kernel/drivers/usb/misc/usbtest.c

   1 #include <linux/kernel.h>
   2 #include <linux/errno.h>
   3 #include <linux/init.h>
   4 #include <linux/slab.h>
   5 #include <linux/mm.h>
   6 #include <linux/module.h>
   7 #include <linux/moduleparam.h>
   8 #include <linux/scatterlist.h>
   9 #include <linux/mutex.h>
  10 #include <linux/timer.h>
  11 #include <linux/usb.h>
  12
  13 #define SIMPLE_IO_TIMEOUT       10000   /* in milliseconds */
  14
  15 /*-------------------------------------------------------------------------*/
  16
  17 static int override_alt = -1;
  18 module_param_named(alt, override_alt, int, 0644);
  19 MODULE_PARM_DESC(alt, ">= 0 to override altsetting selection");
  20 static void complicated_callback(struct urb *urb);
  21
  22 /*-------------------------------------------------------------------------*/
  23
  24 /* FIXME make these public somewhere; usbdevfs.h? */
  25 struct usbtest_param {
  26         /* inputs */
  27         unsigned                test_num;       /* 0..(TEST_CASES-1) */
  28         unsigned                iterations;
  29         unsigned                length;
  30         unsigned                vary;
  31         unsigned                sglen;
  32
  33         /* outputs */
  34         struct timeval          duration;
  35 };
  36 #define USBTEST_REQUEST _IOWR('U', 100, struct usbtest_param)
  37
  38 /*-------------------------------------------------------------------------*/
  39
  40 #define GENERIC         /* let probe() bind using module params */
  41
  42 /* Some devices that can be used for testing will have "real" drivers.
  43  * Entries for those need to be enabled here by hand, after disabling
  44  * that "real" driver.
  45  */
  46 //#define       IBOT2           /* grab iBOT2 webcams */
  47 //#define       KEYSPAN_19Qi    /* grab un-renumerated serial adapter */
  48
  49 /*-------------------------------------------------------------------------*/
  50
  51 struct usbtest_info {
  52         const char              *name;
  53         u8                      ep_in;          /* bulk/intr source */
  54         u8                      ep_out;         /* bulk/intr sink */
  55         unsigned                autoconf:1;
  56         unsigned                ctrl_out:1;
  57         unsigned                iso:1;          /* try iso in/out */
  58         unsigned                intr:1;         /* try interrupt in/out */
  59         int                     alt;
  60 };
  61
  62 /* this is accessed only through usbfs ioctl calls.
  63  * one ioctl to issue a test ... one lock per device.
  64  * tests create other threads if they need them.
  65  * urbs and buffers are allocated dynamically,
  66  * and data generated deterministically.
  67  */
  68 struct usbtest_dev {
  69         struct usb_interface    *intf;
  70         struct usbtest_info     *info;
  71         int                     in_pipe;
  72         int                     out_pipe;
  73         int                     in_iso_pipe;
  74         int                     out_iso_pipe;
  75         int                     in_int_pipe;
  76         int                     out_int_pipe;
  77         struct usb_endpoint_descriptor  *iso_in, *iso_out;
  78         struct usb_endpoint_descriptor  *int_in, *int_out;
  79         struct mutex            lock;
  80
  81 #define TBUF_SIZE       256
  82         u8                      *buf;
  83 };
  84
  85 static struct usb_device *testdev_to_usbdev(struct usbtest_dev *test)
  86 {
  87         return interface_to_usbdev(test->intf);
  88 }
  89
  90 /* set up all urbs so they can be used with either bulk or interrupt */
  91 #define INTERRUPT_RATE          1       /* msec/transfer */
  92
  93 #define ERROR(tdev, fmt, args...) \
  94         dev_err(&(tdev)->intf->dev , fmt , ## args)
  95 #define WARNING(tdev, fmt, args...) \
  96         dev_warn(&(tdev)->intf->dev , fmt , ## args)
  97
  98 #define GUARD_BYTE      0xA5
  99 #define MAX_SGLEN       128
 100
 101 /*-------------------------------------------------------------------------*/
 102
 103 static int
 104 get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf)
 105 {
 106         int                             tmp;
 107         struct usb_host_interface       *alt;
 108         struct usb_host_endpoint        *in, *out;
 109         struct usb_host_endpoint        *iso_in, *iso_out;
 110         struct usb_host_endpoint        *int_in, *int_out;
 111         struct usb_device               *udev;
 112
 113         for (tmp = 0; tmp < intf->num_altsetting; tmp++) {
 114                 unsigned        ep;
 115
 116                 in = out = NULL;
 117                 iso_in = iso_out = NULL;
 118                 int_in = int_out = NULL;
 119                 alt = intf->altsetting + tmp;
 120
 121                 if (override_alt >= 0 &&
 122                                 override_alt != alt->desc.bAlternateSetting)
 123                         continue;
 124
 125                 /* take the first altsetting with in-bulk + out-bulk;
 126                  * ignore other endpoints and altsettings.
 127                  */
 128                 for (ep = 0; ep < alt->desc.bNumEndpoints; ep++) {
 129                         struct usb_host_endpoint        *e;
 130
 131                         e = alt->endpoint + ep;
 132                         switch (usb_endpoint_type(&e->desc)) {
 133                         case USB_ENDPOINT_XFER_BULK:
 134                                 break;
 135                         case USB_ENDPOINT_XFER_INT:
 136                                 if (dev->info->intr)
 137                                         goto try_intr;
 138                         case USB_ENDPOINT_XFER_ISOC:
 139                                 if (dev->info->iso)
 140                                         goto try_iso;
 141                                 /* FALLTHROUGH */
 142                         default:
 143                                 continue;
 144                         }
 145                         if (usb_endpoint_dir_in(&e->desc)) {
 146                                 if (!in)
 147                                         in = e;
 148                         } else {
 149                                 if (!out)
 150                                         out = e;
 151                         }
 152                         continue;
 153 try_intr:
 154                         if (usb_endpoint_dir_in(&e->desc)) {
 155                                 if (!int_in)
 156                                         int_in = e;
 157                         } else {
 158                                 if (!int_out)
 159                                         int_out = e;
 160                         }
 161                         continue;
 162 try_iso:
 163                         if (usb_endpoint_dir_in(&e->desc)) {
 164                                 if (!iso_in)
 165                                         iso_in = e;
 166                         } else {
 167                                 if (!iso_out)
 168                                         iso_out = e;
 169                         }
 170                 }
 171                 if ((in && out)  ||  iso_in || iso_out || int_in || int_out)
 172                         goto found;
 173         }
 174         return -EINVAL;
 175
 176 found:
 177         udev = testdev_to_usbdev(dev);
 178         dev->info->alt = alt->desc.bAlternateSetting;
 179         if (alt->desc.bAlternateSetting != 0) {
 180                 tmp = usb_set_interface(udev,
 181                                 alt->desc.bInterfaceNumber,
 182                                 alt->desc.bAlternateSetting);
 183                 if (tmp < 0)
 184                         return tmp;
 185         }
 186
 187         if (in) {
 188                 dev->in_pipe = usb_rcvbulkpipe(udev,
 189                         in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
 190                 dev->out_pipe = usb_sndbulkpipe(udev,
 191                         out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
 192         }
 193         if (iso_in) {
 194                 dev->iso_in = &iso_in->desc;
 195                 dev->in_iso_pipe = usb_rcvisocpipe(udev,
 196                                 iso_in->desc.bEndpointAddress
 197                                         & USB_ENDPOINT_NUMBER_MASK);
 198         }
 199
 200         if (iso_out) {
 201                 dev->iso_out = &iso_out->desc;
 202                 dev->out_iso_pipe = usb_sndisocpipe(udev,
 203                                 iso_out->desc.bEndpointAddress
 204                                         & USB_ENDPOINT_NUMBER_MASK);
 205         }
 206
 207         if (int_in) {
 208                 dev->int_in = &int_in->desc;
 209                 dev->in_int_pipe = usb_rcvintpipe(udev,
 210                                 int_in->desc.bEndpointAddress
 211                                         & USB_ENDPOINT_NUMBER_MASK);
 212         }
 213
 214         if (int_out) {
 215                 dev->int_out = &int_out->desc;
 216                 dev->out_int_pipe = usb_sndintpipe(udev,
 217                                 int_out->desc.bEndpointAddress
 218                                         & USB_ENDPOINT_NUMBER_MASK);
 219         }
 220         return 0;
 221 }
 222
 223 /*-------------------------------------------------------------------------*/
 224
 225 /* Support for testing basic non-queued I/O streams.
 226  *
 227  * These just package urbs as requests that can be easily canceled.
 228  * Each urb's data buffer is dynamically allocated; callers can fill
 229  * them with non-zero test data (or test for it) when appropriate.
 230  */
 231
 232 static void simple_callback(struct urb *urb)
 233 {
 234         complete(urb->context);
 235 }
 236
 237 static struct urb *usbtest_alloc_urb(
 238         struct usb_device       *udev,
 239         int                     pipe,
 240         unsigned long           bytes,
 241         unsigned                transfer_flags,
 242         unsigned                offset,
 243         u8                      bInterval,
 244         usb_complete_t          complete_fn)
 245 {
 246         struct urb              *urb;
 247
 248         urb = usb_alloc_urb(0, GFP_KERNEL);
 249         if (!urb)
 250                 return urb;
 251
 252         if (bInterval)
 253                 usb_fill_int_urb(urb, udev, pipe, NULL, bytes, complete_fn,
 254                                 NULL, bInterval);
 255         else
 256                 usb_fill_bulk_urb(urb, udev, pipe, NULL, bytes, complete_fn,
 257                                 NULL);
 258
 259         urb->interval = (udev->speed == USB_SPEED_HIGH)
 260                         ? (INTERRUPT_RATE << 3)
 261                         : INTERRUPT_RATE;
 262         urb->transfer_flags = transfer_flags;
 263         if (usb_pipein(pipe))
 264                 urb->transfer_flags |= URB_SHORT_NOT_OK;
 265
 266         if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 267                 urb->transfer_buffer = usb_alloc_coherent(udev, bytes + offset,
 268                         GFP_KERNEL, &urb->transfer_dma);
 269         else
 270                 urb->transfer_buffer = kmalloc(bytes + offset, GFP_KERNEL);
 271
 272         if (!urb->transfer_buffer) {
 273                 usb_free_urb(urb);
 274                 return NULL;
 275         }
 276
 277         /* To test unaligned transfers add an offset and fill the
 278                 unused memory with a guard value */
 279         if (offset) {
 280                 memset(urb->transfer_buffer, GUARD_BYTE, offset);
 281                 urb->transfer_buffer += offset;
 282                 if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 283                         urb->transfer_dma += offset;
 284         }
 285
 286         /* For inbound transfers use guard byte so that test fails if
 287                 data not correctly copied */
 288         memset(urb->transfer_buffer,
 289                         usb_pipein(urb->pipe) ? GUARD_BYTE : 0,
 290                         bytes);
 291         return urb;
 292 }
 293
 294 static struct urb *simple_alloc_urb(
 295         struct usb_device       *udev,
 296         int                     pipe,
 297         unsigned long           bytes,
 298         u8                      bInterval)
 299 {
 300         return usbtest_alloc_urb(udev, pipe, bytes, URB_NO_TRANSFER_DMA_MAP, 0,
 301                         bInterval, simple_callback);
 302 }
 303
 304 static struct urb *complicated_alloc_urb(
 305         struct usb_device       *udev,
 306         int                     pipe,
 307         unsigned long           bytes,
 308         u8                      bInterval)
 309 {
 310         return usbtest_alloc_urb(udev, pipe, bytes, URB_NO_TRANSFER_DMA_MAP, 0,
 311                         bInterval, complicated_callback);
 312 }
 313
 314 static unsigned pattern;
 315 static unsigned mod_pattern;
 316 module_param_named(pattern, mod_pattern, uint, S_IRUGO | S_IWUSR);
 317 MODULE_PARM_DESC(mod_pattern, "i/o pattern (0 == zeroes)");
 318
 319 static unsigned get_maxpacket(struct usb_device *udev, int pipe)
 320 {
 321         struct usb_host_endpoint        *ep;
 322
 323         ep = usb_pipe_endpoint(udev, pipe);
 324         return le16_to_cpup(&ep->desc.wMaxPacketSize);
 325 }
 326
 327 static void simple_fill_buf(struct urb *urb)
 328 {
 329         unsigned        i;
 330         u8              *buf = urb->transfer_buffer;
 331         unsigned        len = urb->transfer_buffer_length;
 332         unsigned        maxpacket;
 333
 334         switch (pattern) {
 335         default:
 336                 /* FALLTHROUGH */
 337         case 0:
 338                 memset(buf, 0, len);
 339                 break;
 340         case 1:                 /* mod63 */
 341                 maxpacket = get_maxpacket(urb->dev, urb->pipe);
 342                 for (i = 0; i < len; i++)
 343                         *buf++ = (u8) ((i % maxpacket) % 63);
 344                 break;
 345         }
 346 }
 347
 348 static inline unsigned long buffer_offset(void *buf)
 349 {
 350         return (unsigned long)buf & (ARCH_KMALLOC_MINALIGN - 1);
 351 }
 352
 353 static int check_guard_bytes(struct usbtest_dev *tdev, struct urb *urb)
 354 {
 355         u8 *buf = urb->transfer_buffer;
 356         u8 *guard = buf - buffer_offset(buf);
 357         unsigned i;
 358
 359         for (i = 0; guard < buf; i++, guard++) {
 360                 if (*guard != GUARD_BYTE) {
 361                         ERROR(tdev, "guard byte[%d] %d (not %d)\n",
 362                                 i, *guard, GUARD_BYTE);
 363                         return -EINVAL;
 364                 }
 365         }
 366         return 0;
 367 }
 368
 369 static int simple_check_buf(struct usbtest_dev *tdev, struct urb *urb)
 370 {
 371         unsigned        i;
 372         u8              expected;
 373         u8              *buf = urb->transfer_buffer;
 374         unsigned        len = urb->actual_length;
 375         unsigned        maxpacket = get_maxpacket(urb->dev, urb->pipe);
 376
 377         int ret = check_guard_bytes(tdev, urb);
 378         if (ret)
 379                 return ret;
 380
 381         for (i = 0; i < len; i++, buf++) {
 382                 switch (pattern) {
 383                 /* all-zeroes has no synchronization issues */
 384                 case 0:
 385                         expected = 0;
 386                         break;
 387                 /* mod63 stays in sync with short-terminated transfers,
 388                  * or otherwise when host and gadget agree on how large
 389                  * each usb transfer request should be.  resync is done
 390                  * with set_interface or set_config.
