add_tail(&hsep->ep.ep_list, &hsudc->gadget.ep_list);
+
+        hsep->dev = hsudc;
+        hsep->ep.name = hsep->name;
+        hsep->ep.maxpacket = epnum ? 512 : 64;
+        hsep->ep.ops = &s3c_hsudc_ep_ops;
+        hsep->fifo = hsudc->regs + S3C_BR(epnum);
+        hsep->desc = 0;
+        hsep->stopped = 0;
+        hsep->wedge = 0;
+
+        set_index(hsudc, epnum);
+        writel(hsep->ep.maxpacket, hsudc->regs + S3C_MPR);
+}
+
+/**
+ * s3c_hsudc_setup_ep - Configure all endpoints to default state.
+ * @hsudc: Reference to device controller.
+ *
+ * Configures all endpoints to default state.
+ */
+static void s3c_hsudc_setup_ep(struct s3c_hsudc *hsudc)
+{
+        int epnum;
+
+        hsudc->ep0state = WAIT_FOR_SETUP;
+        INIT_LIST_HEAD(&hsudc->gadget.ep_list);
+        for (epnum = 0; epnum < hsudc->pd->epnum; epnum++)
+                s3c_hsudc_initep(hsudc, &hsudc->ep[epnum], epnum);
+}
+
+/**
+ * s3c_hsudc_reconfig - Reconfigure the device controller to default state.
+ * @hsudc: Reference to device controller.
+ *
+ * Reconfigures the device controller registers to a default state.
+ */
+static void s3c_hsudc_reconfig(struct s3c_hsudc *hsudc)
+{
+        writel(0xAA, hsudc->regs + S3C_EDR);
+        writel(1, hsudc->regs + S3C_EIER);
+        writel(0, hsudc->regs + S3C_TR);
+        writel(S3C_SCR_DTZIEN_EN | S3C_SCR_RRD_EN | S3C_SCR_SUS_EN |
+                        S3C_SCR_RST_EN, hsudc->regs + S3C_SCR);
+        writel(0, hsudc->regs + S3C_EP0CR);
+
+        s3c_hsudc_setup_ep(hsudc);
+}
+
+/**
+ * s3c_hsudc_irq - Interrupt handler for device controller.
+ * @irq: Not used.
+ * @_dev: Reference to the device controller.
+ *
+ * Interrupt handler for the device controller. This handler handles controller
+ * interrupts and endpoint interrupts.
+ */
+static irqreturn_t s3c_hsudc_irq(int irq, void *_dev)
+{
+        struct s3c_hsudc *hsudc = _dev;
+        struct s3c_hsudc_ep *hsep;
+        u32 ep_intr;
+        u32 sys_status;
+        u32 ep_idx;
+
+        spin_lock(&hsudc->lock);
+
+        sys_status = readl(hsudc->regs + S3C_SSR);
+        ep_intr = readl(hsudc->regs + S3C_EIR) & 0x3FF;
+
+        if (!ep_intr && !(sys_status & S3C_SSR_DTZIEN_EN)) {
+                spin_unlock(&hsudc->lock);
+                return IRQ_HANDLED;
+        }
+
+        if (sys_status) {
+                if (sys_status & S3C_SSR_VBUSON)
+                        writel(S3C_SSR_VBUSON, hsudc->regs + S3C_SSR);
+
+                if (sys_status & S3C_SSR_ERR)
+                        writel(S3C_SSR_ERR, hsudc->regs + S3C_SSR);
+
+                if (sys_status & S3C_SSR_SDE) {
+                        writel(S3C_SSR_SDE, hsudc->regs + S3C_SSR);
+                        hsudc->gadget.speed = (sys_status & S3C_SSR_HSP) ?
+                                USB_SPEED_HIGH : USB_SPEED_FULL;
+                }
+
+                if (sys_status & S3C_SSR_SUSPEND) {
+                        writel(S3C_SSR_SUSPEND, hsudc->regs + S3C_SSR);
+                        if (hsudc->gadget.speed != USB_SPEED_UNKNOWN
+                                && hsudc->driver && hsudc->driver->suspend)
+                                hsudc->driver->suspend(&hsudc->gadget);
+                }
+
+                if (sys_status & S3C_SSR_RESUME) {
+                        writel(S3C_SSR_RESUME, hsudc->regs + S3C_SSR);
+                        if (hsudc->gadget.speed != USB_SPEED_UNKNOWN
+                                && hsudc->driver && hsudc->driver->resume)
+                                hsudc->driver->resume(&hsudc->gadget);
+                }
+
+                if (sys_status & S3C_SSR_RESET) {
+                        writel(S3C_SSR_RESET, hsudc->regs + S3C_SSR);
+                        for (ep_idx = 0; ep_idx < hsudc->pd->epnum; ep_idx++) {
+                                hsep = &hsudc->ep[ep_idx];
+                                hsep->stopped = 1;
+                                s3c_hsudc_nuke_ep(hsep, -ECONNRESET);
+                        }
+                        s3c_hsudc_reconfig(hsudc);
+                        hsudc->ep0state = WAIT_FOR_SETUP;
+                }
+        }
+
+        if (ep_intr & S3C_EIR_EP0) {
+                writel(S3C_EIR_EP0, hsudc->regs + S3C_EIR);
+                set_index(hsudc, 0);
+                s3c_hsudc_handle_ep0_intr(hsudc);
+        }
+
+        ep_intr >>= 1;
+        ep_idx = 1;
+        while (ep_intr) {
+                if (ep_intr & 1)  {
+                        hsep = &hsudc->ep[ep_idx];
+                        set_index(hsudc, ep_idx);
+                        writel(1 << ep_idx, hsudc->regs + S3C_EIR);
+                        if (ep_is_in(hsep))
+                                s3c_hsudc_epin_intr(hsudc, ep_idx);
+                        else
+                                s3c_hsudc_epout_intr(hsudc, ep_idx);
+                }
+                ep_intr >>= 1;
+                ep_idx++;
+        }
+
+        spin_unlock(&hsudc->lock);
+        return IRQ_HANDLED;
+}
+
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
+{
+        struct s3c_hsudc *hsudc = the_controller;
+        int ret;
+
+        if (!driver
+                || (driver->speed != USB_SPEED_FULL &&
+                        driver->speed != USB_SPEED_HIGH)
+                || !bind
+                || !driver->unbind || !driver->disconnect || !driver->setup)
+                return -EINVAL;
+
+        if (!hsudc)
+                return -ENODEV;
+
+        if (hsudc->driver)
+                return -EBUSY;
+
+        hsudc->driver = driver;
+        hsudc->gadget.dev.driver = &driver->driver;
+        hsudc->gadget.speed = USB_SPEED_UNKNOWN;
+        ret = device_add(&hsudc->gadget.dev);
+        if (ret) {
+                dev_err(hsudc->dev, "failed to probe gadget device");
+                return ret;
+        }
+
+        ret = bind(&hsudc->gadget);
