3timCnyY

1===========================================
2List of modified files:
3drivers/usb/gadget/android.c
4drivers/usb/gadget/Kconfig
5drivers/usb/gadget/composite.c
6drivers/usb/gadget/f_acm.c
7drivers/usb/gadget/f_hid.c
8drivers/usb/gadget/f_mass_storage.c
9drivers/usb/gadget/f_ncm.c
10drivers/usb/gadget/f_rndis.c
11drivers/usb/gadget/f_serial.c
12drivers/usb/gadget/rndis.c
13drivers/usb/gadget/rndis.h
14drivers/usb/gadget/storage_common.c
15drivers/usb/gadget/u_ether.c
16drivers/usb/gadget/u_ether.h
17drivers/usb/gadget/u_serial.c
18drivers/usb/gadget/u_serial.h
19drivers/usb/gadget/udc-core.c
20include/linux/usb/android_composite.h
21include/linux/usb/gadget.h
22===========================================
23
24diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
25index f17d2f8..da2fe56 100644
26--- a/drivers/usb/gadget/Kconfig
27+++ b/drivers/usb/gadget/Kconfig
28@@ -441,6 +441,7 @@ config USB_GOKU
29 
30 config USB_EG20T
31 	tristate "Intel EG20T PCH/LAPIS Semiconductor IOH(ML7213/ML7831) UDC"
32+    depends on PCI
33 	help
34 	  This is a USB device driver for EG20T PCH.
35 	  EG20T PCH is the platform controller hub that is used in Intel's
36@@ -476,6 +477,43 @@ config USB_CI13XXX_MSM
37 	  dynamically linked module called "ci13xxx_msm" and force all
38 	  gadget drivers to also be dynamically linked.
39 
40+config USB_CI13XXX_MSM_HSIC
41+    tristate "MIPS HSIC CI13xxx for MSM"
42+    depends on ARCH_MSM
43+    select USB_GADGET_DUALSPEED
44+    help
45+      MSM SoC has chipidea USB controller.  This driver uses
46+      ci13xxx_udc core. Support USB-HSIC core.
47+
48+      Say "y" to link the driver statically, or "m" to build a
49+      dynamically linked module called "ci13xxx_msm_hsic" and force all
50+      gadget drivers to also be dynamically linked.
51+
52+config USB_DWC3_MSM
53+    tristate "DesignWare USB3.0 (DRD) Controller for MSM"
54+    depends on ARCH_MSM
55+    select USB_DWC3
56+    select USB_GADGET_DUALSPEED
57+    select USB_GADGET_SELECTED
58+    help
59+      The DesignWare USB3.0 controller is a SuperSpeed USB3.0 Controller
60+      integrated into the Qualcomm MSM chipset series, supporting host,
61+      device and otg modes of operation. For more information please
62+      refer to http://www.qualcomm.com/chipsets.
63+
64+config USB_DWC3_OMAP
65+    tristate "DesignWare USB3.0 (DRD) Controller for OMAP"
66+    depends on ARCH_OMAP
67+    select USB_DWC3
68+    select USB_GADGET_DUALSPEED
69+    select USB_GADGET_SUPERSPEED
70+    select USB_GADGET_SELECTED
71+    help
72+      DesignWare USB3.0 controller is a SuperSpeed USB3.0 Controller
73+      which can be configured for peripheral-only, host-only, hub-only
74+      and Dual-Role operation. This Controller was first integrated into
75+      the OMAP5 series of processors. More information about the OMAP5
76+      version of this controller, refer to http://www.ti.com/omap5.
77 
78 config USB_GADGET_DWC_OTG
79 	tristate "Synopsys DWC_OTG 2.91a"
80@@ -1116,4 +1154,79 @@ config USB_G_WEBCAM
81 
82 endchoice
83 
84+config USB_CSW_HACK
85+       boolean "USB Mass storage csw hack Feature"
86+       default y
87+       help
88+        This csw hack feature is for increasing the performance of the mass
89+        storage
90+
91+config USB_MSC_PROFILING
92+       bool "USB MSC performance profiling"
93+       help
94+         If you say Y here, support will be added for collecting
95+         Mass-storage performance numbers at the VFS level.
96+
97+config MODEM_SUPPORT
98+       boolean "modem support in generic serial function driver"
99+       depends on USB_G_ANDROID
100+       default y
101+       help
102+         This feature enables the modem functionality in the
103+         generic serial.
104+         adds interrupt endpoint support to send modem notifications
105+         to host.
106+         adds CDC descriptors to enumerate the generic serial as MODEM.
107+         adds CDC class requests to configure MODEM line settings.
108+         Say "y" to enable MODEM support in the generic serial driver.
109+
110+config RMNET_SMD_CTL_CHANNEL
111+       string "RMNET control SMD channel name"
112+       depends on USB_G_ANDROID && MSM_SMD
113+       default ""
114+       help
115+         Control SMD channel for transferring QMI messages
116+
117+config RMNET_SMD_DATA_CHANNEL
118+       string "RMNET Data SMD channel name"
119+       depends on USB_G_ANDROID && MSM_SMD
120+       default ""
121+       help
122+         Data SMD channel for transferring network data
123+
124+config RMNET_SDIO_CTL_CHANNEL
125+       int "RMNET control SDIO channel id"
126+       default 8
127+       depends on MSM_SDIO_CMUX && MSM_SDIO_DMUX
128+       help
129+         Control SDIO channel for transferring RMNET QMI messages
130+
131+config RMNET_SDIO_DATA_CHANNEL
132+       int "RMNET Data SDIO channel id"
133+       default 8
134+       depends on MSM_SDIO_CMUX && MSM_SDIO_DMUX
135+       help
136+         Data SDIO channel for transferring network data
137+
138+config RMNET_SMD_SDIO_CTL_CHANNEL
139+       int "RMNET(sdio_smd) Control SDIO channel id"
140+       depends on MSM_SDIO_CMUX && MSM_SDIO_DMUX
141+       default 8
142+       help
143+         Control SDIO channel for transferring QMI messages
144+
145+config RMNET_SMD_SDIO_DATA_CHANNEL
146+       int "RMNET(sdio_smd) Data SDIO channel id"
147+       default 8
148+       depends on MSM_SDIO_CMUX && MSM_SDIO_DMUX
149+       help
150+         Data SDIO channel for transferring network data
151+
152+config RMNET_SDIO_SMD_DATA_CHANNEL
153+       string "RMNET(sdio_smd) Data SMD channel name"
154+       depends on MSM_SDIO_CMUX && MSM_SDIO_DMUX
155+       default "DATA40"
156+       help
157+         Data SMD channel for transferring network data
158+
159 endif # USB_GADGET
160diff --git a/drivers/usb/gadget/android.c b/drivers/usb/gadget/android.c
161index 70d3150..b7ce3cc 100644
162--- a/drivers/usb/gadget/android.c
163+++ b/drivers/usb/gadget/android.c
164@@ -2,6 +2,7 @@
165  * Gadget Driver for Android
166  *
167  * Copyright (C) 2008 Google, Inc.
168+ *.Copyright (c) 2014, The Linux Foundation. All rights reserved.
169  * Author: Mike Lockwood <lockwood@android.com>
170  *         Benoit Goby <benoit@android.com>
171  *
172@@ -23,29 +24,58 @@
173 #include <linux/kernel.h>
174 #include <linux/utsname.h>
175 #include <linux/platform_device.h>
176+#include <linux/pm_qos.h>
177+#include <linux/of.h>
178 
179 #include <linux/usb/ch9.h>
180 #include <linux/usb/composite.h>
181 #include <linux/usb/gadget.h>
182+#include <linux/usb/android.h>
183+
184+#include <linux/qcom/diag_dload.h>
185 
186 #include "gadget_chips.h"
187 
188-#include "f_hid.c"
189 #include "f_fs.c"
190-#ifdef CONFIG_SOUND
191+#ifdef CONFIG_SND_PCM
192 #include "f_audio_source.c"
193 #endif
194 #include "f_mass_storage.c"
195+#define USB_ETH_RNDIS y
196+#include "f_diag.c"
197+#include "f_qdss.c"
198+#include "f_rmnet_smd.c"
199+#include "f_rmnet.c"
200+#include "f_gps.c"
201+#include "u_smd.c"
202+#include "u_bam.c"
203+#include "u_rmnet_ctrl_smd.c"
204+#include "u_ctrl_qti.c"
205+#include "u_ctrl_hsic.c"
206+#include "u_data_hsic.c"
207+#include "u_ctrl_hsuart.c"
208+#include "u_data_hsuart.c"
209+#include "f_ccid.c"
210 #include "f_mtp.c"
211 #include "f_accessory.c"
212-#define USB_ETH_RNDIS y
213 #include "f_rndis.c"
214 #include "rndis.c"
215-#include "f_ncm.c"
216+#include "f_qc_ecm.c"
217+#include "f_mbim.c"
218+#include "f_qc_rndis.c"
219+#include "u_data_ipa.c"
220+#include "u_bam_data.c"
221+#include "f_ecm.c"
222 #include "u_ether.c"
223-#ifdef CONFIG_USB_GADGET_GG
224-#include "f_gg.c"
225+#include "u_qc_ether.c"
226+#ifdef CONFIG_TARGET_CORE
227 #endif
228+#ifdef CONFIG_SND_PCM
229+#include "u_uac1.c"
230+#include "f_uac1.c"
231+#endif
232+#include "f_ncm.c"
233+#include "f_charger.c"
234 
235 MODULE_AUTHOR("Mike Lockwood");
236 MODULE_DESCRIPTION("Android Composite USB Driver");
237@@ -58,6 +88,8 @@ static const char longname[] = "Gadget Android";
238 #define VENDOR_ID		0x18D1
239 #define PRODUCT_ID		0x0001
240 
241+#define ANDROID_DEVICE_NODE_NAME_LENGTH 11
242+
243 struct android_usb_function {
244 	char *name;
245 	void *config;
246@@ -66,8 +98,7 @@ struct android_usb_function {
247 	char *dev_name;
248 	struct device_attribute **attributes;
249 
250-	/* for android_dev.enabled_functions */
251-	struct list_head enabled_list;
252+	struct android_dev *android_dev;
253 
254 	/* Optional: initialization during gadget bind */
255 	int (*init)(struct android_usb_function *, struct usb_composite_dev *);
256@@ -91,26 +122,114 @@ struct android_usb_function {
257 					const struct usb_ctrlrequest *);
258 };
259 
260+struct android_usb_function_holder {
261+
262+	struct android_usb_function *f;
263+
264+	/* for android_conf.enabled_functions */
265+	struct list_head enabled_list;
266+};
267+
268+/**
269+* struct android_dev - represents android USB gadget device
270+* @name: device name.
271+* @functions: an array of all the supported USB function
272+*    drivers that this gadget support but not necessarily
273+*    added to one of the gadget configurations.
274+* @cdev: The internal composite device. Android gadget device
275+*    is a composite device, such that it can support configurations
276+*    with more than one function driver.
277+* @dev: The kernel device that represents this android device.
278+* @enabled: True if the android gadget is enabled, means all
279+*    the configurations were set and all function drivers were
280+*    bind and ready for USB enumeration.
281+* @disable_depth: Number of times the device was disabled, after
282+*    symmetrical number of enables the device willl be enabled.
283+*    Used for controlling ADB userspace disable/enable requests.
284+* @mutex: Internal mutex for protecting device member fields.
285+* @pdata: Platform data fetched from the kernel device platfrom data.
286+* @connected: True if got connect notification from the gadget UDC.
287+*    False if got disconnect notification from the gadget UDC.
288+* @sw_connected: Equal to 'connected' only after the connect
289+*    notification was handled by the android gadget work function.
290+* @suspended: True if got suspend notification from the gadget UDC.
291+*    False if got resume notification from the gadget UDC.
292+* @sw_suspended: Equal to 'suspended' only after the susped
293+*    notification was handled by the android gadget work function.
294+* @pm_qos: An attribute string that can be set by user space in order to
295+*    determine pm_qos policy. Set to 'high' for always demand pm_qos
296+*    when USB bus is connected and resumed. Set to 'low' for disable
297+*    any setting of pm_qos by this driver. Default = 'high'.
298+* @work: workqueue used for handling notifications from the gadget UDC.
299+* @configs: List of configurations currently configured into the device.
300+*    The android gadget supports more than one configuration. The host
301+*    may choose one configuration from the suggested.
302+* @configs_num: Number of configurations currently configured and existing
303+*    in the configs list.
304+* @list_item: This driver supports more than one android gadget device (for
305+*    example in order to support multiple USB cores), therefore this is
306+*    a item in a linked list of android devices.
307+*/
308 struct android_dev {
309+	const char *name;
310 	struct android_usb_function **functions;
311-	struct list_head enabled_functions;
312 	struct usb_composite_dev *cdev;
313 	struct device *dev;
314 
315+	void (*setup_complete)(struct usb_ep *ep,
316+				struct usb_request *req);
317+
318 	bool enabled;
319 	int disable_depth;
320 	struct mutex mutex;
321+	struct android_usb_platform_data *pdata;
322+
323 	bool connected;
324 	bool sw_connected;
325+	bool suspended;
326+	bool sw_suspended;
327+	char pm_qos[5];
328+	struct pm_qos_request pm_qos_req_dma;
329+	unsigned up_pm_qos_sample_sec;
330+	unsigned up_pm_qos_threshold;
331+	unsigned down_pm_qos_sample_sec;
332+	unsigned down_pm_qos_threshold;
333+	unsigned idle_pc_rpm_no_int_secs;
334+	struct delayed_work pm_qos_work;
335+	enum android_pm_qos_state curr_pm_qos_state;
336 	struct work_struct work;
337 	char ffs_aliases[256];
338+
339+	/* A list of struct android_configuration */
340+	struct list_head configs;
341+	int configs_num;
342+
343+	/* A list node inside the android_dev_list */
344+	struct list_head list_item;
345+};
346+
347+struct android_configuration {
348+	struct usb_configuration usb_config;
349+
350+	/* A list of the functions supported by this config */
351+	struct list_head enabled_functions;
352+
353+	/* A list node inside the struct android_dev.configs list */
354+	struct list_head list_item;
355 };
356 
357+struct dload_struct __iomem *diag_dload;
358 static struct class *android_class;
359-static struct android_dev *_android_dev;
360+static struct list_head android_dev_list;
361+static int android_dev_count;
362 static int android_bind_config(struct usb_configuration *c);
363 static void android_unbind_config(struct usb_configuration *c);
364-static void android_disconnect(struct usb_composite_dev *cdev);
365+static struct android_dev *cdev_to_android_dev(struct usb_composite_dev *cdev);
366+static struct android_configuration *alloc_android_config
367+						(struct android_dev *dev);
368+static void free_android_config(struct android_dev *dev,
369+				struct android_configuration *conf);
370+static int usb_diag_update_pid_and_serial_num(uint32_t pid, const char *snum);
371 
372 /* string IDs are assigned dynamically */
373 #define STRING_MANUFACTURER_IDX		0
374@@ -153,43 +272,198 @@ static struct usb_device_descriptor device_desc = {
375 static struct usb_otg_descriptor otg_descriptor = {
376 	.bLength =		sizeof otg_descriptor,
377 	.bDescriptorType =	USB_DT_OTG,
378-	.bmAttributes =		0,
379-	.bcdOTG 	  = __constant_cpu_to_le16(0x0200),
380+	.bmAttributes =		USB_OTG_SRP | USB_OTG_HNP,
381+	.bcdOTG               = __constant_cpu_to_le16(0x0200),
382 };
383-/*
384+
385 static const struct usb_descriptor_header *otg_desc[] = {
386 	(struct usb_descriptor_header *) &otg_descriptor,
387 	NULL,
388 };
389-*/
390-static struct usb_configuration android_config_driver = {
391-	.label		= "android",
392-	.unbind		= android_unbind_config,
393-	.bConfigurationValue = 1,
394-	.bmAttributes	= USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
395-	.MaxPower	= 500, /* 500ma */
396+
397+static const char *pm_qos_to_string(enum android_pm_qos_state state)
398+{
399+	switch (state) {
400+	case NO_USB_VOTE:	return "NO_USB_VOTE";
401+	case WFI:		return "WFI";
402+	case IDLE_PC:		return "IDLE_PC";
403+	case IDLE_PC_RPM:	return "IDLE_PC_RPM";
404+	default:		return "INVALID_STATE";
405+	}
406+}
407+
408+static void android_pm_qos_update_latency(struct android_dev *dev, u32 latency)
409+{
410+	static int last_vote = -1;
411+
412+	if (latency == last_vote || !latency)
413+		return;
414+
415+	pr_debug("%s: latency updated to: %d\n", __func__, latency);
416+
417+	pm_qos_update_request(&dev->pm_qos_req_dma, latency);
418+
419+	last_vote = latency;
420+}
421+
422+#define DOWN_PM_QOS_SAMPLE_SEC		5
423+#define DOWN_PM_QOS_THRESHOLD		100
424+#define UP_PM_QOS_SAMPLE_SEC		3
425+#define UP_PM_QOS_THRESHOLD		70
426+#define IDLE_PC_RPM_NO_INT_SECS		10
427+
428+static void android_pm_qos_work(struct work_struct *data)
429+{
430+	struct android_dev *dev = container_of(data, struct android_dev,
431+							pm_qos_work.work);
432+	struct usb_gadget *gadget = dev->cdev->gadget;
433+	unsigned next_latency, curr_sample_int_count;
434+	unsigned next_sample_delay_sec;
435+	enum android_pm_qos_state next_state = dev->curr_pm_qos_state;
436+	static unsigned no_int_sample_count;
437+
438+	curr_sample_int_count = gadget->xfer_isr_count;
439+	gadget->xfer_isr_count = 0;
440+
441+	switch (dev->curr_pm_qos_state) {
442+	case WFI:
443+		if (curr_sample_int_count <= dev->down_pm_qos_threshold) {
444+			next_state = IDLE_PC;
445+			next_sample_delay_sec = dev->up_pm_qos_sample_sec;
446+			no_int_sample_count = 0;
447+		} else {
448+			next_sample_delay_sec = dev->down_pm_qos_sample_sec;
449+		}
450+		break;
451+	case IDLE_PC:
452+		if (!curr_sample_int_count)
453+			no_int_sample_count++;
454+		else
455+			no_int_sample_count = 0;
456+
457+		if (curr_sample_int_count >= dev->up_pm_qos_threshold) {
458+			next_state = WFI;
459+			next_sample_delay_sec = dev->down_pm_qos_sample_sec;
460+		} else if (no_int_sample_count >=
461+		      dev->idle_pc_rpm_no_int_secs/dev->up_pm_qos_sample_sec) {
462+			next_state = IDLE_PC_RPM;
463+			next_sample_delay_sec = dev->up_pm_qos_sample_sec;
464+		} else {
465+			next_sample_delay_sec = dev->up_pm_qos_sample_sec;
466+		}
467+		break;
468+	case IDLE_PC_RPM:
469+		if (curr_sample_int_count) {
470+			next_state = WFI;
471+			next_sample_delay_sec = dev->down_pm_qos_sample_sec;
472+			no_int_sample_count = 0;
473+		} else {
474+			next_sample_delay_sec = 2 * dev->up_pm_qos_sample_sec;
475+		}
476+		break;
477+	default:
478+		pr_debug("invalid pm_qos_state (%u)\n", dev->curr_pm_qos_state);
479+		return;
480+	}
481+
482+	if (next_state != dev->curr_pm_qos_state) {
483+		dev->curr_pm_qos_state = next_state;
484+		next_latency = dev->pdata->pm_qos_latency[next_state];
485+		android_pm_qos_update_latency(dev, next_latency);
486+		pr_debug("%s: pm_qos_state:%s, interrupts in last sample:%d\n",
487+				 __func__, pm_qos_to_string(next_state),
488+				curr_sample_int_count);
489+	}
490+
491+	queue_delayed_work(system_nrt_wq, &dev->pm_qos_work,
492+			msecs_to_jiffies(1000*next_sample_delay_sec));
493+}
494+
495+enum android_device_state {
496+	USB_DISCONNECTED,
497+	USB_CONNECTED,
498+	USB_CONFIGURED,
499+	USB_SUSPENDED,
500+	USB_RESUMED
501 };
502 
503 static void android_work(struct work_struct *data)
504 {
505 	struct android_dev *dev = container_of(data, struct android_dev, work);
506 	struct usb_composite_dev *cdev = dev->cdev;
507+	struct android_usb_platform_data *pdata = dev->pdata;
508 	char *disconnected[2] = { "USB_STATE=DISCONNECTED", NULL };
509 	char *connected[2]    = { "USB_STATE=CONNECTED", NULL };
510 	char *configured[2]   = { "USB_STATE=CONFIGURED", NULL };
511+	char *suspended[2]   = { "USB_STATE=SUSPENDED", NULL };
512+	char *resumed[2]   = { "USB_STATE=RESUMED", NULL };
513 	char **uevent_envp = NULL;
514+	static enum android_device_state last_uevent, next_state;
515 	unsigned long flags;
516+	int pm_qos_vote = -1;
517 
518 	spin_lock_irqsave(&cdev->lock, flags);
519-	if (cdev->config)
520+	if (dev->suspended != dev->sw_suspended && cdev->config) {
521+		if (strncmp(dev->pm_qos, "low", 3))
522+			pm_qos_vote = dev->suspended ? 0 : 1;
523+		next_state = dev->suspended ? USB_SUSPENDED : USB_RESUMED;
524+		uevent_envp = dev->suspended ? suspended : resumed;
525+	} else if (cdev->config) {
526 		uevent_envp = configured;
527-	else if (dev->connected != dev->sw_connected)
528+		next_state = USB_CONFIGURED;
529+	} else if (dev->connected != dev->sw_connected) {
530 		uevent_envp = dev->connected ? connected : disconnected;
531+		next_state = dev->connected ? USB_CONNECTED : USB_DISCONNECTED;
532+		if (dev->connected && strncmp(dev->pm_qos, "low", 3))
533+			pm_qos_vote = 1;
534+		else if (!dev->connected || !strncmp(dev->pm_qos, "low", 3))
535+			pm_qos_vote = 0;
536+	}
537 	dev->sw_connected = dev->connected;
538+	dev->sw_suspended = dev->suspended;
539 	spin_unlock_irqrestore(&cdev->lock, flags);
540 
541+	if (pdata->pm_qos_latency[0] && pm_qos_vote == 1) {
542+		cancel_delayed_work_sync(&dev->pm_qos_work);
543+		android_pm_qos_update_latency(dev, pdata->pm_qos_latency[WFI]);
544+		dev->curr_pm_qos_state = WFI;
545+		queue_delayed_work(system_nrt_wq, &dev->pm_qos_work,
546+			    msecs_to_jiffies(1000*dev->down_pm_qos_sample_sec));
547+	} else if (pdata->pm_qos_latency[0] && pm_qos_vote == 0) {
548+		cancel_delayed_work_sync(&dev->pm_qos_work);
549+		android_pm_qos_update_latency(dev, PM_QOS_DEFAULT_VALUE);
550+		dev->curr_pm_qos_state = NO_USB_VOTE;
551+	}
552+
553 	if (uevent_envp) {
554-		kobject_uevent_env(&dev->dev->kobj, KOBJ_CHANGE, uevent_envp);
555+		/*
556+		 * Some userspace modules, e.g. MTP, work correctly only if
557+		 * CONFIGURED uevent is preceded by DISCONNECT uevent.
558+		 * Check if we missed sending out a DISCONNECT uevent. This can
559+		 * happen if host PC resets and configures device really quick.
560+		 */
561+		if (((uevent_envp == connected) &&
562+		      (last_uevent != USB_DISCONNECTED)) ||
563+		    ((uevent_envp == configured) &&
564+		      (last_uevent == USB_CONFIGURED))) {
565+			pr_info("%s: sent missed DISCONNECT event\n", __func__);
566+			kobject_uevent_env(&dev->dev->kobj, KOBJ_CHANGE,
567+								disconnected);
568+			msleep(20);
569+		}
570+		/*
571+		 * Before sending out CONFIGURED uevent give function drivers
572+		 * a chance to wakeup userspace threads and notify disconnect
573+		 */
574+		if (uevent_envp == configured)
575+			msleep(50);
576+
577+		/* Do not notify on suspend / resume */
578+		if (next_state != USB_SUSPENDED && next_state != USB_RESUMED) {
579+			kobject_uevent_env(&dev->dev->kobj, KOBJ_CHANGE,
580+					   uevent_envp);
581+			last_uevent = next_state;
582+		}
583 		pr_info("%s: sent uevent %s\n", __func__, uevent_envp[0]);
584 	} else {
585 		pr_info("%s: did not send uevent (%d %d %p)\n", __func__,
586@@ -197,44 +471,45 @@ static void android_work(struct work_struct *data)
587 	}
588 }
589 
590-static void android_enable(struct android_dev *dev)
591+static int android_enable(struct android_dev *dev)
592 {
593 	struct usb_composite_dev *cdev = dev->cdev;
594+	struct android_configuration *conf;
595+	int err = 0;
596 
597-	BUG_ON(!mutex_is_locked(&dev->mutex));
598-	BUG_ON(!dev->disable_depth);
599+	if (WARN_ON(!dev->disable_depth))
600+		return err;
601 
602 	if (--dev->disable_depth == 0) {
603-#ifdef CONFIG_USB_PCD_SETTINGS
604-		usb_pcd_enable(cdev->gadget);
605-#endif
606-		usb_add_config(cdev, &android_config_driver,
607-					android_bind_config);
608+
609+		list_for_each_entry(conf, &dev->configs, list_item) {
610+			err = usb_add_config(cdev, &conf->usb_config,
611+						android_bind_config);
612+			if (err < 0) {
613+				pr_err("%s: usb_add_config failed : err: %d\n",
614+						__func__, err);
615+				dev->disable_depth++;
616+				return err;
617+			}
618+		}
619 		usb_gadget_connect(cdev->gadget);
620 	}
621+
622+	return err;
623 }
624 
625 static void android_disable(struct android_dev *dev)
626 {
627 	struct usb_composite_dev *cdev = dev->cdev;
628-
629-	BUG_ON(!mutex_is_locked(&dev->mutex));
630+	struct android_configuration *conf;
631 
632 	if (dev->disable_depth++ == 0) {
633 		usb_gadget_disconnect(cdev->gadget);
634 		/* Cancel pending control requests */
635 		usb_ep_dequeue(cdev->gadget->ep0, cdev->req);
636-		usb_remove_config(cdev, &android_config_driver);
637-		/*
638-		 * Moving the disconnect uevent to after
639-		 * cdev->config is made NULL. Else, if the
640-		 * android_work is scheduled before cdev->config
641-		 * is made NULL we may miss out the disconnect uevent.
642-		 */
643-		android_disconnect(cdev);
644-#ifdef CONFIG_USB_PCD_SETTINGS
645-		usb_pcd_disable(cdev->gadget);
646-#endif
647+
648+		list_for_each_entry(conf, &dev->configs, list_item)
649+			usb_remove_config(cdev, &conf->usb_config);
650 	}
651 }
652 
653@@ -245,6 +520,7 @@ struct functionfs_config {
654 	bool opened;
655 	bool enabled;
656 	struct ffs_data *data;
657+	struct android_dev *dev;
658 };
659 
660 static int ffs_function_init(struct android_usb_function *f,
661@@ -265,7 +541,7 @@ static void ffs_function_cleanup(struct android_usb_function *f)
662 
663 static void ffs_function_enable(struct android_usb_function *f)
664 {
665-	struct android_dev *dev = _android_dev;
666+	struct android_dev *dev = f->android_dev;
667 	struct functionfs_config *config = f->config;
668 
669 	config->enabled = true;
670@@ -277,7 +553,7 @@ static void ffs_function_enable(struct android_usb_function *f)
671 
672 static void ffs_function_disable(struct android_usb_function *f)
673 {
674-	struct android_dev *dev = _android_dev;
675+	struct android_dev *dev = f->android_dev;
676 	struct functionfs_config *config = f->config;
677 
678 	config->enabled = false;
679@@ -297,9 +573,12 @@ static int ffs_function_bind_config(struct android_usb_function *f,
680 static ssize_t
681 ffs_aliases_show(struct device *pdev, struct device_attribute *attr, char *buf)
682 {
683-	struct android_dev *dev = _android_dev;
684+	struct android_dev *dev;
685 	int ret;
686 
687+	dev = list_first_entry(&android_dev_list, struct android_dev,
688+					list_item);
689+
690 	mutex_lock(&dev->mutex);
691 	ret = sprintf(buf, "%s\n", dev->ffs_aliases);
692 	mutex_unlock(&dev->mutex);
693@@ -311,9 +590,11 @@ static ssize_t
694 ffs_aliases_store(struct device *pdev, struct device_attribute *attr,
695 					const char *buf, size_t size)
696 {
697-	struct android_dev *dev = _android_dev;
698+	struct android_dev *dev;
699 	char buff[256];
700 
701+	dev = list_first_entry(&android_dev_list, struct android_dev,
702+					list_item);
703 	mutex_lock(&dev->mutex);
704 
705 	if (dev->enabled) {
706@@ -348,48 +629,68 @@ static struct android_usb_function ffs_function = {
707 
708 static int functionfs_ready_callback(struct ffs_data *ffs)
709 {
710-	struct android_dev *dev = _android_dev;
711+	struct android_dev *dev = ffs_function.android_dev;
712 	struct functionfs_config *config = ffs_function.config;
713 	int ret = 0;
714 
715-	mutex_lock(&dev->mutex);
716-
717-	ret = functionfs_bind(ffs, dev->cdev);
718-	if (ret)
719-		goto err;
720+	/* dev is null in case ADB is not in the composition */
721+	if (dev) {
722+		mutex_lock(&dev->mutex);
723+		ret = functionfs_bind(ffs, dev->cdev);
724+		if (ret) {
725+			mutex_unlock(&dev->mutex);
726+			return ret;
727+		}
728+	} else {
729+		/* android ffs_func requires daemon to start only after enable*/
730+		pr_debug("start adbd only in ADB composition\n");
731+		return -ENODEV;
732+	}
733 
734 	config->data = ffs;
735 	config->opened = true;
736+	/* Save dev in case the adb function will get disabled */
737+	config->dev = dev;
738 
739 	if (config->enabled)
740 		android_enable(dev);
741 
742-err:
743 	mutex_unlock(&dev->mutex);
744-	return ret;
745+
746+	return 0;
747 }
748 
749 static void functionfs_closed_callback(struct ffs_data *ffs)
750 {
751-	struct android_dev *dev = _android_dev;
752+	struct android_dev *dev = ffs_function.android_dev;
753 	struct functionfs_config *config = ffs_function.config;
754 
755-	mutex_lock(&dev->mutex);
756+	/*
757+	 * In case new composition is without ADB or ADB got disabled by the
758+	 * time ffs_daemon was stopped then use saved one
759+	 */
760+	if (!dev)
761+		dev = config->dev;
762 
763-	if (config->enabled)
764+	/* fatal-error: It should never happen */
765+	if (!dev)
766+		pr_err("adb_closed_callback: config->dev is NULL");
767+
768+	if (dev)
769+		mutex_lock(&dev->mutex);
770+
771+	if (config->enabled && dev)
772 		android_disable(dev);
773 
774+	config->dev = NULL;
775+
776 	config->opened = false;
777 	config->data = NULL;
778 
779 	functionfs_unbind(ffs);
780-	/* Workaround to decrement the next_string_id
781-	 * Issue: The next_string_id was never decremented
782-	 * and when next_string_id = 254 USB connection fails
783-	 */
784-	dev->cdev->next_string_id -= ffs->strings_count;
785 
786-	mutex_unlock(&dev->mutex);
787+	if (dev)
788+		mutex_unlock(&dev->mutex);
789 }
790 
791 static void *functionfs_acquire_dev_callback(const char *dev_name)
792@@ -401,6 +702,8 @@ static void functionfs_release_dev_callback(struct ffs_data *ffs_data)
793 {
794 }
795 
796+/* ACM */
797+static char acm_transports[32];	/*enabled ACM ports - "tty[,sdio]"*/
798 #define MAX_ACM_INSTANCES 4
799 struct acm_function_config {
800 	int instances;
801@@ -413,8 +716,6 @@ static int
802 acm_function_init(struct android_usb_function *f,
803 		struct usb_composite_dev *cdev)
804 {
805-	int i;
806-	int ret;
807 	struct acm_function_config *config;
808 
809 	config = kzalloc(sizeof(struct acm_function_config), GFP_KERNEL);
810@@ -422,26 +723,7 @@ acm_function_init(struct android_usb_function *f,
811 		return -ENOMEM;
812 	f->config = config;
813 
814-	for (i = 0; i < MAX_ACM_INSTANCES; i++) {
815-		config->f_acm_inst[i] = usb_get_function_instance("acm");
816-		if (IS_ERR(config->f_acm_inst[i])) {
817-			ret = PTR_ERR(config->f_acm_inst[i]);
818-			goto err_usb_get_function_instance;
819-		}
820-		config->f_acm[i] = usb_get_function(config->f_acm_inst[i]);
821-		if (IS_ERR(config->f_acm[i])) {
822-			ret = PTR_ERR(config->f_acm[i]);
823-			goto err_usb_get_function;
824-		}
825-	}
826 	return 0;
827-err_usb_get_function_instance:
828-	while (i-- > 0) {
829-		usb_put_function(config->f_acm[i]);
830-err_usb_get_function:
831-		usb_put_function_instance(config->f_acm_inst[i]);
832-	}
833-	return ret;
834 }
835 
836 static void acm_function_cleanup(struct android_usb_function *f)
837@@ -449,7 +731,8 @@ static void acm_function_cleanup(struct android_usb_function *f)
838 	int i;
839 	struct acm_function_config *config = f->config;
840 
841-	for (i = 0; i < MAX_ACM_INSTANCES; i++) {
842+	acm_port_cleanup();
843+	for (i = 0; i < config->instances_on; i++) {
844 		usb_put_function(config->f_acm[i]);
845 		usb_put_function_instance(config->f_acm_inst[i]);
846 	}
847@@ -461,14 +744,59 @@ static int
848 acm_function_bind_config(struct android_usb_function *f,
849 		struct usb_configuration *c)
850 {
851-	int i;
852-	int ret = 0;
853+	char *name;
854+	char buf[32], *b;
855+	int err = -1, i;
856+	static int acm_initialized, ports;
857 	struct acm_function_config *config = f->config;
858 
859-	config->instances_on = config->instances;
860-	for (i = 0; i < config->instances_on; i++) {
861-		ret = usb_add_function(c, config->f_acm[i]);
862-		if (ret) {
863+	if (acm_initialized)
864+		goto bind_config;
865+
866+	acm_initialized = 1;
867+	strlcpy(buf, acm_transports, sizeof(buf));
868+	b = strim(buf);
869+
870+	while (b) {
871+		name = strsep(&b, ",");
872+
873+		if (name) {
874+			err = acm_init_port(ports, name);
875+			if (err) {
876+				pr_err("acm: Cannot open port '%s'", name);
877+				goto out;
878+			}
879+			ports++;
880+			if (ports >= MAX_ACM_INSTANCES) {
881+				pr_err("acm: max ports reached '%s'", name);
882+				goto out;
883+			}
884+		}
885+	}
886+	err = acm_port_setup(c);
887+	if (err) {
888+		pr_err("acm: Cannot setup transports");
889+		goto out;
890+	}
891+
892+	for (i = 0; i < ports; i++) {
893+		config->f_acm_inst[i] = usb_get_function_instance("acm");
894+		if (IS_ERR(config->f_acm_inst[i])) {
895+			err = PTR_ERR(config->f_acm_inst[i]);
896+			goto err_usb_get_function_instance;
897+		}
898+		config->f_acm[i] = usb_get_function(config->f_acm_inst[i]);
899+		if (IS_ERR(config->f_acm[i])) {
900+			err = PTR_ERR(config->f_acm[i]);
901+			goto err_usb_get_function;
902+		}
903+	}
904+	config->instances_on = ports;
905+
906+bind_config:
907+	for (i = 0; i < ports; i++) {
908+		err = usb_add_function(c, config->f_acm[i]);
909+		if (err) {
910 			pr_err("Could not bind acm%u config\n", i);
911 			goto err_usb_add_function;
912 		}
913@@ -479,35 +807,41 @@ acm_function_bind_config(struct android_usb_function *f,
914 err_usb_add_function:
915 	while (i-- > 0)
916 		usb_remove_function(c, config->f_acm[i]);
917-	return ret;
918+
919+	config->instances_on = 0;
920+	return err;
921+
922+err_usb_get_function_instance:
923+	while (i-- > 0) {
924+		usb_put_function(config->f_acm[i]);
925+err_usb_get_function:
926+		usb_put_function_instance(config->f_acm_inst[i]);
927+	}
928+
929+out:
930+	config->instances_on = 0;
931+	return err;
932 }
933 
934-static ssize_t acm_instances_show(struct device *dev,
935-		struct device_attribute *attr, char *buf)
936+static void acm_function_unbind_config(struct android_usb_function *f,
937+				       struct usb_configuration *c)
938 {
939-	struct android_usb_function *f = dev_get_drvdata(dev);
940 	struct acm_function_config *config = f->config;
941-	return sprintf(buf, "%d\n", config->instances);
942+	config->instances_on = 0;
943 }
944 
945-static ssize_t acm_instances_store(struct device *dev,
946-		struct device_attribute *attr, const char *buf, size_t size)
947+static ssize_t acm_transports_store(
948+		struct device *device, struct device_attribute *attr,
949+		const char *buff, size_t size)
950 {
951-	struct android_usb_function *f = dev_get_drvdata(dev);
952-	struct acm_function_config *config = f->config;
953-	int value;
954+	strlcpy(acm_transports, buff, sizeof(acm_transports));
955 
956-	sscanf(buf, "%d", &value);
957-	if (value > MAX_ACM_INSTANCES)
958-		value = MAX_ACM_INSTANCES;
959-	config->instances = value;
960 	return size;
961 }
962 
963-static DEVICE_ATTR(instances, S_IRUGO | S_IWUSR, acm_instances_show,
964-						 acm_instances_store);
965+static DEVICE_ATTR(acm_transports, S_IWUSR, NULL, acm_transports_store);
966 static struct device_attribute *acm_function_attributes[] = {
967-	&dev_attr_instances,
968+	&dev_attr_acm_transports,
969 	NULL
970 };
971 
972@@ -516,151 +850,1073 @@ static struct android_usb_function acm_function = {
973 	.init		= acm_function_init,
974 	.cleanup	= acm_function_cleanup,
975 	.bind_config	= acm_function_bind_config,
976+	.unbind_config	= acm_function_unbind_config,
977 	.attributes	= acm_function_attributes,
978 };
979 
980-#ifdef CONFIG_USB_GADGET_GG
981-#define MAX_GG_INSTANCES 2
982-struct gg_function_config {
983-	int instances;
984-	int instances_on;
985-	struct usb_function *f_gg[MAX_GG_INSTANCES];
986-	struct usb_function_instance *f_gg_inst[MAX_GG_INSTANCES];
987+/* RMNET_SMD */
988+static int rmnet_smd_function_bind_config(struct android_usb_function *f,
989+					  struct usb_configuration *c)
990+{
991+	return rmnet_smd_bind_config(c);
992+}
993+
994+static struct android_usb_function rmnet_smd_function = {
995+	.name		= "rmnet_smd",
996+	.bind_config	= rmnet_smd_function_bind_config,
997 };
998 
999-static int gg_function_init(struct android_usb_function *f,
1000-		struct usb_composite_dev *cdev)
1001-{
1002-	int i;
1003-	int ret;
1004-	struct gg_function_config *config;
1005+/*rmnet transport string format(per port):"ctrl0,data0,ctrl1,data1..." */
1006+#define MAX_XPORT_STR_LEN 50
1007+static char rmnet_transports[MAX_XPORT_STR_LEN];
1008 
1009-	config = kzalloc(sizeof(struct gg_function_config), GFP_KERNEL);
1010-	if (!config)
1011-		return -ENOMEM;
1012-	f->config = config;
1013+/*rmnet transport name string - "rmnet_hsic[,rmnet_hsusb]" */
1014+static char rmnet_xport_names[MAX_XPORT_STR_LEN];
1015 
1016-	for (i = 0; i < MAX_GG_INSTANCES; i++) {
1017-		config->f_gg_inst[i] = usb_get_function_instance("gg");
1018-		if (IS_ERR(config->f_gg_inst[i])) {
1019-			ret = PTR_ERR(config->f_gg_inst[i]);
1020-			goto err_usb_get_function_instance;
1021-		}
1022-		config->f_gg[i] = usb_get_function(config->f_gg_inst[i]);
1023-		if (IS_ERR(config->f_gg[i])) {
1024-			ret = PTR_ERR(config->f_gg[i]);
1025-			goto err_usb_get_function;
1026-		}
1027-	}
1028-	return 0;
1029-err_usb_get_function_instance:
1030-	while (i-- > 0) {
1031-		usb_put_function(config->f_gg[i]);
1032-err_usb_get_function:
1033-		usb_put_function_instance(config->f_gg_inst[i]);
1034-	}
1035-	return ret;
1036-}
1037+/*qdss transport string format(per port):"bam [, hsic]" */
1038+static char qdss_transports[MAX_XPORT_STR_LEN];
1039 
1040-static void gg_function_cleanup(struct android_usb_function *f)
1041-{
1042-	int i;
1043-	struct gg_function_config *config = f->config;
1044+/*qdss transport name string - "qdss_bam [, qdss_hsic]" */
1045+static char qdss_xport_names[MAX_XPORT_STR_LEN];
1046 
1047-	for (i = 0; i < MAX_GG_INSTANCES; i++) {
1048-		usb_put_function(config->f_gg[i]);
1049-		usb_put_function_instance(config->f_gg_inst[i]);
1050-	}
1051-	kfree(f->config);
1052-	f->config = NULL;
1053+/*qdss debug interface setting 0: disable   1:enable */
1054+static bool qdss_debug_intf;
1055+
1056+static void rmnet_function_cleanup(struct android_usb_function *f)
1057+{
1058+	frmnet_cleanup();
1059 }
1060 
1061-static int gg_function_bind_config(struct android_usb_function *f,
1062-		struct usb_configuration *c)
1063+static int rmnet_function_bind_config(struct android_usb_function *f,
1064+					 struct usb_configuration *c)
1065 {
1066 	int i;
1067-	int ret = 0;
1068-	struct gg_function_config *config = f->config;
1069+	int err = 0;
1070+	char *ctrl_name;
1071+	char *data_name;
1072+	char *tname = NULL;
1073+	char buf[MAX_XPORT_STR_LEN], *b;
1074+	char xport_name_buf[MAX_XPORT_STR_LEN], *tb;
1075+	static int rmnet_initialized, ports;
1076+
1077+	if (!rmnet_initialized) {
1078+		rmnet_initialized = 1;
1079+		strlcpy(buf, rmnet_transports, sizeof(buf));
1080+		b = strim(buf);
1081+
1082+		strlcpy(xport_name_buf, rmnet_xport_names,
1083+				sizeof(xport_name_buf));
1084+		tb = strim(xport_name_buf);
1085+
1086+		while (b) {
1087+			ctrl_name = strsep(&b, ",");
1088+			data_name = strsep(&b, ",");
1089+			if (ctrl_name && data_name) {
1090+				if (tb)
1091+					tname = strsep(&tb, ",");
1092+				err = frmnet_init_port(ctrl_name, data_name,
1093+						tname);
1094+				if (err) {
1095+					pr_err("rmnet: Cannot open ctrl port:"
1096+						"'%s' data port:'%s'\n",
1097+						ctrl_name, data_name);
1098+					goto out;
1099+				}
1100+				ports++;
1101+			}
1102+		}
1103 
1104-	config->instances_on = config->instances;
1105-	for (i = 0; i < config->instances_on; i++) {
1106-		ret = usb_add_function(c, config->f_gg[i]);
1107-		if (ret) {
1108-			pr_err("Could not bind gg%u config\n", i);
1109-			goto err_usb_add_function;
1110+		err = rmnet_gport_setup();
1111+		if (err) {
1112+			pr_err("rmnet: Cannot setup transports");
1113+			goto out;
1114 		}
1115 	}
1116 
1117-	return 0;
1118+	for (i = 0; i < ports; i++) {
1119+		err = frmnet_bind_config(c, i);
1120+		if (err) {
1121+			pr_err("Could not bind rmnet%u config\n", i);
1122+			break;
1123+		}
1124+	}
1125+out:
1126+	return err;
1127+}
1128 
1129-err_usb_add_function:
1130-	while (i-- > 0)
1131-		usb_remove_function(c, config->f_gg[i]);
1132-	return ret;
1133+static void rmnet_function_unbind_config(struct android_usb_function *f,
1134+						struct usb_configuration *c)
1135+{
1136+	frmnet_unbind_config();
1137 }
1138 
1139-static ssize_t gg_instances_show(struct device *dev,
1140+static ssize_t rmnet_transports_show(struct device *dev,
1141 		struct device_attribute *attr, char *buf)
1142 {
1143-	struct android_usb_function *f = dev_get_drvdata(dev);
1144-	struct gg_function_config *config = f->config;
1145-	return sprintf(buf, "%d\n", config->instances);
1146+	return snprintf(buf, PAGE_SIZE, "%s\n", rmnet_transports);
1147 }
1148 
1149-static ssize_t gg_instances_store(struct device *dev,
1150-		struct device_attribute *attr, const char *buf, size_t size)
1151+static ssize_t rmnet_transports_store(
1152+		struct device *device, struct device_attribute *attr,
1153+		const char *buff, size_t size)
1154 {
1155-	struct android_usb_function *f = dev_get_drvdata(dev);
1156-	struct gg_function_config *config = f->config;
1157-	int value;
1158+	strlcpy(rmnet_transports, buff, sizeof(rmnet_transports));
1159 
1160-	sscanf(buf, "%d", &value);
1161-	if (value > MAX_GG_INSTANCES)
1162-		value = MAX_GG_INSTANCES;
1163-	config->instances = value;
1164 	return size;
1165 }
1166 
1167-static DEVICE_ATTR(gg_instances, S_IRUGO | S_IWUSR, gg_instances_show,
1168-						 gg_instances_store);
1169-static struct device_attribute *gg_function_attributes[] = {
1170-	&dev_attr_gg_instances,
1171-	NULL
1172-};
1173-
1174-static struct android_usb_function gg_function = {
1175-	.name		= "gg",
1176-	.init		= gg_function_init,
1177-	.cleanup	= gg_function_cleanup,
1178-	.bind_config	= gg_function_bind_config,
1179-	.attributes	= gg_function_attributes,
1180-};
1181-#endif
1182-
1183-static int
1184-mtp_function_init(struct android_usb_function *f,
1185-		struct usb_composite_dev *cdev)
1186+static ssize_t rmnet_xport_names_show(struct device *dev,
1187+		struct device_attribute *attr, char *buf)
1188 {
1189-	return mtp_setup();
1190+	return snprintf(buf, PAGE_SIZE, "%s\n", rmnet_xport_names);
1191 }
1192 
1193-static void mtp_function_cleanup(struct android_usb_function *f)
1194+static ssize_t rmnet_xport_names_store(
1195+		struct device *device, struct device_attribute *attr,
1196+		const char *buff, size_t size)
1197 {
1198-	mtp_cleanup();
1199+	strlcpy(rmnet_xport_names, buff, sizeof(rmnet_xport_names));
1200+
1201+	return size;
1202 }
1203 
1204-static int
1205-mtp_function_bind_config(struct android_usb_function *f,
1206-		struct usb_configuration *c)
1207+static struct device_attribute dev_attr_rmnet_transports =
1208+					__ATTR(transports, S_IRUGO | S_IWUSR,
1209+						rmnet_transports_show,
1210+						rmnet_transports_store);
1211+
1212+static struct device_attribute dev_attr_rmnet_xport_names =
1213+				__ATTR(transport_names, S_IRUGO | S_IWUSR,
1214+				rmnet_xport_names_show,
1215+				rmnet_xport_names_store);
1216+
1217+static struct device_attribute *rmnet_function_attributes[] = {
1218+					&dev_attr_rmnet_transports,
1219+					&dev_attr_rmnet_xport_names,
1220+					NULL };
1221+
1222+static struct android_usb_function rmnet_function = {
1223+	.name		= "rmnet",
1224+	.cleanup	= rmnet_function_cleanup,
1225+	.bind_config	= rmnet_function_bind_config,
1226+	.unbind_config	= rmnet_function_unbind_config,
1227+	.attributes	= rmnet_function_attributes,
1228+};
1229+
1230+static void gps_function_cleanup(struct android_usb_function *f)
1231 {
1232-	return mtp_bind_config(c, false);
1233+	gps_cleanup();
1234 }
1235 
1236-static int
1237-ptp_function_init(struct android_usb_function *f,
1238-		struct usb_composite_dev *cdev)
1239+static int gps_function_bind_config(struct android_usb_function *f,
1240+					 struct usb_configuration *c)
1241 {
1242-	/* nothing to do - initialization is handled by mtp_function_init */
1243+	int err;
1244+	static int gps_initialized;
1245+
1246+	if (!gps_initialized) {
1247+		gps_initialized = 1;
1248+		err = gps_init_port();
1249+		if (err) {
1250+			pr_err("gps: Cannot init gps port");
1251+			return err;
1252+		}
1253+	}
1254+
1255+	err = gps_gport_setup();
1256+	if (err) {
1257+		pr_err("gps: Cannot setup transports");
1258+		return err;
1259+	}
1260+	err = gps_bind_config(c);
1261+	if (err) {
1262+		pr_err("Could not bind gps config\n");
1263+		return err;
1264+	}
1265+
1266+	return 0;
1267+}
1268+
1269+static struct android_usb_function gps_function = {
1270+	.name		= "gps",
1271+	.cleanup	= gps_function_cleanup,
1272+	.bind_config	= gps_function_bind_config,
1273+};
1274+
1275+/* ncm */
1276+struct ncm_function_config {
1277+	u8      ethaddr[ETH_ALEN];
1278+	struct eth_dev *dev;
1279+};
1280+static int
1281+ncm_function_init(struct android_usb_function *f, struct usb_composite_dev *c)
1282+{
1283+	f->config = kzalloc(sizeof(struct ncm_function_config), GFP_KERNEL);
1284+	if (!f->config)
1285+		return -ENOMEM;
1286+
1287+	return 0;
1288+}
1289+
1290+static void ncm_function_cleanup(struct android_usb_function *f)
1291+{
1292+	kfree(f->config);
1293+	f->config = NULL;
1294+}
1295+
1296+static int
1297+ncm_function_bind_config(struct android_usb_function *f,
1298+				struct usb_configuration *c)
1299+{
1300+	struct ncm_function_config *ncm = f->config;
1301+	int ret;
1302+	struct eth_dev *dev;
1303+
1304+	if (!ncm) {
1305+		pr_err("%s: ncm config is null\n", __func__);
1306+		return -EINVAL;
1307+	}
1308+
1309+	pr_info("%s MAC: %02X:%02X:%02X:%02X:%02X:%02X\n", __func__,
1310+		ncm->ethaddr[0], ncm->ethaddr[1], ncm->ethaddr[2],
1311+		ncm->ethaddr[3], ncm->ethaddr[4], ncm->ethaddr[5]);
1312+
1313+	dev = gether_setup_name(c->cdev->gadget, ncm->ethaddr, "ncm");
1314+	if (IS_ERR(dev)) {
1315+		ret = PTR_ERR(dev);
1316+		pr_err("%s: gether setup failed err:%d\n", __func__, ret);
1317+		return ret;
1318+	}
1319+	ncm->dev = dev;
1320+
1321+	ret = ncm_bind_config(c, ncm->ethaddr, dev);
1322+	if (ret) {
1323+		pr_err("%s: ncm bind config failed err:%d", __func__, ret);
1324+		gether_cleanup(dev);
1325+		return ret;
1326+	}
1327+
1328+	return ret;
1329+}
1330+
1331+static void ncm_function_unbind_config(struct android_usb_function *f,
1332+						struct usb_configuration *c)
1333+{
1334+	struct ncm_function_config *ncm = f->config;
1335+	gether_cleanup(ncm->dev);
1336+}
1337+
1338+static ssize_t ncm_ethaddr_show(struct device *dev,
1339+		struct device_attribute *attr, char *buf)
1340+{
1341+	struct android_usb_function *f = dev_get_drvdata(dev);
1342+	struct ncm_function_config *ncm = f->config;
1343+	return snprintf(buf, PAGE_SIZE, "%02x:%02x:%02x:%02x:%02x:%02x\n",
1344+		ncm->ethaddr[0], ncm->ethaddr[1], ncm->ethaddr[2],
1345+		ncm->ethaddr[3], ncm->ethaddr[4], ncm->ethaddr[5]);
1346+}
1347+
1348+static ssize_t ncm_ethaddr_store(struct device *dev,
1349+		struct device_attribute *attr, const char *buf, size_t size)
1350+{
1351+	struct android_usb_function *f = dev_get_drvdata(dev);
1352+	struct ncm_function_config *ncm = f->config;
1353+
1354+	if (sscanf(buf, "%02x:%02x:%02x:%02x:%02x:%02x\n",
1355+		    (int *)&ncm->ethaddr[0], (int *)&ncm->ethaddr[1],
1356+		    (int *)&ncm->ethaddr[2], (int *)&ncm->ethaddr[3],
1357+		    (int *)&ncm->ethaddr[4], (int *)&ncm->ethaddr[5]) == 6)
1358+		return size;
1359+	return -EINVAL;
1360+}
1361+
1362+static DEVICE_ATTR(ncm_ethaddr, S_IRUGO | S_IWUSR, ncm_ethaddr_show,
1363+					       ncm_ethaddr_store);
1364+static struct device_attribute *ncm_function_attributes[] = {
1365+	&dev_attr_ncm_ethaddr,
1366+	NULL
1367+};
1368+
1369+static struct android_usb_function ncm_function = {
1370+	.name		= "ncm",
1371+	.init		= ncm_function_init,
1372+	.cleanup	= ncm_function_cleanup,
1373+	.bind_config	= ncm_function_bind_config,
1374+	.unbind_config	= ncm_function_unbind_config,
1375+	.attributes	= ncm_function_attributes,
1376+};
1377+/* ecm transport string */
1378+static char ecm_transports[MAX_XPORT_STR_LEN];
1379+
1380+struct ecm_function_config {
1381+	u8      ethaddr[ETH_ALEN];
1382+	struct eth_dev *dev;
1383+};
1384+
1385+static int ecm_function_init(struct android_usb_function *f,
1386+				struct usb_composite_dev *cdev)
1387+{
1388+	f->config = kzalloc(sizeof(struct ecm_function_config), GFP_KERNEL);
1389+	if (!f->config)
1390+		return -ENOMEM;
1391+	return 0;
1392+}
1393+
1394+static int ecm_qc_function_init(struct android_usb_function *f,
1395+				struct usb_composite_dev *cdev)
1396+{
1397+	f->config = kzalloc(sizeof(struct ecm_function_config), GFP_KERNEL);
1398+	if (!f->config)
1399+		return -ENOMEM;
1400+	return ecm_qc_init();
1401+}
1402+static void ecm_function_cleanup(struct android_usb_function *f)
1403+{
1404+	kfree(f->config);
1405+	f->config = NULL;
1406+}
1407+
1408+static int ecm_qc_function_bind_config(struct android_usb_function *f,
1409+					struct usb_configuration *c)
1410+{
1411+	int ret;
1412+	char *trans;
1413+	struct ecm_function_config *ecm = f->config;
1414+
1415+	if (!ecm) {
1416+		pr_err("%s: ecm_pdata\n", __func__);
1417+		return -EINVAL;
1418+	}
1419+
1420+	pr_info("%s MAC: %02X:%02X:%02X:%02X:%02X:%02X\n", __func__,
1421+		ecm->ethaddr[0], ecm->ethaddr[1], ecm->ethaddr[2],
1422+		ecm->ethaddr[3], ecm->ethaddr[4], ecm->ethaddr[5]);
1423+
1424+	pr_debug("%s: ecm_transport is %s", __func__, ecm_transports);
1425+
1426+	trans = strim(ecm_transports);
1427+	if (strcmp("BAM2BAM_IPA", trans)) {
1428+		ret = gether_qc_setup_name(c->cdev->gadget,
1429+						ecm->ethaddr, "ecm");
1430+		if (ret) {
1431+			pr_err("%s: gether_setup failed\n", __func__);
1432+			return ret;
1433+		}
1434+	}
1435+
1436+	return ecm_qc_bind_config(c, ecm->ethaddr, trans);
1437+}
1438+
1439+static void ecm_qc_function_unbind_config(struct android_usb_function *f,
1440+						struct usb_configuration *c)
1441+{
1442+	char *trans = strim(ecm_transports);
1443+
1444+	if (strcmp("BAM2BAM_IPA", trans)) {
1445+		bam_data_flush_workqueue();
1446+		gether_qc_cleanup_name("ecm0");
1447+	}
1448+}
1449+
1450+static ssize_t ecm_ethaddr_show(struct device *dev,
1451+		struct device_attribute *attr, char *buf)
1452+{
1453+	struct android_usb_function *f = dev_get_drvdata(dev);
1454+	struct ecm_function_config *ecm = f->config;
1455+	return snprintf(buf, PAGE_SIZE, "%02x:%02x:%02x:%02x:%02x:%02x\n",
1456+		ecm->ethaddr[0], ecm->ethaddr[1], ecm->ethaddr[2],
1457+		ecm->ethaddr[3], ecm->ethaddr[4], ecm->ethaddr[5]);
1458+}
1459+
1460+static ssize_t ecm_ethaddr_store(struct device *dev,
1461+		struct device_attribute *attr, const char *buf, size_t size)
1462+{
1463+	struct android_usb_function *f = dev_get_drvdata(dev);
1464+	struct ecm_function_config *ecm = f->config;
1465+
1466+	if (sscanf(buf, "%02x:%02x:%02x:%02x:%02x:%02x\n",
1467+		    (int *)&ecm->ethaddr[0], (int *)&ecm->ethaddr[1],
1468+		    (int *)&ecm->ethaddr[2], (int *)&ecm->ethaddr[3],
1469+		    (int *)&ecm->ethaddr[4], (int *)&ecm->ethaddr[5]) == 6)
1470+		return size;
1471+	return -EINVAL;
1472+}
1473+
1474+static DEVICE_ATTR(ecm_ethaddr, S_IRUGO | S_IWUSR, ecm_ethaddr_show,
1475+					       ecm_ethaddr_store);
1476+
1477+static ssize_t ecm_transports_show(struct device *dev,
1478+		struct device_attribute *attr, char *buf)
1479+{
1480+	return snprintf(buf, PAGE_SIZE, "%s\n", ecm_transports);
1481+}
1482+
1483+static ssize_t ecm_transports_store(struct device *dev,
1484+		struct device_attribute *attr, const char *buf, size_t size)
1485+{
1486+	strlcpy(ecm_transports, buf, sizeof(ecm_transports));
1487+	return size;
1488+}
1489+
1490+static DEVICE_ATTR(ecm_transports, S_IRUGO | S_IWUSR, ecm_transports_show,
1491+					       ecm_transports_store);
1492+
1493+static struct device_attribute *ecm_function_attributes[] = {
1494+	&dev_attr_ecm_transports,
1495+	&dev_attr_ecm_ethaddr,
1496+	NULL
1497+};
1498+
1499+static struct android_usb_function ecm_qc_function = {
1500+	.name		= "ecm_qc",
1501+	.init		= ecm_qc_function_init,
1502+	.cleanup	= ecm_function_cleanup,
1503+	.bind_config	= ecm_qc_function_bind_config,
1504+	.unbind_config	= ecm_qc_function_unbind_config,
1505+	.attributes	= ecm_function_attributes,
1506+};
1507+
1508+/* MBIM - used with BAM */
1509+#define MAX_MBIM_INSTANCES 1
1510+
1511+static int mbim_function_init(struct android_usb_function *f,
1512+					 struct usb_composite_dev *cdev)
1513+{
1514+	return mbim_init(MAX_MBIM_INSTANCES);
1515+}
1516+
1517+static void mbim_function_cleanup(struct android_usb_function *f)
1518+{
1519+	fmbim_cleanup();
1520+}
1521+
1522+
1523+/* mbim transport string */
1524+static char mbim_transports[MAX_XPORT_STR_LEN];
1525+
1526+static int mbim_function_bind_config(struct android_usb_function *f,
1527+					  struct usb_configuration *c)
1528+{
1529+	char *trans;
1530+
1531+	pr_debug("%s: mbim transport is %s", __func__, mbim_transports);
1532+	trans = strim(mbim_transports);
1533+	return mbim_bind_config(c, 0, trans);
1534+}
1535+
1536+static void mbim_function_unbind_config(struct android_usb_function *f,
1537+						struct usb_configuration *c)
1538+{
1539+	char *trans = strim(mbim_transports);
1540+
1541+	if (strcmp("BAM2BAM_IPA", trans))
1542+		bam_data_flush_workqueue();
1543+}
1544+
1545+static int mbim_function_ctrlrequest(struct android_usb_function *f,
1546+					struct usb_composite_dev *cdev,
1547+					const struct usb_ctrlrequest *c)
1548+{
1549+	return mbim_ctrlrequest(cdev, c);
1550+}
1551+
1552+static ssize_t mbim_transports_show(struct device *dev,
1553+		struct device_attribute *attr, char *buf)
1554+{
1555+	return snprintf(buf, PAGE_SIZE, "%s\n", mbim_transports);
1556+}
1557+
1558+static ssize_t mbim_transports_store(struct device *dev,
1559+		struct device_attribute *attr, const char *buf, size_t size)
1560+{
1561+	strlcpy(mbim_transports, buf, sizeof(mbim_transports));
1562+	return size;
1563+}
1564+
1565+static DEVICE_ATTR(mbim_transports, S_IRUGO | S_IWUSR, mbim_transports_show,
1566+				mbim_transports_store);
1567+
1568+static ssize_t wMTU_show(struct device *dev,
1569+		struct device_attribute *attr, char *buf)
1570+{
1571+	return snprintf(buf, PAGE_SIZE, "%d\n", ext_mbb_desc.wMTU);
1572+}
1573+
1574+static ssize_t wMTU_store(struct device *dev,
1575+		struct device_attribute *attr, const char *buf, size_t size)
1576+{
1577+	int value;
1578+	if (sscanf(buf, "%d", &value) == 1) {
1579+		if (value < 0 || value > USHRT_MAX)
1580+			pr_err("illegal MTU %d, enter unsigned 16 bits\n",
1581+				value);
1582+		else
1583+			ext_mbb_desc.wMTU = cpu_to_le16(value);
1584+		return size;
1585+	}
1586+	return -EINVAL;
1587+}
1588+
1589+static DEVICE_ATTR(wMTU, S_IRUGO | S_IWUSR, wMTU_show,
1590+				wMTU_store);
1591+
1592+static struct device_attribute *mbim_function_attributes[] = {
1593+	&dev_attr_mbim_transports,
1594+	&dev_attr_wMTU,
1595+	NULL
1596+};
1597+
1598+static struct android_usb_function mbim_function = {
1599+	.name		= "usb_mbim",
1600+	.cleanup	= mbim_function_cleanup,
1601+	.bind_config	= mbim_function_bind_config,
1602+	.unbind_config	= mbim_function_unbind_config,
1603+	.init		= mbim_function_init,
1604+	.ctrlrequest	= mbim_function_ctrlrequest,
1605+	.attributes		= mbim_function_attributes,
1606+};
1607+
1608+#ifdef CONFIG_SND_PCM
1609+/* PERIPHERAL AUDIO */
1610+static int audio_function_bind_config(struct android_usb_function *f,
1611+					  struct usb_configuration *c)
1612+{
1613+	return audio_bind_config(c);
1614+}
1615+
1616+static struct android_usb_function audio_function = {
1617+	.name		= "audio",
1618+	.bind_config	= audio_function_bind_config,
1619+};
1620+#endif
1621+
1622+
1623+/* DIAG */
1624+static char diag_clients[32];	    /*enabled DIAG clients- "diag[,diag_mdm]" */
1625+static ssize_t clients_store(
1626+		struct device *device, struct device_attribute *attr,
1627+		const char *buff, size_t size)
1628+{
1629+	strlcpy(diag_clients, buff, sizeof(diag_clients));
1630+
1631+	return size;
1632+}
1633+
1634+static DEVICE_ATTR(clients, S_IWUSR, NULL, clients_store);
1635+static struct device_attribute *diag_function_attributes[] =
1636+					 { &dev_attr_clients, NULL };
1637+
1638+static int diag_function_init(struct android_usb_function *f,
1639+				 struct usb_composite_dev *cdev)
1640+{
1641+	return diag_setup();
1642+}
1643+
1644+static void diag_function_cleanup(struct android_usb_function *f)
1645+{
1646+	diag_cleanup();
1647+}
1648+
1649+static int diag_function_bind_config(struct android_usb_function *f,
1650+					struct usb_configuration *c)
1651+{
1652+	char *name;
1653+	char buf[32], *b;
1654+	int once = 0, err = -1;
1655+	int (*notify)(uint32_t, const char *);
1656+	struct android_dev *dev = cdev_to_android_dev(c->cdev);
1657+
1658+	strlcpy(buf, diag_clients, sizeof(buf));
1659+	b = strim(buf);
1660+
1661+	while (b) {
1662+		notify = NULL;
1663+		name = strsep(&b, ",");
1664+		/* Allow only first diag channel to update pid and serial no */
1665+		if (!once++) {
1666+			if (dev->pdata && dev->pdata->update_pid_and_serial_num)
1667+				notify = dev->pdata->update_pid_and_serial_num;
1668+			else
1669+				notify = usb_diag_update_pid_and_serial_num;
1670+		}
1671+
1672+		if (name) {
1673+			err = diag_function_add(c, name, notify);
1674+			if (err)
1675+				pr_err("diag: Cannot open channel '%s'", name);
1676+		}
1677+	}
1678+
1679+	return err;
1680+}
1681+
1682+static struct android_usb_function diag_function = {
1683+	.name		= "diag",
1684+	.init		= diag_function_init,
1685+	.cleanup	= diag_function_cleanup,
1686+	.bind_config	= diag_function_bind_config,
1687+	.attributes	= diag_function_attributes,
1688+};
1689+
1690+/* DEBUG */
1691+static int qdss_function_init(struct android_usb_function *f,
1692+	struct usb_composite_dev *cdev)
1693+{
1694+	return qdss_setup();
1695+}
1696+
1697+static void qdss_function_cleanup(struct android_usb_function *f)
1698+{
1699+	qdss_cleanup();
1700+}
1701+
1702+static int qdss_init_transports(int *portnum)
1703+{
1704+	char *ts_port;
1705+	char *tname = NULL;
1706+	char *ctrl_name = NULL;
1707+	char buf[MAX_XPORT_STR_LEN], *type;
1708+	char xport_name_buf[MAX_XPORT_STR_LEN], *tn;
1709+	int err = 0;
1710+
1711+	strlcpy(buf, qdss_transports, sizeof(buf));
1712+	type = strim(buf);
1713+
1714+	strlcpy(xport_name_buf, qdss_xport_names,
1715+			sizeof(xport_name_buf));
1716+	tn = strim(xport_name_buf);
1717+
1718+	pr_debug("%s: qdss_debug_intf = %d\n",
1719+		__func__, qdss_debug_intf);
1720+
1721+	/*
1722+	 * QDSS function driver is being used for QDSS and DPL
1723+	 * functionality. ctrl_name (i.e. ctrl xport) is optional
1724+	 * whereas data transport name is mandatory to provide
1725+	 * while using QDSS/DPL as part of USB composition.