 391                  */
 392                 case 1:                 /* mod63 */
 393                         expected = (i % maxpacket) % 63;
 394                         break;
 395                 /* always fail unsupported patterns */
 396                 default:
 397                         expected = !*buf;
 398                         break;
 399                 }
 400                 if (*buf == expected)
 401                         continue;
 402                 ERROR(tdev, "buf[%d] = %d (not %d)\n", i, *buf, expected);
 403                 return -EINVAL;
 404         }
 405         return 0;
 406 }
 407
 408 static void simple_free_urb(struct urb *urb)
 409 {
 410         unsigned long offset = buffer_offset(urb->transfer_buffer);
 411
 412         if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 413                 usb_free_coherent(
 414                         urb->dev,
 415                         urb->transfer_buffer_length + offset,
 416                         urb->transfer_buffer - offset,
 417                         urb->transfer_dma - offset);
 418         else
 419                 kfree(urb->transfer_buffer - offset);
 420         usb_free_urb(urb);
 421 }
 422
 423 static int simple_io(
 424         struct usbtest_dev      *tdev,
 425         struct urb              *urb,
 426         int                     iterations,
 427         int                     vary,
 428         int                     expected,
 429         const char              *label
 430 )
 431 {
 432         struct usb_device       *udev = urb->dev;
 433         int                     max = urb->transfer_buffer_length;
 434         struct completion       completion;
 435         int                     retval = 0;
 436         unsigned long           expire;
 437
 438         urb->context = &completion;
 439         while (retval == 0 && iterations-- > 0) {
 440                 init_completion(&completion);
 441                 if (usb_pipeout(urb->pipe)) {
 442                         simple_fill_buf(urb);
 443                         urb->transfer_flags |= URB_ZERO_PACKET;
 444                 }
 445                 retval = usb_submit_urb(urb, GFP_KERNEL);
 446                 if (retval != 0)
 447                         break;
 448
 449                 expire = msecs_to_jiffies(SIMPLE_IO_TIMEOUT);
 450                 if (!wait_for_completion_timeout(&completion, expire)) {
 451                         usb_kill_urb(urb);
 452                         retval = (urb->status == -ENOENT ?
 453                                   -ETIMEDOUT : urb->status);
 454                 } else {
 455                         retval = urb->status;
 456                 }
 457
 458                 urb->dev = udev;
 459                 if (retval == 0 && usb_pipein(urb->pipe))
 460                         retval = simple_check_buf(tdev, urb);
 461
 462                 if (vary) {
 463                         int     len = urb->transfer_buffer_length;
 464
 465                         len += vary;
 466                         len %= max;
 467                         if (len == 0)
 468                                 len = (vary < max) ? vary : max;
 469                         urb->transfer_buffer_length = len;
 470                 }
 471
 472                 /* FIXME if endpoint halted, clear halt (and log) */
 473         }
 474         urb->transfer_buffer_length = max;
 475
 476         if (expected != retval)
 477                 dev_err(&udev->dev,
 478                         "%s failed, iterations left %d, status %d (not %d)\n",
 479                                 label, iterations, retval, expected);
 480         return retval;
 481 }
 482
 483
 484 /*-------------------------------------------------------------------------*/
 485
 486 /* We use scatterlist primitives to test queued I/O.
 487  * Yes, this also tests the scatterlist primitives.
 488  */
 489
 490 static void free_sglist(struct scatterlist *sg, int nents)
 491 {
 492         unsigned                i;
 493
 494         if (!sg)
 495                 return;
 496         for (i = 0; i < nents; i++) {
 497                 if (!sg_page(&sg[i]))
 498                         continue;
 499                 kfree(sg_virt(&sg[i]));
 500         }
 501         kfree(sg);
 502 }
 503
 504 static struct scatterlist *
 505 alloc_sglist(int nents, int max, int vary, struct usbtest_dev *dev, int pipe)
 506 {
 507         struct scatterlist      *sg;
 508         unsigned int            n_size = 0;
 509         unsigned                i;
 510         unsigned                size = max;
 511         unsigned                maxpacket =
 512                 get_maxpacket(interface_to_usbdev(dev->intf), pipe);
 513
 514         if (max == 0)
 515                 return NULL;
 516
 517         sg = kmalloc_array(nents, sizeof(*sg), GFP_KERNEL);
 518         if (!sg)
 519                 return NULL;
 520         sg_init_table(sg, nents);
 521
 522         for (i = 0; i < nents; i++) {
 523                 char            *buf;
 524                 unsigned        j;
 525
 526                 buf = kzalloc(size, GFP_KERNEL);
 527                 if (!buf) {
 528                         free_sglist(sg, i);
 529                         return NULL;
 530                 }
 531
 532                 /* kmalloc pages are always physically contiguous! */
 533                 sg_set_buf(&sg[i], buf, size);
 534
 535                 switch (pattern) {
 536                 case 0:
 537                         /* already zeroed */
 538                         break;
 539                 case 1:
 540                         for (j = 0; j < size; j++)
 541                                 *buf++ = (u8) (((j + n_size) % maxpacket) % 63);
 542                         n_size += size;
 543                         break;
 544                 }
 545
 546                 if (vary) {
 547                         size += vary;
 548                         size %= max;
 549                         if (size == 0)
 550                                 size = (vary < max) ? vary : max;
 551                 }
 552         }
 553
 554         return sg;
 555 }
 556
 557 static void sg_timeout(unsigned long _req)
 558 {
 559         struct usb_sg_request   *req = (struct usb_sg_request *) _req;
 560
 561         usb_sg_cancel(req);
 562 }
 563
 564 static int perform_sglist(
 565         struct usbtest_dev      *tdev,
 566         unsigned                iterations,
 567         int                     pipe,
 568         struct usb_sg_request   *req,
 569         struct scatterlist      *sg,
 570         int                     nents
 571 )
 572 {
 573         struct usb_device       *udev = testdev_to_usbdev(tdev);
 574         int                     retval = 0;
 575         struct timer_list       sg_timer;
 576
 577         setup_timer_on_stack(&sg_timer, sg_timeout, (unsigned long) req);
 578
 579         while (retval == 0 && iterations-- > 0) {
 580                 retval = usb_sg_init(req, udev, pipe,
 581                                 (udev->speed == USB_SPEED_HIGH)
 582                                         ? (INTERRUPT_RATE << 3)
 583                                         : INTERRUPT_RATE,
 584                                 sg, nents, 0, GFP_KERNEL);
 585
 586                 if (retval)
 587                         break;
 588                 mod_timer(&sg_timer, jiffies +
 589                                 msecs_to_jiffies(SIMPLE_IO_TIMEOUT));
 590                 usb_sg_wait(req);
 591                 if (!del_timer_sync(&sg_timer))
 592                         retval = -ETIMEDOUT;
 593                 else
 594                         retval = req->status;
 595
 596                 /* FIXME check resulting data pattern */
 597
 598                 /* FIXME if endpoint halted, clear halt (and log) */
 599         }
 600
 601         /* FIXME for unlink or fault handling tests, don't report
 602          * failure if retval is as we expected ...
 603          */
 604         if (retval)
 605                 ERROR(tdev, "perform_sglist failed, "
 606                                 "iterations left %d, status %d\n",
 607                                 iterations, retval);
 608         return retval;
 609 }
 610
 611
 612 /*-------------------------------------------------------------------------*/
 613
 614 /* unqueued control message testing
 615  *
 616  * there's a nice set of device functional requirements in chapter 9 of the
 617  * usb 2.0 spec, which we can apply to ANY device, even ones that don't use
 618  * special test firmware.
 619  *
 620  * we know the device is configured (or suspended) by the time it's visible
 621  * through usbfs.  we can't change that, so we won't test enumeration (which
 622  * worked 'well enough' to get here, this time), power management (ditto),
 623  * or remote wakeup (which needs human interaction).
 624  */
 625
 626 static unsigned realworld = 1;
 627 module_param(realworld, uint, 0);
 628 MODULE_PARM_DESC(realworld, "clear to demand stricter spec compliance");
 629
 630 static int get_altsetting(struct usbtest_dev *dev)
 631 {
 632         struct usb_interface    *iface = dev->intf;
 633         struct usb_device       *udev = interface_to_usbdev(iface);
 634         int                     retval;
 635
 636         retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 637                         USB_REQ_GET_INTERFACE, USB_DIR_IN|USB_RECIP_INTERFACE,
 638                         0, iface->altsetting[0].desc.bInterfaceNumber,
 639                         dev->buf, 1, USB_CTRL_GET_TIMEOUT);
 640         switch (retval) {
 641         case 1:
 642                 return dev->buf[0];
 643         case 0:
 644                 retval = -ERANGE;
 645                 /* FALLTHROUGH */
 646         default:
 647                 return retval;
 648         }
 649 }
 650
 651 static int set_altsetting(struct usbtest_dev *dev, int alternate)
 652 {
 653         struct usb_interface            *iface = dev->intf;
 654         struct usb_device               *udev;
 655
 656         if (alternate < 0 || alternate >= 256)
 657                 return -EINVAL;
 658
 659         udev = interface_to_usbdev(iface);
 660         return usb_set_interface(udev,
 661                         iface->altsetting[0].desc.bInterfaceNumber,
 662                         alternate);
 663 }
 664
 665 static int is_good_config(struct usbtest_dev *tdev, int len)
 666 {
 667         struct usb_config_descriptor    *config;
 668
 669         if (len < sizeof(*config))
 670                 return 0;
 671         config = (struct usb_config_descriptor *) tdev->buf;
 672
 673         switch (config->bDescriptorType) {
 674         case USB_DT_CONFIG:
 675         case USB_DT_OTHER_SPEED_CONFIG:
 676                 if (config->bLength != 9) {
 677                         ERROR(tdev, "bogus config descriptor length\n");
 678                         return 0;
 679                 }
 680                 /* this bit 'must be 1' but often isn't */
 681                 if (!realworld && !(config->bmAttributes & 0x80)) {
 682                         ERROR(tdev, "high bit of config attributes not set\n");
 683                         return 0;
 684                 }
 685                 if (config->bmAttributes & 0x1f) {      /* reserved == 0 */
 686                         ERROR(tdev, "reserved config bits set\n");
 687                         return 0;
 688                 }
 689                 break;
 690         default:
 691                 return 0;
 692         }
 693
 694         if (le16_to_cpu(config->wTotalLength) == len)   /* read it all */
 695                 return 1;
 696         if (le16_to_cpu(config->wTotalLength) >= TBUF_SIZE)     /* max partial read */
 697                 return 1;
 698         ERROR(tdev, "bogus config descriptor read size\n");
 699         return 0;
 700 }
 701
 702 static int is_good_ext(struct usbtest_dev *tdev, u8 *buf)
 703 {
 704         struct usb_ext_cap_descriptor *ext;
 705         u32 attr;
 706
 707         ext = (struct usb_ext_cap_descriptor *) buf;
 708
 709         if (ext->bLength != USB_DT_USB_EXT_CAP_SIZE) {
 710                 ERROR(tdev, "bogus usb 2.0 extension descriptor length\n");
 711                 return 0;
 712         }
 713
 714         attr = le32_to_cpu(ext->bmAttributes);
 715         /* bits[1:15] is used and others are reserved */
 716         if (attr & ~0xfffe) {   /* reserved == 0 */
 717                 ERROR(tdev, "reserved bits set\n");
 718                 return 0;
 719         }
 720
 721         return 1;
 722 }
 723
 724 static int is_good_ss_cap(struct usbtest_dev *tdev, u8 *buf)
 725 {
 726         struct usb_ss_cap_descriptor *ss;
 727
 728         ss = (struct usb_ss_cap_descriptor *) buf;
 729
 730         if (ss->bLength != USB_DT_USB_SS_CAP_SIZE) {
 731                 ERROR(tdev, "bogus superspeed device capability descriptor length\n");
 732                 return 0;
 733         }
 734
 735         /*
 736          * only bit[1] of bmAttributes is used for LTM and others are
 737          * reserved
 738          */
 739         if (ss->bmAttributes & ~0x02) { /* reserved == 0 */
 740                 ERROR(tdev, "reserved bits set in bmAttributes\n");
 741                 return 0;
 742         }
 743
 744         /* bits[0:3] of wSpeedSupported is used and others are reserved */
 745         if (le16_to_cpu(ss->wSpeedSupported) & ~0x0f) { /* reserved == 0 */
 746                 ERROR(tdev, "reserved bits set in wSpeedSupported\n");
 747                 return 0;
 748         }
 749
 750         return 1;
 751 }
 752
 753 static int is_good_con_id(struct usbtest_dev *tdev, u8 *buf)
 754 {
 755         struct usb_ss_container_id_descriptor *con_id;
 756
 757         con_id = (struct usb_ss_container_id_descriptor *) buf;
 758
 759         if (con_id->bLength != USB_DT_USB_SS_CONTN_ID_SIZE) {
 760                 ERROR(tdev, "bogus container id descriptor length\n");
 761                 return 0;
 762         }
 763
 764         if (con_id->bReserved) {        /* reserved == 0 */
 765                 ERROR(tdev, "reserved bits set\n");
 766                 return 0;
 767         }
 768
 769         return 1;
 770 }
 771
 772 /* sanity test for standard requests working with usb_control_mesg() and some
 773  * of the utility functions which use it.