+        if (ret) {
+                dev_err(hsudc->dev, "%s: bind failed\n", hsudc->gadget.name);
+                device_del(&hsudc->gadget.dev);
+
+                hsudc->driver = NULL;
+                hsudc->gadget.dev.driver = NULL;
+                return ret;
+        }
+
+        enable_irq(hsudc->irq);
+        dev_info(hsudc->dev, "bound driver %s\n", driver->driver.name);
+
+        s3c_hsudc_reconfig(hsudc);
+        s3c_hsudc_init_phy();
+        if (hsudc->pd->gpio_init)
+                hsudc->pd->gpio_init();
+
+        return 0;
+}
+EXPORT_SYMBOL(usb_gadget_probe_driver);
+
+int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
+{
+        struct s3c_hsudc *hsudc = the_controller;
+        unsigned long flags;
+
+        if (!hsudc)
+                return -ENODEV;
+
+        if (!driver || driver != hsudc->driver || !driver->unbind)
+                return -EINVAL;
+
+        spin_lock_irqsave(&hsudc->lock, flags);
+        hsudc->driver = 0;
+        s3c_hsudc_uninit_phy();
+        if (hsudc->pd->gpio_uninit)
+                hsudc->pd->gpio_uninit();
+        s3c_hsudc_stop_activity(hsudc, driver);
+        spin_unlock_irqrestore(&hsudc->lock, flags);
+
+        driver->unbind(&hsudc->gadget);
+        device_del(&hsudc->gadget.dev);
+        disable_irq(hsudc->irq);
+
+        dev_info(hsudc->dev, "unregistered gadget driver '%s'\n",
+                        driver->driver.name);
+        return 0;
+}
+EXPORT_SYMBOL(usb_gadget_unregister_driver);
+
+static inline u32 s3c_hsudc_read_frameno(struct s3c_hsudc *hsudc)
+{
+        return readl(hsudc->regs + S3C_FNR) & 0x3FF;
+}
+
+static int s3c_hsudc_gadget_getframe(struct usb_gadget *gadget)
+{
+        return s3c_hsudc_read_frameno(to_hsudc(gadget));
+}
+
+static struct usb_gadget_ops s3c_hsudc_gadget_ops = {
+        .get_frame      = s3c_hsudc_gadget_getframe,
+};
+
+static int s3c_hsudc_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct resource *res;
+        struct s3c_hsudc *hsudc;
+        struct s3c24xx_hsudc_platdata *pd = pdev->dev.platform_data;
+        int ret;
+
+        hsudc = kzalloc(sizeof(struct s3c_hsudc) +
+                        sizeof(struct s3c_hsudc_ep) * pd->epnum,
+                        GFP_KERNEL);
+        if (!hsudc) {
+                dev_err(dev, "cannot allocate memory\n");
+                return -ENOMEM;
+        }
+
+        the_controller = hsudc;
+        platform_set_drvdata(pdev, dev);
+        hsudc->dev = dev;
+        hsudc->pd = pdev->dev.platform_data;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_err(dev, "unable to obtain driver resource data\n");
+                ret = -ENODEV;
+                goto err_res;
+        }
+
+        hsudc->mem_rsrc = request_mem_region(res->start, resource_size(res),
+                                dev_name(&pdev->dev));
+        if (!hsudc->mem_rsrc) {
+                dev_err(dev, "failed to reserve register area\n");
+                ret = -ENODEV;
+                goto err_res;
+        }
+
+        hsudc->regs = ioremap(res->start, resource_size(res));
+        if (!hsudc->regs) {
+                dev_err(dev, "error mapping device register area\n");
+                ret = -EBUSY;
+                goto err_remap;
+        }
+
+        ret = platform_get_irq(pdev, 0);
+        if (ret < 0) {
+                dev_err(dev, "unable to obtain IRQ number\n");
+                goto err_irq;
+        }
+        hsudc->irq = ret;
+
+        ret = request_irq(hsudc->irq, s3c_hsudc_irq, 0, driver_name, hsudc);
+        if (ret < 0) {
+                dev_err(dev, "irq request failed\n");
+                goto err_irq;
+        }
+
+        spin_lock_init(&hsudc->lock);
+
+        device_initialize(&hsudc->gadget.dev);
+        dev_set_name(&hsudc->gadget.dev, "gadget");
+
+        hsudc->gadget.is_dualspeed = 1;
+        hsudc->gadget.ops = &s3c_hsudc_gadget_ops;
+        hsudc->gadget.name = dev_name(dev);
+        hsudc->gadget.dev.parent = dev;
+        hsudc->gadget.dev.dma_mask = dev->dma_mask;
+        hsudc->gadget.ep0 = &hsudc->ep[0].ep;
+
+        hsudc->gadget.is_otg = 0;
+        hsudc->gadget.is_a_peripheral = 0;
+
+        s3c_hsudc_setup_ep(hsudc);
+
+        hsudc->uclk = clk_get(&pdev->dev, "usb-device");
+        if (IS_ERR(hsudc->uclk)) {
+                dev_err(dev, "failed to find usb-device clock source\n");
+                ret = PTR_ERR(hsudc->uclk);
+                goto err_clk;
+        }
+        clk_enable(hsudc->uclk);
+
+        local_irq_disable();
+
+        disable_irq(hsudc->irq);
+        local_irq_enable();
+        return 0;
+err_clk:
+        free_irq(hsudc->irq, hsudc);
+err_irq:
+        iounmap(hsudc->regs);
+
+err_remap:
+        release_resource(hsudc->mem_rsrc);
+        kfree(hsudc->mem_rsrc);
+
+err_res:
+        kfree(hsudc);
+        return ret;
+}
+
+static struct platform_driver s3c_hsudc_driver = {
+        .driver         = {
+                .owner  = THIS_MODULE,
+                .name   = "s3c-hsudc",
+        },
+        .probe          = s3c_hsudc_probe,
+};
+
+static int __init s3c_hsudc_modinit(void)
+{
+        return platform_driver_register(&s3c_hsudc_driver);
+}
+
+static void __exit s3c_hsudc_modexit(void)
+{
+        platform_driver_unregister(&s3c_hsudc_driver);
+}
+
+module_init(s3c_hsudc_modinit);
+module_exit(s3c_hsudc_modexit);
+
+MODULE_DESCRIPTION("Samsung S3C24XX USB high-speed controller driver");
+MODULE_AUTHOR("Thomas Abraham <thomas.ab@samsung.com>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/usb/gadget/s3c2410_udc.c b/drivers/usb/gadget/s3c2410_udc.c
index ea2b3c7ebee5..100f2635cf0a 100644
--- a/drivers/usb/gadget/s3c2410_udc.c
+++ b/drivers/usb/gadget/s3c2410_udc.c
@@ -36,6 +36,7 @@
 #include <linux/platform_device.h>
 #include <linux/clk.h>
 #include <linux/gpio.h>
+#include <linux/prefetch.h>
 