1726+	 */
1727+	while (type) {
1728+		ctrl_name = strsep(&type, ",");
1729+		ts_port = strsep(&type, ",");
1730+		if (!ts_port) {
1731+			pr_debug("%s:ctrl transport is not provided.\n",
1732+								__func__);
1733+			ts_port = ctrl_name;
1734+			ctrl_name = NULL;
1735+		}
1736+
1737+		if (ts_port) {
1738+			if (tn)
1739+				tname = strsep(&tn, ",");
1740+
1741+			err = qdss_init_port(
1742+				ctrl_name,
1743+				ts_port,
1744+				tname,
1745+				qdss_debug_intf);
1746+
1747+			if (err) {
1748+				pr_err("%s: Cannot open transport port:'%s'\n",
1749+					__func__, ts_port);
1750+				return err;
1751+			}
1752+			(*portnum)++;
1753+		} else {
1754+			pr_err("%s: No data transport name for QDSS port.\n",
1755+								__func__);
1756+			err = -ENODEV;
1757+		}
1758+	}
1759+	return err;
1760+}
1761+
1762+static int qdss_function_bind_config(struct android_usb_function *f,
1763+					struct usb_configuration *c)
1764+{
1765+	int i;
1766+	int err = 0;
1767+	static int qdss_initialized = 0, portsnum;
1768+
1769+	if (!qdss_initialized) {
1770+		qdss_initialized = 1;
1771+
1772+		err = qdss_init_transports(&portsnum);
1773+		if (err) {
1774+			pr_err("qdss: Cannot init transports");
1775+			goto out;
1776+		}
1777+
1778+		err = qdss_gport_setup();
1779+		if (err) {
1780+			pr_err("qdss: Cannot setup transports");
1781+			goto out;
1782+		}
1783+	}
1784+
1785+	pr_debug("%s: port number is %d\n", __func__, portsnum);
1786+
1787+	for (i = 0; i < portsnum; i++) {
1788+		err = qdss_bind_config(c, i);
1789+		if (err) {
1790+			pr_err("Could not bind qdss%u config\n", i);
1791+			break;
1792+		}
1793+	}
1794+out:
1795+	return err;
1796+}
1797+
1798+static ssize_t qdss_transports_show(struct device *dev,
1799+		struct device_attribute *attr, char *buf)
1800+{
1801+	return snprintf(buf, PAGE_SIZE, "%s\n", qdss_transports);
1802+}
1803+
1804+static ssize_t qdss_transports_store(
1805+		struct device *device, struct device_attribute *attr,
1806+		const char *buff, size_t size)
1807+{
1808+	strlcpy(qdss_transports, buff, sizeof(qdss_transports));
1809+
1810+	return size;
1811+}
1812+
1813+static ssize_t qdss_xport_names_show(struct device *dev,
1814+		struct device_attribute *attr, char *buf)
1815+{
1816+	return snprintf(buf, PAGE_SIZE, "%s\n", qdss_xport_names);
1817+}
1818+
1819+static ssize_t qdss_xport_names_store(
1820+		struct device *device, struct device_attribute *attr,
1821+		const char *buff, size_t size)
1822+{
1823+	strlcpy(qdss_xport_names, buff, sizeof(qdss_xport_names));
1824+	return size;
1825+}
1826+
1827+static ssize_t qdss_debug_intf_store(
1828+		struct device *device, struct device_attribute *attr,
1829+		const char *buff, size_t size)
1830+{
1831+	strtobool(buff, &qdss_debug_intf);
1832+	return size;
1833+}
1834+
1835+static ssize_t qdss_debug_intf_show(struct device *dev,
1836+		struct device_attribute *attr, char *buf)
1837+{
1838+	return snprintf(buf, PAGE_SIZE, "%d\n", qdss_debug_intf);
1839+}
1840+
1841+static struct device_attribute dev_attr_qdss_transports =
1842+					__ATTR(transports, S_IRUGO | S_IWUSR,
1843+						qdss_transports_show,
1844+						qdss_transports_store);
1845+
1846+static struct device_attribute dev_attr_qdss_xport_names =
1847+				__ATTR(transport_names, S_IRUGO | S_IWUSR,
1848+				qdss_xport_names_show,
1849+				qdss_xport_names_store);
1850+
1851+/* 1(enable)/0(disable) the qdss debug interface */
1852+static struct device_attribute dev_attr_qdss_debug_intf =
1853+				__ATTR(debug_intf, S_IRUGO | S_IWUSR,
1854+				qdss_debug_intf_show,
1855+				qdss_debug_intf_store);
1856+
1857+static struct device_attribute *qdss_function_attributes[] = {
1858+					&dev_attr_qdss_transports,
1859+					&dev_attr_qdss_xport_names,
1860+					&dev_attr_qdss_debug_intf,
1861+					NULL };
1862+
1863+static struct android_usb_function qdss_function = {
1864+	.name		= "qdss",
1865+	.init		= qdss_function_init,
1866+	.cleanup	= qdss_function_cleanup,
1867+	.bind_config	= qdss_function_bind_config,
1868+	.attributes	= qdss_function_attributes,
1869+};
1870+
1871+/* SERIAL */
1872+#define MAX_SERIAL_INSTANCES 4
1873+struct serial_function_config {
1874+	int instances_on;
1875+	struct usb_function *f_serial[MAX_SERIAL_INSTANCES];
1876+	struct usb_function_instance *f_serial_inst[MAX_SERIAL_INSTANCES];
1877+};
1878+
1879+static char serial_transports[32];	/*enabled FSERIAL ports - "tty[,sdio]"*/
1880+static ssize_t serial_transports_store(
1881+		struct device *device, struct device_attribute *attr,
1882+		const char *buff, size_t size)
1883+{
1884+	strlcpy(serial_transports, buff, sizeof(serial_transports));
1885+
1886+	return size;
1887+}
1888+
1889+/*enabled FSERIAL transport names - "serial_hsic[,serial_hsusb]"*/
1890+static char serial_xport_names[32];
1891+static ssize_t serial_xport_names_store(
1892+		struct device *device, struct device_attribute *attr,
1893+		const char *buff, size_t size)
1894+{
1895+	strlcpy(serial_xport_names, buff, sizeof(serial_xport_names));
1896+
1897+	return size;
1898+}
1899+
1900+static ssize_t serial_xport_names_show(struct device *dev,
1901+		struct device_attribute *attr, char *buf)
1902+{
1903+	return snprintf(buf, PAGE_SIZE, "%s\n", serial_xport_names);
1904+}
1905+static ssize_t serial_modem_is_connected_show(
1906+		struct device *device, struct device_attribute *attr,
1907+		char *buff)
1908+{
1909+	unsigned int is_connected = gserial_is_connected();
1910+
1911+	return snprintf(buff, PAGE_SIZE, "%u\n", is_connected);
1912+}
1913+
1914+static ssize_t dun_w_softap_enable_show(
1915+		struct device *device, struct device_attribute *attr,
1916+		char *buff)
1917+{
1918+	unsigned int dun_w_softap_enable = gserial_is_dun_w_softap_enabled();
1919+
1920+	return snprintf(buff, PAGE_SIZE, "%u\n", dun_w_softap_enable);
1921+}
1922+
1923+static ssize_t dun_w_softap_enable_store(
1924+		struct device *device, struct device_attribute *attr,
1925+		const char *buff, size_t size)
1926+{
1927+	unsigned int dun_w_softap_enable;
1928+
1929+	sscanf(buff, "%u", &dun_w_softap_enable);
1930+
1931+	gserial_dun_w_softap_enable(dun_w_softap_enable);
1932+
1933+	return size;
1934+}
1935+
1936+static ssize_t dun_w_softap_active_show(
1937+		struct device *device, struct device_attribute *attr,
1938+		char *buff)
1939+{
1940+	unsigned int dun_w_softap_active = gserial_is_dun_w_softap_active();
1941+
1942+	return snprintf(buff, PAGE_SIZE, "%u\n", dun_w_softap_active);
1943+}
1944+
1945+static DEVICE_ATTR(is_connected_flag, S_IRUGO, serial_modem_is_connected_show,
1946+		NULL);
1947+static DEVICE_ATTR(dun_w_softap_enable, S_IRUGO | S_IWUSR,
1948+	dun_w_softap_enable_show, dun_w_softap_enable_store);
1949+static DEVICE_ATTR(dun_w_softap_active, S_IRUGO, dun_w_softap_active_show,
1950+		NULL);
1951+
1952+
1953+static DEVICE_ATTR(transports, S_IWUSR, NULL, serial_transports_store);
1954+static struct device_attribute dev_attr_serial_xport_names =
1955+				__ATTR(transport_names, S_IRUGO | S_IWUSR,
1956+				serial_xport_names_show,
1957+				serial_xport_names_store);
1958+
1959+static struct device_attribute *serial_function_attributes[] = {
1960+					&dev_attr_transports,
1961+					&dev_attr_serial_xport_names,
1962+					&dev_attr_is_connected_flag,
1963+					&dev_attr_dun_w_softap_enable,
1964+					&dev_attr_dun_w_softap_active,
1965+					NULL };
1966+
1967+static int serial_function_init(struct android_usb_function *f,
1968+					struct usb_composite_dev *cdev)
1969+{
1970+	struct serial_function_config *config;
1971+
1972+	config = kzalloc(sizeof(struct serial_function_config), GFP_KERNEL);
1973+	if (!config)
1974+		return -ENOMEM;
1975+
1976+	f->config = config;
1977+
1978+	return 0;
1979+}
1980+
1981+static void serial_function_cleanup(struct android_usb_function *f)
1982+{
1983+	int i;
1984+	struct serial_function_config *config = f->config;
1985+
1986+	gport_cleanup();
1987+	for (i = 0; i < config->instances_on; i++) {
1988+		usb_put_function(config->f_serial[i]);
1989+		usb_put_function_instance(config->f_serial_inst[i]);
1990+	}
1991+	kfree(f->config);
1992+	f->config = NULL;
1993+}
1994+
1995+static int serial_function_bind_config(struct android_usb_function *f,
1996+					struct usb_configuration *c)
1997+{
1998+	char *name, *xport_name = NULL;
1999+	char buf[32], *b, xport_name_buf[32], *tb;
2000+	int err = -1, i;
2001+	static int serial_initialized = 0, ports = 0;
2002+	struct serial_function_config *config = f->config;
2003+
2004+	if (serial_initialized)
2005+		goto bind_config;
2006+
2007+	serial_initialized = 1;
2008+	strlcpy(buf, serial_transports, sizeof(buf));
2009+	b = strim(buf);
2010+
2011+	strlcpy(xport_name_buf, serial_xport_names, sizeof(xport_name_buf));
2012+	tb = strim(xport_name_buf);
2013+
2014+	while (b) {
2015+		name = strsep(&b, ",");
2016+
2017+		if (name) {
2018+			if (tb)
2019+				xport_name = strsep(&tb, ",");
2020+			err = gserial_init_port(ports, name, xport_name);
2021+			if (err) {
2022+				pr_err("serial: Cannot open port '%s'", name);
2023+				goto out;
2024+			}
2025+			ports++;
2026+			if (ports >= MAX_SERIAL_INSTANCES) {
2027+				pr_err("serial: max ports reached '%s'", name);
2028+				goto out;
2029+			}
2030+		}
2031+	}
2032+	err = gport_setup(c);
2033+	if (err) {
2034+		pr_err("serial: Cannot setup transports");
2035+		goto out;
2036+	}
2037+
2038+	for (i = 0; i < ports; i++) {
2039+		config->f_serial_inst[i] = usb_get_function_instance("gser");
2040+		if (IS_ERR(config->f_serial_inst[i])) {
2041+			err = PTR_ERR(config->f_serial_inst[i]);
2042+			goto err_gser_usb_get_function_instance;
2043+		}
2044+		config->f_serial[i] = usb_get_function(config->f_serial_inst[i]);
2045+		if (IS_ERR(config->f_serial[i])) {
2046+			err = PTR_ERR(config->f_serial[i]);
2047+			goto err_gser_usb_get_function;
2048+		}
2049+	}
2050+	config->instances_on = ports;
2051+
2052+bind_config:
2053+	for (i = 0; i < ports; i++) {
2054+		err = usb_add_function(c, config->f_serial[i]);
2055+		if (err) {
2056+			pr_err("Could not bind gser%u config\n", i);
2057+			goto err_gser_usb_add_function;
2058+		}
2059+	}
2060+	return 0;
2061+
2062+err_gser_usb_add_function:
2063+	while (i-- > 0)
2064+		usb_remove_function(c, config->f_serial[i]);
2065+
2066+	return err;
2067+
2068+err_gser_usb_get_function_instance:
2069+	while (i-- > 0) {
2070+		usb_put_function(config->f_serial[i]);
2071+err_gser_usb_get_function:
2072+		usb_put_function_instance(config->f_serial_inst[i]);
2073+	}
2074+
2075+out:
2076+	return err;
2077+}
2078+
2079+static struct android_usb_function serial_function = {
2080+	.name		= "serial",
2081+	.init		= serial_function_init,
2082+	.cleanup	= serial_function_cleanup,
2083+	.bind_config	= serial_function_bind_config,
2084+	.attributes	= serial_function_attributes,
2085+};
2086+
2087+/* CCID */
2088+static int ccid_function_init(struct android_usb_function *f,
2089+					struct usb_composite_dev *cdev)
2090+{
2091+	return ccid_setup();
2092+}
2093+
2094+static void ccid_function_cleanup(struct android_usb_function *f)
2095+{
2096+	ccid_cleanup();
2097+}
2098+
2099+static int ccid_function_bind_config(struct android_usb_function *f,
2100+						struct usb_configuration *c)
2101+{
2102+	return ccid_bind_config(c);
2103+}
2104+
2105+static struct android_usb_function ccid_function = {
2106+	.name		= "ccid",
2107+	.init		= ccid_function_init,
2108+	.cleanup	= ccid_function_cleanup,
2109+	.bind_config	= ccid_function_bind_config,
2110+};
2111+
2112+/* Charger */
2113+static int charger_function_bind_config(struct android_usb_function *f,
2114+						struct usb_configuration *c)
2115+{
2116+	return charger_bind_config(c);
2117+}
2118+
2119+static struct android_usb_function charger_function = {
2120+	.name		= "charging",
2121+	.bind_config	= charger_function_bind_config,
2122+};
2123+
2124+
2125+static int
2126+mtp_function_init(struct android_usb_function *f,
2127+		struct usb_composite_dev *cdev)
2128+{
2129+	return mtp_setup();
2130+}
2131+
2132+static void mtp_function_cleanup(struct android_usb_function *f)
2133+{
2134+	mtp_cleanup();
2135+}
2136+
2137+static int
2138+mtp_function_bind_config(struct android_usb_function *f,
2139+		struct usb_configuration *c)
2140+{
2141+	return mtp_bind_config(c, false);
2142+}
2143+
2144+static int
2145+ptp_function_init(struct android_usb_function *f,
2146+		struct usb_composite_dev *cdev)
2147+{
2148+	/* nothing to do - initialization is handled by mtp_function_init */
2149 	return 0;
2150 }
2151 
2152@@ -683,6 +1939,14 @@ static int mtp_function_ctrlrequest(struct android_usb_function *f,
2153 	return mtp_ctrlrequest(cdev, c);
2154 }
2155 
2156+static int ptp_function_ctrlrequest(struct android_usb_function *f,
2157+					struct usb_composite_dev *cdev,
2158+					const struct usb_ctrlrequest *c)
2159+{
2160+	return mtp_ctrlrequest(cdev, c);
2161+}
2162+
2163+
2164 static struct android_usb_function mtp_function = {
2165 	.name		= "mtp",
2166 	.init		= mtp_function_init,
2167@@ -697,12 +1961,17 @@ static struct android_usb_function ptp_function = {
2168 	.init		= ptp_function_init,
2169 	.cleanup	= ptp_function_cleanup,
2170 	.bind_config	= ptp_function_bind_config,
2171+	.ctrlrequest	= ptp_function_ctrlrequest,
2172 };
2173 
2174+/* rndis transport string */
2175+static char rndis_transports[MAX_XPORT_STR_LEN];
2176 
2177 struct rndis_function_config {
2178 	u8      ethaddr[ETH_ALEN];
2179 	u32     vendorID;
2180+	u8      max_pkt_per_xfer;
2181+	u8	pkt_alignment_factor;
2182 	char	manufacturer[256];
2183 	/* "Wireless" RNDIS; auto-detected by Windows */
2184 	bool	wceis;
2185@@ -725,6 +1994,27 @@ static void rndis_function_cleanup(struct android_usb_function *f)
2186 	f->config = NULL;
2187 }
2188 
2189+static int rndis_qc_function_init(struct android_usb_function *f,
2190+					struct usb_composite_dev *cdev)
2191+{
2192+	struct rndis_function_config *rndis;
2193+
2194+	rndis = kzalloc(sizeof(struct rndis_function_config), GFP_KERNEL);
2195+	if (!rndis)
2196+		return -ENOMEM;
2197+
2198+	rndis->wceis = true;
2199+
2200+	f->config = rndis;
2201+	return rndis_qc_init();
2202+}
2203+
2204+static void rndis_qc_function_cleanup(struct android_usb_function *f)
2205+{
2206+	rndis_qc_cleanup();
2207+	kfree(f->config);
2208+}
2209+
2210 static int
2211 rndis_function_bind_config(struct android_usb_function *f,
2212 		struct usb_configuration *c)
2213@@ -742,7 +2032,11 @@ rndis_function_bind_config(struct android_usb_function *f,
2214 		rndis->ethaddr[0], rndis->ethaddr[1], rndis->ethaddr[2],
2215 		rndis->ethaddr[3], rndis->ethaddr[4], rndis->ethaddr[5]);
2216 
2217-	dev = gether_setup_name(c->cdev->gadget, rndis->ethaddr, "rndis");
2218+	if (rndis->ethaddr[0])
2219+		dev = gether_setup_name(c->cdev->gadget, NULL, "rndis");
2220+	else
2221+		dev = gether_setup_name(c->cdev->gadget, rndis->ethaddr,
2222+								"rndis");
2223 	if (IS_ERR(dev)) {
2224 		ret = PTR_ERR(dev);
2225 		pr_err("%s: gether_setup failed\n", __func__);
2226@@ -766,6 +2060,51 @@ rndis_function_bind_config(struct android_usb_function *f,
2227 					   rndis->manufacturer, rndis->dev);
2228 }
2229 
2230+static int rndis_qc_function_bind_config(struct android_usb_function *f,
2231+					struct usb_configuration *c)
2232+{
2233+	int ret;
2234+	char *trans;
2235+	struct rndis_function_config *rndis = f->config;
2236+
2237+	if (!rndis) {
2238+		pr_err("%s: rndis_pdata\n", __func__);
2239+		return -EINVAL;
2240+	}
2241+
2242+	pr_info("%s MAC: %02X:%02X:%02X:%02X:%02X:%02X\n", __func__,
2243+		rndis->ethaddr[0], rndis->ethaddr[1], rndis->ethaddr[2],
2244+		rndis->ethaddr[3], rndis->ethaddr[4], rndis->ethaddr[5]);
2245+
2246+	pr_debug("%s: rndis_transport is %s", __func__, rndis_transports);
2247+
2248+	trans = strim(rndis_transports);
2249+	if (strcmp("BAM2BAM_IPA", trans)) {
2250+		ret = gether_qc_setup_name(c->cdev->gadget,
2251+					rndis->ethaddr, "rndis");
2252+		if (ret) {
2253+			pr_err("%s: gether_setup failed\n", __func__);
2254+			return ret;
2255+		}
2256+	}
2257+
2258+	if (rndis->wceis) {
2259+		/* "Wireless" RNDIS; auto-detected by Windows */
2260+		rndis_qc_iad_descriptor.bFunctionClass =
2261+						USB_CLASS_WIRELESS_CONTROLLER;
2262+		rndis_qc_iad_descriptor.bFunctionSubClass = 0x01;
2263+		rndis_qc_iad_descriptor.bFunctionProtocol = 0x03;
2264+		rndis_qc_control_intf.bInterfaceClass =
2265+						USB_CLASS_WIRELESS_CONTROLLER;
2266+		rndis_qc_control_intf.bInterfaceSubClass =	 0x01;
2267+		rndis_qc_control_intf.bInterfaceProtocol =	 0x03;
2268+	}
2269+
2270+	return rndis_qc_bind_config_vendor(c, rndis->ethaddr, rndis->vendorID,
2271+			rndis->manufacturer, rndis->max_pkt_per_xfer,
2272+			rndis->pkt_alignment_factor, trans);
2273+}
2274+
2275 static void rndis_function_unbind_config(struct android_usb_function *f,
2276 						struct usb_configuration *c)
2277 {
2278@@ -773,12 +2112,24 @@ static void rndis_function_unbind_config(struct android_usb_function *f,
2279 	gether_cleanup(rndis->dev);
2280 }
2281 
2282+static void rndis_qc_function_unbind_config(struct android_usb_function *f,
2283+						struct usb_configuration *c)
2284+{
2285+	char *trans = strim(rndis_transports);
2286+
2287+	if (strcmp("BAM2BAM_IPA", trans)) {
2288+		bam_data_flush_workqueue();
2289+		gether_qc_cleanup_name("rndis0");
2290+	}
2291+}
2292+
2293 static ssize_t rndis_manufacturer_show(struct device *dev,
2294 		struct device_attribute *attr, char *buf)
2295 {
2296 	struct android_usb_function *f = dev_get_drvdata(dev);
2297 	struct rndis_function_config *config = f->config;
2298-	return sprintf(buf, "%s\n", config->manufacturer);
2299+
2300+	return snprintf(buf, PAGE_SIZE, "%s\n", config->manufacturer);
2301 }
2302 
2303 static ssize_t rndis_manufacturer_store(struct device *dev,
2304@@ -789,7 +2140,8 @@ static ssize_t rndis_manufacturer_store(struct device *dev,
2305 
2306 	if (size >= sizeof(config->manufacturer))
2307 		return -EINVAL;
2308-	if (sscanf(buf, "%s", config->manufacturer) == 1)
2309+
2310+	if (sscanf(buf, "%255s", config->manufacturer) == 1)
2311 		return size;
2312 	return -1;
2313 }
2314@@ -802,7 +2154,8 @@ static ssize_t rndis_wceis_show(struct device *dev,
2315 {
2316 	struct android_usb_function *f = dev_get_drvdata(dev);
2317 	struct rndis_function_config *config = f->config;
2318-	return sprintf(buf, "%d\n", config->wceis);
2319+
2320+	return snprintf(buf, PAGE_SIZE, "%d\n", config->wceis);
2321 }
2322 
2323 static ssize_t rndis_wceis_store(struct device *dev,
2324@@ -827,7 +2180,8 @@ static ssize_t rndis_ethaddr_show(struct device *dev,
2325 {
2326 	struct android_usb_function *f = dev_get_drvdata(dev);
2327 	struct rndis_function_config *rndis = f->config;
2328-	return sprintf(buf, "%02x:%02x:%02x:%02x:%02x:%02x\n",
2329+
2330+	return snprintf(buf, PAGE_SIZE, "%02x:%02x:%02x:%02x:%02x:%02x\n",
2331 		rndis->ethaddr[0], rndis->ethaddr[1], rndis->ethaddr[2],
2332 		rndis->ethaddr[3], rndis->ethaddr[4], rndis->ethaddr[5]);
2333 }
2334@@ -843,263 +2197,249 @@ static ssize_t rndis_ethaddr_store(struct device *dev,
2335 		    (int *)&rndis->ethaddr[2], (int *)&rndis->ethaddr[3],
2336 		    (int *)&rndis->ethaddr[4], (int *)&rndis->ethaddr[5]) == 6)
2337 		return size;
2338-	return -EINVAL;
2339-}
2340-
2341-static DEVICE_ATTR(ethaddr, S_IRUGO | S_IWUSR, rndis_ethaddr_show,
2342-					       rndis_ethaddr_store);
2343-
2344-static ssize_t rndis_vendorID_show(struct device *dev,
2345-		struct device_attribute *attr, char *buf)
2346-{
2347-	struct android_usb_function *f = dev_get_drvdata(dev);
2348-	struct rndis_function_config *config = f->config;
2349-	return sprintf(buf, "%04x\n", config->vendorID);
2350-}
2351-
2352-static ssize_t rndis_vendorID_store(struct device *dev,
2353-		struct device_attribute *attr, const char *buf, size_t size)
2354-{
2355-	struct android_usb_function *f = dev_get_drvdata(dev);
2356-	struct rndis_function_config *config = f->config;
2357-	int value;
2358-
2359-	if (sscanf(buf, "%04x", &value) == 1) {
2360-		config->vendorID = value;
2361-		return size;
2362-	}
2363-	return -EINVAL;
2364-}
2365-
2366-static DEVICE_ATTR(vendorID, S_IRUGO | S_IWUSR, rndis_vendorID_show,
2367-						rndis_vendorID_store);
2368-
2369-static struct device_attribute *rndis_function_attributes[] = {
2370-	&dev_attr_manufacturer,
2371-	&dev_attr_wceis,
2372-	&dev_attr_ethaddr,
2373-	&dev_attr_vendorID,
2374-	NULL
2375-};
2376-
2377-static struct android_usb_function rndis_function = {
2378-	.name		= "rndis",
2379-	.init		= rndis_function_init,
2380-	.cleanup	= rndis_function_cleanup,
2381-	.bind_config	= rndis_function_bind_config,
2382-	.unbind_config	= rndis_function_unbind_config,
2383-	.attributes	= rndis_function_attributes,
2384-};
2385-
2386-struct ncm_function_config {
2387-	u8      ethaddr[ETH_ALEN];
2388-	u32     vendorID;
2389-	char	manufacturer[256];
2390-	u32	ntb_out_size;
2391-	struct  eth_dev *dev;
2392-};
2393-
2394-static int ncm_function_init(struct android_usb_function *f,
2395-	struct usb_composite_dev *cdev)
2396-{
2397-	f->config = kzalloc(sizeof(struct ncm_function_config), GFP_KERNEL);
2398-	if (!f->config)
2399-		return -ENOMEM;
2400-	return 0;
2401-}
2402-
2403-static void ncm_function_cleanup(struct android_usb_function *f)
2404-{
2405-	kfree(f->config);
2406-	f->config = NULL;
2407-}
2408-
2409-static int ncm_function_bind_config(struct android_usb_function *f,
2410-					struct usb_configuration *c)
2411-{
2412-	int ret = 0;
2413-	struct ncm_function_config *ncm = f->config;
2414-	struct eth_dev *dev = NULL;
2415-
2416-	if (!ncm) {
2417-		pr_err("%s: ncm_pdata\n", __func__);
2418-		return -1;
2419-	}
2420-
2421-	pr_info("%s MAC: %02X:%02X:%02X:%02X:%02X:%02X\n", __func__,
2422-		ncm->ethaddr[0], ncm->ethaddr[1], ncm->ethaddr[2],
2423-		ncm->ethaddr[3], ncm->ethaddr[4], ncm->ethaddr[5]);
2424-
2425-	dev = gether_setup_name(c->cdev->gadget, ncm->ethaddr, "ncm");
2426-
2427-	if (IS_ERR(dev)) {
2428-		ret = PTR_ERR(dev);
2429-		pr_err("%s: gether_setup failed\n", __func__);
2430-		return ret;
2431-	}
2432-	ncm->dev = dev;
2433-
2434-	return ncm_bind_config(c, ncm->ethaddr, dev);
2435+	return -EINVAL;
2436 }
2437 
2438-static void ncm_function_unbind_config(struct android_usb_function *f,
2439-						struct usb_configuration *c)
2440-{
2441-	struct ncm_function_config *ncm = f->config;
2442-	gether_cleanup(ncm->dev);
2443-}
2444+static DEVICE_ATTR(ethaddr, S_IRUGO | S_IWUSR, rndis_ethaddr_show,
2445+					       rndis_ethaddr_store);
2446 
2447-static ssize_t ncm_manufacturer_show(struct device *dev,
2448+static ssize_t rndis_vendorID_show(struct device *dev,
2449 		struct device_attribute *attr, char *buf)
2450 {
2451 	struct android_usb_function *f = dev_get_drvdata(dev);
2452-	struct ncm_function_config *config = f->config;
2453-	return snprintf(buf, PAGE_SIZE, "%s\n", config->manufacturer);
2454+	struct rndis_function_config *config = f->config;
2455+
2456+	return snprintf(buf, PAGE_SIZE, "%04x\n", config->vendorID);
2457 }
2458 
2459-static ssize_t ncm_manufacturer_store(struct device *dev,
2460+static ssize_t rndis_vendorID_store(struct device *dev,
2461 		struct device_attribute *attr, const char *buf, size_t size)
2462 {
2463 	struct android_usb_function *f = dev_get_drvdata(dev);
2464-	struct ncm_function_config *config = f->config;
2465+	struct rndis_function_config *config = f->config;
2466+	int value;
2467 
2468-	if (size >= sizeof(config->manufacturer))
2469-		return -EINVAL;
2470-	if (sscanf(buf, "%s", config->manufacturer) == 1)
2471+	if (sscanf(buf, "%04x", &value) == 1) {
2472+		config->vendorID = value;
2473 		return size;
2474-	return -1;
2475+	}
2476+	return -EINVAL;
2477 }
2478 
2479-static DEVICE_ATTR(manufacturer_ncm, S_IRUGO | S_IWUSR, ncm_manufacturer_show,
2480-						    ncm_manufacturer_store);
2481+static DEVICE_ATTR(vendorID, S_IRUGO | S_IWUSR, rndis_vendorID_show,
2482+						rndis_vendorID_store);
2483 
2484-static ssize_t ncm_ethaddr_show(struct device *dev,
2485+static ssize_t rndis_max_pkt_per_xfer_show(struct device *dev,
2486 		struct device_attribute *attr, char *buf)
2487 {
2488 	struct android_usb_function *f = dev_get_drvdata(dev);
2489-	struct ncm_function_config *ncm = f->config;
2490-	return snprintf(buf, PAGE_SIZE, "%02x:%02x:%02x:%02x:%02x:%02x\n",
2491-		ncm->ethaddr[0], ncm->ethaddr[1], ncm->ethaddr[2],
2492-		ncm->ethaddr[3], ncm->ethaddr[4], ncm->ethaddr[5]);
2493+	struct rndis_function_config *config = f->config;
2494+	return snprintf(buf, PAGE_SIZE, "%d\n", config->max_pkt_per_xfer);
2495 }
2496 
2497-static ssize_t ncm_ethaddr_store(struct device *dev,
2498+static ssize_t rndis_max_pkt_per_xfer_store(struct device *dev,
2499 		struct device_attribute *attr, const char *buf, size_t size)
2500 {
2501 	struct android_usb_function *f = dev_get_drvdata(dev);
2502-	struct ncm_function_config *ncm = f->config;
2503+	struct rndis_function_config *config = f->config;
2504+	int value;
2505 
2506-	if (sscanf(buf, "%02x:%02x:%02x:%02x:%02x:%02x\n",
2507-		    (int *)&ncm->ethaddr[0], (int *)&ncm->ethaddr[1],
2508-		    (int *)&ncm->ethaddr[2], (int *)&ncm->ethaddr[3],
2509-		    (int *)&ncm->ethaddr[4], (int *)&ncm->ethaddr[5]) == 6)
2510+	if (sscanf(buf, "%d", &value) == 1) {
2511+		config->max_pkt_per_xfer = value;
2512 		return size;
2513+	}
2514 	return -EINVAL;
2515 }
2516 
2517-static DEVICE_ATTR(ethaddr_ncm, S_IRUGO | S_IWUSR, ncm_ethaddr_show,
2518-					       ncm_ethaddr_store);
2519-
2520-static ssize_t ncm_vendorID_show(struct device *dev,
2521+static DEVICE_ATTR(max_pkt_per_xfer, S_IRUGO | S_IWUSR,
2522+				   rndis_max_pkt_per_xfer_show,
2523+				   rndis_max_pkt_per_xfer_store);
2524+static ssize_t rndis_transports_show(struct device *dev,
2525 		struct device_attribute *attr, char *buf)
2526 {
2527-	struct android_usb_function *f = dev_get_drvdata(dev);
2528-	struct ncm_function_config *config = f->config;
2529-	return snprintf(buf, PAGE_SIZE, "%04x\n", config->vendorID);
2530+	return snprintf(buf, PAGE_SIZE, "%s\n", rndis_transports);
2531 }
2532 
2533-static ssize_t ncm_vendorID_store(struct device *dev,
2534+static ssize_t rndis_transports_store(struct device *dev,
2535+		struct device_attribute *attr, const char *buf, size_t size)
2536+{
2537+	strlcpy(rndis_transports, buf, sizeof(rndis_transports));
2538+	return size;
2539+}
2540+
2541+static DEVICE_ATTR(rndis_transports, S_IRUGO | S_IWUSR, rndis_transports_show,
2542+					       rndis_transports_store);
2543+
2544+static ssize_t rndis_rx_trigger_store(struct device *dev,
2545 		struct device_attribute *attr, const char *buf, size_t size)
2546 {
2547-	struct android_usb_function *f = dev_get_drvdata(dev);
2548-	struct ncm_function_config *config = f->config;
2549 	int value;
2550 
2551-	if (sscanf(buf, "%04x", &value) == 1) {
2552-		config->vendorID = value;
2553+	if (sscanf(buf, "%d", &value) == 1) {
2554+		rndis_rx_trigger();
2555 		return size;
2556 	}
2557 	return -EINVAL;
2558 }
2559 
2560-static DEVICE_ATTR(vendorID_ncm, S_IRUGO | S_IWUSR, ncm_vendorID_show,
2561-						ncm_vendorID_store);
2562+static DEVICE_ATTR(rx_trigger, S_IWUSR, NULL,
2563+					     rndis_rx_trigger_store);
2564 
2565-static ssize_t ncm_ntb_out_size_show(struct device *dev,
2566+static ssize_t rndis_pkt_alignment_factor_show(struct device *dev,
2567 		struct device_attribute *attr, char *buf)
2568 {
2569 	struct android_usb_function *f = dev_get_drvdata(dev);
2570-	struct ncm_function_config *config = f->config;
2571-	return snprintf(buf, PAGE_SIZE, "%d\n", config->ntb_out_size);
2572+	struct rndis_function_config *config = f->config;
2573+
2574+	return snprintf(buf, PAGE_SIZE, "%d\n", config->pkt_alignment_factor);
2575 }
2576 
2577-static ssize_t ncm_ntb_out_size_store(struct device *dev,
2578+static ssize_t rndis_pkt_alignment_factor_store(struct device *dev,
2579 		struct device_attribute *attr, const char *buf, size_t size)
2580 {
2581 	struct android_usb_function *f = dev_get_drvdata(dev);
2582-	struct ncm_function_config *config = f->config;
2583+	struct rndis_function_config *config = f->config;
2584 	int value;
2585 
2586 	if (sscanf(buf, "%d", &value) == 1) {
2587-		config->ntb_out_size = value;
2588-		pr_info("ntb_out_size = %d bytes", config->ntb_out_size);
2589-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
2590-		ncm_ntb_out_size(config->ntb_out_size);
2591-#endif
2592+		config->pkt_alignment_factor = value;
2593 		return size;
2594 	}
2595+
2596 	return -EINVAL;
2597 }
2598 
2599-static DEVICE_ATTR(ntb_out_size_ncm, S_IRUGO | S_IWUSR, ncm_ntb_out_size_show,
2600-						ncm_ntb_out_size_store);
2601+static DEVICE_ATTR(pkt_alignment_factor, S_IRUGO | S_IWUSR,
2602+					rndis_pkt_alignment_factor_show,
2603+					rndis_pkt_alignment_factor_store);
2604 
2605-static struct device_attribute *ncm_function_attributes[] = {
2606-	&dev_attr_manufacturer_ncm,
2607-	&dev_attr_ethaddr_ncm,
2608-	&dev_attr_vendorID_ncm,
2609-	&dev_attr_ntb_out_size_ncm,
2610+static struct device_attribute *rndis_function_attributes[] = {
2611+	&dev_attr_manufacturer,
2612+	&dev_attr_wceis,
2613+	&dev_attr_ethaddr,
2614+	&dev_attr_vendorID,
2615+	&dev_attr_max_pkt_per_xfer,
2616+	&dev_attr_rndis_transports,
2617+	&dev_attr_rx_trigger,
2618+	&dev_attr_pkt_alignment_factor,
2619 	NULL
2620 };
2621 
2622-static struct android_usb_function ncm_function = {
2623-	.name		= "ncm",
2624-	.init		= ncm_function_init,
2625-	.cleanup	= ncm_function_cleanup,
2626-	.bind_config	= ncm_function_bind_config,
2627-	.unbind_config	= ncm_function_unbind_config,
2628-	.attributes	= ncm_function_attributes,
2629+static struct android_usb_function rndis_function = {
2630+	.name		= "rndis",
2631+	.init		= rndis_function_init,
2632+	.cleanup	= rndis_function_cleanup,
2633+	.bind_config	= rndis_function_bind_config,
2634+	.unbind_config	= rndis_function_unbind_config,
2635+	.attributes	= rndis_function_attributes,
2636+};
2637+
2638+static struct android_usb_function rndis_qc_function = {
2639+	.name		= "rndis_qc",
2640+	.init		= rndis_qc_function_init,
2641+	.cleanup	= rndis_qc_function_cleanup,
2642+	.bind_config	= rndis_qc_function_bind_config,
2643+	.unbind_config	= rndis_qc_function_unbind_config,
2644+	.attributes	= rndis_function_attributes,
2645+};
2646+
2647+static int ecm_function_bind_config(struct android_usb_function *f,
2648+					struct usb_configuration *c)
2649+{
2650+	int ret;
2651+	struct eth_dev *dev;
2652+	struct ecm_function_config *ecm = f->config;
2653+
2654+	if (!ecm) {
2655+		pr_err("%s: ecm_pdata\n", __func__);
2656+		return -EINVAL;
2657+	}
2658+
2659+	pr_info("%s MAC: %02X:%02X:%02X:%02X:%02X:%02X\n", __func__,
2660+		ecm->ethaddr[0], ecm->ethaddr[1], ecm->ethaddr[2],
2661+		ecm->ethaddr[3], ecm->ethaddr[4], ecm->ethaddr[5]);
2662+
2663+	dev = gether_setup_name(c->cdev->gadget, ecm->ethaddr, "ecm");
2664+	if (IS_ERR(dev)) {
2665+		ret = PTR_ERR(dev);
2666+		pr_err("%s: gether_setup failed\n", __func__);
2667+		return ret;
2668+	}
2669+	ecm->dev = dev;
2670+
2671+	ret = ecm_bind_config(c, ecm->ethaddr, dev);
2672+	if (ret) {
2673+		pr_err("%s: ecm_bind_config failed\n", __func__);
2674+		gether_cleanup(dev);
2675+	}
2676+	return ret;
2677+}
2678+
2679+static void ecm_function_unbind_config(struct android_usb_function *f,
2680+						struct usb_configuration *c)
2681+{
2682+	struct ecm_function_config *ecm = f->config;
2683+	gether_cleanup(ecm->dev);
2684+}
2685+
2686+static struct android_usb_function ecm_function = {
2687+	.name		= "ecm",
2688+	.init		= ecm_function_init,
2689+	.cleanup	= ecm_function_cleanup,
2690+	.bind_config	= ecm_function_bind_config,
2691+	.unbind_config	= ecm_function_unbind_config,
2692+	.attributes	= ecm_function_attributes,
2693 };
2694 
2695+#define MAX_LUN_STR_LEN 25
2696+static char lun_info[MAX_LUN_STR_LEN] = {'\0'};
2697 struct mass_storage_function_config {
2698 	struct fsg_config fsg;
2699 	struct fsg_common *common;
2700 };
2701 
2702+#define MAX_LUN_NAME 8
2703 static int mass_storage_function_init(struct android_usb_function *f,
2704 					struct usb_composite_dev *cdev)
2705 {
2706+	struct android_dev *dev = cdev_to_android_dev(cdev);
2707 	struct mass_storage_function_config *config;
2708 	struct fsg_common *common;
2709 	int err;
2710-
2711-#ifdef CONFIG_USB_MULTI_DISK_SUPPORT
2712-	int i, clear;
2713-#endif
2714+	int i, n;
2715+	char name[FSG_MAX_LUNS][MAX_LUN_NAME];
2716+	u8 uicc_nluns = dev->pdata ? dev->pdata->uicc_nluns : 0;
2717 
2718 	config = kzalloc(sizeof(struct mass_storage_function_config),
2719-								GFP_KERNEL);
2720-	if (!config)
2721+							GFP_KERNEL);
2722+	if (!config) {
2723+		pr_err("Memory allocation failed.\n");
2724 		return -ENOMEM;
2725+	}
2726 
2727-#ifdef CONFIG_USB_MULTI_DISK_SUPPORT
2728-	config->fsg.nluns = CONFIG_USB_MASS_STORAGE_LUN_NUM;
2729-	for (i = 0; i < config->fsg.nluns; i++)
2730-		config->fsg.luns[i].removable = 1;
2731-#else
2732 	config->fsg.nluns = 1;
2733+	snprintf(name[0], MAX_LUN_NAME, "lun");
2734 	config->fsg.luns[0].removable = 1;
2735-#endif
2736+
2737+	if (dev->pdata && dev->pdata->cdrom) {
2738+		config->fsg.luns[config->fsg.nluns].cdrom = 1;
2739+		config->fsg.luns[config->fsg.nluns].ro = 1;
2740+		config->fsg.luns[config->fsg.nluns].removable = 0;
2741+		snprintf(name[config->fsg.nluns], MAX_LUN_NAME, "rom");
2742+		config->fsg.nluns++;
2743+	}
2744+
2745+	if (uicc_nluns > FSG_MAX_LUNS - config->fsg.nluns) {
2746+		uicc_nluns = FSG_MAX_LUNS - config->fsg.nluns;
2747+		pr_debug("limiting uicc luns to %d\n", uicc_nluns);
2748+	}
2749+
2750+	for (i = 0; i < uicc_nluns; i++) {
2751+		n = config->fsg.nluns;
2752+		snprintf(name[n], MAX_LUN_NAME, "uicc%d", i);
2753+		config->fsg.luns[n].removable = 1;
2754+		config->fsg.nluns++;
2755+	}
2756 
2757 	common = fsg_common_init(NULL, cdev, &config->fsg);
2758 	if (IS_ERR(common)) {
2759@@ -1107,42 +2447,63 @@ static int mass_storage_function_init(struct android_usb_function *f,
2760 		return PTR_ERR(common);
2761 	}
2762 
2763-#ifdef CONFIG_USB_MULTI_DISK_SUPPORT
2764 	for (i = 0; i < config->fsg.nluns; i++) {
2765-		char lun_name[8];
2766-		sprintf(lun_name, "lun%d", i);
2767 		err = sysfs_create_link(&f->dev->kobj,
2768-				&common->luns[i].dev.kobj,
2769-				lun_name);
2770-		if (err) {
2771-			pr_err("create lun %d failed!\n", i);
2772-			break;
2773-		}
2774+					&common->luns[i].dev.kobj,
2775+					name[i]);
2776+		if (err)
2777+			goto error;
2778 	}
2779 
2780-	if (err) {
2781-		for (clear = i-1; clear >= 0; clear--) {
2782-			char lun_name[8];
2783-			sprintf(lun_name, "lun%d", clear);
2784-			sysfs_remove_link(&f->dev->kobj, lun_name);
2785-		}
2786-		kfree(config);
2787-		return err;
2788+	config->common = common;
2789+	f->config = config;
2790+	return 0;
2791+error:
2792+	for (; i > 0; i--)
2793+		sysfs_remove_link(&f->dev->kobj, name[i-1]);
2794+
2795+	fsg_common_release(&common->ref);
2796+	kfree(config);
2797+	return err;
2798+}
2799+
2800+static int mass_storage_lun_init(struct android_usb_function *f,
2801+						char *lun_info)
2802+{
2803+	struct mass_storage_function_config *config = f->config;
2804+	bool inc_lun = true;
2805+	int i = config->fsg.nluns, index, length;
2806+	static int number_of_luns;
2807+
2808+	length = strlen(lun_info);
2809+	if (!length) {
2810+		pr_err("LUN_INFO is null.\n");
2811+		return -EINVAL;
2812 	}
2813-#else
2814 
2815-	err = sysfs_create_link(&f->dev->kobj,
2816-				&common->luns[0].dev.kobj,
2817-				"lun");
2818-	if (err) {
2819-		kfree(config);
2820-		return err;
2821+	index = i + number_of_luns;
2822+	if (index >= FSG_MAX_LUNS) {
2823+		pr_err("Number of LUNs exceed the limit.\n");
2824+		return -EINVAL;
2825 	}
2826-#endif
2827 
2828-	config->common = common;
2829-	f->config = config;
2830-	return 0;
2831+	if (!strcmp(lun_info, "disk")) {
2832+		config->fsg.luns[index].removable = 1;
2833+	} else if (!strcmp(lun_info, "rom")) {
2834+		config->fsg.luns[index].cdrom = 1;
2835+		config->fsg.luns[index].removable = 0;
2836+		config->fsg.luns[index].ro = 1;
2837+	} else {
2838+		pr_err("Invalid LUN info.\n");
2839+		inc_lun = false;
2840+		return -EINVAL;
2841+	}
2842+
2843+	if (inc_lun)
2844+		number_of_luns++;
2845+
2846+	pr_debug("number_of_luns:%d\n", number_of_luns);
2847+	return number_of_luns;
2848 }
2849 
2850 static void mass_storage_function_cleanup(struct android_usb_function *f)
2851@@ -1151,11 +2512,72 @@ static void mass_storage_function_cleanup(struct android_usb_function *f)
2852 	f->config = NULL;
2853 }
2854 
2855+static void mass_storage_function_enable(struct android_usb_function *f)
2856+{
2857+	struct usb_composite_dev *cdev = f->android_dev->cdev;
2858+	struct mass_storage_function_config *config = f->config;
2859+	struct fsg_common *common = config->common;
2860+	char *lun_type;
2861+	int i, err, prev_nluns;
2862+	char buf[MAX_LUN_STR_LEN], *b;
2863+	int number_of_luns = 0;
2864+	char buf1[5];
2865+	char *lun_name = buf1;
2866+	static int msc_initialized;
2867+
2868+	if (msc_initialized)
2869+		return;
2870+
2871+	prev_nluns = config->fsg.nluns;
2872+
2873+	if (lun_info[0] != '\0') {
2874+		strlcpy(buf, lun_info, sizeof(buf));
2875+		b = strim(buf);
2876+
2877+		while (b) {
2878+			lun_type = strsep(&b, ",");
2879+			if (lun_type)
2880+				number_of_luns =
2881+					mass_storage_lun_init(f, lun_type);
2882+				if (number_of_luns <= 0)
2883+					return;
2884+		}
2885+	} else {
2886+		pr_debug("No extra msc lun required.\n");
2887+		return;
2888+	}
2889+
2890+	err = fsg_add_lun(common, cdev, &config->fsg, number_of_luns);
2891+	if (err) {
2892+		pr_err("Failed adding LUN.\n");
2893+		return;
2894+	}
2895+
2896+	pr_debug("fsg.nluns:%d\n", config->fsg.nluns);
2897+	for (i = prev_nluns; i < config->fsg.nluns; i++) {
2898+		snprintf(lun_name, sizeof(buf), "lun%d", (i-prev_nluns));
2899+		pr_debug("sysfs: LUN name:%s\n", lun_name);
2900+		err = sysfs_create_link(&f->dev->kobj,
2901+			&common->luns[i].dev.kobj, lun_name);
2902+		if (err)
2903+			pr_err("sysfs file creation failed: lun%d err:%d\n",
2904+							(i-prev_nluns), err);
2905+	}
2906+
2907+	msc_initialized = 1;
2908+}
2909+
2910 static int mass_storage_function_bind_config(struct android_usb_function *f,
2911 						struct usb_configuration *c)
2912 {
2913 	struct mass_storage_function_config *config = f->config;
2914-	return fsg_bind_config(c->cdev, c, config->common);
2915+	int ret;
2916+
2917+	ret = fsg_bind_config(c->cdev, c, config->common);
2918+	if (ret)
2919+		pr_err("fsg_bind_config failed. ret:%x\n", ret);
2920+
2921+	return ret;
2922 }
2923 
2924 static ssize_t mass_storage_inquiry_show(struct device *dev,
2925@@ -1163,7 +2585,7 @@ static ssize_t mass_storage_inquiry_show(struct device *dev,
2926 {
2927 	struct android_usb_function *f = dev_get_drvdata(dev);
2928 	struct mass_storage_function_config *config = f->config;
2929-	return sprintf(buf, "%s\n", config->common->inquiry_string);
2930+	return snprintf(buf, PAGE_SIZE, "%s\n", config->common->inquiry_string);
2931 }
2932 
2933 static ssize_t mass_storage_inquiry_store(struct device *dev,
2934@@ -1173,7 +2595,7 @@ static ssize_t mass_storage_inquiry_store(struct device *dev,
2935 	struct mass_storage_function_config *config = f->config;
2936 	if (size >= sizeof(config->common->inquiry_string))
2937 		return -EINVAL;
2938-	if (sscanf(buf, "%s", config->common->inquiry_string) != 1)
2939+	if (sscanf(buf, "%28s", config->common->inquiry_string) != 1)
2940 		return -EINVAL;
2941 	return size;
2942 }
2943@@ -1182,8 +2604,27 @@ static DEVICE_ATTR(inquiry_string, S_IRUGO | S_IWUSR,
2944 					mass_storage_inquiry_show,
2945 					mass_storage_inquiry_store);
2946 
2947+static ssize_t mass_storage_lun_info_show(struct device *dev,
2948+				struct device_attribute *attr, char *buf)
2949+{
2950+
2951+	return snprintf(buf, PAGE_SIZE, "%s\n", lun_info);
2952+}
2953+
2954+static ssize_t mass_storage_lun_info_store(struct device *dev,
2955+		struct device_attribute *attr, const char *buf, size_t size)
2956+{
2957+	strlcpy(lun_info, buf, sizeof(lun_info));
2958+	return size;
2959+}
2960+
2961+static DEVICE_ATTR(luns, S_IRUGO | S_IWUSR,
2962+				mass_storage_lun_info_show,
2963+				mass_storage_lun_info_store);
2964+
2965 static struct device_attribute *mass_storage_function_attributes[] = {
2966 	&dev_attr_inquiry_string,
2967+	&dev_attr_luns,
2968 	NULL
2969 };
2970 
2971@@ -1193,6 +2634,7 @@ static struct android_usb_function mass_storage_function = {
2972 	.cleanup	= mass_storage_function_cleanup,
2973 	.bind_config	= mass_storage_function_bind_config,
2974 	.attributes	= mass_storage_function_attributes,
2975+	.enable		= mass_storage_function_enable,
2976 };
2977 
2978 
2979@@ -1228,8 +2670,7 @@ static struct android_usb_function accessory_function = {
2980 	.ctrlrequest	= accessory_function_ctrlrequest,
2981 };
2982 
2983-
2984-#ifdef CONFIG_SOUND
2985+#ifdef CONFIG_SND_PCM
2986 static int audio_source_function_init(struct android_usb_function *f,
2987 			struct usb_composite_dev *cdev)
2988 {
2989@@ -1273,12 +2714,10 @@ static ssize_t audio_source_pcm_show(struct device *dev,
2990 	struct audio_source_config *config = f->config;
2991 
2992 	/* print PCM card and device numbers */
2993-	return snprintf(buf, PAGE_SIZE, "%d %d\n", config->card,
2994-			config->device);
2995+	return sprintf(buf, "%d %d\n", config->card, config->device);
2996 }
2997 
2998-
2999-static DEVICE_ATTR(pcm, S_IRUGO /*| S_IWUSR*/, audio_source_pcm_show, NULL);
3000+static DEVICE_ATTR(pcm, S_IRUGO, audio_source_pcm_show, NULL);
3001 
3002 static struct device_attribute *audio_source_function_attributes[] = {
3003 	&dev_attr_pcm,
3004@@ -1295,133 +2734,135 @@ static struct android_usb_function audio_source_function = {
3005 };
3006 #endif
3007 
3008-struct hid_function_config {
3009-	struct hidg_func_descriptor *fdesc;
3010-	int index;
3011-};
3012-
3013-/* hid descriptor for a keyboard */
3014-static struct hidg_func_descriptor hid_keyboard_fdesc = {
3015-	.subclass		= 0, /* No subclass */
3016-	.protocol		= 1, /* Keyboard */
3017-	.report_length		= 8,
3018-	.report_desc_length	= 63,
3019-	.report_desc		= {
3020-		0x05, 0x01,	/* USAGE_PAGE (Generic Desktop)	          */
3021-		0x09, 0x06,	/* USAGE (Keyboard)                       */
3022-		0xa1, 0x01,	/* COLLECTION (Application)               */
3023-		0x05, 0x07,	/*   USAGE_PAGE (Keyboard)                */
3024-		0x19, 0xe0,	/*   USAGE_MINIMUM (Keyboard LeftControl) */
3025-		0x29, 0xe7,	/*   USAGE_MAXIMUM (Keyboard Right GUI)   */
3026-		0x15, 0x00,	/*   LOGICAL_MINIMUM (0)                  */
3027-		0x25, 0x01,	/*   LOGICAL_MAXIMUM (1)                  */
3028-		0x75, 0x01,	/*   REPORT_SIZE (1)                      */
3029-		0x95, 0x08,	/*   REPORT_COUNT (8)                     */
3030-		0x81, 0x02,	/*   INPUT (Data,Var,Abs)                 */
3031-		0x95, 0x01,	/*   REPORT_COUNT (1)                     */
3032-		0x75, 0x08,	/*   REPORT_SIZE (8)                      */
3033-		0x81, 0x03,	/*   INPUT (Cnst,Var,Abs)                 */
3034-		0x95, 0x05,	/*   REPORT_COUNT (5)                     */
3035-		0x75, 0x01,	/*   REPORT_SIZE (1)                      */
3036-		0x05, 0x08,	/*   USAGE_PAGE (LEDs)                    */
3037-		0x19, 0x01,	/*   USAGE_MINIMUM (Num Lock)             */
3038-		0x29, 0x05,	/*   USAGE_MAXIMUM (Kana)                 */
3039-		0x91, 0x02,	/*   OUTPUT (Data,Var,Abs)                */
3040-		0x95, 0x01,	/*   REPORT_COUNT (1)                     */
3041-		0x75, 0x03,	/*   REPORT_SIZE (3)                      */
3042-		0x91, 0x03,	/*   OUTPUT (Cnst,Var,Abs)                */
3043-		0x95, 0x06,	/*   REPORT_COUNT (6)                     */
3044-		0x75, 0x08,	/*   REPORT_SIZE (8)                      */
3045-		0x15, 0x00,	/*   LOGICAL_MINIMUM (0)                  */
3046-		0x25, 0x65,	/*   LOGICAL_MAXIMUM (101)                */
3047-		0x05, 0x07,	/*   USAGE_PAGE (Keyboard)                */
3048-		0x19, 0x00,	/*   USAGE_MINIMUM (Reserved)             */
3049-		0x29, 0x65,	/*   USAGE_MAXIMUM (Keyboard Application) */
3050-		0x81, 0x00,	/*   INPUT (Data,Ary,Abs)                 */
3051-		0xc0		/* END_COLLECTION                         */
3052-	}
3053-};
3054-
3055-static int hid_function_init(struct android_usb_function *f,
3056-			struct usb_composite_dev *cdev)
3057+static int android_uasp_connect_cb(bool connect)
3058 {
3059-	struct hid_function_config *config;
3060-	int status = 0;
3061-
3062-	config = kzalloc(sizeof(struct hid_function_config), GFP_KERNEL);
3063-	if (!config)
3064-		return -ENOMEM;
3065-	config->fdesc = &hid_keyboard_fdesc;
3066-	config->index = 0;
3067-	f->config = config;
3068-
3069-	/* set up HID */
3070-	status = ghid_setup(cdev->gadget, 1);
3071-	if (status < 0)
3072-		return status;
3073+	/*
3074+	 * TODO
3075+	 * We may have to disable gadget till UASP configfs nodes
3076+	 * are configured which includes mapping LUN with the
3077+	 * backing file. It is a fundamental difference between
3078+	 * f_mass_storage and f_tcp. That means UASP can not be
3079+	 * in default composition.
3080+	 *
3081+	 * For now, assume that UASP configfs nodes are configured
3082+	 * before enabling android gadget. Or cable should be
3083+	 * reconnected after mapping the LUN.
3084+	 *
3085+	 * Also consider making UASP to respond to Host requests when
3086+	 * Lun is not mapped.
