1 files changed, 238 insertions, 241 deletions

diff --git a/drivers/net/usb/rmnet_usb_ctrl.c b/drivers/net/usb/rmnet_usb_ctrl.c
index 21325a24fc1..946031dadd1 100644
--- a/drivers/net/usb/rmnet_usb_ctrl.c
+++ b/drivers/net/usb/rmnet_usb_ctrl.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2011-2013, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2011-2014, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -38,10 +38,6 @@ module_param_array(rmnet_dev_names, charp, NULL, S_IRUGO | S_IWUSR);
 #define ACM_CTRL_RI		BIT(2)
 #define ACM_CTRL_CD		BIT(3)
 
-/* polling interval for Interrupt ep */
-#define HS_INTERVAL		7
-#define FS_LS_INTERVAL		3
-
 /*echo modem_wait > /sys/class/hsicctl/hsicctlx/modem_wait*/
 static ssize_t modem_wait_store(struct device *d, struct device_attribute *attr,
 		const char *buf, size_t n)
@@ -172,8 +168,8 @@ static void rmnet_usb_ctrl_mux(unsigned int id, struct ctrl_pkt *cpkt)
 static void get_encap_work(struct work_struct *w)
 {
 	struct usb_device	*udev;
-	struct rmnet_ctrl_dev	*dev =
-			container_of(w, struct rmnet_ctrl_dev, get_encap_work);
+	struct rmnet_ctrl_udev	*dev =
+			container_of(w, struct rmnet_ctrl_udev, get_encap_work);
 	int			status;
 
 	if (!test_bit(RMNET_CTRL_DEV_READY, &dev->status))
@@ -202,8 +198,7 @@ static void get_encap_work(struct work_struct *w)
 		usb_unanchor_urb(dev->rcvurb);
 		usb_autopm_put_interface(dev->intf);
 		if (status != -ENODEV)
-			dev_err(dev->devicep,
-			"%s: Error submitting Read URB %d\n",
+			pr_err("%s: Error submitting Read URB %d\n",
 			__func__, status);
 		goto resubmit_int_urb;
 	}
@@ -218,8 +213,7 @@ resubmit_int_urb:
 		if (status) {
 			usb_unanchor_urb(dev->inturb);
 			if (status != -ENODEV)
-				dev_err(dev->devicep,
-				"%s: Error re-submitting Int URB %d\n",
+				pr_err("%s: Error re-submitting Int URB %d\n",
 				__func__, status);
 		}
 	}
@@ -230,7 +224,12 @@ static void notification_available_cb(struct urb *urb)
 	int				status;
 	struct usb_cdc_notification	*ctrl;
 	struct usb_device		*udev;
-	struct rmnet_ctrl_dev		*dev = urb->context;
+	struct rmnet_ctrl_udev		*dev = urb->context;
+	struct rmnet_ctrl_dev		*cdev;
+
+	/*usb device disconnect*/
+	if (urb->dev->state == USB_STATE_NOTATTACHED)
+		return;
 
 	udev = interface_to_usbdev(dev->intf);
 
@@ -268,13 +267,14 @@ static void notification_available_cb(struct urb *urb)
 	switch (ctrl->bNotificationType) {
 	case USB_CDC_NOTIFY_RESPONSE_AVAILABLE:
 		dev->resp_avail_cnt++;
-
 		/* If MUX is not enabled, wakeup up the open process
 		 * upon first notify response available.
 		 */
 		if (!test_bit(RMNET_CTRL_DEV_READY, &dev->status)) {
 			set_bit(RMNET_CTRL_DEV_READY, &dev->status);
-			wake_up(&dev->open_wait_queue);
+
+			cdev = &ctrl_devs[dev->rdev_num][dev->ctrldev_id];
+			wake_up(&cdev->open_wait_queue);
 		}
 
 		usb_mark_last_busy(udev);
@@ -282,7 +282,7 @@ static void notification_available_cb(struct urb *urb)
 
 		return;
 	default:
-		 dev_err(dev->devicep,
+		 dev_err(&dev->intf->dev,
 			"%s:Command not implemented\n", __func__);
 	}
 
@@ -292,8 +292,7 @@ resubmit_int_urb:
 	if (status) {
 		usb_unanchor_urb(urb);
 		if (status != -ENODEV)
-			dev_err(dev->devicep,
-			"%s: Error re-submitting Int URB %d\n",
+			pr_err("%s: Error re-submitting Int URB %d\n",
 			__func__, status);
 	}
 
@@ -304,11 +303,17 @@ static void resp_avail_cb(struct urb *urb)
 {
 	struct usb_device		*udev;
 	struct ctrl_pkt_list_elem	*list_elem = NULL;
-	struct rmnet_ctrl_dev		*rx_dev, *dev = urb->context;
+	struct rmnet_ctrl_udev		*dev = urb->context;
+	struct rmnet_ctrl_dev		*rx_dev;
 	void				*cpkt;
-	int				ch_id, status = 0;
+	int					status = 0;
+	int					ch_id = -EINVAL;
 	size_t				cpkt_size = 0;
 