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
@@ -902,7 +903,7 @@ static irqreturn_t s3c2410_udc_irq(int dummy, void *_dev)
         int pwr_reg;
         int ep0csr;
         int i;
-        u32 idx;
+        u32 idx, idx2;
         unsigned long flags;
 
         spin_lock_irqsave(&dev->lock, flags);
@@ -1017,6 +1018,20 @@ static irqreturn_t s3c2410_udc_irq(int dummy, void *_dev)
                 }
         }
 
+        /* what else causes this interrupt? a receive! who is it? */
+        if (!usb_status && !usbd_status && !pwr_reg && !ep0csr) {
+                for (i = 1; i < S3C2410_ENDPOINTS; i++) {
+                        idx2 = udc_read(S3C2410_UDC_INDEX_REG);
+                        udc_write(i, S3C2410_UDC_INDEX_REG);
+
+                        if (udc_read(S3C2410_UDC_OUT_CSR1_REG) & 0x1)
+                                s3c2410_udc_handle_ep(&dev->ep[i]);
+
+                        /* restore index */
+                        udc_write(idx2, S3C2410_UDC_INDEX_REG);
+                }
+        }
+
         dprintk(DEBUG_VERBOSE, "irq: %d s3c2410_udc_done.\n", IRQ_USBD);
 
         /* Restore old index */
@@ -1467,7 +1482,9 @@ static int s3c2410_udc_set_pullup(struct s3c2410_udc *udc, int is_on)
 {
         dprintk(DEBUG_NORMAL, "%s()\n", __func__);
 
-        if (udc_info && udc_info->udc_command) {
+        if (udc_info && (udc_info->udc_command ||
+                gpio_is_valid(udc_info->pullup_pin))) {
+
                 if (is_on)
                         s3c2410_udc_enable(udc);
                 else {
@@ -1544,6 +1561,32 @@ static const struct usb_gadget_ops s3c2410_ops = {
         .vbus_draw              = s3c2410_vbus_draw,
 };
 
+static void s3c2410_udc_command(enum s3c2410_udc_cmd_e cmd)
+{
+        if (!udc_info)
+                return;
+
+        if (udc_info->udc_command) {
+                udc_info->udc_command(S3C2410_UDC_P_DISABLE);
+        } else if (gpio_is_valid(udc_info->pullup_pin)) {
+                int value;
+
+                switch (cmd) {
+                case S3C2410_UDC_P_ENABLE:
+                        value = 1;
+                        break;
+                case S3C2410_UDC_P_DISABLE:
+                        value = 0;
+                        break;
+                default:
+                        return;
+                }
+                value ^= udc_info->pullup_pin_inverted;
+
+                gpio_set_value(udc_info->pullup_pin, value);
+        }
+}
+
 /*------------------------- gadget driver handling---------------------------*/
 /*
  * s3c2410_udc_disable
@@ -1565,8 +1608,7 @@ static void s3c2410_udc_disable(struct s3c2410_udc *dev)
         udc_write(0x1F, S3C2410_UDC_EP_INT_REG);
 
         /* Good bye, cruel world */
-        if (udc_info && udc_info->udc_command)
-                udc_info->udc_command(S3C2410_UDC_P_DISABLE);
+        s3c2410_udc_command(S3C2410_UDC_P_DISABLE);
 
         /* Set speed to unknown */
         dev->gadget.speed = USB_SPEED_UNKNOWN;
@@ -1627,20 +1669,19 @@ static void s3c2410_udc_enable(struct s3c2410_udc *dev)
         udc_write(S3C2410_UDC_INT_EP0, S3C2410_UDC_EP_INT_EN_REG);
 