 774  *
 775  * this doesn't test how endpoint halts behave or data toggles get set, since
 776  * we won't do I/O to bulk/interrupt endpoints here (which is how to change
 777  * halt or toggle).  toggle testing is impractical without support from hcds.
 778  *
 779  * this avoids failing devices linux would normally work with, by not testing
 780  * config/altsetting operations for devices that only support their defaults.
 781  * such devices rarely support those needless operations.
 782  *
 783  * NOTE that since this is a sanity test, it's not examining boundary cases
 784  * to see if usbcore, hcd, and device all behave right.  such testing would
 785  * involve varied read sizes and other operation sequences.
 786  */
 787 static int ch9_postconfig(struct usbtest_dev *dev)
 788 {
 789         struct usb_interface    *iface = dev->intf;
 790         struct usb_device       *udev = interface_to_usbdev(iface);
 791         int                     i, alt, retval;
 792
 793         /* [9.2.3] if there's more than one altsetting, we need to be able to
 794          * set and get each one.  mostly trusts the descriptors from usbcore.
 795          */
 796         for (i = 0; i < iface->num_altsetting; i++) {
 797
 798                 /* 9.2.3 constrains the range here */
 799                 alt = iface->altsetting[i].desc.bAlternateSetting;
 800                 if (alt < 0 || alt >= iface->num_altsetting) {
 801                         dev_err(&iface->dev,
 802                                         "invalid alt [%d].bAltSetting = %d\n",
 803                                         i, alt);
 804                 }
 805
 806                 /* [real world] get/set unimplemented if there's only one */
 807                 if (realworld && iface->num_altsetting == 1)
 808                         continue;
 809
 810                 /* [9.4.10] set_interface */
 811                 retval = set_altsetting(dev, alt);
 812                 if (retval) {
 813                         dev_err(&iface->dev, "can't set_interface = %d, %d\n",
 814                                         alt, retval);
 815                         return retval;
 816                 }
 817
 818                 /* [9.4.4] get_interface always works */
 819                 retval = get_altsetting(dev);
 820                 if (retval != alt) {
 821                         dev_err(&iface->dev, "get alt should be %d, was %d\n",
 822                                         alt, retval);
 823                         return (retval < 0) ? retval : -EDOM;
 824                 }
 825
 826         }
 827
 828         /* [real world] get_config unimplemented if there's only one */
 829         if (!realworld || udev->descriptor.bNumConfigurations != 1) {
 830                 int     expected = udev->actconfig->desc.bConfigurationValue;
 831
 832                 /* [9.4.2] get_configuration always works
 833                  * ... although some cheap devices (like one TI Hub I've got)
 834                  * won't return config descriptors except before set_config.
 835                  */
 836                 retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 837                                 USB_REQ_GET_CONFIGURATION,
 838                                 USB_DIR_IN | USB_RECIP_DEVICE,
 839                                 0, 0, dev->buf, 1, USB_CTRL_GET_TIMEOUT);
 840                 if (retval != 1 || dev->buf[0] != expected) {
 841                         dev_err(&iface->dev, "get config --> %d %d (1 %d)\n",
 842                                 retval, dev->buf[0], expected);
 843                         return (retval < 0) ? retval : -EDOM;
 844                 }
 845         }
 846
 847         /* there's always [9.4.3] a device descriptor [9.6.1] */
 848         retval = usb_get_descriptor(udev, USB_DT_DEVICE, 0,
 849                         dev->buf, sizeof(udev->descriptor));
 850         if (retval != sizeof(udev->descriptor)) {
 851                 dev_err(&iface->dev, "dev descriptor --> %d\n", retval);
 852                 return (retval < 0) ? retval : -EDOM;
 853         }
 854
 855         /*
 856          * there's always [9.4.3] a bos device descriptor [9.6.2] in USB
 857          * 3.0 spec
 858          */
 859         if (le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0210) {
 860                 struct usb_bos_descriptor *bos = NULL;
 861                 struct usb_dev_cap_header *header = NULL;
 862                 unsigned total, num, length;
 863                 u8 *buf;
 864
 865                 retval = usb_get_descriptor(udev, USB_DT_BOS, 0, dev->buf,
 866                                 sizeof(*udev->bos->desc));
 867                 if (retval != sizeof(*udev->bos->desc)) {
 868                         dev_err(&iface->dev, "bos descriptor --> %d\n", retval);
 869                         return (retval < 0) ? retval : -EDOM;
 870                 }
 871
 872                 bos = (struct usb_bos_descriptor *)dev->buf;
 873                 total = le16_to_cpu(bos->wTotalLength);
 874                 num = bos->bNumDeviceCaps;
 875
 876                 if (total > TBUF_SIZE)
 877                         total = TBUF_SIZE;
 878
 879                 /*
 880                  * get generic device-level capability descriptors [9.6.2]
 881                  * in USB 3.0 spec
 882                  */
 883                 retval = usb_get_descriptor(udev, USB_DT_BOS, 0, dev->buf,
 884                                 total);
 885                 if (retval != total) {
 886                         dev_err(&iface->dev, "bos descriptor set --> %d\n",
 887                                         retval);
 888                         return (retval < 0) ? retval : -EDOM;
 889                 }
 890
 891                 length = sizeof(*udev->bos->desc);
 892                 buf = dev->buf;
 893                 for (i = 0; i < num; i++) {
 894                         buf += length;
 895                         if (buf + sizeof(struct usb_dev_cap_header) >
 896                                         dev->buf + total)
 897                                 break;
 898
 899                         header = (struct usb_dev_cap_header *)buf;
 900                         length = header->bLength;
 901
 902                         if (header->bDescriptorType !=
 903                                         USB_DT_DEVICE_CAPABILITY) {
 904                                 dev_warn(&udev->dev, "not device capability descriptor, skip\n");
 905                                 continue;
 906                         }
 907
 908                         switch (header->bDevCapabilityType) {
 909                         case USB_CAP_TYPE_EXT:
 910                                 if (buf + USB_DT_USB_EXT_CAP_SIZE >
 911                                                 dev->buf + total ||
 912                                                 !is_good_ext(dev, buf)) {
 913                                         dev_err(&iface->dev, "bogus usb 2.0 extension descriptor\n");
 914                                         return -EDOM;
 915                                 }
 916                                 break;
 917                         case USB_SS_CAP_TYPE:
 918                                 if (buf + USB_DT_USB_SS_CAP_SIZE >
 919                                                 dev->buf + total ||
 920                                                 !is_good_ss_cap(dev, buf)) {
 921                                         dev_err(&iface->dev, "bogus superspeed device capability descriptor\n");
 922                                         return -EDOM;
 923                                 }
 924                                 break;
 925                         case CONTAINER_ID_TYPE:
 926                                 if (buf + USB_DT_USB_SS_CONTN_ID_SIZE >
 927                                                 dev->buf + total ||
 928                                                 !is_good_con_id(dev, buf)) {
 929                                         dev_err(&iface->dev, "bogus container id descriptor\n");
 930                                         return -EDOM;
 931                                 }
 932                                 break;
 933                         default:
 934                                 break;
 935                         }
 936                 }
 937         }
 938
 939         /* there's always [9.4.3] at least one config descriptor [9.6.3] */
 940         for (i = 0; i < udev->descriptor.bNumConfigurations; i++) {
 941                 retval = usb_get_descriptor(udev, USB_DT_CONFIG, i,
 942                                 dev->buf, TBUF_SIZE);
 943                 if (!is_good_config(dev, retval)) {
 944                         dev_err(&iface->dev,
 945                                         "config [%d] descriptor --> %d\n",
 946                                         i, retval);
 947                         return (retval < 0) ? retval : -EDOM;
 948                 }
 949
 950                 /* FIXME cross-checking udev->config[i] to make sure usbcore
 951                  * parsed it right (etc) would be good testing paranoia
 952                  */
 953         }
 954
 955         /* and sometimes [9.2.6.6] speed dependent descriptors */
 956         if (le16_to_cpu(udev->descriptor.bcdUSB) == 0x0200) {
 957                 struct usb_qualifier_descriptor *d = NULL;
 958
 959                 /* device qualifier [9.6.2] */
 960                 retval = usb_get_descriptor(udev,
 961                                 USB_DT_DEVICE_QUALIFIER, 0, dev->buf,
 962                                 sizeof(struct usb_qualifier_descriptor));
 963                 if (retval == -EPIPE) {
 964                         if (udev->speed == USB_SPEED_HIGH) {
 965                                 dev_err(&iface->dev,
 966                                                 "hs dev qualifier --> %d\n",
 967                                                 retval);
 968                                 return (retval < 0) ? retval : -EDOM;
 969                         }
 970                         /* usb2.0 but not high-speed capable; fine */
 971                 } else if (retval != sizeof(struct usb_qualifier_descriptor)) {
 972                         dev_err(&iface->dev, "dev qualifier --> %d\n", retval);
 973                         return (retval < 0) ? retval : -EDOM;
 974                 } else
 975                         d = (struct usb_qualifier_descriptor *) dev->buf;
 976
 977                 /* might not have [9.6.2] any other-speed configs [9.6.4] */
 978                 if (d) {
 979                         unsigned max = d->bNumConfigurations;
 980                         for (i = 0; i < max; i++) {
 981                                 retval = usb_get_descriptor(udev,
 982                                         USB_DT_OTHER_SPEED_CONFIG, i,
 983                                         dev->buf, TBUF_SIZE);
 984                                 if (!is_good_config(dev, retval)) {
 985                                         dev_err(&iface->dev,
 986                                                 "other speed config --> %d\n",
 987                                                 retval);
 988                                         return (retval < 0) ? retval : -EDOM;
 989                                 }
 990                         }
 991                 }
 992         }
 993         /* FIXME fetch strings from at least the device descriptor */
 994
 995         /* [9.4.5] get_status always works */
 996         retval = usb_get_status(udev, USB_RECIP_DEVICE, 0, dev->buf);
 997         if (retval) {
 998                 dev_err(&iface->dev, "get dev status --> %d\n", retval);
 999                 return retval;
1000         }
1001
1002         /* FIXME configuration.bmAttributes says if we could try to set/clear
1003          * the device's remote wakeup feature ... if we can, test that here
1004          */
1005
1006         retval = usb_get_status(udev, USB_RECIP_INTERFACE,
1007                         iface->altsetting[0].desc.bInterfaceNumber, dev->buf);
1008         if (retval) {
1009                 dev_err(&iface->dev, "get interface status --> %d\n", retval);
1010                 return retval;
1011         }
1012         /* FIXME get status for each endpoint in the interface */
1013
1014         return 0;
1015 }
1016
1017 /*-------------------------------------------------------------------------*/
1018
1019 /* use ch9 requests to test whether:
1020  *   (a) queues work for control, keeping N subtests queued and
1021  *       active (auto-resubmit) for M loops through the queue.
1022  *   (b) protocol stalls (control-only) will autorecover.
1023  *       it's not like bulk/intr; no halt clearing.
1024  *   (c) short control reads are reported and handled.
1025  *   (d) queues are always processed in-order
1026  */
1027
1028 struct ctrl_ctx {
1029         spinlock_t              lock;
1030         struct usbtest_dev      *dev;
1031         struct completion       complete;
1032         unsigned                count;
1033         unsigned                pending;
1034         int                     status;
1035         struct urb              **urb;
1036         struct usbtest_param    *param;
1037         int                     last;
1038 };
1039
1040 #define NUM_SUBCASES    16              /* how many test subcases here? */
1041
1042 struct subcase {
1043         struct usb_ctrlrequest  setup;
1044         int                     number;
1045         int                     expected;
1046 };
1047
1048 static void ctrl_complete(struct urb *urb)
1049 {
1050         struct ctrl_ctx         *ctx = urb->context;
1051         struct usb_ctrlrequest  *reqp;
1052         struct subcase          *subcase;
1053         int                     status = urb->status;
1054
1055         reqp = (struct usb_ctrlrequest *)urb->setup_packet;
1056         subcase = container_of(reqp, struct subcase, setup);
1057
1058         spin_lock(&ctx->lock);
1059         ctx->count--;
1060         ctx->pending--;
1061
1062         /* queue must transfer and complete in fifo order, unless
1063          * usb_unlink_urb() is used to unlink something not at the
1064          * physical queue head (not tested).