3087+	 */
3088+	pr_debug("UASP %s\n", connect ? "connect" : "disconnect");
3089 
3090 	return 0;
3091 }
3092 
3093-static void hid_function_cleanup(struct android_usb_function *f)
3094+static int uasp_function_init(struct android_usb_function *f,
3095+					struct usb_composite_dev *cdev)
3096+{
3097+	return f_tcm_init(&android_uasp_connect_cb);
3098+}
3099+
3100+static void uasp_function_cleanup(struct android_usb_function *f)
3101 {
3102-	ghid_cleanup();
3103-	kfree(f->config);
3104+	f_tcm_exit();
3105 }
3106 
3107-static int hid_function_bind_config(struct android_usb_function *f,
3108+static int uasp_function_bind_config(struct android_usb_function *f,
3109 						struct usb_configuration *c)
3110 {
3111-	struct hid_function_config *config = f->config;
3112-
3113-	return hidg_bind_config(c, config->fdesc, config->index);
3114+	return tcm_bind_config(c);
3115 }
3116 
3117-static struct android_usb_function hid_function = {
3118-	.name		= "hid",
3119-	.init		= hid_function_init,
3120-	.cleanup	= hid_function_cleanup,
3121-	.bind_config	= hid_function_bind_config,
3122+static struct android_usb_function uasp_function = {
3123+	.name		= "uasp",
3124+	.init		= uasp_function_init,
3125+	.cleanup	= uasp_function_cleanup,
3126+	.bind_config	= uasp_function_bind_config,
3127 };
3128 
3129 static struct android_usb_function *supported_functions[] = {
3130 	&ffs_function,
3131-	&acm_function,
3132-#ifdef CONFIG_USB_GADGET_GG
3133-	&gg_function,
3134+	&mbim_function,
3135+	&ecm_qc_function,
3136+#ifdef CONFIG_SND_PCM
3137+	&audio_function,
3138 #endif
3139+	&rmnet_smd_function,
3140+	&rmnet_function,
3141+	&gps_function,
3142+	&diag_function,
3143+	&qdss_function,
3144+	&serial_function,
3145+	&ccid_function,
3146+	&acm_function,
3147 	&mtp_function,
3148 	&ptp_function,
3149 	&rndis_function,
3150+	&rndis_qc_function,
3151+	&ecm_function,
3152+	&ncm_function,
3153 	&mass_storage_function,
3154 	&accessory_function,
3155-#ifdef CONFIG_SOUND
3156+#ifdef CONFIG_SND_PCM
3157 	&audio_source_function,
3158 #endif
3159-	&ncm_function,
3160-	&hid_function,
3161+	&uasp_function,
3162+	&charger_function,
3163 	NULL
3164 };
3165 
3166+static void android_cleanup_functions(struct android_usb_function **functions)
3167+{
3168+	struct android_usb_function *f;
3169+	struct device_attribute **attrs;
3170+	struct device_attribute *attr;
3171+
3172+	while (*functions) {
3173+		f = *functions++;
3174+
3175+		if (f->dev) {
3176+			device_destroy(android_class, f->dev->devt);
3177+			kfree(f->dev_name);
3178+		} else
3179+			continue;
3180+
3181+		if (f->cleanup)
3182+			f->cleanup(f);
3183+
3184+		attrs = f->attributes;
3185+		if (attrs) {
3186+			while ((attr = *attrs++))
3187+				device_remove_file(f->dev, attr);
3188+		}
3189+	}
3190+}
3191 
3192 static int android_init_functions(struct android_usb_function **functions,
3193 				  struct usb_composite_dev *cdev)
3194 {
3195-	struct android_dev *dev = _android_dev;
3196+	struct android_dev *dev = cdev_to_android_dev(cdev);
3197 	struct android_usb_function *f;
3198 	struct device_attribute **attrs;
3199 	struct device_attribute *attr;
3200 	int err = 0;
3201-	int index = 0;
3202+	int index = 2; /* index 0 is for android0 device
3203+			* index 1 is for android1 device
3204+			*/
3205 
3206 	for (; (f = *functions++); index++) {
3207 		f->dev_name = kasprintf(GFP_KERNEL, "f_%s", f->name);
3208+		f->android_dev = NULL;
3209+		if (!f->dev_name) {
3210+			err = -ENOMEM;
3211+			goto err_out;
3212+		}
3213 		f->dev = device_create(android_class, dev->dev,
3214 				MKDEV(0, index), f, f->dev_name);
3215 		if (IS_ERR(f->dev)) {
3216 			pr_err("%s: Failed to create dev %s", __func__,
3217 							f->dev_name);
3218 			err = PTR_ERR(f->dev);
3219+			f->dev = NULL;
3220 			goto err_create;
3221 		}
3222 
3223@@ -1430,7 +2871,7 @@ static int android_init_functions(struct android_usb_function **functions,
3224 			if (err) {
3225 				pr_err("%s: Failed to init %s", __func__,
3226 								f->name);
3227-				goto err_out;
3228+				goto err_init;
3229 			}
3230 		}
3231 
3232@@ -1441,47 +2882,51 @@ static int android_init_functions(struct android_usb_function **functions,
3233 		}
3234 		if (err) {
3235 			pr_err("%s: Failed to create function %s attributes",
3236-					__func__, f->name);
3237-			goto err_out;
3238-		}
3239-	}
3240-	return 0;
3241-
3242-err_out:
3243-	device_destroy(android_class, f->dev->devt);
3244-err_create:
3245-	kfree(f->dev_name);
3246-	return err;
3247-}
3248-
3249-static void android_cleanup_functions(struct android_usb_function **functions)
3250-{
3251-	struct android_usb_function *f;
3252-
3253-	while (*functions) {
3254-		f = *functions++;
3255-
3256-		if (f->dev) {
3257-			device_destroy(android_class, f->dev->devt);
3258-			kfree(f->dev_name);
3259+					__func__, f->name);
3260+			goto err_attrs;
3261 		}
3262-
3263-		if (f->cleanup)
3264-			f->cleanup(f);
3265 	}
3266+	return 0;
3267+
3268+err_attrs:
3269+	for (attr = *(attrs -= 2); attrs != f->attributes; attr = *(attrs--))
3270+		device_remove_file(f->dev, attr);
3271+	if (f->cleanup)
3272+		f->cleanup(f);
3273+err_init:
3274+	device_destroy(android_class, f->dev->devt);
3275+err_create:
3276+	f->dev = NULL;
3277+	kfree(f->dev_name);
3278+err_out:
3279+	android_cleanup_functions(dev->functions);
3280+	return err;
3281 }
3282 
3283 static int
3284 android_bind_enabled_functions(struct android_dev *dev,
3285 			       struct usb_configuration *c)
3286 {
3287-	struct android_usb_function *f;
3288+	struct android_usb_function_holder *f_holder;
3289+	struct android_configuration *conf =
3290+		container_of(c, struct android_configuration, usb_config);
3291 	int ret;
3292 
3293-	list_for_each_entry(f, &dev->enabled_functions, enabled_list) {
3294-		ret = f->bind_config(f, c);
3295+	list_for_each_entry(f_holder, &conf->enabled_functions, enabled_list) {
3296+		ret = f_holder->f->bind_config(f_holder->f, c);
3297 		if (ret) {
3298-			pr_err("%s: %s failed", __func__, f->name);
3299+			pr_err("%s: %s failed\n", __func__, f_holder->f->name);
3300+			while (!list_empty(&c->functions)) {
3301+				struct usb_function		*f;
3302+
3303+				f = list_first_entry(&c->functions,
3304+					struct usb_function, list);
3305+				list_del(&f->list);
3306+				if (f->unbind)
3307+					f->unbind(c, f);
3308+			}
3309+			if (c->unbind)
3310+				c->unbind(c);
3311 			return ret;
3312 		}
3313 	}
3314@@ -1492,23 +2937,65 @@ static void
3315 android_unbind_enabled_functions(struct android_dev *dev,
3316 			       struct usb_configuration *c)
3317 {
3318-	struct android_usb_function *f;
3319+	struct android_usb_function_holder *f_holder;
3320+	struct android_configuration *conf =
3321+		container_of(c, struct android_configuration, usb_config);
3322 
3323-	list_for_each_entry(f, &dev->enabled_functions, enabled_list) {
3324-		if (f->unbind_config)
3325-			f->unbind_config(f, c);
3326+	list_for_each_entry(f_holder, &conf->enabled_functions, enabled_list) {
3327+		if (f_holder->f->unbind_config)
3328+			f_holder->f->unbind_config(f_holder->f, c);
3329 	}
3330 }
3331+static inline void check_streaming_func(struct usb_gadget *gadget,
3332+		struct android_usb_platform_data *pdata,
3333+		char *name)
3334+{
3335+	int i;
3336 
3337-static int android_enable_function(struct android_dev *dev, char *name)
3338+	for (i = 0; i < pdata->streaming_func_count; i++) {
3339+		if (!strcmp(name, pdata->streaming_func[i])) {
3340+			pr_debug("set streaming_enabled to true\n");
3341+			gadget->streaming_enabled = true;
3342+			break;
3343+		}
3344+	}
3345+}
3346+static int android_enable_function(struct android_dev *dev,
3347+				   struct android_configuration *conf,
3348+				   char *name)
3349 {
3350 	struct android_usb_function **functions = dev->functions;
3351 	struct android_usb_function *f;
3352+	struct android_usb_function_holder *f_holder;
3353+	struct android_usb_platform_data *pdata = dev->pdata;
3354+	struct usb_gadget *gadget = dev->cdev->gadget;
3355+
3356 	while ((f = *functions++)) {
3357 		if (!strcmp(name, f->name)) {
3358-			list_add_tail(&f->enabled_list,
3359-						&dev->enabled_functions);
3360-			return 0;
3361+			if (f->android_dev && f->android_dev != dev)
3362+				pr_err("%s is enabled in other device\n",
3363+					f->name);
3364+			else {
3365+				f_holder = kzalloc(sizeof(*f_holder),
3366+						GFP_KERNEL);
3367+				if (!f_holder) {
3368+					pr_err("Failed to alloc f_holder\n");
3369+					return -ENOMEM;
3370+				}
3371+
3372+				f->android_dev = dev;
3373+				f_holder->f = f;
3374+				list_add_tail(&f_holder->enabled_list,
3375+					      &conf->enabled_functions);
3376+				pr_debug("func:%s is enabled.\n", f->name);
3377+				/*
3378+				 * compare enable function with streaming func
3379+				 * list and based on the same request streaming.
3380+				 */
3381+				check_streaming_func(gadget, pdata, f->name);
3382+
3383+				return 0;
3384+			}
3385 		}
3386 	}
3387 	return -EINVAL;
3388@@ -1517,17 +3004,68 @@ static int android_enable_function(struct android_dev *dev, char *name)
3389 /*-------------------------------------------------------------------------*/
3390 /* /sys/class/android_usb/android%d/ interface */
3391 
3392+static ssize_t remote_wakeup_show(struct device *pdev,
3393+		struct device_attribute *attr, char *buf)
3394+{
3395+	struct android_dev *dev = dev_get_drvdata(pdev);
3396+	struct android_configuration *conf;
3397+
3398+	/*
3399+	 * Show the wakeup attribute of the first configuration,
3400+	 * since all configurations have the same wakeup attribute
3401+	 */
3402+	if (dev->configs_num == 0)
3403+		return 0;
3404+	conf = list_entry(dev->configs.next,
3405+			  struct android_configuration,
3406+			  list_item);
3407+
3408+	return snprintf(buf, PAGE_SIZE, "%d\n",
3409+			!!(conf->usb_config.bmAttributes &
3410+				USB_CONFIG_ATT_WAKEUP));
3411+}
3412+
3413+static ssize_t remote_wakeup_store(struct device *pdev,
3414+		struct device_attribute *attr, const char *buff, size_t size)
3415+{
3416+	struct android_dev *dev = dev_get_drvdata(pdev);
3417+	struct android_configuration *conf;
3418+	int enable = 0;
3419+
3420+	sscanf(buff, "%d", &enable);
3421+
3422+	pr_debug("android_usb: %s remote wakeup\n",
3423+			enable ? "enabling" : "disabling");
3424+
3425+	list_for_each_entry(conf, &dev->configs, list_item)
3426+		if (enable)
3427+			conf->usb_config.bmAttributes |=
3428+					USB_CONFIG_ATT_WAKEUP;
3429+		else
3430+			conf->usb_config.bmAttributes &=
3431+					~USB_CONFIG_ATT_WAKEUP;
3432+
3433+	return size;
3434+}
3435+
3436 static ssize_t
3437 functions_show(struct device *pdev, struct device_attribute *attr, char *buf)
3438 {
3439 	struct android_dev *dev = dev_get_drvdata(pdev);
3440-	struct android_usb_function *f;
3441+	struct android_configuration *conf;
3442+	struct android_usb_function_holder *f_holder;
3443 	char *buff = buf;
3444 
3445 	mutex_lock(&dev->mutex);
3446 
3447-	list_for_each_entry(f, &dev->enabled_functions, enabled_list)
3448-		buff += sprintf(buff, "%s,", f->name);
3449+	list_for_each_entry(conf, &dev->configs, list_item) {
3450+		if (buff != buf)
3451+			*(buff-1) = ':';
3452+		list_for_each_entry(f_holder, &conf->enabled_functions,
3453+					enabled_list)
3454+			buff += snprintf(buff, PAGE_SIZE, "%s,",
3455+					f_holder->f->name);
3456+	}
3457 
3458 	mutex_unlock(&dev->mutex);
3459 
3460@@ -1541,6 +3079,10 @@ functions_store(struct device *pdev, struct device_attribute *attr,
3461 			       const char *buff, size_t size)
3462 {
3463 	struct android_dev *dev = dev_get_drvdata(pdev);
3464+	struct list_head *curr_conf = &dev->configs;
3465+	struct android_configuration *conf;
3466+	char *conf_str;
3467+	struct android_usb_function_holder *f_holder;
3468 	char *name;
3469 	char buf[256], *b;
3470 	char aliases[256], *a;
3471@@ -1555,44 +3097,79 @@ functions_store(struct device *pdev, struct device_attribute *attr,
3472 		return -EBUSY;
3473 	}
3474 
3475-	INIT_LIST_HEAD(&dev->enabled_functions);
3476+	/* Clear previous enabled list */
3477+	list_for_each_entry(conf, &dev->configs, list_item) {
3478+		while (conf->enabled_functions.next !=
3479+				&conf->enabled_functions) {
3480+			f_holder = list_entry(conf->enabled_functions.next,
3481+					typeof(*f_holder),
3482+					enabled_list);
3483+			f_holder->f->android_dev = NULL;
3484+			list_del(&f_holder->enabled_list);
3485+			kfree(f_holder);
3486+		}
3487+		INIT_LIST_HEAD(&conf->enabled_functions);
3488+	}
3489 
3490 	strlcpy(buf, buff, sizeof(buf));
3491 	b = strim(buf);
3492 
3493 	while (b) {
3494-		name = strsep(&b, ",");
3495-		if (!name)
3496+		conf_str = strsep(&b, ":");
3497+		if (!conf_str)
3498 			continue;
3499 
3500-		is_ffs = 0;
3501-		strlcpy(aliases, dev->ffs_aliases, sizeof(aliases));
3502-		a = aliases;
3503-
3504-		while (a) {
3505-			char *alias = strsep(&a, ",");
3506-			if (alias && !strcmp(name, alias)) {
3507-				is_ffs = 1;
3508-				break;
3509+		/* If the next not equal to the head, take it */
3510+		if (curr_conf->next != &dev->configs)
3511+			conf = list_entry(curr_conf->next,
3512+					  struct android_configuration,
3513+					  list_item);
3514+		else
3515+			conf = alloc_android_config(dev);
3516+
3517+		curr_conf = curr_conf->next;
3518+		while (conf_str) {
3519+			name = strsep(&conf_str, ",");
3520+			is_ffs = 0;
3521+			strlcpy(aliases, dev->ffs_aliases, sizeof(aliases));
3522+			a = aliases;
3523+
3524+			while (a) {
3525+				char *alias = strsep(&a, ",");
3526+				if (alias && !strcmp(name, alias)) {
3527+					is_ffs = 1;
3528+					break;
3529+				}
3530 			}
3531-		}
3532 
3533-		if (is_ffs) {
3534-			if (ffs_enabled)
3535+			if (is_ffs) {
3536+				if (ffs_enabled)
3537+					continue;
3538+				err = android_enable_function(dev, conf, "ffs");
3539+				if (err)
3540+					pr_err("android_usb: Cannot enable ffs (%d)",
3541+									err);
3542+				else
3543+					ffs_enabled = 1;
3544 				continue;
3545-			err = android_enable_function(dev, "ffs");
3546+			}
3547+
3548+			if (!strcmp(name, "rndis") &&
3549+				!strcmp(strim(rndis_transports), "BAM2BAM_IPA"))
3550+				name = "rndis_qc";
3551+
3552+			err = android_enable_function(dev, conf, name);
3553 			if (err)
3554-				pr_err("android_usb: Cannot enable ffs (%d)",
3555-									err);
3556-			else
3557-				ffs_enabled = 1;
3558-			continue;
3559+				pr_err("android_usb: Cannot enable '%s' (%d)",
3560+							name, err);
3561 		}
3562+	}
3563 
3564-		err = android_enable_function(dev, name);
3565-		if (err)
3566-			pr_err("android_usb: Cannot enable '%s' (%d)",
3567-							   name, err);
3568+	/* Free uneeded configurations if exists */
3569+	while (curr_conf->next != &dev->configs) {
3570+		conf = list_entry(curr_conf->next,
3571+				  struct android_configuration, list_item);
3572+		free_android_config(dev, conf);
3573 	}
3574 
3575 	mutex_unlock(&dev->mutex);
3576@@ -1604,7 +3181,8 @@ static ssize_t enable_show(struct device *pdev, struct device_attribute *attr,
3577 			   char *buf)
3578 {
3579 	struct android_dev *dev = dev_get_drvdata(pdev);
3580-	return sprintf(buf, "%d\n", dev->enabled);
3581+
3582+	return snprintf(buf, PAGE_SIZE, "%d\n", dev->enabled);
3583 }
3584 
3585 static ssize_t enable_store(struct device *pdev, struct device_attribute *attr,
3586@@ -1612,9 +3190,12 @@ static ssize_t enable_store(struct device *pdev, struct device_attribute *attr,
3587 {
3588 	struct android_dev *dev = dev_get_drvdata(pdev);
3589 	struct usb_composite_dev *cdev = dev->cdev;
3590-	struct android_usb_function *f;
3591+	struct android_usb_function_holder *f_holder;
3592+	struct android_configuration *conf;
3593 	int enabled = 0;
3594-
3595+	bool audio_enabled = false;
3596+	static DEFINE_RATELIMIT_STATE(rl, 10*HZ, 1);
3597+	int err = 0;
3598 
3599 	if (!cdev)
3600 		return -ENODEV;
3601@@ -1633,28 +3214,78 @@ static ssize_t enable_store(struct device *pdev, struct device_attribute *attr,
3602 		cdev->desc.bDeviceClass = device_desc.bDeviceClass;
3603 		cdev->desc.bDeviceSubClass = device_desc.bDeviceSubClass;
3604 		cdev->desc.bDeviceProtocol = device_desc.bDeviceProtocol;
3605-		list_for_each_entry(f, &dev->enabled_functions, enabled_list) {
3606-			if (f->enable)
3607-				f->enable(f);
3608+
3609+		/* Audio dock accessory is unable to enumerate device if
3610+		 * pull-up is enabled immediately. The enumeration is
3611+		 * reliable with 100 msec delay.
3612+		 */
3613+		list_for_each_entry(conf, &dev->configs, list_item)
3614+			list_for_each_entry(f_holder, &conf->enabled_functions,
3615+						enabled_list) {
3616+				if (f_holder->f->enable)
3617+					f_holder->f->enable(f_holder->f);
3618+				if (!strncmp(f_holder->f->name,
3619+						"audio_source", 12))
3620+					audio_enabled = true;
3621+			}
3622+		if (audio_enabled)
3623+			msleep(100);
3624+		err = android_enable(dev);
3625+		if (err < 0) {
3626+			pr_err("%s: android_enable failed\n", __func__);
3627+			dev->connected = 0;
3628+			dev->enabled = false;
3629+			mutex_unlock(&dev->mutex);
3630+			return size;
3631 		}
3632-		android_enable(dev);
3633 		dev->enabled = true;
3634 	} else if (!enabled && dev->enabled) {
3635 		android_disable(dev);
3636-		list_for_each_entry(f, &dev->enabled_functions, enabled_list) {
3637-			if (f->disable)
3638-				f->disable(f);
3639-		}
3640+		list_for_each_entry(conf, &dev->configs, list_item)
3641+			list_for_each_entry(f_holder, &conf->enabled_functions,
3642+						enabled_list) {
3643+				if (f_holder->f->disable)
3644+					f_holder->f->disable(f_holder->f);
3645+			}
3646 		dev->enabled = false;
3647-	} else {
3648+	} else if (__ratelimit(&rl)) {
3649 		pr_err("android_usb: already %s\n",
3650 				dev->enabled ? "enabled" : "disabled");
3651 	}
3652 
3653 	mutex_unlock(&dev->mutex);
3654+
3655+	return size;
3656+}
3657+
3658+static ssize_t pm_qos_show(struct device *pdev,
3659+			   struct device_attribute *attr, char *buf)
3660+{
3661+	struct android_dev *dev = dev_get_drvdata(pdev);
3662+
3663+	return snprintf(buf, PAGE_SIZE, "%s\n", dev->pm_qos);
3664+}
3665+
3666+static ssize_t pm_qos_store(struct device *pdev,
3667+			   struct device_attribute *attr,
3668+			   const char *buff, size_t size)
3669+{
3670+	struct android_dev *dev = dev_get_drvdata(pdev);
3671+
3672+	strlcpy(dev->pm_qos, buff, sizeof(dev->pm_qos));
3673+
3674 	return size;
3675 }
3676 
3677+static ssize_t pm_qos_state_show(struct device *pdev,
3678+			struct device_attribute *attr, char *buf)
3679+{
3680+	struct android_dev *dev = dev_get_drvdata(pdev);
3681+
3682+	return snprintf(buf, PAGE_SIZE, "%s\n",
3683+				pm_qos_to_string(dev->curr_pm_qos_state));
3684+}
3685+
3686 static ssize_t state_show(struct device *pdev, struct device_attribute *attr,
3687 			   char *buf)
3688 {
3689@@ -1673,15 +3304,41 @@ static ssize_t state_show(struct device *pdev, struct device_attribute *attr,
3690 		state = "CONNECTED";
3691 	spin_unlock_irqrestore(&cdev->lock, flags);
3692 out:
3693-	return sprintf(buf, "%s\n", state);
3694+	return snprintf(buf, PAGE_SIZE, "%s\n", state);
3695 }
3696 
3697+#define ANDROID_DEV_ATTR(field, format_string)				\
3698+static ssize_t								\
3699+field ## _show(struct device *pdev, struct device_attribute *attr,	\
3700+		char *buf)						\
3701+{									\
3702+	struct android_dev *dev = dev_get_drvdata(pdev);		\
3703+									\
3704+	return snprintf(buf, PAGE_SIZE,					\
3705+			format_string, dev->field);			\
3706+}									\
3707+static ssize_t								\
3708+field ## _store(struct device *pdev, struct device_attribute *attr,	\
3709+		const char *buf, size_t size)				\
3710+{									\
3711+	unsigned value;							\
3712+	struct android_dev *dev = dev_get_drvdata(pdev);		\
3713+									\
3714+	if (sscanf(buf, format_string, &value) == 1) {			\
3715+		dev->field = value;					\
3716+		return size;						\
3717+	}								\
3718+	return -EINVAL;							\
3719+}									\
3720+static DEVICE_ATTR(field, S_IRUGO | S_IWUSR, field ## _show, field ## _store);
3721+
3722 #define DESCRIPTOR_ATTR(field, format_string)				\
3723 static ssize_t								\
3724 field ## _show(struct device *dev, struct device_attribute *attr,	\
3725 		char *buf)						\
3726 {									\
3727-	return sprintf(buf, format_string, device_desc.field);		\
3728+	return snprintf(buf, PAGE_SIZE,					\
3729+			format_string, device_desc.field);		\
3730 }									\
3731 static ssize_t								\
3732 field ## _store(struct device *dev, struct device_attribute *attr,	\
3733@@ -1701,7 +3358,7 @@ static ssize_t								\
3734 field ## _show(struct device *dev, struct device_attribute *attr,	\
3735 		char *buf)						\
3736 {									\
3737-	return sprintf(buf, "%s", buffer);				\
3738+	return snprintf(buf, PAGE_SIZE, "%s", buffer);			\
3739 }									\
3740 static ssize_t								\
3741 field ## _store(struct device *dev, struct device_attribute *attr,	\
3742@@ -1709,7 +3366,9 @@ field ## _store(struct device *dev, struct device_attribute *attr,	\
3743 {									\
3744 	if (size >= sizeof(buffer))					\
3745 		return -EINVAL;						\
3746-	return strlcpy(buffer, buf, sizeof(buffer));			\
3747+	strlcpy(buffer, buf, sizeof(buffer));				\
3748+	strim(buffer);							\
3749+	return size;							\
3750 }									\
3751 static DEVICE_ATTR(field, S_IRUGO | S_IWUSR, field ## _show, field ## _store);
3752 
3753@@ -1717,19 +3376,9 @@ static DEVICE_ATTR(field, S_IRUGO | S_IWUSR, field ## _show, field ## _store);
3754 DESCRIPTOR_ATTR(idVendor, "%04x\n")
3755 DESCRIPTOR_ATTR(idProduct, "%04x\n")
3756 DESCRIPTOR_ATTR(bcdDevice, "%04x\n")
3757-#if defined CONFIG_MACH_RHEA_SS \
3758-|| defined CONFIG_MACH_RHEA_SS_ZANIN \
3759-|| defined CONFIG_MACH_RHEA_SS_LUCAS \
3760-|| defined CONFIG_MACH_RHEA_SS_AMAZING \
3761-|| defined CONFIG_MACH_RHEA_SS_IVORY
3762-DESCRIPTOR_ATTR(bDeviceClass, "%02x\n")
3763-DESCRIPTOR_ATTR(bDeviceSubClass, "%02x\n")
3764-DESCRIPTOR_ATTR(bDeviceProtocol, "%02x\n")
3765-#else
3766 DESCRIPTOR_ATTR(bDeviceClass, "%d\n")
3767 DESCRIPTOR_ATTR(bDeviceSubClass, "%d\n")
3768 DESCRIPTOR_ATTR(bDeviceProtocol, "%d\n")
3769-#endif
3770 DESCRIPTOR_STRING_ATTR(iManufacturer, manufacturer_string)
3771 DESCRIPTOR_STRING_ATTR(iProduct, product_string)
3772 DESCRIPTOR_STRING_ATTR(iSerial, serial_string)
3773@@ -1737,7 +3386,18 @@ DESCRIPTOR_STRING_ATTR(iSerial, serial_string)
3774 static DEVICE_ATTR(functions, S_IRUGO | S_IWUSR, functions_show,
3775 						 functions_store);
3776 static DEVICE_ATTR(enable, S_IRUGO | S_IWUSR, enable_show, enable_store);
3777+
3778+static DEVICE_ATTR(pm_qos, S_IRUGO | S_IWUSR, pm_qos_show, pm_qos_store);
3779+static DEVICE_ATTR(pm_qos_state, S_IRUGO, pm_qos_state_show, NULL);
3780+ANDROID_DEV_ATTR(up_pm_qos_sample_sec, "%u\n");
3781+ANDROID_DEV_ATTR(down_pm_qos_sample_sec, "%u\n");
3782+ANDROID_DEV_ATTR(up_pm_qos_threshold, "%u\n");
3783+ANDROID_DEV_ATTR(down_pm_qos_threshold, "%u\n");
3784+ANDROID_DEV_ATTR(idle_pc_rpm_no_int_secs, "%u\n");
3785+
3786 static DEVICE_ATTR(state, S_IRUGO, state_show, NULL);
3787+static DEVICE_ATTR(remote_wakeup, S_IRUGO | S_IWUSR,
3788+		remote_wakeup_show, remote_wakeup_store);
3789 
3790 static struct device_attribute *android_usb_attributes[] = {
3791 	&dev_attr_idVendor,
3792@@ -1751,7 +3411,15 @@ static struct device_attribute *android_usb_attributes[] = {
3793 	&dev_attr_iSerial,
3794 	&dev_attr_functions,
3795 	&dev_attr_enable,
3796+	&dev_attr_pm_qos,
3797+	&dev_attr_up_pm_qos_sample_sec,
3798+	&dev_attr_down_pm_qos_sample_sec,
3799+	&dev_attr_up_pm_qos_threshold,
3800+	&dev_attr_down_pm_qos_threshold,
3801+	&dev_attr_idle_pc_rpm_no_int_secs,
3802+	&dev_attr_pm_qos_state,
3803 	&dev_attr_state,
3804+	&dev_attr_remote_wakeup,
3805 	NULL
3806 };
3807 
3808@@ -1760,7 +3428,7 @@ static struct device_attribute *android_usb_attributes[] = {
3809 
3810 static int android_bind_config(struct usb_configuration *c)
3811 {
3812-	struct android_dev *dev = _android_dev;
3813+	struct android_dev *dev = cdev_to_android_dev(c->cdev);
3814 	int ret = 0;
3815 
3816 	ret = android_bind_enabled_functions(dev, c);
3817@@ -1772,26 +3440,42 @@ static int android_bind_config(struct usb_configuration *c)
3818 
3819 static void android_unbind_config(struct usb_configuration *c)
3820 {
3821-	struct android_dev *dev = _android_dev;
3822+	struct android_dev *dev = cdev_to_android_dev(c->cdev);
3823 
3824+	if (c->cdev->gadget->streaming_enabled) {
3825+		c->cdev->gadget->streaming_enabled = false;
3826+		pr_debug("setting streaming_enabled to false.\n");
3827+	}
3828 	android_unbind_enabled_functions(dev, c);
3829 }
3830 
3831 static int android_bind(struct usb_composite_dev *cdev)
3832 {
3833-	struct android_dev *dev = _android_dev;
3834+	struct android_dev *dev;
3835 	struct usb_gadget	*gadget = cdev->gadget;
3836+	struct android_configuration *conf;
3837 	int			id, ret;
3838 
3839+	/* Bind to the last android_dev that was probed */
3840+	dev = list_entry(android_dev_list.prev, struct android_dev, list_item);
3841+
3842+	dev->cdev = cdev;
3843+
3844+	/* Save the default handler */
3845+	dev->setup_complete = cdev->req->complete;
3846+
3847 	/*
3848 	 * Start disconnected. Userspace will connect the gadget once
3849 	 * it is done configuring the functions.
3850 	 */
3851 	usb_gadget_disconnect(gadget);
3852 
3853-	ret = android_init_functions(dev->functions, cdev);
3854-	if (ret)
3855-		return ret;
3856+	/* Init the supported functions only once, on the first android_dev */
3857+	if (android_dev_count == 1) {
3858+		ret = android_init_functions(dev->functions, cdev);
3859+		if (ret)
3860+			return ret;
3861+	}
3862 
3863 	/* Allocate string descriptor numbers ... note that string
3864 	 * contents can be overridden by the composite_dev glue.
3865@@ -1809,9 +3493,10 @@ static int android_bind(struct usb_composite_dev *cdev)
3866 	device_desc.iProduct = id;
3867 
3868 	/* Default strings - should be updated by userspace */
3869-	strncpy(manufacturer_string, "Android", sizeof(manufacturer_string)-1);
3870-	strncpy(product_string, "Android", sizeof(product_string) - 1);
3871-	strncpy(serial_string, "0123456789ABCDEF", sizeof(serial_string) - 1);
3872+	strlcpy(manufacturer_string, "Android",
3873+		sizeof(manufacturer_string) - 1);
3874+	strlcpy(product_string, "Android", sizeof(product_string) - 1);
3875+	strlcpy(serial_string, "0123456789ABCDEF", sizeof(serial_string) - 1);
3876 
3877 	id = usb_string_id(cdev);
3878 	if (id < 0)
3879@@ -1819,46 +3504,68 @@ static int android_bind(struct usb_composite_dev *cdev)
3880 	strings_dev[STRING_SERIAL_IDX].id = id;
3881 	device_desc.iSerialNumber = id;
3882 
3883-	usb_gadget_set_selfpowered(gadget);
3884-	dev->cdev = cdev;
3885+	if (gadget_is_otg(cdev->gadget))
3886+		list_for_each_entry(conf, &dev->configs, list_item)
3887+			conf->usb_config.descriptors = otg_desc;
3888 
3889 	return 0;
3890 }
3891 
3892 static int android_usb_unbind(struct usb_composite_dev *cdev)
3893 {
3894-	struct android_dev *dev = _android_dev;
3895+	struct android_dev *dev = cdev_to_android_dev(cdev);
3896 
3897+	manufacturer_string[0] = '\0';
3898+	product_string[0] = '\0';
3899+	serial_string[0] = '0';
3900 	cancel_work_sync(&dev->work);
3901+	cancel_delayed_work_sync(&dev->pm_qos_work);
3902 	android_cleanup_functions(dev->functions);
3903 	return 0;
3904 }
3905 
3906 /* HACK: android needs to override setup for accessory to work */
3907 static int (*composite_setup_func)(struct usb_gadget *gadget, const struct usb_ctrlrequest *c);
3908+static void (*composite_suspend_func)(struct usb_gadget *gadget);
3909+static void (*composite_resume_func)(struct usb_gadget *gadget);
3910 
3911 static int
3912 android_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *c)
3913 {
3914-	struct android_dev		*dev = _android_dev;
3915 	struct usb_composite_dev	*cdev = get_gadget_data(gadget);
3916+	struct android_dev		*dev = cdev_to_android_dev(cdev);
3917 	struct usb_request		*req = cdev->req;
3918 	struct android_usb_function	*f;
3919+	struct android_usb_function_holder *f_holder;
3920+	struct android_configuration	*conf;
3921 	int value = -EOPNOTSUPP;
3922 	unsigned long flags;
3923+	bool do_work = false;
3924+	bool prev_configured = false;
3925 
3926 	req->zero = 0;
3927 	req->length = 0;
3928+	req->complete = dev->setup_complete;
3929 	gadget->ep0->driver_data = cdev;
3930 
3931-	list_for_each_entry(f, &dev->enabled_functions, enabled_list) {
3932-		if (f->ctrlrequest) {
3933-			value = f->ctrlrequest(f, cdev, c);
3934-			if (value >= 0)
3935-				break;
3936+	list_for_each_entry(conf, &dev->configs, list_item)
3937+		list_for_each_entry(f_holder,
3938+				    &conf->enabled_functions,
3939+				    enabled_list) {
3940+			f = f_holder->f;
3941+			if (f->ctrlrequest) {
3942+				value = f->ctrlrequest(f, cdev, c);
3943+				if (value >= 0)
3944+					break;
3945+			}
3946 		}
3947-	}
3948 
3949+	/*
3950+	 * skip the  work when 2nd set config arrives
3951+	 * with same value from the host.
3952+	 */
3953+	if (cdev->config)
3954+		prev_configured = true;
3955 	/* Special case the accessory function.
3956 	 * It needs to handle control requests before it is enabled.
3957 	 */
3958@@ -1871,19 +3578,21 @@ android_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *c)
3959 	spin_lock_irqsave(&cdev->lock, flags);
3960 	if (!dev->connected) {
3961 		dev->connected = 1;
3962-		schedule_work(&dev->work);
3963+		do_work = true;
3964 	} else if (c->bRequest == USB_REQ_SET_CONFIGURATION &&
3965 						cdev->config) {
3966-		schedule_work(&dev->work);
3967+		if (!prev_configured)
3968+			do_work = true;
3969 	}
3970 	spin_unlock_irqrestore(&cdev->lock, flags);
3971-
3972+	if (do_work)
3973+		schedule_work(&dev->work);
3974 	return value;
3975 }
3976 
3977 static void android_disconnect(struct usb_composite_dev *cdev)
3978 {
3979-	struct android_dev *dev = _android_dev;
3980+	struct android_dev *dev = cdev_to_android_dev(cdev);
3981 
3982 	/* accessory HID support can be active while the
3983 	   accessory function is not actually enabled,
3984@@ -1902,17 +3611,57 @@ static struct usb_composite_driver android_usb_driver = {
3985 	.bind		= android_bind,
3986 	.unbind		= android_usb_unbind,
3987 	.disconnect	= android_disconnect,
3988-	.max_speed	= USB_SPEED_HIGH,
3989+	.max_speed	= USB_SPEED_SUPER
3990 };
3991 
3992-static int android_create_device(struct android_dev *dev)
3993+static void android_suspend(struct usb_gadget *gadget)
3994+{
3995+	struct usb_composite_dev *cdev = get_gadget_data(gadget);
3996+	struct android_dev *dev = cdev_to_android_dev(cdev);
3997+	unsigned long flags;
3998+
3999+	spin_lock_irqsave(&cdev->lock, flags);
4000+	if (!dev->suspended) {
4001+		dev->suspended = 1;
4002+		schedule_work(&dev->work);
4003+	}
4004+	spin_unlock_irqrestore(&cdev->lock, flags);
4005+
4006+	composite_suspend_func(gadget);
4007+}
4008+
4009+static void android_resume(struct usb_gadget *gadget)
4010+{
4011+	struct usb_composite_dev *cdev = get_gadget_data(gadget);
4012+	struct android_dev *dev = cdev_to_android_dev(cdev);
4013+	unsigned long flags;
4014+
4015+	spin_lock_irqsave(&cdev->lock, flags);
4016+	if (dev->suspended) {
4017+		dev->suspended = 0;
4018+		schedule_work(&dev->work);
4019+	}
4020+	spin_unlock_irqrestore(&cdev->lock, flags);
4021+
4022+	composite_resume_func(gadget);
4023+}
4024+
4025+static int android_create_device(struct android_dev *dev, u8 usb_core_id)
4026 {
4027 	struct device_attribute **attrs = android_usb_attributes;
4028 	struct device_attribute *attr;
4029+	char device_node_name[ANDROID_DEVICE_NODE_NAME_LENGTH];
4030 	int err;
4031 
4032-	dev->dev = device_create(android_class, NULL,
4033-					MKDEV(0, 0), NULL, "android0");
4034+	/*
4035+	 * The primary usb core should always have usb_core_id=0, since
4036+	 * Android user space is currently interested in android0 events.
4037+	 */
4038+	snprintf(device_node_name, ANDROID_DEVICE_NODE_NAME_LENGTH,
4039+		 "android%d", usb_core_id);
4040+	pr_debug("%s(): creating android%d device\n", __func__, usb_core_id);
4041+	dev->dev = device_create(android_class, NULL, MKDEV(0, usb_core_id),
4042+		NULL, device_node_name);
4043 	if (IS_ERR(dev->dev))
4044 		return PTR_ERR(dev->dev);
4045 
4046@@ -1928,63 +3677,348 @@ static int android_create_device(struct android_dev *dev)
4047 	return 0;
4048 }
4049 
4050+static void android_destroy_device(struct android_dev *dev)
4051+{
4052+	struct device_attribute **attrs = android_usb_attributes;
4053+	struct device_attribute *attr;
4054 
4055-static int __init init(void)
4056+	while ((attr = *attrs++))
4057+		device_remove_file(dev->dev, attr);
4058+	device_destroy(android_class, dev->dev->devt);
4059+}
4060+
4061+static struct android_dev *cdev_to_android_dev(struct usb_composite_dev *cdev)
4062 {
4063-	struct android_dev *dev;
4064-	int err;
4065+	struct android_dev *dev = NULL;
4066 
4067-	android_class = class_create(THIS_MODULE, "android_usb");
4068-	if (IS_ERR(android_class))
4069-		return PTR_ERR(android_class);
4070+	/* Find the android dev from the list */
4071+	list_for_each_entry(dev, &android_dev_list, list_item) {
4072+		if (dev->cdev == cdev)
4073+			break;
4074+	}
4075 
4076-	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
4077-	if (!dev) {
4078-		err = -ENOMEM;
4079-		goto err_dev;
4080+	return dev;
4081+}
4082+
4083+static struct android_configuration *alloc_android_config
4084+						(struct android_dev *dev)
4085+{
4086+	struct android_configuration *conf;
4087+
4088+	conf = kzalloc(sizeof(*conf), GFP_KERNEL);
4089+	if (!conf) {
4090+		pr_err("%s(): Failed to alloc memory for android conf\n",
4091+			__func__);
4092+		return ERR_PTR(-ENOMEM);
4093 	}
4094 
4095-	dev->disable_depth = 1;
4096-	dev->functions = supported_functions;
4097-	INIT_LIST_HEAD(&dev->enabled_functions);
4098-	INIT_WORK(&dev->work, android_work);
4099-	mutex_init(&dev->mutex);
4100+	dev->configs_num++;
4101+	conf->usb_config.label = dev->name;
4102+	conf->usb_config.unbind = android_unbind_config;
4103+	conf->usb_config.bConfigurationValue = dev->configs_num;
4104 
4105-	err = android_create_device(dev);
4106-	if (err) {
4107-		pr_err("%s: failed to create android device %d", __func__, err);
4108-		goto err_create;
4109+	INIT_LIST_HEAD(&conf->enabled_functions);
4110+
4111+	list_add_tail(&conf->list_item, &dev->configs);
4112+
4113+	return conf;
4114+}
4115+
4116+static void free_android_config(struct android_dev *dev,
4117+			     struct android_configuration *conf)
4118+{
4119+	list_del(&conf->list_item);
4120+	dev->configs_num--;
4121+	kfree(conf);
4122+}
4123+
4124+static int usb_diag_update_pid_and_serial_num(u32 pid, const char *snum)
4125+{
4126+	struct dload_struct local_diag_dload = { 0 };
4127+	int *src, *dst, i;
4128+
4129+	if (!diag_dload) {
4130+		pr_debug("%s: unable to update PID and serial_no\n", __func__);
4131+		return -ENODEV;
4132 	}
4133 
4134-	_android_dev = dev;
4135+	pr_debug("%s: dload:%p pid:%x serial_num:%s\n",
4136+				__func__, diag_dload, pid, snum);
4137 
4138-	err = usb_composite_probe(&android_usb_driver);
4139-	if (err) {
4140-		pr_err("%s: failed to probe driver %d", __func__, err);
4141-		goto err_probe;
4142+	/* update pid */
4143+	local_diag_dload.magic_struct.pid = PID_MAGIC_ID;
4144+	local_diag_dload.pid = pid;
4145+
4146+	/* update serial number */
4147+	if (!snum) {
4148+		local_diag_dload.magic_struct.serial_num = 0;
4149+		memset(&local_diag_dload.serial_number, 0,
4150+				SERIAL_NUMBER_LENGTH);
4151+	} else {
4152+		local_diag_dload.magic_struct.serial_num = SERIAL_NUM_MAGIC_ID;
4153+		strlcpy((char *)&local_diag_dload.serial_number, snum,
4154+				SERIAL_NUMBER_LENGTH);
4155 	}
4156 
4157-	/* HACK: exchange composite's setup with ours */
4158-	composite_setup_func = android_usb_driver.gadget_driver.setup;
4159-	android_usb_driver.gadget_driver.setup = android_setup;
4160+	/* Copy to shared struct (accesses need to be 32 bit aligned) */
4161+	src = (int *)&local_diag_dload;
4162+	dst = (int *)diag_dload;
4163+
4164+	for (i = 0; i < sizeof(*diag_dload) / 4; i++)
4165+		*dst++ = *src++;
4166 
4167 	return 0;
4168+}
4169+
4170+static int android_probe(struct platform_device *pdev)
4171+{
4172+	struct android_usb_platform_data *pdata;
4173+	struct android_dev *android_dev;
4174+	struct resource *res;
4175+	int ret = 0, i, len = 0, prop_len = 0;
4176+	u32 usb_core_id = 0;
4177+
4178+	if (pdev->dev.of_node) {
4179+		dev_dbg(&pdev->dev, "device tree enabled\n");
4180+		pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
4181+		if (!pdata) {
4182+			pr_err("unable to allocate platform data\n");
4183+			return -ENOMEM;
4184+		}
4185+
4186+		of_get_property(pdev->dev.of_node, "qcom,pm-qos-latency",
4187+								&prop_len);
4188+		if (prop_len == sizeof(pdata->pm_qos_latency)) {
4189+			of_property_read_u32_array(pdev->dev.of_node,
4190+				"qcom,pm-qos-latency", pdata->pm_qos_latency,
4191+				 prop_len/sizeof(*pdata->pm_qos_latency));
4192+		} else {
4193+			pr_info("pm_qos latency not specified %d\n", prop_len);
4194+		}
4195+
4196+		ret = of_property_read_u32(pdev->dev.of_node,
4197+					"qcom,usb-core-id",
4198+					&usb_core_id);
4199+		if (!ret)
4200+			pdata->usb_core_id = usb_core_id;
4201+
4202+		len = of_property_count_strings(pdev->dev.of_node,
4203+				"qcom,streaming-func");
4204+		if (len > MAX_STREAMING_FUNCS) {
4205+			pr_err("Invalid number of functions used.\n");
4206+			return -EINVAL;
4207+		}
4208+
4209+		for (i = 0; i < len; i++) {
4210+			const char *name = NULL;
4211+
4212+			of_property_read_string_index(pdev->dev.of_node,
4213+				"qcom,streaming-func", i, &name);
4214+
4215+			if (!name)
4216+				continue;
4217 
4218+			if (sizeof(name) > FUNC_NAME_LEN) {
4219+				pr_err("Function name is bigger than allowed.\n");
4220+				continue;
4221+			}
4222+
4223+			strlcpy(pdata->streaming_func[i], name,
4224+				sizeof(pdata->streaming_func[i]));
4225+			pr_debug("name of streaming function:%s\n",
4226+				pdata->streaming_func[i]);
4227+		}
4228+
4229+		pdata->streaming_func_count = len;
4230+
4231+		pdata->cdrom = of_property_read_bool(pdev->dev.of_node,
4232+			"qcom,android-usb-cdrom");
4233+		ret = of_property_read_u8(pdev->dev.of_node,
4234+				"qcom,android-usb-uicc-nluns",
4235+				&pdata->uicc_nluns);
4236+	} else {
4237+		pdata = pdev->dev.platform_data;
4238+	}
4239+
4240+	if (!android_class) {
4241+		android_class = class_create(THIS_MODULE, "android_usb");
4242+		if (IS_ERR(android_class))
4243+			return PTR_ERR(android_class);
4244+	}
4245+
4246+	android_dev = kzalloc(sizeof(*android_dev), GFP_KERNEL);
4247+	if (!android_dev) {
4248+		pr_err("%s(): Failed to alloc memory for android_dev\n",
4249+			__func__);
4250+		ret = -ENOMEM;
4251+		goto err_alloc;
4252+	}
4253+
4254+	android_dev->name = pdev->name;
4255+	android_dev->disable_depth = 1;
4256+	android_dev->functions = supported_functions;
4257+	android_dev->configs_num = 0;
4258+	INIT_LIST_HEAD(&android_dev->configs);
4259+	INIT_WORK(&android_dev->work, android_work);
4260+	INIT_DELAYED_WORK(&android_dev->pm_qos_work, android_pm_qos_work);
4261+	mutex_init(&android_dev->mutex);
4262+
4263+	android_dev->pdata = pdata;
4264+
4265+	list_add_tail(&android_dev->list_item, &android_dev_list);
4266+	android_dev_count++;
4267+
4268+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
4269+	if (res) {
4270+		diag_dload = devm_ioremap(&pdev->dev, res->start,
4271+							resource_size(res));
4272+		if (!diag_dload) {
4273+			dev_err(&pdev->dev, "ioremap failed\n");
4274+			ret = -ENOMEM;
4275+			goto err_dev;
4276+		}
4277+	} else {
4278+		dev_dbg(&pdev->dev, "failed to get mem resource\n");
4279+	}
4280+
4281+	if (pdata)
4282+		android_usb_driver.gadget_driver.usb_core_id =
4283+						pdata->usb_core_id;
4284+	ret = android_create_device(android_dev,
4285+			android_usb_driver.gadget_driver.usb_core_id);
4286+	if (ret) {
4287+		pr_err("%s(): android_create_device failed\n", __func__);
4288+		goto err_dev;
4289+	}
4290+
4291+	pr_debug("%s(): registering android_usb_driver with core id:%d\n",
4292+		__func__, android_usb_driver.gadget_driver.usb_core_id);
4293+	ret = usb_composite_probe(&android_usb_driver);
4294+	if (ret) {
4295+		/* Perhaps UDC hasn't probed yet, try again later */
4296+		if (ret == -ENODEV)
4297+			ret = -EPROBE_DEFER;
4298+		else
4299+			pr_err("%s(): Failed to register android composite driver\n",
4300+				__func__);
4301+		goto err_probe;
4302+	}
4303+
4304+	/* pm qos request to prevent apps idle power collapse */
4305+	android_dev->curr_pm_qos_state = NO_USB_VOTE;
4306+	if (pdata && pdata->pm_qos_latency[0]) {
4307+		pm_qos_add_request(&android_dev->pm_qos_req_dma,
4308+			PM_QOS_CPU_DMA_LATENCY, PM_QOS_DEFAULT_VALUE);
4309+		android_dev->down_pm_qos_sample_sec = DOWN_PM_QOS_SAMPLE_SEC;
4310+		android_dev->down_pm_qos_threshold = DOWN_PM_QOS_THRESHOLD;
4311+		android_dev->up_pm_qos_sample_sec = UP_PM_QOS_SAMPLE_SEC;
4312+		android_dev->up_pm_qos_threshold = UP_PM_QOS_THRESHOLD;
4313+		android_dev->idle_pc_rpm_no_int_secs = IDLE_PC_RPM_NO_INT_SECS;
4314+	}
4315+	strlcpy(android_dev->pm_qos, "high", sizeof(android_dev->pm_qos));
4316+
4317+	return ret;
4318 err_probe:
4319-	device_destroy(android_class, dev->dev->devt);
4320-err_create:
4321-	kfree(dev);
4322+	android_destroy_device(android_dev);
4323 err_dev:
4324-	class_destroy(android_class);
4325-	return err;
4326+	list_del(&android_dev->list_item);
4327+	android_dev_count--;
4328+	kfree(android_dev);
4329+err_alloc:
4330+	if (list_empty(&android_dev_list)) {
4331+		class_destroy(android_class);
4332+		android_class = NULL;
4333+	}
4334+	return ret;
4335+}
4336+
4337+static int android_remove(struct platform_device *pdev)
4338+{
4339+	struct android_dev *dev = NULL;
4340+	struct android_usb_platform_data *pdata = pdev->dev.platform_data;
4341+	int usb_core_id = 0;
4342+
4343+	if (pdata)
4344+		usb_core_id = pdata->usb_core_id;
4345+
4346+	/* Find the android dev from the list */
4347+	list_for_each_entry(dev, &android_dev_list, list_item) {
4348+		if (!dev->pdata)
4349+			break; /*To backward compatibility*/
4350+		if (dev->pdata->usb_core_id == usb_core_id)
4351+			break;
4352+	}
4353+
4354+	if (dev) {
4355+		android_destroy_device(dev);
4356+		if (pdata && pdata->pm_qos_latency[0])
4357+			pm_qos_remove_request(&dev->pm_qos_req_dma);
4358+		list_del(&dev->list_item);
4359+		android_dev_count--;
4360+		kfree(dev);
4361+	}
4362+
4363+	if (list_empty(&android_dev_list)) {
4364+		class_destroy(android_class);
4365+		android_class = NULL;
4366+		usb_composite_unregister(&android_usb_driver);
4367+	}
4368+
4369+	return 0;
4370+}
4371+
4372+static const struct platform_device_id android_id_table[] = {
4373+	{
4374+		.name = "android_usb",
4375+	},
4376+	{
4377+		.name = "android_usb_hsic",
4378+	},
4379+};
4380+
4381+static struct of_device_id usb_android_dt_match[] = {
4382+	{	.compatible = "qcom,android-usb",
4383+	},
4384+	{}
4385+};
4386+
4387+static struct platform_driver android_platform_driver = {
4388+	.driver = {
4389+		.name = "android_usb",
4390+		.of_match_table = usb_android_dt_match,
4391+	},
4392+	.probe = android_probe,
4393+	.remove = android_remove,
4394+	.id_table = android_id_table,
4395+};
4396+
4397+static int __init init(void)
4398+{
4399+	int ret;
4400+
4401+	INIT_LIST_HEAD(&android_dev_list);
4402+	android_dev_count = 0;
4403+
4404+	ret = platform_driver_register(&android_platform_driver);
4405+	if (ret) {
4406+		pr_err("%s(): Failed to register android"
4407+				 "platform driver\n", __func__);
4408+	}
4409+
4410+	/* HACK: exchange composite's setup with ours */
4411+	composite_setup_func = android_usb_driver.gadget_driver.setup;
4412+	android_usb_driver.gadget_driver.setup = android_setup;
4413+	composite_suspend_func = android_usb_driver.gadget_driver.suspend;
4414+	android_usb_driver.gadget_driver.suspend = android_suspend;
4415+	composite_resume_func = android_usb_driver.gadget_driver.resume;
4416+	android_usb_driver.gadget_driver.resume = android_resume;
4417+
4418+	return ret;
4419 }
4420 late_initcall(init);
4421 
4422 static void __exit cleanup(void)
4423 {
4424-	usb_composite_unregister(&android_usb_driver);
4425-	class_destroy(android_class);
4426-	kfree(_android_dev);
4427-	_android_dev = NULL;
4428+	platform_driver_unregister(&android_platform_driver);
4429 }
4430 module_exit(cleanup);
4431diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
4432index 2ec1a44..6bd85d9 100644
4433--- a/drivers/usb/gadget/composite.c
4434+++ b/drivers/usb/gadget/composite.c
4435@@ -33,9 +33,6 @@ static struct usb_gadget_strings **get_containers_gs(
4436 {
4437 	return (struct usb_gadget_strings **)uc->stash;
4438 }
4439-#define USB_PRE_CONFIG_CURRENT		100
4440-#define USB_OTG_PRE_CONFIG_CURRENT	2
4441-
4442 
4443 /**
4444  * next_ep_desc() - advance to the next EP descriptor
4445@@ -341,6 +338,113 @@ int usb_interface_id(struct usb_configuration *config,
4446 }
4447 EXPORT_SYMBOL_GPL(usb_interface_id);
4448 
4449+/**
4450+ * usb_get_func_interface_id() - Find the interface ID of a function
4451+ * @function: the function for which want to find the interface ID
4452+ * Context: single threaded
4453+ *
4454+ * Returns the interface ID of the function or -ENODEV if this function
4455+ * is not part of this configuration
4456+ */
4457+int usb_get_func_interface_id(struct usb_function *func)
4458+{
4459+	int id;
4460+	struct usb_configuration *config;
4461+
4462+	if (!func)
4463+		return -EINVAL;
4464+
4465+	config = func->config;
4466+
4467+	for (id = 0; id < MAX_CONFIG_INTERFACES; id++) {
4468+		if (config->interface[id] == func)
4469+			return id;
4470+	}
4471+	return -ENODEV;
4472+}
4473+
4474+static int usb_func_wakeup_int(struct usb_function *func,
4475+					bool use_pending_flag)
4476+{
4477+	int ret;
4478+	int interface_id;
4479+	unsigned long flags;
4480+	struct usb_gadget *gadget;
4481+	struct usb_composite_dev *cdev;
4482+
4483+	pr_debug("%s - %s function wakeup, use pending: %u\n",
4484+		__func__, func->name ? func->name : "", use_pending_flag);
4485+
4486+	if (!func || !func->config || !func->config->cdev ||
4487+		!func->config->cdev->gadget)
4488+		return -EINVAL;
4489+
4490+	gadget = func->config->cdev->gadget;
4491+	if ((gadget->speed != USB_SPEED_SUPER) || !func->func_wakeup_allowed) {
4492+		DBG(func->config->cdev,
4493+			"Function Wakeup is not possible. speed=%u, func_wakeup_allowed=%u\n",
4494+			gadget->speed,
4495+			func->func_wakeup_allowed);
4496+
4497+		return -ENOTSUPP;
4498+	}
4499+
4500+	cdev = get_gadget_data(gadget);
4501+	spin_lock_irqsave(&cdev->lock, flags);
4502+
4503+	if (use_pending_flag && !func->func_wakeup_pending) {
4504+		pr_debug("Pending flag is cleared - Function wakeup is cancelled.\n");
4505+		spin_unlock_irqrestore(&cdev->lock, flags);
4506+		return 0;
4507+	}
4508+
4509+	ret = usb_get_func_interface_id(func);
4510+	if (ret < 0) {
4511+		ERROR(func->config->cdev,
4512+			"Function %s - Unknown interface id. Canceling USB request. ret=%d\n",
4513+			func->name ? func->name : "", ret);
4514+
4515+		spin_unlock_irqrestore(&cdev->lock, flags);
4516+		return ret;
4517+	}
4518+
4519+	interface_id = ret;
4520+	ret = usb_gadget_func_wakeup(gadget, interface_id);
4521+
4522+	if (use_pending_flag) {
4523+		func->func_wakeup_pending = false;
4524+	} else {
4525+		if (ret == -EAGAIN)
4526+			func->func_wakeup_pending = true;
4527+	}
4528+
4529+	spin_unlock_irqrestore(&cdev->lock, flags);
4530+
4531+	return ret;
4532+}
4533+
4534+int usb_func_wakeup(struct usb_function *func)
4535+{
4536+	int ret;
4537+
4538+	pr_debug("%s function wakeup\n",
4539+		func->name ? func->name : "");
4540+
4541+	ret = usb_func_wakeup_int(func, false);
4542+	if (ret == -EAGAIN) {
4543+		DBG(func->config->cdev,
4544+			"Function wakeup for %s could not complete due to suspend state. Delayed until after bus resume.\n",
4545+			func->name ? func->name : "");
4546+		ret = 0;
4547+	} else if (ret < 0 && ret != -ENOTSUPP) {
4548+		ERROR(func->config->cdev,
4549+			"Failed to wake function %s from suspend state. ret=%d. Canceling USB request.\n",
4550+			func->name ? func->name : "", ret);
4551+	}
4552+
4553+	return ret;
4554+}
4555+
4556 static u8 encode_bMaxPower(enum usb_device_speed speed,
4557 		struct usb_configuration *c)
4558 {
4559@@ -523,7 +627,8 @@ static int bos_desc(struct usb_composite_dev *cdev)
4560 
4561 	/*
4562 	 * A SuperSpeed device shall include the USB2.0 extension descriptor
4563-	 * and shall support LPM when operating in USB2.0 HS mode.
4564+	 * and shall support LPM when operating in USB2.0 HS mode, as well as
4565+	 * a HS device when operating in USB2.1 HS mode.
4566 	 */
4567 	usb_ext = cdev->req->buf + le16_to_cpu(bos->wTotalLength);
4568 	bos->bNumDeviceCaps++;
4569@@ -533,33 +638,37 @@ static int bos_desc(struct usb_composite_dev *cdev)
4570 	usb_ext->bDevCapabilityType = USB_CAP_TYPE_EXT;
4571 	usb_ext->bmAttributes = cpu_to_le32(USB_LPM_SUPPORT);
4572 
4573-	/*
4574-	 * The Superspeed USB Capability descriptor shall be implemented by all
4575-	 * SuperSpeed devices.
4576-	 */
4577-	ss_cap = cdev->req->buf + le16_to_cpu(bos->wTotalLength);
4578-	bos->bNumDeviceCaps++;
4579-	le16_add_cpu(&bos->wTotalLength, USB_DT_USB_SS_CAP_SIZE);
4580-	ss_cap->bLength = USB_DT_USB_SS_CAP_SIZE;
4581-	ss_cap->bDescriptorType = USB_DT_DEVICE_CAPABILITY;
4582-	ss_cap->bDevCapabilityType = USB_SS_CAP_TYPE;
4583-	ss_cap->bmAttributes = 0; /* LTM is not supported yet */
4584-	ss_cap->wSpeedSupported = cpu_to_le16(USB_LOW_SPEED_OPERATION |
4585-				USB_FULL_SPEED_OPERATION |
4586-				USB_HIGH_SPEED_OPERATION |
4587-				USB_5GBPS_OPERATION);
4588-	ss_cap->bFunctionalitySupport = USB_LOW_SPEED_OPERATION;
4589-
4590-	/* Get Controller configuration */
4591-	if (cdev->gadget->ops->get_config_params)
4592-		cdev->gadget->ops->get_config_params(&dcd_config_params);
4593-	else {
4594-		dcd_config_params.bU1devExitLat = USB_DEFAULT_U1_DEV_EXIT_LAT;
4595-		dcd_config_params.bU2DevExitLat =
4596-			cpu_to_le16(USB_DEFAULT_U2_DEV_EXIT_LAT);
4597+	if (gadget_is_superspeed(cdev->gadget)) {
4598+		/*
4599+		 * The Superspeed USB Capability descriptor shall be
4600+		 * implemented by all SuperSpeed devices.
