kernel/drivers/usb/misc/usbtest.c

   1 #include <linux/kernel.h>
   2 #include <linux/errno.h>
   3 #include <linux/init.h>
   4 #include <linux/slab.h>
   5 #include <linux/mm.h>
   6 #include <linux/module.h>
   7 #include <linux/moduleparam.h>
   8 #include <linux/scatterlist.h>
   9 #include <linux/mutex.h>
  10 #include <linux/timer.h>
  11 #include <linux/usb.h>
  12
  13 #define SIMPLE_IO_TIMEOUT       10000   /* in milliseconds */
  14
  15 /*-------------------------------------------------------------------------*/
  16
  17 static int override_alt = -1;
  18 module_param_named(alt, override_alt, int, 0644);
  19 MODULE_PARM_DESC(alt, ">= 0 to override altsetting selection");
  20
  21 /*-------------------------------------------------------------------------*/
  22
  23 /* FIXME make these public somewhere; usbdevfs.h? */
  24 struct usbtest_param {
  25         /* inputs */
  26         unsigned                test_num;       /* 0..(TEST_CASES-1) */
  27         unsigned                iterations;
  28         unsigned                length;
  29         unsigned                vary;
  30         unsigned                sglen;
  31
  32         /* outputs */
  33         struct timeval          duration;
  34 };
  35 #define USBTEST_REQUEST _IOWR('U', 100, struct usbtest_param)
  36
  37 /*-------------------------------------------------------------------------*/
  38
  39 #define GENERIC         /* let probe() bind using module params */
  40
  41 /* Some devices that can be used for testing will have "real" drivers.
  42  * Entries for those need to be enabled here by hand, after disabling
  43  * that "real" driver.
  44  */
  45 //#define       IBOT2           /* grab iBOT2 webcams */
  46 //#define       KEYSPAN_19Qi    /* grab un-renumerated serial adapter */
  47
  48 /*-------------------------------------------------------------------------*/
  49
  50 struct usbtest_info {
  51         const char              *name;
  52         u8                      ep_in;          /* bulk/intr source */
  53         u8                      ep_out;         /* bulk/intr sink */
  54         unsigned                autoconf:1;
  55         unsigned                ctrl_out:1;
  56         unsigned                iso:1;          /* try iso in/out */
  57         unsigned                intr:1;         /* try interrupt in/out */
  58         int                     alt;
  59 };
  60
  61 /* this is accessed only through usbfs ioctl calls.
  62  * one ioctl to issue a test ... one lock per device.
  63  * tests create other threads if they need them.
  64  * urbs and buffers are allocated dynamically,
  65  * and data generated deterministically.
  66  */
  67 struct usbtest_dev {
  68         struct usb_interface    *intf;
  69         struct usbtest_info     *info;
  70         int                     in_pipe;
  71         int                     out_pipe;
  72         int                     in_iso_pipe;
  73         int                     out_iso_pipe;
  74         int                     in_int_pipe;
  75         int                     out_int_pipe;
  76         struct usb_endpoint_descriptor  *iso_in, *iso_out;
  77         struct usb_endpoint_descriptor  *int_in, *int_out;
  78         struct mutex            lock;
  79
  80 #define TBUF_SIZE       256
  81         u8                      *buf;
  82 };
  83
  84 static struct usb_device *testdev_to_usbdev(struct usbtest_dev *test)
  85 {
  86         return interface_to_usbdev(test->intf);
  87 }
  88
  89 /* set up all urbs so they can be used with either bulk or interrupt */
  90 #define INTERRUPT_RATE          1       /* msec/transfer */
  91
  92 #define ERROR(tdev, fmt, args...) \
  93         dev_err(&(tdev)->intf->dev , fmt , ## args)
  94 #define WARNING(tdev, fmt, args...) \
  95         dev_warn(&(tdev)->intf->dev , fmt , ## args)
  96
  97 #define GUARD_BYTE      0xA5
  98
  99 /*-------------------------------------------------------------------------*/
 100
 101 static int
 102 get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf)
 103 {
 104         int                             tmp;
 105         struct usb_host_interface       *alt;
 106         struct usb_host_endpoint        *in, *out;
 107         struct usb_host_endpoint        *iso_in, *iso_out;
 108         struct usb_host_endpoint        *int_in, *int_out;
 109         struct usb_device               *udev;
 110
 111         for (tmp = 0; tmp < intf->num_altsetting; tmp++) {
 112                 unsigned        ep;
 113
 114                 in = out = NULL;
 115                 iso_in = iso_out = NULL;
 116                 int_in = int_out = NULL;
 117                 alt = intf->altsetting + tmp;
 118
 119                 if (override_alt >= 0 &&
 120                                 override_alt != alt->desc.bAlternateSetting)
 121                         continue;
 122
 123                 /* take the first altsetting with in-bulk + out-bulk;
 124                  * ignore other endpoints and altsettings.
 125                  */
 126                 for (ep = 0; ep < alt->desc.bNumEndpoints; ep++) {
 127                         struct usb_host_endpoint        *e;
 128
 129                         e = alt->endpoint + ep;
 130                         switch (usb_endpoint_type(&e->desc)) {
 131                         case USB_ENDPOINT_XFER_BULK:
 132                                 break;
 133                         case USB_ENDPOINT_XFER_INT:
 134                                 if (dev->info->intr)
 135                                         goto try_intr;
 136                         case USB_ENDPOINT_XFER_ISOC:
 137                                 if (dev->info->iso)
 138                                         goto try_iso;
 139                                 /* FALLTHROUGH */
 140                         default:
 141                                 continue;
 142                         }
 143                         if (usb_endpoint_dir_in(&e->desc)) {
 144                                 if (!in)
 145                                         in = e;
 146                         } else {
 147                                 if (!out)
 148                                         out = e;
 149                         }
 150                         continue;
 151 try_intr:
 152                         if (usb_endpoint_dir_in(&e->desc)) {
 153                                 if (!int_in)
 154                                         int_in = e;
 155                         } else {
 156                                 if (!int_out)
 157                                         int_out = e;
 158                         }
 159                         continue;
 160 try_iso:
 161                         if (usb_endpoint_dir_in(&e->desc)) {
 162                                 if (!iso_in)
 163                                         iso_in = e;
 164                         } else {
 165                                 if (!iso_out)
 166                                         iso_out = e;
 167                         }
 168                 }
 169                 if ((in && out)  ||  iso_in || iso_out || int_in || int_out)
 170                         goto found;
 171         }
 172         return -EINVAL;
 173
 174 found:
 175         udev = testdev_to_usbdev(dev);
 176         dev->info->alt = alt->desc.bAlternateSetting;
 177         if (alt->desc.bAlternateSetting != 0) {
 178                 tmp = usb_set_interface(udev,
 179                                 alt->desc.bInterfaceNumber,
 180                                 alt->desc.bAlternateSetting);
 181                 if (tmp < 0)
 182                         return tmp;
 183         }
 184
 185         if (in) {
 186                 dev->in_pipe = usb_rcvbulkpipe(udev,
 187                         in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
 188                 dev->out_pipe = usb_sndbulkpipe(udev,
 189                         out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
 190         }
 191         if (iso_in) {
 192                 dev->iso_in = &iso_in->desc;
 193                 dev->in_iso_pipe = usb_rcvisocpipe(udev,
 194                                 iso_in->desc.bEndpointAddress
 195                                         & USB_ENDPOINT_NUMBER_MASK);
 196         }
 197
 198         if (iso_out) {
 199                 dev->iso_out = &iso_out->desc;
 200                 dev->out_iso_pipe = usb_sndisocpipe(udev,
 201                                 iso_out->desc.bEndpointAddress
 202                                         & USB_ENDPOINT_NUMBER_MASK);
 203         }
 204
 205         if (int_in) {
 206                 dev->int_in = &int_in->desc;
 207                 dev->in_int_pipe = usb_rcvintpipe(udev,
 208                                 int_in->desc.bEndpointAddress
 209                                         & USB_ENDPOINT_NUMBER_MASK);
 210         }
 211
 212         if (int_out) {
 213                 dev->int_out = &int_out->desc;
 214                 dev->out_int_pipe = usb_sndintpipe(udev,
 215                                 int_out->desc.bEndpointAddress
 216                                         & USB_ENDPOINT_NUMBER_MASK);
 217         }
 218         return 0;
 219 }
 220
 221 /*-------------------------------------------------------------------------*/
 222
 223 /* Support for testing basic non-queued I/O streams.
 224  *
 225  * These just package urbs as requests that can be easily canceled.
 226  * Each urb's data buffer is dynamically allocated; callers can fill
 227  * them with non-zero test data (or test for it) when appropriate.
 228  */
 229
 230 static void simple_callback(struct urb *urb)
 231 {
 232         complete(urb->context);
 233 }
 234
 235 static struct urb *usbtest_alloc_urb(
 236         struct usb_device       *udev,
 237         int                     pipe,
 238         unsigned long           bytes,
 239         unsigned                transfer_flags,
 240         unsigned                offset,
 241         u8                      bInterval)
 242 {
 243         struct urb              *urb;
 244
 245         urb = usb_alloc_urb(0, GFP_KERNEL);
 246         if (!urb)
 247                 return urb;
 248
 249         if (bInterval)
 250                 usb_fill_int_urb(urb, udev, pipe, NULL, bytes, simple_callback,
 251                                 NULL, bInterval);
 252         else
 253                 usb_fill_bulk_urb(urb, udev, pipe, NULL, bytes, simple_callback,
 254                                 NULL);
 255
 256         urb->interval = (udev->speed == USB_SPEED_HIGH)
 257                         ? (INTERRUPT_RATE << 3)
 258                         : INTERRUPT_RATE;
 259         urb->transfer_flags = transfer_flags;
 260         if (usb_pipein(pipe))
 261                 urb->transfer_flags |= URB_SHORT_NOT_OK;
 262
 263         if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 264                 urb->transfer_buffer = usb_alloc_coherent(udev, bytes + offset,
 265                         GFP_KERNEL, &urb->transfer_dma);
 266         else
 267                 urb->transfer_buffer = kmalloc(bytes + offset, GFP_KERNEL);
 268
 269         if (!urb->transfer_buffer) {
 270                 usb_free_urb(urb);
 271                 return NULL;
 272         }
 273
 274         /* To test unaligned transfers add an offset and fill the
 275                 unused memory with a guard value */
 276         if (offset) {
 277                 memset(urb->transfer_buffer, GUARD_BYTE, offset);
 278                 urb->transfer_buffer += offset;
 279                 if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 280                         urb->transfer_dma += offset;
 281         }
 282
 283         /* For inbound transfers use guard byte so that test fails if
 284                 data not correctly copied */
 285         memset(urb->transfer_buffer,
 286                         usb_pipein(urb->pipe) ? GUARD_BYTE : 0,
 287                         bytes);
 288         return urb;
 289 }
 290
 291 static struct urb *simple_alloc_urb(
 292         struct usb_device       *udev,
 293         int                     pipe,
 294         unsigned long           bytes,
 295         u8                      bInterval)
 296 {
 297         return usbtest_alloc_urb(udev, pipe, bytes, URB_NO_TRANSFER_DMA_MAP, 0,
 298                         bInterval);
 299 }
 300
 301 static unsigned pattern;
 302 static unsigned mod_pattern;
 303 module_param_named(pattern, mod_pattern, uint, S_IRUGO | S_IWUSR);
 304 MODULE_PARM_DESC(mod_pattern, "i/o pattern (0 == zeroes)");
 305
 306 static inline void simple_fill_buf(struct urb *urb)
 307 {
 308         unsigned        i;
 309         u8              *buf = urb->transfer_buffer;
 310         unsigned        len = urb->transfer_buffer_length;
 311
 312         switch (pattern) {
 313         default:
 314                 /* FALLTHROUGH */
 315         case 0:
 316                 memset(buf, 0, len);
 317                 break;
 318         case 1:                 /* mod63 */
 319                 for (i = 0; i < len; i++)
 320                         *buf++ = (u8) (i % 63);
 321                 break;
 322         }
 323 }
 324
 325 static inline unsigned long buffer_offset(void *buf)
 326 {
 327         return (unsigned long)buf & (ARCH_KMALLOC_MINALIGN - 1);
 328 }
 329
 330 static int check_guard_bytes(struct usbtest_dev *tdev, struct urb *urb)
 331 {
 332         u8 *buf = urb->transfer_buffer;
 333         u8 *guard = buf - buffer_offset(buf);
 334         unsigned i;
 335
 336         for (i = 0; guard < buf; i++, guard++) {
 337                 if (*guard != GUARD_BYTE) {
 338                         ERROR(tdev, "guard byte[%d] %d (not %d)\n",
 339                                 i, *guard, GUARD_BYTE);
 340                         return -EINVAL;
 341                 }
 342         }
 343         return 0;
 344 }
 345
 346 static int simple_check_buf(struct usbtest_dev *tdev, struct urb *urb)
 347 {
 348         unsigned        i;
 349         u8              expected;
 350         u8              *buf = urb->transfer_buffer;
 351         unsigned        len = urb->actual_length;
 352
 353         int ret = check_guard_bytes(tdev, urb);
 354         if (ret)
 355                 return ret;
 356
 357         for (i = 0; i < len; i++, buf++) {
 358                 switch (pattern) {
 359                 /* all-zeroes has no synchronization issues */
 360                 case 0:
 361                         expected = 0;
 362                         break;
 363                 /* mod63 stays in sync with short-terminated transfers,
 364                  * or otherwise when host and gadget agree on how large
 365                  * each usb transfer request should be.  resync is done
 366                  * with set_interface or set_config.
