kernel/drivers/usb/misc/usbtest.c

   1 #include <linux/kernel.h>
   2 #include <linux/errno.h>
   3 #include <linux/init.h>
   4 #include <linux/slab.h>
   5 #include <linux/mm.h>
   6 #include <linux/module.h>
   7 #include <linux/moduleparam.h>
   8 #include <linux/scatterlist.h>
   9 #include <linux/mutex.h>
  10 #include <linux/timer.h>
  11 #include <linux/usb.h>
  12
  13 #define SIMPLE_IO_TIMEOUT       10000   /* in milliseconds */
  14
  15 /*-------------------------------------------------------------------------*/
  16
  17 static int override_alt = -1;
  18 module_param_named(alt, override_alt, int, 0644);
  19 MODULE_PARM_DESC(alt, ">= 0 to override altsetting selection");
  20 static void complicated_callback(struct urb *urb);
  21
  22 /*-------------------------------------------------------------------------*/
  23
  24 /* FIXME make these public somewhere; usbdevfs.h? */
  25 struct usbtest_param {
  26         /* inputs */
  27         unsigned                test_num;       /* 0..(TEST_CASES-1) */
  28         unsigned                iterations;
  29         unsigned                length;
  30         unsigned                vary;
  31         unsigned                sglen;
  32
  33         /* outputs */
  34         struct timeval          duration;
  35 };
  36 #define USBTEST_REQUEST _IOWR('U', 100, struct usbtest_param)
  37
  38 /*-------------------------------------------------------------------------*/
  39
  40 #define GENERIC         /* let probe() bind using module params */
  41
  42 /* Some devices that can be used for testing will have "real" drivers.
  43  * Entries for those need to be enabled here by hand, after disabling
  44  * that "real" driver.
  45  */
  46 //#define       IBOT2           /* grab iBOT2 webcams */
  47 //#define       KEYSPAN_19Qi    /* grab un-renumerated serial adapter */
  48
  49 /*-------------------------------------------------------------------------*/
  50
  51 struct usbtest_info {
  52         const char              *name;
  53         u8                      ep_in;          /* bulk/intr source */
  54         u8                      ep_out;         /* bulk/intr sink */
  55         unsigned                autoconf:1;
  56         unsigned                ctrl_out:1;
  57         unsigned                iso:1;          /* try iso in/out */
  58         unsigned                intr:1;         /* try interrupt in/out */
  59         int                     alt;
  60 };
  61
  62 /* this is accessed only through usbfs ioctl calls.
  63  * one ioctl to issue a test ... one lock per device.
  64  * tests create other threads if they need them.
  65  * urbs and buffers are allocated dynamically,
  66  * and data generated deterministically.
  67  */
  68 struct usbtest_dev {
  69         struct usb_interface    *intf;
  70         struct usbtest_info     *info;
  71         int                     in_pipe;
  72         int                     out_pipe;
  73         int                     in_iso_pipe;
  74         int                     out_iso_pipe;
  75         int                     in_int_pipe;
  76         int                     out_int_pipe;
  77         struct usb_endpoint_descriptor  *iso_in, *iso_out;
  78         struct usb_endpoint_descriptor  *int_in, *int_out;
  79         struct mutex            lock;
  80
  81 #define TBUF_SIZE       256
  82         u8                      *buf;
  83 };
  84
  85 static struct usb_device *testdev_to_usbdev(struct usbtest_dev *test)
  86 {
  87         return interface_to_usbdev(test->intf);
  88 }
  89
  90 /* set up all urbs so they can be used with either bulk or interrupt */
  91 #define INTERRUPT_RATE          1       /* msec/transfer */
  92
  93 #define ERROR(tdev, fmt, args...) \
  94         dev_err(&(tdev)->intf->dev , fmt , ## args)
  95 #define WARNING(tdev, fmt, args...) \
  96         dev_warn(&(tdev)->intf->dev , fmt , ## args)
  97
  98 #define GUARD_BYTE      0xA5
  99 #define MAX_SGLEN       128
 100
 101 /*-------------------------------------------------------------------------*/
 102
 103 static int
 104 get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf)
 105 {
 106         int                             tmp;
 107         struct usb_host_interface       *alt;
 108         struct usb_host_endpoint        *in, *out;
 109         struct usb_host_endpoint        *iso_in, *iso_out;
 110         struct usb_host_endpoint        *int_in, *int_out;
 111         struct usb_device               *udev;
 112
 113         for (tmp = 0; tmp < intf->num_altsetting; tmp++) {
 114                 unsigned        ep;
 115
 116                 in = out = NULL;
 117                 iso_in = iso_out = NULL;
 118                 int_in = int_out = NULL;
 119                 alt = intf->altsetting + tmp;
 120
 121                 if (override_alt >= 0 &&
 122                                 override_alt != alt->desc.bAlternateSetting)
 123                         continue;
 124
 125                 /* take the first altsetting with in-bulk + out-bulk;
 126                  * ignore other endpoints and altsettings.
 127                  */
 128                 for (ep = 0; ep < alt->desc.bNumEndpoints; ep++) {
 129                         struct usb_host_endpoint        *e;
 130
 131                         e = alt->endpoint + ep;
 132                         switch (usb_endpoint_type(&e->desc)) {
 133                         case USB_ENDPOINT_XFER_BULK:
 134                                 break;
 135                         case USB_ENDPOINT_XFER_INT:
 136                                 if (dev->info->intr)
 137                                         goto try_intr;
 138                         case USB_ENDPOINT_XFER_ISOC:
 139                                 if (dev->info->iso)
 140                                         goto try_iso;
 141                                 /* FALLTHROUGH */
 142                         default:
 143                                 continue;
 144                         }
 145                         if (usb_endpoint_dir_in(&e->desc)) {
 146                                 if (!in)
 147                                         in = e;
 148                         } else {
 149                                 if (!out)
 150                                         out = e;
 151                         }
 152                         continue;
 153 try_intr:
 154                         if (usb_endpoint_dir_in(&e->desc)) {
 155                                 if (!int_in)
 156                                         int_in = e;
 157                         } else {
 158                                 if (!int_out)
 159                                         int_out = e;
 160                         }
 161                         continue;
 162 try_iso:
 163                         if (usb_endpoint_dir_in(&e->desc)) {
 164                                 if (!iso_in)
 165                                         iso_in = e;
 166                         } else {
 167                                 if (!iso_out)
 168                                         iso_out = e;
 169                         }
 170                 }
 171                 if ((in && out)  ||  iso_in || iso_out || int_in || int_out)
 172                         goto found;
 173         }
 174         return -EINVAL;
 175
 176 found:
 177         udev = testdev_to_usbdev(dev);
 178         dev->info->alt = alt->desc.bAlternateSetting;
 179         if (alt->desc.bAlternateSetting != 0) {
 180                 tmp = usb_set_interface(udev,
 181                                 alt->desc.bInterfaceNumber,
 182                                 alt->desc.bAlternateSetting);
 183                 if (tmp < 0)
 184                         return tmp;
 185         }
 186
 187         if (in) {
 188                 dev->in_pipe = usb_rcvbulkpipe(udev,
 189                         in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
 190                 dev->out_pipe = usb_sndbulkpipe(udev,
 191                         out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
 192         }
 193         if (iso_in) {
 194                 dev->iso_in = &iso_in->desc;
 195                 dev->in_iso_pipe = usb_rcvisocpipe(udev,
 196                                 iso_in->desc.bEndpointAddress
 197                                         & USB_ENDPOINT_NUMBER_MASK);
 198         }
 199
 200         if (iso_out) {
 201                 dev->iso_out = &iso_out->desc;
 202                 dev->out_iso_pipe = usb_sndisocpipe(udev,
 203                                 iso_out->desc.bEndpointAddress
 204                                         & USB_ENDPOINT_NUMBER_MASK);
 205         }
 206
 207         if (int_in) {
 208                 dev->int_in = &int_in->desc;
 209                 dev->in_int_pipe = usb_rcvintpipe(udev,
 210                                 int_in->desc.bEndpointAddress
 211                                         & USB_ENDPOINT_NUMBER_MASK);
 212         }
 213
 214         if (int_out) {
 215                 dev->int_out = &int_out->desc;
 216                 dev->out_int_pipe = usb_sndintpipe(udev,
 217                                 int_out->desc.bEndpointAddress
 218                                         & USB_ENDPOINT_NUMBER_MASK);
 219         }
 220         return 0;
 221 }
 222
 223 /*-------------------------------------------------------------------------*/
 224
 225 /* Support for testing basic non-queued I/O streams.
 226  *
 227  * These just package urbs as requests that can be easily canceled.
 228  * Each urb's data buffer is dynamically allocated; callers can fill
 229  * them with non-zero test data (or test for it) when appropriate.