         /* time to say "hello, world" */
-        if (udc_info && udc_info->udc_command)
-                udc_info->udc_command(S3C2410_UDC_P_ENABLE);
+        s3c2410_udc_command(S3C2410_UDC_P_ENABLE);
 }
 
 /*
- *      usb_gadget_register_driver
+ *      usb_gadget_probe_driver
  */
-int usb_gadget_register_driver(struct usb_gadget_driver *driver)
+int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
+                int (*bind)(struct usb_gadget *))
 {
         struct s3c2410_udc *udc = the_controller;
         int             retval;
 
-        dprintk(DEBUG_NORMAL, "usb_gadget_register_driver() '%s'\n",
-                driver->driver.name);
+        dprintk(DEBUG_NORMAL, "%s() '%s'\n", __func__, driver->driver.name);
 
         /* Sanity checks */
         if (!udc)
@@ -1649,10 +1690,9 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
         if (udc->driver)
                 return -EBUSY;
 
-        if (!driver->bind || !driver->setup
-                        || driver->speed < USB_SPEED_FULL) {
+        if (!bind || !driver->setup || driver->speed < USB_SPEED_FULL) {
                 printk(KERN_ERR "Invalid driver: bind %p setup %p speed %d\n",
-                        driver->bind, driver->setup, driver->speed);
+                        bind, driver->setup, driver->speed);
                 return -EINVAL;
         }
 #if defined(MODULE)
@@ -1675,7 +1715,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
         dprintk(DEBUG_NORMAL, "binding gadget driver '%s'\n",
                 driver->driver.name);
 
-        if ((retval = driver->bind (&udc->gadget)) != 0) {
+        if ((retval = bind(&udc->gadget)) != 0) {
                 device_del(&udc->gadget.dev);
                 goto register_error;
         }
@@ -1690,6 +1730,7 @@ register_error:
         udc->gadget.dev.driver = NULL;
         return retval;
 }
+EXPORT_SYMBOL(usb_gadget_probe_driver);
 
 /*
  *      usb_gadget_unregister_driver
@@ -1903,6 +1944,17 @@ static int s3c2410_udc_probe(struct platform_device *pdev)
                 udc->vbus = 1;
         }
 
+        if (udc_info && !udc_info->udc_command &&
+                gpio_is_valid(udc_info->pullup_pin)) {
+
+                retval = gpio_request_one(udc_info->pullup_pin,
+                                udc_info->vbus_pin_inverted ?
+                                GPIOF_OUT_INIT_HIGH : GPIOF_OUT_INIT_LOW,
+                                "udc pullup");
+                if (retval)
+                        goto err_vbus_irq;
+        }
+
         if (s3c2410_udc_debugfs_root) {
                 udc->regs_info = debugfs_create_file("registers", S_IRUGO,
                                 s3c2410_udc_debugfs_root,
@@ -1915,6 +1967,9 @@ static int s3c2410_udc_probe(struct platform_device *pdev)
 
         return 0;
 
+err_vbus_irq:
+        if (udc_info && udc_info->vbus_pin > 0)
+                free_irq(gpio_to_irq(udc_info->vbus_pin), udc);
 err_gpio_claim:
         if (udc_info && udc_info->vbus_pin > 0)
                 gpio_free(udc_info->vbus_pin);
@@ -1942,6 +1997,10 @@ static int s3c2410_udc_remove(struct platform_device *pdev)
 
         debugfs_remove(udc->regs_info);
 
+        if (udc_info && !udc_info->udc_command &&
+                gpio_is_valid(udc_info->pullup_pin))
+                gpio_free(udc_info->pullup_pin);
+
         if (udc_info && udc_info->vbus_pin > 0) {
                 irq = gpio_to_irq(udc_info->vbus_pin);
                 free_irq(irq, udc);
@@ -1973,16 +2032,14 @@ static int s3c2410_udc_remove(struct platform_device *pdev)
 #ifdef CONFIG_PM
 static int s3c2410_udc_suspend(struct platform_device *pdev, pm_message_t message)
 {
-        if (udc_info && udc_info->udc_command)
-                udc_info->udc_command(S3C2410_UDC_P_DISABLE);
+        s3c2410_udc_command(S3C2410_UDC_P_DISABLE);
 
         return 0;
 }
 
 static int s3c2410_udc_resume(struct platform_device *pdev)
 {
-        if (udc_info && udc_info->udc_command)
-                udc_info->udc_command(S3C2410_UDC_P_ENABLE);
+        s3c2410_udc_command(S3C2410_UDC_P_ENABLE);
 
         return 0;
 }
@@ -2049,7 +2106,6 @@ static void __exit udc_exit(void)
 }
 
 EXPORT_SYMBOL(usb_gadget_unregister_driver);
-EXPORT_SYMBOL(usb_gadget_register_driver);
 
 module_init(udc_init);
 module_exit(udc_exit);
diff --git a/drivers/usb/gadget/serial.c b/drivers/usb/gadget/serial.c
index b22eedbc7dc5..1ac57a973aa9 100644
--- a/drivers/usb/gadget/serial.c
+++ b/drivers/usb/gadget/serial.c
@@ -137,7 +137,7 @@ MODULE_PARM_DESC(n_ports, "number of ports to create, default=1");
 
 /*-------------------------------------------------------------------------*/
 
-static int __ref serial_bind_config(struct usb_configuration *c)
+static int __init serial_bind_config(struct usb_configuration *c)
 {
         unsigned i;
         int status = 0;
@@ -155,13 +155,12 @@ static int __ref serial_bind_config(struct usb_configuration *c)
 
 static struct usb_configuration serial_config_driver = {
         /* .label = f(use_acm) */
-        .bind           = serial_bind_config,
         /* .bConfigurationValue = f(use_acm) */
         /* .iConfiguration = DYNAMIC */
         .bmAttributes   = USB_CONFIG_ATT_SELFPOWER,
 };
 