 367                  */
 368                 case 1:                 /* mod63 */
 369                         expected = i % 63;
 370                         break;
 371                 /* always fail unsupported patterns */
 372                 default:
 373                         expected = !*buf;
 374                         break;
 375                 }
 376                 if (*buf == expected)
 377                         continue;
 378                 ERROR(tdev, "buf[%d] = %d (not %d)\n", i, *buf, expected);
 379                 return -EINVAL;
 380         }
 381         return 0;
 382 }
 383
 384 static void simple_free_urb(struct urb *urb)
 385 {
 386         unsigned long offset = buffer_offset(urb->transfer_buffer);
 387
 388         if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 389                 usb_free_coherent(
 390                         urb->dev,
 391                         urb->transfer_buffer_length + offset,
 392                         urb->transfer_buffer - offset,
 393                         urb->transfer_dma - offset);
 394         else
 395                 kfree(urb->transfer_buffer - offset);
 396         usb_free_urb(urb);
 397 }
 398
 399 static int simple_io(
 400         struct usbtest_dev      *tdev,
 401         struct urb              *urb,
 402         int                     iterations,
 403         int                     vary,
 404         int                     expected,
 405         const char              *label
 406 )
 407 {
 408         struct usb_device       *udev = urb->dev;
 409         int                     max = urb->transfer_buffer_length;
 410         struct completion       completion;
 411         int                     retval = 0;
 412         unsigned long           expire;
 413
 414         urb->context = &completion;
 415         while (retval == 0 && iterations-- > 0) {
 416                 init_completion(&completion);
 417                 if (usb_pipeout(urb->pipe)) {
 418                         simple_fill_buf(urb);
 419                         urb->transfer_flags |= URB_ZERO_PACKET;
 420                 }
 421                 retval = usb_submit_urb(urb, GFP_KERNEL);
 422                 if (retval != 0)
 423                         break;
 424
 425                 expire = msecs_to_jiffies(SIMPLE_IO_TIMEOUT);
 426                 if (!wait_for_completion_timeout(&completion, expire)) {
 427                         usb_kill_urb(urb);
 428                         retval = (urb->status == -ENOENT ?
 429                                   -ETIMEDOUT : urb->status);
 430                 } else {
 431                         retval = urb->status;
 432                 }
 433
 434                 urb->dev = udev;
 435                 if (retval == 0 && usb_pipein(urb->pipe))
 436                         retval = simple_check_buf(tdev, urb);
 437
 438                 if (vary) {
 439                         int     len = urb->transfer_buffer_length;
 440
 441                         len += vary;
 442                         len %= max;
 443                         if (len == 0)
 444                                 len = (vary < max) ? vary : max;
 445                         urb->transfer_buffer_length = len;
 446                 }
 447
 448                 /* FIXME if endpoint halted, clear halt (and log) */
 449         }
 450         urb->transfer_buffer_length = max;
 451
 452         if (expected != retval)
 453                 dev_err(&udev->dev,
 454                         "%s failed, iterations left %d, status %d (not %d)\n",
 455                                 label, iterations, retval, expected);
 456         return retval;
 457 }
 458
 459
 460 /*-------------------------------------------------------------------------*/
 461
 462 /* We use scatterlist primitives to test queued I/O.
 463  * Yes, this also tests the scatterlist primitives.
 464  */
 465
 466 static void free_sglist(struct scatterlist *sg, int nents)
 467 {
 468         unsigned                i;
 469
 470         if (!sg)
 471                 return;
 472         for (i = 0; i < nents; i++) {
 473                 if (!sg_page(&sg[i]))
 474                         continue;
 475                 kfree(sg_virt(&sg[i]));
 476         }
 477         kfree(sg);
 478 }
 479
 480 static struct scatterlist *
 481 alloc_sglist(int nents, int max, int vary)
 482 {
 483         struct scatterlist      *sg;
 484         unsigned                i;
 485         unsigned                size = max;
 486
 487         if (max == 0)
 488                 return NULL;
 489
 490         sg = kmalloc_array(nents, sizeof(*sg), GFP_KERNEL);
 491         if (!sg)
 492                 return NULL;
 493         sg_init_table(sg, nents);
 494
 495         for (i = 0; i < nents; i++) {
 496                 char            *buf;
 497                 unsigned        j;
 498
 499                 buf = kzalloc(size, GFP_KERNEL);
 500                 if (!buf) {
 501                         free_sglist(sg, i);
 502                         return NULL;
 503                 }
 504
 505                 /* kmalloc pages are always physically contiguous! */
 506                 sg_set_buf(&sg[i], buf, size);
 507
 508                 switch (pattern) {
 509                 case 0:
 510                         /* already zeroed */
 511                         break;
 512                 case 1:
 513                         for (j = 0; j < size; j++)
 514                                 *buf++ = (u8) (j % 63);
 515                         break;
 516                 }
 517
 518                 if (vary) {
 519                         size += vary;
 520                         size %= max;
 521                         if (size == 0)
 522                                 size = (vary < max) ? vary : max;
 523                 }
 524         }
 525
 526         return sg;
 527 }
 528
 529 static void sg_timeout(unsigned long _req)
 530 {
 531         struct usb_sg_request   *req = (struct usb_sg_request *) _req;
 532
 533         req->status = -ETIMEDOUT;
 534         usb_sg_cancel(req);
 535 }
 536
 537 static int perform_sglist(
 538         struct usbtest_dev      *tdev,
 539         unsigned                iterations,
 540         int                     pipe,
 541         struct usb_sg_request   *req,
 542         struct scatterlist      *sg,
 543         int                     nents
 544 )
 545 {
 546         struct usb_device       *udev = testdev_to_usbdev(tdev);
 547         int                     retval = 0;
 548         struct timer_list       sg_timer;
 549
 550         setup_timer_on_stack(&sg_timer, sg_timeout, (unsigned long) req);
 551
 552         while (retval == 0 && iterations-- > 0) {
 553                 retval = usb_sg_init(req, udev, pipe,
 554                                 (udev->speed == USB_SPEED_HIGH)
 555                                         ? (INTERRUPT_RATE << 3)
 556                                         : INTERRUPT_RATE,
 557                                 sg, nents, 0, GFP_KERNEL);
 558
 559                 if (retval)
 560                         break;
 561                 mod_timer(&sg_timer, jiffies +
 562                                 msecs_to_jiffies(SIMPLE_IO_TIMEOUT));
 563                 usb_sg_wait(req);
 564                 del_timer_sync(&sg_timer);
 565                 retval = req->status;
 566
 567                 /* FIXME check resulting data pattern */
 568
 569                 /* FIXME if endpoint halted, clear halt (and log) */
 570         }
 571
 572         /* FIXME for unlink or fault handling tests, don't report
 573          * failure if retval is as we expected ...
 574          */
 575         if (retval)
 576                 ERROR(tdev, "perform_sglist failed, "
 577                                 "iterations left %d, status %d\n",
 578                                 iterations, retval);
 579         return retval;
 580 }
 581
 582
 583 /*-------------------------------------------------------------------------*/
 584
 585 /* unqueued control message testing
 586  *
 587  * there's a nice set of device functional requirements in chapter 9 of the
 588  * usb 2.0 spec, which we can apply to ANY device, even ones that don't use
 589  * special test firmware.
 590  *
 591  * we know the device is configured (or suspended) by the time it's visible
 592  * through usbfs.  we can't change that, so we won't test enumeration (which
 593  * worked 'well enough' to get here, this time), power management (ditto),
 594  * or remote wakeup (which needs human interaction).
 595  */
 596
 597 static unsigned realworld = 1;
 598 module_param(realworld, uint, 0);
 599 MODULE_PARM_DESC(realworld, "clear to demand stricter spec compliance");
 600
 601 static int get_altsetting(struct usbtest_dev *dev)
 602 {
 603         struct usb_interface    *iface = dev->intf;
 604         struct usb_device       *udev = interface_to_usbdev(iface);
 605         int                     retval;
 606
 607         retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 608                         USB_REQ_GET_INTERFACE, USB_DIR_IN|USB_RECIP_INTERFACE,
 609                         0, iface->altsetting[0].desc.bInterfaceNumber,
 610                         dev->buf, 1, USB_CTRL_GET_TIMEOUT);
 611         switch (retval) {
 612         case 1:
 613                 return dev->buf[0];
 614         case 0:
 615                 retval = -ERANGE;
 616                 /* FALLTHROUGH */
 617         default:
 618                 return retval;
 619         }
 620 }
 621
 622 static int set_altsetting(struct usbtest_dev *dev, int alternate)
 623 {
 624         struct usb_interface            *iface = dev->intf;
 625         struct usb_device               *udev;
 626
 627         if (alternate < 0 || alternate >= 256)
 628                 return -EINVAL;
 629
 630         udev = interface_to_usbdev(iface);
 631         return usb_set_interface(udev,
 632                         iface->altsetting[0].desc.bInterfaceNumber,
 633                         alternate);
 634 }
 635
 636 static int is_good_config(struct usbtest_dev *tdev, int len)
 637 {
 638         struct usb_config_descriptor    *config;
 639
 640         if (len < sizeof(*config))
 641                 return 0;
 642         config = (struct usb_config_descriptor *) tdev->buf;
 643
 644         switch (config->bDescriptorType) {
 645         case USB_DT_CONFIG:
 646         case USB_DT_OTHER_SPEED_CONFIG:
 647                 if (config->bLength != 9) {
 648                         ERROR(tdev, "bogus config descriptor length\n");
 649                         return 0;
 650                 }
 651                 /* this bit 'must be 1' but often isn't */
 652                 if (!realworld && !(config->bmAttributes & 0x80)) {
 653                         ERROR(tdev, "high bit of config attributes not set\n");
 654                         return 0;
 655                 }
 656                 if (config->bmAttributes & 0x1f) {      /* reserved == 0 */
 657                         ERROR(tdev, "reserved config bits set\n");
 658                         return 0;
 659                 }
 660                 break;
 661         default:
 662                 return 0;
 663         }
 664
 665         if (le16_to_cpu(config->wTotalLength) == len)   /* read it all */
 666                 return 1;
 667         if (le16_to_cpu(config->wTotalLength) >= TBUF_SIZE)     /* max partial read */
 668                 return 1;
 669         ERROR(tdev, "bogus config descriptor read size\n");
 670         return 0;
 671 }
 672
 673 static int is_good_ext(struct usbtest_dev *tdev, u8 *buf)
 674 {
 675         struct usb_ext_cap_descriptor *ext;
 676         u32 attr;
 677
 678         ext = (struct usb_ext_cap_descriptor *) buf;
 679
 680         if (ext->bLength != USB_DT_USB_EXT_CAP_SIZE) {
 681                 ERROR(tdev, "bogus usb 2.0 extension descriptor length\n");
 682                 return 0;
 683         }
 684
 685         attr = le32_to_cpu(ext->bmAttributes);
 686         /* bits[1:15] is used and others are reserved */
 687         if (attr & ~0xfffe) {   /* reserved == 0 */
 688                 ERROR(tdev, "reserved bits set\n");
 689                 return 0;
 690         }
 691
 692         return 1;
 693 }
 694
 695 static int is_good_ss_cap(struct usbtest_dev *tdev, u8 *buf)
 696 {
 697         struct usb_ss_cap_descriptor *ss;
 698
 699         ss = (struct usb_ss_cap_descriptor *) buf;
 700
 701         if (ss->bLength != USB_DT_USB_SS_CAP_SIZE) {
 702                 ERROR(tdev, "bogus superspeed device capability descriptor length\n");
 703                 return 0;
 704         }
 705
 706         /*
 707          * only bit[1] of bmAttributes is used for LTM and others are
 708          * reserved
 709          */
 710         if (ss->bmAttributes & ~0x02) { /* reserved == 0 */
 711                 ERROR(tdev, "reserved bits set in bmAttributes\n");
 712                 return 0;
 713         }
 714
 715         /* bits[0:3] of wSpeedSupported is used and others are reserved */
 716         if (le16_to_cpu(ss->wSpeedSupported) & ~0x0f) { /* reserved == 0 */
 717                 ERROR(tdev, "reserved bits set in wSpeedSupported\n");
 718                 return 0;
 719         }
 720
 721         return 1;
 722 }
 723
 724 static int is_good_con_id(struct usbtest_dev *tdev, u8 *buf)
 725 {
 726         struct usb_ss_container_id_descriptor *con_id;
 727
 728         con_id = (struct usb_ss_container_id_descriptor *) buf;
 729
 730         if (con_id->bLength != USB_DT_USB_SS_CONTN_ID_SIZE) {
 731                 ERROR(tdev, "bogus container id descriptor length\n");
 732                 return 0;
 733         }
 734
 735         if (con_id->bReserved) {        /* reserved == 0 */
 736                 ERROR(tdev, "reserved bits set\n");
 737                 return 0;
 738         }
 739
 740         return 1;
 741 }
 742
 743 /* sanity test for standard requests working with usb_control_mesg() and some
 744  * of the utility functions which use it.