+	/*usb device disconnect*/
+	if (urb->dev->state == USB_STATE_NOTATTACHED)
+		return;
+
 	udev = interface_to_usbdev(dev->intf);
 
 	usb_autopm_put_interface_async(dev->intf);
@@ -334,26 +339,24 @@ static void resp_avail_cb(struct urb *urb)
 		goto resubmit_int_urb;
 	}
 
-	dev_dbg(dev->devicep, "Read %d bytes for %s\n",
-		urb->actual_length, dev->name);
-
 	cpkt = urb->transfer_buffer;
 	cpkt_size = urb->actual_length;
 	if (!cpkt_size) {
 		dev->zlp_cnt++;
-		dev_dbg(dev->devicep, "%s: zero length pkt received\n",
+		dev_dbg(&dev->intf->dev, "%s: zero length pkt received\n",
 				__func__);
 		goto resubmit_int_urb;
 	}
 
 	list_elem = kmalloc(sizeof(struct ctrl_pkt_list_elem), GFP_ATOMIC);
 	if (!list_elem) {
-		dev_err(dev->devicep, "%s: list_elem alloc failed\n", __func__);
+		dev_err(&dev->intf->dev, "%s: list_elem alloc failed\n",
+				__func__);
 		return;
 	}
 	list_elem->cpkt.data = kmalloc(cpkt_size, GFP_ATOMIC);
 	if (!list_elem->cpkt.data) {
-		dev_err(dev->devicep, "%s: list_elem->data alloc failed\n",
+		dev_err(&dev->intf->dev, "%s: list_elem->data alloc failed\n",
 			__func__);
 		kfree(list_elem);
 		return;
@@ -361,20 +364,23 @@ static void resp_avail_cb(struct urb *urb)
 	memcpy(list_elem->cpkt.data, cpkt, cpkt_size);
 	list_elem->cpkt.data_size = cpkt_size;
 
-	rx_dev = dev;
+	ch_id = dev->ctrldev_id;
 
 	if (test_bit(RMNET_CTRL_DEV_MUX_EN, &dev->status)) {
 		ch_id = rmnet_usb_ctrl_dmux(list_elem);
 		if (ch_id < 0) {
+			dev->invalid_mux_id_cnt++;
 			kfree(list_elem->cpkt.data);
 			kfree(list_elem);
 			goto resubmit_int_urb;
 		}
-
-		rx_dev = &ctrl_devs[dev->id][ch_id];
 	}
 
-	rx_dev->get_encap_resp_cnt++;
+	rx_dev = &ctrl_devs[dev->rdev_num][ch_id];
+
+	dev->get_encap_resp_cnt++;
+	dev_dbg(&dev->intf->dev, "Read %d bytes for %s\n",
+		urb->actual_length, rx_dev->name);
 
 	spin_lock(&rx_dev->rx_lock);
 	list_add_tail(&list_elem->list, &rx_dev->rx_list);
@@ -391,14 +397,13 @@ resubmit_int_urb:
 		if (status) {
 			usb_unanchor_urb(dev->inturb);
 			if (status != -ENODEV)
-				dev_err(dev->devicep,
-				"%s: Error re-submitting Int URB %d\n",
+				pr_err("%s: Error re-submitting Int URB %d\n",
 				__func__, status);
 		}
 	}
 }
 
-int rmnet_usb_ctrl_start_rx(struct rmnet_ctrl_dev *dev)
+int rmnet_usb_ctrl_start_rx(struct rmnet_ctrl_udev *dev)
 {
 	int	retval = 0;
 
@@ -407,14 +412,13 @@ int rmnet_usb_ctrl_start_rx(struct rmnet_ctrl_dev *dev)
 	if (retval < 0) {
 		usb_unanchor_urb(dev->inturb);
 		if (retval != -ENODEV)
-			dev_err(dev->devicep,
-			"%s Intr submit %d\n", __func__, retval);
+			pr_err("%s Intr submit %d\n", __func__, retval);
 	}
 
 	return retval;
 }
 
-static int rmnet_usb_ctrl_alloc_rx(struct rmnet_ctrl_dev *dev)
+static int rmnet_usb_ctrl_alloc_rx(struct rmnet_ctrl_udev *dev)
 {
 	dev->rcvurb = usb_alloc_urb(0, GFP_KERNEL);
 	if (!dev->rcvurb) {
@@ -444,118 +448,43 @@ nomem:
 	return -ENOMEM;
 