 230  */
 231
 232 static void simple_callback(struct urb *urb)
 233 {
 234         complete(urb->context);
 235 }
 236
 237 static struct urb *usbtest_alloc_urb(
 238         struct usb_device       *udev,
 239         int                     pipe,
 240         unsigned long           bytes,
 241         unsigned                transfer_flags,
 242         unsigned                offset,
 243         u8                      bInterval,
 244         usb_complete_t          complete_fn)
 245 {
 246         struct urb              *urb;
 247
 248         urb = usb_alloc_urb(0, GFP_KERNEL);
 249         if (!urb)
 250                 return urb;
 251
 252         if (bInterval)
 253                 usb_fill_int_urb(urb, udev, pipe, NULL, bytes, complete_fn,
 254                                 NULL, bInterval);
 255         else
 256                 usb_fill_bulk_urb(urb, udev, pipe, NULL, bytes, complete_fn,
 257                                 NULL);
 258
 259         urb->interval = (udev->speed == USB_SPEED_HIGH)
 260                         ? (INTERRUPT_RATE << 3)
 261                         : INTERRUPT_RATE;
 262         urb->transfer_flags = transfer_flags;
 263         if (usb_pipein(pipe))
 264                 urb->transfer_flags |= URB_SHORT_NOT_OK;
 265
 266         if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 267                 urb->transfer_buffer = usb_alloc_coherent(udev, bytes + offset,
 268                         GFP_KERNEL, &urb->transfer_dma);
 269         else
 270                 urb->transfer_buffer = kmalloc(bytes + offset, GFP_KERNEL);
 271
 272         if (!urb->transfer_buffer) {
 273                 usb_free_urb(urb);
 274                 return NULL;
 275         }
 276
 277         /* To test unaligned transfers add an offset and fill the
 278                 unused memory with a guard value */
 279         if (offset) {
 280                 memset(urb->transfer_buffer, GUARD_BYTE, offset);
 281                 urb->transfer_buffer += offset;
 282                 if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 283                         urb->transfer_dma += offset;
 284         }
 285
 286         /* For inbound transfers use guard byte so that test fails if
 287                 data not correctly copied */
 288         memset(urb->transfer_buffer,
 289                         usb_pipein(urb->pipe) ? GUARD_BYTE : 0,
 290                         bytes);
 291         return urb;
 292 }
 293
 294 static struct urb *simple_alloc_urb(
 295         struct usb_device       *udev,
 296         int                     pipe,
 297         unsigned long           bytes,
 298         u8                      bInterval)
 299 {
 300         return usbtest_alloc_urb(udev, pipe, bytes, URB_NO_TRANSFER_DMA_MAP, 0,
 301                         bInterval, simple_callback);
 302 }
 303
 304 static struct urb *complicated_alloc_urb(
 305         struct usb_device       *udev,
 306         int                     pipe,
 307         unsigned long           bytes,
 308         u8                      bInterval)
 309 {
 310         return usbtest_alloc_urb(udev, pipe, bytes, URB_NO_TRANSFER_DMA_MAP, 0,
 311                         bInterval, complicated_callback);
 312 }
 313
 314 static unsigned pattern;
 315 static unsigned mod_pattern;
 316 module_param_named(pattern, mod_pattern, uint, S_IRUGO | S_IWUSR);
 317 MODULE_PARM_DESC(mod_pattern, "i/o pattern (0 == zeroes)");
 318
 319 static unsigned get_maxpacket(struct usb_device *udev, int pipe)
 320 {
 321         struct usb_host_endpoint        *ep;
 322
 323         ep = usb_pipe_endpoint(udev, pipe);
 324         return le16_to_cpup(&ep->desc.wMaxPacketSize);
 325 }
 326
 327 static void simple_fill_buf(struct urb *urb)
 328 {
 329         unsigned        i;
 330         u8              *buf = urb->transfer_buffer;
 331         unsigned        len = urb->transfer_buffer_length;
 332         unsigned        maxpacket;
 333
 334         switch (pattern) {
 335         default:
 336                 /* FALLTHROUGH */
 337         case 0:
 338                 memset(buf, 0, len);
 339                 break;
 340         case 1:                 /* mod63 */
 341                 maxpacket = get_maxpacket(urb->dev, urb->pipe);
 342                 for (i = 0; i < len; i++)
 343                         *buf++ = (u8) ((i % maxpacket) % 63);
 344                 break;
 345         }
 346 }
 347
 348 static inline unsigned long buffer_offset(void *buf)
 349 {
 350         return (unsigned long)buf & (ARCH_KMALLOC_MINALIGN - 1);
 351 }
 352
 353 static int check_guard_bytes(struct usbtest_dev *tdev, struct urb *urb)
 354 {
 355         u8 *buf = urb->transfer_buffer;
 356         u8 *guard = buf - buffer_offset(buf);
 357         unsigned i;
 358
 359         for (i = 0; guard < buf; i++, guard++) {
 360                 if (*guard != GUARD_BYTE) {
 361                         ERROR(tdev, "guard byte[%d] %d (not %d)\n",
 362                                 i, *guard, GUARD_BYTE);
 363                         return -EINVAL;
 364                 }
 365         }
 366         return 0;
 367 }
 368
 369 static int simple_check_buf(struct usbtest_dev *tdev, struct urb *urb)
 370 {
 371         unsigned        i;
 372         u8              expected;
 373         u8              *buf = urb->transfer_buffer;
 374         unsigned        len = urb->actual_length;
 375         unsigned        maxpacket = get_maxpacket(urb->dev, urb->pipe);
 376
 377         int ret = check_guard_bytes(tdev, urb);
 378         if (ret)
 379                 return ret;
 380
 381         for (i = 0; i < len; i++, buf++) {
 382                 switch (pattern) {
 383                 /* all-zeroes has no synchronization issues */
 384                 case 0:
 385                         expected = 0;
 386                         break;
 387                 /* mod63 stays in sync with short-terminated transfers,
 388                  * or otherwise when host and gadget agree on how large
 389                  * each usb transfer request should be.  resync is done
 390                  * with set_interface or set_config.
 391                  */
 392                 case 1:                 /* mod63 */
 393                         expected = (i % maxpacket) % 63;
 394                         break;
 395                 /* always fail unsupported patterns */
 396                 default:
 397                         expected = !*buf;
 398                         break;
 399                 }
 400                 if (*buf == expected)
 401                         continue;
 402                 ERROR(tdev, "buf[%d] = %d (not %d)\n", i, *buf, expected);
 403                 return -EINVAL;
 404         }
 405         return 0;
 406 }
 407
 408 static void simple_free_urb(struct urb *urb)
 409 {
 410         unsigned long offset = buffer_offset(urb->transfer_buffer);
 411
 412         if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 413                 usb_free_coherent(
 414                         urb->dev,
 415                         urb->transfer_buffer_length + offset,
 416                         urb->transfer_buffer - offset,
 417                         urb->transfer_dma - offset);
 418         else
 419                 kfree(urb->transfer_buffer - offset);
 420         usb_free_urb(urb);
 421 }
 422
 423 static int simple_io(
 424         struct usbtest_dev      *tdev,
 425         struct urb              *urb,
 426         int                     iterations,
 427         int                     vary,
 428         int                     expected,
 429         const char              *label
 430 )
 431 {
 432         struct usb_device       *udev = urb->dev;
 433         int                     max = urb->transfer_buffer_length;
 434         struct completion       completion;
 435         int                     retval = 0;
 436         unsigned long           expire;
 437
 438         urb->context = &completion;
 439         while (retval == 0 && iterations-- > 0) {
 440                 init_completion(&completion);
 441                 if (usb_pipeout(urb->pipe)) {
 442                         simple_fill_buf(urb);
 443                         urb->transfer_flags |= URB_ZERO_PACKET;
 444                 }
 445                 retval = usb_submit_urb(urb, GFP_KERNEL);
 446                 if (retval != 0)
 447                         break;
 448
 449                 expire = msecs_to_jiffies(SIMPLE_IO_TIMEOUT);
 450                 if (!wait_for_completion_timeout(&completion, expire)) {
 451                         usb_kill_urb(urb);
 452                         retval = (urb->status == -ENOENT ?
 453                                   -ETIMEDOUT : urb->status);
 454                 } else {
 455                         retval = urb->status;
 456                 }
 457
 458                 urb->dev = udev;
 459                 if (retval == 0 && usb_pipein(urb->pipe))
 460                         retval = simple_check_buf(tdev, urb);
 461
 462                 if (vary) {
 463                         int     len = urb->transfer_buffer_length;
 464
 465                         len += vary;
 466                         len %= max;
 467                         if (len == 0)
 468                                 len = (vary < max) ? vary : max;
 469                         urb->transfer_buffer_length = len;
 470                 }
 471
 472                 /* FIXME if endpoint halted, clear halt (and log) */
 473         }
 474         urb->transfer_buffer_length = max;
 475
 476         if (expected != retval)
 477                 dev_err(&udev->dev,
 478                         "%s failed, iterations left %d, status %d (not %d)\n",
 479                                 label, iterations, retval, expected);
 480         return retval;
 481 }
 482
 483
 484 /*-------------------------------------------------------------------------*/
 485
 486 /* We use scatterlist primitives to test queued I/O.