 745  *
 746  * this doesn't test how endpoint halts behave or data toggles get set, since
 747  * we won't do I/O to bulk/interrupt endpoints here (which is how to change
 748  * halt or toggle).  toggle testing is impractical without support from hcds.
 749  *
 750  * this avoids failing devices linux would normally work with, by not testing
 751  * config/altsetting operations for devices that only support their defaults.
 752  * such devices rarely support those needless operations.
 753  *
 754  * NOTE that since this is a sanity test, it's not examining boundary cases
 755  * to see if usbcore, hcd, and device all behave right.  such testing would
 756  * involve varied read sizes and other operation sequences.
 757  */
 758 static int ch9_postconfig(struct usbtest_dev *dev)
 759 {
 760         struct usb_interface    *iface = dev->intf;
 761         struct usb_device       *udev = interface_to_usbdev(iface);
 762         int                     i, alt, retval;
 763
 764         /* [9.2.3] if there's more than one altsetting, we need to be able to
 765          * set and get each one.  mostly trusts the descriptors from usbcore.
 766          */
 767         for (i = 0; i < iface->num_altsetting; i++) {
 768
 769                 /* 9.2.3 constrains the range here */
 770                 alt = iface->altsetting[i].desc.bAlternateSetting;
 771                 if (alt < 0 || alt >= iface->num_altsetting) {
 772                         dev_err(&iface->dev,
 773                                         "invalid alt [%d].bAltSetting = %d\n",
 774                                         i, alt);
 775                 }
 776
 777                 /* [real world] get/set unimplemented if there's only one */
 778                 if (realworld && iface->num_altsetting == 1)
 779                         continue;
 780
 781                 /* [9.4.10] set_interface */
 782                 retval = set_altsetting(dev, alt);
 783                 if (retval) {
 784                         dev_err(&iface->dev, "can't set_interface = %d, %d\n",
 785                                         alt, retval);
 786                         return retval;
 787                 }
 788
 789                 /* [9.4.4] get_interface always works */
 790                 retval = get_altsetting(dev);
 791                 if (retval != alt) {
 792                         dev_err(&iface->dev, "get alt should be %d, was %d\n",
 793                                         alt, retval);
 794                         return (retval < 0) ? retval : -EDOM;
 795                 }
 796
 797         }
 798
 799         /* [real world] get_config unimplemented if there's only one */
 800         if (!realworld || udev->descriptor.bNumConfigurations != 1) {
 801                 int     expected = udev->actconfig->desc.bConfigurationValue;
 802
 803                 /* [9.4.2] get_configuration always works
 804                  * ... although some cheap devices (like one TI Hub I've got)
 805                  * won't return config descriptors except before set_config.
 806                  */
 807                 retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 808                                 USB_REQ_GET_CONFIGURATION,
 809                                 USB_DIR_IN | USB_RECIP_DEVICE,
 810                                 0, 0, dev->buf, 1, USB_CTRL_GET_TIMEOUT);
 811                 if (retval != 1 || dev->buf[0] != expected) {
 812                         dev_err(&iface->dev, "get config --> %d %d (1 %d)\n",
 813                                 retval, dev->buf[0], expected);
 814                         return (retval < 0) ? retval : -EDOM;
 815                 }
 816         }
 817
 818         /* there's always [9.4.3] a device descriptor [9.6.1] */
 819         retval = usb_get_descriptor(udev, USB_DT_DEVICE, 0,
 820                         dev->buf, sizeof(udev->descriptor));
 821         if (retval != sizeof(udev->descriptor)) {
 822                 dev_err(&iface->dev, "dev descriptor --> %d\n", retval);
 823                 return (retval < 0) ? retval : -EDOM;
 824         }
 825
 826         /*
 827          * there's always [9.4.3] a bos device descriptor [9.6.2] in USB
 828          * 3.0 spec
 829          */
 830         if (le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0210) {
 831                 struct usb_bos_descriptor *bos = NULL;
 832                 struct usb_dev_cap_header *header = NULL;
 833                 unsigned total, num, length;
 834                 u8 *buf;
 835
 836                 retval = usb_get_descriptor(udev, USB_DT_BOS, 0, dev->buf,
 837                                 sizeof(*udev->bos->desc));
 838                 if (retval != sizeof(*udev->bos->desc)) {
 839                         dev_err(&iface->dev, "bos descriptor --> %d\n", retval);
 840                         return (retval < 0) ? retval : -EDOM;
 841                 }
 842
 843                 bos = (struct usb_bos_descriptor *)dev->buf;
 844                 total = le16_to_cpu(bos->wTotalLength);
 845                 num = bos->bNumDeviceCaps;
 846
 847                 if (total > TBUF_SIZE)
 848                         total = TBUF_SIZE;
 849
 850                 /*
 851                  * get generic device-level capability descriptors [9.6.2]
 852                  * in USB 3.0 spec
 853                  */
 854                 retval = usb_get_descriptor(udev, USB_DT_BOS, 0, dev->buf,
 855                                 total);
 856                 if (retval != total) {
 857                         dev_err(&iface->dev, "bos descriptor set --> %d\n",
 858                                         retval);
 859                         return (retval < 0) ? retval : -EDOM;
 860                 }
 861
 862                 length = sizeof(*udev->bos->desc);
 863                 buf = dev->buf;
 864                 for (i = 0; i < num; i++) {
 865                         buf += length;
 866                         if (buf + sizeof(struct usb_dev_cap_header) >
 867                                         dev->buf + total)
 868                                 break;
 869
 870                         header = (struct usb_dev_cap_header *)buf;
 871                         length = header->bLength;
 872
 873                         if (header->bDescriptorType !=
 874                                         USB_DT_DEVICE_CAPABILITY) {
 875                                 dev_warn(&udev->dev, "not device capability descriptor, skip\n");
 876                                 continue;
 877                         }
 878
 879                         switch (header->bDevCapabilityType) {
 880                         case USB_CAP_TYPE_EXT:
 881                                 if (buf + USB_DT_USB_EXT_CAP_SIZE >
 882                                                 dev->buf + total ||
 883                                                 !is_good_ext(dev, buf)) {
 884                                         dev_err(&iface->dev, "bogus usb 2.0 extension descriptor\n");
 885                                         return -EDOM;
 886                                 }
 887                                 break;
 888                         case USB_SS_CAP_TYPE:
 889                                 if (buf + USB_DT_USB_SS_CAP_SIZE >
 890                                                 dev->buf + total ||
 891                                                 !is_good_ss_cap(dev, buf)) {
 892                                         dev_err(&iface->dev, "bogus superspeed device capability descriptor\n");
 893                                         return -EDOM;
 894                                 }
 895                                 break;
 896                         case CONTAINER_ID_TYPE:
 897                                 if (buf + USB_DT_USB_SS_CONTN_ID_SIZE >
 898                                                 dev->buf + total ||
 899                                                 !is_good_con_id(dev, buf)) {
 900                                         dev_err(&iface->dev, "bogus container id descriptor\n");
 901                                         return -EDOM;
 902                                 }
 903                                 break;
 904                         default:
 905                                 break;
 906                         }
 907                 }
 908         }
 909
 910         /* there's always [9.4.3] at least one config descriptor [9.6.3] */
 911         for (i = 0; i < udev->descriptor.bNumConfigurations; i++) {
 912                 retval = usb_get_descriptor(udev, USB_DT_CONFIG, i,
 913                                 dev->buf, TBUF_SIZE);
 914                 if (!is_good_config(dev, retval)) {
 915                         dev_err(&iface->dev,
 916                                         "config [%d] descriptor --> %d\n",
 917                                         i, retval);
 918                         return (retval < 0) ? retval : -EDOM;
 919                 }
 920
 921                 /* FIXME cross-checking udev->config[i] to make sure usbcore
 922                  * parsed it right (etc) would be good testing paranoia
 923                  */
 924         }
 925
 926         /* and sometimes [9.2.6.6] speed dependent descriptors */
 927         if (le16_to_cpu(udev->descriptor.bcdUSB) == 0x0200) {
 928                 struct usb_qualifier_descriptor *d = NULL;
 929
 930                 /* device qualifier [9.6.2] */
 931                 retval = usb_get_descriptor(udev,
 932                                 USB_DT_DEVICE_QUALIFIER, 0, dev->buf,
 933                                 sizeof(struct usb_qualifier_descriptor));
 934                 if (retval == -EPIPE) {
 935                         if (udev->speed == USB_SPEED_HIGH) {
 936                                 dev_err(&iface->dev,
 937                                                 "hs dev qualifier --> %d\n",
 938                                                 retval);
 939                                 return (retval < 0) ? retval : -EDOM;
 940                         }
 941                         /* usb2.0 but not high-speed capable; fine */
 942                 } else if (retval != sizeof(struct usb_qualifier_descriptor)) {
 943                         dev_err(&iface->dev, "dev qualifier --> %d\n", retval);
 944                         return (retval < 0) ? retval : -EDOM;
 945                 } else
 946                         d = (struct usb_qualifier_descriptor *) dev->buf;
 947
 948                 /* might not have [9.6.2] any other-speed configs [9.6.4] */
 949                 if (d) {
 950                         unsigned max = d->bNumConfigurations;
 951                         for (i = 0; i < max; i++) {
 952                                 retval = usb_get_descriptor(udev,
 953                                         USB_DT_OTHER_SPEED_CONFIG, i,
 954                                         dev->buf, TBUF_SIZE);
 955                                 if (!is_good_config(dev, retval)) {
 956                                         dev_err(&iface->dev,
 957                                                 "other speed config --> %d\n",
 958                                                 retval);
 959                                         return (retval < 0) ? retval : -EDOM;
 960                                 }
 961                         }
 962                 }
 963         }
 964         /* FIXME fetch strings from at least the device descriptor */
 965
 966         /* [9.4.5] get_status always works */
 967         retval = usb_get_status(udev, USB_RECIP_DEVICE, 0, dev->buf);
 968         if (retval) {
 969                 dev_err(&iface->dev, "get dev status --> %d\n", retval);
 970                 return retval;
 971         }
 972
 973         /* FIXME configuration.bmAttributes says if we could try to set/clear
 974          * the device's remote wakeup feature ... if we can, test that here
 975          */
 976
 977         retval = usb_get_status(udev, USB_RECIP_INTERFACE,
 978                         iface->altsetting[0].desc.bInterfaceNumber, dev->buf);
 979         if (retval) {
 980                 dev_err(&iface->dev, "get interface status --> %d\n", retval);
 981                 return retval;
 982         }
 983         /* FIXME get status for each endpoint in the interface */
 984
 985         return 0;
 986 }
 987
 988 /*-------------------------------------------------------------------------*/
 989
 990 /* use ch9 requests to test whether:
 991  *   (a) queues work for control, keeping N subtests queued and
 992  *       active (auto-resubmit) for M loops through the queue.
 993  *   (b) protocol stalls (control-only) will autorecover.
 994  *       it's not like bulk/intr; no halt clearing.
 995  *   (c) short control reads are reported and handled.
 996  *   (d) queues are always processed in-order
 997  */
 998
 999 struct ctrl_ctx {
1000         spinlock_t              lock;
1001         struct usbtest_dev      *dev;
1002         struct completion       complete;
1003         unsigned                count;
1004         unsigned                pending;
1005         int                     status;
1006         struct urb              **urb;
1007         struct usbtest_param    *param;
1008         int                     last;
1009 };
1010
1011 #define NUM_SUBCASES    16              /* how many test subcases here? */
1012
1013 struct subcase {
1014         struct usb_ctrlrequest  setup;
1015         int                     number;
1016         int                     expected;
1017 };
1018
1019 static void ctrl_complete(struct urb *urb)
1020 {
1021         struct ctrl_ctx         *ctx = urb->context;
1022         struct usb_ctrlrequest  *reqp;
1023         struct subcase          *subcase;
1024         int                     status = urb->status;
1025
1026         reqp = (struct usb_ctrlrequest *)urb->setup_packet;
1027         subcase = container_of(reqp, struct subcase, setup);
1028
1029         spin_lock(&ctx->lock);
1030         ctx->count--;
1031         ctx->pending--;
1032
1033         /* queue must transfer and complete in fifo order, unless
1034          * usb_unlink_urb() is used to unlink something not at the
1035          * physical queue head (not tested).
1036          */
1037         if (subcase->number > 0) {
1038                 if ((subcase->number - ctx->last) != 1) {
1039                         ERROR(ctx->dev,
1040                                 "subcase %d completed out of order, last %d\n",
1041                                 subcase->number, ctx->last);
1042                         status = -EDOM;
1043                         ctx->last = subcase->number;
1044                         goto error;
1045                 }
1046         }
1047         ctx->last = subcase->number;
1048
1049         /* succeed or fault in only one way? */
1050         if (status == subcase->expected)
1051                 status = 0;
1052
1053         /* async unlink for cleanup? */
1054         else if (status != -ECONNRESET) {
1055
1056                 /* some faults are allowed, not required */
1057                 if (subcase->expected > 0 && (
1058                           ((status == -subcase->expected        /* happened */
1059                            || status == 0))))                   /* didn't */
1060                         status = 0;
1061                 /* sometimes more than one fault is allowed */
1062                 else if (subcase->number == 12 && status == -EPIPE)
1063                         status = 0;
1064                 else
1065                         ERROR(ctx->dev, "subtest %d error, status %d\n",
1066                                         subcase->number, status);
1067         }
1068
1069         /* unexpected status codes mean errors; ideally, in hardware */
1070         if (status) {
1071 error:
1072                 if (ctx->status == 0) {
1073                         int             i;
1074
1075                         ctx->status = status;
1076                         ERROR(ctx->dev, "control queue %02x.%02x, err %d, "
1077                                         "%d left, subcase %d, len %d/%d\n",
1078                                         reqp->bRequestType, reqp->bRequest,
1079                                         status, ctx->count, subcase->number,
1080                                         urb->actual_length,
1081                                         urb->transfer_buffer_length);
1082
1083                         /* FIXME this "unlink everything" exit route should
1084                          * be a separate test case.