4601+		 */
4602+		ss_cap = cdev->req->buf + le16_to_cpu(bos->wTotalLength);
4603+		bos->bNumDeviceCaps++;
4604+		le16_add_cpu(&bos->wTotalLength, USB_DT_USB_SS_CAP_SIZE);
4605+		ss_cap->bLength = USB_DT_USB_SS_CAP_SIZE;
4606+		ss_cap->bDescriptorType = USB_DT_DEVICE_CAPABILITY;
4607+		ss_cap->bDevCapabilityType = USB_SS_CAP_TYPE;
4608+		ss_cap->bmAttributes = 0; /* LTM is not supported yet */
4609+		ss_cap->wSpeedSupported = cpu_to_le16(USB_LOW_SPEED_OPERATION |
4610+					USB_FULL_SPEED_OPERATION |
4611+					USB_HIGH_SPEED_OPERATION |
4612+					USB_5GBPS_OPERATION);
4613+		ss_cap->bFunctionalitySupport = USB_LOW_SPEED_OPERATION;
4614+
4615+		/* Get Controller configuration */
4616+		if (cdev->gadget->ops->get_config_params)
4617+			cdev->gadget->ops->get_config_params
4618+				(&dcd_config_params);
4619+		else {
4620+			dcd_config_params.bU1devExitLat =
4621+				USB_DEFAULT_U1_DEV_EXIT_LAT;
4622+			dcd_config_params.bU2DevExitLat =
4623+				cpu_to_le16(USB_DEFAULT_U2_DEV_EXIT_LAT);
4624+		}
4625+		ss_cap->bU1devExitLat = dcd_config_params.bU1devExitLat;
4626+		ss_cap->bU2DevExitLat = dcd_config_params.bU2DevExitLat;
4627 	}
4628-	ss_cap->bU1devExitLat = dcd_config_params.bU1devExitLat;
4629-	ss_cap->bU2DevExitLat = dcd_config_params.bU2DevExitLat;
4630 
4631 	return le16_to_cpu(bos->wTotalLength);
4632 }
4633@@ -593,9 +702,15 @@ static void reset_config(struct usb_composite_dev *cdev)
4634 		if (f->disable)
4635 			f->disable(f);
4636 
4637+		/* USB 3.0 addition */
4638+		f->func_is_suspended = false;
4639+		f->func_wakeup_allowed = false;
4640+		f->func_wakeup_pending = false;
4641+
4642 		bitmap_zero(f->endpoints, 32);
4643 	}
4644 	cdev->config = NULL;
4645+	cdev->delayed_status = 0;
4646 }
4647 
4648 static int set_config(struct usb_composite_dev *cdev,
4649@@ -607,6 +722,16 @@ static int set_config(struct usb_composite_dev *cdev,
4650 	unsigned		power = gadget_is_otg(gadget) ? 8 : 100;
4651 	int			tmp;
4652 
4653+	/*
4654+	 * ignore 2nd time SET_CONFIGURATION
4655+	 * only for same config value twice.
4656+	 */
4657+	if (cdev->config && (cdev->config->bConfigurationValue == number)) {
4658+		DBG(cdev, "already in the same config with value %d\n",
4659+				number);
4660+		return 0;
4661+	}
4662+
4663 	if (number) {
4664 		list_for_each_entry(c, &cdev->configs, list) {
4665 			if (c->bConfigurationValue == number) {
4666@@ -637,6 +762,8 @@ static int set_config(struct usb_composite_dev *cdev,
4667 		goto done;
4668 
4669 	cdev->config = c;
4670+	c->num_ineps_used = 0;
4671+	c->num_outeps_used = 0;
4672 
4673 	/* Initialize all interfaces by setting them to altsetting zero. */
4674 	for (tmp = 0; tmp < MAX_CONFIG_INTERFACES; tmp++) {
4675@@ -674,6 +801,10 @@ static int set_config(struct usb_composite_dev *cdev,
4676 			addr = ((ep->bEndpointAddress & 0x80) >> 3)
4677 			     |  (ep->bEndpointAddress & 0x0f);
4678 			set_bit(addr, f->endpoints);
4679+			if (usb_endpoint_dir_in(ep))
4680+				c->num_ineps_used++;
4681+			else
4682+				c->num_outeps_used++;
4683 		}
4684 
4685 		result = f->set_alt(f, tmp, 0);
4686@@ -852,6 +983,11 @@ void usb_remove_config(struct usb_composite_dev *cdev,
4687 
4688 	spin_lock_irqsave(&cdev->lock, flags);
4689 
4690+	if (WARN_ON(!config->cdev)) {
4691+		spin_unlock_irqrestore(&cdev->lock, flags);
4692+		return;
4693+	}
4694+
4695 	if (cdev->config == config)
4696 		reset_config(cdev);
4697 
4698@@ -1229,7 +1365,11 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
4699 	u16				w_length = le16_to_cpu(ctrl->wLength);
4700 	struct usb_function		*f = NULL;
4701 	u8				endp;
4702-	struct usb_otg_descriptor*	potgdesc;
4703+	struct usb_configuration *c;
4704+
4705+
4706+	if (w_length > USB_COMP_EP0_BUFSIZ)
4707+		return value;
4708 
4709 	/* partial re-init of the response message; the function or the
4710 	 * gadget might need to intercept e.g. a control-OUT completion
4711@@ -1260,22 +1400,14 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
4712 				} else {
4713 					cdev->desc.bcdUSB = cpu_to_le16(0x0210);
4714 				}
4715+			} else if (gadget->l1_supported) {
4716+				cdev->desc.bcdUSB = cpu_to_le16(0x0201);
4717+				DBG(cdev, "Config HS device with LPM(L1)\n");
4718 			}
4719 
4720 			value = min(w_length, (u16) sizeof cdev->desc);
4721 			memcpy(req->buf, &cdev->desc, value);
4722 			break;
4723-
4724-		case USB_DT_OTG:
4725-			value = min(w_length, (u16) sizeof(struct usb_otg_descriptor));
4726-			potgdesc = (struct usb_otg_descriptor* )req->buf;
4727-			potgdesc->bLength = (u16) sizeof(struct usb_otg_descriptor);
4728-			potgdesc->bDescriptorType = USB_DT_OTG;
4729-			potgdesc->bmAttributes = 0;
4730-			potgdesc->bcdOTG = __constant_cpu_to_le16(0x0200);
4731-
4732-			break;
4733-
4734 		case USB_DT_DEVICE_QUALIFIER:
4735 			if (!gadget_is_dualspeed(gadget) ||
4736 			    gadget->speed >= USB_SPEED_SUPER)
4737@@ -1294,6 +1426,17 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
4738 			if (value >= 0)
4739 				value = min(w_length, (u16) value);
4740 			break;
4741+		case USB_DT_OTG:
4742+			if (!gadget_is_otg(gadget))
4743+				break;
4744+			c = list_first_entry(&cdev->configs,
4745+				struct usb_configuration, list);
4746+			if (c && c->descriptors)
4747+				value = usb_find_descriptor_fillbuf(req->buf,
4748+						USB_COMP_EP0_BUFSIZ,
4749+						c->descriptors,
4750+						USB_DT_OTG);
4751+			break;
4752 		case USB_DT_STRING:
4753 			value = get_string(cdev, req->buf,
4754 					w_index, w_value & 0xff);
4755@@ -1301,7 +1444,8 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
4756 				value = min(w_length, (u16) value);
4757 			break;
4758 		case USB_DT_BOS:
4759-			if (gadget_is_superspeed(gadget)) {
4760+			if (gadget_is_superspeed(gadget) ||
4761+				gadget->l1_supported) {
4762 				value = bos_desc(cdev);
4763 				value = min(w_length, (u16) value);
4764 			}
4765@@ -1348,6 +1492,15 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
4766 			break;
4767 		if (w_value && !f->set_alt)
4768 			break;
4769+		/*
4770+		 * We put interfaces in default settings (alt 0)
4771+		 * upon set config#1. Call set_alt for non-zero
4772+		 * alternate setting.
4773+		 */
4774+		if (!w_value && cdev->config && !f->get_alt) {
4775+			value = 0;
4776+			break;
4777+		}
4778 		value = f->set_alt(f, w_index, w_value);
4779 		if (value == USB_GADGET_DELAYED_STATUS) {
4780 			DBG(cdev,
4781@@ -1417,8 +1570,13 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
4782 			if (!f)
4783 				break;
4784 			value = 0;
4785-			if (f->func_suspend)
4786-				value = f->func_suspend(f, w_index >> 8);
4787+			if (f->func_suspend) {
4788+				const u8 suspend_opt = w_index >> 8;
4789+
4790+				value = f->func_suspend(f, suspend_opt);
4791+				DBG(cdev, "%s function: FUNCTION_SUSPEND(%u)",
4792+					f->name ? f->name : "", suspend_opt);
4793+			}
4794 			if (value < 0) {
4795 				ERROR(cdev,
4796 				      "func_suspend() returned error %d\n",
4797@@ -1470,6 +1628,14 @@ unknown:
4798 			if (c && c->setup)
4799 				value = c->setup(c, ctrl);
4800 		}
4801+		if (f && value == USB_GADGET_DELAYED_STATUS) {
4802+			DBG(cdev,
4803+			 "%s: interface %d (%s) requested delayed status\n",
4804+					__func__, intf, f->name);
4805+			cdev->delayed_status++;
4806+			DBG(cdev, "delayed_status count %d\n",
4807+					cdev->delayed_status);
4808+		}
4809 
4810 		goto done;
4811 	}
4812@@ -1508,11 +1674,11 @@ void composite_disconnect(struct usb_gadget *gadget)
4813 		reset_config(cdev);
4814 	if (cdev->driver->disconnect)
4815 		cdev->driver->disconnect(cdev);
4816+	if (cdev->delayed_status != 0) {
4817+		INFO(cdev, "delayed status mismatch..resetting\n");
4818+		cdev->delayed_status = 0;
4819+	}
4820 	spin_unlock_irqrestore(&cdev->lock, flags);
4821-
4822-	usb_gadget_vbus_draw(gadget,
4823-		gadget_is_otg(gadget) ? USB_OTG_PRE_CONFIG_CURRENT :
4824-		    USB_PRE_CONFIG_CURRENT);
4825 }
4826 
4827 /*-------------------------------------------------------------------------*/
4828@@ -1737,6 +1903,7 @@ composite_resume(struct usb_gadget *gadget)
4829 	struct usb_composite_dev	*cdev = get_gadget_data(gadget);
4830 	struct usb_function		*f;
4831 	u8				maxpower;
4832+	int ret;
4833 
4834 	/* REVISIT:  should we have config level
4835 	 * suspend/resume callbacks?
4836@@ -1744,8 +1911,24 @@ composite_resume(struct usb_gadget *gadget)
4837 	DBG(cdev, "resume\n");
4838 	if (cdev->driver->resume)
4839 		cdev->driver->resume(cdev);
4840+
4841 	if (cdev->config) {
4842 		list_for_each_entry(f, &cdev->config->functions, list) {
4843+			ret = usb_func_wakeup_int(f, true);
4844+			if (ret) {
4845+				if (ret == -EAGAIN) {
4846+					ERROR(f->config->cdev,
4847+						"Function wakeup for %s could not complete due to suspend state.\n",
4848+						f->name ? f->name : "");
4849+					break;
4850+				} else if (ret != -ENOTSUPP) {
4851+					ERROR(f->config->cdev,
4852+						"Failed to wake function %s from suspend state. ret=%d. Canceling USB request.\n",
4853+						f->name ? f->name : "",
4854+						ret);
4855+				}
4856+			}
4857+
4858 			if (f->resume)
4859 				f->resume(f);
4860 		}
4861@@ -1795,6 +1978,7 @@ static const struct usb_gadget_driver composite_driver_template = {
4862 int usb_composite_probe(struct usb_composite_driver *driver)
4863 {
4864 	struct usb_gadget_driver *gadget_driver;
4865+	u8 core_id;
4866 
4867 	if (!driver || !driver->dev || !driver->bind)
4868 		return -EINVAL;
4869@@ -1802,6 +1986,7 @@ int usb_composite_probe(struct usb_composite_driver *driver)
4870 	if (!driver->name)
4871 		driver->name = "composite";
4872 
4873+	core_id = driver->gadget_driver.usb_core_id;
4874 	driver->gadget_driver = composite_driver_template;
4875 	gadget_driver = &driver->gadget_driver;
4876 
4877@@ -1809,6 +1994,11 @@ int usb_composite_probe(struct usb_composite_driver *driver)
4878 	gadget_driver->driver.name = driver->name;
4879 	gadget_driver->max_speed = driver->max_speed;
4880 
4881+	if (core_id)
4882+		gadget_driver->usb_core_id = core_id;
4883+
4884+	pr_debug("%s(): gadget_driver->usb_core_id:%d\n", __func__,
4885+					gadget_driver->usb_core_id);
4886 	return usb_gadget_probe_driver(gadget_driver);
4887 }
4888 EXPORT_SYMBOL_GPL(usb_composite_probe);
4889diff --git a/drivers/usb/gadget/f_acm.c b/drivers/usb/gadget/f_acm.c
4890index 8892f63..2ca35e52 100644
4891--- a/drivers/usb/gadget/f_acm.c
4892+++ b/drivers/usb/gadget/f_acm.c
4893@@ -5,6 +5,7 @@
4894  * Copyright (C) 2008 by David Brownell
4895  * Copyright (C) 2008 by Nokia Corporation
4896  * Copyright (C) 2009 by Samsung Electronics
4897+ * Copyright (c) 2011, 2014 The Linux Foundation. All rights reserved.
4898  * Author: Michal Nazarewicz (mina86@mina86.com)
4899  *
4900  * This software is distributed under the terms of the GNU General
4901@@ -20,12 +21,11 @@
4902 #include <linux/device.h>
4903 #include <linux/err.h>
4904 
4905+#include "usb_gadget_xport.h"
4906 #include "u_serial.h"
4907 #include "gadget_chips.h"
4908 
4909 
4910-static struct acm_logging_callbacks *acm_logging_cb;
4911-
4912 /*
4913  * This CDC ACM function support just wraps control functions and
4914  * notifications around the generic serial-over-usb code.
4915@@ -47,6 +47,7 @@ struct f_acm {
4916 	struct gserial			port;
4917 	u8				ctrl_id, data_id;
4918 	u8				port_num;
4919+	enum transport_type		transport;
4920 
4921 	u8				pending;
4922 
4923@@ -77,6 +78,19 @@ struct f_acm {
4924 #define ACM_CTRL_DCD		(1 << 0)
4925 };
4926 
4927+static unsigned int no_acm_tty_ports;
4928+static unsigned int no_acm_smd_ports;
4929+static unsigned int nr_acm_ports;
4930+static unsigned int acm_next_free_port;
4931+
4932+#define GSERIAL_NO_PORTS 4
4933+
4934+static struct acm_port_info {
4935+	enum transport_type	transport;
4936+	unsigned		port_num;
4937+	unsigned char		client_port_num;
4938+} gacm_ports[GSERIAL_NO_PORTS];
4939+
4940 static inline struct f_acm *func_to_acm(struct usb_function *f)
4941 {
4942 	return container_of(f, struct f_acm, port.func);
4943@@ -87,6 +101,87 @@ static inline struct f_acm *port_to_acm(struct gserial *p)
4944 	return container_of(p, struct f_acm, port);
4945 }
4946 
4947+int acm_port_setup(struct usb_configuration *c)
4948+{
4949+	int ret = 0, i;
4950+
4951+	pr_debug("%s: no_acm_tty_ports:%u nr_acm_ports:%u\n",
4952+			__func__, no_acm_tty_ports, nr_acm_ports);
4953+
4954+	if (no_acm_tty_ports) {
4955+		for (i = 0; i < no_acm_tty_ports; i++) {
4956+			ret = gserial_alloc_line(
4957+					&gacm_ports[i].client_port_num);
4958+			if (ret)
4959+				return ret;
4960+		}
4961+	}
4962+	if (no_acm_smd_ports)
4963+		ret = gsmd_setup(c->cdev->gadget, no_acm_smd_ports);
4964+
4965+	return ret;
4966+}
4967+
4968+void acm_port_cleanup(void)
4969+{
4970+	int i;
4971+
4972+	for (i = 0; i < no_acm_tty_ports; i++)
4973+		gserial_free_line(gacm_ports[i].client_port_num);
4974+}
4975+
4976+static int acm_port_connect(struct f_acm *acm)
4977+{
4978+	unsigned port_num;
4979+
4980+	port_num = gacm_ports[acm->port_num].client_port_num;
4981+
4982+
4983+	pr_debug("%s: transport:%s f_acm:%p gserial:%p port_num:%d cl_port_no:%d\n",
4984+			__func__, xport_to_str(acm->transport),
4985+			acm, &acm->port, acm->port_num, port_num);
4986+
4987+	switch (acm->transport) {
4988+	case USB_GADGET_XPORT_TTY:
4989+		gserial_connect(&acm->port, port_num);
4990+		break;
4991+	case USB_GADGET_XPORT_SMD:
4992+		gsmd_connect(&acm->port, port_num);
4993+		break;
4994+	default:
4995+		pr_err("%s: Un-supported transport: %s\n", __func__,
4996+				xport_to_str(acm->transport));
4997+		return -ENODEV;
4998+	}
4999+
5000+	return 0;
5001+}
5002+
5003+static int acm_port_disconnect(struct f_acm *acm)
5004+{
5005+	unsigned port_num;
5006+
5007+	port_num = gacm_ports[acm->port_num].client_port_num;
5008+
5009+	pr_debug("%s: transport:%s f_acm:%p gserial:%p port_num:%d cl_pno:%d\n",
5010+			__func__, xport_to_str(acm->transport),
5011+			acm, &acm->port, acm->port_num, port_num);
5012+
5013+	switch (acm->transport) {
5014+	case USB_GADGET_XPORT_TTY:
5015+		gserial_disconnect(&acm->port);
5016+		break;
5017+	case USB_GADGET_XPORT_SMD:
5018+		gsmd_disconnect(&acm->port, port_num);
5019+		break;
5020+	default:
5021+		pr_err("%s: Un-supported transport:%s\n", __func__,
5022+				xport_to_str(acm->transport));
5023+		return -ENODEV;
5024+	}
5025+
5026+	return 0;
5027+}
5028 /*-------------------------------------------------------------------------*/
5029 
5030 /* notification endpoint uses smallish and infrequent fixed-size messages */
5031@@ -300,23 +395,6 @@ static struct usb_gadget_strings *acm_strings[] = {
5032 	NULL,
5033 };
5034 
5035-#ifdef CONFIG_BRCM_FUSE_LOG
5036-
5037-/**
5038-* This function is called to register the callback functions for logging modules.
5039-*
5040-* @return    1: ready to send to logging data; 0: not ready to send the logging data.
5041-*
5042-*/
5043-char acm_logging_register_callbacks(struct acm_logging_callbacks *_cb)
5044-{
5045-	pr_info("%s\n", __func__);
5046-	acm_logging_cb = _cb;
5047-	return 0;	/* logging is not ready to send */
5048-}
5049-EXPORT_SYMBOL(acm_logging_register_callbacks);
5050-#endif
5051-
5052 /*-------------------------------------------------------------------------*/
5053 
5054 /* ACM control ... data handling is delegated to tty library code.
5055@@ -412,6 +490,12 @@ static int acm_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
5056 		 * that bit, we should return to that no-flow state.
5057 		 */
5058 		acm->port_handshake_bits = w_value;
5059+		if (acm->port.notify_modem) {
5060+			unsigned port_num =
5061+				gacm_ports[acm->port_num].client_port_num;
5062+
5063+			acm->port.notify_modem(&acm->port, port_num, w_value);
5064+		}
5065 		break;
5066 
5067 	default:
5068@@ -460,7 +544,7 @@ static int acm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
5069 	} else if (intf == acm->data_id) {
5070 		if (acm->port.in->driver_data) {
5071 			DBG(cdev, "reset acm ttyGS%d\n", acm->port_num);
5072-			gserial_disconnect(&acm->port);
5073+			acm_port_disconnect(acm);
5074 		}
5075 		if (!acm->port.in->desc || !acm->port.out->desc) {
5076 			DBG(cdev, "activate acm ttyGS%d\n", acm->port_num);
5077@@ -473,7 +557,7 @@ static int acm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
5078 				return -EINVAL;
5079 			}
5080 		}
5081-		gserial_connect(&acm->port, acm->port_num);
5082+		acm_port_connect(acm);
5083 
5084 	} else
5085 		return -EINVAL;
5086@@ -487,7 +571,7 @@ static void acm_disable(struct usb_function *f)
5087 	struct usb_composite_dev *cdev = f->config->cdev;
5088 
5089 	DBG(cdev, "acm ttyGS%d deactivated\n", acm->port_num);
5090-	gserial_disconnect(&acm->port);
5091+	acm_port_disconnect(acm);
5092 	usb_ep_disable(acm->notify);
5093 	acm->notify->driver_data = NULL;
5094 }
5095@@ -592,30 +676,14 @@ static void acm_connect(struct gserial *port)
5096 {
5097 	struct f_acm		*acm = port_to_acm(port);
5098 
5099-	pr_info("%s", __func__);
5100-
5101 	acm->serial_state |= ACM_CTRL_DSR | ACM_CTRL_DCD;
5102 	acm_notify_serial_state(acm);
5103-
5104-#ifdef CONFIG_BRCM_FUSE_LOG
5105-	if (acm->port_num == ACM_LOGGING_PORT)
5106-		if (acm_logging_cb->start)
5107-			acm_logging_cb->start();
5108-#endif
5109 }
5110 
5111 static void acm_disconnect(struct gserial *port)
5112 {
5113 	struct f_acm		*acm = port_to_acm(port);
5114 
5115-	pr_info("%s", __func__);
5116-
5117-#ifdef CONFIG_BRCM_FUSE_LOG
5118-	if (acm->port_num == ACM_LOGGING_PORT)
5119-		if (acm_logging_cb->stop)
5120-			acm_logging_cb->stop();
5121-#endif
5122-
5123 	acm->serial_state &= ~(ACM_CTRL_DSR | ACM_CTRL_DCD);
5124 	acm_notify_serial_state(acm);
5125 }
5126@@ -634,6 +702,15 @@ static int acm_send_break(struct gserial *port, int duration)
5127 	return acm_notify_serial_state(acm);
5128 }
5129 
5130+static int acm_send_modem_ctrl_bits(struct gserial *port, int ctrl_bits)
5131+{
5132+	struct f_acm *acm = port_to_acm(port);
5133+
5134+	acm->serial_state = ctrl_bits;
5135+
5136+	return acm_notify_serial_state(acm);
5137+}
5138+
5139 /*-------------------------------------------------------------------------*/
5140 
5141 /* ACM function driver setup/binding */
5142@@ -732,9 +809,6 @@ acm_bind(struct usb_configuration *c, struct usb_function *f)
5143 			gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
5144 			acm->port.in->name, acm->port.out->name,
5145 			acm->notify->name);
5146-#ifdef CONFIG_BRCM_FUSE_LOG
5147-	acm_logging_cb = get_acm_callback_func();
5148-#endif
5149 	return 0;
5150 
5151 fail:
5152@@ -769,6 +843,7 @@ static void acm_free_func(struct usb_function *f)
5153 	struct f_acm		*acm = func_to_acm(f);
5154 
5155 	kfree(acm);
5156+	acm_next_free_port--;
5157 }
5158 
5159 static struct usb_function *acm_alloc_func(struct usb_function_instance *fi)
5160@@ -780,11 +855,18 @@ static struct usb_function *acm_alloc_func(struct usb_function_instance *fi)
5161 	if (!acm)
5162 		return ERR_PTR(-ENOMEM);
5163 
5164+	opts = container_of(fi, struct f_serial_opts, func_inst);
5165+
5166 	spin_lock_init(&acm->lock);
5167 
5168+	if (nr_acm_ports)
5169+		opts->port_num = acm_next_free_port++;
5170+
5171+	acm->transport = gacm_ports[opts->port_num].transport;
5172 	acm->port.connect = acm_connect;
5173 	acm->port.disconnect = acm_disconnect;
5174 	acm->port.send_break = acm_send_break;
5175+	acm->port.send_modem_ctrl_bits = acm_send_modem_ctrl_bits;
5176 
5177 	acm->port.func.name = "acm";
5178 	acm->port.func.strings = acm_strings;
5179@@ -794,7 +876,6 @@ static struct usb_function *acm_alloc_func(struct usb_function_instance *fi)
5180 	acm->port.func.setup = acm_setup;
5181 	acm->port.func.disable = acm_disable;
5182 
5183-	opts = container_of(fi, struct f_serial_opts, func_inst);
5184 	acm->port_num = opts->port_num;
5185 	acm->port.func.unbind = acm_unbind;
5186 	acm->port.func.free_func = acm_free_func;
5187@@ -860,7 +941,9 @@ static void acm_free_instance(struct usb_function_instance *fi)
5188 	struct f_serial_opts *opts;
5189 
5190 	opts = container_of(fi, struct f_serial_opts, func_inst);
5191-	gserial_free_line(opts->port_num);
5192+	if (!nr_acm_ports)
5193+		gserial_free_line(opts->port_num);
5194+
5195 	kfree(opts);
5196 }
5197 
5198@@ -873,10 +956,12 @@ static struct usb_function_instance *acm_alloc_instance(void)
5199 	if (!opts)
5200 		return ERR_PTR(-ENOMEM);
5201 	opts->func_inst.free_func_inst = acm_free_instance;
5202-	ret = gserial_alloc_line(&opts->port_num);
5203-	if (ret) {
5204-		kfree(opts);
5205-		return ERR_PTR(ret);
5206+	if (!nr_acm_ports) {
5207+		ret = gserial_alloc_line(&opts->port_num);
5208+		if (ret) {
5209+			kfree(opts);
5210+			return ERR_PTR(ret);
5211+		}
5212 	}
5213 	config_group_init_type_name(&opts->func_inst.group, "",
5214 			&acm_func_type);
5215@@ -884,3 +969,39 @@ static struct usb_function_instance *acm_alloc_instance(void)
5216 }
5217 DECLARE_USB_FUNCTION_INIT(acm, acm_alloc_instance, acm_alloc_func);
5218 MODULE_LICENSE("GPL");
5219+
5220+/**
5221+ * acm_init_port - bind a acm_port to its transport
5222+ */
5223+int acm_init_port(int port_num, const char *name)
5224+{
5225+	enum transport_type transport;
5226+
5227+	if (port_num >= GSERIAL_NO_PORTS)
5228+		return -ENODEV;
5229+
5230+	transport = str_to_xport(name);
5231+	pr_debug("%s, port:%d, transport:%s\n", __func__,
5232+			port_num, xport_to_str(transport));
5233+
5234+	gacm_ports[port_num].transport = transport;
5235+	gacm_ports[port_num].port_num = port_num;
5236+
5237+	switch (transport) {
5238+	case USB_GADGET_XPORT_TTY:
5239+		no_acm_tty_ports++;
5240+		break;
5241+	case USB_GADGET_XPORT_SMD:
5242+		gacm_ports[port_num].client_port_num = no_acm_smd_ports;
5243+		no_acm_smd_ports++;
5244+		break;
5245+	default:
5246+		pr_err("%s: Un-supported transport transport: %u\n",
5247+				__func__, gacm_ports[port_num].transport);
5248+		return -ENODEV;
5249+	}
5250+
5251+	nr_acm_ports++;
5252+
5253+	return 0;
5254+}
5255diff --git a/drivers/usb/gadget/f_hid.c b/drivers/usb/gadget/f_hid.c
5256index bb9fb5e..6e69a8e 100644
5257--- a/drivers/usb/gadget/f_hid.c
5258+++ b/drivers/usb/gadget/f_hid.c
5259@@ -560,7 +560,7 @@ const struct file_operations f_hidg_fops = {
5260 	.llseek		= noop_llseek,
5261 };
5262 
5263-static int /*__init*/ hidg_bind(struct usb_configuration *c, struct usb_function *f)
5264+static int __init hidg_bind(struct usb_configuration *c, struct usb_function *f)
5265 {
5266 	struct usb_ep		*ep;
5267 	struct f_hidg		*hidg = func_to_hidg(f);
5268@@ -689,7 +689,7 @@ static struct usb_gadget_strings *ct_func_strings[] = {
5269 /*-------------------------------------------------------------------------*/
5270 /*                             usb_configuration                           */
5271 
5272-int /*__init*/ hidg_bind_config(struct usb_configuration *c,
5273+int __init hidg_bind_config(struct usb_configuration *c,
5274 			    struct hidg_func_descriptor *fdesc, int index)
5275 {
5276 	struct f_hidg *hidg;
5277@@ -743,7 +743,7 @@ int /*__init*/ hidg_bind_config(struct usb_configuration *c,
5278 	return status;
5279 }
5280 
5281-int ghid_setup(struct usb_gadget *g, int count)
5282+int __init ghid_setup(struct usb_gadget *g, int count)
5283 {
5284 	int status;
5285 	dev_t dev;
5286diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
5287index 9f2987d..aad3b7d 100644
5288--- a/drivers/usb/gadget/f_mass_storage.c
5289+++ b/drivers/usb/gadget/f_mass_storage.c
5290@@ -230,7 +230,11 @@ static const char fsg_string_interface[] = "Mass Storage";
5291 
5292 #include "storage_common.c"
5293 
5294-
5295+#ifdef CONFIG_USB_CSW_HACK
5296+static int write_error_after_csw_sent;
5297+static int must_report_residue;
5298+static int csw_hack_sent;
5299+#endif
5300 /*-------------------------------------------------------------------------*/
5301 
5302 struct fsg_dev;
5303@@ -369,6 +373,7 @@ static inline struct fsg_dev *fsg_from_func(struct usb_function *f)
5304 }
5305 
5306 typedef void (*fsg_routine_t)(struct fsg_dev *);
5307+static int send_status(struct fsg_common *common);
5308 
5309 static int exception_in_progress(struct fsg_common *common)
5310 {
5311@@ -536,7 +541,10 @@ static int fsg_setup(struct usb_function *f,
5312 		 */
5313 		DBG(fsg, "bulk reset request\n");
5314 		raise_exception(fsg->common, FSG_STATE_RESET);
5315-		return DELAYED_STATUS;
5316+		if (fsg->common->cdev)
5317+			return USB_GADGET_DELAYED_STATUS;
5318+		else
5319+			return DELAYED_STATUS;
5320 
5321 	case US_BULK_GET_MAX_LUN:
5322 		if (ctrl->bRequestType !=
5323@@ -627,12 +635,18 @@ static int sleep_thread(struct fsg_common *common)
5324 			rc = -EINTR;
5325 			break;
5326 		}
5327-		if (common->thread_wakeup_needed)
5328+		spin_lock_irq(&common->lock);
5329+		if (common->thread_wakeup_needed) {
5330+			spin_unlock_irq(&common->lock);
5331 			break;
5332+		}
5333+		spin_unlock_irq(&common->lock);
5334 		schedule();
5335 	}
5336 	__set_current_state(TASK_RUNNING);
5337+	spin_lock_irq(&common->lock);
5338 	common->thread_wakeup_needed = 0;
5339+	spin_unlock_irq(&common->lock);
5340 	smp_rmb();	/* ensure the latest bh->state is visible */
5341 	return rc;
5342 }
5343@@ -696,12 +710,17 @@ static int do_read(struct fsg_common *common)
5344 			     curlun->file_length - file_offset);
5345 
5346 		/* Wait for the next buffer to become available */
5347+		spin_lock_irq(&common->lock);
5348 		bh = common->next_buffhd_to_fill;
5349 		while (bh->state != BUF_STATE_EMPTY) {
5350+			spin_unlock_irq(&common->lock);
5351 			rc = sleep_thread(common);
5352 			if (rc)
5353 				return rc;
5354+
5355+			spin_lock_irq(&common->lock);
5356 		}
5357+		spin_unlock_irq(&common->lock);
5358 
5359 		/*
5360 		 * If we were asked to read past the end of file,
5361@@ -713,8 +732,10 @@ static int do_read(struct fsg_common *common)
5362 			curlun->sense_data_info =
5363 					file_offset >> curlun->blkbits;
5364 			curlun->info_valid = 1;
5365+			spin_lock_irq(&common->lock);
5366 			bh->inreq->length = 0;
5367 			bh->state = BUF_STATE_FULL;
5368+			spin_unlock_irq(&common->lock);
5369 			break;
5370 		}
5371 
5372@@ -754,8 +775,10 @@ static int do_read(struct fsg_common *common)
5373 		 * equal to the buffer size, which is divisible by the
5374 		 * bulk-in maxpacket size.
5375 		 */
5376+		spin_lock_irq(&common->lock);
5377 		bh->inreq->length = nread;
5378 		bh->state = BUF_STATE_FULL;
5379+		spin_unlock_irq(&common->lock);
5380 
5381 		/* If an error occurred, report it and its position */
5382 		if (nread < amount) {
5383@@ -795,6 +818,9 @@ static int do_write(struct fsg_common *common)
5384 	ssize_t			nwritten;
5385 	int			rc;
5386 
5387+#ifdef CONFIG_USB_CSW_HACK
5388+	int			i;
5389+#endif
5390 
5391 #ifdef CONFIG_USB_MSC_PROFILING
5392 	ktime_t			start, diff;
5393@@ -891,7 +917,17 @@ static int do_write(struct fsg_common *common)
5394 		bh = common->next_buffhd_to_drain;
5395 		if (bh->state == BUF_STATE_EMPTY && !get_some_more)
5396 			break;			/* We stopped early */
5397+#ifdef CONFIG_USB_CSW_HACK
5398+		/*
5399+		 * If the csw packet is already submmitted to the hardware,
5400+		 * by marking the state of buffer as full, then by checking
5401+		 * the residue, we make sure that this csw packet is not
5402+		 * written on to the storage media.
5403+		 */
5404+		if (bh->state == BUF_STATE_FULL && common->residue) {
5405+#else
5406 		if (bh->state == BUF_STATE_FULL) {
5407+#endif
5408 			smp_rmb();
5409 			common->next_buffhd_to_drain = bh->next;
5410 			bh->state = BUF_STATE_EMPTY;
5411@@ -962,9 +998,47 @@ static int do_write(struct fsg_common *common)
5412 				curlun->sense_data_info =
5413 					file_offset >> curlun->blkbits;
5414 				curlun->info_valid = 1;
5415+#ifdef CONFIG_USB_CSW_HACK
5416+				write_error_after_csw_sent = 1;
5417+				goto write_error;
5418+#endif
5419 				break;
5420 			}
5421 
5422+#ifdef CONFIG_USB_CSW_HACK
5423+write_error:
5424+			if ((nwritten == amount) && !csw_hack_sent) {
5425+				if (write_error_after_csw_sent)
5426+					break;
5427+
5428+				/*
5429+				 * If residue still exists and nothing left to
5430+				 * write, device must send correct residue to
5431+				 * host in this case.
5432+				 */
5433+				if (!amount_left_to_write && common->residue) {
5434+					must_report_residue = 1;
5435+					break;
5436+				}
5437+				/*
5438+				 * Check if any of the buffer is in the
5439+				 * busy state, if any buffer is in busy state,
5440+				 * means the complete data is not received
5441+				 * yet from the host. So there is no point in
5442+				 * csw right away without the complete data.
5443+				 */
5444+				for (i = 0; i < fsg_num_buffers; i++) {
5445+					if (common->buffhds[i].state ==
5446+							BUF_STATE_BUSY)
5447+						break;
5448+				}
5449+				if (!amount_left_to_req && i == fsg_num_buffers) {
5450+					csw_hack_sent = 1;
5451+					send_status(common);
5452+				}
5453+			}
5454+#endif
5455+
5456  empty_write:
5457 			/* Did the host decide to stop early? */
5458 			if (bh->outreq->actual < bh->bulk_out_intended_length) {
5459@@ -1413,8 +1487,7 @@ static int do_prevent_allow(struct fsg_common *common)
5460 		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
5461 		return -EINVAL;
5462 	}
5463-
5464-	if (curlun->prevent_medium_removal && !prevent)
5465+	if (!curlun->nofua && curlun->prevent_medium_removal && !prevent)
5466 		fsg_lun_fsync_sub(curlun);
5467 	curlun->prevent_medium_removal = prevent;
5468 	return 0;
5469@@ -1661,12 +1734,17 @@ static int send_status(struct fsg_common *common)
5470 	u32			sd, sdinfo = 0;
5471 
5472 	/* Wait for the next buffer to become available */
5473+	spin_lock_irq(&common->lock);
5474 	bh = common->next_buffhd_to_fill;
5475 	while (bh->state != BUF_STATE_EMPTY) {
5476+		spin_unlock_irq(&common->lock);
5477 		rc = sleep_thread(common);
5478 		if (rc)
5479 			return rc;
5480+
5481+		spin_lock_irq(&common->lock);
5482 	}
5483+	spin_unlock_irq(&common->lock);
5484 
5485 	if (curlun) {
5486 		sd = curlun->sense_data;
5487@@ -1694,6 +1772,20 @@ static int send_status(struct fsg_common *common)
5488 	csw->Signature = cpu_to_le32(US_BULK_CS_SIGN);
5489 	csw->Tag = common->tag;
5490 	csw->Residue = cpu_to_le32(common->residue);
5491+#ifdef CONFIG_USB_CSW_HACK
5492+	/* Since csw is being sent early, before
5493+	 * writing on to storage media, need to set
5494+	 * residue to zero,assuming that write will succeed.
5495+	 */
5496+	if (write_error_after_csw_sent || must_report_residue) {
5497+		write_error_after_csw_sent = 0;
5498+		must_report_residue = 0;
5499+		csw->Residue = cpu_to_le32(common->residue);
5500+	} else
5501+		csw->Residue = 0;
5502+#else
5503+	csw->Residue = cpu_to_le32(common->residue);
5504+#endif
5505 	csw->Status = status;
5506 
5507 	bh->inreq->length = US_BULK_CS_WRAP_LEN;
5508@@ -1863,13 +1955,19 @@ static int do_scsi_command(struct fsg_common *common)
5509 	dump_cdb(common);
5510 
5511 	/* Wait for the next buffer to become available for data or status */
5512+	spin_lock_irq(&common->lock);
5513 	bh = common->next_buffhd_to_fill;
5514 	common->next_buffhd_to_drain = bh;
5515 	while (bh->state != BUF_STATE_EMPTY) {
5516+		spin_unlock_irq(&common->lock);
5517 		rc = sleep_thread(common);
5518 		if (rc)
5519 			return rc;
5520+
5521+		spin_lock_irq(&common->lock);
5522 	}
5523+	spin_unlock_irq(&common->lock);
5524+
5525 	common->phase_error = 0;
5526 	common->short_packet_received = 0;
5527 
5528@@ -2210,12 +2308,17 @@ static int get_next_command(struct fsg_common *common)
5529 	int			rc = 0;
5530 
5531 	/* Wait for the next buffer to become available */
5532+	spin_lock_irq(&common->lock);
5533 	bh = common->next_buffhd_to_fill;
5534 	while (bh->state != BUF_STATE_EMPTY) {
5535+		spin_unlock_irq(&common->lock);
5536 		rc = sleep_thread(common);
5537 		if (rc)
5538 			return rc;
5539+
5540+		spin_lock_irq(&common->lock);
5541 	}
5542+	spin_unlock_irq(&common->lock);
5543 
5544 	/* Queue a request to read a Bulk-only CBW */
5545 	set_bulk_out_req_length(common, bh, US_BULK_CB_WRAP_LEN);
5546@@ -2230,14 +2333,23 @@ static int get_next_command(struct fsg_common *common)
5547 	 */
5548 
5549 	/* Wait for the CBW to arrive */
5550+	spin_lock_irq(&common->lock);
5551 	while (bh->state != BUF_STATE_FULL) {
5552+		spin_unlock_irq(&common->lock);
5553 		rc = sleep_thread(common);
5554 		if (rc)
5555 			return rc;
5556+
5557+		spin_lock_irq(&common->lock);
5558 	}
5559+	spin_unlock_irq(&common->lock);
5560+
5561 	smp_rmb();
5562 	rc = fsg_is_set(common) ? received_cbw(common->fsg, bh) : -EIO;
5563+
5564+	spin_lock_irq(&common->lock);
5565 	bh->state = BUF_STATE_EMPTY;
5566+	spin_unlock_irq(&common->lock);
5567 
5568 	return rc;
5569 }
5570@@ -2282,15 +2394,6 @@ reset:
5571 			}
5572 		}
5573 
5574-		/* Disable the endpoints */
5575-		if (fsg->bulk_in_enabled) {
5576-			usb_ep_disable(fsg->bulk_in);
5577-			fsg->bulk_in_enabled = 0;
5578-		}
5579-		if (fsg->bulk_out_enabled) {
5580-			usb_ep_disable(fsg->bulk_out);
5581-			fsg->bulk_out_enabled = 0;
5582-		}
5583 
5584 		common->fsg = NULL;
5585 		wake_up(&common->fsg_wait);
5586@@ -2303,28 +2406,6 @@ reset:
5587 	common->fsg = new_fsg;
5588 	fsg = common->fsg;
5589 
5590-	/* Enable the endpoints */
5591-	rc = config_ep_by_speed(common->gadget, &(fsg->function), fsg->bulk_in);
5592-	if (rc)
5593-		goto reset;
5594-	rc = usb_ep_enable(fsg->bulk_in);
5595-	if (rc)
5596-		goto reset;
5597-	fsg->bulk_in->driver_data = common;
5598-	fsg->bulk_in_enabled = 1;
5599-
5600-	rc = config_ep_by_speed(common->gadget, &(fsg->function),
5601-				fsg->bulk_out);
5602-	if (rc)
5603-		goto reset;
5604-	rc = usb_ep_enable(fsg->bulk_out);
5605-	if (rc)
5606-		goto reset;
5607-	fsg->bulk_out->driver_data = common;
5608-	fsg->bulk_out_enabled = 1;
5609-	common->bulk_out_maxpacket = usb_endpoint_maxp(fsg->bulk_out->desc);
5610-	clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
5611-
5612 	/* Allocate the requests */
5613 	for (i = 0; i < fsg_num_buffers; ++i) {
5614 		struct fsg_buffhd	*bh = &common->buffhds[i];
5615@@ -2353,14 +2434,58 @@ reset:
5616 static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
5617 {
5618 	struct fsg_dev *fsg = fsg_from_func(f);
5619+	struct fsg_common *common = fsg->common;
5620+	int rc;
5621+
5622+	/* Enable the endpoints */
5623+	rc = config_ep_by_speed(common->gadget, &(fsg->function), fsg->bulk_in);
5624+	if (rc)
5625+		return rc;
5626+	rc = usb_ep_enable(fsg->bulk_in);
5627+	if (rc)
5628+		return rc;
5629+	fsg->bulk_in->driver_data = common;
5630+	fsg->bulk_in_enabled = 1;
5631+
5632+	rc = config_ep_by_speed(common->gadget, &(fsg->function),
5633+				fsg->bulk_out);
5634+	if (rc)
5635+		goto reset_bulk_int;
5636+	rc = usb_ep_enable(fsg->bulk_out);
5637+	if (rc)
5638+		goto reset_bulk_int;
5639+	fsg->bulk_out->driver_data = common;
5640+	fsg->bulk_out_enabled = 1;
5641+	common->bulk_out_maxpacket =
5642+			le16_to_cpu(fsg->bulk_out->desc->wMaxPacketSize);
5643+	clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
5644+	csw_hack_sent = 0;
5645+	write_error_after_csw_sent = 0;
5646 	fsg->common->new_fsg = fsg;
5647 	raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
5648 	return USB_GADGET_DELAYED_STATUS;
5649+
5650+reset_bulk_int:
5651+	usb_ep_disable(fsg->bulk_in);
5652+	fsg->bulk_in_enabled = 0;
5653+	return rc;
5654 }
5655 
5656 static void fsg_disable(struct usb_function *f)
5657 {
5658 	struct fsg_dev *fsg = fsg_from_func(f);
5659+
5660+	/* Disable the endpoints */
5661+	if (fsg->bulk_in_enabled) {
5662+		usb_ep_disable(fsg->bulk_in);
5663+		fsg->bulk_in_enabled = 0;
5664+		fsg->bulk_in->driver_data = NULL;
5665+	}
5666+	if (fsg->bulk_out_enabled) {
5667+		usb_ep_disable(fsg->bulk_out);
5668+		fsg->bulk_out_enabled = 0;
5669+		fsg->bulk_out->driver_data = NULL;
5670+	}
5671 	fsg->common->new_fsg = NULL;
5672 	raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
5673 }
5674@@ -2407,10 +2532,13 @@ static void handle_exception(struct fsg_common *common)
5675 		/* Wait until everything is idle */
5676 		for (;;) {
5677 			int num_active = 0;
5678+			spin_lock_irq(&common->lock);
5679 			for (i = 0; i < fsg_num_buffers; ++i) {
5680 				bh = &common->buffhds[i];
5681 				num_active += bh->inreq_busy + bh->outreq_busy;
5682 			}
5683+			spin_unlock_irq(&common->lock);
5684+
5685 			if (num_active == 0)
5686 				break;
5687 			if (sleep_thread(common))
5688@@ -2476,8 +2604,13 @@ static void handle_exception(struct fsg_common *common)
5689 				       &common->fsg->atomic_bitflags))
5690 			usb_ep_clear_halt(common->fsg->bulk_in);
5691 
5692-		if (common->ep0_req_tag == exception_req_tag)
5693-			ep0_queue(common);	/* Complete the status stage */
5694+		if (common->ep0_req_tag == exception_req_tag) {
5695+			/* Complete the status stage */
5696+			if (common->cdev)
5697+				usb_composite_setup_continue(common->cdev);
5698+			else
5699+				ep0_queue(common);
5700+		}
5701 
5702 		/*
5703 		 * Technically this should go here, but it would only be
5704@@ -2567,6 +2700,16 @@ static int fsg_main_thread(void *common_)
5705 			common->state = FSG_STATE_STATUS_PHASE;
5706 		spin_unlock_irq(&common->lock);
5707 
5708+#ifdef CONFIG_USB_CSW_HACK
5709+		/* Since status is already sent for write scsi command,
5710+		 * need to skip sending status once again if it is a
5711+		 * write scsi command.
5712+		 */
5713+		if (csw_hack_sent) {
5714+			csw_hack_sent = 0;
5715+			continue;
5716+		}
5717+#endif
5718 		if (send_status(common))
5719 			continue;
5720 
5721@@ -2604,20 +2747,18 @@ static int fsg_main_thread(void *common_)
5722 /*************************** DEVICE ATTRIBUTES ***************************/
5723 
5724 static DEVICE_ATTR(ro, 0644, fsg_show_ro, fsg_store_ro);
5725-static DEVICE_ATTR(cdrom, 0644, fsg_show_cdrom, fsg_store_cdrom);
5726 static DEVICE_ATTR(nofua, 0644, fsg_show_nofua, fsg_store_nofua);
5727 static DEVICE_ATTR(file, 0644, fsg_show_file, fsg_store_file);
5728 
5729 static struct device_attribute dev_attr_ro_cdrom =
5730 	__ATTR(ro, 0444, fsg_show_ro, NULL);
5731 static struct device_attribute dev_attr_file_nonremovable =
5732-	__ATTR(file, 0444, fsg_show_file, NULL);
5733+	__ATTR(file, 0644, fsg_show_file, fsg_store_file);
5734 
5735 #ifdef CONFIG_USB_MSC_PROFILING
5736 static DEVICE_ATTR(perf, 0644, fsg_show_perf, fsg_store_perf);
5737 #endif
5738 
5739-
5740 /****************************** FSG COMMON ******************************/
5741 
5742 static void fsg_common_release(struct kref *ref);
5743@@ -2637,6 +2778,95 @@ static inline void fsg_common_put(struct fsg_common *common)
5744 	kref_put(&common->ref, fsg_common_release);
5745 }
5746 
5747+/*
5748+ * This function creates device entry for LUN and its related paramters.
5749+*/
5750+static int create_lun_device(struct fsg_common *common,
5751+				struct usb_composite_dev *cdev,
5752+				struct fsg_config *cfg,
5753+				int add_lun_index)
5754+{
5755+	struct usb_gadget *gadget = cdev->gadget;
5756+	struct fsg_lun *curlun = common->luns;
5757+	struct fsg_lun_config *lcfg = cfg->luns;
5758+	int rc = 0, i;
5759+	int nluns = cfg->nluns;
5760+
5761+	/*
5762+	 * Check if index is non-zero, increment current lun_config
5763+	 * and cur_lun pointers.
5764+	 */
5765+	lcfg += add_lun_index;
5766+	curlun += add_lun_index;
5767+
5768+	for (i = add_lun_index; i < nluns; ++i, ++curlun, ++lcfg) {
5769+		curlun->cdrom = !!lcfg->cdrom;
5770+		curlun->ro = lcfg->cdrom || lcfg->ro;
5771+		curlun->initially_ro = curlun->ro;
5772+		curlun->removable = lcfg->removable;
5773+		curlun->nofua = lcfg->nofua;
5774+		curlun->dev.release = fsg_lun_release;
5775+		curlun->dev.parent = &gadget->dev;
5776+		/* curlun->dev.driver = &fsg_driver.driver; XXX */
5777+		dev_set_drvdata(&curlun->dev, &common->filesem);
5778+		dev_set_name(&curlun->dev, "lun%d", i);
5779+
5780+		rc = device_register(&curlun->dev);
5781+		if (rc) {
5782+			pr_err("failed to register LUN%d: %d\n", i, rc);
5783+			common->nluns = i;
5784+			put_device(&curlun->dev);
5785+			goto error_release;
5786+		}
5787+
5788+		rc = device_create_file(&curlun->dev,
5789+					curlun->cdrom
5790+				      ? &dev_attr_ro_cdrom
5791+				      : &dev_attr_ro);
5792+		if (rc)
5793+			goto error_luns;
5794+
5795+		rc = device_create_file(&curlun->dev,
5796+					curlun->removable
5797+				      ? &dev_attr_file
5798+				      : &dev_attr_file_nonremovable);
5799+		if (rc)
5800+			goto error_luns;
5801+
5802+		rc = device_create_file(&curlun->dev, &dev_attr_nofua);
5803+		if (rc)
5804+			goto error_luns;
5805+
5806+#ifdef CONFIG_USB_MSC_PROFILING
5807+		rc = device_create_file(&curlun->dev, &dev_attr_perf);
5808+		if (rc)
5809+			pr_err("failed to create perf sysfs node:%d\n", rc);
5810+#endif
5811+		if (lcfg->filename) {
5812+			rc = fsg_lun_open(curlun, lcfg->filename);
5813+			if (rc) {
5814+				pr_err("failed to open lun file.\n");
5815+				goto error_luns;
5816+			}
5817+		} else if (!curlun->removable && !curlun->cdrom) {
5818+			ERROR(common, "no file given for LUN%d\n", i);
5819+			rc = -EINVAL;
5820+			goto error_luns;
5821+		}
5822+	}
5823+
5824+	common->nluns = nluns;
5825+	return rc;
5826+
5827+error_luns:
5828+	common->nluns = i;
5829+error_release:
5830+	common->state = FSG_STATE_TERMINATED;
5831+	fsg_common_release(&common->ref);
5832+
5833+	return rc;
5834+}
5835+
5836 static struct fsg_common *fsg_common_init(struct fsg_common *common,
5837 					  struct usb_composite_dev *cdev,
5838 					  struct fsg_config *cfg)
5839@@ -2644,7 +2874,6 @@ static struct fsg_common *fsg_common_init(struct fsg_common *common,
5840 	struct usb_gadget *gadget = cdev->gadget;
5841 	struct fsg_buffhd *bh;
5842 	struct fsg_lun *curlun;
5843-	struct fsg_lun_config *lcfg;
5844 	int nluns, i, rc;
5845 	char *pathbuf;
5846 
5847@@ -2686,20 +2915,11 @@ static struct fsg_common *fsg_common_init(struct fsg_common *common,
5848 	common->ep0req = cdev->req;
5849 	common->cdev = cdev;
5850 
5851-	/* Maybe allocate device-global string IDs, and patch descriptors */
5852-	if (fsg_strings[FSG_STRING_INTERFACE].id == 0) {
5853-		rc = usb_string_id(cdev);
5854-		if (unlikely(rc < 0))
5855-			goto error_release;
5856-		fsg_strings[FSG_STRING_INTERFACE].id = rc;
5857-		fsg_intf_desc.iInterface = rc;
5858-	}
5859-
5860 	/*
5861 	 * Create the LUNs, open their backing files, and register the
5862 	 * LUN devices in sysfs.
5863 	 */
5864-	curlun = kcalloc(nluns, sizeof(*curlun), GFP_KERNEL);
5865+	curlun = kcalloc(FSG_MAX_LUNS, sizeof(*curlun), GFP_KERNEL);
5866 	if (unlikely(!curlun)) {
5867 		rc = -ENOMEM;
5868 		goto error_release;
5869@@ -2707,63 +2927,9 @@ static struct fsg_common *fsg_common_init(struct fsg_common *common,
5870 	common->luns = curlun;
5871 
5872 	init_rwsem(&common->filesem);
5873-
5874-	for (i = 0, lcfg = cfg->luns; i < nluns; ++i, ++curlun, ++lcfg) {
5875-		curlun->cdrom = !!lcfg->cdrom;
5876-		curlun->ro = lcfg->cdrom || lcfg->ro;
5877-		curlun->initially_ro = curlun->ro;
5878-		curlun->removable = lcfg->removable;
5879-		curlun->dev.release = fsg_lun_release;
5880-		curlun->dev.parent = &gadget->dev;
5881-		/* curlun->dev.driver = &fsg_driver.driver; XXX */
5882-		dev_set_drvdata(&curlun->dev, &common->filesem);
5883-		dev_set_name(&curlun->dev, "lun%d", i);
5884-
5885-		rc = device_register(&curlun->dev);
5886-		if (rc) {
5887-			INFO(common, "failed to register LUN%d: %d\n", i, rc);
5888-			common->nluns = i;
5889-			put_device(&curlun->dev);
5890-			goto error_release;
5891-		}
5892-
5893-		rc = device_create_file(&curlun->dev,
5894-					curlun->cdrom
5895-				      ? &dev_attr_ro_cdrom
5896-				      : &dev_attr_ro);
5897-		if (rc)
5898-			goto error_luns;
5899-		rc = device_create_file(&curlun->dev,
5900-					curlun->removable
5901-				      ? &dev_attr_file
5902-				      : &dev_attr_file_nonremovable);
5903-		if (rc)
5904-			goto error_luns;
5905-
5906-		rc = device_create_file(&curlun->dev, &dev_attr_cdrom);
5907-		if (rc)
5908-			goto error_luns;
5909-
5910-		rc = device_create_file(&curlun->dev, &dev_attr_nofua);
5911-		if (rc)
5912-			goto error_luns;
5913-#ifdef CONFIG_USB_MSC_PROFILING
5914-		rc = device_create_file(&curlun->dev, &dev_attr_perf);
5915-		if (rc)
5916-			dev_err(&gadget->dev, "failed to create sysfs entry:"
5917-				"(dev_attr_perf) error: %d\n", rc);
5918-#endif
5919-		if (lcfg->filename) {
5920-			rc = fsg_lun_open(curlun, lcfg->filename);
5921-			if (rc)
5922-				goto error_luns;
5923-		} else if (!curlun->removable) {
5924-			ERROR(common, "no file given for LUN%d\n", i);
5925-			rc = -EINVAL;
5926-			goto error_luns;
5927-		}
5928-	}
5929-	common->nluns = nluns;
5930+	rc = create_lun_device(common, cdev, cfg, 0);
5931+	if (rc != 0)
5932+		goto error;
5933 
5934 	/* Data buffers cyclic list */
5935 	bh = common->buffhds;
5936@@ -2844,12 +3010,11 @@ buffhds_first_it:
5937 
5938 	return common;
5939 
5940-error_luns:
5941-	common->nluns = i + 1;
5942 error_release:
5943 	common->state = FSG_STATE_TERMINATED;	/* The thread is dead */
5944 	/* Call fsg_common_release() directly, ref might be not initialised. */
5945 	fsg_common_release(&common->ref);
5946+error:
5947 	return ERR_PTR(rc);
5948 }
5949 
5950@@ -2873,7 +3038,6 @@ static void fsg_common_release(struct kref *ref)
5951 			device_remove_file(&lun->dev, &dev_attr_perf);
5952 #endif
5953 			device_remove_file(&lun->dev, &dev_attr_nofua);
5954-
5955 			device_remove_file(&lun->dev,
5956 					   lun->cdrom
5957 					 ? &dev_attr_ro_cdrom
5958@@ -2882,7 +3046,6 @@ static void fsg_common_release(struct kref *ref)
5959 					   lun->removable
5960 					 ? &dev_attr_file
5961 					 : &dev_attr_file_nonremovable);
5962-			device_remove_file(&lun->dev, &dev_attr_cdrom);
5963 			fsg_lun_close(lun);
5964 			device_unregister(&lun->dev);
5965 		}
5966@@ -2998,6 +3161,15 @@ static int fsg_bind_config(struct usb_composite_dev *cdev,
5967 	struct fsg_dev *fsg;
5968 	int rc;
5969 
5970+	/* Maybe allocate device-global string IDs, and patch descriptors */
5971+	if (fsg_strings[FSG_STRING_INTERFACE].id == 0) {
5972+		rc = usb_string_id(cdev);
5973+		if (unlikely(rc < 0))
5974+			return rc;
5975+		fsg_strings[FSG_STRING_INTERFACE].id = rc;
5976+		fsg_intf_desc.iInterface = rc;
5977+	}
5978+
5979 	fsg = kzalloc(sizeof *fsg, GFP_KERNEL);
5980 	if (unlikely(!fsg))
5981 		return -ENOMEM;
5982@@ -3116,3 +3288,27 @@ fsg_common_from_params(struct fsg_common *common,
5983 	fsg_config_from_params(&cfg, params);
5984 	return fsg_common_init(common, cdev, &cfg);
5985 }
5986+
5987+/*
5988+ * This API allows to add luns devices when MSC is being enabled.
5989+ */
5990+static int fsg_add_lun(struct fsg_common *common,
5991+			struct usb_composite_dev *cdev,
5992+			struct fsg_config *cfg,
5993+			int add_luns)
5994+{
5995+	int nluns, rc = 0;
5996+	int total_luns;
5997+
5998+	if (add_luns) {
5999+		nluns = common->nluns;
6000+		total_luns = nluns + add_luns;
6001+		pr_debug("total_luns:%d\n", total_luns);
6002+		cfg->nluns = total_luns;
6003+		rc = create_lun_device(common, cdev, cfg, nluns);
6004+		if (rc)
6005+			pr_err("Failed device lun creation.\n");
6006+	}
6007+
6008+	return rc;
6009+}
6010diff --git a/drivers/usb/gadget/f_ncm.c b/drivers/usb/gadget/f_ncm.c
6011index 2769688..3c847cf 100644
6012--- a/drivers/usb/gadget/f_ncm.c
6013+++ b/drivers/usb/gadget/f_ncm.c
6014@@ -24,6 +24,21 @@
6015 
6016 #include "u_ether.h"
6017 
6018+#undef DBG
6019+#undef VDBG
6020+#undef ERROR
6021+#undef INFO
6022+
6023+#define DBG(d, fmt, args...) \
6024+	dev_dbg(&(d)->gadget->dev , fmt , ## args)
6025+#define VDBG(d, fmt, args...) \
6026+	dev_vdbg(&(d)->gadget->dev , fmt , ## args)
6027+#define ERROR(d, fmt, args...) \
6028+	dev_err(&(d)->gadget->dev , fmt , ## args)
6029+#define WARNING(d, fmt, args...) \
6030+	dev_warn(&(d)->gadget->dev , fmt , ## args)
6031+#define INFO(d, fmt, args...) \
6032+	dev_info(&(d)->gadget->dev , fmt , ## args)
6033 /*
6034  * This function is a "CDC Network Control Model" (CDC NCM) Ethernet link.
6035  * NCM is intended to be used with high-speed network attachments.