 }
-static int rmnet_usb_ctrl_write_cmd(struct rmnet_ctrl_dev *dev)
+static int rmnet_usb_ctrl_write_cmd(struct rmnet_ctrl_udev *dev, u8 req,
+		u16 val, void *data, u16 size)
 {
 	struct usb_device	*udev;
+	int			ret;
 
 	if (!test_bit(RMNET_CTRL_DEV_READY, &dev->status))
-		return -ENODEV;
+		return -ENETRESET;
+
+	ret = usb_autopm_get_interface(dev->intf);
+	if (ret < 0) {
+		pr_debug("%s: Unable to resume interface: %d\n",
+			__func__, ret);
+		return ret;
+	}
 
 	udev = interface_to_usbdev(dev->intf);
-	dev->set_ctrl_line_state_cnt++;
-	return usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
-		USB_CDC_REQ_SET_CONTROL_LINE_STATE,
+	ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+		req,
 		(USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE),
-		dev->cbits_tomdm,
+		val,
 		dev->intf->cur_altsetting->desc.bInterfaceNumber,
-		NULL, 0, USB_CTRL_SET_TIMEOUT);
-}
-
-static void ctrl_write_callback(struct urb *urb)
-{
-	struct ctrl_pkt		*cpkt = urb->context;
-	struct rmnet_ctrl_dev	*dev = cpkt->ctxt;
-
-	if (urb->status) {
+		data, size, USB_CTRL_SET_TIMEOUT);
+	if (ret < 0)
 		dev->tx_ctrl_err_cnt++;
-		pr_debug_ratelimited("Write status/size %d/%d\n",
-				urb->status, urb->actual_length);
-	}
-
-	kfree(urb->setup_packet);
-	kfree(urb->transfer_buffer);
-	usb_free_urb(urb);
-	kfree(cpkt);
-	usb_autopm_put_interface_async(dev->intf);
-}
-
-static int rmnet_usb_ctrl_write(struct rmnet_ctrl_dev *dev,
-		struct ctrl_pkt *cpkt, size_t size)
-{
-	int			result;
-	struct urb		*sndurb;
-	struct usb_ctrlrequest	*out_ctlreq;
-	struct usb_device	*udev;
-
-	if (!test_bit(RMNET_CTRL_DEV_READY, &dev->status))
-		return -ENETRESET;
-
-	udev = interface_to_usbdev(dev->intf);
-
-	sndurb = usb_alloc_urb(0, GFP_KERNEL);
-	if (!sndurb) {
-		dev_err(dev->devicep, "Error allocating read urb\n");
-		return -ENOMEM;
-	}
-
-	out_ctlreq = kmalloc(sizeof(*out_ctlreq), GFP_KERNEL);
-	if (!out_ctlreq) {
-		usb_free_urb(sndurb);
-		dev_err(dev->devicep, "Error allocating setup packet buffer\n");
-		return -ENOMEM;
-	}
 
-	/* CDC Send Encapsulated Request packet */
-	out_ctlreq->bRequestType = (USB_DIR_OUT | USB_TYPE_CLASS |
-			     USB_RECIP_INTERFACE);
-	out_ctlreq->bRequest = USB_CDC_SEND_ENCAPSULATED_COMMAND;
-	out_ctlreq->wValue = 0;
-	out_ctlreq->wIndex = dev->intf->cur_altsetting->desc.bInterfaceNumber;
-	out_ctlreq->wLength = cpu_to_le16(cpkt->data_size);
-
-	usb_fill_control_urb(sndurb, udev,
-			     usb_sndctrlpipe(udev, 0),
-			     (unsigned char *)out_ctlreq, (void *)cpkt->data,
-			     cpkt->data_size, ctrl_write_callback, cpkt);
-
-	result = usb_autopm_get_interface(dev->intf);
-	if (result < 0) {
-		dev_dbg(dev->devicep, "%s: Unable to resume interface: %d\n",
-			__func__, result);
-
-		/*
-		* Revisit:  if (result == -EPERM)
-		*		rmnet_usb_suspend(dev->intf, PMSG_SUSPEND);
-		*/
-
-		usb_free_urb(sndurb);
-		kfree(out_ctlreq);
-		return result;
-	}
-
-	usb_anchor_urb(sndurb, &dev->tx_submitted);
-	dev->snd_encap_cmd_cnt++;
-	result = usb_submit_urb(sndurb, GFP_KERNEL);
-	if (result < 0) {
-		if (result != -ENODEV)
-			dev_err(dev->devicep,
-			"%s: Submit URB error %d\n",
-			__func__, result);
-		dev->snd_encap_cmd_cnt--;
-		usb_autopm_put_interface(dev->intf);
-		usb_unanchor_urb(sndurb);
-		usb_free_urb(sndurb);
-		kfree(out_ctlreq);
-		return result;
-	}
+	usb_autopm_put_interface(dev->intf);
 