1085                          */
1086
1087                         /* unlink whatever's still pending */
1088                         for (i = 1; i < ctx->param->sglen; i++) {
1089                                 struct urb *u = ctx->urb[
1090                                                         (i + subcase->number)
1091                                                         % ctx->param->sglen];
1092
1093                                 if (u == urb || !u->dev)
1094                                         continue;
1095                                 spin_unlock(&ctx->lock);
1096                                 status = usb_unlink_urb(u);
1097                                 spin_lock(&ctx->lock);
1098                                 switch (status) {
1099                                 case -EINPROGRESS:
1100                                 case -EBUSY:
1101                                 case -EIDRM:
1102                                         continue;
1103                                 default:
1104                                         ERROR(ctx->dev, "urb unlink --> %d\n",
1105                                                         status);
1106                                 }
1107                         }
1108                         status = ctx->status;
1109                 }
1110         }
1111
1112         /* resubmit if we need to, else mark this as done */
1113         if ((status == 0) && (ctx->pending < ctx->count)) {
1114                 status = usb_submit_urb(urb, GFP_ATOMIC);
1115                 if (status != 0) {
1116                         ERROR(ctx->dev,
1117                                 "can't resubmit ctrl %02x.%02x, err %d\n",
1118                                 reqp->bRequestType, reqp->bRequest, status);
1119                         urb->dev = NULL;
1120                 } else
1121                         ctx->pending++;
1122         } else
1123                 urb->dev = NULL;
1124
1125         /* signal completion when nothing's queued */
1126         if (ctx->pending == 0)
1127                 complete(&ctx->complete);
1128         spin_unlock(&ctx->lock);
1129 }
1130
1131 static int
1132 test_ctrl_queue(struct usbtest_dev *dev, struct usbtest_param *param)
1133 {
1134         struct usb_device       *udev = testdev_to_usbdev(dev);
1135         struct urb              **urb;
1136         struct ctrl_ctx         context;
1137         int                     i;
1138
1139         if (param->sglen == 0 || param->iterations > UINT_MAX / param->sglen)
1140                 return -EOPNOTSUPP;
1141
1142         spin_lock_init(&context.lock);
1143         context.dev = dev;
1144         init_completion(&context.complete);
1145         context.count = param->sglen * param->iterations;
1146         context.pending = 0;
1147         context.status = -ENOMEM;
1148         context.param = param;
1149         context.last = -1;
1150
1151         /* allocate and init the urbs we'll queue.
1152          * as with bulk/intr sglists, sglen is the queue depth; it also
1153          * controls which subtests run (more tests than sglen) or rerun.
1154          */
1155         urb = kcalloc(param->sglen, sizeof(struct urb *), GFP_KERNEL);
1156         if (!urb)
1157                 return -ENOMEM;
1158         for (i = 0; i < param->sglen; i++) {
1159                 int                     pipe = usb_rcvctrlpipe(udev, 0);
1160                 unsigned                len;
1161                 struct urb              *u;
1162                 struct usb_ctrlrequest  req;
1163                 struct subcase          *reqp;
1164
1165                 /* sign of this variable means:
1166                  *  -: tested code must return this (negative) error code
1167                  *  +: tested code may return this (negative too) error code
1168                  */
1169                 int                     expected = 0;
1170
1171                 /* requests here are mostly expected to succeed on any
1172                  * device, but some are chosen to trigger protocol stalls
1173                  * or short reads.
1174                  */
1175                 memset(&req, 0, sizeof(req));
1176                 req.bRequest = USB_REQ_GET_DESCRIPTOR;
1177                 req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
1178
1179                 switch (i % NUM_SUBCASES) {
1180                 case 0:         /* get device descriptor */
1181                         req.wValue = cpu_to_le16(USB_DT_DEVICE << 8);
1182                         len = sizeof(struct usb_device_descriptor);
1183                         break;
1184                 case 1:         /* get first config descriptor (only) */
1185                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1186                         len = sizeof(struct usb_config_descriptor);
1187                         break;
1188                 case 2:         /* get altsetting (OFTEN STALLS) */
1189                         req.bRequest = USB_REQ_GET_INTERFACE;
1190                         req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
1191                         /* index = 0 means first interface */
1192                         len = 1;
1193                         expected = EPIPE;
1194                         break;
1195                 case 3:         /* get interface status */
1196                         req.bRequest = USB_REQ_GET_STATUS;
1197                         req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
1198                         /* interface 0 */
1199                         len = 2;
1200                         break;
1201                 case 4:         /* get device status */
1202                         req.bRequest = USB_REQ_GET_STATUS;
1203                         req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
1204                         len = 2;
1205                         break;
1206                 case 5:         /* get device qualifier (MAY STALL) */
1207                         req.wValue = cpu_to_le16 (USB_DT_DEVICE_QUALIFIER << 8);
1208                         len = sizeof(struct usb_qualifier_descriptor);
1209                         if (udev->speed != USB_SPEED_HIGH)
1210                                 expected = EPIPE;
1211                         break;
1212                 case 6:         /* get first config descriptor, plus interface */
1213                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1214                         len = sizeof(struct usb_config_descriptor);
1215                         len += sizeof(struct usb_interface_descriptor);
1216                         break;
1217                 case 7:         /* get interface descriptor (ALWAYS STALLS) */
1218                         req.wValue = cpu_to_le16 (USB_DT_INTERFACE << 8);
1219                         /* interface == 0 */
1220                         len = sizeof(struct usb_interface_descriptor);
1221                         expected = -EPIPE;
1222                         break;
1223                 /* NOTE: two consecutive stalls in the queue here.
1224                  *  that tests fault recovery a bit more aggressively. */
1225                 case 8:         /* clear endpoint halt (MAY STALL) */
1226                         req.bRequest = USB_REQ_CLEAR_FEATURE;
1227                         req.bRequestType = USB_RECIP_ENDPOINT;
1228                         /* wValue 0 == ep halt */
1229                         /* wIndex 0 == ep0 (shouldn't halt!) */
1230                         len = 0;
1231                         pipe = usb_sndctrlpipe(udev, 0);
1232                         expected = EPIPE;
1233                         break;
1234                 case 9:         /* get endpoint status */
1235                         req.bRequest = USB_REQ_GET_STATUS;
1236                         req.bRequestType = USB_DIR_IN|USB_RECIP_ENDPOINT;
1237                         /* endpoint 0 */
1238                         len = 2;
1239                         break;
1240                 case 10:        /* trigger short read (EREMOTEIO) */
1241                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1242                         len = 1024;
1243                         expected = -EREMOTEIO;
1244                         break;
1245                 /* NOTE: two consecutive _different_ faults in the queue. */
1246                 case 11:        /* get endpoint descriptor (ALWAYS STALLS) */
1247                         req.wValue = cpu_to_le16(USB_DT_ENDPOINT << 8);
1248                         /* endpoint == 0 */
1249                         len = sizeof(struct usb_interface_descriptor);
1250                         expected = EPIPE;
1251                         break;
1252                 /* NOTE: sometimes even a third fault in the queue! */
1253                 case 12:        /* get string 0 descriptor (MAY STALL) */
1254                         req.wValue = cpu_to_le16(USB_DT_STRING << 8);
1255                         /* string == 0, for language IDs */
1256                         len = sizeof(struct usb_interface_descriptor);
1257                         /* may succeed when > 4 languages */
1258                         expected = EREMOTEIO;   /* or EPIPE, if no strings */
1259                         break;
1260                 case 13:        /* short read, resembling case 10 */
1261                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1262                         /* last data packet "should" be DATA1, not DATA0 */
1263                         if (udev->speed == USB_SPEED_SUPER)
1264                                 len = 1024 - 512;
1265                         else
1266                                 len = 1024 - udev->descriptor.bMaxPacketSize0;
1267                         expected = -EREMOTEIO;
1268                         break;
1269                 case 14:        /* short read; try to fill the last packet */
1270                         req.wValue = cpu_to_le16((USB_DT_DEVICE << 8) | 0);
1271                         /* device descriptor size == 18 bytes */
1272                         len = udev->descriptor.bMaxPacketSize0;
1273                         if (udev->speed == USB_SPEED_SUPER)
1274                                 len = 512;
1275                         switch (len) {
1276                         case 8:
1277                                 len = 24;
1278                                 break;
1279                         case 16:
1280                                 len = 32;
1281                                 break;
1282                         }
1283                         expected = -EREMOTEIO;
1284                         break;
1285                 case 15:
1286                         req.wValue = cpu_to_le16(USB_DT_BOS << 8);
1287                         if (udev->bos)
1288                                 len = le16_to_cpu(udev->bos->desc->wTotalLength);
1289                         else
1290                                 len = sizeof(struct usb_bos_descriptor);
1291                         if (le16_to_cpu(udev->descriptor.bcdUSB) < 0x0201)
1292                                 expected = -EPIPE;
1293                         break;
1294                 default:
1295                         ERROR(dev, "bogus number of ctrl queue testcases!\n");
1296                         context.status = -EINVAL;
1297                         goto cleanup;
1298                 }
1299                 req.wLength = cpu_to_le16(len);
1300                 urb[i] = u = simple_alloc_urb(udev, pipe, len, 0);
1301                 if (!u)
1302                         goto cleanup;
1303
1304                 reqp = kmalloc(sizeof(*reqp), GFP_KERNEL);
1305                 if (!reqp)
1306                         goto cleanup;
1307                 reqp->setup = req;
1308                 reqp->number = i % NUM_SUBCASES;
1309                 reqp->expected = expected;
1310                 u->setup_packet = (char *) &reqp->setup;
1311
1312                 u->context = &context;
1313                 u->complete = ctrl_complete;
1314         }
1315
1316         /* queue the urbs */
1317         context.urb = urb;
1318         spin_lock_irq(&context.lock);
1319         for (i = 0; i < param->sglen; i++) {
1320                 context.status = usb_submit_urb(urb[i], GFP_ATOMIC);
1321                 if (context.status != 0) {
1322                         ERROR(dev, "can't submit urb[%d], status %d\n",
1323                                         i, context.status);
1324                         context.count = context.pending;
1325                         break;
1326                 }
1327                 context.pending++;
1328         }
1329         spin_unlock_irq(&context.lock);
1330
1331         /* FIXME  set timer and time out; provide a disconnect hook */
1332
1333         /* wait for the last one to complete */
1334         if (context.pending > 0)
1335                 wait_for_completion(&context.complete);
1336
1337 cleanup:
1338         for (i = 0; i < param->sglen; i++) {
1339                 if (!urb[i])
1340                         continue;
1341                 urb[i]->dev = udev;
1342                 kfree(urb[i]->setup_packet);
1343                 simple_free_urb(urb[i]);
1344         }
1345         kfree(urb);
1346         return context.status;
1347 }
1348 #undef NUM_SUBCASES
1349
1350
1351 /*-------------------------------------------------------------------------*/
1352
1353 static void unlink1_callback(struct urb *urb)
1354 {
1355         int     status = urb->status;
1356
1357         /* we "know" -EPIPE (stall) never happens */
1358         if (!status)
1359                 status = usb_submit_urb(urb, GFP_ATOMIC);
1360         if (status) {
1361                 urb->status = status;
1362                 complete(urb->context);
1363         }
1364 }
1365
1366 static int unlink1(struct usbtest_dev *dev, int pipe, int size, int async)
1367 {
1368         struct urb              *urb;
1369         struct completion       completion;
1370         int                     retval = 0;
1371
1372         init_completion(&completion);
1373         urb = simple_alloc_urb(testdev_to_usbdev(dev), pipe, size, 0);
1374         if (!urb)
1375                 return -ENOMEM;
1376         urb->context = &completion;
1377         urb->complete = unlink1_callback;
1378
1379         if (usb_pipeout(urb->pipe)) {
1380                 simple_fill_buf(urb);
1381                 urb->transfer_flags |= URB_ZERO_PACKET;
1382         }
1383
1384         /* keep the endpoint busy.  there are lots of hc/hcd-internal
1385          * states, and testing should get to all of them over time.
1386          *
1387          * FIXME want additional tests for when endpoint is STALLing
1388          * due to errors, or is just NAKing requests.
1389          */
1390         retval = usb_submit_urb(urb, GFP_KERNEL);
1391         if (retval != 0) {
1392                 dev_err(&dev->intf->dev, "submit fail %d\n", retval);
1393                 return retval;
1394         }
1395
1396         /* unlinking that should always work.  variable delay tests more
1397          * hcd states and code paths, even with little other system load.