 487  * Yes, this also tests the scatterlist primitives.
 488  */
 489
 490 static void free_sglist(struct scatterlist *sg, int nents)
 491 {
 492         unsigned                i;
 493
 494         if (!sg)
 495                 return;
 496         for (i = 0; i < nents; i++) {
 497                 if (!sg_page(&sg[i]))
 498                         continue;
 499                 kfree(sg_virt(&sg[i]));
 500         }
 501         kfree(sg);
 502 }
 503
 504 static struct scatterlist *
 505 alloc_sglist(int nents, int max, int vary, struct usbtest_dev *dev, int pipe)
 506 {
 507         struct scatterlist      *sg;
 508         unsigned                i;
 509         unsigned                size = max;
 510         unsigned                maxpacket =
 511                 get_maxpacket(interface_to_usbdev(dev->intf), pipe);
 512
 513         if (max == 0)
 514                 return NULL;
 515
 516         sg = kmalloc_array(nents, sizeof(*sg), GFP_KERNEL);
 517         if (!sg)
 518                 return NULL;
 519         sg_init_table(sg, nents);
 520
 521         for (i = 0; i < nents; i++) {
 522                 char            *buf;
 523                 unsigned        j;
 524
 525                 buf = kzalloc(size, GFP_KERNEL);
 526                 if (!buf) {
 527                         free_sglist(sg, i);
 528                         return NULL;
 529                 }
 530
 531                 /* kmalloc pages are always physically contiguous! */
 532                 sg_set_buf(&sg[i], buf, size);
 533
 534                 switch (pattern) {
 535                 case 0:
 536                         /* already zeroed */
 537                         break;
 538                 case 1:
 539                         for (j = 0; j < size; j++)
 540                                 *buf++ = (u8) ((j % maxpacket) % 63);
 541                         break;
 542                 }
 543
 544                 if (vary) {
 545                         size += vary;
 546                         size %= max;
 547                         if (size == 0)
 548                                 size = (vary < max) ? vary : max;
 549                 }
 550         }
 551
 552         return sg;
 553 }
 554
 555 static void sg_timeout(unsigned long _req)
 556 {
 557         struct usb_sg_request   *req = (struct usb_sg_request *) _req;
 558
 559         req->status = -ETIMEDOUT;
 560         usb_sg_cancel(req);
 561 }
 562
 563 static int perform_sglist(
 564         struct usbtest_dev      *tdev,
 565         unsigned                iterations,
 566         int                     pipe,
 567         struct usb_sg_request   *req,
 568         struct scatterlist      *sg,
 569         int                     nents
 570 )
 571 {
 572         struct usb_device       *udev = testdev_to_usbdev(tdev);
 573         int                     retval = 0;
 574         struct timer_list       sg_timer;
 575
 576         setup_timer_on_stack(&sg_timer, sg_timeout, (unsigned long) req);
 577
 578         while (retval == 0 && iterations-- > 0) {
 579                 retval = usb_sg_init(req, udev, pipe,
 580                                 (udev->speed == USB_SPEED_HIGH)
 581                                         ? (INTERRUPT_RATE << 3)
 582                                         : INTERRUPT_RATE,
 583                                 sg, nents, 0, GFP_KERNEL);
 584
 585                 if (retval)
 586                         break;
 587                 mod_timer(&sg_timer, jiffies +
 588                                 msecs_to_jiffies(SIMPLE_IO_TIMEOUT));
 589                 usb_sg_wait(req);
 590                 del_timer_sync(&sg_timer);
 591                 retval = req->status;
 592
 593                 /* FIXME check resulting data pattern */
 594
 595                 /* FIXME if endpoint halted, clear halt (and log) */
 596         }
 597
 598         /* FIXME for unlink or fault handling tests, don't report
 599          * failure if retval is as we expected ...
 600          */
 601         if (retval)
 602                 ERROR(tdev, "perform_sglist failed, "
 603                                 "iterations left %d, status %d\n",
 604                                 iterations, retval);
 605         return retval;
 606 }
 607
 608
 609 /*-------------------------------------------------------------------------*/
 610
 611 /* unqueued control message testing
 612  *
 613  * there's a nice set of device functional requirements in chapter 9 of the
 614  * usb 2.0 spec, which we can apply to ANY device, even ones that don't use
 615  * special test firmware.
 616  *
 617  * we know the device is configured (or suspended) by the time it's visible
 618  * through usbfs.  we can't change that, so we won't test enumeration (which
 619  * worked 'well enough' to get here, this time), power management (ditto),
 620  * or remote wakeup (which needs human interaction).
 621  */
 622
 623 static unsigned realworld = 1;
 624 module_param(realworld, uint, 0);
 625 MODULE_PARM_DESC(realworld, "clear to demand stricter spec compliance");
 626
 627 static int get_altsetting(struct usbtest_dev *dev)
 628 {
 629         struct usb_interface    *iface = dev->intf;
 630         struct usb_device       *udev = interface_to_usbdev(iface);
 631         int                     retval;
 632
 633         retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 634                         USB_REQ_GET_INTERFACE, USB_DIR_IN|USB_RECIP_INTERFACE,
 635                         0, iface->altsetting[0].desc.bInterfaceNumber,
 636                         dev->buf, 1, USB_CTRL_GET_TIMEOUT);
 637         switch (retval) {
 638         case 1:
 639                 return dev->buf[0];
 640         case 0:
 641                 retval = -ERANGE;
 642                 /* FALLTHROUGH */
 643         default:
 644                 return retval;
 645         }
 646 }
 647
 648 static int set_altsetting(struct usbtest_dev *dev, int alternate)
 649 {
 650         struct usb_interface            *iface = dev->intf;
 651         struct usb_device               *udev;
 652
 653         if (alternate < 0 || alternate >= 256)
 654                 return -EINVAL;
 655
 656         udev = interface_to_usbdev(iface);
 657         return usb_set_interface(udev,
 658                         iface->altsetting[0].desc.bInterfaceNumber,
 659                         alternate);
 660 }
 661
 662 static int is_good_config(struct usbtest_dev *tdev, int len)
 663 {
 664         struct usb_config_descriptor    *config;
 665
 666         if (len < sizeof(*config))
 667                 return 0;
 668         config = (struct usb_config_descriptor *) tdev->buf;
 669
 670         switch (config->bDescriptorType) {
 671         case USB_DT_CONFIG:
 672         case USB_DT_OTHER_SPEED_CONFIG:
 673                 if (config->bLength != 9) {
 674                         ERROR(tdev, "bogus config descriptor length\n");
 675                         return 0;
 676                 }
 677                 /* this bit 'must be 1' but often isn't */
 678                 if (!realworld && !(config->bmAttributes & 0x80)) {
 679                         ERROR(tdev, "high bit of config attributes not set\n");
 680                         return 0;
 681                 }
 682                 if (config->bmAttributes & 0x1f) {      /* reserved == 0 */
 683                         ERROR(tdev, "reserved config bits set\n");
 684                         return 0;
 685                 }
 686                 break;
 687         default:
 688                 return 0;
 689         }
 690
 691         if (le16_to_cpu(config->wTotalLength) == len)   /* read it all */
 692                 return 1;
 693         if (le16_to_cpu(config->wTotalLength) >= TBUF_SIZE)     /* max partial read */
 694                 return 1;
 695         ERROR(tdev, "bogus config descriptor read size\n");
 696         return 0;
 697 }
 698
 699 static int is_good_ext(struct usbtest_dev *tdev, u8 *buf)
 700 {
 701         struct usb_ext_cap_descriptor *ext;
 702         u32 attr;
 703
 704         ext = (struct usb_ext_cap_descriptor *) buf;
 705
 706         if (ext->bLength != USB_DT_USB_EXT_CAP_SIZE) {
 707                 ERROR(tdev, "bogus usb 2.0 extension descriptor length\n");
 708                 return 0;
 709         }
 710
 711         attr = le32_to_cpu(ext->bmAttributes);
 712         /* bits[1:15] is used and others are reserved */
 713         if (attr & ~0xfffe) {   /* reserved == 0 */
 714                 ERROR(tdev, "reserved bits set\n");
 715                 return 0;
 716         }
 717
 718         return 1;
 719 }
 720
 721 static int is_good_ss_cap(struct usbtest_dev *tdev, u8 *buf)
 722 {
 723         struct usb_ss_cap_descriptor *ss;
 724
 725         ss = (struct usb_ss_cap_descriptor *) buf;
 726
 727         if (ss->bLength != USB_DT_USB_SS_CAP_SIZE) {
 728                 ERROR(tdev, "bogus superspeed device capability descriptor length\n");
 729                 return 0;
 730         }
 731
 732         /*
 733          * only bit[1] of bmAttributes is used for LTM and others are
 734          * reserved
 735          */
 736         if (ss->bmAttributes & ~0x02) { /* reserved == 0 */
 737                 ERROR(tdev, "reserved bits set in bmAttributes\n");
 738                 return 0;
 739         }
 740
 741         /* bits[0:3] of wSpeedSupported is used and others are reserved */
 742         if (le16_to_cpu(ss->wSpeedSupported) & ~0x0f) { /* reserved == 0 */
 743                 ERROR(tdev, "reserved bits set in wSpeedSupported\n");
 744                 return 0;
 745         }
 746
 747         return 1;
 748 }
 749
 750 static int is_good_con_id(struct usbtest_dev *tdev, u8 *buf)
 751 {
 752         struct usb_ss_container_id_descriptor *con_id;
 753
 754         con_id = (struct usb_ss_container_id_descriptor *) buf;
 755
 756         if (con_id->bLength != USB_DT_USB_SS_CONTN_ID_SIZE) {
 757                 ERROR(tdev, "bogus container id descriptor length\n");
 758                 return 0;
 759         }
 760
 761         if (con_id->bReserved) {        /* reserved == 0 */
 762                 ERROR(tdev, "reserved bits set\n");
 763                 return 0;
 764         }
 765
 766         return 1;
 767 }
 768
 769 /* sanity test for standard requests working with usb_control_mesg() and some
 770  * of the utility functions which use it.