1065          */
1066         if (subcase->number > 0) {
1067                 if ((subcase->number - ctx->last) != 1) {
1068                         ERROR(ctx->dev,
1069                                 "subcase %d completed out of order, last %d\n",
1070                                 subcase->number, ctx->last);
1071                         status = -EDOM;
1072                         ctx->last = subcase->number;
1073                         goto error;
1074                 }
1075         }
1076         ctx->last = subcase->number;
1077
1078         /* succeed or fault in only one way? */
1079         if (status == subcase->expected)
1080                 status = 0;
1081
1082         /* async unlink for cleanup? */
1083         else if (status != -ECONNRESET) {
1084
1085                 /* some faults are allowed, not required */
1086                 if (subcase->expected > 0 && (
1087                           ((status == -subcase->expected        /* happened */
1088                            || status == 0))))                   /* didn't */
1089                         status = 0;
1090                 /* sometimes more than one fault is allowed */
1091                 else if (subcase->number == 12 && status == -EPIPE)
1092                         status = 0;
1093                 else
1094                         ERROR(ctx->dev, "subtest %d error, status %d\n",
1095                                         subcase->number, status);
1096         }
1097
1098         /* unexpected status codes mean errors; ideally, in hardware */
1099         if (status) {
1100 error:
1101                 if (ctx->status == 0) {
1102                         int             i;
1103
1104                         ctx->status = status;
1105                         ERROR(ctx->dev, "control queue %02x.%02x, err %d, "
1106                                         "%d left, subcase %d, len %d/%d\n",
1107                                         reqp->bRequestType, reqp->bRequest,
1108                                         status, ctx->count, subcase->number,
1109                                         urb->actual_length,
1110                                         urb->transfer_buffer_length);
1111
1112                         /* FIXME this "unlink everything" exit route should
1113                          * be a separate test case.
1114                          */
1115
1116                         /* unlink whatever's still pending */
1117                         for (i = 1; i < ctx->param->sglen; i++) {
1118                                 struct urb *u = ctx->urb[
1119                                                         (i + subcase->number)
1120                                                         % ctx->param->sglen];
1121
1122                                 if (u == urb || !u->dev)
1123                                         continue;
1124                                 spin_unlock(&ctx->lock);
1125                                 status = usb_unlink_urb(u);
1126                                 spin_lock(&ctx->lock);
1127                                 switch (status) {
1128                                 case -EINPROGRESS:
1129                                 case -EBUSY:
1130                                 case -EIDRM:
1131                                         continue;
1132                                 default:
1133                                         ERROR(ctx->dev, "urb unlink --> %d\n",
1134                                                         status);
1135                                 }
1136                         }
1137                         status = ctx->status;
1138                 }
1139         }
1140
1141         /* resubmit if we need to, else mark this as done */
1142         if ((status == 0) && (ctx->pending < ctx->count)) {
1143                 status = usb_submit_urb(urb, GFP_ATOMIC);
1144                 if (status != 0) {
1145                         ERROR(ctx->dev,
1146                                 "can't resubmit ctrl %02x.%02x, err %d\n",
1147                                 reqp->bRequestType, reqp->bRequest, status);
1148                         urb->dev = NULL;
1149                 } else
1150                         ctx->pending++;
1151         } else
1152                 urb->dev = NULL;
1153
1154         /* signal completion when nothing's queued */
1155         if (ctx->pending == 0)
1156                 complete(&ctx->complete);
1157         spin_unlock(&ctx->lock);
1158 }
1159
1160 static int
1161 test_ctrl_queue(struct usbtest_dev *dev, struct usbtest_param *param)
1162 {
1163         struct usb_device       *udev = testdev_to_usbdev(dev);
1164         struct urb              **urb;
1165         struct ctrl_ctx         context;
1166         int                     i;
1167
1168         if (param->sglen == 0 || param->iterations > UINT_MAX / param->sglen)
1169                 return -EOPNOTSUPP;
1170
1171         spin_lock_init(&context.lock);
1172         context.dev = dev;
1173         init_completion(&context.complete);
1174         context.count = param->sglen * param->iterations;
1175         context.pending = 0;
1176         context.status = -ENOMEM;
1177         context.param = param;
1178         context.last = -1;
1179
1180         /* allocate and init the urbs we'll queue.
1181          * as with bulk/intr sglists, sglen is the queue depth; it also
1182          * controls which subtests run (more tests than sglen) or rerun.
1183          */
1184         urb = kcalloc(param->sglen, sizeof(struct urb *), GFP_KERNEL);
1185         if (!urb)
1186                 return -ENOMEM;
1187         for (i = 0; i < param->sglen; i++) {
1188                 int                     pipe = usb_rcvctrlpipe(udev, 0);
1189                 unsigned                len;
1190                 struct urb              *u;
1191                 struct usb_ctrlrequest  req;
1192                 struct subcase          *reqp;
1193
1194                 /* sign of this variable means:
1195                  *  -: tested code must return this (negative) error code
1196                  *  +: tested code may return this (negative too) error code
1197                  */
1198                 int                     expected = 0;
1199
1200                 /* requests here are mostly expected to succeed on any
1201                  * device, but some are chosen to trigger protocol stalls
1202                  * or short reads.
1203                  */
1204                 memset(&req, 0, sizeof(req));
1205                 req.bRequest = USB_REQ_GET_DESCRIPTOR;
1206                 req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
1207
1208                 switch (i % NUM_SUBCASES) {
1209                 case 0:         /* get device descriptor */
1210                         req.wValue = cpu_to_le16(USB_DT_DEVICE << 8);
1211                         len = sizeof(struct usb_device_descriptor);
1212                         break;
1213                 case 1:         /* get first config descriptor (only) */
1214                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1215                         len = sizeof(struct usb_config_descriptor);
1216                         break;
1217                 case 2:         /* get altsetting (OFTEN STALLS) */
1218                         req.bRequest = USB_REQ_GET_INTERFACE;
1219                         req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
1220                         /* index = 0 means first interface */
1221                         len = 1;
1222                         expected = EPIPE;
1223                         break;
1224                 case 3:         /* get interface status */
1225                         req.bRequest = USB_REQ_GET_STATUS;
1226                         req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
1227                         /* interface 0 */
1228                         len = 2;
1229                         break;
1230                 case 4:         /* get device status */
1231                         req.bRequest = USB_REQ_GET_STATUS;
1232                         req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
1233                         len = 2;
1234                         break;
1235                 case 5:         /* get device qualifier (MAY STALL) */
1236                         req.wValue = cpu_to_le16 (USB_DT_DEVICE_QUALIFIER << 8);
1237                         len = sizeof(struct usb_qualifier_descriptor);
1238                         if (udev->speed != USB_SPEED_HIGH)
1239                                 expected = EPIPE;
1240                         break;
1241                 case 6:         /* get first config descriptor, plus interface */
1242                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1243                         len = sizeof(struct usb_config_descriptor);
1244                         len += sizeof(struct usb_interface_descriptor);
1245                         break;
1246                 case 7:         /* get interface descriptor (ALWAYS STALLS) */
1247                         req.wValue = cpu_to_le16 (USB_DT_INTERFACE << 8);
1248                         /* interface == 0 */
1249                         len = sizeof(struct usb_interface_descriptor);
1250                         expected = -EPIPE;
1251                         break;
1252                 /* NOTE: two consecutive stalls in the queue here.
1253                  *  that tests fault recovery a bit more aggressively. */
1254                 case 8:         /* clear endpoint halt (MAY STALL) */
1255                         req.bRequest = USB_REQ_CLEAR_FEATURE;
1256                         req.bRequestType = USB_RECIP_ENDPOINT;
1257                         /* wValue 0 == ep halt */
1258                         /* wIndex 0 == ep0 (shouldn't halt!) */
1259                         len = 0;
1260                         pipe = usb_sndctrlpipe(udev, 0);
1261                         expected = EPIPE;
1262                         break;
1263                 case 9:         /* get endpoint status */
1264                         req.bRequest = USB_REQ_GET_STATUS;
1265                         req.bRequestType = USB_DIR_IN|USB_RECIP_ENDPOINT;
1266                         /* endpoint 0 */
1267                         len = 2;
1268                         break;
1269                 case 10:        /* trigger short read (EREMOTEIO) */
1270                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1271                         len = 1024;
1272                         expected = -EREMOTEIO;
1273                         break;
1274                 /* NOTE: two consecutive _different_ faults in the queue. */
1275                 case 11:        /* get endpoint descriptor (ALWAYS STALLS) */
1276                         req.wValue = cpu_to_le16(USB_DT_ENDPOINT << 8);
1277                         /* endpoint == 0 */
1278                         len = sizeof(struct usb_interface_descriptor);
1279                         expected = EPIPE;
1280                         break;
1281                 /* NOTE: sometimes even a third fault in the queue! */
1282                 case 12:        /* get string 0 descriptor (MAY STALL) */
1283                         req.wValue = cpu_to_le16(USB_DT_STRING << 8);
1284                         /* string == 0, for language IDs */
1285                         len = sizeof(struct usb_interface_descriptor);
1286                         /* may succeed when > 4 languages */
1287                         expected = EREMOTEIO;   /* or EPIPE, if no strings */
1288                         break;
1289                 case 13:        /* short read, resembling case 10 */
1290                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1291                         /* last data packet "should" be DATA1, not DATA0 */
1292                         if (udev->speed == USB_SPEED_SUPER)
1293                                 len = 1024 - 512;
1294                         else
1295                                 len = 1024 - udev->descriptor.bMaxPacketSize0;
1296                         expected = -EREMOTEIO;
1297                         break;
1298                 case 14:        /* short read; try to fill the last packet */
1299                         req.wValue = cpu_to_le16((USB_DT_DEVICE << 8) | 0);
1300                         /* device descriptor size == 18 bytes */
1301                         len = udev->descriptor.bMaxPacketSize0;
1302                         if (udev->speed == USB_SPEED_SUPER)
1303                                 len = 512;
1304                         switch (len) {
1305                         case 8:
1306                                 len = 24;
1307                                 break;
1308                         case 16:
1309                                 len = 32;
1310                                 break;
1311                         }
1312                         expected = -EREMOTEIO;
1313                         break;
1314                 case 15:
1315                         req.wValue = cpu_to_le16(USB_DT_BOS << 8);
1316                         if (udev->bos)
1317                                 len = le16_to_cpu(udev->bos->desc->wTotalLength);
1318                         else
1319                                 len = sizeof(struct usb_bos_descriptor);
1320                         if (le16_to_cpu(udev->descriptor.bcdUSB) < 0x0201)
1321                                 expected = -EPIPE;
1322                         break;
1323                 default:
1324                         ERROR(dev, "bogus number of ctrl queue testcases!\n");
1325                         context.status = -EINVAL;
1326                         goto cleanup;
1327                 }
1328                 req.wLength = cpu_to_le16(len);
1329                 urb[i] = u = simple_alloc_urb(udev, pipe, len, 0);
1330                 if (!u)
1331                         goto cleanup;
1332
1333                 reqp = kmalloc(sizeof(*reqp), GFP_KERNEL);
1334                 if (!reqp)
1335                         goto cleanup;
1336                 reqp->setup = req;
1337                 reqp->number = i % NUM_SUBCASES;
1338                 reqp->expected = expected;
1339                 u->setup_packet = (char *) &reqp->setup;
1340
1341                 u->context = &context;
1342                 u->complete = ctrl_complete;
1343         }
1344
1345         /* queue the urbs */
1346         context.urb = urb;
1347         spin_lock_irq(&context.lock);
1348         for (i = 0; i < param->sglen; i++) {
1349                 context.status = usb_submit_urb(urb[i], GFP_ATOMIC);
1350                 if (context.status != 0) {
1351                         ERROR(dev, "can't submit urb[%d], status %d\n",
1352                                         i, context.status);
1353                         context.count = context.pending;
1354                         break;
1355                 }
1356                 context.pending++;
1357         }
1358         spin_unlock_irq(&context.lock);
1359
1360         /* FIXME  set timer and time out; provide a disconnect hook */
1361
1362         /* wait for the last one to complete */
1363         if (context.pending > 0)
1364                 wait_for_completion(&context.complete);
1365
1366 cleanup:
1367         for (i = 0; i < param->sglen; i++) {
1368                 if (!urb[i])
1369                         continue;
1370                 urb[i]->dev = udev;
1371                 kfree(urb[i]->setup_packet);
1372                 simple_free_urb(urb[i]);
1373         }
1374         kfree(urb);
1375         return context.status;
1376 }
1377 #undef NUM_SUBCASES
1378
1379
1380 /*-------------------------------------------------------------------------*/
1381
1382 static void unlink1_callback(struct urb *urb)
1383 {
1384         int     status = urb->status;
1385
1386         /* we "know" -EPIPE (stall) never happens */
1387         if (!status)
1388                 status = usb_submit_urb(urb, GFP_ATOMIC);
1389         if (status) {
1390                 urb->status = status;
1391                 complete(urb->context);
1392         }
1393 }
1394
1395 static int unlink1(struct usbtest_dev *dev, int pipe, int size, int async)
1396 {
1397         struct urb              *urb;
1398         struct completion       completion;
1399         int                     retval = 0;
1400
1401         init_completion(&completion);
1402         urb = simple_alloc_urb(testdev_to_usbdev(dev), pipe, size, 0);
1403         if (!urb)
1404                 return -ENOMEM;
1405         urb->context = &completion;
1406         urb->complete = unlink1_callback;
1407
1408         if (usb_pipeout(urb->pipe)) {
1409                 simple_fill_buf(urb);
1410                 urb->transfer_flags |= URB_ZERO_PACKET;
1411         }
1412
1413         /* keep the endpoint busy.  there are lots of hc/hcd-internal
1414          * states, and testing should get to all of them over time.
1415          *
1416          * FIXME want additional tests for when endpoint is STALLing
1417          * due to errors, or is just NAKing requests.
1418          */
1419         retval = usb_submit_urb(urb, GFP_KERNEL);
1420         if (retval != 0) {
1421                 dev_err(&dev->intf->dev, "submit fail %d\n", retval);
1422                 return retval;
1423         }
1424
1425         /* unlinking that should always work.  variable delay tests more
1426          * hcd states and code paths, even with little other system load.