-	return size;
+	return ret;
 }
 
 static int rmnet_ctl_open(struct inode *inode, struct file *file)
 {
-	int			retval = 0;
-	struct rmnet_ctrl_dev	*dev =
+	struct ctrl_pkt_list_elem	*list_elem = NULL;
+	unsigned long			flag;
+	int				retval = 0;
+	struct rmnet_ctrl_dev		*dev =
 		container_of(inode->i_cdev, struct rmnet_ctrl_dev, cdev);
 
 	if (!dev)
@@ -565,10 +494,11 @@ static int rmnet_ctl_open(struct inode *inode, struct file *file)
 		goto already_opened;
 
 	if (dev->mdm_wait_timeout &&
-			!test_bit(RMNET_CTRL_DEV_READY, &dev->status)) {
+			!test_bit(RMNET_CTRL_DEV_READY, &dev->cudev->status)) {
 		retval = wait_event_interruptible_timeout(
 				dev->open_wait_queue,
-				test_bit(RMNET_CTRL_DEV_READY, &dev->status),
+				test_bit(RMNET_CTRL_DEV_READY,
+					&dev->cudev->status),
 				msecs_to_jiffies(dev->mdm_wait_timeout * 1000));
 		if (retval == 0) {
 			dev_err(dev->devicep, "%s: Timeout opening %s\n",
@@ -581,12 +511,25 @@ static int rmnet_ctl_open(struct inode *inode, struct file *file)
 		}
 	}
 
-	if (!test_bit(RMNET_CTRL_DEV_READY, &dev->status)) {
+	if (!test_bit(RMNET_CTRL_DEV_READY, &dev->cudev->status)) {
 		dev_dbg(dev->devicep, "%s: Connection timedout opening %s\n",
 					__func__, dev->name);
 		return -ETIMEDOUT;
 	}
 
+	/* clear stale data if device close called but channel was ready */
+	spin_lock_irqsave(&dev->rx_lock, flag);
+	while (!list_empty(&dev->rx_list)) {
+		list_elem = list_first_entry(
+				&dev->rx_list,
+				struct ctrl_pkt_list_elem,
+				list);
+		list_del(&list_elem->list);
+		kfree(list_elem->cpkt.data);
+		kfree(list_elem);
+	}
+	spin_unlock_irqrestore(&dev->rx_lock, flag);
+
 	set_bit(RMNET_CTRL_DEV_OPEN, &dev->status);
 
 	file->private_data = dev;
@@ -602,7 +545,6 @@ static int rmnet_ctl_release(struct inode *inode, struct file *file)
 	struct ctrl_pkt_list_elem	*list_elem = NULL;
 	struct rmnet_ctrl_dev		*dev;
 	unsigned long			flag;
-	int				time;
 
 	dev = file->private_data;
 	if (!dev)
@@ -624,11 +566,6 @@ static int rmnet_ctl_release(struct inode *inode, struct file *file)
 
 	clear_bit(RMNET_CTRL_DEV_OPEN, &dev->status);
 
-	time = usb_wait_anchor_empty_timeout(&dev->tx_submitted,
-			UNLINK_TIMEOUT_MS);
-	if (!time)
-		usb_kill_anchored_urbs(&dev->tx_submitted);
-
 	file->private_data = NULL;
 
 	return 0;
@@ -644,7 +581,7 @@ static unsigned int rmnet_ctl_poll(struct file *file, poll_table *wait)
 		return POLLERR;
 
 	poll_wait(file, &dev->read_wait_queue, wait);
-	if (!test_bit(RMNET_CTRL_DEV_READY, &dev->status)) {
+	if (!test_bit(RMNET_CTRL_DEV_READY, &dev->cudev->status)) {
 		dev_dbg(dev->devicep, "%s: Device not connected\n",
 			__func__);
 		return POLLERR;
@@ -673,7 +610,7 @@ static ssize_t rmnet_ctl_read(struct file *file, char __user *buf, size_t count,
 	DBG("%s: Read from %s\n", __func__, dev->name);
 
 ctrl_read:
-	if (!test_bit(RMNET_CTRL_DEV_READY, &dev->status)) {
+	if (!test_bit(RMNET_CTRL_DEV_READY, &dev->cudev->status)) {
 		dev_dbg(dev->devicep, "%s: Device not connected\n",
 			__func__);
 		return -ENETRESET;
@@ -684,7 +621,8 @@ ctrl_read:
 
 		retval = wait_event_interruptible(dev->read_wait_queue,
 				!list_empty(&dev->rx_list) ||
-				!test_bit(RMNET_CTRL_DEV_READY, &dev->status));
+				!test_bit(RMNET_CTRL_DEV_READY,
+					&dev->cudev->status));
 		if (retval < 0)
 			return retval;
 
@@ -740,7 +678,7 @@ static ssize_t rmnet_ctl_write(struct file *file, const char __user * buf,
 	if (size <= 0)
 		return -EINVAL;
 
-	if (!test_bit(RMNET_CTRL_DEV_READY, &dev->status))
+	if (!test_bit(RMNET_CTRL_DEV_READY, &dev->cudev->status))
 		return -ENETRESET;
 
 	DBG("%s: Writing %i bytes on %s\n", __func__, size, dev->name);
@@ -779,9 +717,14 @@ static ssize_t rmnet_ctl_write(struct file *file, const char __user * buf,
 	}
 	DUMP_BUFFER("Write: ", size, buf);
 