1398          */
1399         msleep(jiffies % (2 * INTERRUPT_RATE));
1400         if (async) {
1401                 while (!completion_done(&completion)) {
1402                         retval = usb_unlink_urb(urb);
1403
1404                         if (retval == 0 && usb_pipein(urb->pipe))
1405                                 retval = simple_check_buf(dev, urb);
1406
1407                         switch (retval) {
1408                         case -EBUSY:
1409                         case -EIDRM:
1410                                 /* we can't unlink urbs while they're completing
1411                                  * or if they've completed, and we haven't
1412                                  * resubmitted. "normal" drivers would prevent
1413                                  * resubmission, but since we're testing unlink
1414                                  * paths, we can't.
1415                                  */
1416                                 ERROR(dev, "unlink retry\n");
1417                                 continue;
1418                         case 0:
1419                         case -EINPROGRESS:
1420                                 break;
1421
1422                         default:
1423                                 dev_err(&dev->intf->dev,
1424                                         "unlink fail %d\n", retval);
1425                                 return retval;
1426                         }
1427
1428                         break;
1429                 }
1430         } else
1431                 usb_kill_urb(urb);
1432
1433         wait_for_completion(&completion);
1434         retval = urb->status;
1435         simple_free_urb(urb);
1436
1437         if (async)
1438                 return (retval == -ECONNRESET) ? 0 : retval - 1000;
1439         else
1440                 return (retval == -ENOENT || retval == -EPERM) ?
1441                                 0 : retval - 2000;
1442 }
1443
1444 static int unlink_simple(struct usbtest_dev *dev, int pipe, int len)
1445 {
1446         int                     retval = 0;
1447
1448         /* test sync and async paths */
1449         retval = unlink1(dev, pipe, len, 1);
1450         if (!retval)
1451                 retval = unlink1(dev, pipe, len, 0);
1452         return retval;
1453 }
1454
1455 /*-------------------------------------------------------------------------*/
1456
1457 struct queued_ctx {
1458         struct completion       complete;
1459         atomic_t                pending;
1460         unsigned                num;
1461         int                     status;
1462         struct urb              **urbs;
1463 };
1464
1465 static void unlink_queued_callback(struct urb *urb)
1466 {
1467         int                     status = urb->status;
1468         struct queued_ctx       *ctx = urb->context;
1469
1470         if (ctx->status)
1471                 goto done;
1472         if (urb == ctx->urbs[ctx->num - 4] || urb == ctx->urbs[ctx->num - 2]) {
1473                 if (status == -ECONNRESET)
1474                         goto done;
1475                 /* What error should we report if the URB completed normally? */
1476         }
1477         if (status != 0)
1478                 ctx->status = status;
1479
1480  done:
1481         if (atomic_dec_and_test(&ctx->pending))
1482                 complete(&ctx->complete);
1483 }
1484
1485 static int unlink_queued(struct usbtest_dev *dev, int pipe, unsigned num,
1486                 unsigned size)
1487 {
1488         struct queued_ctx       ctx;
1489         struct usb_device       *udev = testdev_to_usbdev(dev);
1490         void                    *buf;
1491         dma_addr_t              buf_dma;
1492         int                     i;
1493         int                     retval = -ENOMEM;
1494
1495         init_completion(&ctx.complete);
1496         atomic_set(&ctx.pending, 1);    /* One more than the actual value */
1497         ctx.num = num;
1498         ctx.status = 0;
1499
1500         buf = usb_alloc_coherent(udev, size, GFP_KERNEL, &buf_dma);
1501         if (!buf)
1502                 return retval;
1503         memset(buf, 0, size);
1504
1505         /* Allocate and init the urbs we'll queue */
1506         ctx.urbs = kcalloc(num, sizeof(struct urb *), GFP_KERNEL);
1507         if (!ctx.urbs)
1508                 goto free_buf;
1509         for (i = 0; i < num; i++) {
1510                 ctx.urbs[i] = usb_alloc_urb(0, GFP_KERNEL);
1511                 if (!ctx.urbs[i])
1512                         goto free_urbs;
1513                 usb_fill_bulk_urb(ctx.urbs[i], udev, pipe, buf, size,
1514                                 unlink_queued_callback, &ctx);
1515                 ctx.urbs[i]->transfer_dma = buf_dma;
1516                 ctx.urbs[i]->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
1517
1518                 if (usb_pipeout(ctx.urbs[i]->pipe)) {
1519                         simple_fill_buf(ctx.urbs[i]);
1520                         ctx.urbs[i]->transfer_flags |= URB_ZERO_PACKET;
1521                 }
1522         }
1523
1524         /* Submit all the URBs and then unlink URBs num - 4 and num - 2. */
1525         for (i = 0; i < num; i++) {
1526                 atomic_inc(&ctx.pending);
1527                 retval = usb_submit_urb(ctx.urbs[i], GFP_KERNEL);
1528                 if (retval != 0) {
1529                         dev_err(&dev->intf->dev, "submit urbs[%d] fail %d\n",
1530                                         i, retval);
1531                         atomic_dec(&ctx.pending);
1532                         ctx.status = retval;
1533                         break;
1534                 }
1535         }
1536         if (i == num) {
1537                 usb_unlink_urb(ctx.urbs[num - 4]);
1538                 usb_unlink_urb(ctx.urbs[num - 2]);
1539         } else {
1540                 while (--i >= 0)
1541                         usb_unlink_urb(ctx.urbs[i]);
1542         }
1543
1544         if (atomic_dec_and_test(&ctx.pending))          /* The extra count */
1545                 complete(&ctx.complete);
1546         wait_for_completion(&ctx.complete);
1547         retval = ctx.status;
1548
1549  free_urbs:
1550         for (i = 0; i < num; i++)
1551                 usb_free_urb(ctx.urbs[i]);
1552         kfree(ctx.urbs);
1553  free_buf:
1554         usb_free_coherent(udev, size, buf, buf_dma);
1555         return retval;
1556 }
1557
1558 /*-------------------------------------------------------------------------*/
1559
1560 static int verify_not_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
1561 {
1562         int     retval;
1563         u16     status;
1564
1565         /* shouldn't look or act halted */
1566         retval = usb_get_status(urb->dev, USB_RECIP_ENDPOINT, ep, &status);
1567         if (retval < 0) {
1568                 ERROR(tdev, "ep %02x couldn't get no-halt status, %d\n",
1569                                 ep, retval);
1570                 return retval;
1571         }
1572         if (status != 0) {
1573                 ERROR(tdev, "ep %02x bogus status: %04x != 0\n", ep, status);
1574                 return -EINVAL;
1575         }
1576         retval = simple_io(tdev, urb, 1, 0, 0, __func__);
1577         if (retval != 0)
1578                 return -EINVAL;
1579         return 0;
1580 }
1581
1582 static int verify_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
1583 {
1584         int     retval;
1585         u16     status;
1586
1587         /* should look and act halted */
1588         retval = usb_get_status(urb->dev, USB_RECIP_ENDPOINT, ep, &status);
1589         if (retval < 0) {
1590                 ERROR(tdev, "ep %02x couldn't get halt status, %d\n",
1591                                 ep, retval);
1592                 return retval;
1593         }
1594         if (status != 1) {
1595                 ERROR(tdev, "ep %02x bogus status: %04x != 1\n", ep, status);
1596                 return -EINVAL;
1597         }
1598         retval = simple_io(tdev, urb, 1, 0, -EPIPE, __func__);
1599         if (retval != -EPIPE)
1600                 return -EINVAL;
1601         retval = simple_io(tdev, urb, 1, 0, -EPIPE, "verify_still_halted");
1602         if (retval != -EPIPE)
1603                 return -EINVAL;
1604         return 0;
1605 }
1606
1607 static int test_halt(struct usbtest_dev *tdev, int ep, struct urb *urb)
1608 {
1609         int     retval;
1610
1611         /* shouldn't look or act halted now */
1612         retval = verify_not_halted(tdev, ep, urb);
1613         if (retval < 0)
1614                 return retval;
1615
1616         /* set halt (protocol test only), verify it worked */
1617         retval = usb_control_msg(urb->dev, usb_sndctrlpipe(urb->dev, 0),
1618                         USB_REQ_SET_FEATURE, USB_RECIP_ENDPOINT,
1619                         USB_ENDPOINT_HALT, ep,
1620                         NULL, 0, USB_CTRL_SET_TIMEOUT);
1621         if (retval < 0) {
1622                 ERROR(tdev, "ep %02x couldn't set halt, %d\n", ep, retval);
1623                 return retval;
1624         }
1625         retval = verify_halted(tdev, ep, urb);
1626         if (retval < 0) {
1627                 int ret;
1628
1629                 /* clear halt anyways, else further tests will fail */
1630                 ret = usb_clear_halt(urb->dev, urb->pipe);
1631                 if (ret)
1632                         ERROR(tdev, "ep %02x couldn't clear halt, %d\n",
1633                               ep, ret);
1634
1635                 return retval;
1636         }
1637
1638         /* clear halt (tests API + protocol), verify it worked */
1639         retval = usb_clear_halt(urb->dev, urb->pipe);
1640         if (retval < 0) {
1641                 ERROR(tdev, "ep %02x couldn't clear halt, %d\n", ep, retval);
1642                 return retval;
1643         }
1644         retval = verify_not_halted(tdev, ep, urb);
1645         if (retval < 0)
1646                 return retval;
1647
1648         /* NOTE:  could also verify SET_INTERFACE clear halts ... */
1649
1650         return 0;
1651 }
1652
1653 static int halt_simple(struct usbtest_dev *dev)
1654 {
1655         int                     ep;
1656         int                     retval = 0;
1657         struct urb              *urb;
1658         struct usb_device       *udev = testdev_to_usbdev(dev);
1659
1660         if (udev->speed == USB_SPEED_SUPER)
1661                 urb = simple_alloc_urb(udev, 0, 1024, 0);
1662         else
1663                 urb = simple_alloc_urb(udev, 0, 512, 0);
1664         if (urb == NULL)
1665                 return -ENOMEM;
1666
1667         if (dev->in_pipe) {
1668                 ep = usb_pipeendpoint(dev->in_pipe) | USB_DIR_IN;
1669                 urb->pipe = dev->in_pipe;
1670                 retval = test_halt(dev, ep, urb);
1671                 if (retval < 0)
1672                         goto done;
1673         }
1674
1675         if (dev->out_pipe) {
1676                 ep = usb_pipeendpoint(dev->out_pipe);
1677                 urb->pipe = dev->out_pipe;
1678                 retval = test_halt(dev, ep, urb);
1679         }
1680 done:
1681         simple_free_urb(urb);
1682         return retval;
1683 }
1684
1685 /*-------------------------------------------------------------------------*/
1686
1687 /* Control OUT tests use the vendor control requests from Intel's
1688  * USB 2.0 compliance test device:  write a buffer, read it back.
1689  *
1690  * Intel's spec only _requires_ that it work for one packet, which
1691  * is pretty weak.   Some HCDs place limits here; most devices will
1692  * need to be able to handle more than one OUT data packet.  We'll
1693  * try whatever we're told to try.
1694  */
1695 static int ctrl_out(struct usbtest_dev *dev,
1696                 unsigned count, unsigned length, unsigned vary, unsigned offset)
1697 {
1698         unsigned                i, j, len;
1699         int                     retval;
1700         u8                      *buf;
1701         char                    *what = "?";
1702         struct usb_device       *udev;
1703
1704         if (length < 1 || length > 0xffff || vary >= length)
1705                 return -EINVAL;
1706
1707         buf = kmalloc(length + offset, GFP_KERNEL);
1708         if (!buf)
1709                 return -ENOMEM;
1710
1711         buf += offset;
1712         udev = testdev_to_usbdev(dev);
1713         len = length;
1714         retval = 0;
1715
1716         /* NOTE:  hardware might well act differently if we pushed it
1717          * with lots back-to-back queued requests.
1718          */
1719         for (i = 0; i < count; i++) {
1720                 /* write patterned data */
1721                 for (j = 0; j < len; j++)
1722                         buf[j] = i + j;
1723                 retval = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
1724                                 0x5b, USB_DIR_OUT|USB_TYPE_VENDOR,
1725                                 0, 0, buf, len, USB_CTRL_SET_TIMEOUT);
1726                 if (retval != len) {
1727                         what = "write";
1728                         if (retval >= 0) {
1729                                 ERROR(dev, "ctrl_out, wlen %d (expected %d)\n",
1730                                                 retval, len);
1731                                 retval = -EBADMSG;
1732                         }
1733                         break;
1734                 }
1735
1736                 /* read it back -- assuming nothing intervened!!  */
1737                 retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
1738                                 0x5c, USB_DIR_IN|USB_TYPE_VENDOR,
1739                                 0, 0, buf, len, USB_CTRL_GET_TIMEOUT);
1740                 if (retval != len) {
1741                         what = "read";
1742                         if (retval >= 0) {
1743                                 ERROR(dev, "ctrl_out, rlen %d (expected %d)\n",
1744                                                 retval, len);
1745                                 retval = -EBADMSG;
1746                         }
1747                         break;
1748                 }
1749
1750                 /* fail if we can't verify */
1751                 for (j = 0; j < len; j++) {
1752                         if (buf[j] != (u8) (i + j)) {
1753                                 ERROR(dev, "ctrl_out, byte %d is %d not %d\n",
1754                                         j, buf[j], (u8) i + j);
1755                                 retval = -EBADMSG;
1756                                 break;
1757                         }
1758                 }
1759                 if (retval < 0) {
1760                         what = "verify";
1761                         break;
1762                 }
1763
1764                 len += vary;
1765
1766                 /* [real world] the "zero bytes IN" case isn't really used.