1427          */
1428         msleep(jiffies % (2 * INTERRUPT_RATE));
1429         if (async) {
1430                 while (!completion_done(&completion)) {
1431                         retval = usb_unlink_urb(urb);
1432
1433                         if (retval == 0 && usb_pipein(urb->pipe))
1434                                 retval = simple_check_buf(dev, urb);
1435
1436                         switch (retval) {
1437                         case -EBUSY:
1438                         case -EIDRM:
1439                                 /* we can't unlink urbs while they're completing
1440                                  * or if they've completed, and we haven't
1441                                  * resubmitted. "normal" drivers would prevent
1442                                  * resubmission, but since we're testing unlink
1443                                  * paths, we can't.
1444                                  */
1445                                 ERROR(dev, "unlink retry\n");
1446                                 continue;
1447                         case 0:
1448                         case -EINPROGRESS:
1449                                 break;
1450
1451                         default:
1452                                 dev_err(&dev->intf->dev,
1453                                         "unlink fail %d\n", retval);
1454                                 return retval;
1455                         }
1456
1457                         break;
1458                 }
1459         } else
1460                 usb_kill_urb(urb);
1461
1462         wait_for_completion(&completion);
1463         retval = urb->status;
1464         simple_free_urb(urb);
1465
1466         if (async)
1467                 return (retval == -ECONNRESET) ? 0 : retval - 1000;
1468         else
1469                 return (retval == -ENOENT || retval == -EPERM) ?
1470                                 0 : retval - 2000;
1471 }
1472
1473 static int unlink_simple(struct usbtest_dev *dev, int pipe, int len)
1474 {
1475         int                     retval = 0;
1476
1477         /* test sync and async paths */
1478         retval = unlink1(dev, pipe, len, 1);
1479         if (!retval)
1480                 retval = unlink1(dev, pipe, len, 0);
1481         return retval;
1482 }
1483
1484 /*-------------------------------------------------------------------------*/
1485
1486 struct queued_ctx {
1487         struct completion       complete;
1488         atomic_t                pending;
1489         unsigned                num;
1490         int                     status;
1491         struct urb              **urbs;
1492 };
1493
1494 static void unlink_queued_callback(struct urb *urb)
1495 {
1496         int                     status = urb->status;
1497         struct queued_ctx       *ctx = urb->context;
1498
1499         if (ctx->status)
1500                 goto done;
1501         if (urb == ctx->urbs[ctx->num - 4] || urb == ctx->urbs[ctx->num - 2]) {
1502                 if (status == -ECONNRESET)
1503                         goto done;
1504                 /* What error should we report if the URB completed normally? */
1505         }
1506         if (status != 0)
1507                 ctx->status = status;
1508
1509  done:
1510         if (atomic_dec_and_test(&ctx->pending))
1511                 complete(&ctx->complete);
1512 }
1513
1514 static int unlink_queued(struct usbtest_dev *dev, int pipe, unsigned num,
1515                 unsigned size)
1516 {
1517         struct queued_ctx       ctx;
1518         struct usb_device       *udev = testdev_to_usbdev(dev);
1519         void                    *buf;
1520         dma_addr_t              buf_dma;
1521         int                     i;
1522         int                     retval = -ENOMEM;
1523
1524         init_completion(&ctx.complete);
1525         atomic_set(&ctx.pending, 1);    /* One more than the actual value */
1526         ctx.num = num;
1527         ctx.status = 0;
1528
1529         buf = usb_alloc_coherent(udev, size, GFP_KERNEL, &buf_dma);
1530         if (!buf)
1531                 return retval;
1532         memset(buf, 0, size);
1533
1534         /* Allocate and init the urbs we'll queue */
1535         ctx.urbs = kcalloc(num, sizeof(struct urb *), GFP_KERNEL);
1536         if (!ctx.urbs)
1537                 goto free_buf;
1538         for (i = 0; i < num; i++) {
1539                 ctx.urbs[i] = usb_alloc_urb(0, GFP_KERNEL);
1540                 if (!ctx.urbs[i])
1541                         goto free_urbs;
1542                 usb_fill_bulk_urb(ctx.urbs[i], udev, pipe, buf, size,
1543                                 unlink_queued_callback, &ctx);
1544                 ctx.urbs[i]->transfer_dma = buf_dma;
1545                 ctx.urbs[i]->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
1546
1547                 if (usb_pipeout(ctx.urbs[i]->pipe)) {
1548                         simple_fill_buf(ctx.urbs[i]);
1549                         ctx.urbs[i]->transfer_flags |= URB_ZERO_PACKET;
1550                 }
1551         }
1552
1553         /* Submit all the URBs and then unlink URBs num - 4 and num - 2. */
1554         for (i = 0; i < num; i++) {
1555                 atomic_inc(&ctx.pending);
1556                 retval = usb_submit_urb(ctx.urbs[i], GFP_KERNEL);
1557                 if (retval != 0) {
1558                         dev_err(&dev->intf->dev, "submit urbs[%d] fail %d\n",
1559                                         i, retval);
1560                         atomic_dec(&ctx.pending);
1561                         ctx.status = retval;
1562                         break;
1563                 }
1564         }
1565         if (i == num) {
1566                 usb_unlink_urb(ctx.urbs[num - 4]);
1567                 usb_unlink_urb(ctx.urbs[num - 2]);
1568         } else {
1569                 while (--i >= 0)
1570                         usb_unlink_urb(ctx.urbs[i]);
1571         }
1572
1573         if (atomic_dec_and_test(&ctx.pending))          /* The extra count */
1574                 complete(&ctx.complete);
1575         wait_for_completion(&ctx.complete);
1576         retval = ctx.status;
1577
1578  free_urbs:
1579         for (i = 0; i < num; i++)
1580                 usb_free_urb(ctx.urbs[i]);
1581         kfree(ctx.urbs);
1582  free_buf:
1583         usb_free_coherent(udev, size, buf, buf_dma);
1584         return retval;
1585 }
1586
1587 /*-------------------------------------------------------------------------*/
1588
1589 static int verify_not_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
1590 {
1591         int     retval;
1592         u16     status;
1593
1594         /* shouldn't look or act halted */
1595         retval = usb_get_status(urb->dev, USB_RECIP_ENDPOINT, ep, &status);
1596         if (retval < 0) {
1597                 ERROR(tdev, "ep %02x couldn't get no-halt status, %d\n",
1598                                 ep, retval);
1599                 return retval;
1600         }
1601         if (status != 0) {
1602                 ERROR(tdev, "ep %02x bogus status: %04x != 0\n", ep, status);
1603                 return -EINVAL;
1604         }
1605         retval = simple_io(tdev, urb, 1, 0, 0, __func__);
1606         if (retval != 0)
1607                 return -EINVAL;
1608         return 0;
1609 }
1610
1611 static int verify_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
1612 {
1613         int     retval;
1614         u16     status;
1615
1616         /* should look and act halted */
1617         retval = usb_get_status(urb->dev, USB_RECIP_ENDPOINT, ep, &status);
1618         if (retval < 0) {
1619                 ERROR(tdev, "ep %02x couldn't get halt status, %d\n",
1620                                 ep, retval);
1621                 return retval;
1622         }
1623         if (status != 1) {
1624                 ERROR(tdev, "ep %02x bogus status: %04x != 1\n", ep, status);
1625                 return -EINVAL;
1626         }
1627         retval = simple_io(tdev, urb, 1, 0, -EPIPE, __func__);
1628         if (retval != -EPIPE)
1629                 return -EINVAL;
1630         retval = simple_io(tdev, urb, 1, 0, -EPIPE, "verify_still_halted");
1631         if (retval != -EPIPE)
1632                 return -EINVAL;
1633         return 0;
1634 }
1635
1636 static int test_halt(struct usbtest_dev *tdev, int ep, struct urb *urb)
1637 {
1638         int     retval;
1639
1640         /* shouldn't look or act halted now */
1641         retval = verify_not_halted(tdev, ep, urb);
1642         if (retval < 0)
1643                 return retval;
1644
1645         /* set halt (protocol test only), verify it worked */
1646         retval = usb_control_msg(urb->dev, usb_sndctrlpipe(urb->dev, 0),
1647                         USB_REQ_SET_FEATURE, USB_RECIP_ENDPOINT,
1648                         USB_ENDPOINT_HALT, ep,
1649                         NULL, 0, USB_CTRL_SET_TIMEOUT);
1650         if (retval < 0) {
1651                 ERROR(tdev, "ep %02x couldn't set halt, %d\n", ep, retval);
1652                 return retval;
1653         }
1654         retval = verify_halted(tdev, ep, urb);
1655         if (retval < 0) {
1656                 int ret;
1657
1658                 /* clear halt anyways, else further tests will fail */
1659                 ret = usb_clear_halt(urb->dev, urb->pipe);
1660                 if (ret)
1661                         ERROR(tdev, "ep %02x couldn't clear halt, %d\n",
1662                               ep, ret);
1663
1664                 return retval;
1665         }
1666
1667         /* clear halt (tests API + protocol), verify it worked */
1668         retval = usb_clear_halt(urb->dev, urb->pipe);
1669         if (retval < 0) {
1670                 ERROR(tdev, "ep %02x couldn't clear halt, %d\n", ep, retval);
1671                 return retval;
1672         }
1673         retval = verify_not_halted(tdev, ep, urb);
1674         if (retval < 0)
1675                 return retval;
1676
1677         /* NOTE:  could also verify SET_INTERFACE clear halts ... */
1678
1679         return 0;
1680 }
1681
1682 static int halt_simple(struct usbtest_dev *dev)
1683 {
1684         int                     ep;
1685         int                     retval = 0;
1686         struct urb              *urb;
1687         struct usb_device       *udev = testdev_to_usbdev(dev);
1688
1689         if (udev->speed == USB_SPEED_SUPER)
1690                 urb = simple_alloc_urb(udev, 0, 1024, 0);
1691         else
1692                 urb = simple_alloc_urb(udev, 0, 512, 0);
1693         if (urb == NULL)
1694                 return -ENOMEM;
1695
1696         if (dev->in_pipe) {
1697                 ep = usb_pipeendpoint(dev->in_pipe) | USB_DIR_IN;
1698                 urb->pipe = dev->in_pipe;
1699                 retval = test_halt(dev, ep, urb);
1700                 if (retval < 0)
1701                         goto done;
1702         }
1703
1704         if (dev->out_pipe) {
1705                 ep = usb_pipeendpoint(dev->out_pipe);
1706                 urb->pipe = dev->out_pipe;
1707                 retval = test_halt(dev, ep, urb);
1708         }
1709 done:
1710         simple_free_urb(urb);
1711         return retval;
1712 }
1713
1714 /*-------------------------------------------------------------------------*/
1715
1716 /* Control OUT tests use the vendor control requests from Intel's
1717  * USB 2.0 compliance test device:  write a buffer, read it back.
1718  *
1719  * Intel's spec only _requires_ that it work for one packet, which
1720  * is pretty weak.   Some HCDs place limits here; most devices will
1721  * need to be able to handle more than one OUT data packet.  We'll
1722  * try whatever we're told to try.
1723  */
1724 static int ctrl_out(struct usbtest_dev *dev,
1725                 unsigned count, unsigned length, unsigned vary, unsigned offset)
1726 {
1727         unsigned                i, j, len;
1728         int                     retval;
1729         u8                      *buf;
1730         char                    *what = "?";
1731         struct usb_device       *udev;
1732
1733         if (length < 1 || length > 0xffff || vary >= length)
1734                 return -EINVAL;
1735
1736         buf = kmalloc(length + offset, GFP_KERNEL);
1737         if (!buf)
1738                 return -ENOMEM;
1739
1740         buf += offset;
1741         udev = testdev_to_usbdev(dev);
1742         len = length;
1743         retval = 0;
1744
1745         /* NOTE:  hardware might well act differently if we pushed it
1746          * with lots back-to-back queued requests.
1747          */
1748         for (i = 0; i < count; i++) {
1749                 /* write patterned data */
1750                 for (j = 0; j < len; j++)
1751                         buf[j] = (u8)(i + j);
1752                 retval = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
1753                                 0x5b, USB_DIR_OUT|USB_TYPE_VENDOR,
1754                                 0, 0, buf, len, USB_CTRL_SET_TIMEOUT);
1755                 if (retval != len) {
1756                         what = "write";
1757                         if (retval >= 0) {
1758                                 ERROR(dev, "ctrl_out, wlen %d (expected %d)\n",
1759                                                 retval, len);
1760                                 retval = -EBADMSG;
1761                         }
1762                         break;
1763                 }
1764
1765                 /* read it back -- assuming nothing intervened!!  */
1766                 retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
1767                                 0x5c, USB_DIR_IN|USB_TYPE_VENDOR,
1768                                 0, 0, buf, len, USB_CTRL_GET_TIMEOUT);
1769                 if (retval != len) {
1770                         what = "read";
1771                         if (retval >= 0) {
1772                                 ERROR(dev, "ctrl_out, rlen %d (expected %d)\n",
1773                                                 retval, len);
1774                                 retval = -EBADMSG;
1775                         }
1776                         break;
1777                 }
1778
1779                 /* fail if we can't verify */
1780                 for (j = 0; j < len; j++) {
1781                         if (buf[j] != (u8)(i + j)) {
1782                                 ERROR(dev, "ctrl_out, byte %d is %d not %d\n",
1783                                         j, buf[j], (u8)(i + j));
1784                                 retval = -EBADMSG;
1785                                 break;
1786                         }
1787                 }
1788                 if (retval < 0) {
1789                         what = "verify";
1790                         break;
1791                 }
1792
1793                 len += vary;
1794
1795                 /* [real world] the "zero bytes IN" case isn't really used.
1796                  * hardware can easily trip up in this weird case, since its
1797                  * status stage is IN, not OUT like other ep0in transfers.