 771  *
 772  * this doesn't test how endpoint halts behave or data toggles get set, since
 773  * we won't do I/O to bulk/interrupt endpoints here (which is how to change
 774  * halt or toggle).  toggle testing is impractical without support from hcds.
 775  *
 776  * this avoids failing devices linux would normally work with, by not testing
 777  * config/altsetting operations for devices that only support their defaults.
 778  * such devices rarely support those needless operations.
 779  *
 780  * NOTE that since this is a sanity test, it's not examining boundary cases
 781  * to see if usbcore, hcd, and device all behave right.  such testing would
 782  * involve varied read sizes and other operation sequences.
 783  */
 784 static int ch9_postconfig(struct usbtest_dev *dev)
 785 {
 786         struct usb_interface    *iface = dev->intf;
 787         struct usb_device       *udev = interface_to_usbdev(iface);
 788         int                     i, alt, retval;
 789
 790         /* [9.2.3] if there's more than one altsetting, we need to be able to
 791          * set and get each one.  mostly trusts the descriptors from usbcore.
 792          */
 793         for (i = 0; i < iface->num_altsetting; i++) {
 794
 795                 /* 9.2.3 constrains the range here */
 796                 alt = iface->altsetting[i].desc.bAlternateSetting;
 797                 if (alt < 0 || alt >= iface->num_altsetting) {
 798                         dev_err(&iface->dev,
 799                                         "invalid alt [%d].bAltSetting = %d\n",
 800                                         i, alt);
 801                 }
 802
 803                 /* [real world] get/set unimplemented if there's only one */
 804                 if (realworld && iface->num_altsetting == 1)
 805                         continue;
 806
 807                 /* [9.4.10] set_interface */
 808                 retval = set_altsetting(dev, alt);
 809                 if (retval) {
 810                         dev_err(&iface->dev, "can't set_interface = %d, %d\n",
 811                                         alt, retval);
 812                         return retval;
 813                 }
 814
 815                 /* [9.4.4] get_interface always works */
 816                 retval = get_altsetting(dev);
 817                 if (retval != alt) {
 818                         dev_err(&iface->dev, "get alt should be %d, was %d\n",
 819                                         alt, retval);
 820                         return (retval < 0) ? retval : -EDOM;
 821                 }
 822
 823         }
 824
 825         /* [real world] get_config unimplemented if there's only one */
 826         if (!realworld || udev->descriptor.bNumConfigurations != 1) {
 827                 int     expected = udev->actconfig->desc.bConfigurationValue;
 828
 829                 /* [9.4.2] get_configuration always works
 830                  * ... although some cheap devices (like one TI Hub I've got)
 831                  * won't return config descriptors except before set_config.
 832                  */
 833                 retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 834                                 USB_REQ_GET_CONFIGURATION,
 835                                 USB_DIR_IN | USB_RECIP_DEVICE,
 836                                 0, 0, dev->buf, 1, USB_CTRL_GET_TIMEOUT);
 837                 if (retval != 1 || dev->buf[0] != expected) {
 838                         dev_err(&iface->dev, "get config --> %d %d (1 %d)\n",
 839                                 retval, dev->buf[0], expected);
 840                         return (retval < 0) ? retval : -EDOM;
 841                 }
 842         }
 843
 844         /* there's always [9.4.3] a device descriptor [9.6.1] */
 845         retval = usb_get_descriptor(udev, USB_DT_DEVICE, 0,
 846                         dev->buf, sizeof(udev->descriptor));
 847         if (retval != sizeof(udev->descriptor)) {
 848                 dev_err(&iface->dev, "dev descriptor --> %d\n", retval);
 849                 return (retval < 0) ? retval : -EDOM;
 850         }
 851
 852         /*
 853          * there's always [9.4.3] a bos device descriptor [9.6.2] in USB
 854          * 3.0 spec
 855          */
 856         if (le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0210) {
 857                 struct usb_bos_descriptor *bos = NULL;
 858                 struct usb_dev_cap_header *header = NULL;
 859                 unsigned total, num, length;
 860                 u8 *buf;
 861
 862                 retval = usb_get_descriptor(udev, USB_DT_BOS, 0, dev->buf,
 863                                 sizeof(*udev->bos->desc));
 864                 if (retval != sizeof(*udev->bos->desc)) {
 865                         dev_err(&iface->dev, "bos descriptor --> %d\n", retval);
 866                         return (retval < 0) ? retval : -EDOM;
 867                 }
 868
 869                 bos = (struct usb_bos_descriptor *)dev->buf;
 870                 total = le16_to_cpu(bos->wTotalLength);
 871                 num = bos->bNumDeviceCaps;
 872
 873                 if (total > TBUF_SIZE)
 874                         total = TBUF_SIZE;
 875
 876                 /*
 877                  * get generic device-level capability descriptors [9.6.2]
 878                  * in USB 3.0 spec
 879                  */
 880                 retval = usb_get_descriptor(udev, USB_DT_BOS, 0, dev->buf,
 881                                 total);
 882                 if (retval != total) {
 883                         dev_err(&iface->dev, "bos descriptor set --> %d\n",
 884                                         retval);
 885                         return (retval < 0) ? retval : -EDOM;
 886                 }
 887
 888                 length = sizeof(*udev->bos->desc);
 889                 buf = dev->buf;
 890                 for (i = 0; i < num; i++) {
 891                         buf += length;
 892                         if (buf + sizeof(struct usb_dev_cap_header) >
 893                                         dev->buf + total)
 894                                 break;
 895
 896                         header = (struct usb_dev_cap_header *)buf;
 897                         length = header->bLength;
 898
 899                         if (header->bDescriptorType !=
 900                                         USB_DT_DEVICE_CAPABILITY) {
 901                                 dev_warn(&udev->dev, "not device capability descriptor, skip\n");
 902                                 continue;
 903                         }
 904
 905                         switch (header->bDevCapabilityType) {
 906                         case USB_CAP_TYPE_EXT:
 907                                 if (buf + USB_DT_USB_EXT_CAP_SIZE >
 908                                                 dev->buf + total ||
 909                                                 !is_good_ext(dev, buf)) {
 910                                         dev_err(&iface->dev, "bogus usb 2.0 extension descriptor\n");
 911                                         return -EDOM;
 912                                 }
 913                                 break;
 914                         case USB_SS_CAP_TYPE:
 915                                 if (buf + USB_DT_USB_SS_CAP_SIZE >
 916                                                 dev->buf + total ||
 917                                                 !is_good_ss_cap(dev, buf)) {
 918                                         dev_err(&iface->dev, "bogus superspeed device capability descriptor\n");
 919                                         return -EDOM;
 920                                 }
 921                                 break;
 922                         case CONTAINER_ID_TYPE:
 923                                 if (buf + USB_DT_USB_SS_CONTN_ID_SIZE >
 924                                                 dev->buf + total ||
 925                                                 !is_good_con_id(dev, buf)) {
 926                                         dev_err(&iface->dev, "bogus container id descriptor\n");
 927                                         return -EDOM;
 928                                 }
 929                                 break;
 930                         default:
 931                                 break;
 932                         }
 933                 }
 934         }
 935
 936         /* there's always [9.4.3] at least one config descriptor [9.6.3] */
 937         for (i = 0; i < udev->descriptor.bNumConfigurations; i++) {
 938                 retval = usb_get_descriptor(udev, USB_DT_CONFIG, i,
 939                                 dev->buf, TBUF_SIZE);
 940                 if (!is_good_config(dev, retval)) {
 941                         dev_err(&iface->dev,
 942                                         "config [%d] descriptor --> %d\n",
 943                                         i, retval);
 944                         return (retval < 0) ? retval : -EDOM;
 945                 }
 946
 947                 /* FIXME cross-checking udev->config[i] to make sure usbcore
 948                  * parsed it right (etc) would be good testing paranoia
 949                  */
 950         }
 951
 952         /* and sometimes [9.2.6.6] speed dependent descriptors */
 953         if (le16_to_cpu(udev->descriptor.bcdUSB) == 0x0200) {
 954                 struct usb_qualifier_descriptor *d = NULL;
 955
 956                 /* device qualifier [9.6.2] */
 957                 retval = usb_get_descriptor(udev,
 958                                 USB_DT_DEVICE_QUALIFIER, 0, dev->buf,
 959                                 sizeof(struct usb_qualifier_descriptor));
 960                 if (retval == -EPIPE) {
 961                         if (udev->speed == USB_SPEED_HIGH) {