-	status = rmnet_usb_ctrl_write(dev, cpkt, size);
-	if (status == size)
-		return size;
+	status = rmnet_usb_ctrl_write_cmd(dev->cudev,
+			USB_CDC_SEND_ENCAPSULATED_COMMAND, 0, cpkt->data,
+			cpkt->data_size);
+	if (status > 0)
+		dev->cudev->snd_encap_cmd_cnt++;
+
+	kfree(cpkt->data);
+	kfree(cpkt);
 
 	return status;
 }
@@ -810,16 +753,11 @@ static int rmnet_ctrl_tiocmset(struct rmnet_ctrl_dev *dev, unsigned int set,
 
 	mutex_unlock(&dev->dev_lock);
 
-	retval = usb_autopm_get_interface(dev->intf);
-	if (retval < 0) {
-		dev_dbg(dev->devicep, "%s: Unable to resume interface: %d\n",
-			__func__, retval);
-		return retval;
-	}
-
-	retval = rmnet_usb_ctrl_write_cmd(dev);
+	retval = rmnet_usb_ctrl_write_cmd(dev->cudev,
+			USB_CDC_REQ_SET_CONTROL_LINE_STATE, 0, NULL, 0);
+	if (!retval)
+		dev->cudev->set_ctrl_line_state_cnt++;
 
-	usb_autopm_put_interface(dev->intf);
 	return retval;
 }
 
@@ -884,6 +822,7 @@ int rmnet_usb_ctrl_probe(struct usb_interface *intf,
 			 unsigned long rmnet_devnum,
 			 unsigned long *data)
 {
+	struct rmnet_ctrl_udev		*cudev;
 	struct rmnet_ctrl_dev		*dev = NULL;
 	u16				wMaxPacketSize;
 	struct usb_endpoint_descriptor	*ep;
@@ -904,91 +843,99 @@ int rmnet_usb_ctrl_probe(struct usb_interface *intf,
 		return -ENODEV;
 	}
 
-	dev->int_pipe = usb_rcvintpipe(udev,
-		int_in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
-
-	dev->intf = intf;
+	cudev = dev->cudev;
 
-	dev->id = rmnet_devnum;
+	cudev->int_pipe = usb_rcvintpipe(udev,
+		int_in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
 
-	dev->snd_encap_cmd_cnt = 0;
-	dev->get_encap_resp_cnt = 0;
-	dev->resp_avail_cnt = 0;
-	dev->tx_ctrl_err_cnt = 0;
-	dev->set_ctrl_line_state_cnt = 0;
+	cudev->intf = intf;
 
-	dev->inturb = usb_alloc_urb(0, GFP_KERNEL);
-	if (!dev->inturb) {
-		dev_err(dev->devicep, "Error allocating int urb\n");
+	cudev->inturb = usb_alloc_urb(0, GFP_KERNEL);
+	if (!cudev->inturb) {
+		dev_err(&intf->dev, "Error allocating int urb\n");
+		kfree(cudev);
 		return -ENOMEM;
 	}
 
 	/*use max pkt size from ep desc*/
-	ep = &dev->intf->cur_altsetting->endpoint[0].desc;
+	ep = &cudev->intf->cur_altsetting->endpoint[0].desc;
 	wMaxPacketSize = le16_to_cpu(ep->wMaxPacketSize);
 
-	dev->intbuf = kmalloc(wMaxPacketSize, GFP_KERNEL);
-	if (!dev->intbuf) {
-		usb_free_urb(dev->inturb);
-		dev_err(dev->devicep, "Error allocating int buffer\n");
+	cudev->intbuf = kmalloc(wMaxPacketSize, GFP_KERNEL);
+	if (!cudev->intbuf) {
+		usb_free_urb(cudev->inturb);
+		kfree(cudev);
+		dev_err(&intf->dev, "Error allocating int buffer\n");
 		return -ENOMEM;
 	}
 
-	dev->in_ctlreq->bRequestType =
+	cudev->in_ctlreq->bRequestType =
 		(USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE);
-	dev->in_ctlreq->bRequest  = USB_CDC_GET_ENCAPSULATED_RESPONSE;
-	dev->in_ctlreq->wValue = 0;
-	dev->in_ctlreq->wIndex =
-		dev->intf->cur_altsetting->desc.bInterfaceNumber;
-	dev->in_ctlreq->wLength = cpu_to_le16(DEFAULT_READ_URB_LENGTH);
+	cudev->in_ctlreq->bRequest  = USB_CDC_GET_ENCAPSULATED_RESPONSE;
+	cudev->in_ctlreq->wValue = 0;
+	cudev->in_ctlreq->wIndex =
+		cudev->intf->cur_altsetting->desc.bInterfaceNumber;
+	cudev->in_ctlreq->wLength = cpu_to_le16(DEFAULT_READ_URB_LENGTH);
 
-	interval = max((int)int_in->desc.bInterval,
-			(udev->speed == USB_SPEED_HIGH) ? HS_INTERVAL
-							: FS_LS_INTERVAL);
+	interval = int_in->desc.bInterval;
 