1798                  */
1799                 if (len > length)
1800                         len = realworld ? 1 : 0;
1801         }
1802
1803         if (retval < 0)
1804                 ERROR(dev, "ctrl_out %s failed, code %d, count %d\n",
1805                         what, retval, i);
1806
1807         kfree(buf - offset);
1808         return retval;
1809 }
1810
1811 /*-------------------------------------------------------------------------*/
1812
1813 /* ISO/BULK tests ... mimics common usage
1814  *  - buffer length is split into N packets (mostly maxpacket sized)
1815  *  - multi-buffers according to sglen
1816  */
1817
1818 struct transfer_context {
1819         unsigned                count;
1820         unsigned                pending;
1821         spinlock_t              lock;
1822         struct completion       done;
1823         int                     submit_error;
1824         unsigned long           errors;
1825         unsigned long           packet_count;
1826         struct usbtest_dev      *dev;
1827         bool                    is_iso;
1828 };
1829
1830 static void complicated_callback(struct urb *urb)
1831 {
1832         struct transfer_context *ctx = urb->context;
1833
1834         spin_lock(&ctx->lock);
1835         ctx->count--;
1836
1837         ctx->packet_count += urb->number_of_packets;
1838         if (urb->error_count > 0)
1839                 ctx->errors += urb->error_count;
1840         else if (urb->status != 0)
1841                 ctx->errors += (ctx->is_iso ? urb->number_of_packets : 1);
1842         else if (urb->actual_length != urb->transfer_buffer_length)
1843                 ctx->errors++;
1844         else if (check_guard_bytes(ctx->dev, urb) != 0)
1845                 ctx->errors++;
1846
1847         if (urb->status == 0 && ctx->count > (ctx->pending - 1)
1848                         && !ctx->submit_error) {
1849                 int status = usb_submit_urb(urb, GFP_ATOMIC);
1850                 switch (status) {
1851                 case 0:
1852                         goto done;
1853                 default:
1854                         dev_err(&ctx->dev->intf->dev,
1855                                         "iso resubmit err %d\n",
1856                                         status);
1857                         /* FALLTHROUGH */
1858                 case -ENODEV:                   /* disconnected */
1859                 case -ESHUTDOWN:                /* endpoint disabled */
1860                         ctx->submit_error = 1;
1861                         break;
1862                 }
1863         }
1864
1865         ctx->pending--;
1866         if (ctx->pending == 0) {
1867                 if (ctx->errors)
1868                         dev_err(&ctx->dev->intf->dev,
1869                                 "iso test, %lu errors out of %lu\n",
1870                                 ctx->errors, ctx->packet_count);
1871                 complete(&ctx->done);
1872         }
1873 done:
1874         spin_unlock(&ctx->lock);
1875 }
1876
1877 static struct urb *iso_alloc_urb(
1878         struct usb_device       *udev,
1879         int                     pipe,
1880         struct usb_endpoint_descriptor  *desc,
1881         long                    bytes,
1882         unsigned offset
1883 )
1884 {
1885         struct urb              *urb;
1886         unsigned                i, maxp, packets;
1887
1888         if (bytes < 0 || !desc)
1889                 return NULL;
1890         maxp = 0x7ff & usb_endpoint_maxp(desc);
1891         maxp *= 1 + (0x3 & (usb_endpoint_maxp(desc) >> 11));
1892         packets = DIV_ROUND_UP(bytes, maxp);
1893
1894         urb = usb_alloc_urb(packets, GFP_KERNEL);
1895         if (!urb)
1896                 return urb;
1897         urb->dev = udev;
1898         urb->pipe = pipe;
1899
1900         urb->number_of_packets = packets;
1901         urb->transfer_buffer_length = bytes;
1902         urb->transfer_buffer = usb_alloc_coherent(udev, bytes + offset,
1903                                                         GFP_KERNEL,
1904                                                         &urb->transfer_dma);
1905         if (!urb->transfer_buffer) {
1906                 usb_free_urb(urb);
1907                 return NULL;
1908         }
1909         if (offset) {
1910                 memset(urb->transfer_buffer, GUARD_BYTE, offset);
1911                 urb->transfer_buffer += offset;
1912                 urb->transfer_dma += offset;
1913         }
1914         /* For inbound transfers use guard byte so that test fails if
1915                 data not correctly copied */
1916         memset(urb->transfer_buffer,
1917                         usb_pipein(urb->pipe) ? GUARD_BYTE : 0,
1918                         bytes);
1919
1920         for (i = 0; i < packets; i++) {
1921                 /* here, only the last packet will be short */
1922                 urb->iso_frame_desc[i].length = min((unsigned) bytes, maxp);
1923                 bytes -= urb->iso_frame_desc[i].length;
1924
1925                 urb->iso_frame_desc[i].offset = maxp * i;
1926         }
1927
1928         urb->complete = complicated_callback;
1929         /* urb->context = SET BY CALLER */
1930         urb->interval = 1 << (desc->bInterval - 1);
1931         urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
1932         return urb;
1933 }
1934
1935 static int
1936 test_queue(struct usbtest_dev *dev, struct usbtest_param *param,
1937                 int pipe, struct usb_endpoint_descriptor *desc, unsigned offset)
1938 {
1939         struct transfer_context context;
1940         struct usb_device       *udev;
1941         unsigned                i;
1942         unsigned long           packets = 0;
1943         int                     status = 0;
1944         struct urb              *urbs[param->sglen];
1945
1946         memset(&context, 0, sizeof(context));
1947         context.count = param->iterations * param->sglen;
1948         context.dev = dev;
1949         context.is_iso = !!desc;
1950         init_completion(&context.done);
1951         spin_lock_init(&context.lock);
1952
1953         udev = testdev_to_usbdev(dev);
1954
1955         for (i = 0; i < param->sglen; i++) {
1956                 if (context.is_iso)
1957                         urbs[i] = iso_alloc_urb(udev, pipe, desc,
1958                                         param->length, offset);
1959                 else
1960                         urbs[i] = complicated_alloc_urb(udev, pipe,
1961                                         param->length, 0);
1962
1963                 if (!urbs[i]) {
1964                         status = -ENOMEM;
1965                         goto fail;
1966                 }
1967                 packets += urbs[i]->number_of_packets;
1968                 urbs[i]->context = &context;
1969         }
1970         packets *= param->iterations;
1971
1972         if (context.is_iso) {
1973                 dev_info(&dev->intf->dev,
1974                         "iso period %d %sframes, wMaxPacket %d, transactions: %d\n",
1975                         1 << (desc->bInterval - 1),
1976                         (udev->speed == USB_SPEED_HIGH) ? "micro" : "",
1977                         usb_endpoint_maxp(desc) & 0x7ff,
1978                         1 + (0x3 & (usb_endpoint_maxp(desc) >> 11)));
1979
1980                 dev_info(&dev->intf->dev,
1981                         "total %lu msec (%lu packets)\n",
1982                         (packets * (1 << (desc->bInterval - 1)))
1983                                 / ((udev->speed == USB_SPEED_HIGH) ? 8 : 1),
1984                         packets);
1985         }
1986
1987         spin_lock_irq(&context.lock);
1988         for (i = 0; i < param->sglen; i++) {
1989                 ++context.pending;
1990                 status = usb_submit_urb(urbs[i], GFP_ATOMIC);
1991                 if (status < 0) {
1992                         ERROR(dev, "submit iso[%d], error %d\n", i, status);
1993                         if (i == 0) {
1994                                 spin_unlock_irq(&context.lock);
1995                                 goto fail;
1996                         }
1997
1998                         simple_free_urb(urbs[i]);
1999                         urbs[i] = NULL;
2000                         context.pending--;
2001                         context.submit_error = 1;
2002                         break;
2003                 }
2004         }
2005         spin_unlock_irq(&context.lock);
2006
2007         wait_for_completion(&context.done);
2008
2009         for (i = 0; i < param->sglen; i++) {
2010                 if (urbs[i])
2011                         simple_free_urb(urbs[i]);
2012         }
2013         /*
2014          * Isochronous transfers are expected to fail sometimes.  As an
2015          * arbitrary limit, we will report an error if any submissions
2016          * fail or if the transfer failure rate is > 10%.
2017          */
2018         if (status != 0)
2019                 ;
2020         else if (context.submit_error)
2021                 status = -EACCES;
2022         else if (context.errors >
2023                         (context.is_iso ? context.packet_count / 10 : 0))
2024                 status = -EIO;
2025         return status;
2026
2027 fail:
2028         for (i = 0; i < param->sglen; i++) {
2029                 if (urbs[i])
2030                         simple_free_urb(urbs[i]);
2031         }
2032         return status;
2033 }
2034
2035 static int test_unaligned_bulk(
2036         struct usbtest_dev *tdev,
2037         int pipe,
2038         unsigned length,
2039         int iterations,
2040         unsigned transfer_flags,
2041         const char *label)
2042 {
2043         int retval;
2044         struct urb *urb = usbtest_alloc_urb(testdev_to_usbdev(tdev),
2045                         pipe, length, transfer_flags, 1, 0, simple_callback);
2046
2047         if (!urb)
2048                 return -ENOMEM;
2049
2050         retval = simple_io(tdev, urb, iterations, 0, 0, label);
2051         simple_free_urb(urb);
2052         return retval;
2053 }
2054
2055 /*-------------------------------------------------------------------------*/
2056
2057 /* We only have this one interface to user space, through usbfs.
2058  * User mode code can scan usbfs to find N different devices (maybe on
2059  * different busses) to use when testing, and allocate one thread per
2060  * test.  So discovery is simplified, and we have no device naming issues.
2061  *
2062  * Don't use these only as stress/load tests.  Use them along with with
2063  * other USB bus activity:  plugging, unplugging, mousing, mp3 playback,
2064  * video capture, and so on.  Run different tests at different times, in
2065  * different sequences.  Nothing here should interact with other devices,
2066  * except indirectly by consuming USB bandwidth and CPU resources for test
2067  * threads and request completion.  But the only way to know that for sure
2068  * is to test when HC queues are in use by many devices.
2069  *
2070  * WARNING:  Because usbfs grabs udev->dev.sem before calling this ioctl(),
2071  * it locks out usbcore in certain code paths.  Notably, if you disconnect
2072  * the device-under-test, hub_wq will wait block forever waiting for the
2073  * ioctl to complete ... so that usb_disconnect() can abort the pending
2074  * urbs and then call usbtest_disconnect().  To abort a test, you're best
2075  * off just killing the userspace task and waiting for it to exit.
2076  */
2077
2078 static int
2079 usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
2080 {
2081         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2082         struct usb_device       *udev = testdev_to_usbdev(dev);
2083         struct usbtest_param    *param = buf;
2084         int                     retval = -EOPNOTSUPP;
2085         struct urb              *urb;
2086         struct scatterlist      *sg;
2087         struct usb_sg_request   req;
2088         struct timeval          start;
2089         unsigned                i;
2090
2091         /* FIXME USBDEVFS_CONNECTINFO doesn't say how fast the device is. */
2092
2093         pattern = mod_pattern;
2094
2095         if (code != USBTEST_REQUEST)
2096                 return -EOPNOTSUPP;
2097
2098         if (param->iterations <= 0)
2099                 return -EINVAL;
2100
2101         if (param->sglen > MAX_SGLEN)
2102                 return -EINVAL;
2103
2104         if (mutex_lock_interruptible(&dev->lock))
2105                 return -ERESTARTSYS;
2106
2107         /* FIXME: What if a system sleep starts while a test is running? */
2108
2109         /* some devices, like ez-usb default devices, need a non-default
2110          * altsetting to have any active endpoints.  some tests change
2111          * altsettings; force a default so most tests don't need to check.
2112          */
2113         if (dev->info->alt >= 0) {
2114                 int     res;
2115
2116                 if (intf->altsetting->desc.bInterfaceNumber) {
2117                         mutex_unlock(&dev->lock);
2118                         return -ENODEV;
2119                 }
2120                 res = set_altsetting(dev, dev->info->alt);
2121                 if (res) {
2122                         dev_err(&intf->dev,
2123                                         "set altsetting to %d failed, %d\n",
2124                                         dev->info->alt, res);
2125                         mutex_unlock(&dev->lock);
2126                         return res;
2127                 }
2128         }
2129
2130         /*
2131          * Just a bunch of test cases that every HCD is expected to handle.
2132          *
2133          * Some may need specific firmware, though it'd be good to have
2134          * one firmware image to handle all the test cases.
2135          *
2136          * FIXME add more tests!  cancel requests, verify the data, control
2137          * queueing, concurrent read+write threads, and so on.