-static int __ref gs_bind(struct usb_composite_dev *cdev)
+static int __init gs_bind(struct usb_composite_dev *cdev)
 {
         int                     gcnum;
         struct usb_gadget       *gadget = cdev->gadget;
@@ -225,7 +224,8 @@ static int __ref gs_bind(struct usb_composite_dev *cdev)
         }
 
         /* register our configuration */
-        status = usb_add_config(cdev, &serial_config_driver);
+        status = usb_add_config(cdev, &serial_config_driver,
+                        serial_bind_config);
         if (status < 0)
                 goto fail;
 
@@ -242,7 +242,6 @@ static struct usb_composite_driver gserial_driver = {
         .name           = "g_serial",
         .dev            = &device_desc,
         .strings        = dev_strings,
-        .bind           = gs_bind,
 };
 
 static int __init init(void)
@@ -271,7 +270,7 @@ static int __init init(void)
         }
         strings_dev[STRING_DESCRIPTION_IDX].s = serial_config_driver.label;
 
-        return usb_composite_register(&gserial_driver);
+        return usb_composite_probe(&gserial_driver, gs_bind);
 }
 module_init(init);
 
diff --git a/drivers/usb/gadget/storage_common.c b/drivers/usb/gadget/storage_common.c
index 484acfb1a7c5..1fa4f705b0b4 100644
--- a/drivers/usb/gadget/storage_common.c
+++ b/drivers/usb/gadget/storage_common.c
@@ -26,7 +26,6 @@
  * be defined (each of type pointer to char):
  *  - fsg_string_manufacturer -- name of the manufacturer
  *  - fsg_string_product      -- name of the product
- *  - fsg_string_serial       -- product's serial
  *  - fsg_string_config       -- name of the configuration
  *  - fsg_string_interface    -- name of the interface
  * The first four are only needed when FSG_DESCRIPTORS_DEVICE_STRINGS
@@ -54,6 +53,8 @@
  */
 
 
+#include <linux/usb/storage.h>
+#include <scsi/scsi.h>
 #include <asm/unaligned.h>
 
 
@@ -153,23 +154,6 @@
 
 /*-------------------------------------------------------------------------*/
 
-/* SCSI device types */
-#define TYPE_DISK       0x00
-#define TYPE_CDROM      0x05
-
-/* USB protocol value = the transport method */
-#define USB_PR_CBI      0x00            /* Control/Bulk/Interrupt */
-#define USB_PR_CB       0x01            /* Control/Bulk w/o interrupt */
-#define USB_PR_BULK     0x50            /* Bulk-only */
-
-/* USB subclass value = the protocol encapsulation */
-#define USB_SC_RBC      0x01            /* Reduced Block Commands (flash) */
-#define USB_SC_8020     0x02            /* SFF-8020i, MMC-2, ATAPI (CD-ROM) */
-#define USB_SC_QIC      0x03            /* QIC-157 (tape) */
-#define USB_SC_UFI      0x04            /* UFI (floppy) */
-#define USB_SC_8070     0x05            /* SFF-8070i (removable) */
-#define USB_SC_SCSI     0x06            /* Transparent SCSI */
-
 /* Bulk-only data structures */
 
 /* Command Block Wrapper */
@@ -221,33 +205,6 @@ struct interrupt_data {
 /* Length of a SCSI Command Data Block */
 #define MAX_COMMAND_SIZE        16
 
-/* SCSI commands that we recognize */
-#define SC_FORMAT_UNIT                  0x04
-#define SC_INQUIRY                      0x12
-#define SC_MODE_SELECT_6                0x15
-#define SC_MODE_SELECT_10               0x55
-#define SC_MODE_SENSE_6                 0x1a
-#define SC_MODE_SENSE_10                0x5a
-#define SC_PREVENT_ALLOW_MEDIUM_REMOVAL 0x1e
-#define SC_READ_6                       0x08
-#define SC_READ_10                      0x28
-#define SC_READ_12                      0xa8
-#define SC_READ_CAPACITY                0x25
-#define SC_READ_FORMAT_CAPACITIES       0x23
-#define SC_READ_HEADER                  0x44
-#define SC_READ_TOC                     0x43
-#define SC_RELEASE                      0x17
-#define SC_REQUEST_SENSE                0x03
-#define SC_RESERVE                      0x16
-#define SC_SEND_DIAGNOSTIC              0x1d
-#define SC_START_STOP_UNIT              0x1b
-#define SC_SYNCHRONIZE_CACHE            0x35
-#define SC_TEST_UNIT_READY              0x00
-#define SC_VERIFY                       0x2f
-#define SC_WRITE_6                      0x0a
-#define SC_WRITE_10                     0x2a
-#define SC_WRITE_12                     0xaa
-
 /* SCSI Sense Key/Additional Sense Code/ASC Qualifier values */
 #define SS_NO_SENSE                             0
 #define SS_COMMUNICATION_FAILURE                0x040800
@@ -552,7 +509,7 @@ static struct usb_string		fsg_strings[] = {
 #ifndef FSG_NO_DEVICE_STRINGS
         {FSG_STRING_MANUFACTURER,       fsg_string_manufacturer},
         {FSG_STRING_PRODUCT,            fsg_string_product},
-        {FSG_STRING_SERIAL,             fsg_string_serial},
+        {FSG_STRING_SERIAL,             ""},
         {FSG_STRING_CONFIG,             fsg_string_config},
 #endif
         {FSG_STRING_INTERFACE,          fsg_string_interface},
@@ -586,7 +543,7 @@ static int fsg_lun_open(struct fsg_lun *curlun, const char *filename)
         ro = curlun->initially_ro;
         if (!ro) {
                 filp = filp_open(filename, O_RDWR | O_LARGEFILE, 0);
-                if (-EROFS == PTR_ERR(filp))
+                if (PTR_ERR(filp) == -EROFS || PTR_ERR(filp) == -EACCES)
                         ro = 1;
         }
         if (ro)
@@ -601,10 +558,7 @@ static int fsg_lun_open(struct fsg_lun *curlun, const char *filename)
 