 962                                 dev_err(&iface->dev,
 963                                                 "hs dev qualifier --> %d\n",
 964                                                 retval);
 965                                 return (retval < 0) ? retval : -EDOM;
 966                         }
 967                         /* usb2.0 but not high-speed capable; fine */
 968                 } else if (retval != sizeof(struct usb_qualifier_descriptor)) {
 969                         dev_err(&iface->dev, "dev qualifier --> %d\n", retval);
 970                         return (retval < 0) ? retval : -EDOM;
 971                 } else
 972                         d = (struct usb_qualifier_descriptor *) dev->buf;
 973
 974                 /* might not have [9.6.2] any other-speed configs [9.6.4] */
 975                 if (d) {
 976                         unsigned max = d->bNumConfigurations;
 977                         for (i = 0; i < max; i++) {
 978                                 retval = usb_get_descriptor(udev,
 979                                         USB_DT_OTHER_SPEED_CONFIG, i,
 980                                         dev->buf, TBUF_SIZE);
 981                                 if (!is_good_config(dev, retval)) {
 982                                         dev_err(&iface->dev,
 983                                                 "other speed config --> %d\n",
 984                                                 retval);
 985                                         return (retval < 0) ? retval : -EDOM;
 986                                 }
 987                         }
 988                 }
 989         }
 990         /* FIXME fetch strings from at least the device descriptor */
 991
 992         /* [9.4.5] get_status always works */
 993         retval = usb_get_status(udev, USB_RECIP_DEVICE, 0, dev->buf);
 994         if (retval) {
 995                 dev_err(&iface->dev, "get dev status --> %d\n", retval);
 996                 return retval;
 997         }
 998
 999         /* FIXME configuration.bmAttributes says if we could try to set/clear
1000          * the device's remote wakeup feature ... if we can, test that here
1001          */
1002
1003         retval = usb_get_status(udev, USB_RECIP_INTERFACE,
1004                         iface->altsetting[0].desc.bInterfaceNumber, dev->buf);
1005         if (retval) {
1006                 dev_err(&iface->dev, "get interface status --> %d\n", retval);
1007                 return retval;
1008         }
1009         /* FIXME get status for each endpoint in the interface */
1010
1011         return 0;
1012 }
1013
1014 /*-------------------------------------------------------------------------*/
1015
1016 /* use ch9 requests to test whether:
1017  *   (a) queues work for control, keeping N subtests queued and
1018  *       active (auto-resubmit) for M loops through the queue.
1019  *   (b) protocol stalls (control-only) will autorecover.
1020  *       it's not like bulk/intr; no halt clearing.
1021  *   (c) short control reads are reported and handled.
1022  *   (d) queues are always processed in-order
1023  */
1024
1025 struct ctrl_ctx {
1026         spinlock_t              lock;
1027         struct usbtest_dev      *dev;
1028         struct completion       complete;
1029         unsigned                count;
1030         unsigned                pending;
1031         int                     status;
1032         struct urb              **urb;
1033         struct usbtest_param    *param;
1034         int                     last;
1035 };
1036
1037 #define NUM_SUBCASES    16              /* how many test subcases here? */
1038
1039 struct subcase {
1040         struct usb_ctrlrequest  setup;
1041         int                     number;
1042         int                     expected;
1043 };
1044
1045 static void ctrl_complete(struct urb *urb)
1046 {
1047         struct ctrl_ctx         *ctx = urb->context;
1048         struct usb_ctrlrequest  *reqp;
1049         struct subcase          *subcase;
1050         int                     status = urb->status;
1051
1052         reqp = (struct usb_ctrlrequest *)urb->setup_packet;
1053         subcase = container_of(reqp, struct subcase, setup);
1054
1055         spin_lock(&ctx->lock);
1056         ctx->count--;
1057         ctx->pending--;
1058
1059         /* queue must transfer and complete in fifo order, unless
1060          * usb_unlink_urb() is used to unlink something not at the
1061          * physical queue head (not tested).
1062          */
1063         if (subcase->number > 0) {
1064                 if ((subcase->number - ctx->last) != 1) {
1065                         ERROR(ctx->dev,
1066                                 "subcase %d completed out of order, last %d\n",
1067                                 subcase->number, ctx->last);
1068                         status = -EDOM;
1069                         ctx->last = subcase->number;
1070                         goto error;
1071                 }
1072         }
1073         ctx->last = subcase->number;
1074
1075         /* succeed or fault in only one way? */
1076         if (status == subcase->expected)
1077                 status = 0;
1078
1079         /* async unlink for cleanup? */
1080         else if (status != -ECONNRESET) {
1081
1082                 /* some faults are allowed, not required */
1083                 if (subcase->expected > 0 && (
1084                           ((status == -subcase->expected        /* happened */
1085                            || status == 0))))                   /* didn't */
1086                         status = 0;
1087                 /* sometimes more than one fault is allowed */
1088                 else if (subcase->number == 12 && status == -EPIPE)
1089                         status = 0;
1090                 else
1091                         ERROR(ctx->dev, "subtest %d error, status %d\n",
1092                                         subcase->number, status);
1093         }
1094
1095         /* unexpected status codes mean errors; ideally, in hardware */
1096         if (status) {
1097 error:
1098                 if (ctx->status == 0) {
1099                         int             i;
1100
1101                         ctx->status = status;
1102                         ERROR(ctx->dev, "control queue %02x.%02x, err %d, "
1103                                         "%d left, subcase %d, len %d/%d\n",
1104                                         reqp->bRequestType, reqp->bRequest,
1105                                         status, ctx->count, subcase->number,
1106                                         urb->actual_length,
1107                                         urb->transfer_buffer_length);
1108
1109                         /* FIXME this "unlink everything" exit route should
1110                          * be a separate test case.
1111                          */
1112
1113                         /* unlink whatever's still pending */
1114                         for (i = 1; i < ctx->param->sglen; i++) {
1115                                 struct urb *u = ctx->urb[
1116                                                         (i + subcase->number)
1117                                                         % ctx->param->sglen];
1118
1119                                 if (u == urb || !u->dev)
1120                                         continue;
1121                                 spin_unlock(&ctx->lock);
1122                                 status = usb_unlink_urb(u);
1123                                 spin_lock(&ctx->lock);
1124                                 switch (status) {
1125                                 case -EINPROGRESS:
1126                                 case -EBUSY:
1127                                 case -EIDRM:
1128                                         continue;
1129                                 default:
1130                                         ERROR(ctx->dev, "urb unlink --> %d\n",
1131                                                         status);
1132                                 }
1133                         }
1134                         status = ctx->status;
1135                 }
1136         }
1137
1138         /* resubmit if we need to, else mark this as done */
1139         if ((status == 0) && (ctx->pending < ctx->count)) {
1140                 status = usb_submit_urb(urb, GFP_ATOMIC);
1141                 if (status != 0) {
1142                         ERROR(ctx->dev,
1143                                 "can't resubmit ctrl %02x.%02x, err %d\n",
1144                                 reqp->bRequestType, reqp->bRequest, status);
1145                         urb->dev = NULL;
1146                 } else
1147                         ctx->pending++;
1148         } else
1149                 urb->dev = NULL;
1150
1151         /* signal completion when nothing's queued */
1152         if (ctx->pending == 0)
1153                 complete(&ctx->complete);
1154         spin_unlock(&ctx->lock);
1155 }
1156
1157 static int
1158 test_ctrl_queue(struct usbtest_dev *dev, struct usbtest_param *param)
1159 {
1160         struct usb_device       *udev = testdev_to_usbdev(dev);
1161         struct urb              **urb;
1162         struct ctrl_ctx         context;
1163         int                     i;
1164
1165         if (param->sglen == 0 || param->iterations > UINT_MAX / param->sglen)
1166                 return -EOPNOTSUPP;
1167
1168         spin_lock_init(&context.lock);
1169         context.dev = dev;
1170         init_completion(&context.complete);
1171         context.count = param->sglen * param->iterations;
1172         context.pending = 0;
1173         context.status = -ENOMEM;
1174         context.param = param;
1175         context.last = -1;
1176
1177         /* allocate and init the urbs we'll queue.