2138          */
2139         do_gettimeofday(&start);
2140         switch (param->test_num) {
2141
2142         case 0:
2143                 dev_info(&intf->dev, "TEST 0:  NOP\n");
2144                 retval = 0;
2145                 break;
2146
2147         /* Simple non-queued bulk I/O tests */
2148         case 1:
2149                 if (dev->out_pipe == 0)
2150                         break;
2151                 dev_info(&intf->dev,
2152                                 "TEST 1:  write %d bytes %u times\n",
2153                                 param->length, param->iterations);
2154                 urb = simple_alloc_urb(udev, dev->out_pipe, param->length, 0);
2155                 if (!urb) {
2156                         retval = -ENOMEM;
2157                         break;
2158                 }
2159                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2160                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test1");
2161                 simple_free_urb(urb);
2162                 break;
2163         case 2:
2164                 if (dev->in_pipe == 0)
2165                         break;
2166                 dev_info(&intf->dev,
2167                                 "TEST 2:  read %d bytes %u times\n",
2168                                 param->length, param->iterations);
2169                 urb = simple_alloc_urb(udev, dev->in_pipe, param->length, 0);
2170                 if (!urb) {
2171                         retval = -ENOMEM;
2172                         break;
2173                 }
2174                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2175                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test2");
2176                 simple_free_urb(urb);
2177                 break;
2178         case 3:
2179                 if (dev->out_pipe == 0 || param->vary == 0)
2180                         break;
2181                 dev_info(&intf->dev,
2182                                 "TEST 3:  write/%d 0..%d bytes %u times\n",
2183                                 param->vary, param->length, param->iterations);
2184                 urb = simple_alloc_urb(udev, dev->out_pipe, param->length, 0);
2185                 if (!urb) {
2186                         retval = -ENOMEM;
2187                         break;
2188                 }
2189                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2190                 retval = simple_io(dev, urb, param->iterations, param->vary,
2191                                         0, "test3");
2192                 simple_free_urb(urb);
2193                 break;
2194         case 4:
2195                 if (dev->in_pipe == 0 || param->vary == 0)
2196                         break;
2197                 dev_info(&intf->dev,
2198                                 "TEST 4:  read/%d 0..%d bytes %u times\n",
2199                                 param->vary, param->length, param->iterations);
2200                 urb = simple_alloc_urb(udev, dev->in_pipe, param->length, 0);
2201                 if (!urb) {
2202                         retval = -ENOMEM;
2203                         break;
2204                 }
2205                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2206                 retval = simple_io(dev, urb, param->iterations, param->vary,
2207                                         0, "test4");
2208                 simple_free_urb(urb);
2209                 break;
2210
2211         /* Queued bulk I/O tests */
2212         case 5:
2213                 if (dev->out_pipe == 0 || param->sglen == 0)
2214                         break;
2215                 dev_info(&intf->dev,
2216                         "TEST 5:  write %d sglists %d entries of %d bytes\n",
2217                                 param->iterations,
2218                                 param->sglen, param->length);
2219                 sg = alloc_sglist(param->sglen, param->length,
2220                                 0, dev, dev->out_pipe);
2221                 if (!sg) {
2222                         retval = -ENOMEM;
2223                         break;
2224                 }
2225                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2226                 retval = perform_sglist(dev, param->iterations, dev->out_pipe,
2227                                 &req, sg, param->sglen);
2228                 free_sglist(sg, param->sglen);
2229                 break;
2230
2231         case 6:
2232                 if (dev->in_pipe == 0 || param->sglen == 0)
2233                         break;
2234                 dev_info(&intf->dev,
2235                         "TEST 6:  read %d sglists %d entries of %d bytes\n",
2236                                 param->iterations,
2237                                 param->sglen, param->length);
2238                 sg = alloc_sglist(param->sglen, param->length,
2239                                 0, dev, dev->in_pipe);
2240                 if (!sg) {
2241                         retval = -ENOMEM;
2242                         break;
2243                 }
2244                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2245                 retval = perform_sglist(dev, param->iterations, dev->in_pipe,
2246                                 &req, sg, param->sglen);
2247                 free_sglist(sg, param->sglen);
2248                 break;
2249         case 7:
2250                 if (dev->out_pipe == 0 || param->sglen == 0 || param->vary == 0)
2251                         break;
2252                 dev_info(&intf->dev,
2253                         "TEST 7:  write/%d %d sglists %d entries 0..%d bytes\n",
2254                                 param->vary, param->iterations,
2255                                 param->sglen, param->length);
2256                 sg = alloc_sglist(param->sglen, param->length,
2257                                 param->vary, dev, dev->out_pipe);
2258                 if (!sg) {
2259                         retval = -ENOMEM;
2260                         break;
2261                 }
2262                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2263                 retval = perform_sglist(dev, param->iterations, dev->out_pipe,
2264                                 &req, sg, param->sglen);
2265                 free_sglist(sg, param->sglen);
2266                 break;
2267         case 8:
2268                 if (dev->in_pipe == 0 || param->sglen == 0 || param->vary == 0)
2269                         break;
2270                 dev_info(&intf->dev,
2271                         "TEST 8:  read/%d %d sglists %d entries 0..%d bytes\n",
2272                                 param->vary, param->iterations,
2273                                 param->sglen, param->length);
2274                 sg = alloc_sglist(param->sglen, param->length,
2275                                 param->vary, dev, dev->in_pipe);
2276                 if (!sg) {
2277                         retval = -ENOMEM;
2278                         break;
2279                 }
2280                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2281                 retval = perform_sglist(dev, param->iterations, dev->in_pipe,
2282                                 &req, sg, param->sglen);
2283                 free_sglist(sg, param->sglen);
2284                 break;
2285
2286         /* non-queued sanity tests for control (chapter 9 subset) */
2287         case 9:
2288                 retval = 0;
2289                 dev_info(&intf->dev,
2290                         "TEST 9:  ch9 (subset) control tests, %d times\n",
2291                                 param->iterations);
2292                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2293                         retval = ch9_postconfig(dev);
2294                 if (retval)
2295                         dev_err(&intf->dev, "ch9 subset failed, "
2296                                         "iterations left %d\n", i);
2297                 break;
2298
2299         /* queued control messaging */
2300         case 10:
2301                 retval = 0;
2302                 dev_info(&intf->dev,
2303                                 "TEST 10:  queue %d control calls, %d times\n",
2304                                 param->sglen,
2305                                 param->iterations);
2306                 retval = test_ctrl_queue(dev, param);
2307                 break;
2308
2309         /* simple non-queued unlinks (ring with one urb) */
2310         case 11:
2311                 if (dev->in_pipe == 0 || !param->length)
2312                         break;
2313                 retval = 0;
2314                 dev_info(&intf->dev, "TEST 11:  unlink %d reads of %d\n",
2315                                 param->iterations, param->length);
2316                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2317                         retval = unlink_simple(dev, dev->in_pipe,
2318                                                 param->length);
2319                 if (retval)
2320                         dev_err(&intf->dev, "unlink reads failed %d, "
2321                                 "iterations left %d\n", retval, i);
2322                 break;
2323         case 12:
2324                 if (dev->out_pipe == 0 || !param->length)
2325                         break;
2326                 retval = 0;
2327                 dev_info(&intf->dev, "TEST 12:  unlink %d writes of %d\n",
2328                                 param->iterations, param->length);
2329                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2330                         retval = unlink_simple(dev, dev->out_pipe,
2331                                                 param->length);
2332                 if (retval)
2333                         dev_err(&intf->dev, "unlink writes failed %d, "
2334                                 "iterations left %d\n", retval, i);
2335                 break;
2336
2337         /* ep halt tests */
2338         case 13:
2339                 if (dev->out_pipe == 0 && dev->in_pipe == 0)
2340                         break;
2341                 retval = 0;
2342                 dev_info(&intf->dev, "TEST 13:  set/clear %d halts\n",
2343                                 param->iterations);
2344                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2345                         retval = halt_simple(dev);
2346
2347                 if (retval)
2348                         ERROR(dev, "halts failed, iterations left %d\n", i);
2349                 break;
2350
2351         /* control write tests */
2352         case 14:
2353                 if (!dev->info->ctrl_out)
2354                         break;
2355                 dev_info(&intf->dev, "TEST 14:  %d ep0out, %d..%d vary %d\n",
2356                                 param->iterations,
2357                                 realworld ? 1 : 0, param->length,
2358                                 param->vary);
2359                 retval = ctrl_out(dev, param->iterations,
2360                                 param->length, param->vary, 0);
2361                 break;
2362
2363         /* iso write tests */
2364         case 15:
2365                 if (dev->out_iso_pipe == 0 || param->sglen == 0)
2366                         break;
2367                 dev_info(&intf->dev,
2368                         "TEST 15:  write %d iso, %d entries of %d bytes\n",
2369                                 param->iterations,
2370                                 param->sglen, param->length);
2371                 /* FIRMWARE:  iso sink */
2372                 retval = test_queue(dev, param,
2373                                 dev->out_iso_pipe, dev->iso_out, 0);
2374                 break;
2375
2376         /* iso read tests */
2377         case 16:
2378                 if (dev->in_iso_pipe == 0 || param->sglen == 0)
2379                         break;
2380                 dev_info(&intf->dev,
2381                         "TEST 16:  read %d iso, %d entries of %d bytes\n",
2382                                 param->iterations,
2383                                 param->sglen, param->length);
2384                 /* FIRMWARE:  iso source */
2385                 retval = test_queue(dev, param,
2386                                 dev->in_iso_pipe, dev->iso_in, 0);
2387                 break;
2388
2389         /* FIXME scatterlist cancel (needs helper thread) */
2390
2391         /* Tests for bulk I/O using DMA mapping by core and odd address */
2392         case 17:
2393                 if (dev->out_pipe == 0)
2394                         break;
2395                 dev_info(&intf->dev,
2396                         "TEST 17:  write odd addr %d bytes %u times core map\n",
2397                         param->length, param->iterations);
2398
2399                 retval = test_unaligned_bulk(
2400                                 dev, dev->out_pipe,
2401                                 param->length, param->iterations,
2402                                 0, "test17");
2403                 break;
2404
2405         case 18:
2406                 if (dev->in_pipe == 0)
2407                         break;
2408                 dev_info(&intf->dev,
2409                         "TEST 18:  read odd addr %d bytes %u times core map\n",
2410                         param->length, param->iterations);
2411
2412                 retval = test_unaligned_bulk(
2413                                 dev, dev->in_pipe,
2414                                 param->length, param->iterations,
2415                                 0, "test18");
2416                 break;
2417
2418         /* Tests for bulk I/O using premapped coherent buffer and odd address */
2419         case 19:
2420                 if (dev->out_pipe == 0)
2421                         break;
2422                 dev_info(&intf->dev,
2423                         "TEST 19:  write odd addr %d bytes %u times premapped\n",
2424                         param->length, param->iterations);
2425
2426                 retval = test_unaligned_bulk(
2427                                 dev, dev->out_pipe,
2428                                 param->length, param->iterations,
2429                                 URB_NO_TRANSFER_DMA_MAP, "test19");
2430                 break;
2431
2432         case 20:
2433                 if (dev->in_pipe == 0)
2434                         break;
2435                 dev_info(&intf->dev,
2436                         "TEST 20:  read odd addr %d bytes %u times premapped\n",
2437                         param->length, param->iterations);
2438
2439                 retval = test_unaligned_bulk(
2440                                 dev, dev->in_pipe,
2441                                 param->length, param->iterations,
2442                                 URB_NO_TRANSFER_DMA_MAP, "test20");
2443                 break;
2444
2445         /* control write tests with unaligned buffer */
2446         case 21:
2447                 if (!dev->info->ctrl_out)
2448                         break;
2449                 dev_info(&intf->dev,
2450                                 "TEST 21:  %d ep0out odd addr, %d..%d vary %d\n",
2451                                 param->iterations,
2452                                 realworld ? 1 : 0, param->length,
2453                                 param->vary);
2454                 retval = ctrl_out(dev, param->iterations,
2455                                 param->length, param->vary, 1);
2456                 break;
2457
2458         /* unaligned iso tests */
2459         case 22:
2460                 if (dev->out_iso_pipe == 0 || param->sglen == 0)
2461                         break;
2462                 dev_info(&intf->dev,
2463                         "TEST 22:  write %d iso odd, %d entries of %d bytes\n",
2464                                 param->iterations,
2465                                 param->sglen, param->length);
2466                 retval = test_queue(dev, param,
2467                                 dev->out_iso_pipe, dev->iso_out, 1);
2468                 break;
2469
2470         case 23:
2471                 if (dev->in_iso_pipe == 0 || param->sglen == 0)
2472                         break;
2473                 dev_info(&intf->dev,
2474                         "TEST 23:  read %d iso odd, %d entries of %d bytes\n",
2475                                 param->iterations,
2476                                 param->sglen, param->length);
2477                 retval = test_queue(dev, param,
2478                                 dev->in_iso_pipe, dev->iso_in, 1);
2479                 break;
2480
2481         /* unlink URBs from a bulk-OUT queue */
2482         case 24:
2483                 if (dev->out_pipe == 0 || !param->length || param->sglen < 4)
2484                         break;
2485                 retval = 0;
2486                 dev_info(&intf->dev, "TEST 24:  unlink from %d queues of "
2487                                 "%d %d-byte writes\n",
2488                                 param->iterations, param->sglen, param->length);
2489                 for (i = param->iterations; retval == 0 && i > 0; --i) {
2490                         retval = unlink_queued(dev, dev->out_pipe,
2491                                                 param->sglen, param->length);
2492                         if (retval) {
2493                                 dev_err(&intf->dev,
2494                                         "unlink queued writes failed %d, "
2495                                         "iterations left %d\n", retval, i);
2496                                 break;
2497                         }
2498                 }
2499                 break;
2500
2501         /* Simple non-queued interrupt I/O tests */
2502         case 25:
2503                 if (dev->out_int_pipe == 0)
2504                         break;
2505                 dev_info(&intf->dev,
2506                                 "TEST 25: write %d bytes %u times\n",
2507                                 param->length, param->iterations);
2508                 urb = simple_alloc_urb(udev, dev->out_int_pipe, param->length,
2509                                 dev->int_out->bInterval);
2510                 if (!urb) {
2511                         retval = -ENOMEM;
2512                         break;
2513                 }
2514                 /* FIRMWARE: interrupt sink (maybe accepts short writes) */
2515                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test25");
2516                 simple_free_urb(urb);
2517                 break;
2518         case 26:
2519                 if (dev->in_int_pipe == 0)
2520                         break;
2521                 dev_info(&intf->dev,
2522                                 "TEST 26: read %d bytes %u times\n",
2523                                 param->length, param->iterations);
2524                 urb = simple_alloc_urb(udev, dev->in_int_pipe, param->length,
2525                                 dev->int_in->bInterval);
2526                 if (!urb) {
2527                         retval = -ENOMEM;
2528                         break;
2529                 }
2530                 /* FIRMWARE: interrupt source (maybe generates short writes) */
2531                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test26");
2532                 simple_free_urb(urb);
2533                 break;
2534         case 27:
2535                 /* We do performance test, so ignore data compare */
2536                 if (dev->out_pipe == 0 || param->sglen == 0 || pattern != 0)
2537                         break;
2538                 dev_info(&intf->dev,
2539                         "TEST 27: bulk write %dMbytes\n", (param->iterations *
2540                         param->sglen * param->length) / (1024 * 1024));
2541                 retval = test_queue(dev, param,
2542                                 dev->out_pipe, NULL, 0);
2543                 break;
2544         case 28:
2545                 if (dev->in_pipe == 0 || param->sglen == 0 || pattern != 0)
2546                         break;
2547                 dev_info(&intf->dev,
2548                         "TEST 28: bulk read %dMbytes\n", (param->iterations *
2549                         param->sglen * param->length) / (1024 * 1024));
2550                 retval = test_queue(dev, param,
2551                                 dev->in_pipe, NULL, 0);
2552                 break;
2553         }
2554         do_gettimeofday(&param->duration);
2555         param->duration.tv_sec -= start.tv_sec;
2556         param->duration.tv_usec -= start.tv_usec;
2557         if (param->duration.tv_usec < 0) {
2558                 param->duration.tv_usec += 1000 * 1000;
2559                 param->duration.tv_sec -= 1;
2560         }
2561         mutex_unlock(&dev->lock);
2562         return retval;
2563 }
2564
2565 /*-------------------------------------------------------------------------*/
2566
2567 static unsigned force_interrupt;
2568 module_param(force_interrupt, uint, 0);
2569 MODULE_PARM_DESC(force_interrupt, "0 = test default; else interrupt");
2570
2571 #ifdef  GENERIC
2572 static unsigned short vendor;
2573 module_param(vendor, ushort, 0);
2574 MODULE_PARM_DESC(vendor, "vendor code (from usb-if)");
2575
2576 static unsigned short product;
2577 module_param(product, ushort, 0);
2578 MODULE_PARM_DESC(product, "product code (from vendor)");
2579 #endif
2580
2581 static int
2582 usbtest_probe(struct usb_interface *intf, const struct usb_device_id *id)
2583 {
2584         struct usb_device       *udev;
2585         struct usbtest_dev      *dev;
2586         struct usbtest_info     *info;
2587         char                    *rtest, *wtest;
2588         char                    *irtest, *iwtest;
2589         char                    *intrtest, *intwtest;
2590
2591         udev = interface_to_usbdev(intf);
2592
2593 #ifdef  GENERIC
2594         /* specify devices by module parameters? */
2595         if (id->match_flags == 0) {
2596                 /* vendor match required, product match optional */
2597                 if (!vendor || le16_to_cpu(udev->descriptor.idVendor) != (u16)vendor)
2598                         return -ENODEV;
2599                 if (product && le16_to_cpu(udev->descriptor.idProduct) != (u16)product)
2600                         return -ENODEV;
2601                 dev_info(&intf->dev, "matched module params, "
2602                                         "vend=0x%04x prod=0x%04x\n",
2603                                 le16_to_cpu(udev->descriptor.idVendor),
2604                                 le16_to_cpu(udev->descriptor.idProduct));
2605         }
2606 #endif
2607
2608         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
2609         if (!dev)
2610                 return -ENOMEM;
2611         info = (struct usbtest_info *) id->driver_info;
2612         dev->info = info;
2613         mutex_init(&dev->lock);
2614
2615         dev->intf = intf;
2616
2617         /* cacheline-aligned scratch for i/o */
2618         dev->buf = kmalloc(TBUF_SIZE, GFP_KERNEL);
2619         if (dev->buf == NULL) {
2620                 kfree(dev);
2621                 return -ENOMEM;
2622         }
2623
2624         /* NOTE this doesn't yet test the handful of difference that are
2625          * visible with high speed interrupts:  bigger maxpacket (1K) and
2626          * "high bandwidth" modes (up to 3 packets/uframe).