         if (filp->f_path.dentry)
                 inode = filp->f_path.dentry->d_inode;
-        if (inode && S_ISBLK(inode->i_mode)) {
-                if (bdev_read_only(inode->i_bdev))
-                        ro = 1;
-        } else if (!inode || !S_ISREG(inode->i_mode)) {
+        if (!inode || (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))) {
                 LINFO(curlun, "invalid file type: %s\n", filename);
                 goto out;
         }
@@ -754,13 +708,14 @@ static ssize_t fsg_show_file(struct device *dev, struct device_attribute *attr,
 static ssize_t fsg_store_ro(struct device *dev, struct device_attribute *attr,
                             const char *buf, size_t count)
 {
-        ssize_t         rc = count;
+        ssize_t         rc;
         struct fsg_lun  *curlun = fsg_lun_from_dev(dev);
         struct rw_semaphore     *filesem = dev_get_drvdata(dev);
-        unsigned long   ro;
+        unsigned        ro;
 
-        if (strict_strtoul(buf, 2, &ro))
-                return -EINVAL;
+        rc = kstrtouint(buf, 2, &ro);
+        if (rc)
+                return rc;
 
         /*
          * Allow the write-enable status to change only while the
@@ -774,6 +729,7 @@ static ssize_t fsg_store_ro(struct device *dev, struct device_attribute *attr,
                 curlun->ro = ro;
                 curlun->initially_ro = ro;
                 LDBG(curlun, "read-only status set to %d\n", curlun->ro);
+                rc = count;
         }
         up_read(filesem);
         return rc;
@@ -784,10 +740,12 @@ static ssize_t fsg_store_nofua(struct device *dev,
                                const char *buf, size_t count)
 {
         struct fsg_lun  *curlun = fsg_lun_from_dev(dev);
-        unsigned long   nofua;
+        unsigned        nofua;
+        int             ret;
 
-        if (strict_strtoul(buf, 2, &nofua))
-                return -EINVAL;
+        ret = kstrtouint(buf, 2, &nofua);
+        if (ret)
+                return ret;
 
         /* Sync data when switching from async mode to sync */
         if (!nofua && curlun->nofua)
diff --git a/drivers/usb/gadget/u_audio.c b/drivers/usb/gadget/u_audio.c
index 7a86d2c9109c..59ffe1ecf1c9 100644
--- a/drivers/usb/gadget/u_audio.c
+++ b/drivers/usb/gadget/u_audio.c
@@ -255,6 +255,7 @@ static int gaudio_open_snd_dev(struct gaudio *card)
                 ERROR(card, "No such PCM capture device: %s\n", fn_cap);
                 snd->substream = NULL;
                 snd->card = NULL;
+                snd->filp = NULL;
         } else {
                 pcm_file = snd->filp->private_data;
                 snd->substream = pcm_file->substream;
@@ -273,17 +274,17 @@ static int gaudio_close_snd_dev(struct gaudio *gau)
 
         /* Close control device */
         snd = &gau->control;
-        if (!IS_ERR(snd->filp))
+        if (snd->filp)
                 filp_close(snd->filp, current->files);
 
         /* Close PCM playback device and setup substream */
         snd = &gau->playback;
-        if (!IS_ERR(snd->filp))
+        if (snd->filp)
                 filp_close(snd->filp, current->files);
 
         /* Close PCM capture device and setup substream */
         snd = &gau->capture;
-        if (!IS_ERR(snd->filp))
+        if (snd->filp)
                 filp_close(snd->filp, current->files);
 
         return 0;
@@ -304,8 +305,7 @@ int __init gaudio_setup(struct gaudio *card)
         ret = gaudio_open_snd_dev(card);
         if (ret)
                 ERROR(card, "we need at least one control device\n");
-
-        if (!the_card)
+        else if (!the_card)
                 the_card = card;
 
         return ret;
diff --git a/drivers/usb/gadget/u_ether.c b/drivers/usb/gadget/u_ether.c
index 6bb876d65252..2ac1d2147325 100644
--- a/drivers/usb/gadget/u_ether.c
+++ b/drivers/usb/gadget/u_ether.c
@@ -240,6 +240,9 @@ rx_submit(struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags)
         size += out->maxpacket - 1;
         size -= size % out->maxpacket;
 
+        if (dev->port_usb->is_fixed)
+                size = max_t(size_t, size, dev->port_usb->fixed_out_len);
+
         skb = alloc_skb(size + NET_IP_ALIGN, gfp_flags);
         if (skb == NULL) {
                 DBG(dev, "no rx skb\n");
@@ -578,12 +581,19 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
         req->context = skb;
         req->complete = tx_complete;
 
+        /* NCM requires no zlp if transfer is dwNtbInMaxSize */
+        if (dev->port_usb->is_fixed &&
+            length == dev->port_usb->fixed_in_len &&
+            (length % in->maxpacket) == 0)
+                req->zero = 0;
+        else
+                req->zero = 1;
+
         /* use zlp framing on tx for strict CDC-Ether conformance,
          * though any robust network rx path ignores extra padding.
          * and some hardware doesn't like to write zlps.
          */
-        req->zero = 1;
-        if (!dev->zlp && (length % in->maxpacket) == 0)
+        if (req->zero && !dev->zlp && (length % in->maxpacket) == 0)
                 length++;
 
         req->length = length;
@@ -797,7 +807,6 @@ int gether_setup(struct usb_gadget *g, u8 ethaddr[ETH_ALEN])
          *  - iff DATA transfer is active, carrier is "on"
          *  - tx queueing enabled if open *and* carrier is "on"
          */
-        netif_stop_queue(net);
         netif_carrier_off(net);
 
         dev->gadget = g;
@@ -830,11 +839,9 @@ void gether_cleanup(void)
                 return;
 
         unregister_netdev(the_dev->net);
+        flush_work_sync(&the_dev->work);
         free_netdev(the_dev->net);
 