1178          * as with bulk/intr sglists, sglen is the queue depth; it also
1179          * controls which subtests run (more tests than sglen) or rerun.
1180          */
1181         urb = kcalloc(param->sglen, sizeof(struct urb *), GFP_KERNEL);
1182         if (!urb)
1183                 return -ENOMEM;
1184         for (i = 0; i < param->sglen; i++) {
1185                 int                     pipe = usb_rcvctrlpipe(udev, 0);
1186                 unsigned                len;
1187                 struct urb              *u;
1188                 struct usb_ctrlrequest  req;
1189                 struct subcase          *reqp;
1190
1191                 /* sign of this variable means:
1192                  *  -: tested code must return this (negative) error code
1193                  *  +: tested code may return this (negative too) error code
1194                  */
1195                 int                     expected = 0;
1196
1197                 /* requests here are mostly expected to succeed on any
1198                  * device, but some are chosen to trigger protocol stalls
1199                  * or short reads.
1200                  */
1201                 memset(&req, 0, sizeof(req));
1202                 req.bRequest = USB_REQ_GET_DESCRIPTOR;
1203                 req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
1204
1205                 switch (i % NUM_SUBCASES) {
1206                 case 0:         /* get device descriptor */
1207                         req.wValue = cpu_to_le16(USB_DT_DEVICE << 8);
1208                         len = sizeof(struct usb_device_descriptor);
1209                         break;
1210                 case 1:         /* get first config descriptor (only) */
1211                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1212                         len = sizeof(struct usb_config_descriptor);
1213                         break;
1214                 case 2:         /* get altsetting (OFTEN STALLS) */
1215                         req.bRequest = USB_REQ_GET_INTERFACE;
1216                         req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
1217                         /* index = 0 means first interface */
1218                         len = 1;
1219                         expected = EPIPE;
1220                         break;
1221                 case 3:         /* get interface status */
1222                         req.bRequest = USB_REQ_GET_STATUS;
1223                         req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
1224                         /* interface 0 */
1225                         len = 2;
1226                         break;
1227                 case 4:         /* get device status */
1228                         req.bRequest = USB_REQ_GET_STATUS;
1229                         req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
1230                         len = 2;
1231                         break;
1232                 case 5:         /* get device qualifier (MAY STALL) */
1233                         req.wValue = cpu_to_le16 (USB_DT_DEVICE_QUALIFIER << 8);
1234                         len = sizeof(struct usb_qualifier_descriptor);
1235                         if (udev->speed != USB_SPEED_HIGH)
1236                                 expected = EPIPE;
1237                         break;
1238                 case 6:         /* get first config descriptor, plus interface */
1239                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1240                         len = sizeof(struct usb_config_descriptor);
1241                         len += sizeof(struct usb_interface_descriptor);
1242                         break;
1243                 case 7:         /* get interface descriptor (ALWAYS STALLS) */
1244                         req.wValue = cpu_to_le16 (USB_DT_INTERFACE << 8);
1245                         /* interface == 0 */
1246                         len = sizeof(struct usb_interface_descriptor);
1247                         expected = -EPIPE;
1248                         break;
1249                 /* NOTE: two consecutive stalls in the queue here.
1250                  *  that tests fault recovery a bit more aggressively. */
1251                 case 8:         /* clear endpoint halt (MAY STALL) */
1252                         req.bRequest = USB_REQ_CLEAR_FEATURE;
1253                         req.bRequestType = USB_RECIP_ENDPOINT;
1254                         /* wValue 0 == ep halt */
1255                         /* wIndex 0 == ep0 (shouldn't halt!) */
1256                         len = 0;
1257                         pipe = usb_sndctrlpipe(udev, 0);
1258                         expected = EPIPE;
1259                         break;
1260                 case 9:         /* get endpoint status */
1261                         req.bRequest = USB_REQ_GET_STATUS;
1262                         req.bRequestType = USB_DIR_IN|USB_RECIP_ENDPOINT;
1263                         /* endpoint 0 */
1264                         len = 2;
1265                         break;
1266                 case 10:        /* trigger short read (EREMOTEIO) */
1267                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1268                         len = 1024;
1269                         expected = -EREMOTEIO;
1270                         break;
1271                 /* NOTE: two consecutive _different_ faults in the queue. */
1272                 case 11:        /* get endpoint descriptor (ALWAYS STALLS) */
1273                         req.wValue = cpu_to_le16(USB_DT_ENDPOINT << 8);
1274                         /* endpoint == 0 */
1275                         len = sizeof(struct usb_interface_descriptor);
1276                         expected = EPIPE;
1277                         break;
1278                 /* NOTE: sometimes even a third fault in the queue! */
1279                 case 12:        /* get string 0 descriptor (MAY STALL) */
1280                         req.wValue = cpu_to_le16(USB_DT_STRING << 8);
1281                         /* string == 0, for language IDs */
1282                         len = sizeof(struct usb_interface_descriptor);
1283                         /* may succeed when > 4 languages */
1284                         expected = EREMOTEIO;   /* or EPIPE, if no strings */
1285                         break;
1286                 case 13:        /* short read, resembling case 10 */
1287                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1288                         /* last data packet "should" be DATA1, not DATA0 */
1289                         if (udev->speed == USB_SPEED_SUPER)
1290                                 len = 1024 - 512;
1291                         else
1292                                 len = 1024 - udev->descriptor.bMaxPacketSize0;
1293                         expected = -EREMOTEIO;
1294                         break;
1295                 case 14:        /* short read; try to fill the last packet */
1296                         req.wValue = cpu_to_le16((USB_DT_DEVICE << 8) | 0);
1297                         /* device descriptor size == 18 bytes */
1298                         len = udev->descriptor.bMaxPacketSize0;
1299                         if (udev->speed == USB_SPEED_SUPER)
1300                                 len = 512;
1301                         switch (len) {
1302                         case 8:
1303                                 len = 24;
1304                                 break;
1305                         case 16:
1306                                 len = 32;
1307                                 break;
1308                         }
1309                         expected = -EREMOTEIO;
1310                         break;
1311                 case 15:
1312                         req.wValue = cpu_to_le16(USB_DT_BOS << 8);
1313                         if (udev->bos)
1314                                 len = le16_to_cpu(udev->bos->desc->wTotalLength);
1315                         else
1316                                 len = sizeof(struct usb_bos_descriptor);
1317                         if (le16_to_cpu(udev->descriptor.bcdUSB) < 0x0201)
1318                                 expected = -EPIPE;
1319                         break;
1320                 default:
1321                         ERROR(dev, "bogus number of ctrl queue testcases!\n");
1322                         context.status = -EINVAL;
1323                         goto cleanup;
1324                 }
1325                 req.wLength = cpu_to_le16(len);
1326                 urb[i] = u = simple_alloc_urb(udev, pipe, len, 0);
1327                 if (!u)
1328                         goto cleanup;
1329
1330                 reqp = kmalloc(sizeof(*reqp), GFP_KERNEL);
1331                 if (!reqp)
1332                         goto cleanup;
1333                 reqp->setup = req;
1334                 reqp->number = i % NUM_SUBCASES;
1335                 reqp->expected = expected;
1336                 u->setup_packet = (char *) &reqp->setup;
1337
1338                 u->context = &context;
1339                 u->complete = ctrl_complete;
1340         }
1341
1342         /* queue the urbs */
1343         context.urb = urb;
1344         spin_lock_irq(&context.lock);
1345         for (i = 0; i < param->sglen; i++) {
1346                 context.status = usb_submit_urb(urb[i], GFP_ATOMIC);
1347                 if (context.status != 0) {
1348                         ERROR(dev, "can't submit urb[%d], status %d\n",
1349                                         i, context.status);
1350                         context.count = context.pending;
1351                         break;
1352                 }
1353                 context.pending++;
1354         }
1355         spin_unlock_irq(&context.lock);
1356
1357         /* FIXME  set timer and time out; provide a disconnect hook */
1358
1359         /* wait for the last one to complete */
1360         if (context.pending > 0)
1361                 wait_for_completion(&context.complete);
1362
1363 cleanup:
1364         for (i = 0; i < param->sglen; i++) {
1365                 if (!urb[i])
1366                         continue;
1367                 urb[i]->dev = udev;
1368                 kfree(urb[i]->setup_packet);
1369                 simple_free_urb(urb[i]);
1370         }
1371         kfree(urb);
1372         return context.status;
1373 }
1374 #undef NUM_SUBCASES
1375
1376
1377 /*-------------------------------------------------------------------------*/
1378
1379 static void unlink1_callback(struct urb *urb)
1380 {
1381         int     status = urb->status;
1382
1383         /* we "know" -EPIPE (stall) never happens */
1384         if (!status)
1385                 status = usb_submit_urb(urb, GFP_ATOMIC);
1386         if (status) {
1387                 urb->status = status;
1388                 complete(urb->context);
1389         }
1390 }
1391
1392 static int unlink1(struct usbtest_dev *dev, int pipe, int size, int async)
1393 {
1394         struct urb              *urb;
1395         struct completion       completion;
1396         int                     retval = 0;
1397
1398         init_completion(&completion);
1399         urb = simple_alloc_urb(testdev_to_usbdev(dev), pipe, size, 0);
1400         if (!urb)
1401                 return -ENOMEM;
1402         urb->context = &completion;
1403         urb->complete = unlink1_callback;
1404
1405         if (usb_pipeout(urb->pipe)) {
1406                 simple_fill_buf(urb);
1407                 urb->transfer_flags |= URB_ZERO_PACKET;
1408         }
1409
1410         /* keep the endpoint busy.  there are lots of hc/hcd-internal
1411          * states, and testing should get to all of them over time.