1767                  * hardware can easily trip up in this weird case, since its
1768                  * status stage is IN, not OUT like other ep0in transfers.
1769                  */
1770                 if (len > length)
1771                         len = realworld ? 1 : 0;
1772         }
1773
1774         if (retval < 0)
1775                 ERROR(dev, "ctrl_out %s failed, code %d, count %d\n",
1776                         what, retval, i);
1777
1778         kfree(buf - offset);
1779         return retval;
1780 }
1781
1782 /*-------------------------------------------------------------------------*/
1783
1784 /* ISO tests ... mimics common usage
1785  *  - buffer length is split into N packets (mostly maxpacket sized)
1786  *  - multi-buffers according to sglen
1787  */
1788
1789 struct iso_context {
1790         unsigned                count;
1791         unsigned                pending;
1792         spinlock_t              lock;
1793         struct completion       done;
1794         int                     submit_error;
1795         unsigned long           errors;
1796         unsigned long           packet_count;
1797         struct usbtest_dev      *dev;
1798 };
1799
1800 static void iso_callback(struct urb *urb)
1801 {
1802         struct iso_context      *ctx = urb->context;
1803
1804         spin_lock(&ctx->lock);
1805         ctx->count--;
1806
1807         ctx->packet_count += urb->number_of_packets;
1808         if (urb->error_count > 0)
1809                 ctx->errors += urb->error_count;
1810         else if (urb->status != 0)
1811                 ctx->errors += urb->number_of_packets;
1812         else if (urb->actual_length != urb->transfer_buffer_length)
1813                 ctx->errors++;
1814         else if (check_guard_bytes(ctx->dev, urb) != 0)
1815                 ctx->errors++;
1816
1817         if (urb->status == 0 && ctx->count > (ctx->pending - 1)
1818                         && !ctx->submit_error) {
1819                 int status = usb_submit_urb(urb, GFP_ATOMIC);
1820                 switch (status) {
1821                 case 0:
1822                         goto done;
1823                 default:
1824                         dev_err(&ctx->dev->intf->dev,
1825                                         "iso resubmit err %d\n",
1826                                         status);
1827                         /* FALLTHROUGH */
1828                 case -ENODEV:                   /* disconnected */
1829                 case -ESHUTDOWN:                /* endpoint disabled */
1830                         ctx->submit_error = 1;
1831                         break;
1832                 }
1833         }
1834
1835         ctx->pending--;
1836         if (ctx->pending == 0) {
1837                 if (ctx->errors)
1838                         dev_err(&ctx->dev->intf->dev,
1839                                 "iso test, %lu errors out of %lu\n",
1840                                 ctx->errors, ctx->packet_count);
1841                 complete(&ctx->done);
1842         }
1843 done:
1844         spin_unlock(&ctx->lock);
1845 }
1846
1847 static struct urb *iso_alloc_urb(
1848         struct usb_device       *udev,
1849         int                     pipe,
1850         struct usb_endpoint_descriptor  *desc,
1851         long                    bytes,
1852         unsigned offset
1853 )
1854 {
1855         struct urb              *urb;
1856         unsigned                i, maxp, packets;
1857
1858         if (bytes < 0 || !desc)
1859                 return NULL;
1860         maxp = 0x7ff & usb_endpoint_maxp(desc);
1861         maxp *= 1 + (0x3 & (usb_endpoint_maxp(desc) >> 11));
1862         packets = DIV_ROUND_UP(bytes, maxp);
1863
1864         urb = usb_alloc_urb(packets, GFP_KERNEL);
1865         if (!urb)
1866                 return urb;
1867         urb->dev = udev;
1868         urb->pipe = pipe;
1869
1870         urb->number_of_packets = packets;
1871         urb->transfer_buffer_length = bytes;
1872         urb->transfer_buffer = usb_alloc_coherent(udev, bytes + offset,
1873                                                         GFP_KERNEL,
1874                                                         &urb->transfer_dma);
1875         if (!urb->transfer_buffer) {
1876                 usb_free_urb(urb);
1877                 return NULL;
1878         }
1879         if (offset) {
1880                 memset(urb->transfer_buffer, GUARD_BYTE, offset);
1881                 urb->transfer_buffer += offset;
1882                 urb->transfer_dma += offset;
1883         }
1884         /* For inbound transfers use guard byte so that test fails if
1885                 data not correctly copied */
1886         memset(urb->transfer_buffer,
1887                         usb_pipein(urb->pipe) ? GUARD_BYTE : 0,
1888                         bytes);
1889
1890         for (i = 0; i < packets; i++) {
1891                 /* here, only the last packet will be short */
1892                 urb->iso_frame_desc[i].length = min((unsigned) bytes, maxp);
1893                 bytes -= urb->iso_frame_desc[i].length;
1894
1895                 urb->iso_frame_desc[i].offset = maxp * i;
1896         }
1897
1898         urb->complete = iso_callback;
1899         /* urb->context = SET BY CALLER */
1900         urb->interval = 1 << (desc->bInterval - 1);
1901         urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
1902         return urb;
1903 }
1904
1905 static int
1906 test_iso_queue(struct usbtest_dev *dev, struct usbtest_param *param,
1907                 int pipe, struct usb_endpoint_descriptor *desc, unsigned offset)
1908 {
1909         struct iso_context      context;
1910         struct usb_device       *udev;
1911         unsigned                i;
1912         unsigned long           packets = 0;
1913         int                     status = 0;
1914         struct urb              *urbs[10];      /* FIXME no limit */
1915
1916         if (param->sglen > 10)
1917                 return -EDOM;
1918
1919         memset(&context, 0, sizeof(context));
1920         context.count = param->iterations * param->sglen;
1921         context.dev = dev;
1922         init_completion(&context.done);
1923         spin_lock_init(&context.lock);
1924
1925         memset(urbs, 0, sizeof(urbs));
1926         udev = testdev_to_usbdev(dev);
1927         dev_info(&dev->intf->dev,
1928                 "... iso period %d %sframes, wMaxPacket %04x\n",
1929                 1 << (desc->bInterval - 1),
1930                 (udev->speed == USB_SPEED_HIGH) ? "micro" : "",
1931                 usb_endpoint_maxp(desc));
1932
1933         for (i = 0; i < param->sglen; i++) {
1934                 urbs[i] = iso_alloc_urb(udev, pipe, desc,
1935                                         param->length, offset);
1936                 if (!urbs[i]) {
1937                         status = -ENOMEM;
1938                         goto fail;
1939                 }
1940                 packets += urbs[i]->number_of_packets;
1941                 urbs[i]->context = &context;
1942         }
1943         packets *= param->iterations;
1944         dev_info(&dev->intf->dev,
1945                 "... total %lu msec (%lu packets)\n",
1946                 (packets * (1 << (desc->bInterval - 1)))
1947                         / ((udev->speed == USB_SPEED_HIGH) ? 8 : 1),
1948                 packets);
1949
1950         spin_lock_irq(&context.lock);
1951         for (i = 0; i < param->sglen; i++) {
1952                 ++context.pending;
1953                 status = usb_submit_urb(urbs[i], GFP_ATOMIC);
1954                 if (status < 0) {
1955                         ERROR(dev, "submit iso[%d], error %d\n", i, status);
1956                         if (i == 0) {
1957                                 spin_unlock_irq(&context.lock);
1958                                 goto fail;
1959                         }
1960
1961                         simple_free_urb(urbs[i]);
1962                         urbs[i] = NULL;
1963                         context.pending--;
1964                         context.submit_error = 1;
1965                         break;
1966                 }
1967         }
1968         spin_unlock_irq(&context.lock);
1969
1970         wait_for_completion(&context.done);
1971
1972         for (i = 0; i < param->sglen; i++) {
1973                 if (urbs[i])
1974                         simple_free_urb(urbs[i]);
1975         }
1976         /*
1977          * Isochronous transfers are expected to fail sometimes.  As an
1978          * arbitrary limit, we will report an error if any submissions
1979          * fail or if the transfer failure rate is > 10%.
1980          */
1981         if (status != 0)
1982                 ;
1983         else if (context.submit_error)
1984                 status = -EACCES;
1985         else if (context.errors > context.packet_count / 10)
1986                 status = -EIO;
1987         return status;
1988
1989 fail:
1990         for (i = 0; i < param->sglen; i++) {
1991                 if (urbs[i])
1992                         simple_free_urb(urbs[i]);
1993         }
1994         return status;
1995 }
1996
1997 static int test_unaligned_bulk(
1998         struct usbtest_dev *tdev,
1999         int pipe,
2000         unsigned length,
2001         int iterations,
2002         unsigned transfer_flags,
2003         const char *label)
2004 {
2005         int retval;
2006         struct urb *urb = usbtest_alloc_urb(
2007                 testdev_to_usbdev(tdev), pipe, length, transfer_flags, 1, 0);
2008
2009         if (!urb)
2010                 return -ENOMEM;
2011
2012         retval = simple_io(tdev, urb, iterations, 0, 0, label);
2013         simple_free_urb(urb);
2014         return retval;
2015 }
2016
2017 /*-------------------------------------------------------------------------*/
2018
2019 /* We only have this one interface to user space, through usbfs.
2020  * User mode code can scan usbfs to find N different devices (maybe on
2021  * different busses) to use when testing, and allocate one thread per
2022  * test.  So discovery is simplified, and we have no device naming issues.
2023  *
2024  * Don't use these only as stress/load tests.  Use them along with with
2025  * other USB bus activity:  plugging, unplugging, mousing, mp3 playback,
2026  * video capture, and so on.  Run different tests at different times, in
2027  * different sequences.  Nothing here should interact with other devices,
2028  * except indirectly by consuming USB bandwidth and CPU resources for test
2029  * threads and request completion.  But the only way to know that for sure
2030  * is to test when HC queues are in use by many devices.
2031  *
2032  * WARNING:  Because usbfs grabs udev->dev.sem before calling this ioctl(),
2033  * it locks out usbcore in certain code paths.  Notably, if you disconnect
2034  * the device-under-test, hub_wq will wait block forever waiting for the
2035  * ioctl to complete ... so that usb_disconnect() can abort the pending
2036  * urbs and then call usbtest_disconnect().  To abort a test, you're best
2037  * off just killing the userspace task and waiting for it to exit.
2038  */
2039
2040 static int
2041 usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
2042 {
2043         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2044         struct usb_device       *udev = testdev_to_usbdev(dev);
2045         struct usbtest_param    *param = buf;
2046         int                     retval = -EOPNOTSUPP;
2047         struct urb              *urb;
2048         struct scatterlist      *sg;
2049         struct usb_sg_request   req;
2050         struct timeval          start;
2051         unsigned                i;
2052
2053         /* FIXME USBDEVFS_CONNECTINFO doesn't say how fast the device is. */
2054
2055         pattern = mod_pattern;
2056
2057         if (code != USBTEST_REQUEST)
2058                 return -EOPNOTSUPP;
2059
2060         if (param->iterations <= 0)
2061                 return -EINVAL;
2062
2063         if (mutex_lock_interruptible(&dev->lock))
2064                 return -ERESTARTSYS;
2065
2066         /* FIXME: What if a system sleep starts while a test is running? */
2067
2068         /* some devices, like ez-usb default devices, need a non-default
2069          * altsetting to have any active endpoints.  some tests change
2070          * altsettings; force a default so most tests don't need to check.
2071          */
2072         if (dev->info->alt >= 0) {
2073                 int     res;
2074
2075                 if (intf->altsetting->desc.bInterfaceNumber) {
2076                         mutex_unlock(&dev->lock);
2077                         return -ENODEV;
2078                 }
2079                 res = set_altsetting(dev, dev->info->alt);
2080                 if (res) {
2081                         dev_err(&intf->dev,
2082                                         "set altsetting to %d failed, %d\n",
2083                                         dev->info->alt, res);
2084                         mutex_unlock(&dev->lock);
2085                         return res;
2086                 }
2087         }
2088
2089         /*
2090          * Just a bunch of test cases that every HCD is expected to handle.
2091          *
2092          * Some may need specific firmware, though it'd be good to have
2093          * one firmware image to handle all the test cases.
2094          *
2095          * FIXME add more tests!  cancel requests, verify the data, control
2096          * queueing, concurrent read+write threads, and so on.