-        /* assuming we used keventd, it must quiesce too */
-        flush_scheduled_work();
-
         the_dev = NULL;
 }
 
diff --git a/drivers/usb/gadget/u_ether.h b/drivers/usb/gadget/u_ether.h
index 3c8c0c9f9d72..b56e1e7d423c 100644
--- a/drivers/usb/gadget/u_ether.h
+++ b/drivers/usb/gadget/u_ether.h
@@ -62,6 +62,10 @@ struct gether {
 
         /* hooks for added framing, as needed for RNDIS and EEM. */
         u32                             header_len;
+        /* NCM requires fixed size bundles */
+        bool                            is_fixed;
+        u32                             fixed_out_len;
+        u32                             fixed_in_len;
         struct sk_buff                  *(*wrap)(struct gether *port,
                                                 struct sk_buff *skb);
         int                             (*unwrap)(struct gether *port,
@@ -103,6 +107,7 @@ static inline bool can_support_ecm(struct usb_gadget *gadget)
 /* each configuration may bind one instance of an ethernet link */
 int geth_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN]);
 int ecm_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN]);
+int ncm_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN]);
 int eem_bind_config(struct usb_configuration *c);
 
 #ifdef USB_ETH_RNDIS
diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c
index 01e5354a4c20..40f7716b31fc 100644
--- a/drivers/usb/gadget/u_serial.c
+++ b/drivers/usb/gadget/u_serial.c
@@ -105,11 +105,15 @@ struct gs_port {
         wait_queue_head_t       close_wait;     /* wait for last close */
 
         struct list_head        read_pool;
+        int read_started;
+        int read_allocated;
         struct list_head        read_queue;
         unsigned                n_read;
         struct tasklet_struct   push;
 
         struct list_head        write_pool;
+        int write_started;
+        int write_allocated;
         struct gs_buf           port_write_buf;
         wait_queue_head_t       drain_wait;     /* wait while writes drain */
 
@@ -363,6 +367,9 @@ __acquires(&port->port_lock)
                 struct usb_request      *req;
                 int                     len;
 
+                if (port->write_started >= QUEUE_SIZE)
+                        break;
+
                 req = list_entry(pool->next, struct usb_request, list);
                 len = gs_send_packet(port, req->buf, in->maxpacket);
                 if (len == 0) {
@@ -397,6 +404,8 @@ __acquires(&port->port_lock)
                         break;
                 }
 
+                port->write_started++;
+
                 /* abort immediately after disconnect */
                 if (!port->port_usb)
                         break;
@@ -418,7 +427,6 @@ __acquires(&port->port_lock)
 {
         struct list_head        *pool = &port->read_pool;
         struct usb_ep           *out = port->port_usb->out;
-        unsigned                started = 0;
 
         while (!list_empty(pool)) {
                 struct usb_request      *req;
@@ -430,6 +438,9 @@ __acquires(&port->port_lock)
                 if (!tty)
                         break;
 
+                if (port->read_started >= QUEUE_SIZE)
+                        break;
+
                 req = list_entry(pool->next, struct usb_request, list);
                 list_del(&req->list);
                 req->length = out->maxpacket;
@@ -447,13 +458,13 @@ __acquires(&port->port_lock)
                         list_add(&req->list, pool);
                         break;
                 }
-                started++;
+                port->read_started++;
 
                 /* abort immediately after disconnect */
                 if (!port->port_usb)
                         break;
         }
-        return started;
+        return port->read_started;
 }
 
 /*
@@ -535,6 +546,7 @@ static void gs_rx_push(unsigned long _port)
                 }
 recycle:
                 list_move(&req->list, &port->read_pool);
+                port->read_started--;
         }
 
         /* Push from tty to ldisc; without low_latency set this is handled by
@@ -587,6 +599,7 @@ static void gs_write_complete(struct usb_ep *ep, struct usb_request *req)
 
         spin_lock(&port->port_lock);
         list_add(&req->list, &port->write_pool);
+        port->write_started--;
 
         switch (req->status) {
         default:
@@ -608,7 +621,8 @@ static void gs_write_complete(struct usb_ep *ep, struct usb_request *req)
         spin_unlock(&port->port_lock);
 }
 
-static void gs_free_requests(struct usb_ep *ep, struct list_head *head)
+static void gs_free_requests(struct usb_ep *ep, struct list_head *head,
+                                                         int *allocated)
 {
         struct usb_request      *req;
 
@@ -616,25 +630,31 @@ static void gs_free_requests(struct usb_ep *ep, struct list_head *head)
                 req = list_entry(head->next, struct usb_request, list);
                 list_del(&req->list);
                 gs_free_req(ep, req);
+                if (allocated)
+                        (*allocated)--;
         }
 }
 
 static int gs_alloc_requests(struct usb_ep *ep, struct list_head *head,
-                void (*fn)(struct usb_ep *, struct usb_request *))
+                void (*fn)(struct usb_ep *, struct usb_request *),
+                int *allocated)
 {
         int                     i;
         struct usb_request      *req;
+        int n = allocated ? QUEUE_SIZE - *allocated : QUEUE_SIZE;
 