1412          *
1413          * FIXME want additional tests for when endpoint is STALLing
1414          * due to errors, or is just NAKing requests.
1415          */
1416         retval = usb_submit_urb(urb, GFP_KERNEL);
1417         if (retval != 0) {
1418                 dev_err(&dev->intf->dev, "submit fail %d\n", retval);
1419                 return retval;
1420         }
1421
1422         /* unlinking that should always work.  variable delay tests more
1423          * hcd states and code paths, even with little other system load.
1424          */
1425         msleep(jiffies % (2 * INTERRUPT_RATE));
1426         if (async) {
1427                 while (!completion_done(&completion)) {
1428                         retval = usb_unlink_urb(urb);
1429
1430                         if (retval == 0 && usb_pipein(urb->pipe))
1431                                 retval = simple_check_buf(dev, urb);
1432
1433                         switch (retval) {
1434                         case -EBUSY:
1435                         case -EIDRM:
1436                                 /* we can't unlink urbs while they're completing
1437                                  * or if they've completed, and we haven't
1438                                  * resubmitted. "normal" drivers would prevent
1439                                  * resubmission, but since we're testing unlink
1440                                  * paths, we can't.
1441                                  */
1442                                 ERROR(dev, "unlink retry\n");
1443                                 continue;
1444                         case 0:
1445                         case -EINPROGRESS:
1446                                 break;
1447
1448                         default:
1449                                 dev_err(&dev->intf->dev,
1450                                         "unlink fail %d\n", retval);
1451                                 return retval;
1452                         }
1453
1454                         break;
1455                 }
1456         } else
1457                 usb_kill_urb(urb);
1458
1459         wait_for_completion(&completion);
1460         retval = urb->status;
1461         simple_free_urb(urb);
1462
1463         if (async)
1464                 return (retval == -ECONNRESET) ? 0 : retval - 1000;
1465         else
1466                 return (retval == -ENOENT || retval == -EPERM) ?
1467                                 0 : retval - 2000;
1468 }
1469
1470 static int unlink_simple(struct usbtest_dev *dev, int pipe, int len)
1471 {
1472         int                     retval = 0;
1473
1474         /* test sync and async paths */
1475         retval = unlink1(dev, pipe, len, 1);
1476         if (!retval)
1477                 retval = unlink1(dev, pipe, len, 0);
1478         return retval;
1479 }
1480
1481 /*-------------------------------------------------------------------------*/
1482
1483 struct queued_ctx {
1484         struct completion       complete;
1485         atomic_t                pending;
1486         unsigned                num;
1487         int                     status;
1488         struct urb              **urbs;
1489 };
1490
1491 static void unlink_queued_callback(struct urb *urb)
1492 {
1493         int                     status = urb->status;
1494         struct queued_ctx       *ctx = urb->context;
1495
1496         if (ctx->status)
1497                 goto done;
1498         if (urb == ctx->urbs[ctx->num - 4] || urb == ctx->urbs[ctx->num - 2]) {
1499                 if (status == -ECONNRESET)
1500                         goto done;
1501                 /* What error should we report if the URB completed normally? */
1502         }
1503         if (status != 0)
1504                 ctx->status = status;
1505
1506  done:
1507         if (atomic_dec_and_test(&ctx->pending))
1508                 complete(&ctx->complete);
1509 }
1510
1511 static int unlink_queued(struct usbtest_dev *dev, int pipe, unsigned num,
1512                 unsigned size)
1513 {
1514         struct queued_ctx       ctx;
1515         struct usb_device       *udev = testdev_to_usbdev(dev);
1516         void                    *buf;
1517         dma_addr_t              buf_dma;
1518         int                     i;
1519         int                     retval = -ENOMEM;
1520
1521         init_completion(&ctx.complete);
1522         atomic_set(&ctx.pending, 1);    /* One more than the actual value */
1523         ctx.num = num;
1524         ctx.status = 0;
1525
1526         buf = usb_alloc_coherent(udev, size, GFP_KERNEL, &buf_dma);
1527         if (!buf)
1528                 return retval;
1529         memset(buf, 0, size);
1530
1531         /* Allocate and init the urbs we'll queue */
1532         ctx.urbs = kcalloc(num, sizeof(struct urb *), GFP_KERNEL);
1533         if (!ctx.urbs)
1534                 goto free_buf;
1535         for (i = 0; i < num; i++) {
1536                 ctx.urbs[i] = usb_alloc_urb(0, GFP_KERNEL);
1537                 if (!ctx.urbs[i])
1538                         goto free_urbs;
1539                 usb_fill_bulk_urb(ctx.urbs[i], udev, pipe, buf, size,
1540                                 unlink_queued_callback, &ctx);
1541                 ctx.urbs[i]->transfer_dma = buf_dma;
1542                 ctx.urbs[i]->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
1543
1544                 if (usb_pipeout(ctx.urbs[i]->pipe)) {
1545                         simple_fill_buf(ctx.urbs[i]);
1546                         ctx.urbs[i]->transfer_flags |= URB_ZERO_PACKET;
1547                 }
1548         }
1549
1550         /* Submit all the URBs and then unlink URBs num - 4 and num - 2. */
1551         for (i = 0; i < num; i++) {
1552                 atomic_inc(&ctx.pending);
1553                 retval = usb_submit_urb(ctx.urbs[i], GFP_KERNEL);
1554                 if (retval != 0) {
1555                         dev_err(&dev->intf->dev, "submit urbs[%d] fail %d\n",
1556                                         i, retval);
1557                         atomic_dec(&ctx.pending);
1558                         ctx.status = retval;
1559                         break;
1560                 }
1561         }
1562         if (i == num) {
1563                 usb_unlink_urb(ctx.urbs[num - 4]);
1564                 usb_unlink_urb(ctx.urbs[num - 2]);
1565         } else {
1566                 while (--i >= 0)
1567                         usb_unlink_urb(ctx.urbs[i]);
1568         }
1569
1570         if (atomic_dec_and_test(&ctx.pending))          /* The extra count */
1571                 complete(&ctx.complete);
1572         wait_for_completion(&ctx.complete);
1573         retval = ctx.status;
1574
1575  free_urbs:
1576         for (i = 0; i < num; i++)
1577                 usb_free_urb(ctx.urbs[i]);
1578         kfree(ctx.urbs);
1579  free_buf:
1580         usb_free_coherent(udev, size, buf, buf_dma);
1581         return retval;
1582 }
1583
1584 /*-------------------------------------------------------------------------*/
1585
1586 static int verify_not_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
1587 {
1588         int     retval;
1589         u16     status;
1590
1591         /* shouldn't look or act halted */
1592         retval = usb_get_status(urb->dev, USB_RECIP_ENDPOINT, ep, &status);
1593         if (retval < 0) {
1594                 ERROR(tdev, "ep %02x couldn't get no-halt status, %d\n",
1595                                 ep, retval);
1596                 return retval;
1597         }
1598         if (status != 0) {
1599                 ERROR(tdev, "ep %02x bogus status: %04x != 0\n", ep, status);
1600                 return -EINVAL;
1601         }
1602         retval = simple_io(tdev, urb, 1, 0, 0, __func__);
1603         if (retval != 0)
1604                 return -EINVAL;
1605         return 0;
1606 }
1607
1608 static int verify_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
1609 {
1610         int     retval;
1611         u16     status;
1612
1613         /* should look and act halted */
1614         retval = usb_get_status(urb->dev, USB_RECIP_ENDPOINT, ep, &status);
1615         if (retval < 0) {
1616                 ERROR(tdev, "ep %02x couldn't get halt status, %d\n",
1617                                 ep, retval);
1618                 return retval;
1619         }
1620         if (status != 1) {
1621                 ERROR(tdev, "ep %02x bogus status: %04x != 1\n", ep, status);
1622                 return -EINVAL;
1623         }
1624         retval = simple_io(tdev, urb, 1, 0, -EPIPE, __func__);
1625         if (retval != -EPIPE)
1626                 return -EINVAL;
1627         retval = simple_io(tdev, urb, 1, 0, -EPIPE, "verify_still_halted");
1628         if (retval != -EPIPE)
1629                 return -EINVAL;
1630         return 0;
1631 }
1632
1633 static int test_halt(struct usbtest_dev *tdev, int ep, struct urb *urb)
1634 {
1635         int     retval;
1636
1637         /* shouldn't look or act halted now */
1638         retval = verify_not_halted(tdev, ep, urb);
1639         if (retval < 0)
1640                 return retval;
1641