2097          */
2098         do_gettimeofday(&start);
2099         switch (param->test_num) {
2100
2101         case 0:
2102                 dev_info(&intf->dev, "TEST 0:  NOP\n");
2103                 retval = 0;
2104                 break;
2105
2106         /* Simple non-queued bulk I/O tests */
2107         case 1:
2108                 if (dev->out_pipe == 0)
2109                         break;
2110                 dev_info(&intf->dev,
2111                                 "TEST 1:  write %d bytes %u times\n",
2112                                 param->length, param->iterations);
2113                 urb = simple_alloc_urb(udev, dev->out_pipe, param->length, 0);
2114                 if (!urb) {
2115                         retval = -ENOMEM;
2116                         break;
2117                 }
2118                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2119                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test1");
2120                 simple_free_urb(urb);
2121                 break;
2122         case 2:
2123                 if (dev->in_pipe == 0)
2124                         break;
2125                 dev_info(&intf->dev,
2126                                 "TEST 2:  read %d bytes %u times\n",
2127                                 param->length, param->iterations);
2128                 urb = simple_alloc_urb(udev, dev->in_pipe, param->length, 0);
2129                 if (!urb) {
2130                         retval = -ENOMEM;
2131                         break;
2132                 }
2133                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2134                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test2");
2135                 simple_free_urb(urb);
2136                 break;
2137         case 3:
2138                 if (dev->out_pipe == 0 || param->vary == 0)
2139                         break;
2140                 dev_info(&intf->dev,
2141                                 "TEST 3:  write/%d 0..%d bytes %u times\n",
2142                                 param->vary, param->length, param->iterations);
2143                 urb = simple_alloc_urb(udev, dev->out_pipe, param->length, 0);
2144                 if (!urb) {
2145                         retval = -ENOMEM;
2146                         break;
2147                 }
2148                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2149                 retval = simple_io(dev, urb, param->iterations, param->vary,
2150                                         0, "test3");
2151                 simple_free_urb(urb);
2152                 break;
2153         case 4:
2154                 if (dev->in_pipe == 0 || param->vary == 0)
2155                         break;
2156                 dev_info(&intf->dev,
2157                                 "TEST 4:  read/%d 0..%d bytes %u times\n",
2158                                 param->vary, param->length, param->iterations);
2159                 urb = simple_alloc_urb(udev, dev->in_pipe, param->length, 0);
2160                 if (!urb) {
2161                         retval = -ENOMEM;
2162                         break;
2163                 }
2164                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2165                 retval = simple_io(dev, urb, param->iterations, param->vary,
2166                                         0, "test4");
2167                 simple_free_urb(urb);
2168                 break;
2169
2170         /* Queued bulk I/O tests */
2171         case 5:
2172                 if (dev->out_pipe == 0 || param->sglen == 0)
2173                         break;
2174                 dev_info(&intf->dev,
2175                         "TEST 5:  write %d sglists %d entries of %d bytes\n",
2176                                 param->iterations,
2177                                 param->sglen, param->length);
2178                 sg = alloc_sglist(param->sglen, param->length, 0);
2179                 if (!sg) {
2180                         retval = -ENOMEM;
2181                         break;
2182                 }
2183                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2184                 retval = perform_sglist(dev, param->iterations, dev->out_pipe,
2185                                 &req, sg, param->sglen);
2186                 free_sglist(sg, param->sglen);
2187                 break;
2188
2189         case 6:
2190                 if (dev->in_pipe == 0 || param->sglen == 0)
2191                         break;
2192                 dev_info(&intf->dev,
2193                         "TEST 6:  read %d sglists %d entries of %d bytes\n",
2194                                 param->iterations,
2195                                 param->sglen, param->length);
2196                 sg = alloc_sglist(param->sglen, param->length, 0);
2197                 if (!sg) {
2198                         retval = -ENOMEM;
2199                         break;
2200                 }
2201                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2202                 retval = perform_sglist(dev, param->iterations, dev->in_pipe,
2203                                 &req, sg, param->sglen);
2204                 free_sglist(sg, param->sglen);
2205                 break;
2206         case 7:
2207                 if (dev->out_pipe == 0 || param->sglen == 0 || param->vary == 0)
2208                         break;
2209                 dev_info(&intf->dev,
2210                         "TEST 7:  write/%d %d sglists %d entries 0..%d bytes\n",
2211                                 param->vary, param->iterations,
2212                                 param->sglen, param->length);
2213                 sg = alloc_sglist(param->sglen, param->length, param->vary);
2214                 if (!sg) {
2215                         retval = -ENOMEM;
2216                         break;
2217                 }
2218                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2219                 retval = perform_sglist(dev, param->iterations, dev->out_pipe,
2220                                 &req, sg, param->sglen);
2221                 free_sglist(sg, param->sglen);
2222                 break;
2223         case 8:
2224                 if (dev->in_pipe == 0 || param->sglen == 0 || param->vary == 0)
2225                         break;
2226                 dev_info(&intf->dev,
2227                         "TEST 8:  read/%d %d sglists %d entries 0..%d bytes\n",
2228                                 param->vary, param->iterations,
2229                                 param->sglen, param->length);
2230                 sg = alloc_sglist(param->sglen, param->length, param->vary);
2231                 if (!sg) {
2232                         retval = -ENOMEM;
2233                         break;
2234                 }
2235                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2236                 retval = perform_sglist(dev, param->iterations, dev->in_pipe,
2237                                 &req, sg, param->sglen);
2238                 free_sglist(sg, param->sglen);
2239                 break;
2240
2241         /* non-queued sanity tests for control (chapter 9 subset) */
2242         case 9:
2243                 retval = 0;
2244                 dev_info(&intf->dev,
2245                         "TEST 9:  ch9 (subset) control tests, %d times\n",
2246                                 param->iterations);
2247                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2248                         retval = ch9_postconfig(dev);
2249                 if (retval)
2250                         dev_err(&intf->dev, "ch9 subset failed, "
2251                                         "iterations left %d\n", i);
2252                 break;
2253
2254         /* queued control messaging */
2255         case 10:
2256                 retval = 0;
2257                 dev_info(&intf->dev,
2258                                 "TEST 10:  queue %d control calls, %d times\n",
2259                                 param->sglen,
2260                                 param->iterations);
2261                 retval = test_ctrl_queue(dev, param);
2262                 break;
2263
2264         /* simple non-queued unlinks (ring with one urb) */
2265         case 11:
2266                 if (dev->in_pipe == 0 || !param->length)
2267                         break;
2268                 retval = 0;
2269                 dev_info(&intf->dev, "TEST 11:  unlink %d reads of %d\n",
2270                                 param->iterations, param->length);
2271                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2272                         retval = unlink_simple(dev, dev->in_pipe,
2273                                                 param->length);
2274                 if (retval)
2275                         dev_err(&intf->dev, "unlink reads failed %d, "
2276                                 "iterations left %d\n", retval, i);
2277                 break;
2278         case 12:
2279                 if (dev->out_pipe == 0 || !param->length)
2280                         break;
2281                 retval = 0;
2282                 dev_info(&intf->dev, "TEST 12:  unlink %d writes of %d\n",
2283                                 param->iterations, param->length);
2284                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2285                         retval = unlink_simple(dev, dev->out_pipe,
2286                                                 param->length);
2287                 if (retval)
2288                         dev_err(&intf->dev, "unlink writes failed %d, "
2289                                 "iterations left %d\n", retval, i);
2290                 break;
2291
2292         /* ep halt tests */
2293         case 13:
2294                 if (dev->out_pipe == 0 && dev->in_pipe == 0)
2295                         break;
2296                 retval = 0;
2297                 dev_info(&intf->dev, "TEST 13:  set/clear %d halts\n",
2298                                 param->iterations);
2299                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2300                         retval = halt_simple(dev);
2301
2302                 if (retval)
2303                         ERROR(dev, "halts failed, iterations left %d\n", i);
2304                 break;
2305
2306         /* control write tests */
2307         case 14:
2308                 if (!dev->info->ctrl_out)
2309                         break;
2310                 dev_info(&intf->dev, "TEST 14:  %d ep0out, %d..%d vary %d\n",
2311                                 param->iterations,
2312                                 realworld ? 1 : 0, param->length,
2313                                 param->vary);
2314                 retval = ctrl_out(dev, param->iterations,
2315                                 param->length, param->vary, 0);
2316                 break;
2317
2318         /* iso write tests */
2319         case 15:
2320                 if (dev->out_iso_pipe == 0 || param->sglen == 0)
2321                         break;
2322                 dev_info(&intf->dev,
2323                         "TEST 15:  write %d iso, %d entries of %d bytes\n",
2324                                 param->iterations,
2325                                 param->sglen, param->length);
2326                 /* FIRMWARE:  iso sink */
2327                 retval = test_iso_queue(dev, param,
2328                                 dev->out_iso_pipe, dev->iso_out, 0);
2329                 break;
2330
2331         /* iso read tests */
2332         case 16:
2333                 if (dev->in_iso_pipe == 0 || param->sglen == 0)
2334                         break;
2335                 dev_info(&intf->dev,
2336                         "TEST 16:  read %d iso, %d entries of %d bytes\n",
2337                                 param->iterations,
2338                                 param->sglen, param->length);
2339                 /* FIRMWARE:  iso source */
2340                 retval = test_iso_queue(dev, param,
2341                                 dev->in_iso_pipe, dev->iso_in, 0);
2342                 break;
2343
2344         /* FIXME scatterlist cancel (needs helper thread) */
2345
2346         /* Tests for bulk I/O using DMA mapping by core and odd address */
2347         case 17:
2348                 if (dev->out_pipe == 0)
2349                         break;
2350                 dev_info(&intf->dev,
2351                         "TEST 17:  write odd addr %d bytes %u times core map\n",
2352                         param->length, param->iterations);
2353
2354                 retval = test_unaligned_bulk(
2355                                 dev, dev->out_pipe,
2356                                 param->length, param->iterations,
2357                                 0, "test17");
2358                 break;
2359
2360         case 18:
2361                 if (dev->in_pipe == 0)
2362                         break;
2363                 dev_info(&intf->dev,
2364                         "TEST 18:  read odd addr %d bytes %u times core map\n",
2365                         param->length, param->iterations);
2366
2367                 retval = test_unaligned_bulk(
2368                                 dev, dev->in_pipe,
2369                                 param->length, param->iterations,
2370                                 0, "test18");
2371                 break;
2372
2373         /* Tests for bulk I/O using premapped coherent buffer and odd address */
2374         case 19:
2375                 if (dev->out_pipe == 0)
2376                         break;
2377                 dev_info(&intf->dev,
2378                         "TEST 19:  write odd addr %d bytes %u times premapped\n",
2379                         param->length, param->iterations);
2380
2381                 retval = test_unaligned_bulk(
2382                                 dev, dev->out_pipe,
2383                                 param->length, param->iterations,
2384                                 URB_NO_TRANSFER_DMA_MAP, "test19");
2385                 break;
2386
2387         case 20:
2388                 if (dev->in_pipe == 0)
2389                         break;
2390                 dev_info(&intf->dev,
2391                         "TEST 20:  read odd addr %d bytes %u times premapped\n",
2392                         param->length, param->iterations);
2393
2394                 retval = test_unaligned_bulk(
2395                                 dev, dev->in_pipe,
2396                                 param->length, param->iterations,
2397                                 URB_NO_TRANSFER_DMA_MAP, "test20");
2398                 break;
2399
2400         /* control write tests with unaligned buffer */
2401         case 21:
2402                 if (!dev->info->ctrl_out)
2403                         break;
2404                 dev_info(&intf->dev,
2405                                 "TEST 21:  %d ep0out odd addr, %d..%d vary %d\n",
2406                                 param->iterations,
2407                                 realworld ? 1 : 0, param->length,
2408                                 param->vary);
2409                 retval = ctrl_out(dev, param->iterations,
2410                                 param->length, param->vary, 1);
2411                 break;
2412
2413         /* unaligned iso tests */
2414         case 22:
2415                 if (dev->out_iso_pipe == 0 || param->sglen == 0)
2416                         break;
2417                 dev_info(&intf->dev,
2418                         "TEST 22:  write %d iso odd, %d entries of %d bytes\n",
2419                                 param->iterations,
2420                                 param->sglen, param->length);
2421                 retval = test_iso_queue(dev, param,
2422                                 dev->out_iso_pipe, dev->iso_out, 1);
2423                 break;
2424
2425         case 23:
2426                 if (dev->in_iso_pipe == 0 || param->sglen == 0)
2427                         break;
2428                 dev_info(&intf->dev,
2429                         "TEST 23:  read %d iso odd, %d entries of %d bytes\n",
2430                                 param->iterations,
2431                                 param->sglen, param->length);
2432                 retval = test_iso_queue(dev, param,
2433                                 dev->in_iso_pipe, dev->iso_in, 1);
2434                 break;
2435
2436         /* unlink URBs from a bulk-OUT queue */
2437         case 24:
2438                 if (dev->out_pipe == 0 || !param->length || param->sglen < 4)
2439                         break;
2440                 retval = 0;
2441                 dev_info(&intf->dev, "TEST 24:  unlink from %d queues of "
2442                                 "%d %d-byte writes\n",
2443                                 param->iterations, param->sglen, param->length);
2444                 for (i = param->iterations; retval == 0 && i > 0; --i) {
2445                         retval = unlink_queued(dev, dev->out_pipe,
2446                                                 param->sglen, param->length);
2447                         if (retval) {
2448                                 dev_err(&intf->dev,
2449                                         "unlink queued writes failed %d, "
2450                                         "iterations left %d\n", retval, i);
2451                                 break;
2452                         }
2453                 }
2454                 break;
2455
2456         /* Simple non-queued interrupt I/O tests */
2457         case 25:
2458                 if (dev->out_int_pipe == 0)
2459                         break;
2460                 dev_info(&intf->dev,
2461                                 "TEST 25: write %d bytes %u times\n",
2462                                 param->length, param->iterations);
2463                 urb = simple_alloc_urb(udev, dev->out_int_pipe, param->length,
2464                                 dev->int_out->bInterval);
2465                 if (!urb) {
2466                         retval = -ENOMEM;
2467                         break;
2468                 }
2469                 /* FIRMWARE: interrupt sink (maybe accepts short writes) */
2470                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test25");
2471                 simple_free_urb(urb);
2472                 break;
2473         case 26:
2474                 if (dev->in_int_pipe == 0)
2475                         break;
2476                 dev_info(&intf->dev,
2477                                 "TEST 26: read %d bytes %u times\n",
2478                                 param->length, param->iterations);
2479                 urb = simple_alloc_urb(udev, dev->in_int_pipe, param->length,
2480                                 dev->int_in->bInterval);
2481                 if (!urb) {
2482                         retval = -ENOMEM;
2483                         break;
2484                 }
2485                 /* FIRMWARE: interrupt source (maybe generates short writes) */
2486                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test26");
2487                 simple_free_urb(urb);
2488                 break;
2489         }
2490         do_gettimeofday(&param->duration);
2491         param->duration.tv_sec -= start.tv_sec;
2492         param->duration.tv_usec -= start.tv_usec;
2493         if (param->duration.tv_usec < 0) {
2494                 param->duration.tv_usec += 1000 * 1000;
2495                 param->duration.tv_sec -= 1;
2496         }
2497         mutex_unlock(&dev->lock);
2498         return retval;
2499 }
2500
2501 /*-------------------------------------------------------------------------*/
2502
2503 static unsigned force_interrupt;
2504 module_param(force_interrupt, uint, 0);
2505 MODULE_PARM_DESC(force_interrupt, "0 = test default; else interrupt");
2506
2507 #ifdef  GENERIC
2508 static unsigned short vendor;
2509 module_param(vendor, ushort, 0);
2510 MODULE_PARM_DESC(vendor, "vendor code (from usb-if)");
2511
2512 static unsigned short product;
2513 module_param(product, ushort, 0);
2514 MODULE_PARM_DESC(product, "product code (from vendor)");
2515 #endif
2516
2517 static int
2518 usbtest_probe(struct usb_interface *intf, const struct usb_device_id *id)
2519 {
2520         struct usb_device       *udev;
2521         struct usbtest_dev      *dev;
2522         struct usbtest_info     *info;
2523         char                    *rtest, *wtest;
2524         char                    *irtest, *iwtest;
2525         char                    *intrtest, *intwtest;
2526
2527         udev = interface_to_usbdev(intf);
2528
2529 #ifdef  GENERIC
2530         /* specify devices by module parameters? */
2531         if (id->match_flags == 0) {
2532                 /* vendor match required, product match optional */
2533                 if (!vendor || le16_to_cpu(udev->descriptor.idVendor) != (u16)vendor)
2534                         return -ENODEV;
2535                 if (product && le16_to_cpu(udev->descriptor.idProduct) != (u16)product)
2536                         return -ENODEV;
2537                 dev_info(&intf->dev, "matched module params, "
2538                                         "vend=0x%04x prod=0x%04x\n",
2539                                 le16_to_cpu(udev->descriptor.idVendor),
2540                                 le16_to_cpu(udev->descriptor.idProduct));
2541         }
2542 #endif
2543
2544         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
2545         if (!dev)
2546                 return -ENOMEM;
2547         info = (struct usbtest_info *) id->driver_info;
2548         dev->info = info;
2549         mutex_init(&dev->lock);
2550
2551         dev->intf = intf;
2552
2553         /* cacheline-aligned scratch for i/o */
2554         dev->buf = kmalloc(TBUF_SIZE, GFP_KERNEL);
2555         if (dev->buf == NULL) {
2556                 kfree(dev);
2557                 return -ENOMEM;
2558         }
2559
2560         /* NOTE this doesn't yet test the handful of difference that are
2561          * visible with high speed interrupts:  bigger maxpacket (1K) and
2562          * "high bandwidth" modes (up to 3 packets/uframe).