2627          */
2628         rtest = wtest = "";
2629         irtest = iwtest = "";
2630         intrtest = intwtest = "";
2631         if (force_interrupt || udev->speed == USB_SPEED_LOW) {
2632                 if (info->ep_in) {
2633                         dev->in_pipe = usb_rcvintpipe(udev, info->ep_in);
2634                         rtest = " intr-in";
2635                 }
2636                 if (info->ep_out) {
2637                         dev->out_pipe = usb_sndintpipe(udev, info->ep_out);
2638                         wtest = " intr-out";
2639                 }
2640         } else {
2641                 if (override_alt >= 0 || info->autoconf) {
2642                         int status;
2643
2644                         status = get_endpoints(dev, intf);
2645                         if (status < 0) {
2646                                 WARNING(dev, "couldn't get endpoints, %d\n",
2647                                                 status);
2648                                 kfree(dev->buf);
2649                                 kfree(dev);
2650                                 return status;
2651                         }
2652                         /* may find bulk or ISO pipes */
2653                 } else {
2654                         if (info->ep_in)
2655                                 dev->in_pipe = usb_rcvbulkpipe(udev,
2656                                                         info->ep_in);
2657                         if (info->ep_out)
2658                                 dev->out_pipe = usb_sndbulkpipe(udev,
2659                                                         info->ep_out);
2660                 }
2661                 if (dev->in_pipe)
2662                         rtest = " bulk-in";
2663                 if (dev->out_pipe)
2664                         wtest = " bulk-out";
2665                 if (dev->in_iso_pipe)
2666                         irtest = " iso-in";
2667                 if (dev->out_iso_pipe)
2668                         iwtest = " iso-out";
2669                 if (dev->in_int_pipe)
2670                         intrtest = " int-in";
2671                 if (dev->out_int_pipe)
2672                         intwtest = " int-out";
2673         }
2674
2675         usb_set_intfdata(intf, dev);
2676         dev_info(&intf->dev, "%s\n", info->name);
2677         dev_info(&intf->dev, "%s {control%s%s%s%s%s%s%s} tests%s\n",
2678                         usb_speed_string(udev->speed),
2679                         info->ctrl_out ? " in/out" : "",
2680                         rtest, wtest,
2681                         irtest, iwtest,
2682                         intrtest, intwtest,
2683                         info->alt >= 0 ? " (+alt)" : "");
2684         return 0;
2685 }
2686
2687 static int usbtest_suspend(struct usb_interface *intf, pm_message_t message)
2688 {
2689         return 0;
2690 }
2691
2692 static int usbtest_resume(struct usb_interface *intf)
2693 {
2694         return 0;
2695 }
2696
2697
2698 static void usbtest_disconnect(struct usb_interface *intf)
2699 {
2700         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2701
2702         usb_set_intfdata(intf, NULL);
2703         dev_dbg(&intf->dev, "disconnect\n");
2704         kfree(dev);
2705 }
2706
2707 /* Basic testing only needs a device that can source or sink bulk traffic.
2708  * Any device can test control transfers (default with GENERIC binding).
2709  *
2710  * Several entries work with the default EP0 implementation that's built
2711  * into EZ-USB chips.  There's a default vendor ID which can be overridden
2712  * by (very) small config EEPROMS, but otherwise all these devices act
2713  * identically until firmware is loaded:  only EP0 works.  It turns out
2714  * to be easy to make other endpoints work, without modifying that EP0
2715  * behavior.  For now, we expect that kind of firmware.
2716  */
2717
2718 /* an21xx or fx versions of ez-usb */
2719 static struct usbtest_info ez1_info = {
2720         .name           = "EZ-USB device",
2721         .ep_in          = 2,
2722         .ep_out         = 2,
2723         .alt            = 1,
2724 };
2725
2726 /* fx2 version of ez-usb */
2727 static struct usbtest_info ez2_info = {
2728         .name           = "FX2 device",
2729         .ep_in          = 6,
2730         .ep_out         = 2,
2731         .alt            = 1,
2732 };
2733
2734 /* ezusb family device with dedicated usb test firmware,
2735  */
2736 static struct usbtest_info fw_info = {
2737         .name           = "usb test device",
2738         .ep_in          = 2,
2739         .ep_out         = 2,
2740         .alt            = 1,
2741         .autoconf       = 1,            /* iso and ctrl_out need autoconf */
2742         .ctrl_out       = 1,
2743         .iso            = 1,            /* iso_ep's are #8 in/out */
2744 };
2745
2746 /* peripheral running Linux and 'zero.c' test firmware, or
2747  * its user-mode cousin. different versions of this use
2748  * different hardware with the same vendor/product codes.
2749  * host side MUST rely on the endpoint descriptors.
2750  */
2751 static struct usbtest_info gz_info = {
2752         .name           = "Linux gadget zero",
2753         .autoconf       = 1,
2754         .ctrl_out       = 1,
2755         .iso            = 1,
2756         .intr           = 1,
2757         .alt            = 0,
2758 };
2759
2760 static struct usbtest_info um_info = {
2761         .name           = "Linux user mode test driver",
2762         .autoconf       = 1,
2763         .alt            = -1,
2764 };
2765
2766 static struct usbtest_info um2_info = {
2767         .name           = "Linux user mode ISO test driver",
2768         .autoconf       = 1,
2769         .iso            = 1,
2770         .alt            = -1,
2771 };
2772
2773 #ifdef IBOT2
2774 /* this is a nice source of high speed bulk data;
2775  * uses an FX2, with firmware provided in the device
2776  */
2777 static struct usbtest_info ibot2_info = {
2778         .name           = "iBOT2 webcam",
2779         .ep_in          = 2,
2780         .alt            = -1,
2781 };
2782 #endif
2783
2784 #ifdef GENERIC
2785 /* we can use any device to test control traffic */
2786 static struct usbtest_info generic_info = {
2787         .name           = "Generic USB device",
2788         .alt            = -1,
2789 };
2790 #endif
2791
2792
2793 static const struct usb_device_id id_table[] = {
2794
2795         /*-------------------------------------------------------------*/
2796
2797         /* EZ-USB devices which download firmware to replace (or in our
2798          * case augment) the default device implementation.
2799          */
2800
2801         /* generic EZ-USB FX controller */
2802         { USB_DEVICE(0x0547, 0x2235),
2803                 .driver_info = (unsigned long) &ez1_info,
2804         },
2805
2806         /* CY3671 development board with EZ-USB FX */
2807         { USB_DEVICE(0x0547, 0x0080),
2808                 .driver_info = (unsigned long) &ez1_info,
2809         },
2810
2811         /* generic EZ-USB FX2 controller (or development board) */
2812         { USB_DEVICE(0x04b4, 0x8613),
2813                 .driver_info = (unsigned long) &ez2_info,
2814         },
2815
2816         /* re-enumerated usb test device firmware */
2817         { USB_DEVICE(0xfff0, 0xfff0),
2818                 .driver_info = (unsigned long) &fw_info,
2819         },
2820
2821         /* "Gadget Zero" firmware runs under Linux */
2822         { USB_DEVICE(0x0525, 0xa4a0),
2823                 .driver_info = (unsigned long) &gz_info,
2824         },
2825
2826         /* so does a user-mode variant */
2827         { USB_DEVICE(0x0525, 0xa4a4),
2828                 .driver_info = (unsigned long) &um_info,
2829         },
2830
2831         /* ... and a user-mode variant that talks iso */
2832         { USB_DEVICE(0x0525, 0xa4a3),
2833                 .driver_info = (unsigned long) &um2_info,
2834         },
2835
2836 #ifdef KEYSPAN_19Qi
2837         /* Keyspan 19qi uses an21xx (original EZ-USB) */
2838         /* this does not coexist with the real Keyspan 19qi driver! */
2839         { USB_DEVICE(0x06cd, 0x010b),
2840                 .driver_info = (unsigned long) &ez1_info,
2841         },
2842 #endif
2843
2844         /*-------------------------------------------------------------*/
2845
2846 #ifdef IBOT2
2847         /* iBOT2 makes a nice source of high speed bulk-in data */
2848         /* this does not coexist with a real iBOT2 driver! */
2849         { USB_DEVICE(0x0b62, 0x0059),
2850                 .driver_info = (unsigned long) &ibot2_info,
2851         },
2852 #endif
2853
2854         /*-------------------------------------------------------------*/
2855
2856 #ifdef GENERIC
2857         /* module params can specify devices to use for control tests */
2858         { .driver_info = (unsigned long) &generic_info, },
2859 #endif
2860
2861         /*-------------------------------------------------------------*/
2862
2863         { }
2864 };
2865 MODULE_DEVICE_TABLE(usb, id_table);
2866
2867 static struct usb_driver usbtest_driver = {
2868         .name =         "usbtest",
2869         .id_table =     id_table,
2870         .probe =        usbtest_probe,
2871         .unlocked_ioctl = usbtest_ioctl,
2872         .disconnect =   usbtest_disconnect,
2873         .suspend =      usbtest_suspend,
2874         .resume =       usbtest_resume,
2875 };
2876
2877 /*-------------------------------------------------------------------------*/
2878
2879 static int __init usbtest_init(void)
2880 {
2881 #ifdef GENERIC
2882         if (vendor)
2883                 pr_debug("params: vend=0x%04x prod=0x%04x\n", vendor, product);
2884 #endif
2885         return usb_register(&usbtest_driver);
2886 }
2887 module_init(usbtest_init);
2888
2889 static void __exit usbtest_exit(void)
2890 {
2891         usb_deregister(&usbtest_driver);
2892 }
2893 module_exit(usbtest_exit);
2894
2895 MODULE_DESCRIPTION("USB Core/HCD Testing Driver");
2896 MODULE_LICENSE("GPL");
2897