6036@@ -167,8 +182,8 @@ static struct usb_cdc_union_desc ncm_union_desc = {
6037 	/* .bSlaveInterface0 =	DYNAMIC */
6038 };
6039 
6040-static struct usb_cdc_ether_desc ecm_desc = {
6041-	.bLength =		sizeof ecm_desc,
6042+static struct usb_cdc_ether_desc necm_desc = {
6043+	.bLength =		sizeof necm_desc,
6044 	.bDescriptorType =	USB_DT_CS_INTERFACE,
6045 	.bDescriptorSubType =	USB_CDC_ETHERNET_TYPE,
6046 
6047@@ -256,7 +271,7 @@ static struct usb_descriptor_header *ncm_fs_function[] = {
6048 	(struct usb_descriptor_header *) &ncm_control_intf,
6049 	(struct usb_descriptor_header *) &ncm_header_desc,
6050 	(struct usb_descriptor_header *) &ncm_union_desc,
6051-	(struct usb_descriptor_header *) &ecm_desc,
6052+	(struct usb_descriptor_header *) &necm_desc,
6053 	(struct usb_descriptor_header *) &ncm_desc,
6054 	(struct usb_descriptor_header *) &fs_ncm_notify_desc,
6055 	/* data interface, altsettings 0 and 1 */
6056@@ -302,7 +317,7 @@ static struct usb_descriptor_header *ncm_hs_function[] = {
6057 	(struct usb_descriptor_header *) &ncm_control_intf,
6058 	(struct usb_descriptor_header *) &ncm_header_desc,
6059 	(struct usb_descriptor_header *) &ncm_union_desc,
6060-	(struct usb_descriptor_header *) &ecm_desc,
6061+	(struct usb_descriptor_header *) &necm_desc,
6062 	(struct usb_descriptor_header *) &ncm_desc,
6063 	(struct usb_descriptor_header *) &hs_ncm_notify_desc,
6064 	/* data interface, altsettings 0 and 1 */
6065@@ -313,17 +328,88 @@ static struct usb_descriptor_header *ncm_hs_function[] = {
6066 	NULL,
6067 };
6068 
6069+/* Super Speed Support */
6070+static struct usb_endpoint_descriptor ncm_ss_notify_desc = {
6071+	.bLength =		USB_DT_ENDPOINT_SIZE,
6072+	.bDescriptorType =	USB_DT_ENDPOINT,
6073+	.bEndpointAddress =	USB_DIR_IN,
6074+	.bmAttributes =		USB_ENDPOINT_XFER_INT,
6075+	.wMaxPacketSize =	cpu_to_le16(NCM_STATUS_BYTECOUNT),
6076+	.bInterval =		USB_MS_TO_HS_INTERVAL(NCM_STATUS_INTERVAL_MS),
6077+};
6078+
6079+static struct usb_ss_ep_comp_descriptor ncm_ss_notify_comp_desc = {
6080+	.bLength =		sizeof(ncm_ss_notify_comp_desc),
6081+	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
6082+	/* the following 3 values can be tweaked if necessary */
6083+	/* .bMaxBurst =		0, */
6084+	/* .bmAttributes =	0, */
6085+	.wBytesPerInterval =	cpu_to_le16(NCM_STATUS_BYTECOUNT),
6086+};
6087+
6088+static struct usb_endpoint_descriptor ncm_ss_in_desc = {
6089+	.bLength =		USB_DT_ENDPOINT_SIZE,
6090+	.bDescriptorType =	USB_DT_ENDPOINT,
6091+	.bEndpointAddress =	USB_DIR_IN,
6092+	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
6093+	.wMaxPacketSize =	cpu_to_le16(1024),
6094+};
6095+
6096+static struct usb_ss_ep_comp_descriptor ncm_ss_in_comp_desc = {
6097+	.bLength =		sizeof(ncm_ss_in_comp_desc),
6098+	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
6099+	/* the following 2 values can be tweaked if necessary */
6100+	/* .bMaxBurst =		0, */
6101+	/* .bmAttributes =	0, */
6102+};
6103+
6104+static struct usb_endpoint_descriptor ncm_ss_out_desc = {
6105+	.bLength =		USB_DT_ENDPOINT_SIZE,
6106+	.bDescriptorType =	USB_DT_ENDPOINT,
6107+	.bEndpointAddress =	USB_DIR_OUT,
6108+	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
6109+	.wMaxPacketSize =	cpu_to_le16(1024),
6110+};
6111+
6112+static struct usb_ss_ep_comp_descriptor ncm_ss_out_comp_desc = {
6113+	.bLength =		sizeof(ncm_ss_out_comp_desc),
6114+	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
6115+	/* the following 2 values can be tweaked if necessary */
6116+	/* .bMaxBurst =		0, */
6117+	/* .bmAttributes =	0, */
6118+};
6119+
6120+static struct usb_descriptor_header *ncm_ss_function[] = {
6121+	(struct usb_descriptor_header *) &ncm_iad_desc,
6122+	/* CDC NCM control descriptors */
6123+	(struct usb_descriptor_header *) &ncm_control_intf,
6124+	(struct usb_descriptor_header *) &ncm_header_desc,
6125+	(struct usb_descriptor_header *) &ncm_union_desc,
6126+	(struct usb_descriptor_header *) &necm_desc,
6127+	(struct usb_descriptor_header *) &ncm_desc,
6128+	(struct usb_descriptor_header *) &ncm_ss_notify_desc,
6129+	(struct usb_descriptor_header *) &ncm_ss_notify_comp_desc,
6130+	/* data interface, altsettings 0 and 1 */
6131+	(struct usb_descriptor_header *) &ncm_data_nop_intf,
6132+	(struct usb_descriptor_header *) &ncm_data_intf,
6133+	(struct usb_descriptor_header *) &ncm_ss_in_desc,
6134+	(struct usb_descriptor_header *) &ncm_ss_in_comp_desc,
6135+	(struct usb_descriptor_header *) &ncm_ss_out_desc,
6136+	(struct usb_descriptor_header *) &ncm_ss_out_comp_desc,
6137+	NULL,
6138+};
6139+
6140 /* string descriptors: */
6141 
6142 #define STRING_CTRL_IDX	0
6143 #define STRING_MAC_IDX	1
6144-#define STRING_DATA_IDX	2
6145+#define NCM_STRING_DATA_IDX	2	/* Avoid a collision with f_mbim.c */
6146 #define STRING_IAD_IDX	3
6147 
6148 static struct usb_string ncm_string_defs[] = {
6149 	[STRING_CTRL_IDX].s = "CDC Network Control Model (NCM)",
6150 	[STRING_MAC_IDX].s = "",
6151-	[STRING_DATA_IDX].s = "CDC Network Data",
6152+	[NCM_STRING_DATA_IDX].s = "CDC Network Data",
6153 	[STRING_IAD_IDX].s = "CDC NCM",
6154 	{  } /* end of list */
6155 };
6156@@ -435,6 +521,7 @@ static inline unsigned get_ncm(__le16 **p, unsigned size)
6157 static inline void ncm_reset_values(struct f_ncm *ncm)
6158 {
6159 	ncm->parser_opts = &ndp16_opts;
6160+	ncm->ndp_sign = ncm->parser_opts->ndp_sign;
6161 	ncm->is_crc = false;
6162 	ncm->port.cdc_filter = DEFAULT_FILTER;
6163 
6164@@ -1222,8 +1309,17 @@ ncm_bind(struct usb_configuration *c, struct usb_function *f)
6165 	hs_ncm_notify_desc.bEndpointAddress =
6166 		fs_ncm_notify_desc.bEndpointAddress;
6167 
6168+	if (gadget_is_superspeed(c->cdev->gadget)) {
6169+		ncm_ss_in_desc.bEndpointAddress =
6170+					fs_ncm_in_desc.bEndpointAddress;
6171+		ncm_ss_out_desc.bEndpointAddress =
6172+					fs_ncm_out_desc.bEndpointAddress;
6173+		ncm_ss_notify_desc.bEndpointAddress =
6174+					fs_ncm_notify_desc.bEndpointAddress;
6175+	}
6176+
6177 	status = usb_assign_descriptors(f, ncm_fs_function, ncm_hs_function,
6178-			NULL);
6179+					ncm_ss_function);
6180 	/*
6181 	 * NOTE:  all that is done without knowing or caring about
6182 	 * the network link ... which is unavailable to this code
6183@@ -1275,20 +1371,6 @@ ncm_unbind(struct usb_configuration *c, struct usb_function *f)
6184 	kfree(ncm);
6185 }
6186 
6187-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
6188-/**
6189- * ncm_ntb_out_size - set the max ntb out size for uplink.
6190- *
6191- */
6192-void ncm_ntb_out_size(u32 ntb_out_size)
6193-{
6194-	if (ntb_out_size)
6195-		ntb_parameters.dwNtbOutMaxSize = ntb_out_size;
6196-	pr_info("ntb_parameters.dwNtbOutMaxSize = %d\n",
6197-		ntb_parameters.dwNtbOutMaxSize);
6198-}
6199-#endif
6200-
6201 /**
6202  * ncm_bind_config - add CDC Network link to a configuration
6203  * @c: the configuration to support the network link
6204@@ -1317,11 +1399,11 @@ int ncm_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN],
6205 		ncm_control_intf.iInterface =
6206 			ncm_string_defs[STRING_CTRL_IDX].id;
6207 
6208-		status = ncm_string_defs[STRING_DATA_IDX].id;
6209+		status = ncm_string_defs[NCM_STRING_DATA_IDX].id;
6210 		ncm_data_nop_intf.iInterface = status;
6211 		ncm_data_intf.iInterface = status;
6212 
6213-		ecm_desc.iMACAddress = ncm_string_defs[STRING_MAC_IDX].id;
6214+		necm_desc.iMACAddress = ncm_string_defs[STRING_MAC_IDX].id;
6215 		ncm_iad_desc.iFunction = ncm_string_defs[STRING_IAD_IDX].id;
6216 	}
6217 
6218diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
6219index 1bf5f4a..d94a727 100644
6220--- a/drivers/usb/gadget/f_rndis.c
6221+++ b/drivers/usb/gadget/f_rndis.c
6222@@ -25,7 +25,6 @@
6223 #include "u_ether.h"
6224 #include "rndis.h"
6225 
6226-
6227 /*
6228  * This function is an RNDIS Ethernet port -- a Microsoft protocol that's
6229  * been promoted instead of the standard CDC Ethernet.  The published RNDIS
6230@@ -67,6 +66,20 @@
6231  *   - MS-Windows drivers sometimes emit undocumented requests.
6232  */
6233 
6234+static unsigned int rndis_dl_max_pkt_per_xfer = 3;
6235+module_param(rndis_dl_max_pkt_per_xfer, uint, S_IRUGO | S_IWUSR);
6236+MODULE_PARM_DESC(rndis_dl_max_pkt_per_xfer,
6237+	"Maximum packets per transfer for DL aggregation");
6238+
6239+static unsigned int rndis_ul_max_pkt_per_xfer = 3;
6240+module_param(rndis_ul_max_pkt_per_xfer, uint, S_IRUGO | S_IWUSR);
6241+MODULE_PARM_DESC(rndis_ul_max_pkt_per_xfer,
6242+	"Maximum packets per transfer for UL aggregation");
6243+
6244+static unsigned int rx_trigger_enabled;
6245+module_param(rx_trigger_enabled, uint, S_IRUGO | S_IWUSR);
6246+MODULE_PARM_DESC(rx_trigger_enabled, "rx trigger_enable");
6247+
6248 struct f_rndis {
6249 	struct gether			port;
6250 	u8				ctrl_id, data_id;
6251@@ -80,6 +93,28 @@ struct f_rndis {
6252 	atomic_t			notify_count;
6253 };
6254 
6255+static struct f_rndis *__rndis;
6256+
6257+int
6258+rndis_rx_trigger(void)
6259+{
6260+	struct f_rndis *rndis = __rndis;
6261+
6262+	if (!rx_trigger_enabled || !rndis) {
6263+		pr_err("can't set rx trigger\n");
6264+		return -EINVAL;
6265+	}
6266+
6267+	if (rndis->port.rx_triggered)
6268+		return 0;
6269+
6270+
6271+	rndis->port.rx_triggered = true;
6272+	gether_up(&rndis->port);
6273+
6274+	return 0;
6275+}
6276+
6277 static inline struct f_rndis *func_to_rndis(struct usb_function *f)
6278 {
6279 	return container_of(f, struct f_rndis, port.func);
6280@@ -364,27 +399,42 @@ static struct usb_gadget_strings *rndis_strings[] = {
6281 	NULL,
6282 };
6283 
6284-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
6285-#define DMA_ALIGN_ROOM 4
6286-#endif
6287-
6288 /*-------------------------------------------------------------------------*/
6289 
6290 static struct sk_buff *rndis_add_header(struct gether *port,
6291 					struct sk_buff *skb)
6292 {
6293 	struct sk_buff *skb2;
6294-
6295-	skb2 = skb_realloc_headroom(skb, sizeof(struct rndis_packet_msg_type)
6296-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
6297-		+ DMA_ALIGN_ROOM
6298-#endif
6299-	);
6300-	if (skb2)
6301-		rndis_add_hdr(skb2);
6302-
6303-	dev_kfree_skb_any(skb);
6304-	return skb2;
6305+	struct rndis_packet_msg_type *header = NULL;
6306+	struct f_rndis *rndis = func_to_rndis(&port->func);
6307+	struct usb_composite_dev *cdev = port->func.config->cdev;
6308+
6309+	if (rndis->port.multi_pkt_xfer || cdev->gadget->sg_supported) {
6310+		if (port->header) {
6311+			header = port->header;
6312+			header->MessageType = cpu_to_le32(RNDIS_MSG_PACKET);
6313+			header->MessageLength = cpu_to_le32(skb->len +
6314+							sizeof(*header));
6315+			header->DataOffset = cpu_to_le32(36);
6316+			header->DataLength = cpu_to_le32(skb->len);
6317+			pr_debug("MessageLength:%d DataLength:%d\n",
6318+						header->MessageLength,
6319+						header->DataLength);
6320+			return skb;
6321+		} else {
6322+			dev_kfree_skb_any(skb);
6323+			pr_err("RNDIS header is NULL.\n");
6324+			return NULL;
6325+		}
6326+	} else {
6327+		skb2 = skb_realloc_headroom(skb,
6328+				sizeof(struct rndis_packet_msg_type));
6329+		if (skb2)
6330+			rndis_add_hdr(skb2);
6331+
6332+		dev_kfree_skb_any(skb);
6333+		return skb2;
6334+	}
6335 }
6336 
6337 static void rndis_response_available(void *_rndis)
6338@@ -398,6 +448,8 @@ static void rndis_response_available(void *_rndis)
6339 	if (atomic_inc_return(&rndis->notify_count) != 1)
6340 		return;
6341 
6342+	if (!rndis->notify->driver_data)
6343+		return;
6344 	/* Send RNDIS RESPONSE_AVAILABLE notification; a
6345 	 * USB_CDC_NOTIFY_RESPONSE_AVAILABLE "should" work too
6346 	 *
6347@@ -416,16 +468,13 @@ static void rndis_response_available(void *_rndis)
6348 static void rndis_response_complete(struct usb_ep *ep, struct usb_request *req)
6349 {
6350 	struct f_rndis			*rndis = req->context;
6351-	struct usb_composite_dev	*cdev = NULL;
6352+	struct usb_composite_dev	*cdev;
6353 	int				status = req->status;
6354 
6355-	/* In usb plug in/out and tetherring on/off
6356-	 * regression tests, port.func.config */
6357-	/* may be NULL pointer.*/
6358-	if (rndis->port.func.config != NULL)
6359-		cdev = rndis->port.func.config->cdev;
6360+	if (!rndis->port.func.config || !rndis->port.func.config->cdev)
6361+		return;
6362 	else
6363-		printk(KERN_ERR "rndis gadget driver is removed.\n");
6364+		cdev = rndis->port.func.config->cdev;
6365 
6366 	/* after TX:
6367 	 *  - USB_CDC_GET_ENCAPSULATED_RESPONSE (ep0/control)
6368@@ -438,8 +487,7 @@ static void rndis_response_complete(struct usb_ep *ep, struct usb_request *req)
6369 		atomic_set(&rndis->notify_count, 0);
6370 		break;
6371 	default:
6372-		if (cdev != NULL)
6373-			DBG(cdev, "RNDIS %s response error %d, %d/%d\n",
6374+		DBG(cdev, "RNDIS %s response error %d, %d/%d\n",
6375 			ep->name, status,
6376 			req->actual, req->length);
6377 		/* FALLTHROUGH */
6378@@ -455,32 +503,63 @@ static void rndis_response_complete(struct usb_ep *ep, struct usb_request *req)
6379 		status = usb_ep_queue(rndis->notify, req, GFP_ATOMIC);
6380 		if (status) {
6381 			atomic_dec(&rndis->notify_count);
6382-			if (cdev != NULL)
6383-				DBG(cdev, "notify/1 --> %d\n", status);
6384+			DBG(cdev, "notify/1 --> %d\n", status);
6385 		}
6386 		break;
6387 	}
6388 }
6389 
6390+#define MAX_PKTS_PER_XFER	10
6391 static void rndis_command_complete(struct usb_ep *ep, struct usb_request *req)
6392 {
6393 	struct f_rndis			*rndis = req->context;
6394-	struct usb_composite_dev	*cdev = NULL;
6395+	struct usb_composite_dev	*cdev;
6396 	int				status;
6397+	rndis_init_msg_type		*buf;
6398 
6399-	/* In usb plug in/out regression tests, port.func.config */
6400-	/* may be NULL pointer.*/
6401-	if (rndis->port.func.config != NULL)
6402-		cdev = rndis->port.func.config->cdev;
6403+	if (!rndis->port.func.config || !rndis->port.func.config->cdev)
6404+		return;
6405 	else
6406-		printk(KERN_ERR "rndis gadget driver is removed.\n");
6407+		cdev = rndis->port.func.config->cdev;
6408 
6409 	/* received RNDIS command from USB_CDC_SEND_ENCAPSULATED_COMMAND */
6410 //	spin_lock(&dev->lock);
6411 	status = rndis_msg_parser(rndis->config, (u8 *) req->buf);
6412-	if ((status < 0) && (cdev != NULL))
6413-		ERROR(cdev, "RNDIS command error %d, %d/%d\n",
6414+	if (status < 0)
6415+		pr_err("RNDIS command error %d, %d/%d\n",
6416 			status, req->actual, req->length);
6417+
6418+	buf = (rndis_init_msg_type *)req->buf;
6419+
6420+	if (buf->MessageType == RNDIS_MSG_INIT) {
6421+		if (cdev->gadget->sg_supported) {
6422+			rndis->port.dl_max_xfer_size = buf->MaxTransferSize;
6423+			gether_update_dl_max_xfer_size(&rndis->port,
6424+					rndis->port.dl_max_xfer_size);
6425+
6426+			/* if SG is enabled multiple packets can be put
6427+			 * together too quickly. However, module param
6428+			 * is not honored.
6429+			 */
6430+			rndis->port.dl_max_pkts_per_xfer = 5;
6431+
6432+			gether_update_dl_max_pkts_per_xfer(&rndis->port,
6433+					 rndis->port.dl_max_pkts_per_xfer);
6434+
6435+			return;
6436+		}
6437+
6438+		if (buf->MaxTransferSize > 2048)
6439+			rndis->port.multi_pkt_xfer = 1;
6440+		else
6441+			rndis->port.multi_pkt_xfer = 0;
6442+		DBG(cdev, "%s: MaxTransferSize: %d : Multi_pkt_txr: %s\n",
6443+				__func__, buf->MaxTransferSize,
6444+				rndis->port.multi_pkt_xfer ? "enabled" :
6445+							    "disabled");
6446+		if (rndis_dl_max_pkt_per_xfer <= 1)
6447+			rndis->port.multi_pkt_xfer = 0;
6448+	}
6449 //	spin_unlock(&dev->lock);
6450 }
6451 
6452@@ -582,6 +661,8 @@ static int rndis_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
6453 	} else if (intf == rndis->data_id) {
6454 		struct net_device	*net;
6455 
6456+		rndis->port.rx_triggered = false;
6457+
6458 		if (rndis->port.in_ep->driver_data) {
6459 			DBG(cdev, "reset rndis\n");
6460 			gether_disconnect(&rndis->port);
6461@@ -616,7 +697,8 @@ static int rndis_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
6462 		 */
6463 		rndis->port.cdc_filter = 0;
6464 
6465-		DBG(cdev, "RNDIS RX/TX early activation ... \n");
6466+		DBG(cdev, "RNDIS RX/TX early activation ...\n");
6467+		gether_enable_sg(&rndis->port, true);
6468 		net = gether_connect(&rndis->port);
6469 		if (IS_ERR(net))
6470 			return PTR_ERR(net);
6471@@ -774,6 +856,7 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f)
6472 
6473 	rndis_set_param_medium(rndis->config, RNDIS_MEDIUM_802_3, 0);
6474 	rndis_set_host_mac(rndis->config, rndis->ethaddr);
6475+	rndis_set_max_pkt_xfer(rndis->config, rndis_ul_max_pkt_per_xfer);
6476 
6477 	if (rndis->manufacturer && rndis->vendorID &&
6478 			rndis_set_param_vendor(rndis->config, rndis->vendorID,
6479@@ -827,6 +910,7 @@ rndis_unbind(struct usb_configuration *c, struct usb_function *f)
6480 	usb_ep_free_request(rndis->notify, rndis->notify_req);
6481 
6482 	kfree(rndis);
6483+	__rndis = NULL;
6484 }
6485 
6486 /* Some controllers can't support RNDIS ... */
6487@@ -867,6 +951,8 @@ rndis_bind_config_vendor(struct usb_configuration *c, u8 ethaddr[ETH_ALEN],
6488 	if (!rndis)
6489 		goto fail;
6490 
6491+	__rndis = rndis;
6492+
6493 	memcpy(rndis->ethaddr, ethaddr, ETH_ALEN);
6494 	rndis->vendorID = vendorID;
6495 	rndis->manufacturer = manufacturer;
6496@@ -879,6 +965,9 @@ rndis_bind_config_vendor(struct usb_configuration *c, u8 ethaddr[ETH_ALEN],
6497 	rndis->port.header_len = sizeof(struct rndis_packet_msg_type);
6498 	rndis->port.wrap = rndis_add_header;
6499 	rndis->port.unwrap = rndis_rm_hdr;
6500+	rndis->port.ul_max_pkts_per_xfer = rndis_ul_max_pkt_per_xfer;
6501+	rndis->port.dl_max_pkts_per_xfer = rndis_dl_max_pkt_per_xfer;
6502+	rndis->port.rx_trigger_enabled = rx_trigger_enabled;
6503 
6504 	rndis->port.func.name = "rndis";
6505 	rndis->port.func.strings = rndis_strings;
6506diff --git a/drivers/usb/gadget/f_serial.c b/drivers/usb/gadget/f_serial.c
6507index 981113c..7190194 100644
6508--- a/drivers/usb/gadget/f_serial.c
6509+++ b/drivers/usb/gadget/f_serial.c
6510@@ -4,6 +4,7 @@
6511  * Copyright (C) 2003 Al Borchers (alborchers@steinerpoint.com)
6512  * Copyright (C) 2008 by David Brownell
6513  * Copyright (C) 2008 by Nokia Corporation
6514+ * Copyright (c) 2014, The Linux Foundation. All rights reserved.
6515  *
6516  * This software is distributed under the terms of the GNU General
6517  * Public License ("GPL") as published by the Free Software Foundation,
6518@@ -14,6 +15,13 @@
6519 #include <linux/kernel.h>
6520 #include <linux/module.h>
6521 #include <linux/device.h>
6522+#include <linux/miscdevice.h>
6523+#include <linux/uaccess.h>
6524+#include <linux/fs.h>
6525+#include <linux/usb/composite.h>
6526+#include <linux/tty.h>
6527+
6528+#include "usb_gadget_xport.h"
6529 
6530 #include "u_serial.h"
6531 #include "gadget_chips.h"
6532@@ -28,17 +36,109 @@
6533  * if you can arrange appropriate host side drivers.
6534  */
6535 
6536+#define GSERIAL_IOCTL_MAGIC		'G'
6537+#define GSERIAL_SET_XPORT_TYPE		_IOW(GSERIAL_IOCTL_MAGIC, 0, u32)
6538+#define GSERIAL_SMD_WRITE		_IOW(GSERIAL_IOCTL_MAGIC, 1, \
6539+					struct ioctl_smd_write_arg_type)
6540+
6541+#define GSERIAL_SET_XPORT_TYPE_TTY 0
6542+#define GSERIAL_SET_XPORT_TYPE_SMD 1
6543+
6544+#define GSERIAL_BUF_LEN  256
6545+#define GSERIAL_NO_PORTS 3
6546+
6547+struct ioctl_smd_write_arg_type {
6548+	char		*buf;
6549+	unsigned int	size;
6550+};
6551+
6552 struct f_gser {
6553 	struct gserial			port;
6554 	u8				data_id;
6555 	u8				port_num;
6556+
6557+	u8				online;
6558+	enum transport_type		transport;
6559+
6560+	atomic_t			ioctl_excl;
6561+	atomic_t			open_excl;
6562+
6563+#ifdef CONFIG_MODEM_SUPPORT
6564+	u8				pending;
6565+	spinlock_t			lock;
6566+	struct usb_ep			*notify;
6567+	struct usb_request		*notify_req;
6568+
6569+	struct usb_cdc_line_coding	port_line_coding;
6570+
6571+	/* SetControlLineState request */
6572+	u16				port_handshake_bits;
6573+#define ACM_CTRL_RTS	(1 << 1)	/* unused with full duplex */
6574+#define ACM_CTRL_DTR	(1 << 0)	/* host is ready for data r/w */
6575+
6576+	/* SerialState notification */
6577+	u16				serial_state;
6578+#define ACM_CTRL_OVERRUN	(1 << 6)
6579+#define ACM_CTRL_PARITY		(1 << 5)
6580+#define ACM_CTRL_FRAMING	(1 << 4)
6581+#define ACM_CTRL_RI		(1 << 3)
6582+#define ACM_CTRL_BRK		(1 << 2)
6583+#define ACM_CTRL_DSR		(1 << 1)
6584+#define ACM_CTRL_DCD		(1 << 0)
6585+#endif
6586 };
6587 
6588+
6589+static unsigned int no_tty_ports;
6590+static unsigned int no_smd_ports;
6591+static unsigned int no_hsic_sports;
6592+static unsigned int no_hsuart_sports;
6593+static unsigned int nr_ports;
6594+static unsigned int gser_next_free_port;
6595+
6596+static struct port_info {
6597+	enum transport_type	transport;
6598+	unsigned		port_num;
6599+	unsigned char		client_port_num;
6600+	struct f_gser		*gser_ptr;
6601+	bool			dun_w_softap_enable;
6602+} gserial_ports[GSERIAL_NO_PORTS];
6603+
6604+static int gser_open_dev(struct inode *ip, struct file *fp);
6605+static int gser_release_dev(struct inode *ip, struct file *fp);
6606+static long gser_ioctl(struct file *fp, unsigned cmd, unsigned long arg);
6607+static void gser_ioctl_set_transport(struct f_gser *gser,
6608+				unsigned int transport);
6609+
6610+
6611+static const struct file_operations gser_fops = {
6612+	.owner = THIS_MODULE,
6613+	.open = gser_open_dev,
6614+	.release = gser_release_dev,
6615+	.unlocked_ioctl = gser_ioctl,
6616+};
6617+
6618+static struct miscdevice gser_device = {
6619+	.minor = MISC_DYNAMIC_MINOR,
6620+	.name = "android_serial_device",
6621+	.fops = &gser_fops,
6622+};
6623+
6624+static int registered;
6625+
6626 static inline struct f_gser *func_to_gser(struct usb_function *f)
6627 {
6628 	return container_of(f, struct f_gser, port.func);
6629 }
6630 
6631+#ifdef CONFIG_MODEM_SUPPORT
6632+static inline struct f_gser *port_to_gser(struct gserial *p)
6633+{
6634+	return container_of(p, struct f_gser, port);
6635+}
6636+#define GS_LOG2_NOTIFY_INTERVAL		5	/* 1 << 5 == 32 msec */
6637+#define GS_NOTIFY_MAXPACKET		10	/* notification + 2 bytes */
6638+#endif
6639 /*-------------------------------------------------------------------------*/
6640 
6641 /* interface descriptor: */
6642@@ -47,14 +147,59 @@ static struct usb_interface_descriptor gser_interface_desc = {
6643 	.bLength =		USB_DT_INTERFACE_SIZE,
6644 	.bDescriptorType =	USB_DT_INTERFACE,
6645 	/* .bInterfaceNumber = DYNAMIC */
6646+#ifdef CONFIG_MODEM_SUPPORT
6647+	.bNumEndpoints =	3,
6648+#else
6649 	.bNumEndpoints =	2,
6650+#endif
6651 	.bInterfaceClass =	USB_CLASS_VENDOR_SPEC,
6652 	.bInterfaceSubClass =	0,
6653 	.bInterfaceProtocol =	0,
6654 	/* .iInterface = DYNAMIC */
6655 };
6656+#ifdef CONFIG_MODEM_SUPPORT
6657+static struct usb_cdc_header_desc gser_header_desc  = {
6658+	.bLength =		sizeof(gser_header_desc),
6659+	.bDescriptorType =	USB_DT_CS_INTERFACE,
6660+	.bDescriptorSubType =	USB_CDC_HEADER_TYPE,
6661+	.bcdCDC =		__constant_cpu_to_le16(0x0110),
6662+};
6663+
6664+static struct usb_cdc_call_mgmt_descriptor
6665+gser_call_mgmt_descriptor  = {
6666+	.bLength =		sizeof(gser_call_mgmt_descriptor),
6667+	.bDescriptorType =	USB_DT_CS_INTERFACE,
6668+	.bDescriptorSubType =	USB_CDC_CALL_MANAGEMENT_TYPE,
6669+	.bmCapabilities =	0,
6670+	/* .bDataInterface = DYNAMIC */
6671+};
6672+
6673+static struct usb_cdc_acm_descriptor gser_descriptor  = {
6674+	.bLength =		sizeof(gser_descriptor),
6675+	.bDescriptorType =	USB_DT_CS_INTERFACE,
6676+	.bDescriptorSubType =	USB_CDC_ACM_TYPE,
6677+	.bmCapabilities =	USB_CDC_CAP_LINE,
6678+};
6679 
6680+static struct usb_cdc_union_desc gser_union_desc  = {
6681+	.bLength =		sizeof(gser_union_desc),
6682+	.bDescriptorType =	USB_DT_CS_INTERFACE,
6683+	.bDescriptorSubType =	USB_CDC_UNION_TYPE,
6684+	/* .bMasterInterface0 =	DYNAMIC */
6685+	/* .bSlaveInterface0 =	DYNAMIC */
6686+};
6687+#endif
6688 /* full speed support: */
6689+#ifdef CONFIG_MODEM_SUPPORT
6690+static struct usb_endpoint_descriptor gser_fs_notify_desc = {
6691+	.bLength =		USB_DT_ENDPOINT_SIZE,
6692+	.bDescriptorType =	USB_DT_ENDPOINT,
6693+	.bEndpointAddress =	USB_DIR_IN,
6694+	.bmAttributes =		USB_ENDPOINT_XFER_INT,
6695+	.wMaxPacketSize =	__constant_cpu_to_le16(GS_NOTIFY_MAXPACKET),
6696+	.bInterval =		1 << GS_LOG2_NOTIFY_INTERVAL,
6697+};
6698+#endif
6699 
6700 static struct usb_endpoint_descriptor gser_fs_in_desc = {
6701 	.bLength =		USB_DT_ENDPOINT_SIZE,
6702@@ -72,29 +217,53 @@ static struct usb_endpoint_descriptor gser_fs_out_desc = {
6703 
6704 static struct usb_descriptor_header *gser_fs_function[] = {
6705 	(struct usb_descriptor_header *) &gser_interface_desc,
6706+#ifdef CONFIG_MODEM_SUPPORT
6707+	(struct usb_descriptor_header *) &gser_header_desc,
6708+	(struct usb_descriptor_header *) &gser_call_mgmt_descriptor,
6709+	(struct usb_descriptor_header *) &gser_descriptor,
6710+	(struct usb_descriptor_header *) &gser_union_desc,
6711+	(struct usb_descriptor_header *) &gser_fs_notify_desc,
6712+#endif
6713 	(struct usb_descriptor_header *) &gser_fs_in_desc,
6714 	(struct usb_descriptor_header *) &gser_fs_out_desc,
6715 	NULL,
6716 };
6717 
6718 /* high speed support: */
6719+#ifdef CONFIG_MODEM_SUPPORT
6720+static struct usb_endpoint_descriptor gser_hs_notify_desc  = {
6721+	.bLength =		USB_DT_ENDPOINT_SIZE,
6722+	.bDescriptorType =	USB_DT_ENDPOINT,
6723+	.bEndpointAddress =	USB_DIR_IN,
6724+	.bmAttributes =		USB_ENDPOINT_XFER_INT,
6725+	.wMaxPacketSize =	__constant_cpu_to_le16(GS_NOTIFY_MAXPACKET),
6726+	.bInterval =		GS_LOG2_NOTIFY_INTERVAL+4,
6727+};
6728+#endif
6729 
6730 static struct usb_endpoint_descriptor gser_hs_in_desc = {
6731 	.bLength =		USB_DT_ENDPOINT_SIZE,
6732 	.bDescriptorType =	USB_DT_ENDPOINT,
6733 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
6734-	.wMaxPacketSize =	cpu_to_le16(512),
6735+	.wMaxPacketSize =	__constant_cpu_to_le16(512),
6736 };
6737 
6738 static struct usb_endpoint_descriptor gser_hs_out_desc = {
6739 	.bLength =		USB_DT_ENDPOINT_SIZE,
6740 	.bDescriptorType =	USB_DT_ENDPOINT,
6741 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
6742-	.wMaxPacketSize =	cpu_to_le16(512),
6743+	.wMaxPacketSize =	__constant_cpu_to_le16(512),
6744 };
6745 
6746 static struct usb_descriptor_header *gser_hs_function[] = {
6747 	(struct usb_descriptor_header *) &gser_interface_desc,
6748+#ifdef CONFIG_MODEM_SUPPORT
6749+	(struct usb_descriptor_header *) &gser_header_desc,
6750+	(struct usb_descriptor_header *) &gser_call_mgmt_descriptor,
6751+	(struct usb_descriptor_header *) &gser_descriptor,
6752+	(struct usb_descriptor_header *) &gser_union_desc,
6753+	(struct usb_descriptor_header *) &gser_hs_notify_desc,
6754+#endif
6755 	(struct usb_descriptor_header *) &gser_hs_in_desc,
6756 	(struct usb_descriptor_header *) &gser_hs_out_desc,
6757 	NULL,
6758@@ -119,8 +288,37 @@ static struct usb_ss_ep_comp_descriptor gser_ss_bulk_comp_desc = {
6759 	.bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
6760 };
6761 
6762+#ifdef CONFIG_MODEM_SUPPORT
6763+static struct usb_endpoint_descriptor gser_ss_notify_desc  = {
6764+	.bLength =		USB_DT_ENDPOINT_SIZE,
6765+	.bDescriptorType =	USB_DT_ENDPOINT,
6766+	.bEndpointAddress =	USB_DIR_IN,
6767+	.bmAttributes =		USB_ENDPOINT_XFER_INT,
6768+	.wMaxPacketSize =	__constant_cpu_to_le16(GS_NOTIFY_MAXPACKET),
6769+	.bInterval =		GS_LOG2_NOTIFY_INTERVAL+4,
6770+};
6771+
6772+static struct usb_ss_ep_comp_descriptor gser_ss_notify_comp_desc = {
6773+	.bLength =		sizeof gser_ss_notify_comp_desc,
6774+	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
6775+
6776+	/* the following 2 values can be tweaked if necessary */
6777+	/* .bMaxBurst =		0, */
6778+	/* .bmAttributes =	0, */
6779+	.wBytesPerInterval =	cpu_to_le16(GS_NOTIFY_MAXPACKET),
6780+};
6781+#endif
6782+
6783 static struct usb_descriptor_header *gser_ss_function[] = {
6784 	(struct usb_descriptor_header *) &gser_interface_desc,
6785+#ifdef CONFIG_MODEM_SUPPORT
6786+	(struct usb_descriptor_header *) &gser_header_desc,
6787+	(struct usb_descriptor_header *) &gser_call_mgmt_descriptor,
6788+	(struct usb_descriptor_header *) &gser_descriptor,
6789+	(struct usb_descriptor_header *) &gser_union_desc,
6790+	(struct usb_descriptor_header *) &gser_ss_notify_desc,
6791+	(struct usb_descriptor_header *) &gser_ss_notify_comp_desc,
6792+#endif
6793 	(struct usb_descriptor_header *) &gser_ss_in_desc,
6794 	(struct usb_descriptor_header *) &gser_ss_bulk_comp_desc,
6795 	(struct usb_descriptor_header *) &gser_ss_out_desc,
6796@@ -145,18 +343,283 @@ static struct usb_gadget_strings *gser_strings[] = {
6797 	NULL,
6798 };
6799 
6800+int gport_setup(struct usb_configuration *c)
6801+{
6802+	int ret = 0;
6803+	int port_idx;
6804+	int i;
6805+
6806+	pr_debug("%s: no_tty_ports: %u "
6807+		" no_smd_ports: %u no_hsic_sports: %u no_hsuart_ports: %u nr_ports: %u\n",
6808+			__func__, no_tty_ports, no_smd_ports,
6809+			no_hsic_sports, no_hsuart_sports, nr_ports);
6810+
6811+	if (no_tty_ports) {
6812+		for (i = 0; i < no_tty_ports; i++) {
6813+			ret = gserial_alloc_line(
6814+					&gserial_ports[i].client_port_num);
6815+			if (ret)
6816+				return ret;
6817+		}
6818+	}
6819+
6820+	if (no_smd_ports)
6821+		ret = gsmd_setup(c->cdev->gadget, no_smd_ports);
6822+	if (no_hsic_sports) {
6823+		port_idx = ghsic_data_setup(no_hsic_sports, USB_GADGET_SERIAL);
6824+		if (port_idx < 0)
6825+			return port_idx;
6826+
6827+		for (i = 0; i < nr_ports; i++) {
6828+			if (gserial_ports[i].transport ==
6829+					USB_GADGET_XPORT_HSIC) {
6830+				gserial_ports[i].client_port_num = port_idx;
6831+				port_idx++;
6832+			}
6833+		}
6834+
6835+		/*clinet port num is same for data setup and ctrl setup*/
6836+		ret = ghsic_ctrl_setup(no_hsic_sports, USB_GADGET_SERIAL);
6837+		if (ret < 0)
6838+			return ret;
6839+	}
6840+	if (no_hsuart_sports) {
6841+		port_idx = ghsuart_data_setup(no_hsuart_sports,
6842+					USB_GADGET_SERIAL);
6843+		if (port_idx < 0)
6844+			return port_idx;
6845+
6846+		for (i = 0; i < nr_ports; i++) {
6847+			if (gserial_ports[i].transport ==
6848+					USB_GADGET_XPORT_HSUART) {
6849+				gserial_ports[i].client_port_num = port_idx;
6850+				port_idx++;
6851+			}
6852+		}
6853+	}
6854+	return ret;
6855+}
6856+
6857+void gport_cleanup(void)
6858+{
6859+	int i;
6860+
6861+	for (i = 0; i < no_tty_ports; i++)
6862+		gserial_free_line(gserial_ports[i].client_port_num);
6863+}
6864+
6865+static int gport_connect(struct f_gser *gser)
6866+{
6867+	unsigned	port_num;
6868+	int		ret;
6869+
6870+	pr_debug("%s: transport: %s f_gser: %p gserial: %p port_num: %d\n",
6871+			__func__, xport_to_str(gser->transport),
6872+			gser, &gser->port, gser->port_num);
6873+
6874+	port_num = gserial_ports[gser->port_num].client_port_num;
6875+
6876+	switch (gser->transport) {
6877+	case USB_GADGET_XPORT_TTY:
6878+		gserial_connect(&gser->port, port_num);
6879+		break;
6880+	case USB_GADGET_XPORT_SMD:
6881+		gsmd_connect(&gser->port, port_num);
6882+		break;
6883+	case USB_GADGET_XPORT_HSIC:
6884+		ret = ghsic_ctrl_connect(&gser->port, port_num);
6885+		if (ret) {
6886+			pr_err("%s: ghsic_ctrl_connect failed: err:%d\n",
6887+					__func__, ret);
6888+			return ret;
6889+		}
6890+		ret = ghsic_data_connect(&gser->port, port_num);
6891+		if (ret) {
6892+			pr_err("%s: ghsic_data_connect failed: err:%d\n",
6893+					__func__, ret);
6894+			ghsic_ctrl_disconnect(&gser->port, port_num);
6895+			return ret;
6896+		}
6897+		break;
6898+	case USB_GADGET_XPORT_HSUART:
6899+		ret = ghsuart_data_connect(&gser->port, port_num);
6900+		if (ret) {
6901+			pr_err("%s: ghsuart_data_connect failed: err:%d\n",
6902+					__func__, ret);
6903+			return ret;
6904+		}
6905+		break;
6906+	default:
6907+		pr_err("%s: Un-supported transport: %s\n", __func__,
6908+				xport_to_str(gser->transport));
6909+		return -ENODEV;
6910+	}
6911+
6912+	return 0;
6913+}
6914+
6915+static int gport_disconnect(struct f_gser *gser)
6916+{
6917+	unsigned port_num;
6918+
6919+	port_num = gserial_ports[gser->port_num].client_port_num;
6920+
6921+	pr_debug("%s: transport: %s f_gser: %p gserial: %p port_num: %d\n",
6922+			__func__, xport_to_str(gser->transport),
6923+			gser, &gser->port, gser->port_num);
6924+
6925+	switch (gser->transport) {
6926+	case USB_GADGET_XPORT_TTY:
6927+		gserial_disconnect(&gser->port);
6928+		break;
6929+	case USB_GADGET_XPORT_SMD:
6930+		gsmd_disconnect(&gser->port, port_num);
6931+		break;
6932+	case USB_GADGET_XPORT_HSIC:
6933+		ghsic_ctrl_disconnect(&gser->port, port_num);
6934+		ghsic_data_disconnect(&gser->port, port_num);
6935+		break;
6936+	case USB_GADGET_XPORT_HSUART:
6937+		ghsuart_data_disconnect(&gser->port, port_num);
6938+		break;
6939+	default:
6940+		pr_err("%s: Un-supported transport:%s\n", __func__,
6941+				xport_to_str(gser->transport));
6942+		return -ENODEV;
6943+	}
6944+
6945+	return 0;
6946+}
6947+
6948+#ifdef CONFIG_MODEM_SUPPORT
6949+static void gser_complete_set_line_coding(struct usb_ep *ep,
6950+		struct usb_request *req)
6951+{
6952+	struct f_gser            *gser = ep->driver_data;
6953+	struct usb_composite_dev *cdev = gser->port.func.config->cdev;
6954+
6955+	if (req->status != 0) {
6956+		DBG(cdev, "gser ttyGS%d completion, err %d\n",
6957+				gser->port_num, req->status);
6958+		return;
6959+	}
6960+
6961+	/* normal completion */
6962+	if (req->actual != sizeof(gser->port_line_coding)) {
6963+		DBG(cdev, "gser ttyGS%d short resp, len %d\n",
6964+				gser->port_num, req->actual);
6965+		usb_ep_set_halt(ep);
6966+	} else {
6967+		struct usb_cdc_line_coding	*value = req->buf;
6968+		gser->port_line_coding = *value;
6969+	}
6970+}
6971 /*-------------------------------------------------------------------------*/
6972 
6973+static int
6974+gser_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
6975+{
6976+	struct f_gser            *gser = func_to_gser(f);
6977+	struct usb_composite_dev *cdev = f->config->cdev;
6978+	struct usb_request	 *req = cdev->req;
6979+	int			 value = -EOPNOTSUPP;
6980+	u16			 w_index = le16_to_cpu(ctrl->wIndex);
6981+	u16			 w_value = le16_to_cpu(ctrl->wValue);
6982+	u16			 w_length = le16_to_cpu(ctrl->wLength);
6983+
6984+	switch ((ctrl->bRequestType << 8) | ctrl->bRequest) {
6985+
6986+	/* SET_LINE_CODING ... just read and save what the host sends */
6987+	case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
6988+			| USB_CDC_REQ_SET_LINE_CODING:
6989+		if (w_length != sizeof(struct usb_cdc_line_coding))
6990+			goto invalid;
6991+
6992+		value = w_length;
6993+		cdev->gadget->ep0->driver_data = gser;
6994+		req->complete = gser_complete_set_line_coding;
6995+		break;
6996+
6997+	/* GET_LINE_CODING ... return what host sent, or initial value */
6998+	case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
6999+			| USB_CDC_REQ_GET_LINE_CODING:
7000+		value = min_t(unsigned, w_length,
7001+				sizeof(struct usb_cdc_line_coding));
7002+		memcpy(req->buf, &gser->port_line_coding, value);
7003+		break;
7004+
7005+	/* SET_CONTROL_LINE_STATE ... save what the host sent */
7006+	case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
7007+			| USB_CDC_REQ_SET_CONTROL_LINE_STATE:
7008+
7009+		value = 0;
7010+		gser->port_handshake_bits = w_value;
7011+		if (gser->port.notify_modem) {
7012+			unsigned port_num =
7013+				gserial_ports[gser->port_num].client_port_num;
7014+
7015+			gser->port.notify_modem(&gser->port,
7016+					port_num, w_value);
7017+		}
7018+		break;
7019+
7020+	default:
7021+invalid:
7022+		DBG(cdev, "invalid control req%02x.%02x v%04x i%04x l%d\n",
7023+			ctrl->bRequestType, ctrl->bRequest,
7024+			w_value, w_index, w_length);
7025+	}
7026+
7027+	/* respond with data transfer or status phase? */
7028+	if (value >= 0) {
7029+		DBG(cdev, "gser ttyGS%d req%02x.%02x v%04x i%04x l%d\n",
7030+			gser->port_num, ctrl->bRequestType, ctrl->bRequest,
7031+			w_value, w_index, w_length);
7032+		req->zero = 0;
7033+		req->length = value;
7034+		value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
7035+		if (value < 0)
7036+			ERROR(cdev, "gser response on ttyGS%d, err %d\n",
7037+					gser->port_num, value);
7038+	}
7039+
7040+	/* device either stalls (value < 0) or reports success */
7041+	return value;
7042+}
7043+#endif
7044 static int gser_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
7045 {
7046 	struct f_gser		*gser = func_to_gser(f);
7047 	struct usb_composite_dev *cdev = f->config->cdev;
7048+	int rc = 0;
7049 
7050 	/* we know alt == 0, so this is an activation or a reset */
7051 
7052+#ifdef CONFIG_MODEM_SUPPORT
7053+	if (gser->notify->driver_data) {
7054+		DBG(cdev, "reset generic ctl ttyGS%d\n", gser->port_num);
7055+		usb_ep_disable(gser->notify);
7056+	}
7057+
7058+	if (!gser->notify->desc) {
7059+		if (config_ep_by_speed(cdev->gadget, f, gser->notify)) {
7060+			gser->notify->desc = NULL;
7061+			return -EINVAL;
7062+		}
7063+	}
7064+	rc = usb_ep_enable(gser->notify);
7065+
7066+	if (rc) {
7067+		ERROR(cdev, "can't enable %s, result %d\n",
7068+					gser->notify->name, rc);
7069+		return rc;
7070+	}
7071+	gser->notify->driver_data = gser;
7072+#endif
7073+
7074 	if (gser->port.in->driver_data) {
7075-		DBG(cdev, "reset generic ttyGS%d\n", gser->port_num);
7076-		gserial_disconnect(&gser->port);
7077+		DBG(cdev, "reset generic data ttyGS%d\n", gser->port_num);
7078+		gport_disconnect(gser);
7079 	}
7080 	if (!gser->port.in->desc || !gser->port.out->desc) {
7081 		DBG(cdev, "activate generic ttyGS%d\n", gser->port_num);
7082@@ -167,8 +630,11 @@ static int gser_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
7083 			return -EINVAL;
7084 		}
7085 	}
7086-	gserial_connect(&gser->port, gser->port_num);
7087-	return 0;
7088+
7089+	gport_connect(gser);
7090+
7091+	gser->online = 1;
7092+	return rc;
7093 }
7094 
7095 static void gser_disable(struct usb_function *f)
7096@@ -177,9 +643,181 @@ static void gser_disable(struct usb_function *f)
7097 	struct usb_composite_dev *cdev = f->config->cdev;
7098 
7099 	DBG(cdev, "generic ttyGS%d deactivated\n", gser->port_num);
7100-	gserial_disconnect(&gser->port);
7101+
7102+	gport_disconnect(gser);
7103+
7104+#ifdef CONFIG_MODEM_SUPPORT
7105+	usb_ep_fifo_flush(gser->notify);
7106+	usb_ep_disable(gser->notify);
7107+	gser->notify->driver_data = NULL;
7108+#endif
7109+	gser->online = 0;
7110+}
7111+#ifdef CONFIG_MODEM_SUPPORT
7112+static int gser_notify(struct f_gser *gser, u8 type, u16 value,
7113+		void *data, unsigned length)
7114+{
7115+	struct usb_ep			*ep = gser->notify;
7116+	struct usb_request		*req;
7117+	struct usb_cdc_notification	*notify;
7118+	const unsigned			len = sizeof(*notify) + length;
7119+	void				*buf;
7120+	int				status;
7121+	struct usb_composite_dev *cdev = gser->port.func.config->cdev;
7122+
7123+	req = gser->notify_req;
7124+	gser->notify_req = NULL;
7125+	gser->pending = false;
7126+
7127+	req->length = len;
7128+	notify = req->buf;
7129+	buf = notify + 1;
7130+
7131+	notify->bmRequestType = USB_DIR_IN | USB_TYPE_CLASS
7132+			| USB_RECIP_INTERFACE;
7133+	notify->bNotificationType = type;
7134+	notify->wValue = cpu_to_le16(value);
7135+	notify->wIndex = cpu_to_le16(gser->data_id);
7136+	notify->wLength = cpu_to_le16(length);
7137+	memcpy(buf, data, length);
7138+
7139+	status = usb_ep_queue(ep, req, GFP_ATOMIC);
7140+	if (status < 0) {
7141+		ERROR(cdev, "gser ttyGS%d can't notify serial state, %d\n",
7142+				gser->port_num, status);
7143+		gser->notify_req = req;
7144+	}
7145+
7146+	return status;
7147+}
7148+
7149+static int gser_notify_serial_state(struct f_gser *gser)
7150+{
7151+	int			 status;
7152+	unsigned long flags;
7153+	struct usb_composite_dev *cdev = gser->port.func.config->cdev;
7154+
7155+	spin_lock_irqsave(&gser->lock, flags);
7156+	if (gser->notify_req) {
7157+		DBG(cdev, "gser ttyGS%d serial state %04x\n",
7158+				gser->port_num, gser->serial_state);
7159+		status = gser_notify(gser, USB_CDC_NOTIFY_SERIAL_STATE,
7160+				0, &gser->serial_state,
7161+					sizeof(gser->serial_state));
7162+	} else {
7163+		gser->pending = true;
7164+		status = 0;
7165+	}
7166+	spin_unlock_irqrestore(&gser->lock, flags);
7167+	return status;
7168+}
7169+
7170+static void gser_notify_complete(struct usb_ep *ep, struct usb_request *req)
7171+{
7172+	struct f_gser *gser = req->context;
7173+	u8	      doit = false;
7174+	unsigned long flags;
7175+
7176+	/* on this call path we do NOT hold the port spinlock,
7177+	 * which is why ACM needs its own spinlock
7178+	 */
7179+	spin_lock_irqsave(&gser->lock, flags);
7180+	if (req->status != -ESHUTDOWN)
7181+		doit = gser->pending;
7182+	gser->notify_req = req;
7183+	spin_unlock_irqrestore(&gser->lock, flags);
7184+
7185+	if (doit && gser->online)
7186+		gser_notify_serial_state(gser);
7187+}
7188+static void gser_connect(struct gserial *port)
7189+{
7190+	struct f_gser *gser = port_to_gser(port);
7191+
7192+	gser->serial_state |= ACM_CTRL_DSR | ACM_CTRL_DCD;
7193+	gser_notify_serial_state(gser);
7194+}
7195+
7196+unsigned int gser_get_dtr(struct gserial *port)
7197+{
7198+	struct f_gser *gser = port_to_gser(port);
7199+
7200+	if (gser->port_handshake_bits & ACM_CTRL_DTR)
7201+		return 1;
7202+	else
7203+		return 0;
7204+}
7205+
7206+unsigned int gser_get_rts(struct gserial *port)
7207+{
7208+	struct f_gser *gser = port_to_gser(port);
7209+
7210+	if (gser->port_handshake_bits & ACM_CTRL_RTS)
7211+		return 1;
7212+	else
7213+		return 0;
7214+}
7215+
7216+unsigned int gser_send_carrier_detect(struct gserial *port, unsigned int yes)
7217+{
7218+	struct f_gser *gser = port_to_gser(port);
7219+	u16			state;
7220+
7221+	state = gser->serial_state;
7222+	state &= ~ACM_CTRL_DCD;
7223+	if (yes)
7224+		state |= ACM_CTRL_DCD;
7225+
7226+	gser->serial_state = state;
7227+	return gser_notify_serial_state(gser);
7228+
7229+}
7230+
7231+unsigned int gser_send_ring_indicator(struct gserial *port, unsigned int yes)
7232+{
7233+	struct f_gser *gser = port_to_gser(port);
7234+	u16			state;
7235+
7236+	state = gser->serial_state;
7237+	state &= ~ACM_CTRL_RI;
7238+	if (yes)
7239+		state |= ACM_CTRL_RI;
7240+
7241+	gser->serial_state = state;
7242+	return gser_notify_serial_state(gser);
7243+
7244 }
7245+static void gser_disconnect(struct gserial *port)
7246+{
7247+	struct f_gser *gser = port_to_gser(port);
7248+
7249+	gser->serial_state &= ~(ACM_CTRL_DSR | ACM_CTRL_DCD);
7250+	gser_notify_serial_state(gser);
7251+}
7252+
7253+static int gser_send_break(struct gserial *port, int duration)
7254+{
7255+	struct f_gser *gser = port_to_gser(port);
7256+	u16			state;
7257+
7258+	state = gser->serial_state;
7259+	state &= ~ACM_CTRL_BRK;
7260+	if (duration)
7261+		state |= ACM_CTRL_BRK;
7262 
7263+	gser->serial_state = state;
7264+	return gser_notify_serial_state(gser);
7265+}
7266+
7267+static int gser_send_modem_ctrl_bits(struct gserial *port, int ctrl_bits)
7268+{
7269+	struct f_gser *gser = port_to_gser(port);
7270+
7271+	gser->serial_state = ctrl_bits;
7272+
7273+	return gser_notify_serial_state(gser);
7274+}
7275+#endif
7276 /*-------------------------------------------------------------------------*/
7277 
7278 /* serial function driver setup/binding */
7279@@ -225,6 +863,23 @@ static int gser_bind(struct usb_configuration *c, struct usb_function *f)
7280 	gser->port.out = ep;
7281 	ep->driver_data = cdev;	/* claim */
7282 
7283+#ifdef CONFIG_MODEM_SUPPORT
7284+	ep = usb_ep_autoconfig(cdev->gadget, &gser_fs_notify_desc);
7285+	if (!ep)
7286+		goto fail;
7287+	gser->notify = ep;
7288+	ep->driver_data = cdev;	/* claim */
7289+	/* allocate notification */
7290+	gser->notify_req = gs_alloc_req(ep,
7291+			sizeof(struct usb_cdc_notification) + 2,
7292+			GFP_KERNEL);
7293+	if (!gser->notify_req)
7294+		goto fail;
7295+
7296+	gser->notify_req->complete = gser_notify_complete;
7297+	gser->notify_req->context = gser;
7298+#endif
7299+
7300 	/* support all relevant hardware speeds... we expect that when
7301 	 * hardware is dual speed, all bulk-capable endpoints work at
7302 	 * both speeds
7303@@ -235,10 +890,26 @@ static int gser_bind(struct usb_configuration *c, struct usb_function *f)
7304 	gser_ss_in_desc.bEndpointAddress = gser_fs_in_desc.bEndpointAddress;
7305 	gser_ss_out_desc.bEndpointAddress = gser_fs_out_desc.bEndpointAddress;
7306 
7307+	if (gadget_is_dualspeed(c->cdev->gadget)) {
7308+#ifdef CONFIG_MODEM_SUPPORT
7309+		gser_hs_notify_desc.bEndpointAddress =
7310+				gser_fs_notify_desc.bEndpointAddress;
7311+#endif
7312+	}
7313+	if (gadget_is_superspeed(c->cdev->gadget)) {
7314+#ifdef CONFIG_MODEM_SUPPORT
7315+		gser_ss_notify_desc.bEndpointAddress =
7316+				gser_fs_notify_desc.bEndpointAddress;
7317+#endif
7318+	}
7319+
7320 	status = usb_assign_descriptors(f, gser_fs_function, gser_hs_function,
7321 			gser_ss_function);
7322 	if (status)
7323 		goto fail;
7324+
7325+	gserial_ports[gser->port_num].gser_ptr = gser;
7326+
7327 	DBG(cdev, "generic ttyGS%d: %s speed IN/%s OUT/%s\n",
7328 			gser->port_num,
7329 			gadget_is_superspeed(c->cdev->gadget) ? "super" :
7330@@ -247,6 +918,14 @@ static int gser_bind(struct usb_configuration *c, struct usb_function *f)
7331 	return 0;
7332 
7333 fail:
7334+#ifdef CONFIG_MODEM_SUPPORT
7335+	if (gser->notify_req)
7336+		gs_free_req(gser->notify, gser->notify_req);
7337+
7338+	/* we might as well release our claims on endpoints */
7339+	if (gser->notify)
7340+		gser->notify->driver_data = NULL;
7341+#endif
7342 	/* we might as well release our claims on endpoints */
7343 	if (gser->port.out)
7344 		gser->port.out->driver_data = NULL;
7345@@ -316,7 +995,9 @@ static void gser_free_inst(struct usb_function_instance *f)
7346 	struct f_serial_opts *opts;
7347 
7348 	opts = container_of(f, struct f_serial_opts, func_inst);
7349-	gserial_free_line(opts->port_num);
7350+	if (!nr_ports)
7351+		gserial_free_line(opts->port_num);
7352+
7353 	kfree(opts);
7354 }
7355 
7356@@ -330,10 +1011,14 @@ static struct usb_function_instance *gser_alloc_inst(void)
7357 		return ERR_PTR(-ENOMEM);
7358 
7359 	opts->func_inst.free_func_inst = gser_free_inst;
7360-	ret = gserial_alloc_line(&opts->port_num);
7361-	if (ret) {
7362-		kfree(opts);
7363-		return ERR_PTR(ret);
7364+
7365+	/* Check if tty registration is handled here or not */
7366+	if (!nr_ports) {
7367+		ret = gserial_alloc_line(&opts->port_num);
7368+		if (ret) {
7369+			kfree(opts);
7370+			return ERR_PTR(ret);
7371+		}
7372 	}
7373 	config_group_init_type_name(&opts->func_inst.group, "",
7374 				    &serial_func_type);
7375@@ -346,12 +1031,41 @@ static void gser_free(struct usb_function *f)
7376 	struct f_gser *serial;
7377 
7378 	serial = func_to_gser(f);
7379+	pr_debug("%s: port %d", __func__, serial->port_num);
7380+
7381+	gserial_ports[serial->port_num].gser_ptr = NULL;
7382 	kfree(serial);
7383+	gser_next_free_port--;
7384 }
7385 
7386 static void gser_unbind(struct usb_configuration *c, struct usb_function *f)
7387 {
7388+	struct f_gser *gser = func_to_gser(f);
7389+
7390 	usb_free_all_descriptors(f);
7391+#ifdef CONFIG_MODEM_SUPPORT
7392+	gs_free_req(gser->notify, gser->notify_req);
7393+#endif
7394+
7395+	gserial_ports[gser->port_num].gser_ptr = NULL;
7396+}
7397+
7398+static int gser_init(void)
7399+{
7400+	int ret;
7401+
7402+	pr_debug("%s: initialize serial function instance", __func__);
7403+
7404+	if (registered)
7405+		return 0;
7406+
7407+	ret = misc_register(&gser_device);
7408+	if (ret)
7409+		pr_err("Serial driver failed to register");
7410+	else
7411+		registered = 1;
7412+
7413+	return ret;
7414 }
7415 
7416 struct usb_function *gser_alloc(struct usb_function_instance *fi)
7417@@ -366,6 +1080,12 @@ struct usb_function *gser_alloc(struct usb_function_instance *fi)
7418 
7419 	opts = container_of(fi, struct f_serial_opts, func_inst);
7420 
7421+#ifdef CONFIG_MODEM_SUPPORT
7422+	spin_lock_init(&gser->lock);
7423+#endif
7424+	if (nr_ports)
7425+		opts->port_num = gser_next_free_port++;
7426+
7427 	gser->port_num = opts->port_num;
7428 
7429 	gser->port.func.name = "gser";
7430@@ -375,6 +1095,27 @@ struct usb_function *gser_alloc(struct usb_function_instance *fi)
7431 	gser->port.func.set_alt = gser_set_alt;
7432 	gser->port.func.disable = gser_disable;
7433 	gser->port.func.free_func = gser_free;
7434+	gser->transport		= gserial_ports[opts->port_num].transport;
7435+#ifdef CONFIG_MODEM_SUPPORT
7436+	/* We support only three ports for now */
7437+	if (opts->port_num == 0)
7438+		gser->port.func.name = "modem";
7439+	else if (opts->port_num == 1)
7440+		gser->port.func.name = "nmea";
7441+	else
7442+		gser->port.func.name = "modem2";
7443+	gser->port.func.setup = gser_setup;
7444+	gser->port.connect = gser_connect;
7445+	gser->port.get_dtr = gser_get_dtr;
7446+	gser->port.get_rts = gser_get_rts;
7447+	gser->port.send_carrier_detect = gser_send_carrier_detect;
7448+	gser->port.send_ring_indicator = gser_send_ring_indicator;
7449+	gser->port.send_modem_ctrl_bits = gser_send_modem_ctrl_bits;
7450+	gser->port.disconnect = gser_disconnect;
7451+	gser->port.send_break = gser_send_break;
7452+#endif
7453+	gserial_ports[gser->port_num].gser_ptr = gser;
7454+	gser_init();
7455 
7456 	return &gser->port.func;
7457 }
7458@@ -383,3 +1124,269 @@ DECLARE_USB_FUNCTION_INIT(gser, gser_alloc_inst, gser_alloc);
7459 MODULE_LICENSE("GPL");
7460 MODULE_AUTHOR("Al Borchers");
7461 MODULE_AUTHOR("David Brownell");
7462+
7463+/**
7464+ * gserial_init_port - bind a gserial_port to its transport
7465+ */
7466+int gserial_init_port(int port_num, const char *name,
7467+		const char *port_name)
7468+{
7469+	enum transport_type transport;
7470+	int ret = 0;
7471+
7472+	if (port_num >= GSERIAL_NO_PORTS)
7473+		return -ENODEV;
7474+
7475+	transport = str_to_xport(name);
7476+	pr_debug("%s, port:%d, transport:%s\n", __func__,
7477+			port_num, xport_to_str(transport));
7478+
7479+	gserial_ports[port_num].transport = transport;
7480+	gserial_ports[port_num].port_num = port_num;
7481+
7482+	switch (transport) {
7483+	case USB_GADGET_XPORT_TTY:
7484+		no_tty_ports++;
7485+		break;
7486+	case USB_GADGET_XPORT_SMD:
7487+		gserial_ports[port_num].client_port_num = no_smd_ports;
7488+		no_smd_ports++;
7489+		break;
7490+	case USB_GADGET_XPORT_HSIC:
7491+		ghsic_ctrl_set_port_name(port_name, name);
7492+		ghsic_data_set_port_name(port_name, name);
7493+
7494+		/*client port number will be updated in gport_setup*/
7495+		no_hsic_sports++;
7496+		break;
7497+	case USB_GADGET_XPORT_HSUART:
7498+		/*client port number will be updated in gport_setup*/
7499+		no_hsuart_sports++;
7500+		break;
7501+	default:
7502+		pr_err("%s: Un-supported transport transport: %u\n",
7503+				__func__, gserial_ports[port_num].transport);
7504+		return -ENODEV;
7505+	}
7506+
7507+	nr_ports++;
7508+
7509+	return ret;
7510+}
7511+
7512+
7513+bool gserial_is_connected(void)
7514+{
7515+	if (gserial_ports[0].gser_ptr != NULL)
7516+		return gserial_ports[0].gser_ptr->online;
7517+	return 0;
7518+}
7519+
7520+bool gserial_is_dun_w_softap_enabled(void)
7521+{
7522+	if (gserial_ports[0].gser_ptr != NULL)
7523+		return gserial_ports[0].dun_w_softap_enable;
7524+	return 0;
7525+}
7526+
7527+void gserial_dun_w_softap_enable(bool enable)
7528+{
7529+	pr_debug("android_usb: Setting dun_w_softap_enable to %u.",
7530+		enable);
7531+
7532+	gserial_ports[0].dun_w_softap_enable = enable;
7533+}
7534+
7535+bool gserial_is_dun_w_softap_active(void)
7536+{
7537+	if (gserial_ports[0].gser_ptr != NULL)
7538+		return gserial_ports[0].dun_w_softap_enable &&
7539+			gserial_ports[0].gser_ptr->online;
7540+	return 0;
7541+}
7542+
7543+static inline int gser_device_lock(atomic_t *excl)
7544+{
7545+	if (atomic_inc_return(excl) == 1) {
7546+		return 0;
7547+	} else {
7548+		atomic_dec(excl);
7549+		return -EBUSY;
7550+	}
7551+}
7552+
7553+static inline void gser_device_unlock(atomic_t *excl)
7554+{
7555+	atomic_dec(excl);
7556+}
7557+
7558+static int gser_open_dev(struct inode *ip, struct file *fp)
7559+{
7560+	struct f_gser *gser = gserial_ports[0].gser_ptr;
7561+
7562+	pr_debug("%s: Open serial device", __func__);
7563+
7564+	if (!gser) {
7565+		pr_err("%s: Serial device not created yet", __func__);
7566+		return -ENODEV;
7567+	}
7568+
7569+	if (gser_device_lock(&gser->open_excl)) {
7570+		pr_err("%s: Already opened", __func__);
7571+		return -EBUSY;
7572+	}
7573+
7574+	fp->private_data = gser;
7575+	pr_debug("%s: Serial device opened", __func__);
7576+
7577+	return 0;
7578+}
7579+
7580+static int gser_release_dev(struct inode *ip, struct file *fp)
7581+{
7582+	struct f_gser *gser = fp->private_data;
7583+
7584+	pr_debug("%s: Close serial device", __func__);
7585+
7586+	if (!gser) {
7587+		pr_err("Serial device not created yet\n");
7588+		return -ENODEV;
7589+	}
7590+
7591+	gser_device_unlock(&gser->open_excl);
7592+
7593+	return 0;
7594+}
7595+
7596+static void gser_ioctl_set_transport(struct f_gser *gser,
7597+	unsigned int transport)
7598+{
7599+	int ret;
7600+	enum transport_type new_transport;
7601+	const struct usb_endpoint_descriptor *ep_in_desc_backup;
7602+	const struct usb_endpoint_descriptor *ep_out_desc_backup;
7603+
7604+	if (transport == GSERIAL_SET_XPORT_TYPE_TTY) {
7605+		new_transport = USB_GADGET_XPORT_TTY;
7606+		pr_debug("%s: Switching modem transport to TTY.", __func__);
7607+		gser->port.flags |= ASYNC_LOW_LATENCY;
7608+	} else if (transport == GSERIAL_SET_XPORT_TYPE_SMD) {
7609+		new_transport = USB_GADGET_XPORT_SMD;
7610+		pr_debug("%s: Switching modem transport to SMD.", __func__);
7611+	} else {
7612+		pr_err("%s: Wrong transport type %d", __func__, transport);
7613+		return;
7614+	}
7615+
7616+	if (gser->transport == new_transport) {
7617+		pr_debug("%s: Modem transport aready set to this type.",
7618+			__func__);
7619+		return;
7620+	}
7621+
7622+	ep_in_desc_backup  = gser->port.in->desc;
7623+	ep_out_desc_backup = gser->port.out->desc;
7624+	gport_disconnect(gser);
7625+	if (new_transport == USB_GADGET_XPORT_TTY) {
7626+		ret = gserial_alloc_line(
7627+			&gserial_ports[gser->port_num].client_port_num);
7628+		if (ret)
7629+			pr_debug("%s: Unable to alloc TTY line", __func__);
7630+	}
7631+
7632+	gser->port.in->desc  = ep_in_desc_backup;
7633+	gser->port.out->desc = ep_out_desc_backup;
7634+	gser->transport = new_transport;
7635+	gport_connect(gser);
7636+	pr_debug("%s: Modem transport switch is complete.", __func__);
7637+
7638+}
7639+
7640+static long gser_ioctl(struct file *fp, unsigned cmd, unsigned long arg)
7641+{
7642+	int ret = 0;
7643+	int count;
7644+	int xport_type;
7645+	int smd_port_num;
7646+	char smd_write_buf[GSERIAL_BUF_LEN];
7647+	struct ioctl_smd_write_arg_type smd_write_arg;
7648+	struct f_gser *gser;
7649+	void __user *argp = (void __user *)arg;
7650+
7651+	if (!fp || !fp->private_data) {
7652+		pr_err("%s: Invalid file handle", __func__);
7653+		return -EBADFD;
7654+	}
7655+
7656+	gser = fp->private_data;
7657+	pr_debug("Received command %d", cmd);
7658+
7659+	if (gser_device_lock(&gser->ioctl_excl))
7660+		return -EBUSY;
7661+
7662+	switch (cmd) {
7663+	case GSERIAL_SET_XPORT_TYPE:
7664+		if (copy_from_user(&xport_type, argp, sizeof(xport_type))) {
7665+			pr_err("%s: failed to copy IOCTL set transport type",
7666+				__func__);
7667+			ret = -EFAULT;
7668+			break;
7669+		}
7670+
7671+		gser_ioctl_set_transport(gser, xport_type);
7672+		break;
7673+
7674+	case GSERIAL_SMD_WRITE:
7675+		if (gser->transport != USB_GADGET_XPORT_SMD) {
7676+			pr_err("%s: ERR: Got SMD WR cmd when not in SMD mode",
7677+				__func__);
7678+
7679+			break;
7680+		}
7681+
7682+		pr_debug("%s: Copy GSERIAL_SMD_WRITE IOCTL command argument",
7683+			__func__);
7684+		if (copy_from_user(&smd_write_arg, argp,
7685+			sizeof(smd_write_arg))) {
7686+			ret = -EFAULT;
7687+
7688+			pr_err("%s: failed to copy IOCTL GSERIAL_SMD_WRITE arg",
7689+				__func__);
7690+
7691+			break;
7692+		}
7693+		smd_port_num =
7694+			gserial_ports[gser->port_num].client_port_num;
7695+
7696+		pr_debug("%s: Copying %d bytes from user buffer to local\n",
7697+			__func__, smd_write_arg.size);
7698+
7699+		if (copy_from_user(smd_write_buf, smd_write_arg.buf,
7700+			smd_write_arg.size)) {
7701+
7702+			pr_err("%s: failed to copy buf for GSERIAL_SMD_WRITE",
7703+				__func__);
7704+
7705+			ret = -EFAULT;
7706+			break;
7707+		}
7708+
7709+		pr_debug("%s: Writing %d bytes to SMD channel\n",
7710+			__func__, smd_write_arg.size);
7711+
7712+		count = gsmd_write(smd_port_num, smd_write_buf,
7713+			smd_write_arg.size);
7714+
7715+		if (count != smd_write_arg.size)
7716+			ret = -EFAULT;
7717+
7718+		break;
7719+	default:
7720+		pr_err("Unsupported IOCTL");
7721+		ret = -EINVAL;
7722+	}
7723+
7724+	gser_device_unlock(&gser->ioctl_excl);
7725+	return ret;
7726+}
7727+
7728diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c
7729index 693f0c2..fb2b81d 100644
7730--- a/drivers/usb/gadget/rndis.c
7731+++ b/drivers/usb/gadget/rndis.c
7732@@ -35,7 +35,7 @@
7733 #include <asm/io.h>
7734 #include <asm/byteorder.h>
7735 #include <asm/unaligned.h>
7736-
7737+#include "u_bam_data.h"
7738 
7739 #undef	VERBOSE_DEBUG
7740 
7741@@ -59,6 +59,16 @@ MODULE_PARM_DESC (rndis_debug, "enable debugging");
7742 
7743 #define RNDIS_MAX_CONFIGS	1
7744 
7745+int rndis_ul_max_pkt_per_xfer_rcvd;
7746+module_param(rndis_ul_max_pkt_per_xfer_rcvd, int, S_IRUGO);
7747+MODULE_PARM_DESC(rndis_ul_max_pkt_per_xfer_rcvd,
7748+	"Max num of REMOTE_NDIS_PACKET_MSGs received in a single transfer");
7749+
7750+int rndis_ul_max_xfer_size_rcvd;
7751+module_param(rndis_ul_max_xfer_size_rcvd, int, S_IRUGO);
7752+MODULE_PARM_DESC(rndis_ul_max_xfer_size_rcvd,
7753+	"Max size of bus transfer received");
7754+
7755 
7756 static rndis_params rndis_per_dev_params[RNDIS_MAX_CONFIGS];
7757 
7758@@ -534,14 +544,11 @@ static int gen_ndis_set_resp(u8 configNr, u32 OID, u8 *buf, u32 buf_len,
7759 		 */
7760 		retval = 0;
7761 		if (*params->filter) {
7762-			params->state = RNDIS_DATA_INITIALIZED;
7763-			netif_carrier_on(params->dev);
7764-			if (netif_running(params->dev))
7765-				netif_wake_queue(params->dev);
7766+			pr_debug("%s(): disable flow control\n", __func__);
7767+			rndis_flow_control(configNr, false);
7768 		} else {
7769-			params->state = RNDIS_INITIALIZED;
7770-			netif_carrier_off(params->dev);
7771-			netif_stop_queue(params->dev);
7772+			pr_debug("%s(): enable flow control\n", __func__);
7773+			rndis_flow_control(configNr, true);
7774 		}
7775 		break;
7776 
7777@@ -585,16 +592,17 @@ static int rndis_init_response(int configNr, rndis_init_msg_type *buf)
7778 	resp->MinorVersion = cpu_to_le32(RNDIS_MINOR_VERSION);
7779 	resp->DeviceFlags = cpu_to_le32(RNDIS_DF_CONNECTIONLESS);
7780 	resp->Medium = cpu_to_le32(RNDIS_MEDIUM_802_3);
7781-	resp->MaxPacketsPerTransfer = cpu_to_le32(1);
7782-	resp->MaxTransferSize = cpu_to_le32(
7783-		  params->dev->mtu
7784+	resp->MaxPacketsPerTransfer = cpu_to_le32(params->max_pkt_per_xfer);
7785+	resp->MaxTransferSize = cpu_to_le32(params->max_pkt_per_xfer *
7786+		(params->dev->mtu
7787 		+ sizeof(struct ethhdr)
7788 		+ sizeof(struct rndis_packet_msg_type)
7789-		+ 22);
7790-	resp->PacketAlignmentFactor = cpu_to_le32(0);
7791+		+ 22));
7792+	resp->PacketAlignmentFactor = cpu_to_le32(params->pkt_alignment_factor);
7793 	resp->AFListOffset = cpu_to_le32(0);
7794 	resp->AFListSize = cpu_to_le32(0);
7795 
7796+	params->ul_max_xfer_size = le32_to_cpu(resp->MaxTransferSize);
7797 	params->resp_avail(params->v);
7798 	return 0;
7799 }
7800@@ -686,6 +694,12 @@ static int rndis_reset_response(int configNr, rndis_reset_msg_type *buf)
7801 	rndis_reset_cmplt_type *resp;
7802 	rndis_resp_t *r;
7803 	struct rndis_params *params = rndis_per_dev_params + configNr;
7804+	u32 length;
7805+	u8 *xbuf;
7806+
7807+	/* drain the response queue */
7808+	while ((xbuf = rndis_get_next_response(configNr, &length)))
7809+		rndis_free_response(configNr, xbuf);
7810 
7811 	r = rndis_add_response(configNr, sizeof(rndis_reset_cmplt_type));
7812 	if (!r)
7813@@ -794,7 +808,7 @@ void rndis_set_host_mac(int configNr, const u8 *addr)
7814  */
7815 int rndis_msg_parser(u8 configNr, u8 *buf)
7816 {
7817-	u32 MsgType, MsgLength;
7818+	u32 MsgType, MsgLength, major, minor, max_transfer_size;
7819 	__le32 *tmp;
7820 	struct rndis_params *params;
7821 
7822@@ -819,6 +833,19 @@ int rndis_msg_parser(u8 configNr, u8 *buf)
7823 	case RNDIS_MSG_INIT:
7824 		pr_debug("%s: RNDIS_MSG_INIT\n",
7825 			__func__);
7826+		tmp++; /* to get RequestID */
7827+		major = get_unaligned_le32(tmp++);
7828+		minor = get_unaligned_le32(tmp++);
7829+		max_transfer_size = get_unaligned_le32(tmp++);
7830+
7831+		params->host_rndis_major_ver = major;
7832+		params->host_rndis_minor_ver = minor;
7833+		params->dl_max_xfer_size = max_transfer_size;
7834+
7835+		pr_debug("%s(): RNDIS Host Major:%d Minor:%d version\n",
7836+					__func__, major, minor);
7837+		pr_debug("%s(): UL Max Transfer size:%x\n", __func__,
7838+					max_transfer_size);
7839 		params->state = RNDIS_INITIALIZED;
7840 		return rndis_init_response(configNr,
7841 					(rndis_init_msg_type *)buf);
7842@@ -826,11 +853,17 @@ int rndis_msg_parser(u8 configNr, u8 *buf)
7843 	case RNDIS_MSG_HALT:
7844 		pr_debug("%s: RNDIS_MSG_HALT\n",
7845 			__func__);
7846-		params->state = RNDIS_UNINITIALIZED;
7847-		if (params->dev) {
7848-			netif_carrier_off(params->dev);
7849-			netif_stop_queue(params->dev);
7850+
7851+		if (!is_rndis_ipa_supported()) {
7852+			if (params->dev) {
7853+				netif_carrier_off(params->dev);
7854+				netif_stop_queue(params->dev);
7855+			}
7856+		} else {
7857+			if (params->state == RNDIS_DATA_INITIALIZED)
7858+				u_bam_data_stop_rndis_ipa();
7859 		}
7860+		params->state = RNDIS_UNINITIALIZED;
7861 		return 0;
7862 
7863 	case RNDIS_MSG_QUERY:
7864@@ -883,6 +916,8 @@ int rndis_register(void (*resp_avail)(void *v), void *v)
7865 			rndis_per_dev_params[i].used = 1;
7866 			rndis_per_dev_params[i].resp_avail = resp_avail;
7867 			rndis_per_dev_params[i].v = v;
7868+			rndis_per_dev_params[i].max_pkt_per_xfer = 1;
7869+			rndis_per_dev_params[i].pkt_alignment_factor = 0;
7870 			pr_debug("%s: configNr = %d\n", __func__, i);
7871 			return i;
7872 		}
7873@@ -910,6 +945,10 @@ int rndis_set_param_dev(u8 configNr, struct net_device *dev, u16 *cdc_filter)
7874 	rndis_per_dev_params[configNr].dev = dev;
7875 	rndis_per_dev_params[configNr].filter = cdc_filter;
7876 
7877+	/* reset aggregation stats for every set_alt */
7878+	rndis_ul_max_xfer_size_rcvd = 0;
7879+	rndis_ul_max_pkt_per_xfer_rcvd = 0;
7880+
7881 	return 0;
7882 }
7883 
7884@@ -935,6 +974,67 @@ int rndis_set_param_medium(u8 configNr, u32 medium, u32 speed)
7885 
7886 	return 0;
7887 }
7888+u32 rndis_get_dl_max_xfer_size(u8 configNr)
7889+{
7890+	pr_debug("%s:\n", __func__);
7891+	return rndis_per_dev_params[configNr].dl_max_xfer_size;
7892+}
7893+
7894+u32 rndis_get_ul_max_xfer_size(u8 configNr)
7895+{
7896+	pr_debug("%s:\n", __func__);
7897+	return rndis_per_dev_params[configNr].ul_max_xfer_size;
7898+}
7899+
7900+void rndis_set_max_pkt_xfer(u8 configNr, u8 max_pkt_per_xfer)
7901+{
7902+	pr_debug("%s:\n", __func__);
7903+
7904+	rndis_per_dev_params[configNr].max_pkt_per_xfer = max_pkt_per_xfer;
7905+}
7906+
7907+void rndis_set_pkt_alignment_factor(u8 configNr, u8 pkt_alignment_factor)
7908+{
7909+	pr_debug("%s:\n", __func__);
7910+
7911+	rndis_per_dev_params[configNr].pkt_alignment_factor =
7912+					pkt_alignment_factor;
7913+}
7914+/**
7915+ * rndis_flow_control: enable/disable flow control with USB RNDIS interface
7916+ * confignr - RNDIS network interface number
7917+ * enable_flow_control - true: perform flow control, false: disable flow control
7918+ *
7919+ * In BAM2BAM IPA mode, this function triggers functionality to start/stop
7920+ * endless transfers, otherwise it enables/disables RNDIS network interface.