-	usb_fill_int_urb(dev->inturb, udev,
-			 dev->int_pipe,
-			 dev->intbuf, wMaxPacketSize,
-			 notification_available_cb, dev, interval);
+	usb_fill_int_urb(cudev->inturb, udev,
+			 cudev->int_pipe,
+			 cudev->intbuf, wMaxPacketSize,
+			 notification_available_cb, cudev, interval);
 
 	usb_mark_last_busy(udev);
-	ret = rmnet_usb_ctrl_start_rx(dev);
+	ret = rmnet_usb_ctrl_start_rx(cudev);
 	if (ret) {
-		usb_free_urb(dev->inturb);
-		kfree(dev->intbuf);
+		usb_free_urb(cudev->inturb);
+		kfree(cudev->intbuf);
+		kfree(cudev);
 		return ret;
 	}
 
-	dev->claimed = true;
-
-	/*mux info is passed to data parameter*/
-	if (*data)
-		set_bit(RMNET_CTRL_DEV_MUX_EN, &dev->status);
+	*data = (unsigned long)cudev;
 
-	*data = (unsigned long)dev;
 
 	/* If MUX is enabled, wakeup the open process here */
-	if (test_bit(RMNET_CTRL_DEV_MUX_EN, &dev->status)) {
-		set_bit(RMNET_CTRL_DEV_READY, &dev->status);
-		wake_up(&dev->open_wait_queue);
+	if (test_bit(RMNET_CTRL_DEV_MUX_EN, &cudev->status)) {
+		set_bit(RMNET_CTRL_DEV_READY, &cudev->status);
+		for (n = 0; n < insts_per_dev; n++) {
+			dev = &ctrl_devs[rmnet_devnum][n];
+			wake_up(&dev->open_wait_queue);
+		}
+	} else {
+		cudev->ctrldev_id = n;
+		dev->claimed = true;
 	}
 
 	return 0;
 }
 
-void rmnet_usb_ctrl_disconnect(struct rmnet_ctrl_dev *dev)
+void rmnet_usb_ctrl_disconnect(struct rmnet_ctrl_udev *dev)
 {
-	dev->claimed = false;
+	struct rmnet_ctrl_dev *cdev;
+	int n;
 
 	clear_bit(RMNET_CTRL_DEV_READY, &dev->status);
 
-	mutex_lock(&dev->dev_lock);
-	/*TBD: for now just update CD status*/
-	dev->cbits_tolocal = ~ACM_CTRL_CD;
-	dev->cbits_tomdm = ~ACM_CTRL_DTR;
-	mutex_unlock(&dev->dev_lock);
-
-	wake_up(&dev->read_wait_queue);
+	if (test_bit(RMNET_CTRL_DEV_MUX_EN, &dev->status)) {
+		for (n = 0; n < insts_per_dev; n++) {
+			cdev = &ctrl_devs[dev->rdev_num][n];
+			wake_up(&cdev->read_wait_queue);
+			mutex_lock(&cdev->dev_lock);
+			cdev->cbits_tolocal = ~ACM_CTRL_CD;
+			cdev->cbits_tomdm = ~ACM_CTRL_DTR;
+			mutex_unlock(&cdev->dev_lock);
+		}
+	} else {
+		cdev = &ctrl_devs[dev->rdev_num][dev->ctrldev_id];
+		cdev->claimed = false;
+		wake_up(&cdev->read_wait_queue);
+		mutex_lock(&cdev->dev_lock);
+		cdev->cbits_tolocal = ~ACM_CTRL_CD;
+		cdev->cbits_tomdm = ~ACM_CTRL_DTR;
+		mutex_unlock(&cdev->dev_lock);
+	}
 
 	cancel_work_sync(&dev->get_encap_work);
 
@@ -1007,7 +954,8 @@ void rmnet_usb_ctrl_disconnect(struct rmnet_ctrl_dev *dev)
 static ssize_t rmnet_usb_ctrl_read_stats(struct file *file, char __user *ubuf,
 		size_t count, loff_t *ppos)
 {
-	struct rmnet_ctrl_dev	*dev;
+	struct rmnet_ctrl_udev	*dev;
+	struct rmnet_ctrl_dev	*cdev;
 	char			*buf;
 	int			ret;
 	int			i, n;
@@ -1019,7 +967,8 @@ static ssize_t rmnet_usb_ctrl_read_stats(struct file *file, char __user *ubuf,
 