2563          */
2564         rtest = wtest = "";
2565         irtest = iwtest = "";
2566         intrtest = intwtest = "";
2567         if (force_interrupt || udev->speed == USB_SPEED_LOW) {
2568                 if (info->ep_in) {
2569                         dev->in_pipe = usb_rcvintpipe(udev, info->ep_in);
2570                         rtest = " intr-in";
2571                 }
2572                 if (info->ep_out) {
2573                         dev->out_pipe = usb_sndintpipe(udev, info->ep_out);
2574                         wtest = " intr-out";
2575                 }
2576         } else {
2577                 if (override_alt >= 0 || info->autoconf) {
2578                         int status;
2579
2580                         status = get_endpoints(dev, intf);
2581                         if (status < 0) {
2582                                 WARNING(dev, "couldn't get endpoints, %d\n",
2583                                                 status);
2584                                 kfree(dev->buf);
2585                                 kfree(dev);
2586                                 return status;
2587                         }
2588                         /* may find bulk or ISO pipes */
2589                 } else {
2590                         if (info->ep_in)
2591                                 dev->in_pipe = usb_rcvbulkpipe(udev,
2592                                                         info->ep_in);
2593                         if (info->ep_out)
2594                                 dev->out_pipe = usb_sndbulkpipe(udev,
2595                                                         info->ep_out);
2596                 }
2597                 if (dev->in_pipe)
2598                         rtest = " bulk-in";
2599                 if (dev->out_pipe)
2600                         wtest = " bulk-out";
2601                 if (dev->in_iso_pipe)
2602                         irtest = " iso-in";
2603                 if (dev->out_iso_pipe)
2604                         iwtest = " iso-out";
2605                 if (dev->in_int_pipe)
2606                         intrtest = " int-in";
2607                 if (dev->out_int_pipe)
2608                         intwtest = " int-out";
2609         }
2610
2611         usb_set_intfdata(intf, dev);
2612         dev_info(&intf->dev, "%s\n", info->name);
2613         dev_info(&intf->dev, "%s {control%s%s%s%s%s%s%s} tests%s\n",
2614                         usb_speed_string(udev->speed),
2615                         info->ctrl_out ? " in/out" : "",
2616                         rtest, wtest,
2617                         irtest, iwtest,
2618                         intrtest, intwtest,
2619                         info->alt >= 0 ? " (+alt)" : "");
2620         return 0;
2621 }
2622
2623 static int usbtest_suspend(struct usb_interface *intf, pm_message_t message)
2624 {
2625         return 0;
2626 }
2627
2628 static int usbtest_resume(struct usb_interface *intf)
2629 {
2630         return 0;
2631 }
2632
2633
2634 static void usbtest_disconnect(struct usb_interface *intf)
2635 {
2636         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2637
2638         usb_set_intfdata(intf, NULL);
2639         dev_dbg(&intf->dev, "disconnect\n");
2640         kfree(dev);
2641 }
2642
2643 /* Basic testing only needs a device that can source or sink bulk traffic.
2644  * Any device can test control transfers (default with GENERIC binding).
2645  *
2646  * Several entries work with the default EP0 implementation that's built
2647  * into EZ-USB chips.  There's a default vendor ID which can be overridden
2648  * by (very) small config EEPROMS, but otherwise all these devices act
2649  * identically until firmware is loaded:  only EP0 works.  It turns out
2650  * to be easy to make other endpoints work, without modifying that EP0
2651  * behavior.  For now, we expect that kind of firmware.
2652  */
2653
2654 /* an21xx or fx versions of ez-usb */
2655 static struct usbtest_info ez1_info = {
2656         .name           = "EZ-USB device",
2657         .ep_in          = 2,
2658         .ep_out         = 2,
2659         .alt            = 1,
2660 };
2661
2662 /* fx2 version of ez-usb */
2663 static struct usbtest_info ez2_info = {
2664         .name           = "FX2 device",
2665         .ep_in          = 6,
2666         .ep_out         = 2,
2667         .alt            = 1,
2668 };
2669
2670 /* ezusb family device with dedicated usb test firmware,
2671  */
2672 static struct usbtest_info fw_info = {
2673         .name           = "usb test device",
2674         .ep_in          = 2,
2675         .ep_out         = 2,
2676         .alt            = 1,
2677         .autoconf       = 1,            /* iso and ctrl_out need autoconf */
2678         .ctrl_out       = 1,
2679         .iso            = 1,            /* iso_ep's are #8 in/out */
2680 };
2681
2682 /* peripheral running Linux and 'zero.c' test firmware, or
2683  * its user-mode cousin. different versions of this use
2684  * different hardware with the same vendor/product codes.
2685  * host side MUST rely on the endpoint descriptors.
2686  */
2687 static struct usbtest_info gz_info = {
2688         .name           = "Linux gadget zero",
2689         .autoconf       = 1,
2690         .ctrl_out       = 1,
2691         .iso            = 1,
2692         .intr           = 1,
2693         .alt            = 0,
2694 };
2695
2696 static struct usbtest_info um_info = {
2697         .name           = "Linux user mode test driver",
2698         .autoconf       = 1,
2699         .alt            = -1,
2700 };
2701
2702 static struct usbtest_info um2_info = {
2703         .name           = "Linux user mode ISO test driver",
2704         .autoconf       = 1,
2705         .iso            = 1,
2706         .alt            = -1,
2707 };
2708
2709 #ifdef IBOT2
2710 /* this is a nice source of high speed bulk data;
2711  * uses an FX2, with firmware provided in the device
2712  */
2713 static struct usbtest_info ibot2_info = {
2714         .name           = "iBOT2 webcam",
2715         .ep_in          = 2,
2716         .alt            = -1,
2717 };
2718 #endif
2719
2720 #ifdef GENERIC
2721 /* we can use any device to test control traffic */
2722 static struct usbtest_info generic_info = {
2723         .name           = "Generic USB device",
2724         .alt            = -1,
2725 };
2726 #endif
2727
2728
2729 static const struct usb_device_id id_table[] = {
2730
2731         /*-------------------------------------------------------------*/
2732
2733         /* EZ-USB devices which download firmware to replace (or in our
2734          * case augment) the default device implementation.
2735          */
2736
2737         /* generic EZ-USB FX controller */
2738         { USB_DEVICE(0x0547, 0x2235),
2739                 .driver_info = (unsigned long) &ez1_info,
2740         },
2741
2742         /* CY3671 development board with EZ-USB FX */
2743         { USB_DEVICE(0x0547, 0x0080),
2744                 .driver_info = (unsigned long) &ez1_info,
2745         },
2746
2747         /* generic EZ-USB FX2 controller (or development board) */
2748         { USB_DEVICE(0x04b4, 0x8613),
2749                 .driver_info = (unsigned long) &ez2_info,
2750         },
2751
2752         /* re-enumerated usb test device firmware */
2753         { USB_DEVICE(0xfff0, 0xfff0),
2754                 .driver_info = (unsigned long) &fw_info,
2755         },
2756
2757         /* "Gadget Zero" firmware runs under Linux */
2758         { USB_DEVICE(0x0525, 0xa4a0),
2759                 .driver_info = (unsigned long) &gz_info,
2760         },
2761
2762         /* so does a user-mode variant */
2763         { USB_DEVICE(0x0525, 0xa4a4),
2764                 .driver_info = (unsigned long) &um_info,
2765         },
2766
2767         /* ... and a user-mode variant that talks iso */
2768         { USB_DEVICE(0x0525, 0xa4a3),
2769                 .driver_info = (unsigned long) &um2_info,
2770         },
2771
2772 #ifdef KEYSPAN_19Qi
2773         /* Keyspan 19qi uses an21xx (original EZ-USB) */
2774         /* this does not coexist with the real Keyspan 19qi driver! */
2775         { USB_DEVICE(0x06cd, 0x010b),
2776                 .driver_info = (unsigned long) &ez1_info,
2777         },
2778 #endif
2779
2780         /*-------------------------------------------------------------*/
2781
2782 #ifdef IBOT2
2783         /* iBOT2 makes a nice source of high speed bulk-in data */
2784         /* this does not coexist with a real iBOT2 driver! */
2785         { USB_DEVICE(0x0b62, 0x0059),
2786                 .driver_info = (unsigned long) &ibot2_info,
2787         },
2788 #endif
2789
2790         /*-------------------------------------------------------------*/
2791
2792 #ifdef GENERIC
2793         /* module params can specify devices to use for control tests */
2794         { .driver_info = (unsigned long) &generic_info, },
2795 #endif
2796
2797         /*-------------------------------------------------------------*/
2798
2799         { }
2800 };
2801 MODULE_DEVICE_TABLE(usb, id_table);
2802
2803 static struct usb_driver usbtest_driver = {
2804         .name =         "usbtest",
2805         .id_table =     id_table,
2806         .probe =        usbtest_probe,
2807         .unlocked_ioctl = usbtest_ioctl,
2808         .disconnect =   usbtest_disconnect,
2809         .suspend =      usbtest_suspend,
2810         .resume =       usbtest_resume,
2811 };
2812
2813 /*-------------------------------------------------------------------------*/
2814
2815 static int __init usbtest_init(void)
2816 {
2817 #ifdef GENERIC
2818         if (vendor)
2819                 pr_debug("params: vend=0x%04x prod=0x%04x\n", vendor, product);
2820 #endif
2821         return usb_register(&usbtest_driver);
2822 }
2823 module_init(usbtest_init);
2824
2825 static void __exit usbtest_exit(void)
2826 {
2827         usb_deregister(&usbtest_driver);
2828 }
2829 module_exit(usbtest_exit);
2830
2831 MODULE_DESCRIPTION("USB Core/HCD Testing Driver");
2832 MODULE_LICENSE("GPL");
2833