7921+ */
7922+void rndis_flow_control(u8 confignr, bool enable_flow_control)
7923+{
7924+	struct rndis_params *params;
7925+
7926+	params = &rndis_per_dev_params[confignr];
7927+	pr_debug("%s(): params->state:%x\n", __func__, params->state);
7928+	if (enable_flow_control) {
7929+		if (is_rndis_ipa_supported()) {
7930+			if (params->state == RNDIS_DATA_INITIALIZED)
7931+				u_bam_data_stop_rndis_ipa();
7932+		} else {
7933+			netif_carrier_off(params->dev);
7934+			netif_stop_queue(params->dev);
7935+		}
7936+		params->state = RNDIS_INITIALIZED;
7937+	} else {
7938+		if (is_rndis_ipa_supported()) {
7939+			if (params->state != RNDIS_DATA_INITIALIZED)
7940+				u_bam_data_start_rndis_ipa();
7941+		} else {
7942+			netif_carrier_on(params->dev);
7943+			if (netif_running(params->dev))
7944+				netif_wake_queue(params->dev);
7945+		}
7946+		params->state = RNDIS_DATA_INITIALIZED;
7947+	}
7948+}
7949 
7950 void rndis_add_hdr(struct sk_buff *skb)
7951 {
7952@@ -954,25 +1054,33 @@ void rndis_free_response(int configNr, u8 *buf)
7953 {
7954 	rndis_resp_t *r;
7955 	struct list_head *act, *tmp;
7956+	unsigned long flags;
7957 
7958+	spin_lock_irqsave(&rndis_per_dev_params[configNr].lock, flags);
7959 	list_for_each_safe(act, tmp,
7960 			&(rndis_per_dev_params[configNr].resp_queue))
7961 	{
7962+		if (!act)
7963+			continue;
7964+
7965 		r = list_entry(act, rndis_resp_t, list);
7966 		if (r && r->buf == buf) {
7967 			list_del(&r->list);
7968 			kfree(r);
7969 		}
7970 	}
7971+	spin_unlock_irqrestore(&rndis_per_dev_params[configNr].lock, flags);
7972 }
7973 
7974 u8 *rndis_get_next_response(int configNr, u32 *length)
7975 {
7976 	rndis_resp_t *r;
7977 	struct list_head *act, *tmp;
7978+	unsigned long flags;
7979 
7980 	if (!length) return NULL;
7981 
7982+	spin_lock_irqsave(&rndis_per_dev_params[configNr].lock, flags);
7983 	list_for_each_safe(act, tmp,
7984 			&(rndis_per_dev_params[configNr].resp_queue))
7985 	{
7986@@ -980,9 +1088,12 @@ u8 *rndis_get_next_response(int configNr, u32 *length)
7987 		if (!r->send) {
7988 			r->send = 1;
7989 			*length = r->length;
7990+			spin_unlock_irqrestore(
7991+				&rndis_per_dev_params[configNr].lock, flags);
7992 			return r->buf;
7993 		}
7994 	}
7995+	spin_unlock_irqrestore(&rndis_per_dev_params[configNr].lock, flags);
7996 
7997 	return NULL;
7998 }
7999@@ -990,6 +1101,7 @@ u8 *rndis_get_next_response(int configNr, u32 *length)
8000 static rndis_resp_t *rndis_add_response(int configNr, u32 length)
8001 {
8002 	rndis_resp_t *r;
8003+	unsigned long flags;
8004 
8005 	/* NOTE: this gets copied into ether.c USB_BUFSIZ bytes ... */
8006 	r = kmalloc(sizeof(rndis_resp_t) + length, GFP_ATOMIC);
8007@@ -999,8 +1111,10 @@ static rndis_resp_t *rndis_add_response(int configNr, u32 length)
8008 	r->length = length;
8009 	r->send = 0;
8010 
8011+	spin_lock_irqsave(&rndis_per_dev_params[configNr].lock, flags);
8012 	list_add_tail(&r->list,
8013 		&(rndis_per_dev_params[configNr].resp_queue));
8014+	spin_unlock_irqrestore(&rndis_per_dev_params[configNr].lock, flags);
8015 	return r;
8016 }
8017 
8018@@ -1008,25 +1122,72 @@ int rndis_rm_hdr(struct gether *port,
8019 			struct sk_buff *skb,
8020 			struct sk_buff_head *list)
8021 {
8022-	/* tmp points to a struct rndis_packet_msg_type */
8023-	__le32 *tmp = (void *)skb->data;
8024+	int num_pkts = 0;
8025 
8026-	/* MessageType, MessageLength */
8027-	if (cpu_to_le32(RNDIS_MSG_PACKET)
8028-			!= get_unaligned(tmp++)) {
8029-		dev_kfree_skb_any(skb);
8030-		return -EINVAL;
8031-	}
8032-	tmp++;
8033+	if (skb->len > rndis_ul_max_xfer_size_rcvd)
8034+		rndis_ul_max_xfer_size_rcvd = skb->len;
8035+
8036+	while (skb->len) {
8037+		struct rndis_packet_msg_type *hdr;
8038+		struct sk_buff		*skb2;
8039+		u32		msg_len, data_offset, data_len;
8040+
8041+		if (skb->len < sizeof *hdr) {
8042+			pr_err("invalid rndis pkt: skblen:%u hdr_len:%zu",
8043+					skb->len, sizeof *hdr);
8044+			dev_kfree_skb_any(skb);
8045+			return -EINVAL;
8046+		}
8047+
8048+		hdr = (void *)skb->data;
8049+		msg_len = le32_to_cpu(hdr->MessageLength);
8050+		data_offset = le32_to_cpu(hdr->DataOffset);
8051+		data_len = le32_to_cpu(hdr->DataLength);
8052+
8053+		if (skb->len < msg_len ||
8054+			((data_offset + data_len + 8) > msg_len)) {
8055+			pr_err("invalid rndis message: %d/%d/%d/%d, len:%d\n",
8056+				le32_to_cpu(hdr->MessageType),
8057+				msg_len, data_offset, data_len, skb->len);
8058+			dev_kfree_skb_any(skb);
8059+			return -EOVERFLOW;
8060+		}
8061+
8062+		if (le32_to_cpu(hdr->MessageType) != RNDIS_MSG_PACKET) {
8063+			pr_err("invalid rndis message: %d/%d/%d/%d, len:%d\n",
8064+				le32_to_cpu(hdr->MessageType),
8065+				msg_len, data_offset, data_len, skb->len);
8066+			dev_kfree_skb_any(skb);
8067+			return -EINVAL;
8068+		}
8069 
8070-	/* DataOffset, DataLength */
8071-	if (!skb_pull(skb, get_unaligned_le32(tmp++) + 8)) {
8072-		dev_kfree_skb_any(skb);
8073-		return -EOVERFLOW;
8074+		num_pkts++;
8075+
8076+		skb_pull(skb, data_offset + 8);
8077+
8078+		if (data_len == skb->len ||
8079+				data_len == (skb->len - 1)) {
8080+			skb_trim(skb, data_len);
8081+			break;
8082+		}
8083+
8084+		skb2 = skb_clone(skb, GFP_ATOMIC);
8085+		if (!skb2) {
8086+			pr_err("%s:skb clone failed\n", __func__);
8087+			dev_kfree_skb_any(skb);
8088+			return -ENOMEM;
8089+		}
8090+
8091+		skb_pull(skb, msg_len - sizeof *hdr);
8092+		skb_trim(skb2, data_len);
8093+		skb_queue_tail(list, skb2);
8094 	}
8095-	skb_trim(skb, get_unaligned_le32(tmp++));
8096+
8097+	if (num_pkts > rndis_ul_max_pkt_per_xfer_rcvd)
8098+		rndis_ul_max_pkt_per_xfer_rcvd = num_pkts;
8099 
8100 	skb_queue_tail(list, skb);
8101+
8102 	return 0;
8103 }
8104 
8105@@ -1044,7 +1205,10 @@ static int rndis_proc_show(struct seq_file *m, void *v)
8106 			 "speed     : %d\n"
8107 			 "cable     : %s\n"
8108 			 "vendor ID : 0x%08X\n"
8109-			 "vendor    : %s\n",
8110+			 "vendor    : %s\n"
8111+			 "ul-max-xfer-size:%zu max-xfer-size-rcvd: %d\n"
8112+			 "ul-max-pkts-per-xfer:%d max-pkts-per-xfer-rcvd:%d\n"
8113+			"pkt_alignment_factor:%d\n",
8114 			 param->confignr, (param->used) ? "y" : "n",
8115 			 ({ char *s = "?";
8116 			 switch (param->state) {
8117@@ -1058,7 +1222,14 @@ static int rndis_proc_show(struct seq_file *m, void *v)
8118 			 param->medium,
8119 			 (param->media_state) ? 0 : param->speed*100,
8120 			 (param->media_state) ? "disconnected" : "connected",
8121-			 param->vendorID, param->vendorDescr);
8122+			 param->vendorID, param->vendorDescr,
8123+			 param->max_pkt_per_xfer *
8124+				 (param->dev->mtu + sizeof(struct ethhdr) +
8125+				  sizeof(struct rndis_packet_msg_type) + 22),
8126+			 rndis_ul_max_xfer_size_rcvd,
8127+			 param->max_pkt_per_xfer,
8128+			 rndis_ul_max_pkt_per_xfer_rcvd,
8129+			param->pkt_alignment_factor);
8130 	return 0;
8131 }
8132 
8133@@ -1154,9 +1325,11 @@ int rndis_init(void)
8134 			return -EIO;
8135 		}
8136 #endif
8137+		spin_lock_init(&(rndis_per_dev_params[i].lock));
8138 		rndis_per_dev_params[i].confignr = i;
8139 		rndis_per_dev_params[i].used = 0;
8140 		rndis_per_dev_params[i].state = RNDIS_UNINITIALIZED;
8141+		rndis_per_dev_params[i].pkt_alignment_factor = 0;
8142 		rndis_per_dev_params[i].media_state
8143 				= RNDIS_MEDIA_STATE_DISCONNECTED;
8144 		INIT_LIST_HEAD(&(rndis_per_dev_params[i].resp_queue));
8145diff --git a/drivers/usb/gadget/rndis.h b/drivers/usb/gadget/rndis.h
8146index 0647f2f..c48a057 100644
8147--- a/drivers/usb/gadget/rndis.h
8148+++ b/drivers/usb/gadget/rndis.h
8149@@ -189,10 +189,17 @@ typedef struct rndis_params
8150 	struct net_device	*dev;
8151 
8152 	u32			vendorID;
8153+	u8			max_pkt_per_xfer;
8154+	u8			pkt_alignment_factor;
8155 	const char		*vendorDescr;
8156 	void			(*resp_avail)(void *v);
8157 	void			*v;
8158 	struct list_head	resp_queue;
8159+	spinlock_t		lock;
8160+	u32			host_rndis_major_ver;
8161+	u32			host_rndis_minor_ver;
8162+	u32			ul_max_xfer_size;
8163+	u32			dl_max_xfer_size;
8164 } rndis_params;
8165 
8166 /* RNDIS Message parser and other useless functions */
8167@@ -204,6 +211,9 @@ int  rndis_set_param_dev (u8 configNr, struct net_device *dev,
8168 int  rndis_set_param_vendor (u8 configNr, u32 vendorID,
8169 			    const char *vendorDescr);
8170 int  rndis_set_param_medium (u8 configNr, u32 medium, u32 speed);
8171+void rndis_set_max_pkt_xfer(u8 configNr, u8 max_pkt_per_xfer);
8172+u32  rndis_get_ul_max_xfer_size(u8 configNr);
8173+u32  rndis_get_dl_max_xfer_size(u8 configNr);
8174 void rndis_add_hdr (struct sk_buff *skb);
8175 int rndis_rm_hdr(struct gether *port, struct sk_buff *skb,
8176 			struct sk_buff_head *list);
8177@@ -215,8 +225,8 @@ int  rndis_signal_connect (int configNr);
8178 int  rndis_signal_disconnect (int configNr);
8179 int  rndis_state (int configNr);
8180 extern void rndis_set_host_mac (int configNr, const u8 *addr);
8181-
8182+extern bool is_rndis_ipa_supported(void);
8183 int rndis_init(void);
8184 void rndis_exit (void);
8185-
8186+void rndis_flow_control(u8 confignr, bool enable_flow_control);
8187 #endif  /* _LINUX_RNDIS_H */
8188diff --git a/drivers/usb/gadget/storage_common.c b/drivers/usb/gadget/storage_common.c
8189index 09275cc..9835254 100644
8190--- a/drivers/usb/gadget/storage_common.c
8191+++ b/drivers/usb/gadget/storage_common.c
8192@@ -169,6 +169,9 @@ static inline struct fsg_lun *fsg_lun_from_dev(struct device *dev)
8193 #define EP0_BUFSIZE	256
8194 #define DELAYED_STATUS	(EP0_BUFSIZE + 999)	/* An impossibly large value */
8195 
8196+#ifdef CONFIG_USB_CSW_HACK
8197+#define fsg_num_buffers		4
8198+#else
8199 #ifdef CONFIG_USB_GADGET_DEBUG_FILES
8200 
8201 static unsigned int fsg_num_buffers = CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS;
8202@@ -184,6 +187,7 @@ MODULE_PARM_DESC(num_buffers, "Number of pipeline buffers");
8203 #define fsg_num_buffers	CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS
8204 
8205 #endif /* CONFIG_USB_DEBUG */
8206+#endif /* CONFIG_USB_CSW_HACK */
8207 
8208 /* check if fsg_num_buffers is within a valid range */
8209 static inline int fsg_num_buffers_validate(void)
8210@@ -434,17 +438,6 @@ static int fsg_lun_open(struct fsg_lun *curlun, const char *filename)
8211 	unsigned int			blkbits;
8212 	unsigned int			blksize;
8213 
8214-
8215-	if (filename) {
8216-		int len = strlen(filename);
8217-		if ((len > 3) &&
8218-			(!strcmp(filename + (len - 3), "ISO") ||
8219-			!strcmp(filename + (len - 3), "iso")))
8220-			curlun->cdrom = 1;
8221-		else
8222-			curlun->cdrom = 0;
8223-	}
8224-
8225 	/* R/W if we can, R/O if we must */
8226 	ro = curlun->initially_ro;
8227 	if (!ro) {
8228@@ -579,15 +572,6 @@ static ssize_t fsg_show_ro(struct device *dev, struct device_attribute *attr,
8229 				  : curlun->initially_ro);
8230 }
8231 
8232-static ssize_t fsg_show_cdrom(struct device *dev,
8233-			struct device_attribute *attr, char *buf)
8234-{
8235-	struct fsg_lun	*curlun = fsg_lun_from_dev(dev);
8236-
8237-	return sprintf(buf, "%d\n", curlun->cdrom);
8238-}
8239-
8240-
8241 static ssize_t fsg_show_nofua(struct device *dev, struct device_attribute *attr,
8242 			      char *buf)
8243 {
8244@@ -596,38 +580,6 @@ static ssize_t fsg_show_nofua(struct device *dev, struct device_attribute *attr,
8245 	return sprintf(buf, "%u\n", curlun->nofua);
8246 }
8247 
8248-
8249-static ssize_t fsg_store_cdrom(struct device *dev,
8250-			struct device_attribute *attr,
8251-			const char *buf, size_t count)
8252-{
8253-	ssize_t		rc;
8254-	struct fsg_lun	*curlun = fsg_lun_from_dev(dev);
8255-	struct rw_semaphore	*filesem = dev_get_drvdata(dev);
8256-	unsigned	cdrom;
8257-
8258-	rc = kstrtouint(buf, 2, &cdrom);
8259-	if (rc)
8260-		return rc;
8261-
8262-	/*
8263-	 * Allow the write-enable status to change only while the
8264-	 * backing file is closed.
8265-	 */
8266-	down_read(filesem);
8267-	if (fsg_lun_is_open(curlun)) {
8268-		LDBG(curlun, "cdrom status change prevented\n");
8269-		rc = -EBUSY;
8270-	} else {
8271-		curlun->cdrom = cdrom;
8272-		LDBG(curlun, "cdrom status set to %d\n", curlun->cdrom);
8273-		rc = count;
8274-	}
8275-	up_read(filesem);
8276-	return rc;
8277-}
8278-
8279-
8280 #ifdef CONFIG_USB_MSC_PROFILING
8281 static ssize_t fsg_show_perf(struct device *dev, struct device_attribute *attr,
8282 			      char *buf)
8283@@ -680,6 +632,9 @@ static ssize_t fsg_show_file(struct device *dev, struct device_attribute *attr,
8284 			rc = PTR_ERR(p);
8285 		else {
8286 			rc = strlen(p);
8287+			if (rc > PAGE_SIZE - 2)
8288+				rc = PAGE_SIZE - 2;
8289+
8290 			memmove(buf, p, rc);
8291 			buf[rc] = '\n';		/* Add a newline */
8292 			buf[++rc] = 0;
8293@@ -751,10 +706,16 @@ static ssize_t fsg_store_file(struct device *dev, struct device_attribute *attr,
8294 	struct rw_semaphore	*filesem = dev_get_drvdata(dev);
8295 	int		rc = 0;
8296 
8297+
8298+#if !defined(CONFIG_USB_G_ANDROID)
8299+	/* disabled in android because we need to allow closing the backing file
8300+	 * if the media was removed
8301+	 */
8302 	if (curlun->prevent_medium_removal && fsg_lun_is_open(curlun)) {
8303 		LDBG(curlun, "eject attempt prevented\n");
8304 		return -EBUSY;				/* "Door is locked" */
8305 	}
8306+#endif
8307 
8308 	/* Remove a trailing newline */
8309 	if (count > 0 && buf[count-1] == '\n')
8310diff --git a/drivers/usb/gadget/u_ether.c b/drivers/usb/gadget/u_ether.c
8311index 4b3602f..96276dd 100644
8312--- a/drivers/usb/gadget/u_ether.c
8313+++ b/drivers/usb/gadget/u_ether.c
8314@@ -18,11 +18,15 @@
8315 #include <linux/gfp.h>
8316 #include <linux/device.h>
8317 #include <linux/ctype.h>
8318+#include <linux/if_arp.h>
8319 #include <linux/etherdevice.h>
8320 #include <linux/ethtool.h>
8321 #include <linux/if_vlan.h>
8322-#include <linux/brcm_console.h>
8323-
8324+#include <linux/msm_rmnet.h>
8325+#include <linux/debugfs.h>
8326+#include <linux/seq_file.h>
8327+#include <linux/notifier.h>
8328+#include <linux/cpufreq.h>
8329 #include "u_ether.h"
8330 
8331 
8332@@ -49,82 +53,34 @@
8333 
8334 #define UETH__VERSION	"29-May-2008"
8335 
8336-#ifdef CONFIG_BRCM_NETCONSOLE
8337-
8338-#define USB_EVENTQUEUE_SIZE 4
8339+static struct workqueue_struct	*uether_wq;
8340+static struct workqueue_struct	*uether_tx_wq;
8341 
8342-struct usb_event_queue_t {
8343-	uint32_t		in_index;
8344-	uint32_t		out_index;
8345-	uint32_t		is_empty;
8346-	spinlock_t		usbevent_lock;
8347-	uint32_t		event[USB_EVENTQUEUE_SIZE];
8348-};
8349+static int tx_start_threshold = 1500;
8350+module_param(tx_start_threshold, uint, S_IRUGO | S_IWUSR);
8351+MODULE_PARM_DESC(tx_start_threshold,
8352+	"Threashold to start stopped network queue");
8353 
8354-static uint32_t queue_usbevent(struct usb_event_queue_t *queue, uint32_t event);
8355-static uint32_t dequeue_usbevent(struct usb_event_queue_t *queue, uint32_t *pevent);
8356-static uint32_t usb_eventqueue_init(struct usb_event_queue_t *queue);
8357+static int tx_stop_threshold = 2000;
8358+module_param(tx_stop_threshold, uint, S_IRUGO | S_IWUSR);
8359+MODULE_PARM_DESC(tx_stop_threshold,
8360+	"Threashold to stop network queue");
8361 
8362-static uint32_t usb_eventqueue_init(struct usb_event_queue_t *queue)
8363-{
8364-	spin_lock_init(&queue->usbevent_lock);
8365-	queue->in_index = 0;
8366-	queue->out_index = 0;
8367-	queue->is_empty = 1;
8368-	return 1;
8369-}
8370+static unsigned int min_cpu_freq;
8371+module_param(min_cpu_freq, uint, S_IRUGO | S_IWUSR);
8372+MODULE_PARM_DESC(min_cpu_freq,
8373+	"to set minimum cpu frquency to when ethernet ifc is active");
8374 
8375-static uint32_t is_queue_empty(struct usb_event_queue_t *queue)
8376-{
8377-	if ((queue->in_index == queue->out_index) && (queue->is_empty))
8378-		return 1;
8379-	else
8380-		return 0;
8381-}
8382-static uint32_t is_queue_full(struct usb_event_queue_t *queue)
8383-{
8384-	if ((queue->in_index == queue->out_index) && (!queue->is_empty))
8385-		return 1;
8386-	else
8387-		return 0;
8388-}
8389-
8390-static uint32_t queue_usbevent(struct usb_event_queue_t *queue, uint32_t event)
8391-{
8392-	unsigned long flags;
8393-	spin_lock_irqsave(&queue->usbevent_lock, flags);
8394-	if (is_queue_full(queue)) {
8395-		spin_unlock_irqrestore(&queue->usbevent_lock, flags);
8396-		return 0;
8397-	}
8398-	queue->event[queue->in_index++] = event;
8399-	if (queue->in_index >= USB_EVENTQUEUE_SIZE) {
8400-		queue->in_index = 0;
8401-	}
8402-	queue->is_empty = 0;
8403-	spin_unlock_irqrestore(&queue->usbevent_lock, flags);
8404-	return 1;
8405-}
8406+/* this refers to max number sgs per transfer
8407+ * which includes headers/data packets
8408+ */
8409+#define DL_MAX_PKTS_PER_XFER	20
8410 
8411-static uint32_t dequeue_usbevent(struct usb_event_queue_t *queue, uint32_t *pevent)
8412-{
8413-	unsigned long flags;
8414-	spin_lock_irqsave(&queue->usbevent_lock, flags);
8415-	if (is_queue_empty(queue)) {
8416-		spin_unlock_irqrestore(&queue->usbevent_lock, flags);
8417-		return 0;
8418-	}
8419-	*pevent = queue->event[queue->out_index++];
8420-	if (queue->out_index >= USB_EVENTQUEUE_SIZE) {
8421-		queue->out_index = 0;
8422-	}
8423-	if (queue->out_index == queue->in_index) {
8424-		queue->is_empty = 1;
8425-	}
8426-	spin_unlock_irqrestore(&queue->usbevent_lock, flags);
8427-	return 1;
8428-}
8429-#endif
8430+enum ifc_state {
8431+	ETH_UNDEFINED,
8432+	ETH_STOP,
8433+	ETH_START,
8434+};
8435 
8436 struct eth_dev {
8437 	/* lock is held while accessing port_usb
8438@@ -135,195 +91,90 @@ struct eth_dev {
8439 	struct net_device	*net;
8440 	struct usb_gadget	*gadget;
8441 
8442-	spinlock_t		req_lock
8443-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
8444-	, req_rx_lock
8445-#endif
8446-	;	/* guard {rx,tx}_reqs */
8447+	spinlock_t		req_lock;	/* guard {rx,tx}_reqs */
8448 	struct list_head	tx_reqs, rx_reqs;
8449-	atomic_t		tx_qlen;
8450+	unsigned		tx_qlen;
8451+/* Minimum number of TX USB request queued to UDC */
8452+#define TX_REQ_THRESHOLD	5
8453+	int			no_tx_req_used;
8454+	int			tx_skb_hold_count;
8455+	u32			tx_req_bufsize;
8456+	struct sk_buff_head	tx_skb_q;
8457 
8458 	struct sk_buff_head	rx_frames;
8459 
8460 	unsigned		header_len;
8461+	unsigned int		ul_max_pkts_per_xfer;
8462+	unsigned int		dl_max_pkts_per_xfer;
8463+	uint32_t		dl_max_xfer_size;
8464+	bool			rx_trigger_enabled;
8465 	struct sk_buff		*(*wrap)(struct gether *, struct sk_buff *skb);
8466 	int			(*unwrap)(struct gether *,
8467 						struct sk_buff *skb,
8468 						struct sk_buff_head *list);
8469 
8470 	struct work_struct	work;
8471-#ifdef CONFIG_BRCM_NETCONSOLE
8472-	struct usb_event_queue_t usbevent_queue;
8473-#endif
8474-
8475-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
8476-	struct workqueue_struct *rx_workqueue;
8477-	unsigned char			*skb_data;
8478-#endif
8479+	struct work_struct	rx_work;
8480+	struct work_struct	tx_work;
8481+
8482 	unsigned long		todo;
8483+	unsigned long		flags;
8484+	unsigned short		rx_needed_headroom;
8485 #define	WORK_RX_MEMORY		0
8486-#define	WORK_BRCM_NETCONSOLE_ON		1
8487-#define	WORK_BRCM_NETCONSOLE_OFF	2
8488-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
8489-#define	WORK_ALLOC_RX_SKB			4
8490-#endif
8491+
8492 	bool			zlp;
8493 	u8			host_mac[ETH_ALEN];
8494-};
8495-
8496-#ifdef CONFIG_BRCM_NETCONSOLE
8497-
8498-static DEFINE_MUTEX(cleanup_netpoll_mutex);
8499-
8500-void cleanup_netpoll_lock(void)
8501-{
8502-	mutex_lock(&cleanup_netpoll_mutex);
8503-}
8504 
8505-void cleanup_netpoll_unlock(void)
8506-{
8507-	if (mutex_is_locked(&cleanup_netpoll_mutex))
8508-		mutex_unlock(&cleanup_netpoll_mutex);
8509-}
8510-#endif
8511-
8512-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
8513-#define	MAX_RX_SKB_SIZE			2048
8514-#define	UETH_RX_SKB_THRESHOLD	192
8515-#define	UETH_RX_SKB_THRESH_NCM	48
8516-static struct sk_buff_head skb_rx_pool;
8517-static int	rx_skb_q_no;
8518-static bool is_rx_prealloc_mode;
8519-static unsigned short max_skb_buf_sz, max_skb_buf_no;
8520+	/* stats */
8521+	unsigned long		tx_throttle;
8522+	unsigned long		rx_throttle;
8523+	unsigned int		tx_aggr_cnt[DL_MAX_PKTS_PER_XFER];
8524+	unsigned int		tx_pkts_rcvd;
8525+	unsigned int		loop_brk_cnt;
8526+	struct dentry		*uether_dent;
8527+	struct dentry		*uether_dfile;
8528 
8529-/**
8530- * static void prealloc_rx_skbs(void) - the function is to alloc skb
8531- * if pre-allocated memory was able to reach the max_skb_buf_no.
8532- *
8533- */
8534-static void alloc_rx_skb(void)
8535-{
8536-	struct sk_buff *skb;
8537-	unsigned long flags;
8538+	enum ifc_state		state;
8539+	struct notifier_block	cpufreq_notifier;
8540+	struct work_struct	cpu_policy_w;
8541 
8542-	pr_debug("alloc_rx_skbs");
8543-	spin_lock_irqsave(&skb_rx_pool.lock, flags);
8544-	if (rx_skb_q_no < max_skb_buf_no) {
8545-		skb = alloc_skb(max_skb_buf_sz, GFP_ATOMIC);
8546-		if (!skb) {
8547-			spin_unlock_irqrestore(&skb_rx_pool.lock, flags);
8548-			return;
8549-		} else {
8550-			rx_skb_q_no++;
8551-			pr_debug("TX_SKB NO:%d\n", skb_rx_pool.qlen);
8552-			skb->signature = SKB_UETH_RX_THRESHOLD_SIG;
8553-			__skb_queue_tail(&skb_rx_pool, skb);
8554-		}
8555-	}
8556-	spin_unlock_irqrestore(&skb_rx_pool.lock, flags);
8557-}
8558-
8559-
8560-/**
8561- * static void refill_rx_skbs(struct sk_buff *skb) - put the skb buf back to queue to reuse
8562- *
8563- */
8564-static void refill_rx_skbs(struct sk_buff *skb)
8565-{
8566-	unsigned long flags;
8567-
8568-	spin_lock_irqsave(&skb_rx_pool.lock, flags);
8569-	if (skb) {
8570-		skb->signature = SKB_UETH_RX_THRESHOLD_SIG;
8571-		__skb_queue_tail(&skb_rx_pool, skb);
8572-		/* pr_info("@%d", skb_rx_pool.qlen); */
8573-	} else {
8574-		pr_warn("Can not refill the skb buffer....\n");
8575-	}
8576-	/* pr_info("@%d",skb_pool.qlen); */
8577-	spin_unlock_irqrestore(&skb_rx_pool.lock, flags);
8578-}
8579-
8580-static void defer_kevent(struct eth_dev *dev, int flag);
8581-
8582-/**
8583- * void ueth_recycle_rx_skbs_data - recycle the skb buffer with
8584- * the new skb header.
8585- *
8586- */
8587-void ueth_recycle_rx_skb_data(unsigned char *skb_data, gfp_t gfp_flags, void  *dev_handle)
8588-{
8589-	struct sk_buff *skb;
8590-	struct eth_dev *dev = dev_handle;
8591-
8592-	skb = alloc_skb_uether_rx(max_skb_buf_sz, skb_data, gfp_flags);
8593-	if (!skb) {
8594-		pr_warn("retry: alloc ueth rx skb\n");
8595-		dev->skb_data = skb_data;
8596-		defer_kevent(dev, WORK_ALLOC_RX_SKB);
8597-	} else
8598-		refill_rx_skbs(skb);
8599-}
8600+	bool			sg_enabled;
8601+};
8602 
8603-/**
8604- * void ueth_rx_skb_queue_purge(struct sk_buff *skb) -
8605- *	Delete all buffers on an &sk_buff list. Each buffer is removed from
8606- *	the list and one reference dropped. This function takes the list
8607- *	lock and is atomic with respect to other list locking functions.
8608- *
8609+/* when sg is enabled, sg_ctx is used to track skb each usb request will
8610+ * xfer
8611  */
8612-static void ueth_rx_skb_queue_purge(struct sk_buff_head *list)
8613-{
8614-	struct sk_buff *skb;
8615-	while ((skb = skb_dequeue(list)) != NULL) {
8616-		skb->signature = 0;
8617-		kfree_skb(skb);
8618-	}
8619-}
8620+struct sg_ctx {
8621+	struct sk_buff_head	skbs;
8622+};
8623 
8624-/**
8625- * static void prealloc_rx_skbs(void) - reserve the skb bufs with
8626- * allocated memory for rx_submit.
8627- *
8628- */
8629-static void prealloc_rx_skbs(void)
8630-{
8631-	struct sk_buff *skb;
8632-	unsigned long flags;
8633 
8634-	pr_info("prealloc_rx_skbs");
8635-	rx_skb_q_no = 0;
8636-	is_rx_prealloc_mode =  true;
8637-
8638-	skb_queue_head_init(&skb_rx_pool);
8639-	spin_lock_irqsave(&skb_rx_pool.lock, flags);
8640-	while (skb_rx_pool.qlen < max_skb_buf_no) {
8641-		skb = alloc_skb(max_skb_buf_sz, GFP_ATOMIC);
8642-		if (!skb) {
8643-			rx_skb_q_no = skb_rx_pool.qlen;
8644-			spin_unlock_irqrestore(&skb_rx_pool.lock, flags);
8645-			return;
8646-		} else {
8647-			rx_skb_q_no++;
8648-			pr_debug("TX_SKB NO:%d\n", skb_rx_pool.qlen);
8649-			skb->signature = SKB_UETH_RX_THRESHOLD_SIG;
8650-			__skb_queue_tail(&skb_rx_pool, skb);
8651-		}
8652-	}
8653-	spin_unlock_irqrestore(&skb_rx_pool.lock, flags);
8654-}
8655-#endif
8656+static void uether_debugfs_init(struct eth_dev *dev, const char *n);
8657+static void uether_debugfs_exit(struct eth_dev *dev);
8658 
8659 /*-------------------------------------------------------------------------*/
8660 
8661+
8662 #define RX_EXTRA	20	/* bytes guarding against rx overflows */
8663 
8664 #define DEFAULT_QLEN	2	/* double buffering by default */
8665 
8666-static unsigned qmult = 5;
8667+static unsigned qmult = 20;
8668 module_param(qmult, uint, S_IRUGO|S_IWUSR);
8669 MODULE_PARM_DESC(qmult, "queue length multiplier at high/super speed");
8670 
8671+/*
8672+ * Usually downlink rates are higher than uplink rates and it
8673+ * deserve higher number of requests. For CAT-6 data rates of
8674+ * 300Mbps (~30 packets per milli-sec) 40 usb request may not
8675+ * be sufficient. At this rate and with interrupt moderation
8676+ * of interconnect, data can be very bursty. tx_qmult is the
8677+ * additional multipler on qmult.
8678+ */
8679+static unsigned tx_qmult = 1;
8680+module_param(tx_qmult, uint, S_IRUGO|S_IWUSR);
8681+MODULE_PARM_DESC(tx_qmult, "Additional queue length multiplier for tx");
8682+
8683 /* for dual-speed hardware, use deeper queues at high/super speed */
8684 static inline int qlen(struct usb_gadget *gadget)
8685 {
8686@@ -335,6 +186,11 @@ static inline int qlen(struct usb_gadget *gadget)
8687 }
8688 
8689 /*-------------------------------------------------------------------------*/
8690+#define U_ETHER_RX_PENDING_TSHOLD 500
8691+
8692+static unsigned int u_ether_rx_pending_thld = U_ETHER_RX_PENDING_TSHOLD;
8693+module_param(u_ether_rx_pending_thld, uint, S_IRUGO | S_IWUSR);
8694+
8695 
8696 /* REVISIT there must be a better way than having two sets
8697  * of debug calls ...
8698@@ -392,6 +248,25 @@ static int ueth_change_mtu(struct net_device *net, int new_mtu)
8699 	return status;
8700 }
8701 
8702+static int ueth_change_mtu_ip(struct net_device *net, int new_mtu)
8703+{
8704+	struct eth_dev	*dev = netdev_priv(net);
8705+	unsigned long	flags;
8706+	int		status = 0;
8707+
8708+	spin_lock_irqsave(&dev->lock, flags);
8709+	if (new_mtu <= 0)
8710+		status = -EINVAL;
8711+	else
8712+		net->mtu = new_mtu;
8713+
8714+	DBG(dev, "[%s] MTU change: old=%d new=%d\n", net->name,
8715+					net->mtu, new_mtu);
8716+	spin_unlock_irqrestore(&dev->lock, flags);
8717+
8718+	return status;
8719+}
8720+
8721 static void eth_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *p)
8722 {
8723 	struct eth_dev *dev = netdev_priv(net);
8724@@ -415,39 +290,8 @@ static const struct ethtool_ops ops = {
8725 
8726 static void defer_kevent(struct eth_dev *dev, int flag)
8727 {
8728-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
8729-	int testwkbit;
8730-	unsigned long	flags;
8731-
8732-	spin_lock_irqsave(&dev->req_rx_lock, flags);
8733-	testwkbit = test_and_set_bit(flag, &dev->todo);
8734-	spin_unlock_irqrestore(&dev->req_rx_lock, flags);
8735-
8736-	if (testwkbit)
8737-		return;
8738-#else
8739 	if (test_and_set_bit(flag, &dev->todo))
8740 		return;
8741-#endif
8742-
8743-#ifdef CONFIG_BRCM_NETCONSOLE
8744-	if ((flag == WORK_BRCM_NETCONSOLE_ON) || (flag == WORK_BRCM_NETCONSOLE_OFF)) {
8745-		if (!queue_usbevent(&dev->usbevent_queue, flag)) {
8746-			ERROR(dev, "event queue full, kevent %d may have been dropped\n", flag);
8747-			return;
8748-		}
8749-	}
8750-#endif
8751-
8752-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
8753-	if (dev->rx_workqueue) {
8754-		if (!queue_work(dev->rx_workqueue, &dev->work))
8755-			ERROR(dev, "kevent %d may have been dropped\n", flag);
8756-		else
8757-			DBG(dev, "kevent %d scheduled\n", flag);
8758-		return;
8759-	}
8760-#endif
8761 	if (!schedule_work(&dev->work))
8762 		ERROR(dev, "kevent %d may have been dropped\n", flag);
8763 	else
8764@@ -455,6 +299,7 @@ static void defer_kevent(struct eth_dev *dev, int flag)
8765 }
8766 
8767 static void rx_complete(struct usb_ep *ep, struct usb_request *req);
8768+static void tx_complete(struct usb_ep *ep, struct usb_request *req);
8769 
8770 static int
8771 rx_submit(struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags)
8772@@ -464,16 +309,18 @@ rx_submit(struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags)
8773 	size_t		size = 0;
8774 	struct usb_ep	*out;
8775 	unsigned long	flags;
8776+	unsigned short reserve_headroom;
8777 
8778 	spin_lock_irqsave(&dev->lock, flags);
8779 	if (dev->port_usb)
8780 		out = dev->port_usb->out_ep;
8781 	else
8782 		out = NULL;
8783-	spin_unlock_irqrestore(&dev->lock, flags);
8784 
8785-	if (!out)
8786+	if (!out) {
8787+		spin_unlock_irqrestore(&dev->lock, flags);
8788 		return -ENOTCONN;
8789+	}
8790 
8791 
8792 	/* Padding up to RX_EXTRA handles minor disagreements with host.
8793@@ -488,60 +335,42 @@ rx_submit(struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags)
8794 	 * means receivers can't recover lost synch on their own (because
8795 	 * new packets don't only start after a short RX).
8796 	 */
8797-		size += sizeof(struct ethhdr) + dev->net->mtu + RX_EXTRA;
8798-		size += dev->port_usb->header_len;
8799-		size += out->maxpacket - 1;
8800-		size -= size % out->maxpacket;
8801-
8802-		if (dev->port_usb->is_fixed)
8803-			size = max_t(size_t, size,
8804-				dev->port_usb->fixed_out_len);
8805-
8806-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
8807-	if (is_rx_prealloc_mode) {
8808-		if (size > max_skb_buf_sz) {
8809-			pr_info("skb data size = %d\n", size);
8810-			skb = alloc_skb(size + NET_IP_ALIGN, gfp_flags);
8811-		} else
8812-			skb = skb_dequeue(&skb_rx_pool);
8813-
8814-		if (!skb) {
8815-			alloc_rx_skb();
8816-			pr_debug("No RX SKB...\n");
8817-			goto enomem;
8818-		}
8819-	} else {
8820-#endif
8821-				skb = alloc_skb(size + NET_IP_ALIGN, gfp_flags);
8822-			if (skb == NULL) {
8823-				DBG(dev, "no rx skb\n");
8824-			goto enomem;
8825-		}
8826-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
8827+	size += sizeof(struct ethhdr) + dev->net->mtu + RX_EXTRA;
8828+	size += dev->port_usb->header_len;
8829+	size += out->maxpacket - 1;
8830+	size -= size % out->maxpacket;
8831+
8832+	if (dev->ul_max_pkts_per_xfer)
8833+		size *= dev->ul_max_pkts_per_xfer;
8834+
8835+	if (dev->port_usb->is_fixed)
8836+		size = max_t(size_t, size, dev->port_usb->fixed_out_len);
8837+	spin_unlock_irqrestore(&dev->lock, flags);
8838+
8839+	if (dev->rx_needed_headroom)
8840+		reserve_headroom = dev->rx_needed_headroom;
8841+	else
8842+		reserve_headroom = NET_IP_ALIGN;
8843+
8844+	pr_debug("%s: size: %zu + %d(hr)", __func__, size, reserve_headroom);
8845+
8846+	skb = alloc_skb(size + reserve_headroom, gfp_flags);
8847+	if (skb == NULL) {
8848+		DBG(dev, "no rx skb\n");
8849+		goto enomem;
8850 	}
8851-#endif
8852 
8853 	/* Some platforms perform better when IP packets are aligned,
8854 	 * but on at least one, checksumming fails otherwise.  Note:
8855 	 * RNDIS headers involve variable numbers of LE32 values.
8856 	 */
8857-	skb_reserve(skb, NET_IP_ALIGN);
8858+	skb_reserve(skb, reserve_headroom);
8859 
8860 	req->buf = skb->data;
8861 	req->length = size;
8862-	req->complete = rx_complete;
8863 	req->context = skb;
8864-	req->dma = 0;
8865 
8866-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
8867-	/* Need lock since it could be prempted by rx_complete
8868-	when rx_submit is executed from schedule queue. */
8869-	spin_lock_irqsave(&dev->req_rx_lock, flags);
8870-#endif
8871 	retval = usb_ep_queue(out, req, gfp_flags);
8872-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
8873-	spin_unlock_irqrestore(&dev->req_rx_lock, flags);
8874-#endif
8875 	if (retval == -ENOMEM)
8876 enomem:
8877 		defer_kevent(dev, WORK_RX_MEMORY);
8878@@ -549,18 +378,16 @@ enomem:
8879 		DBG(dev, "rx submit --> %d\n", retval);
8880 		if (skb)
8881 			dev_kfree_skb_any(skb);
8882-		spin_lock_irqsave(&dev->req_lock, flags);
8883-		list_add(&req->list, &dev->rx_reqs);
8884-		spin_unlock_irqrestore(&dev->req_lock, flags);
8885 	}
8886 	return retval;
8887 }
8888 
8889 static void rx_complete(struct usb_ep *ep, struct usb_request *req)
8890 {
8891-	struct sk_buff	*skb = req->context, *skb2;
8892+	struct sk_buff	*skb = req->context;
8893 	struct eth_dev	*dev = ep->driver_data;
8894 	int		status = req->status;
8895+	bool		queue = 0;
8896 
8897 	switch (status) {
8898 
8899@@ -576,6 +403,10 @@ static void rx_complete(struct usb_ep *ep, struct usb_request *req)
8900 				status = dev->unwrap(dev->port_usb,
8901 							skb,
8902 							&dev->rx_frames);
8903+				if (status == -EINVAL)
8904+					dev->net->stats.rx_errors++;
8905+				else if (status == -EOVERFLOW)
8906+					dev->net->stats.rx_over_errors++;
8907 			} else {
8908 				dev_kfree_skb_any(skb);
8909 				status = -ENOTCONN;
8910@@ -584,30 +415,9 @@ static void rx_complete(struct usb_ep *ep, struct usb_request *req)
8911 		} else {
8912 			skb_queue_tail(&dev->rx_frames, skb);
8913 		}
8914-		skb = NULL;
8915-
8916-		skb2 = skb_dequeue(&dev->rx_frames);
8917-		while (skb2) {
8918-			if (status < 0
8919-					|| ETH_HLEN > skb2->len
8920-					|| skb2->len > VLAN_ETH_FRAME_LEN) {
8921-				dev->net->stats.rx_errors++;
8922-				dev->net->stats.rx_length_errors++;
8923-				DBG(dev, "rx length %d\n", skb2->len);
8924-				dev_kfree_skb_any(skb2);
8925-				goto next_frame;
8926-			}
8927-			skb2->protocol = eth_type_trans(skb2, dev->net);
8928-			dev->net->stats.rx_packets++;
8929-			dev->net->stats.rx_bytes += skb2->len;
8930 
8931-			/* no buffer copies needed, unless hardware can't
8932-			 * use skb buffers.