         /* Pre-allocate up to QUEUE_SIZE transfers, but if we can't
          * do quite that many this time, don't fail ... we just won't
          * be as speedy as we might otherwise be.
          */
-        for (i = 0; i < QUEUE_SIZE; i++) {
+        for (i = 0; i < n; i++) {
                 req = gs_alloc_req(ep, ep->maxpacket, GFP_ATOMIC);
                 if (!req)
                         return list_empty(head) ? -ENOMEM : 0;
                 req->complete = fn;
                 list_add_tail(&req->list, head);
+                if (allocated)
+                        (*allocated)++;
         }
         return 0;
 }
@@ -661,14 +681,15 @@ static int gs_start_io(struct gs_port *port)
          * configurations may use different endpoints with a given port;
          * and high speed vs full speed changes packet sizes too.
          */
-        status = gs_alloc_requests(ep, head, gs_read_complete);
+        status = gs_alloc_requests(ep, head, gs_read_complete,
+                &port->read_allocated);
         if (status)
                 return status;
 
         status = gs_alloc_requests(port->port_usb->in, &port->write_pool,
-                        gs_write_complete);
+                        gs_write_complete, &port->write_allocated);
         if (status) {
-                gs_free_requests(ep, head);
+                gs_free_requests(ep, head, &port->read_allocated);
                 return status;
         }
 
@@ -680,8 +701,9 @@ static int gs_start_io(struct gs_port *port)
         if (started) {
                 tty_wakeup(port->port_tty);
         } else {
-                gs_free_requests(ep, head);
-                gs_free_requests(port->port_usb->in, &port->write_pool);
+                gs_free_requests(ep, head, &port->read_allocated);
+                gs_free_requests(port->port_usb->in, &port->write_pool,
+                        &port->write_allocated);
                 status = -EIO;
         }
 
@@ -1315,8 +1337,12 @@ void gserial_disconnect(struct gserial *gser)
         spin_lock_irqsave(&port->port_lock, flags);
         if (port->open_count == 0 && !port->openclose)
                 gs_buf_free(&port->port_write_buf);
-        gs_free_requests(gser->out, &port->read_pool);
-        gs_free_requests(gser->out, &port->read_queue);
-        gs_free_requests(gser->in, &port->write_pool);
+        gs_free_requests(gser->out, &port->read_pool, NULL);
+        gs_free_requests(gser->out, &port->read_queue, NULL);
+        gs_free_requests(gser->in, &port->write_pool, NULL);
+
+        port->read_allocated = port->read_started =
+                port->write_allocated = port->write_started = 0;
+
         spin_unlock_irqrestore(&port->port_lock, flags);
 }
diff --git a/drivers/usb/gadget/webcam.c b/drivers/usb/gadget/webcam.c
index de1deb7a3c63..a5a0fdb808c7 100644
--- a/drivers/usb/gadget/webcam.c
+++ b/drivers/usb/gadget/webcam.c
@@ -308,7 +308,7 @@ static const struct uvc_descriptor_header * const uvc_hs_streaming_cls[] = {
  * USB configuration
  */
 
-static int __ref
+static int __init
 webcam_config_bind(struct usb_configuration *c)
 {
         return uvc_bind_config(c, uvc_control_cls, uvc_fs_streaming_cls,
@@ -317,7 +317,6 @@ webcam_config_bind(struct usb_configuration *c)
 
 static struct usb_configuration webcam_config_driver = {
         .label                  = webcam_config_label,
-        .bind                   = webcam_config_bind,
         .bConfigurationValue    = 1,
         .iConfiguration         = 0, /* dynamic */
         .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
@@ -330,7 +329,7 @@ webcam_unbind(struct usb_composite_dev *cdev)
         return 0;
 }
 
-static int __ref
+static int __init
 webcam_bind(struct usb_composite_dev *cdev)
 {
         int ret;
@@ -354,7 +353,8 @@ webcam_bind(struct usb_composite_dev *cdev)
         webcam_config_driver.iConfiguration = ret;
 
         /* Register our configuration. */
-        if ((ret = usb_add_config(cdev, &webcam_config_driver)) < 0)
+        if ((ret = usb_add_config(cdev, &webcam_config_driver,
+                                        webcam_config_bind)) < 0)
                 goto error;
 
         INFO(cdev, "Webcam Video Gadget\n");
@@ -373,14 +373,13 @@ static struct usb_composite_driver webcam_driver = {
         .name           = "g_webcam",
         .dev            = &webcam_device_descriptor,
         .strings        = webcam_device_strings,
-        .bind           = webcam_bind,
         .unbind         = webcam_unbind,
 };
 
 static int __init
 webcam_init(void)
 {
-        return usb_composite_register(&webcam_driver);
+        return usb_composite_probe(&webcam_driver, webcam_bind);
 }
 
 static void __exit
diff --git a/drivers/usb/gadget/zero.c b/drivers/usb/gadget/zero.c
index cf353920bb1c..6d16db9d9d2d 100644
--- a/drivers/usb/gadget/zero.c
+++ b/drivers/usb/gadget/zero.c
@@ -264,7 +264,7 @@ static void zero_resume(struct usb_composite_dev *cdev)
 
 /*-------------------------------------------------------------------------*/
 
-static int __ref zero_bind(struct usb_composite_dev *cdev)
+static int __init zero_bind(struct usb_composite_dev *cdev)
 {
         int                     gcnum;
         struct usb_gadget       *gadget = cdev->gadget;
@@ -340,7 +340,6 @@ static struct usb_composite_driver zero_driver = {
         .name           = "zero",
         .dev            = &device_desc,
         .strings        = dev_strings,
-        .bind           = zero_bind,
         .unbind         = zero_unbind,
         .suspend        = zero_suspend,
         .resume         = zero_resume,
@@ -351,7 +350,7 @@ MODULE_LICENSE("GPL");
 
 static int __init init(void)
 {
-        return usb_composite_register(&zero_driver);
+        return usb_composite_probe(&zero_driver, zero_bind);
 }
 module_init(init);