 	for (i = 0; i < num_devs; i++) {
 		for (n = 0; n < insts_per_dev; n++) {
-			dev = &ctrl_devs[i][n];
+			cdev = &ctrl_devs[i][n];
+			dev = cdev->cudev;
 			temp += scnprintf(buf + temp, DEBUG_BUF_SIZE - temp,
 					"\n#ctrl_dev: %p     Name: %s#\n"
 					"snd encap cmd cnt         %u\n"
@@ -1032,20 +981,22 @@ static ssize_t rmnet_usb_ctrl_read_stats(struct file *file, char __user *ubuf,
 					"mdm_wait_timeout:         %u\n"
 					"zlp_cnt:                  %u\n"
 					"get_encap_failure_cnt     %u\n"
+					"invalid mux id cnt        %u\n"
 					"RMNET_CTRL_DEV_MUX_EN:    %d\n"
 					"RMNET_CTRL_DEV_OPEN:      %d\n"
 					"RMNET_CTRL_DEV_READY:     %d\n",
-					dev, dev->name,
+					cdev, cdev->name,
 					dev->snd_encap_cmd_cnt,
 					dev->resp_avail_cnt,
 					dev->get_encap_resp_cnt,
 					dev->set_ctrl_line_state_cnt,
 					dev->tx_ctrl_err_cnt,
-					dev->cbits_tolocal,
-					dev->cbits_tomdm,
-					dev->mdm_wait_timeout,
+					cdev->cbits_tolocal,
+					cdev->cbits_tomdm,
+					cdev->mdm_wait_timeout,
 					dev->zlp_cnt,
 					dev->get_encap_failure_cnt,
+					dev->invalid_mux_id_cnt,
 					test_bit(RMNET_CTRL_DEV_MUX_EN,
 							&dev->status),
 					test_bit(RMNET_CTRL_DEV_OPEN,
@@ -1063,12 +1014,14 @@ static ssize_t rmnet_usb_ctrl_read_stats(struct file *file, char __user *ubuf,
 static ssize_t rmnet_usb_ctrl_reset_stats(struct file *file, const char __user *
 		buf, size_t count, loff_t *ppos)
 {
-	struct rmnet_ctrl_dev	*dev;
+	struct rmnet_ctrl_udev	*dev;
+	struct rmnet_ctrl_dev	*cdev;
 	int			i, n;
 
 	for (i = 0; i < num_devs; i++) {
 		for (n = 0; n < insts_per_dev; n++) {
-			dev = &ctrl_devs[i][n];
+			cdev = &ctrl_devs[i][n];
+			dev = cdev->cudev;
 
 			dev->snd_encap_cmd_cnt = 0;
 			dev->resp_avail_cnt = 0;
@@ -1076,6 +1029,7 @@ static ssize_t rmnet_usb_ctrl_reset_stats(struct file *file, const char __user *
 			dev->set_ctrl_line_state_cnt = 0;
 			dev->tx_ctrl_err_cnt = 0;
 			dev->zlp_cnt = 0;
+			dev->invalid_mux_id_cnt = 0;
 		}
 	}
 	return count;
@@ -1111,11 +1065,14 @@ static void rmnet_usb_ctrl_debugfs_init(void) { }
 static void rmnet_usb_ctrl_debugfs_exit(void) { }
 #endif
 
-int rmnet_usb_ctrl_init(int no_rmnet_devs, int no_rmnet_insts_per_dev)
+int rmnet_usb_ctrl_init(int no_rmnet_devs, int no_rmnet_insts_per_dev,
+		unsigned long mux_info)
 {
 	struct rmnet_ctrl_dev	*dev;
+	struct rmnet_ctrl_udev	*cudev;
 	int			i, n;
 	int			status;
+	int			cmux_enabled;
 
 	num_devs = no_rmnet_devs;
 	insts_per_dev = no_rmnet_insts_per_dev;
@@ -1153,13 +1110,6 @@ int rmnet_usb_ctrl_init(int no_rmnet_devs, int no_rmnet_insts_per_dev)
 			snprintf(dev->name, CTRL_DEV_MAX_LEN, "%s%d",
 				 rmnet_dev_names[i], n);
 
-			dev->wq = create_singlethread_workqueue(dev->name);
-			if (!dev->wq) {
-				pr_err("unable to allocate workqueue");
-				kfree(dev);
-				return -ENOMEM;
-			}
-
 			dev->ch_id = n;
 
 			mutex_init(&dev->dev_lock);
@@ -1167,9 +1117,6 @@ int rmnet_usb_ctrl_init(int no_rmnet_devs, int no_rmnet_insts_per_dev)
 			init_waitqueue_head(&dev->read_wait_queue);
 			init_waitqueue_head(&dev->open_wait_queue);
 			INIT_LIST_HEAD(&dev->rx_list);
-			init_usb_anchor(&dev->tx_submitted);
-			init_usb_anchor(&dev->rx_submitted);
-			INIT_WORK(&dev->get_encap_work, get_encap_work);
 