8933-			 */
8934-			status = netif_rx(skb2);
8935-next_frame:
8936-			skb2 = skb_dequeue(&dev->rx_frames);
8937-		}
8938+		if (!status)
8939+			queue = 1;
8940 		break;
8941 
8942 	/* software-driven interface shutdown */
8943@@ -630,29 +440,41 @@ quiesce:
8944 		/* FALLTHROUGH */
8945 
8946 	default:
8947+		queue = 1;
8948+		dev_kfree_skb_any(skb);
8949 		dev->net->stats.rx_errors++;
8950 		DBG(dev, "rx status %d\n", status);
8951 		break;
8952 	}
8953 
8954-	if (skb)
8955-		dev_kfree_skb_any(skb);
8956-
8957-	if (!netif_running(dev->net)) {
8958 clean:
8959+	if (queue && dev->rx_frames.qlen <= u_ether_rx_pending_thld) {
8960+		if (rx_submit(dev, req, GFP_ATOMIC) < 0) {
8961+			spin_lock(&dev->req_lock);
8962+			list_add(&req->list, &dev->rx_reqs);
8963+			spin_unlock(&dev->req_lock);
8964+		}
8965+	} else {
8966+		/* rx buffers draining is delayed,defer further queuing to wq */
8967+		if (queue)
8968+			dev->rx_throttle++;
8969 		spin_lock(&dev->req_lock);
8970 		list_add(&req->list, &dev->rx_reqs);
8971 		spin_unlock(&dev->req_lock);
8972-		req = NULL;
8973 	}
8974-	if (req)
8975-		rx_submit(dev, req, GFP_ATOMIC);
8976+
8977+	if (queue)
8978+		queue_work_on(0, uether_wq, &dev->rx_work);
8979 }
8980 
8981-static int prealloc(struct list_head *list, struct usb_ep *ep, unsigned n)
8982+static int prealloc(struct list_head *list,
8983+		struct usb_ep *ep, unsigned n,
8984+		bool sg_supported, int hlen)
8985 {
8986 	unsigned		i;
8987 	struct usb_request	*req;
8988+	bool			usb_in;
8989+	struct sg_ctx		*sg_ctx;
8990 
8991 	if (!n)
8992 		return -ENOMEM;
8993@@ -663,10 +485,37 @@ static int prealloc(struct list_head *list, struct usb_ep *ep, unsigned n)
8994 		if (i-- == 0)
8995 			goto extra;
8996 	}
8997+
8998+	if (ep->desc->bEndpointAddress & USB_DIR_IN)
8999+		usb_in = true;
9000+	else
9001+		usb_in = false;
9002+
9003 	while (i--) {
9004 		req = usb_ep_alloc_request(ep, GFP_ATOMIC);
9005 		if (!req)
9006 			return list_empty(list) ? -ENOMEM : 0;
9007+		/* update completion handler */
9008+		if (usb_in) {
9009+			req->complete = tx_complete;
9010+			if (!sg_supported)
9011+				goto add_list;
9012+			req->sg = kmalloc(
9013+					DL_MAX_PKTS_PER_XFER *
9014+						sizeof(struct scatterlist),
9015+					GFP_ATOMIC);
9016+			if (!req->sg)
9017+				goto extra;
9018+			sg_ctx = kmalloc(sizeof(*sg_ctx), GFP_ATOMIC);
9019+			if (!sg_ctx)
9020+				goto extra;
9021+			req->context = sg_ctx;
9022+			req->buf = kzalloc(DL_MAX_PKTS_PER_XFER * hlen,
9023+						GFP_ATOMIC);
9024+		} else {
9025+			req->complete = rx_complete;
9026+		}
9027+add_list:
9028 		list_add(&req->list, list);
9029 	}
9030 	return 0;
9031@@ -678,6 +527,13 @@ extra:
9032 
9033 		next = req->list.next;
9034 		list_del(&req->list);
9035+
9036+		if (sg_supported) {
9037+			kfree(req->sg);
9038+			kfree(req->context);
9039+			kfree(req->buf);
9040+		}
9041+
9042 		usb_ep_free_request(ep, req);
9043 
9044 		if (next == list)
9045@@ -693,10 +549,14 @@ static int alloc_requests(struct eth_dev *dev, struct gether *link, unsigned n)
9046 	int	status;
9047 
9048 	spin_lock(&dev->req_lock);
9049-	status = prealloc(&dev->tx_reqs, link->in_ep, n);
9050+	status = prealloc(&dev->tx_reqs, link->in_ep, n * tx_qmult,
9051+				dev->sg_enabled,
9052+				dev->header_len);
9053 	if (status < 0)
9054 		goto fail;
9055-	status = prealloc(&dev->rx_reqs, link->out_ep, n);
9056+	status = prealloc(&dev->rx_reqs, link->out_ep, n,
9057+				dev->sg_enabled,
9058+				dev->header_len);
9059 	if (status < 0)
9060 		goto fail;
9061 	goto done;
9062@@ -711,16 +571,24 @@ static void rx_fill(struct eth_dev *dev, gfp_t gfp_flags)
9063 {
9064 	struct usb_request	*req;
9065 	unsigned long		flags;
9066+	int			req_cnt = 0;
9067 
9068 	/* fill unused rxq slots with some skb */
9069 	spin_lock_irqsave(&dev->req_lock, flags);
9070 	while (!list_empty(&dev->rx_reqs)) {
9071+		/* break the nexus of continuous completion and re-submission*/
9072+		if (++req_cnt > qlen(dev->gadget))
9073+			break;
9074+
9075 		req = container_of(dev->rx_reqs.next,
9076 				struct usb_request, list);
9077 		list_del_init(&req->list);
9078 		spin_unlock_irqrestore(&dev->req_lock, flags);
9079 
9080 		if (rx_submit(dev, req, gfp_flags) < 0) {
9081+			spin_lock_irqsave(&dev->req_lock, flags);
9082+			list_add(&req->list, &dev->rx_reqs);
9083+			spin_unlock_irqrestore(&dev->req_lock, flags);
9084 			defer_kevent(dev, WORK_RX_MEMORY);
9085 			return;
9086 		}
9087@@ -729,94 +597,105 @@ static void rx_fill(struct eth_dev *dev, gfp_t gfp_flags)
9088 	}
9089 	spin_unlock_irqrestore(&dev->req_lock, flags);
9090 }
9091-#ifdef CONFIG_BRCM_NETCONSOLE
9092-static void usb_test_work(struct work_struct *work)
9093+
9094+static __be16 ether_ip_type_trans(struct sk_buff *skb,
9095+	struct net_device *dev)
9096 {
9097-	struct eth_dev	*dev = container_of(work, struct eth_dev, work);
9098-	uint32_t event;
9099-
9100-	while (dequeue_usbevent(&dev->usbevent_queue, &event)) {
9101-		switch (event) {
9102-		case WORK_BRCM_NETCONSOLE_ON:
9103-			cleanup_netpoll_lock();
9104-			brcm_current_netcon_status(USB_RNDIS_ON);
9105-			cleanup_netpoll_unlock();
9106-			break;
9107+	__be16	protocol = 0;
9108 
9109-		case WORK_BRCM_NETCONSOLE_OFF:
9110-			cleanup_netpoll_lock();
9111-			brcm_current_netcon_status(USB_RNDIS_OFF);
9112-			cleanup_netpoll_unlock();
9113-			break;
9114+	skb->dev = dev;
9115 
9116-		default:
9117-			break;
9118-		}
9119+	switch (skb->data[0] & 0xf0) {
9120+	case 0x40:
9121+		protocol = htons(ETH_P_IP);
9122+		break;
9123+	case 0x60:
9124+		protocol = htons(ETH_P_IPV6);
9125+		break;
9126+	default:
9127+		if ((skb->data[0] & 0x40) == 0x00)
9128+			protocol = htons(ETH_P_MAP);
9129+		else
9130+			pr_debug_ratelimited("[%s] L3 protocol decode error: 0x%02x",
9131+					dev->name, skb->data[0] & 0xf0);
9132 	}
9133-	return;
9134+
9135+	return protocol;
9136 }
9137-#endif
9138 
9139-static void eth_work(struct work_struct *work)
9140+static void process_rx_w(struct work_struct *work)
9141 {
9142-	struct eth_dev	*dev = container_of(work, struct eth_dev, work);
9143+	struct eth_dev	*dev = container_of(work, struct eth_dev, rx_work);
9144+	struct sk_buff	*skb;
9145+	int		status = 0;
9146 
9147-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
9148-	int			testwkbit;
9149-	unsigned long	flags;
9150+	if (!dev->port_usb)
9151+		return;
9152+
9153+	set_wake_up_idle(true);
9154+	while ((skb = skb_dequeue(&dev->rx_frames))) {
9155+		if (status < 0
9156+				|| ETH_HLEN > skb->len
9157+				|| (skb->len > ETH_FRAME_LEN &&
9158+				test_bit(RMNET_MODE_LLP_ETH, &dev->flags))) {
9159+			dev->net->stats.rx_errors++;
9160+			dev->net->stats.rx_length_errors++;
9161+			DBG(dev, "rx length %d\n", skb->len);
9162+			dev_kfree_skb_any(skb);
9163+			continue;
9164+		}
9165+		if (test_bit(RMNET_MODE_LLP_IP, &dev->flags))
9166+			skb->protocol = ether_ip_type_trans(skb, dev->net);
9167+		else
9168+			skb->protocol = eth_type_trans(skb, dev->net);
9169 
9170-	spin_lock_irqsave(&dev->req_rx_lock, flags);
9171-	testwkbit = test_and_clear_bit(WORK_RX_MEMORY, &dev->todo);
9172-	spin_unlock_irqrestore(&dev->req_rx_lock, flags);
9173+		dev->net->stats.rx_packets++;
9174+		dev->net->stats.rx_bytes += skb->len;
9175 
9176-	if (testwkbit) {
9177-		if (netif_running(dev->net))
9178-			rx_fill(dev, GFP_KERNEL);
9179-	}
9180-#ifdef CONFIG_BRCM_NETCONSOLE
9181-	else {
9182-		usb_test_work(work);
9183+		status = netif_rx_ni(skb);
9184 	}
9185+	set_wake_up_idle(false);
9186 
9187-	if (test_and_clear_bit(WORK_ALLOC_RX_SKB, &dev->todo))
9188-		ueth_recycle_rx_skb_data(dev->skb_data, GFP_KERNEL, dev);
9189-#endif
9190-
9191-	if (dev->todo)
9192-		DBG(dev, "work done, flags = 0x%lx\n", dev->todo);
9193-	return;
9194+	if (netif_running(dev->net))
9195+		rx_fill(dev, GFP_KERNEL);
9196+}
9197 
9198-#else /* CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION */
9199+static void eth_work(struct work_struct *work)
9200+{
9201+	struct eth_dev	*dev = container_of(work, struct eth_dev, work);
9202 
9203 	if (test_and_clear_bit(WORK_RX_MEMORY, &dev->todo)) {
9204 		if (netif_running(dev->net))
9205 			rx_fill(dev, GFP_KERNEL);
9206 	}
9207-#ifdef CONFIG_BRCM_NETCONSOLE
9208-	else {
9209-		usb_test_work(work);
9210-	}
9211-#endif
9212 
9213 	if (dev->todo)
9214 		DBG(dev, "work done, flags = 0x%lx\n", dev->todo);
9215-
9216-#endif /* CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION */
9217-
9218-}
9219-
9220-
9221-#ifdef CONFIG_NET_POLL_CONTROLLER
9222-static void eth_poll_controller(struct net_device *dev)
9223-{
9224-	return; /* do not thing.... */
9225 }
9226-#endif
9227 
9228 static void tx_complete(struct usb_ep *ep, struct usb_request *req)
9229 {
9230-	struct sk_buff	*skb = req->context;
9231-	struct eth_dev	*dev = ep->driver_data;
9232+	struct sk_buff	*skb;
9233+	struct eth_dev	*dev;
9234+	struct net_device *net;
9235+	struct usb_request *new_req;
9236+	struct usb_ep *in;
9237+	int n = 1;
9238+	int length;
9239+	int retval;
9240+
9241+	if (!ep->driver_data) {
9242+		usb_ep_free_request(ep, req);
9243+		return;
9244+	}
9245+
9246+	dev = ep->driver_data;
9247+	net = dev->net;
9248+
9249+	if (!dev->port_usb) {
9250+		usb_ep_free_request(ep, req);
9251+		return;
9252+	}
9253 
9254 	switch (req->status) {
9255 	default:
9256@@ -827,23 +706,301 @@ static void tx_complete(struct usb_ep *ep, struct usb_request *req)
9257 	case -ESHUTDOWN:		/* disconnect etc */
9258 		break;
9259 	case 0:
9260-		dev->net->stats.tx_bytes += skb->len;
9261+		if (!req->zero)
9262+			dev->net->stats.tx_bytes += req->actual-1;
9263+		else
9264+			dev->net->stats.tx_bytes += req->actual;
9265+	}
9266+
9267+	if (req->num_sgs) {
9268+		struct sg_ctx *sg_ctx = req->context;
9269+
9270+		n = skb_queue_len(&sg_ctx->skbs);
9271+		dev->tx_aggr_cnt[n-1]++;
9272+
9273+		/* sg_ctx is only accessible here, can use lock-free version */
9274+		__skb_queue_purge(&sg_ctx->skbs);
9275+	}
9276+
9277+	dev->net->stats.tx_packets += n;
9278+
9279+	spin_lock(&dev->req_lock);
9280+	list_add_tail(&req->list, &dev->tx_reqs);
9281+
9282+	if (req->num_sgs) {
9283+		if (!req->status)
9284+			queue_work(uether_tx_wq, &dev->tx_work);
9285+
9286+		spin_unlock(&dev->req_lock);
9287+		return;
9288 	}
9289-	dev->net->stats.tx_packets++;
9290 
9291-	spin_lock(&dev->req_lock);
9292-	list_add(&req->list, &dev->tx_reqs);
9293-	spin_unlock(&dev->req_lock);
9294-	dev_kfree_skb_any(skb);
9295+	if (dev->port_usb->multi_pkt_xfer && !req->context) {
9296+		dev->no_tx_req_used--;
9297+		req->length = 0;
9298+		in = dev->port_usb->in_ep;
9299+
9300+		if (!list_empty(&dev->tx_reqs)) {
9301+			new_req = container_of(dev->tx_reqs.next,
9302+					struct usb_request, list);
9303+			list_del(&new_req->list);
9304+			spin_unlock(&dev->req_lock);
9305+			if (new_req->length > 0) {
9306+				length = new_req->length;
9307+
9308+				/* NCM requires no zlp if transfer is
9309+				 * dwNtbInMaxSize */
9310+				if (dev->port_usb->is_fixed &&
9311+					length == dev->port_usb->fixed_in_len &&
9312+					(length % in->maxpacket) == 0)
9313+					new_req->zero = 0;
9314+				else
9315+					new_req->zero = 1;
9316+
9317+				/* use zlp framing on tx for strict CDC-Ether
9318+				 * conformance, though any robust network rx
9319+				 * path ignores extra padding. and some hardware
9320+				 * doesn't like to write zlps.
9321+				 */
9322+				if (new_req->zero && !dev->zlp &&
9323+						(length % in->maxpacket) == 0) {
9324+					new_req->zero = 0;
9325+					length++;
9326+				}
9327+
9328+				new_req->length = length;
9329+				retval = usb_ep_queue(in, new_req, GFP_ATOMIC);
9330+				switch (retval) {
9331+				default:
9332+					DBG(dev, "tx queue err %d\n", retval);
9333+					new_req->length = 0;
9334+					spin_lock(&dev->req_lock);
9335+					list_add_tail(&new_req->list,
9336+							&dev->tx_reqs);
9337+					spin_unlock(&dev->req_lock);
9338+					break;
9339+				case 0:
9340+					spin_lock(&dev->req_lock);
9341+					dev->no_tx_req_used++;
9342+					spin_unlock(&dev->req_lock);
9343+					net->trans_start = jiffies;
9344+				}
9345+			} else {
9346+				spin_lock(&dev->req_lock);
9347+				/*
9348+				 * Put the idle request at the back of the
9349+				 * queue. The xmit function will put the
9350+				 * unfinished request at the beginning of the
9351+				 * queue.
9352+				 */
9353+				list_add_tail(&new_req->list, &dev->tx_reqs);
9354+				spin_unlock(&dev->req_lock);
9355+			}
9356+		} else {
9357+			spin_unlock(&dev->req_lock);
9358+		}
9359+	} else {
9360+		skb = req->context;
9361+		/* Is aggregation already enabled and buffers allocated ? */
9362+		if (dev->port_usb->multi_pkt_xfer && dev->tx_req_bufsize) {
9363+			req->buf = kzalloc(dev->tx_req_bufsize, GFP_ATOMIC);
9364+			req->context = NULL;
9365+		} else {
9366+			req->buf = NULL;
9367+		}
9368+
9369+		spin_unlock(&dev->req_lock);
9370+		dev_kfree_skb_any(skb);
9371+	}
9372+
9373+	if (netif_carrier_ok(dev->net))
9374+		netif_wake_queue(dev->net);
9375+}
9376+
9377+static inline int is_promisc(u16 cdc_filter)
9378+{
9379+	return cdc_filter & USB_CDC_PACKET_TYPE_PROMISCUOUS;
9380+}
9381+
9382+static int alloc_tx_buffer(struct eth_dev *dev)
9383+{
9384+	struct list_head	*act;
9385+	struct usb_request	*req;
9386+
9387+	dev->tx_req_bufsize = (dev->dl_max_pkts_per_xfer *
9388+				(dev->net->mtu
9389+				+ sizeof(struct ethhdr)
9390+				/* size of rndis_packet_msg_type */
9391+				+ 44
9392+				+ 22));
9393+
9394+	list_for_each(act, &dev->tx_reqs) {
9395+		req = container_of(act, struct usb_request, list);
9396+		if (!req->buf) {
9397+			req->buf = kzalloc(dev->tx_req_bufsize,
9398+						GFP_ATOMIC);
9399+			if (!req->buf)
9400+				goto free_buf;
9401+		}
9402+		/* req->context is not used for multi_pkt_xfers */
9403+		req->context = NULL;
9404+	}
9405+	return 0;
9406+
9407+free_buf:
9408+	/* tx_req_bufsize = 0 retries mem alloc on next eth_start_xmit */
9409+	dev->tx_req_bufsize = 0;
9410+	list_for_each(act, &dev->tx_reqs) {
9411+		req = container_of(act, struct usb_request, list);
9412+		kfree(req->buf);
9413+		req->buf = NULL;
9414+	}
9415+	return -ENOMEM;
9416+}
9417+
9418+static void process_tx_w(struct work_struct *w)
9419+{
9420+	struct eth_dev		*dev = container_of(w, struct eth_dev, tx_work);
9421+	struct net_device	*net = NULL;
9422+	struct sk_buff		*skb = NULL;
9423+	struct sg_ctx		*sg_ctx;
9424+	struct usb_request	*req;
9425+	struct usb_ep		*in = NULL;
9426+	int			ret, count, hlen = 0, hdr_offset;
9427+	uint32_t		max_size = 0;
9428+	uint32_t		max_num_pkts = 1;
9429+	unsigned long		flags;
9430+	bool			header_on = false;
9431+	int			req_cnt = 0;
9432+	bool			port_usb_active;
9433+
9434+	spin_lock_irqsave(&dev->lock, flags);
9435+	if (dev->port_usb) {
9436+		in = dev->port_usb->in_ep;
9437+		max_size = dev->dl_max_xfer_size;
9438+		max_num_pkts = dev->dl_max_pkts_per_xfer;
9439+		if (!max_num_pkts)
9440+			max_num_pkts = 1;
9441+		hlen = dev->header_len;
9442+		net = dev->net;
9443+	}
9444+	spin_unlock_irqrestore(&dev->lock, flags);
9445+
9446+	spin_lock_irqsave(&dev->req_lock, flags);
9447+	while (in && !list_empty(&dev->tx_reqs) &&
9448+			(skb = skb_dequeue(&dev->tx_skb_q))) {
9449+		req = list_first_entry(&dev->tx_reqs, struct usb_request,
9450+				list);
9451+		list_del(&req->list);
9452+		spin_unlock_irqrestore(&dev->req_lock, flags);
9453+
9454+		req->num_sgs = 0;
9455+		req->zero = 1;
9456+		req->length = 0;
9457+		sg_ctx = req->context;
9458+		skb_queue_head_init(&sg_ctx->skbs);
9459+		sg_init_table(req->sg, DL_MAX_PKTS_PER_XFER);
9460+
9461+		hdr_offset = 0;
9462+		count = 1;
9463+		do {
9464+			/* spinlock can be avoided if buffer can passed
9465+			 * wrap callback argument. However, it requires
9466+			 * changes to all existing clients
9467+			 */
9468+			spin_lock_irqsave(&dev->lock, flags);
9469+			if (!dev->port_usb) {
9470+				spin_unlock_irqrestore(&dev->lock, flags);
9471+				skb_queue_purge(&sg_ctx->skbs);
9472+				kfree(req->sg);
9473+				kfree(req->context);
9474+				kfree(req->buf);
9475+				usb_ep_free_request(in, req);
9476+
9477+				return;
9478+			}
9479+
9480+			if (hlen && dev->wrap) {
9481+				dev->port_usb->header = req->buf + hdr_offset;
9482+				skb = dev->wrap(dev->port_usb, skb);
9483+				header_on = true;
9484+			}
9485+			spin_unlock_irqrestore(&dev->lock, flags);
9486+
9487+			if (header_on) {
9488+				sg_set_buf(&req->sg[req->num_sgs],
9489+					req->buf + hdr_offset, hlen);
9490+				req->num_sgs++;
9491+				hdr_offset += hlen;
9492+				req->length += hlen;
9493+			}
9494+
9495+			/* skb processing */
9496+			sg_set_buf(&req->sg[req->num_sgs], skb->data, skb->len);
9497+			req->num_sgs++;
9498+
9499+			req->length += skb->len;
9500+			skb_queue_tail(&sg_ctx->skbs, skb);
9501+
9502+			skb = skb_dequeue(&dev->tx_skb_q);
9503+			if (!skb)
9504+				break;
9505+			if ((req->length + skb->len + hlen) >= max_size ||
9506+					count >= max_num_pkts) {
9507+				skb_queue_head(&dev->tx_skb_q, skb);
9508+				break;
9509+			}
9510+			count++;
9511+		} while (true);
9512+
9513+		sg_mark_end(&req->sg[req->num_sgs - 1]);
9514+
9515+		spin_lock_irqsave(&dev->lock, flags);
9516+		if (dev->port_usb) {
9517+			in = dev->port_usb->in_ep;
9518+			port_usb_active = 1;
9519+		} else {
9520+			port_usb_active = 0;
9521+		}
9522+		spin_unlock_irqrestore(&dev->lock, flags);
9523+
9524+		if (!port_usb_active) {
9525+			__skb_queue_purge(&sg_ctx->skbs);
9526+			kfree(req->sg);
9527+			kfree(req->context);
9528+			kfree(req->buf);
9529+			usb_ep_free_request(in, req);
9530+
9531+			return;
9532+		}
9533+
9534+		ret = usb_ep_queue(in, req, GFP_KERNEL);
9535+		spin_lock_irqsave(&dev->req_lock, flags);
9536+		switch (ret) {
9537+		default:
9538+			dev->net->stats.tx_dropped +=
9539+				skb_queue_len(&sg_ctx->skbs);
9540+
9541+			__skb_queue_purge(&sg_ctx->skbs);
9542+			list_add_tail(&req->list, &dev->tx_reqs);
9543+			break;
9544+		case 0:
9545+			net->trans_start = jiffies;
9546+		}
9547+
9548+		/* break the loop after processing 10 packets
9549+		 * otherwise wd may kick in
9550+		 */
9551+		if (ret || ++req_cnt > 10) {
9552+			dev->loop_brk_cnt++;
9553+			break;
9554+		}
9555 
9556-	atomic_dec(&dev->tx_qlen);
9557-	if (netif_carrier_ok(dev->net))
9558-		netif_wake_queue(dev->net);
9559-}
9560+		if (dev->tx_skb_q.qlen <  tx_start_threshold)
9561+			netif_start_queue(net);
9562 
9563-static inline int is_promisc(u16 cdc_filter)
9564-{
9565-	return cdc_filter & USB_CDC_PACKET_TYPE_PROMISCUOUS;
9566+	}
9567+	spin_unlock_irqrestore(&dev->req_lock, flags);
9568 }
9569 
9570 static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
9571@@ -854,16 +1011,15 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
9572 	int			retval;
9573 	struct usb_request	*req = NULL;
9574 	unsigned long		flags;
9575-	struct usb_ep		*in;
9576-	u16			cdc_filter;
9577+	struct usb_ep		*in = NULL;
9578+	u16			cdc_filter = 0;
9579+	bool			multi_pkt_xfer = false;
9580 
9581 	spin_lock_irqsave(&dev->lock, flags);
9582 	if (dev->port_usb) {
9583 		in = dev->port_usb->in_ep;
9584 		cdc_filter = dev->port_usb->cdc_filter;
9585-	} else {
9586-		in = NULL;
9587-		cdc_filter = 0;
9588+		multi_pkt_xfer = dev->port_usb->multi_pkt_xfer;
9589 	}
9590 	spin_unlock_irqrestore(&dev->lock, flags);
9591 
9592@@ -872,8 +1028,9 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
9593 		return NETDEV_TX_OK;
9594 	}
9595 
9596-	/* apply outgoing CDC or RNDIS filters */
9597-	if (!is_promisc(cdc_filter)) {
9598+	/* apply outgoing CDC or RNDIS filters only for ETH packets */
9599+	if (!test_bit(RMNET_MODE_LLP_IP, &dev->flags) &&
9600+						!is_promisc(cdc_filter)) {
9601 		u8		*dest = skb->data;
9602 
9603 		if (is_multicast_ether_addr(dest)) {
9604@@ -894,7 +1051,45 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
9605 		/* ignores USB_CDC_PACKET_TYPE_DIRECTED */
9606 	}
9607 
9608+	dev->tx_pkts_rcvd++;
9609+	if (dev->sg_enabled) {
9610+		skb_queue_tail(&dev->tx_skb_q, skb);
9611+		if (dev->tx_skb_q.qlen > tx_stop_threshold) {
9612+			dev->tx_throttle++;
9613+			netif_stop_queue(net);
9614+		}
9615+
9616+		queue_work(uether_tx_wq, &dev->tx_work);
9617+		return NETDEV_TX_OK;
9618+	}
9619+
9620+	/*
9621+	 * No buffer copies needed, unless the network stack did it
9622+	 * or the hardware can't use skb buffers or there's not enough
9623+	 * enough space for extra headers we need.
9624+	 */
9625+	spin_lock_irqsave(&dev->lock, flags);
9626+	if (dev->wrap && dev->port_usb)
9627+		skb = dev->wrap(dev->port_usb, skb);
9628+	spin_unlock_irqrestore(&dev->lock, flags);
9629+
9630+	if (!skb) {
9631+		dev->net->stats.tx_dropped++;
9632+
9633+		/* no error code for dropped packets */
9634+		return NETDEV_TX_OK;
9635+	}
9636+
9637+	/* Allocate memory for tx_reqs to support multi packet transfer */
9638 	spin_lock_irqsave(&dev->req_lock, flags);
9639+	if (multi_pkt_xfer && !dev->tx_req_bufsize) {
9640+		retval = alloc_tx_buffer(dev);
9641+		if (retval < 0) {
9642+			spin_unlock_irqrestore(&dev->req_lock, flags);
9643+			return -ENOMEM;
9644+		}
9645+	}
9646+
9647 	/*
9648 	 * this freelist can be empty if an interrupt triggered disconnect()
9649 	 * and reconfigured the gadget (shutting down this queue) after the
9650@@ -909,46 +1104,54 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
9651 	list_del(&req->list);
9652 
9653 	/* temporarily stop TX queue when the freelist empties */
9654-	if (list_empty(&dev->tx_reqs))
9655+	if (list_empty(&dev->tx_reqs)) {
9656+		/*
9657+		 * tx_throttle gives info about number of times u_ether
9658+		 * asked network layer to stop queueing packets to it
9659+		 * when transmit resources are unavailable
9660+		 */
9661+		dev->tx_throttle++;
9662 		netif_stop_queue(net);
9663+	}
9664 	spin_unlock_irqrestore(&dev->req_lock, flags);
9665 
9666-	/* no buffer copies needed, unless the network stack did it
9667-	 * or the hardware can't use skb buffers.
9668-	 * or there's not enough space for extra headers we need
9669-	 */
9670-	if (skb->signature != SKB_NETPOLL_SIGNATURE) {
9671-		if (dev->wrap) {
9672-			unsigned long	flags;
9673 
9674-			spin_lock_irqsave(&dev->lock, flags);
9675-			if (dev->port_usb)
9676-				skb = dev->wrap(dev->port_usb, skb);
9677-			spin_unlock_irqrestore(&dev->lock, flags);
9678-			if (!skb)
9679-				goto drop;
9680-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
9681-			/* The following is to eliminate to malloc for
9682-				the unaligned memory*/
9683-			spin_lock_irqsave(&dev->lock, flags);
9684-			if (skb_headroom(skb) >
9685-				((unsigned long)skb->data & 3)) {
9686-				u8 *data = skb->data;
9687-				size_t len = skb_headlen(skb);
9688-				skb->data -= ((unsigned long)skb->data & 3);
9689-				memmove(skb->data, data, len);
9690-				skb_set_tail_pointer(skb, len);
9691-				pr_debug("mem_mv");
9692+	if (multi_pkt_xfer) {
9693+
9694+		pr_debug("req->length:%d header_len:%u\n"
9695+				"skb->len:%d skb->data_len:%d\n",
9696+				req->length, dev->header_len,
9697+				skb->len, skb->data_len);
9698+		/* Add RNDIS Header */
9699+		memcpy(req->buf + req->length, dev->port_usb->header,
9700+						dev->header_len);
9701+		/* Increment req length by header size */
9702+		req->length += dev->header_len;
9703+		/* Copy received IP data from SKB */
9704+		memcpy(req->buf + req->length, skb->data, skb->len);
9705+		/* Increment req length by skb data length */
9706+		req->length += skb->len;
9707+		length = req->length;
9708+		dev_kfree_skb_any(skb);
9709+
9710+		spin_lock_irqsave(&dev->req_lock, flags);
9711+		dev->tx_skb_hold_count++;
9712+		if (dev->tx_skb_hold_count < dev->dl_max_pkts_per_xfer) {
9713+			if (dev->no_tx_req_used > TX_REQ_THRESHOLD) {
9714+				list_add(&req->list, &dev->tx_reqs);
9715+				spin_unlock_irqrestore(&dev->req_lock, flags);
9716+				goto success;
9717 			}
9718-			spin_unlock_irqrestore(&dev->lock, flags);
9719-#endif
9720 		}
9721-	}
9722-	length = skb->len;
9723 
9724-	req->buf = skb->data;
9725-	req->context = skb;
9726-	req->complete = tx_complete;
9727+		dev->no_tx_req_used++;
9728+		dev->tx_skb_hold_count = 0;
9729+		spin_unlock_irqrestore(&dev->req_lock, flags);
9730+	} else {
9731+		length = skb->len;
9732+		req->buf = skb->data;
9733+		req->context = skb;
9734+	}
9735 
9736 	/* NCM requires no zlp if transfer is dwNtbInMaxSize */
9737 	if (dev->port_usb->is_fixed &&
9738@@ -962,46 +1165,50 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
9739 	 * though any robust network rx path ignores extra padding.
9740 	 * and some hardware doesn't like to write zlps.
9741 	 */
9742-	if (req->zero && !dev->zlp && (length % in->maxpacket) == 0)
9743+	if (req->zero && !dev->zlp && (length % in->maxpacket) == 0) {
9744+		req->zero = 0;
9745 		length++;
9746+	}
9747 
9748 	req->length = length;
9749 
9750 	/* throttle high/super speed IRQ rate back slightly */
9751-	if (gadget_is_dualspeed(dev->gadget))
9752-		req->no_interrupt = (dev->gadget->speed == USB_SPEED_HIGH ||
9753-				     dev->gadget->speed == USB_SPEED_SUPER)
9754-			? ((atomic_read(&dev->tx_qlen) % qmult) != 0)
9755-			: 0;
9756-
9757-	req->dma = 0;
9758+	if (gadget_is_dualspeed(dev->gadget) &&
9759+		 (dev->gadget->speed == USB_SPEED_HIGH ||
9760+		  dev->gadget->speed == USB_SPEED_SUPER)) {
9761+		dev->tx_qlen++;
9762+		if (dev->tx_qlen == (qmult/2)) {
9763+			req->no_interrupt = 0;
9764+			dev->tx_qlen = 0;
9765+		} else {
9766+			req->no_interrupt = 1;
9767+		}
9768+	} else {
9769+		req->no_interrupt = 0;
9770+	}
9771 
9772-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
9773-	spin_lock_irqsave(&dev->req_lock, flags);
9774-#endif
9775 	retval = usb_ep_queue(in, req, GFP_ATOMIC);
9776-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
9777-	spin_unlock_irqrestore(&dev->req_lock, flags);
9778-#endif
9779 	switch (retval) {
9780 	default:
9781 		DBG(dev, "tx queue err %d\n", retval);
9782 		break;
9783 	case 0:
9784 		net->trans_start = jiffies;
9785-		atomic_inc(&dev->tx_qlen);
9786 	}
9787 
9788 	if (retval) {
9789-		dev_kfree_skb_any(skb);
9790-drop:
9791+		if (!multi_pkt_xfer)
9792+			dev_kfree_skb_any(skb);
9793+		else
9794+			req->length = 0;
9795 		dev->net->stats.tx_dropped++;
9796 		spin_lock_irqsave(&dev->req_lock, flags);
9797 		if (list_empty(&dev->tx_reqs))
9798 			netif_start_queue(net);
9799-		list_add(&req->list, &dev->tx_reqs);
9800+		list_add_tail(&req->list, &dev->tx_reqs);
9801 		spin_unlock_irqrestore(&dev->req_lock, flags);
9802 	}
9803+success:
9804 	return NETDEV_TX_OK;
9805 }
9806 
9807@@ -1015,25 +1222,34 @@ static void eth_start(struct eth_dev *dev, gfp_t gfp_flags)
9808 	rx_fill(dev, gfp_flags);
9809 
9810 	/* and open the tx floodgates */
9811-	atomic_set(&dev->tx_qlen, 0);
9812+	dev->tx_qlen = 0;
9813 	netif_wake_queue(dev->net);
9814-
9815-#ifdef CONFIG_BRCM_NETCONSOLE
9816-	defer_kevent(dev, WORK_BRCM_NETCONSOLE_ON);
9817-#endif
9818 }
9819 
9820 static int eth_open(struct net_device *net)
9821 {
9822 	struct eth_dev	*dev = netdev_priv(net);
9823 	struct gether	*link;
9824+	bool wait_for_rx_trigger;
9825+	int i;
9826 
9827 	DBG(dev, "%s\n", __func__);
9828-	if (netif_carrier_ok(dev->net))
9829-		eth_start(dev, GFP_KERNEL);
9830 
9831 	spin_lock_irq(&dev->lock);
9832 	link = dev->port_usb;
9833+	spin_unlock_irq(&dev->lock);
9834+
9835+	wait_for_rx_trigger = dev->rx_trigger_enabled && link &&
9836+		!link->rx_triggered;
9837+
9838+	if (netif_carrier_ok(dev->net) && !wait_for_rx_trigger)
9839+		eth_start(dev, GFP_KERNEL);
9840+
9841+	dev->state = ETH_START;
9842+	for_each_online_cpu(i)
9843+		cpufreq_update_policy(i);
9844+
9845+	spin_lock_irq(&dev->lock);
9846 	if (link && link->open)
9847 		link->open(link);
9848 	spin_unlock_irq(&dev->lock);
9849@@ -1045,8 +1261,11 @@ static int eth_stop(struct net_device *net)
9850 {
9851 	struct eth_dev	*dev = netdev_priv(net);
9852 	unsigned long	flags;
9853+	int i;
9854+	enum ifc_state prev_state;
9855 
9856 	VDBG(dev, "%s\n", __func__);
9857+
9858 	netif_stop_queue(net);
9859 
9860 	DBG(dev, "stop stats: rx/tx %ld/%ld, errs %ld/%ld\n",
9861@@ -1078,6 +1297,14 @@ static int eth_stop(struct net_device *net)
9862 		usb_ep_disable(link->in_ep);
9863 		usb_ep_disable(link->out_ep);
9864 		if (netif_carrier_ok(net)) {
9865+			if (config_ep_by_speed(dev->gadget, &link->func,
9866+					       link->in_ep) ||
9867+			    config_ep_by_speed(dev->gadget, &link->func,
9868+					       link->out_ep)) {
9869+				link->in_ep->desc = NULL;
9870+				link->out_ep->desc = NULL;
9871+				return -EINVAL;
9872+			}
9873 			DBG(dev, "host still using in/out endpoints\n");
9874 			link->in_ep->desc = in;
9875 			link->out_ep->desc = out;
9876@@ -1087,6 +1314,14 @@ static int eth_stop(struct net_device *net)
9877 	}
9878 	spin_unlock_irqrestore(&dev->lock, flags);
9879 
9880+	prev_state = dev->state;
9881+	dev->state = ETH_STOP;
9882+
9883+	/* if previous state is eth_start, update cpufreq policy to normal */
9884+	if (prev_state == ETH_START)
9885+		for_each_online_cpu(i)
9886+			cpufreq_update_policy(i);
9887+
9888 	return 0;
9889 }
9890 
9891@@ -1102,7 +1337,6 @@ static char *host_addr;
9892 module_param(host_addr, charp, S_IRUGO);
9893 MODULE_PARM_DESC(host_addr, "Host Ethernet Address");
9894 
9895-#if 0 /* See gether_setup */
9896 static int get_ether_addr(const char *str, u8 *dev_addr)
9897 {
9898 	if (str) {
9899@@ -1115,7 +1349,7 @@ static int get_ether_addr(const char *str, u8 *dev_addr)
9900 				str++;
9901 			num = hex_to_bin(*str++) << 4;
9902 			num |= hex_to_bin(*str++);
9903-			dev_addr[i] = num;
9904+			dev_addr [i] = num;
9905 		}
9906 		if (is_valid_ether_addr(dev_addr))
9907 			return 0;
9908@@ -1123,24 +1357,214 @@ static int get_ether_addr(const char *str, u8 *dev_addr)
9909 	eth_random_addr(dev_addr);
9910 	return 1;
9911 }
9912-#endif
9913+
9914+static int ether_ioctl(struct net_device *, struct ifreq *, int);
9915 
9916 static const struct net_device_ops eth_netdev_ops = {
9917 	.ndo_open		= eth_open,
9918 	.ndo_stop		= eth_stop,
9919 	.ndo_start_xmit		= eth_start_xmit,
9920+	.ndo_do_ioctl		= ether_ioctl,
9921 	.ndo_change_mtu		= ueth_change_mtu,
9922-	.ndo_set_mac_address	= eth_mac_addr,
9923+	.ndo_set_mac_address 	= eth_mac_addr,
9924 	.ndo_validate_addr	= eth_validate_addr,
9925-#ifdef CONFIG_NET_POLL_CONTROLLER
9926-	.ndo_poll_controller = eth_poll_controller,
9927-#endif
9928 };
9929 
9930+static const struct net_device_ops eth_netdev_ops_ip = {
9931+	.ndo_open		= eth_open,
9932+	.ndo_stop		= eth_stop,
9933+	.ndo_start_xmit		= eth_start_xmit,
9934+	.ndo_do_ioctl		= ether_ioctl,
9935+	.ndo_change_mtu		= ueth_change_mtu_ip,
9936+	.ndo_set_mac_address	= 0,
9937+	.ndo_validate_addr	= 0,
9938+};
9939+
9940+static int rmnet_ioctl_extended(struct net_device *dev, struct ifreq *ifr)
9941+{
9942+	struct rmnet_ioctl_extended_s ext_cmd;
9943+	struct eth_dev *eth_dev = netdev_priv(dev);
9944+	int rc = 0;
9945+
9946+	rc = copy_from_user(&ext_cmd, ifr->ifr_ifru.ifru_data,
9947+			    sizeof(struct rmnet_ioctl_extended_s));
9948+
9949+	if (rc) {
9950+		DBG("%s(): copy_from_user() failed\n", __func__);
9951+		return rc;
9952+	}
9953+
9954+	switch (ext_cmd.extended_ioctl) {
9955+	case RMNET_IOCTL_GET_SUPPORTED_FEATURES:
9956+		ext_cmd.u.data = 0;
9957+		break;
9958+
9959+	case RMNET_IOCTL_SET_MRU:
9960+		if (netif_running(dev))
9961+			return -EBUSY;
9962+
9963+		/* 16K max */
9964+		if ((size_t)ext_cmd.u.data > 0x4000)
9965+			return -EINVAL;
9966+
9967+		if (eth_dev->port_usb) {
9968+			eth_dev->port_usb->is_fixed = true;
9969+			eth_dev->port_usb->fixed_out_len =
9970+				(size_t) ext_cmd.u.data;
9971+			DBG("[%s] rmnet_ioctl(): SET MRU to %u\n", dev->name,
9972+				eth_dev->mru);
9973+		} else {
9974+			pr_err("[%s]: %s: SET MRU failed. Cable disconnected\n",
9975+				dev->name, __func__);
9976+			return -ENODEV;
9977+		}
9978+		break;
9979+
9980+	case RMNET_IOCTL_GET_MRU:
9981+		if (eth_dev->port_usb) {
9982+			ext_cmd.u.data = eth_dev->port_usb->is_fixed ?
9983+					eth_dev->port_usb->fixed_out_len :
9984+					dev->mtu;
9985+		} else {
9986+			pr_err("[%s]: %s: GET MRU failed. Cable disconnected\n",
9987+				dev->name, __func__);
9988+			return -ENODEV;
9989+		}
9990+		break;
9991+
9992+	case RMNET_IOCTL_GET_DRIVER_NAME:
9993+		strlcpy(ext_cmd.u.if_name, dev->name,
9994+			sizeof(ext_cmd.u.if_name));
9995+		break;
9996+
9997+	default:
9998+		break;
9999+	}
10000+
10001+	rc = copy_to_user(ifr->ifr_ifru.ifru_data, &ext_cmd,
10002+			  sizeof(struct rmnet_ioctl_extended_s));
10003+
10004+	if (rc)
10005+		DBG("%s(): copy_to_user() failed\n", __func__);
10006+	return rc;
10007+}
10008+
10009+static int ether_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
10010+{
10011+	struct eth_dev	*eth_dev = netdev_priv(dev);
10012+	void __user *addr = (void __user *) ifr->ifr_ifru.ifru_data;
10013+	int		prev_mtu = dev->mtu;
10014+	u32		state, old_opmode;
10015+	int		rc = -EFAULT;
10016+
10017+	old_opmode = eth_dev->flags;
10018+	/* Process IOCTL command */
10019+	switch (cmd) {
10020+	case RMNET_IOCTL_SET_LLP_ETHERNET:	/*Set Ethernet protocol*/
10021+		/* Perform Ethernet config only if in IP mode currently*/
10022+		if (test_bit(RMNET_MODE_LLP_IP, &eth_dev->flags)) {
10023+			ether_setup(dev);
10024+			dev->mtu = prev_mtu;
10025+			dev->netdev_ops = &eth_netdev_ops;
10026+			clear_bit(RMNET_MODE_LLP_IP, &eth_dev->flags);
10027+			set_bit(RMNET_MODE_LLP_ETH, &eth_dev->flags);
10028+			DBG(eth_dev, "[%s] ioctl(): set Ethernet proto mode\n",
10029+					dev->name);
10030+		}
10031+		if (test_bit(RMNET_MODE_LLP_ETH, &eth_dev->flags))
10032+			rc = 0;
10033+		break;
10034+
10035+	case RMNET_IOCTL_SET_LLP_IP:		/* Set RAWIP protocol*/
10036+		/* Perform IP config only if in Ethernet mode currently*/
10037+		if (test_bit(RMNET_MODE_LLP_ETH, &eth_dev->flags)) {
10038+			/* Undo config done in ether_setup() */
10039+			dev->header_ops = 0;  /* No header */
10040+			dev->type = ARPHRD_RAWIP;
10041+			dev->hard_header_len = 0;
10042+			dev->mtu = prev_mtu;
10043+			dev->addr_len = 0;
10044+			dev->flags &= ~(IFF_BROADCAST | IFF_MULTICAST);
10045+			dev->netdev_ops = &eth_netdev_ops_ip;
10046+			clear_bit(RMNET_MODE_LLP_ETH, &eth_dev->flags);
10047+			set_bit(RMNET_MODE_LLP_IP, &eth_dev->flags);
10048+			DBG(eth_dev, "[%s] ioctl(): set IP protocol mode\n",
10049+					dev->name);
10050+		}
10051+		if (test_bit(RMNET_MODE_LLP_IP, &eth_dev->flags))
10052+			rc = 0;
10053+		break;
10054+
10055+	case RMNET_IOCTL_GET_LLP:	/* Get link protocol state */
10056+		state = eth_dev->flags & (RMNET_MODE_LLP_ETH
10057+						| RMNET_MODE_LLP_IP);
10058+		if (copy_to_user(addr, &state, sizeof(state)))
10059+			break;
10060+		rc = 0;
10061+		break;
10062+
10063+	case RMNET_IOCTL_SET_RX_HEADROOM:	/* Set RX headroom */
10064+		if (copy_from_user(&eth_dev->rx_needed_headroom, addr,
10065+					sizeof(eth_dev->rx_needed_headroom)))
10066+			break;
10067+		DBG(eth_dev, "[%s] ioctl(): set RX HEADROOM: %x\n",
10068+				dev->name, eth_dev->rx_needed_headroom);
10069+		rc = 0;
10070+		break;
10071+
10072+	case RMNET_IOCTL_EXTENDED:
10073+		rc = rmnet_ioctl_extended(dev, ifr);
10074+		break;
10075+
10076+	default:
10077+		pr_err("[%s] error: ioctl called for unsupported cmd[%d]",
10078+			dev->name, cmd);
10079+		rc = -EINVAL;
10080+	}
10081+
10082+	DBG(eth_dev, "[%s] %s: cmd=0x%x opmode old=0x%08x new=0x%08lx\n",
10083+		dev->name, __func__, cmd, old_opmode, eth_dev->flags);
10084+
10085+	return rc;
10086+}
10087+
10088 static struct device_type gadget_type = {
10089 	.name	= "gadget",
10090 };
10091 
10092+static int gether_cpufreq_notifier_cb(struct notifier_block *nfb,
10093+		unsigned long event, void *data)
10094+{
10095+	struct cpufreq_policy *policy = data;
10096+	unsigned int cpu = policy->cpu;
10097+	struct eth_dev	*dev = container_of(nfb, struct eth_dev,
10098+					cpufreq_notifier);
10099+
10100+	if (!min_cpu_freq)
10101+		return NOTIFY_OK;
10102+
10103+	switch (event) {
10104+	case CPUFREQ_ADJUST:
10105+		pr_debug("%s: cpu:%u\n", __func__, cpu);
10106+
10107+		if (dev->state == ETH_START)
10108+			cpufreq_verify_within_limits(policy,
10109+					min_cpu_freq, UINT_MAX);
10110+
10111+		break;
10112+	}
10113+
10114+	return NOTIFY_OK;
10115+}
10116+
10117+static void update_cpu_policy_w(struct work_struct *work)
10118+{
10119+	int i;
10120+
10121+	for_each_online_cpu(i)
10122+		cpufreq_update_policy(i);
10123+}
10124+
10125 /**
10126  * gether_setup_name - initialize one ethernet-over-usb link
10127  * @g: gadget to associated with these links
10128@@ -1170,49 +1594,26 @@ struct eth_dev *gether_setup_name(struct usb_gadget *g, u8 ethaddr[ETH_ALEN],
10129 	spin_lock_init(&dev->lock);
10130 	spin_lock_init(&dev->req_lock);
10131 	INIT_WORK(&dev->work, eth_work);
10132+	INIT_WORK(&dev->rx_work, process_rx_w);
10133+	INIT_WORK(&dev->tx_work, process_tx_w);
10134 	INIT_LIST_HEAD(&dev->tx_reqs);
10135 	INIT_LIST_HEAD(&dev->rx_reqs);
10136-	skb_queue_head_init(&dev->rx_frames);
10137+	INIT_WORK(&dev->cpu_policy_w, update_cpu_policy_w);
10138 
10139-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
10140-	spin_lock_init(&dev->req_rx_lock);
10141-	dev->rx_workqueue = create_workqueue("rx_ether_queue");
10142-	if (dev->rx_workqueue == NULL)
10143-		pr_err("rx_ether_queue creation fail once\n");
10144-#endif
10145+	skb_queue_head_init(&dev->rx_frames);
10146+	skb_queue_head_init(&dev->tx_skb_q);
10147 
10148-#ifdef CONFIG_BRCM_NETCONSOLE
10149-	usb_eventqueue_init(&dev->usbevent_queue);
10150-#endif
10151 	/* network device setup */
10152 	dev->net = net;
10153 	snprintf(net->name, sizeof(net->name), "%s%%d", netname);
10154 
10155-#if 0 /* We use the fixed host MAC address for USB logging. */
10156 	if (get_ether_addr(dev_addr, net->dev_addr))
10157 		dev_warn(&g->dev,
10158 			"using random %s ethernet address\n", "self");
10159 	if (get_ether_addr(host_addr, dev->host_mac))
10160 		dev_warn(&g->dev,
10161 			"using random %s ethernet address\n", "host");
10162-#else
10163-	dev_warn(&g->dev,
10164-			"using fixed %s ethernet address\n", "self");
10165-	net->dev_addr[0] = 0x22;
10166-	net->dev_addr[1] = 0x33;
10167-	net->dev_addr[2] = 0x44;
10168-	net->dev_addr[3] = 0x55;
10169-	net->dev_addr[4] = 0x66;
10170-	net->dev_addr[5] = 0x77;
10171-	dev_warn(&g->dev,
10172-			"using fixed %s ethernet address\n", "host");
10173-	dev->host_mac[0] = 0xaa;
10174-	dev->host_mac[1] = 0xbb;
10175-	dev->host_mac[2] = 0xcc;
10176-	dev->host_mac[3] = 0xdd;
10177-	dev->host_mac[4] = 0xee;
10178-	dev->host_mac[5] = 0xff;
10179-#endif
10180+
10181 	if (ethaddr)
10182 		memcpy(ethaddr, dev->host_mac, ETH_ALEN);
10183 
10184@@ -1220,6 +1621,9 @@ struct eth_dev *gether_setup_name(struct usb_gadget *g, u8 ethaddr[ETH_ALEN],
10185 
10186 	SET_ETHTOOL_OPS(net, &ops);
10187 
10188+	/* set operation mode to eth by default */
10189+	set_bit(RMNET_MODE_LLP_ETH, &dev->flags);
10190+
10191 	dev->gadget = g;
10192 	SET_NETDEV_DEV(net, &g->dev);
10193 	SET_NETDEV_DEVTYPE(net, &gadget_type);
10194@@ -1238,6 +1642,12 @@ struct eth_dev *gether_setup_name(struct usb_gadget *g, u8 ethaddr[ETH_ALEN],
10195 		 *  - tx queueing enabled if open *and* carrier is "on"
10196 		 */
10197 		netif_carrier_off(net);
10198+		uether_debugfs_init(dev, netname);
10199+
10200+		dev->cpufreq_notifier.notifier_call =
10201+					gether_cpufreq_notifier_cb;
10202+		cpufreq_register_notifier(&dev->cpufreq_notifier,
10203+				CPUFREQ_POLICY_NOTIFIER);
10204 	}
10205 
10206 	return dev;
10207@@ -1251,20 +1661,56 @@ struct eth_dev *gether_setup_name(struct usb_gadget *g, u8 ethaddr[ETH_ALEN],
10208  */
10209 void gether_cleanup(struct eth_dev *dev)
10210 {
10211-	pr_info("%s\n", __func__);
10212+	int i;
10213 
10214 	if (!dev)
10215 		return;
10216 
10217+	/* make sure cpu boost is set to normal again */
10218+	dev->state = ETH_UNDEFINED;
10219+	cancel_work_sync(&dev->cpu_policy_w);
10220+	for_each_online_cpu(i)
10221+		cpufreq_update_policy(i);
10222+
10223+	cpufreq_unregister_notifier(&dev->cpufreq_notifier,
10224+				CPUFREQ_POLICY_NOTIFIER);
10225+
10226+	uether_debugfs_exit(dev);
10227 	unregister_netdev(dev->net);
10228 	flush_work(&dev->work);
10229-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
10230-	flush_workqueue(dev->rx_workqueue);
10231-	destroy_workqueue(dev->rx_workqueue);
10232-#endif
10233 	free_netdev(dev->net);
10234 }
10235 
10236+void gether_update_dl_max_xfer_size(struct gether *link, uint32_t s)
10237+{
10238+	struct eth_dev		*dev = link->ioport;
10239+	unsigned long flags;
10240+
10241+	spin_lock_irqsave(&dev->lock, flags);
10242+	dev->dl_max_xfer_size = s;
10243+	spin_unlock_irqrestore(&dev->lock, flags);
10244+}
10245+
10246+void gether_enable_sg(struct gether *link, bool enable)
10247+{
10248+	struct eth_dev		*dev = link->ioport;
10249+
10250+	dev->sg_enabled = enable ? dev->gadget->sg_supported : false;
10251+}
10252+
10253+void gether_update_dl_max_pkts_per_xfer(struct gether *link, uint32_t n)
10254+{
10255+	struct eth_dev		*dev = link->ioport;
10256+	unsigned long flags;
10257+
10258+	if (n > DL_MAX_PKTS_PER_XFER)
10259+		n = DL_MAX_PKTS_PER_XFER;
10260+
10261+	spin_lock_irqsave(&dev->lock, flags);
10262+	dev->dl_max_pkts_per_xfer = n;
10263+	spin_unlock_irqrestore(&dev->lock, flags);
10264+}
10265+
10266 /**
10267  * gether_connect - notify network layer that USB link is active
10268  * @link: the USB link, set up with endpoints, descriptors matching
10269@@ -1285,12 +1731,24 @@ struct net_device *gether_connect(struct gether *link)
10270 {
10271 	struct eth_dev		*dev = link->ioport;
10272 	int			result = 0;
10273-
10274-	pr_info("%s\n", __func__);
10275+	bool wait_for_rx_trigger;
10276 
10277 	if (!dev)
10278 		return ERR_PTR(-EINVAL);
10279 
10280+	/* if scatter/gather or sg is supported then headers can be part of
10281+	 * req->buf which is allocated later
10282+	 */
10283+	if (!dev->sg_enabled) {
10284+		link->header = kzalloc(sizeof(struct rndis_packet_msg_type),
10285+						GFP_ATOMIC);
10286+		if (!link->header) {
10287+			pr_err("RNDIS header memory allocation failed.\n");
10288+			result = -ENOMEM;
10289+			goto fail;
10290+		}
10291+	}
10292+
10293 	link->in_ep->driver_data = dev;
10294 	result = usb_ep_enable(link->in_ep);
10295 	if (result != 0) {
10296@@ -1307,29 +1765,26 @@ struct net_device *gether_connect(struct gether *link)
10297 		goto fail1;
10298 	}
10299 
10300+	dev->header_len = link->header_len;
10301+	dev->unwrap = link->unwrap;
10302+	dev->wrap = link->wrap;
10303+	dev->ul_max_pkts_per_xfer = link->ul_max_pkts_per_xfer;
10304+	dev->dl_max_pkts_per_xfer = link->dl_max_pkts_per_xfer;
10305+	dev->dl_max_xfer_size = link->dl_max_xfer_size;
10306+	dev->rx_trigger_enabled = link->rx_trigger_enabled;
10307+
10308 	if (result == 0)
10309 		result = alloc_requests(dev, link, qlen(dev->gadget));
10310 
10311 	if (result == 0) {
10312-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
10313-		if (link->is_fixed) { /* NCM */
10314-			max_skb_buf_no = UETH_RX_SKB_THRESH_NCM;
10315-			max_skb_buf_sz = link->fixed_out_len;
10316-		} else {
10317-			max_skb_buf_no = UETH_RX_SKB_THRESHOLD;
10318-			max_skb_buf_sz = MAX_RX_SKB_SIZE;
10319-		}
10320-		pr_info("USB Ether: It is in SKB prealloc mode!\n");
10321-		prealloc_rx_skbs();
10322-#endif
10323+
10324 		dev->zlp = link->is_zlp_ok;
10325 		DBG(dev, "qlen %d\n", qlen(dev->gadget));
10326 
10327-		dev->header_len = link->header_len;
10328-		dev->unwrap = link->unwrap;
10329-		dev->wrap = link->wrap;
10330-
10331 		spin_lock(&dev->lock);
10332+		dev->tx_skb_hold_count = 0;
10333+		dev->no_tx_req_used = 0;
10334+		dev->tx_req_bufsize = 0;
10335 		dev->port_usb = link;
10336 		if (netif_running(dev->net)) {
10337 			if (link->open)
10338@@ -1341,7 +1796,11 @@ struct net_device *gether_connect(struct gether *link)
10339 		spin_unlock(&dev->lock);
10340 
10341 		netif_carrier_on(dev->net);
10342-		if (netif_running(dev->net))
10343+
10344+		wait_for_rx_trigger = dev->rx_trigger_enabled &&
10345+			!link->rx_triggered;
10346+
10347+		if (netif_running(dev->net) && !wait_for_rx_trigger)
10348 			eth_start(dev, GFP_ATOMIC);
10349 
10350 	/* on error, disable any endpoints  */
10351@@ -1350,10 +1809,15 @@ struct net_device *gether_connect(struct gether *link)
10352 fail1:
10353 		(void) usb_ep_disable(link->in_ep);
10354 	}
10355-fail0:
10356+
10357 	/* caller is responsible for cleanup on error */
10358-	if (result < 0)
10359+	if (result < 0) {
10360+fail0:
10361+		kfree(link->header);
10362+fail:
10363 		return ERR_PTR(result);
10364+	}
10365+
10366 	return dev->net;
10367 }
10368 
10369@@ -1373,17 +1837,15 @@ void gether_disconnect(struct gether *link)
10370 {
10371 	struct eth_dev		*dev = link->ioport;
10372 	struct usb_request	*req;
10373+	struct sk_buff		*skb;
10374 
10375-	WARN_ON(!dev);
10376 	if (!dev)
10377 		return;
10378 
10379 	DBG(dev, "%s\n", __func__);
10380-	pr_info("%s\n", __func__);
10381 
10382-#ifdef CONFIG_BRCM_NETCONSOLE
10383-	defer_kevent(dev, WORK_BRCM_NETCONSOLE_OFF);
10384-#endif
10385+	dev->state = ETH_UNDEFINED;
10386+	queue_work(uether_wq, &dev->cpu_policy_w);
10387 
10388 	netif_stop_queue(dev->net);
10389 	netif_carrier_off(dev->net);
10390@@ -1400,10 +1862,28 @@ void gether_disconnect(struct gether *link)
10391 		list_del(&req->list);
10392 
10393 		spin_unlock(&dev->req_lock);
10394+		if (link->multi_pkt_xfer ||
10395+				dev->sg_enabled) {
10396+			kfree(req->buf);
10397+			req->buf = NULL;
10398+		}
10399+		if (dev->sg_enabled) {
10400+			kfree(req->context);
10401+			kfree(req->sg);
10402+		}
10403+
10404 		usb_ep_free_request(link->in_ep, req);
10405 		spin_lock(&dev->req_lock);
10406 	}
10407+
10408+	/* Free rndis header buffer memory */
10409+	if (!dev->sg_enabled)
10410+		kfree(link->header);
10411+	link->header = NULL;
10412 	spin_unlock(&dev->req_lock);
10413+
10414+	skb_queue_purge(&dev->tx_skb_q);
10415+
10416 	link->in_ep->driver_data = NULL;
10417 	link->in_ep->desc = NULL;
10418 
10419@@ -1419,18 +1899,143 @@ void gether_disconnect(struct gether *link)
10420 		spin_lock(&dev->req_lock);
10421 	}
10422 	spin_unlock(&dev->req_lock);
10423+
10424+	spin_lock(&dev->rx_frames.lock);
10425+	while ((skb = __skb_dequeue(&dev->rx_frames)))
10426+		dev_kfree_skb_any(skb);
10427+	spin_unlock(&dev->rx_frames.lock);
10428+
10429 	link->out_ep->driver_data = NULL;
10430 	link->out_ep->desc = NULL;
10431 
10432+	pr_debug("%s(): tx_throttle count= %lu", __func__,
10433+					dev->tx_throttle);
10434+	/* reset tx_throttle count */
10435+	dev->tx_throttle = 0;
10436+	dev->rx_throttle = 0;
10437+
10438 	/* finish forgetting about this USB link episode */
10439 	dev->header_len = 0;
10440 	dev->unwrap = NULL;
10441 	dev->wrap = NULL;
10442+	dev->rx_trigger_enabled = 0;
10443 
10444 	spin_lock(&dev->lock);
10445 	dev->port_usb = NULL;
10446 	spin_unlock(&dev->lock);
10447-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
10448-	ueth_rx_skb_queue_purge(&skb_rx_pool);
10449-#endif
10450 }
10451+
10452+int gether_up(struct gether *link)
10453+{
10454+	struct eth_dev *dev = link->ioport;
10455+
10456+	if (dev && netif_carrier_ok(dev->net))
10457+		eth_start(dev, GFP_KERNEL);
10458+
10459+	return 0;
10460+}
10461+
10462+
10463+static int uether_stat_show(struct seq_file *s, void *unused)
10464+{
10465+	struct eth_dev *dev = s->private;
10466+	int ret = 0;
10467+	int i;
10468+
10469+	if (dev) {
10470+		seq_printf(s, "rx_throttle = %lu\n",
10471+					dev->rx_throttle);
10472+		seq_printf(s, "tx_qlen=%u tx_throttle = %lu\n aggr count:",
10473+					dev->tx_skb_q.qlen,
10474+					dev->tx_throttle);
10475+		for (i = 0; i < DL_MAX_PKTS_PER_XFER; i++)
10476+			seq_printf(s, "%u\t", dev->tx_aggr_cnt[i]);
10477+
10478+		seq_printf(s, "\nloop_brk_cnt = %u\n tx_pkts_rcvd=%u\n",
10479+					dev->loop_brk_cnt,
10480+					dev->tx_pkts_rcvd);
10481+	}
10482+
10483+	return ret;
10484+}
10485+
10486+static int uether_open(struct inode *inode, struct file *file)
10487+{
10488+	return single_open(file, uether_stat_show, inode->i_private);
10489+}
10490+
10491+static ssize_t uether_stat_reset(struct file *file,
10492+		const char __user *ubuf, size_t count, loff_t *ppos)
10493+{
10494+	struct seq_file *s = file->private_data;
10495+	struct eth_dev *dev = s->private;
10496+	unsigned long flags;
10497+
10498+	spin_lock_irqsave(&dev->lock, flags);
10499+	/* Reset tx_throttle */
10500+	dev->tx_throttle = 0;
10501+	dev->rx_throttle = 0;
10502+	spin_unlock_irqrestore(&dev->lock, flags);
10503+	return count;
10504+}
10505+
10506+const struct file_operations uether_stats_ops = {
10507+	.open = uether_open,
10508+	.read = seq_read,
10509+	.write = uether_stat_reset,
10510+};
10511+
10512+static void uether_debugfs_init(struct eth_dev *dev, const char *name)
10513+{
10514+	struct dentry *uether_dent;
10515+	struct dentry *uether_dfile;
10516+
10517+	uether_dent = debugfs_create_dir(name, 0);
10518+	if (IS_ERR(uether_dent))
10519+		return;
10520+	dev->uether_dent = uether_dent;
10521+
10522+	uether_dfile = debugfs_create_file("status", S_IRUGO | S_IWUSR,
10523+				uether_dent, dev, &uether_stats_ops);
10524+	if (!uether_dfile || IS_ERR(uether_dfile))
10525+		debugfs_remove(uether_dent);
10526+	dev->uether_dfile = uether_dfile;
10527+}
10528+
10529+static void uether_debugfs_exit(struct eth_dev *dev)
10530+{
10531+	debugfs_remove(dev->uether_dfile);
10532+	debugfs_remove(dev->uether_dent);
10533+	dev->uether_dent = NULL;
10534+	dev->uether_dfile = NULL;
10535+}
10536+
10537+static int __init gether_init(void)
10538+{
10539+	uether_wq = alloc_workqueue("uether", WQ_CPU_INTENSIVE, 1);
10540+	if (!uether_wq) {
10541+		pr_err("%s: Unable to create workqueue: uether\n", __func__);
10542+		return -ENOMEM;
10543+	}
10544+
10545+	uether_tx_wq = alloc_workqueue("uether_tx",
10546+				WQ_CPU_INTENSIVE | WQ_UNBOUND, 1);
10547+	if (!uether_tx_wq) {
10548+		destroy_workqueue(uether_wq);
10549+		pr_err("%s: Unable to create workqueue: uether\n", __func__);
10550+		return -ENOMEM;
10551+	}
10552+
10553+	return 0;
10554+}
10555+module_init(gether_init);
10556+
10557+static void __exit gether_exit(void)
10558+{
10559+	destroy_workqueue(uether_tx_wq);
10560+	destroy_workqueue(uether_wq);
10561+
10562+}
10563+module_exit(gether_exit);
10564+MODULE_DESCRIPTION("ethernet over USB driver");
10565+MODULE_LICENSE("GPL v2");
10566diff --git a/drivers/usb/gadget/u_ether.h b/drivers/usb/gadget/u_ether.h
10567index 886c500..4b6064e 100644
10568--- a/drivers/usb/gadget/u_ether.h
10569+++ b/drivers/usb/gadget/u_ether.h
10570@@ -54,6 +54,13 @@ struct gether {
10571 	bool				is_fixed;
10572 	u32				fixed_out_len;
10573 	u32				fixed_in_len;
10574+
10575+	unsigned			ul_max_pkts_per_xfer;
10576+	uint32_t			dl_max_pkts_per_xfer;
10577+	uint32_t			dl_max_xfer_size;
10578+	bool				multi_pkt_xfer;
10579+	bool				rx_trigger_enabled;
10580+	bool				rx_triggered;
10581 	struct sk_buff			*(*wrap)(struct gether *port,
10582 						struct sk_buff *skb);
10583 	int				(*unwrap)(struct gether *port,
10584@@ -63,6 +70,8 @@ struct gether {
10585 	/* called on network open/close */
10586 	void				(*open)(struct gether *);
10587 	void				(*close)(struct gether *);
10588+	struct rndis_packet_msg_type	*header;
10589+
10590 };
10591 
10592 #define	DEFAULT_FILTER	(USB_CDC_PACKET_TYPE_BROADCAST \
10593@@ -98,6 +107,10 @@ void gether_cleanup(struct eth_dev *dev);
10594 /* connect/disconnect is handled by individual functions */
10595 struct net_device *gether_connect(struct gether *);
10596 void gether_disconnect(struct gether *);
10597+int gether_up(struct gether *);
10598+void gether_update_dl_max_pkts_per_xfer(struct gether *link, uint32_t n);
10599+void gether_update_dl_max_xfer_size(struct gether *link, uint32_t s);
10600+void gether_enable_sg(struct gether *link, bool);
10601 
10602 /* Some controllers can't support CDC Ethernet (ECM) ... */
10603 static inline bool can_support_ecm(struct usb_gadget *gadget)
10604@@ -125,6 +138,7 @@ int eem_bind_config(struct usb_configuration *c, struct eth_dev *dev);
10605 
10606 int rndis_bind_config_vendor(struct usb_configuration *c, u8 ethaddr[ETH_ALEN],
10607 		u32 vendorID, const char *manufacturer, struct eth_dev *dev);
10608+int rndis_rx_trigger(void);
10609 
10610 #else
10611 
10612@@ -135,6 +149,12 @@ rndis_bind_config_vendor(struct usb_configuration *c, u8 ethaddr[ETH_ALEN],
10613 	return 0;
10614 }
10615 
10616+static inline int
10617+rndis_rx_trigger(void)
10618+{
10619+	return 0;
10620+}
10621+
10622 #endif
10623 
10624 /**
10625@@ -155,12 +175,4 @@ static inline int rndis_bind_config(struct usb_configuration *c,
10626 	return rndis_bind_config_vendor(c, ethaddr, 0, NULL, dev);
10627 }
10628 
10629-#ifdef CONFIG_BRCM_NETCONSOLE
10630-extern void brcm_current_netcon_status(unsigned char status);
10631-extern unsigned char brcm_get_netcon_status(void);
10632-#endif
10633-#ifdef CONFIG_USB_ETH_SKB_ALLOC_OPTIMIZATION
10634-extern void ncm_ntb_out_size(u32 ntb_out_size);
10635-#endif
10636-
10637 #endif /* __U_ETHER_H */
10638diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c
10639index 2fe5fd9..030a47e 100644
10640--- a/drivers/usb/gadget/u_serial.c
10641+++ b/drivers/usb/gadget/u_serial.c
10642@@ -4,6 +4,7 @@
10643  * Copyright (C) 2003 Al Borchers (alborchers@steinerpoint.com)
10644  * Copyright (C) 2008 David Brownell
10645  * Copyright (C) 2008 by Nokia Corporation
10646+ * Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
10647  *
10648  * This code also borrows from usbserial.c, which is
10649  * Copyright (C) 1999 - 2002 Greg Kroah-Hartman (greg@kroah.com)
10650@@ -27,11 +28,11 @@
10651 #include <linux/slab.h>
10652 #include <linux/export.h>
10653 #include <linux/module.h>
10654+#include <linux/debugfs.h>
10655+#include <linux/workqueue.h>
10656 
10657 #include "u_serial.h"
10658 
10659-static struct acm_logging_callbacks *acm_logging_cb;
10660-
10661 
10662 /*
10663  * This component encapsulates the TTY layer glue needed to provide basic
10664@@ -82,9 +83,14 @@ static struct acm_logging_callbacks *acm_logging_cb;
10665  * next layer of buffering.  For TX that's a circular buffer; for RX
10666  * consider it a NOP.  A third layer is provided by the TTY code.