 			cdev_init(&dev->cdev, &ctrldev_fops);
 			dev->cdev.owner = THIS_MODULE;
@@ -1178,7 +1125,6 @@ int rmnet_usb_ctrl_init(int no_rmnet_devs, int no_rmnet_insts_per_dev)
 			if (status) {
 				pr_err("%s: cdev_add() ret %i\n", __func__,
 					status);
-				destroy_workqueue(dev->wq);
 				kfree(dev);
 				return status;
 			}
@@ -1191,7 +1137,6 @@ int rmnet_usb_ctrl_init(int no_rmnet_devs, int no_rmnet_insts_per_dev)
 				pr_err("%s: device_create() returned %ld\n",
 					__func__, PTR_ERR(dev->devicep));
 				cdev_del(&dev->cdev);
-				destroy_workqueue(dev->wq);
 				kfree(dev);
 				return PTR_ERR(dev->devicep);
 			}
@@ -1203,23 +1148,65 @@ int rmnet_usb_ctrl_init(int no_rmnet_devs, int no_rmnet_insts_per_dev)
 				device_destroy(dev->devicep->class,
 					       dev->devicep->devt);
 				cdev_del(&dev->cdev);
-				destroy_workqueue(dev->wq);
 				kfree(dev);
 				return status;
 			}
 			dev_set_drvdata(dev->devicep, dev);
 
-			status = rmnet_usb_ctrl_alloc_rx(dev);
+			cmux_enabled = test_bit(i, &mux_info);
+			if (n && cmux_enabled) {
+				dev->cudev = cudev;
+				set_bit(RMNET_CTRL_DEV_MUX_EN, &dev->status);
+				continue;
+			}
+			cudev = kzalloc(sizeof(*cudev), GFP_KERNEL);
+			if (!cudev) {
+				pr_err("Error allocating rmnet usb ctrl dev\n");
+				device_remove_file(dev->devicep,
+						   &dev_attr_modem_wait);
+				device_destroy(dev->devicep->class,
+						   dev->devicep->devt);
+				cdev_del(&dev->cdev);
+				kfree(dev);
+				return -ENOMEM;
+			}
+
+			cudev->rdev_num = i;
+			cudev->wq = create_singlethread_workqueue(dev->name);
+			if (!cudev->wq) {
+				pr_err("unable to allocate workqueue");
+				kfree(cudev);
+				device_remove_file(dev->devicep,
+						   &dev_attr_modem_wait);
+				device_destroy(dev->devicep->class,
+						   dev->devicep->devt);
+				cdev_del(&dev->cdev);
+				kfree(dev);
+				return -ENOMEM;
+			}
+
+			init_usb_anchor(&cudev->tx_submitted);
+			init_usb_anchor(&cudev->rx_submitted);
+			INIT_WORK(&cudev->get_encap_work, get_encap_work);
+
+			status = rmnet_usb_ctrl_alloc_rx(cudev);
 			if (status) {
+				destroy_workqueue(cudev->wq);
+				kfree(cudev);
 				device_remove_file(dev->devicep,
 						   &dev_attr_modem_wait);
 				device_destroy(dev->devicep->class,
 					       dev->devicep->devt);
 				cdev_del(&dev->cdev);
-				destroy_workqueue(dev->wq);
 				kfree(dev);
 				return status;
 			}
+
+			dev->cudev = cudev;
+			if (cmux_enabled) {
+				set_bit(RMNET_CTRL_DEV_MUX_EN, &dev->status);
+				set_bit(RMNET_CTRL_DEV_MUX_EN, &cudev->status);
+			}
 		}
 	}
 
@@ -1230,25 +1217,35 @@ int rmnet_usb_ctrl_init(int no_rmnet_devs, int no_rmnet_insts_per_dev)
 
 static void free_rmnet_ctrl_dev(struct rmnet_ctrl_dev *dev)
 {
-	kfree(dev->in_ctlreq);
-	kfree(dev->rcvbuf);
-	kfree(dev->intbuf);
-	usb_free_urb(dev->rcvurb);
-	usb_free_urb(dev->inturb);
 	device_remove_file(dev->devicep, &dev_attr_modem_wait);
 	cdev_del(&dev->cdev);
-	destroy_workqueue(dev->wq);
 	device_destroy(dev->devicep->class,
 		       dev->devicep->devt);
 }
 
-void rmnet_usb_ctrl_exit(int no_rmnet_devs, int no_rmnet_insts_per_dev)
+static void free_rmnet_ctrl_udev(struct rmnet_ctrl_udev *cudev)
+{
+	kfree(cudev->in_ctlreq);
+	kfree(cudev->rcvbuf);
+	kfree(cudev->intbuf);
+	usb_free_urb(cudev->rcvurb);
+	usb_free_urb(cudev->inturb);
+	destroy_workqueue(cudev->wq);
+	kfree(cudev);
+}
+
+void rmnet_usb_ctrl_exit(int no_rmnet_devs, int no_rmnet_insts_per_dev,
+	unsigned long mux_info)
 {
 	int i, n;
 
 	for (i = 0; i < no_rmnet_devs; i++) {
-		for (n = 0; n < no_rmnet_insts_per_dev; n++)
+		for (n = 0; n < no_rmnet_insts_per_dev; n++) {
 			free_rmnet_ctrl_dev(&ctrl_devs[i][n]);
+			if (n && test_bit(i, &mux_info))
+				continue;
+			free_rmnet_ctrl_udev((&ctrl_devs[i][n])->cudev);
+		}
 
 		kfree(ctrl_devs[i]);