10667  */
10668-#define QUEUE_SIZE		16
10669+#define TX_QUEUE_SIZE		8
10670+#define TX_BUF_SIZE		4096
10671 #define WRITE_BUF_SIZE		8192		/* TX only */
10672 
10673+#define RX_QUEUE_SIZE		8
10674+#define RX_BUF_SIZE		4096
10675+
10676+
10677 /* circular buffer */
10678 struct gs_buf {
10679 	unsigned		buf_size;
10680@@ -111,11 +117,8 @@ struct gs_port {
10681 	int read_allocated;
10682 	struct list_head	read_queue;
10683 	unsigned		n_read;
10684-#ifndef CONFIG_USE_WORKQ_PUSH
10685-	struct tasklet_struct	push;
10686-#else
10687-	struct work_struct      push;
10688-#endif
10689+	struct work_struct	push;
10690+
10691 	struct list_head	write_pool;
10692 	int write_started;
10693 	int write_allocated;
10694@@ -124,6 +127,10 @@ struct gs_port {
10695 
10696 	/* REVISIT this state ... */
10697 	struct usb_cdc_line_coding port_line_coding;	/* 8-N-1 etc */
10698+	unsigned long           nbytes_from_host;
10699+	unsigned long           nbytes_to_tty;
10700+	unsigned long           nbytes_from_tty;
10701+	unsigned long           nbytes_to_host;
10702 };
10703 
10704 static struct portmaster {
10705@@ -131,6 +138,8 @@ static struct portmaster {
10706 	struct gs_port	*port;
10707 } ports[MAX_U_SERIAL_PORTS];
10708 
10709+static struct workqueue_struct *gserial_wq;
10710+
10711 #define GS_CLOSE_TIMEOUT		15		/* seconds */
10712 
10713 
10714@@ -366,21 +375,50 @@ __releases(&port->port_lock)
10715 __acquires(&port->port_lock)
10716 */
10717 {
10718-	struct list_head	*pool = &port->write_pool;
10719-	struct usb_ep		*in = port->port_usb->in;
10720+	struct list_head	*pool;
10721+	struct usb_ep		*in;
10722 	int			status = 0;
10723+	static long 		prev_len;
10724 	bool			do_tty_wake = false;
10725 
10726+	if (!port || !port->port_usb) {
10727+		pr_err("Error - port or port->usb is NULL.");
10728+		return -EIO;
10729+	}
10730+
10731+	pool = &port->write_pool;
10732+	in   = port->port_usb->in;
10733+
10734 	while (!list_empty(pool)) {
10735 		struct usb_request	*req;
10736 		int			len;
10737 
10738-		if (port->write_started >= QUEUE_SIZE)
10739+		if (port->write_started >= TX_QUEUE_SIZE)
10740 			break;
10741 
10742 		req = list_entry(pool->next, struct usb_request, list);
10743-		len = gs_send_packet(port, req->buf, in->maxpacket);
10744+		len = gs_send_packet(port, req->buf, TX_BUF_SIZE);
10745 		if (len == 0) {
10746+			/* Queue zero length packet explicitly to make it
10747+			 * work with UDCs which don't support req->zero flag
10748+			 */
10749+			if (prev_len && (prev_len % in->maxpacket == 0)) {
10750+				req->length = 0;
10751+				list_del(&req->list);
10752+				spin_unlock(&port->port_lock);
10753+				status = usb_ep_queue(in, req, GFP_ATOMIC);
10754+				spin_lock(&port->port_lock);
10755+				if (!port->port_usb) {
10756+					gs_free_req(in, req);
10757+					break;
10758+				}
10759+				if (status) {
10760+					printk(KERN_ERR "%s: %s err %d\n",
10761+					__func__, "queue", status);
10762+					list_add(&req->list, pool);
10763+				}
10764+				prev_len = 0;
10765+			}
10766 			wake_up_interruptible(&port->drain_wait);
10767 			break;
10768 		}
10769@@ -388,7 +426,6 @@ __acquires(&port->port_lock)
10770 
10771 		req->length = len;
10772 		list_del(&req->list);
10773-		req->zero = (gs_buf_data_avail(&port->port_write_buf) == 0);
10774 
10775 		pr_vdebug(PREFIX "%d: tx len=%d, 0x%02x 0x%02x 0x%02x ...\n",
10776 				port->port_num, len, *((u8 *)req->buf),
10777@@ -404,19 +441,27 @@ __acquires(&port->port_lock)
10778 		spin_unlock(&port->port_lock);
10779 		status = usb_ep_queue(in, req, GFP_ATOMIC);
10780 		spin_lock(&port->port_lock);
10781-
10782+		/*
10783+		 * If port_usb is NULL, gserial disconnect is called
10784+		 * while the spinlock is dropped and all requests are
10785+		 * freed. Free the current request here.
10786+		 */
10787+		if (!port->port_usb) {
10788+			do_tty_wake = false;
10789+			gs_free_req(in, req);
10790+			break;
10791+		}
10792 		if (status) {
10793 			pr_debug("%s: %s %s err %d\n",
10794 					__func__, "queue", in->name, status);
10795 			list_add(&req->list, pool);
10796 			break;
10797 		}
10798+		prev_len = req->length;
10799+		port->nbytes_from_tty += req->length;
10800 
10801 		port->write_started++;
10802 
10803-		/* abort immediately after disconnect */
10804-		if (!port->port_usb)
10805-			break;
10806 	}
10807 
10808 	if (do_tty_wake && port->port.tty)
10809@@ -433,8 +478,17 @@ __releases(&port->port_lock)
10810 __acquires(&port->port_lock)
10811 */
10812 {
10813-	struct list_head	*pool = &port->read_pool;
10814-	struct usb_ep		*out = port->port_usb->out;
10815+	struct list_head	*pool;
10816+	struct usb_ep		*out;
10817+	unsigned		started = 0;
10818+
10819+	if (!port || !port->port_usb) {
10820+		pr_err("Error - port or port->usb is NULL.");
10821+		return -EIO;
10822+	}
10823+
10824+	pool = &port->read_pool;
10825+	out  = port->port_usb->out;
10826 
10827 	while (!list_empty(pool)) {
10828 		struct usb_request	*req;
10829@@ -446,12 +500,12 @@ __acquires(&port->port_lock)
10830 		if (!tty)
10831 			break;
10832 
10833-		if (port->read_started >= QUEUE_SIZE)
10834+		if (port->read_started >= RX_QUEUE_SIZE)
10835 			break;
10836 
10837 		req = list_entry(pool->next, struct usb_request, list);
10838 		list_del(&req->list);
10839-		req->length = out->maxpacket;
10840+		req->length = RX_BUF_SIZE;
10841 
10842 		/* drop lock while we call out; the controller driver
10843 		 * may need to call us back (e.g. for disconnect)
10844@@ -459,7 +513,16 @@ __acquires(&port->port_lock)
10845 		spin_unlock(&port->port_lock);
10846 		status = usb_ep_queue(out, req, GFP_ATOMIC);
10847 		spin_lock(&port->port_lock);
10848-
10849+		/*
10850+		 * If port_usb is NULL, gserial disconnect is called
10851+		 * while the spinlock is dropped and all requests are
10852+		 * freed. Free the current request here.
10853+		 */
10854+		if (!port->port_usb) {
10855+			started = 0;
10856+			gs_free_req(out, req);
10857+			break;
10858+		}
10859 		if (status) {
10860 			pr_debug("%s: %s %s err %d\n",
10861 					__func__, "queue", out->name, status);
10862@@ -468,9 +531,6 @@ __acquires(&port->port_lock)
10863 		}
10864 		port->read_started++;
10865 
10866-		/* abort immediately after disconnect */
10867-		if (!port->port_usb)
10868-			break;
10869 	}
10870 	return port->read_started;
10871 }
10872@@ -485,26 +545,14 @@ __acquires(&port->port_lock)
10873  * So QUEUE_SIZE packets plus however many the FIFO holds (usually two)
10874  * can be buffered before the TTY layer's buffers (currently 64 KB).
10875  */
10876-#ifndef CONFIG_USE_WORKQ_PUSH
10877-static void gs_rx_push(unsigned long _port)
10878-{
10879-	struct gs_port		*port = (void *)_port;
10880-	struct list_head	*queue = &port->read_queue;
10881-#else
10882-static void gs_rx_push(struct work_struct *work)
10883+static void gs_rx_push(struct work_struct *w)
10884 {
10885-	struct gs_port	*port;
10886-	struct list_head	*queue;
10887-#endif
10888+	struct gs_port		*port = container_of(w, struct gs_port, push);
10889 	struct tty_struct	*tty;
10890+	struct list_head	*queue = &port->read_queue;
10891 	bool			disconnect = false;
10892 	bool			do_push = false;
10893 
10894-#ifdef CONFIG_USE_WORKQ_PUSH
10895-	port = container_of(work, struct gs_port, push);
10896-	queue = &port->read_queue;
10897-#endif
10898-
10899 	/* hand any queued data to the tty */
10900 	spin_lock_irq(&port->port_lock);
10901 	tty = port->port.tty;
10902@@ -549,6 +597,7 @@ static void gs_rx_push(struct work_struct *work)
10903 
10904 			count = tty_insert_flip_string(&port->port, packet,
10905 					size);
10906+			port->nbytes_to_tty += count;
10907 			if (count)
10908 				do_push = true;
10909 			if (count != size) {
10910@@ -572,23 +621,18 @@ static void gs_rx_push(struct work_struct *work)
10911 	if (do_push)
10912 		tty_flip_buffer_push(&port->port);
10913 
10914-
10915 	/* We want our data queue to become empty ASAP, keeping data
10916 	 * in the tty and ldisc (not here).  If we couldn't push any
10917 	 * this time around, there may be trouble unless there's an
10918 	 * implicit tty_unthrottle() call on its way...
10919 	 *
10920-	 * REVISIT we should probably add a timer to keep the tasklet
10921+	 * REVISIT we should probably add a timer to keep the work queue
10922 	 * from starving ... but it's not clear that case ever happens.
10923 	 */
10924 	if (!list_empty(queue) && tty) {
10925 		if (!test_bit(TTY_THROTTLED, &tty->flags)) {
10926 			if (do_push)
10927-#ifndef CONFIG_USE_WORKQ_PUSH
10928-				tasklet_schedule(&port->push);
10929-#else
10930-				schedule_work(&port->push);
10931-#endif
10932+				queue_work(gserial_wq, &port->push);
10933 			else
10934 				pr_warning(PREFIX "%d: RX not scheduled?\n",
10935 					port->port_num);
10936@@ -605,29 +649,23 @@ static void gs_rx_push(struct work_struct *work)
10937 static void gs_read_complete(struct usb_ep *ep, struct usb_request *req)
10938 {
10939 	struct gs_port	*port = ep->driver_data;
10940-
10941-	if (WARN_ON(!port))
10942-		return;
10943+	unsigned long flags;
10944 
10945 	/* Queue all received data until the tty layer is ready for it. */
10946-	spin_lock(&port->port_lock);
10947+	spin_lock_irqsave(&port->port_lock, flags);
10948+	port->nbytes_from_host += req->actual;
10949 	list_add_tail(&req->list, &port->read_queue);
10950-#ifndef CONFIG_USE_WORKQ_PUSH
10951-	tasklet_schedule(&port->push);
10952-#else
10953-	schedule_work(&port->push);
10954-#endif
10955-	spin_unlock(&port->port_lock);
10956+	queue_work(gserial_wq, &port->push);
10957+	spin_unlock_irqrestore(&port->port_lock, flags);
10958 }
10959 
10960 static void gs_write_complete(struct usb_ep *ep, struct usb_request *req)
10961 {
10962 	struct gs_port	*port = ep->driver_data;
10963+	unsigned long flags;
10964 
10965-	if (WARN_ON(!port))
10966-		return;
10967-
10968-	spin_lock(&port->port_lock);
10969+	spin_lock_irqsave(&port->port_lock, flags);
10970+	port->nbytes_to_host += req->actual;
10971 	list_add(&req->list, &port->write_pool);
10972 	port->write_started--;
10973 
10974@@ -639,7 +677,8 @@ static void gs_write_complete(struct usb_ep *ep, struct usb_request *req)
10975 		/* FALL THROUGH */
10976 	case 0:
10977 		/* normal completion */
10978-		gs_start_tx(port);
10979+		if (port->port_usb)
10980+			gs_start_tx(port);
10981 		break;
10982 
10983 	case -ESHUTDOWN:
10984@@ -648,7 +687,7 @@ static void gs_write_complete(struct usb_ep *ep, struct usb_request *req)
10985 		break;
10986 	}
10987 
10988-	spin_unlock(&port->port_lock);
10989+	spin_unlock_irqrestore(&port->port_lock, flags);
10990 }
10991 
10992 static void gs_free_requests(struct usb_ep *ep, struct list_head *head,
10993@@ -666,19 +705,20 @@ static void gs_free_requests(struct usb_ep *ep, struct list_head *head,
10994 }
10995 
10996 static int gs_alloc_requests(struct usb_ep *ep, struct list_head *head,
10997+		int queue_size, int req_size,
10998 		void (*fn)(struct usb_ep *, struct usb_request *),
10999 		int *allocated)
11000 {
11001 	int			i;
11002 	struct usb_request	*req;
11003-	int n = allocated ? QUEUE_SIZE - *allocated : QUEUE_SIZE;
11004+	int n = allocated ? queue_size - *allocated : queue_size;
11005 
11006 	/* Pre-allocate up to QUEUE_SIZE transfers, but if we can't
11007 	 * do quite that many this time, don't fail ... we just won't
11008 	 * be as speedy as we might otherwise be.
11009 	 */
11010 	for (i = 0; i < n; i++) {
11011-		req = gs_alloc_req(ep, ep->maxpacket, GFP_ATOMIC);
11012+		req = gs_alloc_req(ep, req_size, GFP_ATOMIC);
11013 		if (!req)
11014 			return list_empty(head) ? -ENOMEM : 0;
11015 		req->complete = fn;
11016@@ -700,24 +740,32 @@ static int gs_alloc_requests(struct usb_ep *ep, struct list_head *head,
11017  */
11018 static int gs_start_io(struct gs_port *port)
11019 {
11020-	struct list_head	*head = &port->read_pool;
11021-	struct usb_ep		*ep = port->port_usb->out;
11022+	struct list_head	*head;
11023+	struct usb_ep		*ep;
11024 	int			status;
11025 	unsigned		started;
11026 
11027+	if (!port || !port->port_usb) {
11028+		pr_err("Error - port or port->usb is NULL.");
11029+		return -EIO;
11030+	}
11031+
11032+	head = &port->read_pool;
11033+	ep = port->port_usb->out;
11034+
11035 	/* Allocate RX and TX I/O buffers.  We can't easily do this much
11036 	 * earlier (with GFP_KERNEL) because the requests are coupled to
11037 	 * endpoints, as are the packet sizes we'll be using.  Different
11038 	 * configurations may use different endpoints with a given port;
11039 	 * and high speed vs full speed changes packet sizes too.
11040 	 */
11041-	status = gs_alloc_requests(ep, head, gs_read_complete,
11042-		&port->read_allocated);
11043+	status = gs_alloc_requests(ep, head, RX_QUEUE_SIZE, RX_BUF_SIZE,
11044+			 gs_read_complete, &port->read_allocated);
11045 	if (status)
11046 		return status;
11047 
11048 	status = gs_alloc_requests(port->port_usb->in, &port->write_pool,
11049-			gs_write_complete, &port->write_allocated);
11050+			TX_QUEUE_SIZE, TX_BUF_SIZE, gs_write_complete, &port->write_allocated);
11051 	if (status) {
11052 		gs_free_requests(ep, head, &port->read_allocated);
11053 		return status;
11054@@ -832,6 +880,11 @@ static int gs_open(struct tty_struct *tty, struct file *file)
11055 	if (port->port_usb) {
11056 		struct gserial	*gser = port->port_usb;
11057 
11058+		if (gser->flags & ASYNC_LOW_LATENCY) {
11059+			pr_debug("%s: Setting to low latency", __func__);
11060+			tty->port->low_latency = 1;
11061+		}
11062+
11063 		pr_debug("gs_open: start ttyGS%d\n", port->port_num);
11064 		gs_start_io(port);
11065 
11066@@ -865,9 +918,6 @@ static void gs_close(struct tty_struct *tty, struct file *file)
11067 	struct gs_port *port = tty->driver_data;
11068 	struct gserial	*gser;
11069 
11070-	if (WARN_ON(!port))
11071-		return;
11072-
11073 	spin_lock_irq(&port->port_lock);
11074 
11075 	if (port->port.count != 1) {
11076@@ -904,7 +954,7 @@ static void gs_close(struct tty_struct *tty, struct file *file)
11077 
11078 	/* Iff we're disconnected, there can be no I/O in flight so it's
11079 	 * ok to free the circular buffer; else just scrub it.  And don't
11080-	 * let the push tasklet fire again until we're re-opened.
11081+	 * let the push work queue fire again until we're re-opened.
11082 	 */
11083 	if (gser == NULL)
11084 		gs_buf_free(&port->port_write_buf);
11085@@ -926,16 +976,12 @@ exit:
11086 
11087 static int gs_write(struct tty_struct *tty, const unsigned char *buf, int count)
11088 {
11089-	struct gs_port	*port;
11090+	struct gs_port	*port = tty->driver_data;
11091 	unsigned long	flags;
11092 	int		status;
11093 
11094-	if (tty->driver_data == (void *)0) {
11095-		pr_warn("tty->driver_data is zero\n");
11096+	if (!port)
11097 		return 0;
11098-	}
11099-	port = tty->driver_data;
11100-
11101 	pr_vdebug("gs_write: ttyGS%d (%p) writing %d bytes\n",
11102 			port->port_num, tty, count);
11103 
11104@@ -956,10 +1002,9 @@ static int gs_put_char(struct tty_struct *tty, unsigned char ch)
11105 	unsigned long	flags;
11106 	int		status;
11107 
11108-	if (WARN_ON(!port))
11109+	if (!port)
11110 		return 0;
11111-
11112-	pr_vdebug("gs_put_char: (%d,%p) char=0x%x, called from %p\n",
11113+	pr_vdebug("gs_put_char: (%d,%p) char=0x%x, called from %pf\n",
11114 		port->port_num, tty, ch, __builtin_return_address(0));
11115 
11116 	spin_lock_irqsave(&port->port_lock, flags);
11117@@ -974,9 +1019,8 @@ static void gs_flush_chars(struct tty_struct *tty)
11118 	struct gs_port	*port = tty->driver_data;
11119 	unsigned long	flags;
11120 
11121-	if (WARN_ON(!port))
11122+	if (!port)
11123 		return;
11124-
11125 	pr_vdebug("gs_flush_chars: (%d,%p)\n", port->port_num, tty);
11126 
11127 	spin_lock_irqsave(&port->port_lock, flags);
11128@@ -991,9 +1035,8 @@ static int gs_write_room(struct tty_struct *tty)
11129 	unsigned long	flags;
11130 	int		room = 0;
11131 
11132-	if (WARN_ON(!port))
11133+	if (!port)
11134 		return 0;
11135-
11136 	spin_lock_irqsave(&port->port_lock, flags);
11137 	if (port->port_usb)
11138 		room = gs_buf_space_avail(&port->port_write_buf);
11139@@ -1011,9 +1054,8 @@ static int gs_chars_in_buffer(struct tty_struct *tty)
11140 	unsigned long	flags;
11141 	int		chars = 0;
11142 
11143-	if (WARN_ON(!port))
11144+	if (!port)
11145 		return 0;
11146-
11147 	spin_lock_irqsave(&port->port_lock, flags);
11148 	chars = gs_buf_data_avail(&port->port_write_buf);
11149 	spin_unlock_irqrestore(&port->port_lock, flags);
11150@@ -1030,7 +1072,11 @@ static void gs_unthrottle(struct tty_struct *tty)
11151 	struct gs_port		*port = tty->driver_data;
11152 	unsigned long		flags;
11153 
11154-	if (WARN_ON(!port))
11155+	/*
11156+	 * tty's driver data is set to NULL during port close.  Nothing
11157+	 * to do here.
11158+	 */
11159+	if (!port)
11160 		return;
11161 
11162 	spin_lock_irqsave(&port->port_lock, flags);
11163@@ -1039,11 +1085,7 @@ static void gs_unthrottle(struct tty_struct *tty)
11164 		 * rts/cts, or other handshaking with the host, but if the
11165 		 * read queue backs up enough we'll be NAKing OUT packets.
11166 		 */
11167-#ifndef CONFIG_USE_WORKQ_PUSH
11168-		tasklet_schedule(&port->push);
11169-#else
11170-		schedule_work(&port->push);
11171-#endif
11172+		queue_work(gserial_wq, &port->push);
11173 		pr_vdebug(PREFIX "%d: unthrottle\n", port->port_num);
11174 	}
11175 	spin_unlock_irqrestore(&port->port_lock, flags);
11176@@ -1055,9 +1097,8 @@ static int gs_break_ctl(struct tty_struct *tty, int duration)
11177 	int		status = 0;
11178 	struct gserial	*gser;
11179 
11180-	if (WARN_ON(!port))
11181+	if (!port)
11182 		return 0;
11183-
11184 	pr_vdebug("gs_break_ctl: ttyGS%d, send break (%d)\n",
11185 			port->port_num, duration);
11186 
11187@@ -1070,6 +1111,81 @@ static int gs_break_ctl(struct tty_struct *tty, int duration)
11188 	return status;
11189 }
11190 
11191+static int gs_tiocmget(struct tty_struct *tty)
11192+{
11193+	struct gs_port	*port = tty->driver_data;
11194+	struct gserial	*gser;
11195+	unsigned int result = 0;
11196+
11197+	if (!port)
11198+		return -ENODEV;
11199+	spin_lock_irq(&port->port_lock);
11200+	gser = port->port_usb;
11201+	if (!gser) {
11202+		result = -ENODEV;
11203+		goto fail;
11204+	}
11205+
11206+	if (gser->get_dtr)
11207+		result |= (gser->get_dtr(gser) ? TIOCM_DTR : 0);
11208+
11209+	if (gser->get_rts)
11210+		result |= (gser->get_rts(gser) ? TIOCM_RTS : 0);
11211+
11212+	if (gser->serial_state & TIOCM_CD)
11213+		result |= TIOCM_CD;
11214+
11215+	if (gser->serial_state & TIOCM_RI)
11216+		result |= TIOCM_RI;
11217+fail:
11218+	spin_unlock_irq(&port->port_lock);
11219+	return result;
11220+}
11221+
11222+static int gs_tiocmset(struct tty_struct *tty,
11223+	unsigned int set, unsigned int clear)
11224+{
11225+	struct gs_port	*port = tty->driver_data;
11226+	struct gserial *gser;
11227+	int	status = 0;
11228+
11229+	if (!port)
11230+		return -ENODEV;
11231+	spin_lock_irq(&port->port_lock);
11232+	gser = port->port_usb;
11233+	if (!gser) {
11234+		status = -ENODEV;
11235+		goto fail;
11236+	}
11237+
11238+	if (set & TIOCM_RI) {
11239+		if (gser->send_ring_indicator) {
11240+			gser->serial_state |= TIOCM_RI;
11241+			status = gser->send_ring_indicator(gser, 1);
11242+		}
11243+	}
11244+	if (clear & TIOCM_RI) {
11245+		if (gser->send_ring_indicator) {
11246+			gser->serial_state &= ~TIOCM_RI;
11247+			status = gser->send_ring_indicator(gser, 0);
11248+		}
11249+	}
11250+	if (set & TIOCM_CD) {
11251+		if (gser->send_carrier_detect) {
11252+			gser->serial_state |= TIOCM_CD;
11253+			status = gser->send_carrier_detect(gser, 1);
11254+		}
11255+	}
11256+	if (clear & TIOCM_CD) {
11257+		if (gser->send_carrier_detect) {
11258+			gser->serial_state &= ~TIOCM_CD;
11259+			status = gser->send_carrier_detect(gser, 0);
11260+		}
11261+	}
11262+fail:
11263+	spin_unlock_irq(&port->port_lock);
11264+	return status;
11265+}
11266 static const struct tty_operations gs_tty_ops = {
11267 	.open =			gs_open,
11268 	.close =		gs_close,
11269@@ -1080,6 +1196,8 @@ static const struct tty_operations gs_tty_ops = {
11270 	.chars_in_buffer =	gs_chars_in_buffer,
11271 	.unthrottle =		gs_unthrottle,
11272 	.break_ctl =		gs_break_ctl,
11273+	.tiocmget  =		gs_tiocmget,
11274+	.tiocmset  =		gs_tiocmset,
11275 };
11276 
11277 /*-------------------------------------------------------------------------*/
11278@@ -1107,12 +1225,9 @@ gs_port_alloc(unsigned port_num, struct usb_cdc_line_coding *coding)
11279 	tty_port_init(&port->port);
11280 	spin_lock_init(&port->port_lock);
11281 	init_waitqueue_head(&port->drain_wait);
11282-#ifndef CONFIG_USE_WORKQ_PUSH
11283-	tasklet_init(&port->push, gs_rx_push, (unsigned long) port);
11284-#else
11285-	pr_info("use workqueue push\n");
11286+
11287 	INIT_WORK(&port->push, gs_rx_push);
11288-#endif
11289+
11290 	INIT_LIST_HEAD(&port->read_pool);
11291 	INIT_LIST_HEAD(&port->read_queue);
11292 	INIT_LIST_HEAD(&port->write_pool);
11293@@ -1126,6 +1241,124 @@ out:
11294 	return ret;
11295 }
11296 
11297+
11298+#if defined(CONFIG_DEBUG_FS)
11299+
11300+#define BUF_SIZE	512
11301+
11302+static ssize_t debug_read_status(struct file *file, char __user *ubuf,
11303+					size_t count, loff_t *ppos)
11304+{
11305+	struct gs_port *ui_dev = file->private_data;
11306+	struct tty_struct       *tty;
11307+	struct gserial		*gser;
11308+	char *buf;
11309+	unsigned long flags;
11310+	int i = 0;
11311+	int ret;
11312+	int result = 0;
11313+
11314+	tty = ui_dev->port.tty;
11315+	gser = ui_dev->port_usb;
11316+
11317+	buf = kzalloc(sizeof(char) * BUF_SIZE, GFP_KERNEL);
11318+	if (!buf)
11319+		return -ENOMEM;
11320+
11321+	spin_lock_irqsave(&ui_dev->port_lock, flags);
11322+
11323+	i += scnprintf(buf + i, BUF_SIZE - i,
11324+		"nbytes_from_host: %lu\n", ui_dev->nbytes_from_host);
11325+
11326+	i += scnprintf(buf + i, BUF_SIZE - i,
11327+		"nbytes_to_tty: %lu\n", ui_dev->nbytes_to_tty);
11328+
11329+	i += scnprintf(buf + i, BUF_SIZE - i, "nbytes_with_usb_OUT_txr: %lu\n",
11330+			(ui_dev->nbytes_from_host - ui_dev->nbytes_to_tty));
11331+
11332+	i += scnprintf(buf + i, BUF_SIZE - i,
11333+		"nbytes_from_tty: %lu\n", ui_dev->nbytes_from_tty);
11334+
11335+	i += scnprintf(buf + i, BUF_SIZE - i,
11336+		"nbytes_to_host: %lu\n", ui_dev->nbytes_to_host);
11337+
11338+	i += scnprintf(buf + i, BUF_SIZE - i, "nbytes_with_usb_IN_txr: %lu\n",
11339+			(ui_dev->nbytes_from_tty - ui_dev->nbytes_to_host));
11340+
11341+	if (tty)
11342+		i += scnprintf(buf + i, BUF_SIZE - i,
11343+			"tty_flags: %lu\n", tty->flags);
11344+
11345+	if (gser->get_dtr) {
11346+		result |= (gser->get_dtr(gser) ? TIOCM_DTR : 0);
11347+		i += scnprintf(buf + i, BUF_SIZE - i,
11348+			"DTR_status: %d\n", result);
11349+	}
11350+
11351+	spin_unlock_irqrestore(&ui_dev->port_lock, flags);
11352+
11353+	ret = simple_read_from_buffer(ubuf, count, ppos, buf, i);
11354+
11355+	kfree(buf);
11356+
11357+	return ret;
11358+}
11359+
11360+static ssize_t debug_write_reset(struct file *file, const char __user *buf,
11361+			size_t count, loff_t *ppos)
11362+{
11363+	struct gs_port *ui_dev = file->private_data;
11364+	unsigned long flags;
11365+
11366+	spin_lock_irqsave(&ui_dev->port_lock, flags);
11367+	ui_dev->nbytes_from_host = ui_dev->nbytes_to_tty =
11368+			ui_dev->nbytes_from_tty = ui_dev->nbytes_to_host = 0;
11369+	spin_unlock_irqrestore(&ui_dev->port_lock, flags);
11370+
11371+	return count;
11372+}
11373+
11374+static int serial_debug_open(struct inode *inode, struct file *file)
11375+{
11376+	file->private_data = inode->i_private;
11377+	return 0;
11378+}
11379+
11380+const struct file_operations debug_rst_ops = {
11381+	.open = serial_debug_open,
11382+	.write = debug_write_reset,
11383+};
11384+
11385+const struct file_operations debug_adb_ops = {
11386+	.open = serial_debug_open,
11387+	.read = debug_read_status,
11388+};
11389+
11390+struct dentry *gs_dent;
11391+static void usb_debugfs_init(struct gs_port *ui_dev, int port_num)
11392+{
11393+	char buf[48];
11394+
11395+	snprintf(buf, 48, "usb_serial%d", port_num);
11396+	gs_dent = debugfs_create_dir(buf, 0);
11397+	if (!gs_dent || IS_ERR(gs_dent))
11398+		return;
11399+
11400+	debugfs_create_file("readstatus", 0444, gs_dent, ui_dev,
11401+			&debug_adb_ops);
11402+	debugfs_create_file("reset", S_IRUGO | S_IWUSR,
11403+			gs_dent, ui_dev, &debug_rst_ops);
11404+}
11405+
11406+static void usb_debugfs_remove(void)
11407+{
11408+	debugfs_remove_recursive(gs_dent);
11409+}
11410+#else
11411+static inline void usb_debugfs_init(struct gs_port *ui_dev, int port_num) {}
11412+static inline void usb_debugfs_remove(void) {}
11413+#endif
11414+
11415 static int gs_closed(struct gs_port *port)
11416 {
11417 	int cond;
11418@@ -1138,11 +1371,7 @@ static int gs_closed(struct gs_port *port)
11419 
11420 static void gserial_free_port(struct gs_port *port)
11421 {
11422-#ifndef CONFIG_USE_WORKQ_PUSH
11423-	tasklet_kill(&port->push);
11424-#else
11425-	flush_work(&port->push);
11426-#endif
11427+	cancel_work_sync(&port->push);
11428 	/* wait for old opens to finish */
11429 	wait_event(port->port.close_wait, gs_closed(port));
11430 	WARN_ON(port->port_usb != NULL);
11431@@ -1281,6 +1510,10 @@ int gserial_connect(struct gserial *gser, u8 port_num)
11432 	 */
11433 	if (port->port.count) {
11434 		pr_debug("gserial_connect: start ttyGS%d\n", port->port_num);
11435+		if (gser->flags & ASYNC_LOW_LATENCY) {
11436+			pr_debug("%s: Setting to low latency", __func__);
11437+			gser->ioport->port.tty->port->low_latency = 1;
11438+		}
11439 		gs_start_io(port);
11440 		if (gser->connect)
11441 			gser->connect(gser);
11442@@ -1318,12 +1551,6 @@ void gserial_disconnect(struct gserial *gser)
11443 	if (!port)
11444 		return;
11445 
11446-#ifdef CONFIG_BRCM_FUSE_LOG
11447-	if (port->port_num == ACM_LOGGING_PORT)
11448-		if (acm_logging_cb && acm_logging_cb->stop)
11449-			acm_logging_cb->stop();
11450-#endif
11451-
11452 	/* tell the TTY glue not to do I/O here any more */
11453 	spin_lock_irqsave(&port->port_lock, flags);
11454 
11455@@ -1357,6 +1584,9 @@ void gserial_disconnect(struct gserial *gser)
11456 	port->read_allocated = port->read_started =
11457 		port->write_allocated = port->write_started = 0;
11458 
11459+	port->nbytes_from_host = port->nbytes_to_tty =
11460+		port->nbytes_from_tty = port->nbytes_to_host = 0;
11461+
11462 	spin_unlock_irqrestore(&port->port_lock, flags);
11463 }
11464 EXPORT_SYMBOL_GPL(gserial_disconnect);
11465@@ -1376,10 +1606,10 @@ static int userial_init(void)
11466 
11467 	gs_tty_driver->type = TTY_DRIVER_TYPE_SERIAL;
11468 	gs_tty_driver->subtype = SERIAL_TYPE_NORMAL;
11469-	gs_tty_driver->flags = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
11470+	gs_tty_driver->flags = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV
11471+				| TTY_DRIVER_RESET_TERMIOS;
11472 	gs_tty_driver->init_termios = tty_std_termios;
11473 
11474-
11475 	/* 9600-8-N-1 ... matches defaults expected by "usbser.sys" on
11476 	 * MS-Windows.  Otherwise, most of these flags shouldn't affect
11477 	 * anything unless we were to actually hook up to a serial line.
11478@@ -1393,6 +1623,12 @@ static int userial_init(void)
11479 	for (i = 0; i < MAX_U_SERIAL_PORTS; i++)
11480 		mutex_init(&ports[i].lock);
11481 
11482+	gserial_wq = create_singlethread_workqueue("k_gserial");
11483+	if (!gserial_wq) {
11484+		status = -ENOMEM;
11485+		goto fail;
11486+	}
11487+
11488 	/* export the driver ... */
11489 	status = tty_register_driver(gs_tty_driver);
11490 	if (status) {
11491@@ -1401,6 +1637,9 @@ static int userial_init(void)
11492 		goto fail;
11493 	}
11494 
11495+	for (i = 0; i < MAX_U_SERIAL_PORTS; i++)
11496+		usb_debugfs_init(ports[i].port, i);
11497+
11498 	pr_debug("%s: registered %d ttyGS* device%s\n", __func__,
11499 			MAX_U_SERIAL_PORTS,
11500 			(MAX_U_SERIAL_PORTS == 1) ? "" : "s");
11501@@ -1408,6 +1647,8 @@ static int userial_init(void)
11502 	return status;
11503 fail:
11504 	put_tty_driver(gs_tty_driver);
11505+	if (gserial_wq)
11506+		destroy_workqueue(gserial_wq);
11507 	gs_tty_driver = NULL;
11508 	return status;
11509 }
11510@@ -1415,6 +1656,8 @@ module_init(userial_init);
11511 
11512 static void userial_cleanup(void)
11513 {
11514+	usb_debugfs_remove();
11515+	destroy_workqueue(gserial_wq);
11516 	tty_unregister_driver(gs_tty_driver);
11517 	put_tty_driver(gs_tty_driver);
11518 	gs_tty_driver = NULL;
11519diff --git a/drivers/usb/gadget/u_serial.h b/drivers/usb/gadget/u_serial.h
11520index 8c5dfae..c72257a 100644
11521--- a/drivers/usb/gadget/u_serial.h
11522+++ b/drivers/usb/gadget/u_serial.h
11523@@ -15,11 +15,7 @@
11524 #include <linux/usb/composite.h>
11525 #include <linux/usb/cdc.h>
11526 
11527-#ifdef CONFIG_USB_GADGET_GG
11528-#define MAX_U_SERIAL_PORTS	6
11529-#else
11530 #define MAX_U_SERIAL_PORTS	4
11531-#endif
11532 
11533 struct f_serial_opts {
11534 	struct usb_function_instance func_inst;
11535@@ -47,13 +43,26 @@ struct gserial {
11536 	struct usb_ep			*in;
11537 	struct usb_ep			*out;
11538 
11539+	unsigned long			flags;
11540+
11541 	/* REVISIT avoid this CDC-ACM support harder ... */
11542 	struct usb_cdc_line_coding port_line_coding;	/* 9600-8-N-1 etc */
11543+	u16				serial_state;
11544+
11545+	/* control signal callbacks*/
11546+	unsigned int (*get_dtr)(struct gserial *p);
11547+	unsigned int (*get_rts)(struct gserial *p);
11548 
11549 	/* notification callbacks */
11550 	void (*connect)(struct gserial *p);
11551 	void (*disconnect)(struct gserial *p);
11552 	int (*send_break)(struct gserial *p, int duration);
11553+	unsigned int (*send_carrier_detect)(struct gserial *p, unsigned int);
11554+	unsigned int (*send_ring_indicator)(struct gserial *p, unsigned int);
11555+	int (*send_modem_ctrl_bits)(struct gserial *p, int ctrl_bits);
11556+
11557+	/* notification changes to modem */
11558+	void (*notify_modem)(void *gser, u8 portno, int ctrl_bits);
11559 };
11560 
11561 /* utilities to allocate/free request and buffer */
11562@@ -68,21 +77,19 @@ void gserial_free_line(unsigned char port_line);
11563 int gserial_connect(struct gserial *, u8 port_num);
11564 void gserial_disconnect(struct gserial *);
11565 
11566+/* sdio related functions */
11567+int gsdio_setup(struct usb_gadget *g, unsigned n_ports);
11568+int gsdio_connect(struct gserial *, u8 port_num);
11569+void gsdio_disconnect(struct gserial *, u8 portno);
11570+
11571+int gsmd_setup(struct usb_gadget *g, unsigned n_ports);
11572+int gsmd_connect(struct gserial *, u8 port_num);
11573+void gsmd_disconnect(struct gserial *, u8 portno);
11574+int gsmd_write(u8 portno, char *buf, unsigned int size);
11575+
11576+
11577 /* functions are bound to configurations by a config or gadget driver */
11578 int gser_bind_config(struct usb_configuration *c, u8 port_num);
11579 int obex_bind_config(struct usb_configuration *c, u8 port_num);
11580 
11581-/* ACM devices */
11582-#ifdef CONFIG_BRCM_FUSE_LOG
11583-#define ACM_LOGGING_PORT	1
11584-
11585-//static struct acm_logging_callbacks *acm_logging_cb;
11586-extern struct acm_logging_callbacks *get_acm_callback_func(void);
11587-struct acm_logging_callbacks {
11588-	/** Start function for role change */
11589-	int (*start) (void);
11590-	/** Stop Function for role change */
11591-	int (*stop) (void);
11592-};
11593-#endif
11594 #endif /* __U_SERIAL_H */
11595diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c
11596index afe9b9e..14f0266 100644
11597--- a/drivers/usb/gadget/udc-core.c
11598+++ b/drivers/usb/gadget/udc-core.c
11599@@ -23,9 +23,11 @@
11600 #include <linux/list.h>
11601 #include <linux/err.h>
11602 #include <linux/dma-mapping.h>
11603+#include <linux/workqueue.h>
11604 
11605 #include <linux/usb/ch9.h>
11606 #include <linux/usb/gadget.h>
11607+#include <linux/usb/composite.h>
11608 
11609 /**
11610  * struct usb_udc - describes one usb device controller
11611@@ -67,7 +69,7 @@ int usb_gadget_map_request(struct usb_gadget *gadget,
11612 		}
11613 
11614 		req->num_mapped_sgs = mapped;
11615-	} else {
11616+	} else if (!req->dma_pre_mapped) {
11617 		req->dma = dma_map_single(&gadget->dev, req->buf, req->length,
11618 				is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
11619 
11620@@ -92,20 +94,34 @@ void usb_gadget_unmap_request(struct usb_gadget *gadget,
11621 				is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
11622 
11623 		req->num_mapped_sgs = 0;
11624-	} else {
11625+	} else if (!req->dma_pre_mapped && req->dma != DMA_ERROR_CODE) {
11626+		/*
11627+		 * If the DMA address has not been mapped by a higher layer,
11628+		 * then unmap it here. Otherwise, the DMA address will be
11629+		 * unmapped by the upper layer (where the request was queued).
11630+		 */
11631 		dma_unmap_single(&gadget->dev, req->dma, req->length,
11632-				is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
11633+			is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
11634+
11635+		req->dma = DMA_ERROR_CODE;
11636 	}
11637 }
11638 EXPORT_SYMBOL_GPL(usb_gadget_unmap_request);
11639 
11640 /* ------------------------------------------------------------------------- */
11641 
11642+static void usb_gadget_state_work(struct work_struct *work)
11643+{
11644+	struct usb_gadget	*gadget = work_to_gadget(work);
11645+
11646+	sysfs_notify(&gadget->dev.kobj, NULL, "status");
11647+}
11648+
11649 void usb_gadget_set_state(struct usb_gadget *gadget,
11650 		enum usb_device_state state)
11651 {
11652 	gadget->state = state;
11653-	sysfs_notify(&gadget->dev.kobj, NULL, "state");
11654+	schedule_work(&gadget->work);
11655 }
11656 EXPORT_SYMBOL_GPL(usb_gadget_set_state);
11657 
11658@@ -192,6 +208,7 @@ int usb_add_gadget_udc_release(struct device *parent, struct usb_gadget *gadget,
11659 		goto err1;
11660 
11661 	dev_set_name(&gadget->dev, "gadget");
11662+	INIT_WORK(&gadget->work, usb_gadget_state_work);
11663 	gadget->dev.parent = parent;
11664 
11665 	dma_set_coherent_mask(&gadget->dev, parent->coherent_dma_mask);
11666@@ -309,6 +326,7 @@ found:
11667 		usb_gadget_remove_driver(udc);
11668 
11669 	kobject_uevent(&udc->dev.kobj, KOBJ_REMOVE);
11670+	flush_work(&gadget->work);
11671 	device_unregister(&udc->dev);
11672 	device_unregister(&gadget->dev);
11673 }
11674@@ -335,15 +353,6 @@ static int udc_bind_to_driver(struct usb_udc *udc, struct usb_gadget_driver *dri
11675 		driver->unbind(udc->gadget);
11676 		goto err1;
11677 	}
11678-	/*
11679-	 * HACK: The Android gadget driver disconnects the gadget
11680-	 * on bind and expects the gadget to stay disconnected until
11681-	 * it calls usb_gadget_connect when userspace is ready. Remove
11682-	 * the call to usb_gadget_connect bellow to avoid enabling the
11683-	 * pullup before userspace is ready.
11684-	 *
11685-	 * usb_gadget_connect(udc->gadget);
11686-	 */
11687 
11688 	kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);
11689 	return 0;
11690@@ -392,8 +401,9 @@ int usb_gadget_probe_driver(struct usb_gadget_driver *driver)
11691 
11692 	mutex_lock(&udc_lock);
11693 	list_for_each_entry(udc, &udc_list, list) {
11694-		/* For now we take the first one */
11695-		if (!udc->driver)
11696+		/* Match according to usb_core_id */
11697+		if (!udc->driver && udc->gadget &&
11698+		    udc->gadget->usb_core_id == driver->usb_core_id)
11699 			goto found;
11700 	}
11701 
11702@@ -428,6 +438,37 @@ int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
11703 }
11704 EXPORT_SYMBOL_GPL(usb_gadget_unregister_driver);
11705 
11706+int usb_func_ep_queue(struct usb_function *func, struct usb_ep *ep,
11707+			       struct usb_request *req, gfp_t gfp_flags)
11708+{
11709+	int ret;
11710+	struct usb_gadget *gadget;
11711+
11712+	if (!func || !ep || !req) {
11713+		pr_err("Invalid argument. func=%p, ep=%p, req=%p\n",
11714+			func, ep, req);
11715+		return -EINVAL;
11716+	}
11717+
11718+	pr_debug("Function %s queueing new data into ep %u\n",
11719+		func->name ? func->name : "", ep->address);
11720+
11721+	gadget = func->config->cdev->gadget;
11722+	if ((gadget->speed == USB_SPEED_SUPER) && func->func_is_suspended) {
11723+		ret = usb_func_wakeup(func);
11724+		if (ret) {
11725+			pr_err("Failed to send function wake up notification. func name:%s, ep:%u\n",
11726+				func->name ? func->name : "",
11727+				ep->address);
11728+			return ret;
11729+		}
11730+	}
11731+
11732+	ret = usb_ep_queue(ep, req, gfp_flags);
11733+	return ret;
11734+}
11735+
11736+
11737 /* ------------------------------------------------------------------------- */
11738 
11739 static ssize_t usb_udc_srp_store(struct device *dev,
11740diff --git a/include/linux/usb/gadget.h b/include/linux/usb/gadget.h
11741index 05c6118..745bf1b 100644
11742--- a/include/linux/usb/gadget.h
11743+++ b/include/linux/usb/gadget.h
11744@@ -22,6 +22,7 @@
11745 #include <linux/slab.h>
11746 #include <linux/scatterlist.h>
11747 #include <linux/types.h>
11748+#include <linux/workqueue.h>
11749 #include <linux/usb/ch9.h>
11750 
11751 struct usb_ep;
11752@@ -45,6 +46,11 @@ struct usb_ep;
11753  *     by adding a zero length packet as needed;
11754  * @short_not_ok: When reading data, makes short packets be
11755  *     treated as errors (queue stops advancing till cleanup).
11756+ * @dma_pre_mapped: Tells the USB core driver whether this request should be
11757+ *	DMA-mapped before it is queued to the USB HW. When set to true, it means
11758+ *	that the request has already been mapped in advance and therefore the
11759+ *	USB core driver does NOT need to do DMA-mapping when the request is
11760+ *	queued to the USB HW.
11761  * @complete: Function called when request completes, so this request and
11762  *	its buffer may be re-used.  The function will always be called with
11763  *	interrupts disabled, and it must not sleep.
11764@@ -68,6 +74,7 @@ struct usb_ep;
11765  *	Note that for writes (IN transfers) some data bytes may still
11766  *	reside in a device-side FIFO when the request is reported as
11767  *	complete.
11768+ *@udc_priv: Vendor private data in usage by the UDC.
11769  *
11770  * These are allocated/freed through the endpoint they're used with.  The
11771  * hardware's driver can add extra per-request data to the memory it returns,
11772@@ -100,6 +107,7 @@ struct usb_request {
11773 	unsigned		no_interrupt:1;
11774 	unsigned		zero:1;
11775 	unsigned		short_not_ok:1;
11776+	unsigned		dma_pre_mapped:1;
11777 
11778 	void			(*complete)(struct usb_ep *ep,
11779 					struct usb_request *req);
11780@@ -108,6 +116,7 @@ struct usb_request {
11781 
11782 	int			status;
11783 	unsigned		actual;
11784+	unsigned		udc_priv;
11785 };
11786 
11787 /*-------------------------------------------------------------------------*/
11788@@ -127,7 +136,6 @@ struct usb_ep_ops {
11789 	struct usb_request *(*alloc_request) (struct usb_ep *ep,
11790 		gfp_t gfp_flags);
11791 	void (*free_request) (struct usb_ep *ep, struct usb_request *req);
11792-
11793 	int (*queue) (struct usb_ep *ep, struct usb_request *req,
11794 		gfp_t gfp_flags);
11795 	int (*dequeue) (struct usb_ep *ep, struct usb_request *req);
11796@@ -158,6 +166,8 @@ struct usb_ep_ops {
11797  *	enabled and remains valid until the endpoint is disabled.
11798  * @comp_desc: In case of SuperSpeed support, this is the endpoint companion
11799  *	descriptor that is used to configure the endpoint
11800+ * @endless: In case where endless transfer is being initiated, this is set
11801+ *	to disable usb event interrupt for few events.
11802  *
11803  * the bus controller driver lists all the general purpose endpoints in
11804  * gadget->ep_list.  the control endpoint (gadget->ep0) is not in that list,
11805@@ -176,6 +186,7 @@ struct usb_ep {
11806 	u8			address;
11807 	const struct usb_endpoint_descriptor	*desc;
11808 	const struct usb_ss_ep_comp_descriptor	*comp_desc;
11809+	bool			endless;
11810 };
11811 
11812 /*-------------------------------------------------------------------------*/
11813@@ -460,6 +471,7 @@ struct usb_gadget_driver;
11814 struct usb_gadget_ops {
11815 	int	(*get_frame)(struct usb_gadget *);
11816 	int	(*wakeup)(struct usb_gadget *);
11817+	int	(*func_wakeup)(struct usb_gadget *, int interface_id);
11818 	int	(*set_selfpowered) (struct usb_gadget *, int is_selfpowered);
11819 	int	(*vbus_session) (struct usb_gadget *, int is_active);
11820 	int	(*vbus_draw) (struct usb_gadget *, unsigned mA);
11821@@ -471,18 +483,11 @@ struct usb_gadget_ops {
11822 			struct usb_gadget_driver *);
11823 	int	(*udc_stop)(struct usb_gadget *,
11824 			struct usb_gadget_driver *);
11825-
11826-	/* Those two are deprecated */
11827-	int	(*start)(struct usb_gadget_driver *,
11828-			int (*bind)(struct usb_gadget *));
11829-	int	(*stop)(struct usb_gadget_driver *);
11830-#ifdef CONFIG_USB_PCD_SETTINGS
11831-	int	(*pcd_start_clean) (struct usb_gadget *, int is_start);
11832-#endif
11833 };
11834 
11835 /**
11836  * struct usb_gadget - represents a usb slave device
11837+ * @work: (internal use) Workqueue to be used for sysfs_notify()
11838  * @ops: Function pointers used to access hardware-specific operations.
11839  * @ep0: Endpoint zero, used when reading or writing responses to
11840  *	driver setup() requests
11841@@ -503,11 +508,18 @@ struct usb_gadget_ops {
11842  *	only supports HNP on a different root port.
11843  * @b_hnp_enable: OTG device feature flag, indicating that the A-Host
11844  *	enabled HNP support.
11845+ * @host_request: A flag set by user when wishes to take up host role.
11846+ * @otg_srp_reqd: OTG test mode feature to initiate SRP after the end of
11847+ * current session.
11848  * @name: Identifies the controller hardware type.  Used in diagnostics
11849  *	and sometimes configuration.
11850  * @dev: Driver model state for this abstract device.
11851  * @out_epnum: last used out ep number
11852  * @in_epnum: last used in ep number
11853+ * @usb_core_id: Identifies the usb core controlled by this usb_gadget.
11854+ *		 Used in case of more then one core operates concurrently.
11855+ * @streaming_enabled: Enable streaming mode with usb core.
11856+ * @xfer_isr_count: UI (transfer complete) interrupts count
11857  *
11858  * Gadgets have a mostly-portable "gadget driver" implementing device
11859  * functions, handling all usb configurations and interfaces.  Gadget
11860@@ -528,6 +540,7 @@ struct usb_gadget_ops {
11861  * device is acting as a B-Peripheral (so is_a_peripheral is false).
11862  */
11863 struct usb_gadget {
11864+	struct work_struct		work;
11865 	/* readonly to gadget driver */
11866 	const struct usb_gadget_ops	*ops;
11867 	struct usb_ep			*ep0;
11868@@ -541,11 +554,20 @@ struct usb_gadget {
11869 	unsigned			b_hnp_enable:1;
11870 	unsigned			a_hnp_support:1;
11871 	unsigned			a_alt_hnp_support:1;
11872+	unsigned			host_request:1;
11873+	unsigned			otg_srp_reqd:1;
11874 	const char			*name;
11875 	struct device			dev;
11876 	unsigned			out_epnum;
11877 	unsigned			in_epnum;
11878+	bool				l1_supported;
11879+	u8				usb_core_id;
11880+	bool				streaming_enabled;
11881+	bool				remote_wakeup;
11882+	void				*private;
11883+	u32				xfer_isr_count;
11884 };
11885+#define work_to_gadget(w)	(container_of((w), struct usb_gadget, work))
11886 
11887 static inline void set_gadget_data(struct usb_gadget *gadget, void *data)
11888 	{ dev_set_drvdata(&gadget->dev, data); }
11889@@ -628,6 +650,26 @@ static inline int usb_gadget_wakeup(struct usb_gadget *gadget)
11890 }
11891 
11892 /**
11893+ * usb_gadget_func_wakeup - send a function remote wakeup up notification
11894+ * to the host connected to this gadget
11895+ * @gadget: controller used to wake up the host
11896+ * @interface_id: the interface which triggered the remote wakeup event
11897+ *
11898+ * Returns zero on success. Otherwise, negative error code is returned.
11899+ */
11900+static inline int usb_gadget_func_wakeup(struct usb_gadget *gadget,
11901+	int interface_id)
11902+{
11903+	if (gadget->speed != USB_SPEED_SUPER)
11904+		return -EOPNOTSUPP;
11905+
11906+	if (!gadget->ops->func_wakeup)
11907+		return -EOPNOTSUPP;
11908+
11909+	return gadget->ops->func_wakeup(gadget, interface_id);
11910+}
11911+
11912+/**
11913  * usb_gadget_set_selfpowered - sets the device selfpowered feature.
11914  * @gadget:the device being declared as self-powered
11915  *
11916@@ -757,31 +799,6 @@ static inline int usb_gadget_disconnect(struct usb_gadget *gadget)
11917 	return gadget->ops->pullup(gadget, 0);
11918 }
11919 
11920-#ifdef CONFIG_USB_PCD_SETTINGS
11921-/**
11922- * usb_pcd_enable - enable pcd and initialize endps
11923- *
11924- * Returns zero on success, else negative errno.
11925- */
11926-static inline int usb_pcd_enable(struct usb_gadget *gadget)
11927-{
11928-	if (!gadget->ops->pcd_start_clean)
11929-		return -EOPNOTSUPP;
11930-	return gadget->ops->pcd_start_clean(gadget, 1);
11931-}
11932-
11933-/**
11934- * usb_pcd_disable - disable pcd and clean up endps
11935- *
11936- * Returns zero on success, else negative errno.
11937- */
11938-static inline int usb_pcd_disable(struct usb_gadget *gadget)
11939-{
11940-	if (!gadget->ops->pcd_start_clean)
11941-		return -EOPNOTSUPP;
11942-	return gadget->ops->pcd_start_clean(gadget, 0);
11943-}
11944-#endif
11945 
11946 /*-------------------------------------------------------------------------*/
11947 
11948@@ -806,6 +823,8 @@ static inline int usb_pcd_disable(struct usb_gadget *gadget)
11949  * @suspend: Invoked on USB suspend.  May be called in_interrupt.
11950  * @resume: Invoked on USB resume.  May be called in_interrupt.
11951  * @driver: Driver model state for this driver.
11952+ * @usb_core_id: Identifies the usb core controlled by this usb_gadget_driver.
11953+ *               Used in case of more then one core operates concurrently.
11954  *
11955  * Devices are disabled till a gadget driver successfully bind()s, which
11956  * means the driver will handle setup() requests needed to enumerate (and
11957@@ -865,6 +884,8 @@ struct usb_gadget_driver {
11958 
11959 	/* FIXME support safe rmmod */
11960 	struct device_driver	driver;
11961+
11962+	u8			usb_core_id;
11963 };
11964 
11965 
11966@@ -955,6 +976,11 @@ int usb_gadget_get_string(struct usb_gadget_strings *table, int id, u8 *buf);
11967 
11968 /* utility to simplify managing config descriptors */
11969 
11970+/* Find and fill the requested descriptor into buffer */
11971+int
11972+usb_find_descriptor_fillbuf(void *, unsigned,
11973+		const struct usb_descriptor_header **, u8);
11974+
11975 /* write vector of descriptors into buffer */
11976 int usb_descriptor_fillbuf(void *, unsigned,
11977 		const struct usb_descriptor_header **);
11978@@ -985,6 +1011,24 @@ void usb_free_all_descriptors(struct usb_function *f);
11979 
11980 /*-------------------------------------------------------------------------*/
11981 
11982+/**
11983+ * usb_func_ep_queue - queues (submits) an I/O request to a function endpoint.
11984+ * This function is similar to the usb_ep_queue function, but in addition it
11985+ * also checks whether the function is in Super Speed USB Function Suspend
11986+ * state, and if so a Function Wake notification is sent to the host
11987+ * (USB 3.0 spec, section 9.2.5.2).
11988+ * @func: the function which issues the USB I/O request.
11989+ * @ep:the endpoint associated with the request
11990+ * @req:the request being submitted
11991+ * @gfp_flags: GFP_* flags to use in case the lower level driver couldn't
11992+ *	pre-allocate all necessary memory with the request.
11993+ *
11994+ */
11995+int usb_func_ep_queue(struct usb_function *func, struct usb_ep *ep,
11996+				struct usb_request *req, gfp_t gfp_flags);
11997+
11998+/*-------------------------------------------------------------------------*/
11999+
12000 /* utility to simplify map/unmap of usb_requests to/from DMA */
12001 
12002 extern int usb_gadget_map_request(struct usb_gadget *gadget,