1642         /* set halt (protocol test only), verify it worked */
1643         retval = usb_control_msg(urb->dev, usb_sndctrlpipe(urb->dev, 0),
1644                         USB_REQ_SET_FEATURE, USB_RECIP_ENDPOINT,
1645                         USB_ENDPOINT_HALT, ep,
1646                         NULL, 0, USB_CTRL_SET_TIMEOUT);
1647         if (retval < 0) {
1648                 ERROR(tdev, "ep %02x couldn't set halt, %d\n", ep, retval);
1649                 return retval;
1650         }
1651         retval = verify_halted(tdev, ep, urb);
1652         if (retval < 0) {
1653                 int ret;
1654
1655                 /* clear halt anyways, else further tests will fail */
1656                 ret = usb_clear_halt(urb->dev, urb->pipe);
1657                 if (ret)
1658                         ERROR(tdev, "ep %02x couldn't clear halt, %d\n",
1659                               ep, ret);
1660
1661                 return retval;
1662         }
1663
1664         /* clear halt (tests API + protocol), verify it worked */
1665         retval = usb_clear_halt(urb->dev, urb->pipe);
1666         if (retval < 0) {
1667                 ERROR(tdev, "ep %02x couldn't clear halt, %d\n", ep, retval);
1668                 return retval;
1669         }
1670         retval = verify_not_halted(tdev, ep, urb);
1671         if (retval < 0)
1672                 return retval;
1673
1674         /* NOTE:  could also verify SET_INTERFACE clear halts ... */
1675
1676         return 0;
1677 }
1678
1679 static int halt_simple(struct usbtest_dev *dev)
1680 {
1681         int                     ep;
1682         int                     retval = 0;
1683         struct urb              *urb;
1684         struct usb_device       *udev = testdev_to_usbdev(dev);
1685
1686         if (udev->speed == USB_SPEED_SUPER)
1687                 urb = simple_alloc_urb(udev, 0, 1024, 0);
1688         else
1689                 urb = simple_alloc_urb(udev, 0, 512, 0);
1690         if (urb == NULL)
1691                 return -ENOMEM;
1692
1693         if (dev->in_pipe) {
1694                 ep = usb_pipeendpoint(dev->in_pipe) | USB_DIR_IN;
1695                 urb->pipe = dev->in_pipe;
1696                 retval = test_halt(dev, ep, urb);
1697                 if (retval < 0)
1698                         goto done;
1699         }
1700
1701         if (dev->out_pipe) {
1702                 ep = usb_pipeendpoint(dev->out_pipe);
1703                 urb->pipe = dev->out_pipe;
1704                 retval = test_halt(dev, ep, urb);
1705         }
1706 done:
1707         simple_free_urb(urb);
1708         return retval;
1709 }
1710
1711 /*-------------------------------------------------------------------------*/
1712
1713 /* Control OUT tests use the vendor control requests from Intel's
1714  * USB 2.0 compliance test device:  write a buffer, read it back.
1715  *
1716  * Intel's spec only _requires_ that it work for one packet, which
1717  * is pretty weak.   Some HCDs place limits here; most devices will
1718  * need to be able to handle more than one OUT data packet.  We'll
1719  * try whatever we're told to try.
1720  */
1721 static int ctrl_out(struct usbtest_dev *dev,
1722                 unsigned count, unsigned length, unsigned vary, unsigned offset)
1723 {
1724         unsigned                i, j, len;
1725         int                     retval;
1726         u8                      *buf;
1727         char                    *what = "?";
1728         struct usb_device       *udev;
1729
1730         if (length < 1 || length > 0xffff || vary >= length)
1731                 return -EINVAL;
1732
1733         buf = kmalloc(length + offset, GFP_KERNEL);
1734         if (!buf)
1735                 return -ENOMEM;
1736
1737         buf += offset;
1738         udev = testdev_to_usbdev(dev);
1739         len = length;
1740         retval = 0;
1741
1742         /* NOTE:  hardware might well act differently if we pushed it
1743          * with lots back-to-back queued requests.
1744          */
1745         for (i = 0; i < count; i++) {
1746                 /* write patterned data */
1747                 for (j = 0; j < len; j++)
1748                         buf[j] = (u8)(i + j);
1749                 retval = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
1750                                 0x5b, USB_DIR_OUT|USB_TYPE_VENDOR,
1751                                 0, 0, buf, len, USB_CTRL_SET_TIMEOUT);
1752                 if (retval != len) {
1753                         what = "write";
1754                         if (retval >= 0) {
1755                                 ERROR(dev, "ctrl_out, wlen %d (expected %d)\n",
1756                                                 retval, len);
1757                                 retval = -EBADMSG;
1758                         }
1759                         break;
1760                 }
1761
1762                 /* read it back -- assuming nothing intervened!!  */
1763                 retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
1764                                 0x5c, USB_DIR_IN|USB_TYPE_VENDOR,
1765                                 0, 0, buf, len, USB_CTRL_GET_TIMEOUT);
1766                 if (retval != len) {
1767                         what = "read";
1768                         if (retval >= 0) {
1769                                 ERROR(dev, "ctrl_out, rlen %d (expected %d)\n",
1770                                                 retval, len);
1771                                 retval = -EBADMSG;
1772                         }
1773                         break;
1774                 }
1775
1776                 /* fail if we can't verify */
1777                 for (j = 0; j < len; j++) {
1778                         if (buf[j] != (u8)(i + j)) {
1779                                 ERROR(dev, "ctrl_out, byte %d is %d not %d\n",
1780                                         j, buf[j], (u8)(i + j));
1781                                 retval = -EBADMSG;
1782                                 break;
1783                         }
1784                 }
1785                 if (retval < 0) {
1786                         what = "verify";
1787                         break;
1788                 }
1789
1790                 len += vary;
1791
1792                 /* [real world] the "zero bytes IN" case isn't really used.
1793                  * hardware can easily trip up in this weird case, since its
1794                  * status stage is IN, not OUT like other ep0in transfers.
1795                  */
1796                 if (len > length)
1797                         len = realworld ? 1 : 0;
1798         }
1799
1800         if (retval < 0)
1801                 ERROR(dev, "ctrl_out %s failed, code %d, count %d\n",
1802                         what, retval, i);
1803
1804         kfree(buf - offset);
1805         return retval;
1806 }
1807
1808 /*-------------------------------------------------------------------------*/
1809
1810 /* ISO/BULK tests ... mimics common usage
1811  *  - buffer length is split into N packets (mostly maxpacket sized)
1812  *  - multi-buffers according to sglen
1813  */
1814
1815 struct transfer_context {
1816         unsigned                count;
1817         unsigned                pending;
1818         spinlock_t              lock;
1819         struct completion       done;
1820         int                     submit_error;
1821         unsigned long           errors;
1822         unsigned long           packet_count;
1823         struct usbtest_dev      *dev;
1824         bool                    is_iso;
1825 };
1826
1827 static void complicated_callback(struct urb *urb)
1828 {
1829         struct transfer_context *ctx = urb->context;
1830
1831         spin_lock(&ctx->lock);
1832         ctx->count--;
1833
1834         ctx->packet_count += urb->number_of_packets;
1835         if (urb->error_count > 0)
1836                 ctx->errors += urb->error_count;
1837         else if (urb->status != 0)
1838                 ctx->errors += (ctx->is_iso ? urb->number_of_packets : 1);
1839         else if (urb->actual_length != urb->transfer_buffer_length)
1840                 ctx->errors++;
1841         else if (check_guard_bytes(ctx->dev, urb) != 0)
1842                 ctx->errors++;
1843
1844         if (urb->status == 0 && ctx->count > (ctx->pending - 1)
1845                         && !ctx->submit_error) {
1846                 int status = usb_submit_urb(urb, GFP_ATOMIC);
1847                 switch (status) {
1848                 case 0:
1849                         goto done;
1850                 default:
1851                         dev_err(&ctx->dev->intf->dev,
1852                                         "iso resubmit err %d\n",
1853                                         status);
1854                         /* FALLTHROUGH */
1855                 case -ENODEV:                   /* disconnected */
1856                 case -ESHUTDOWN:                /* endpoint disabled */
1857                         ctx->submit_error = 1;
1858                         break;
1859                 }
1860         }
1861
1862         ctx->pending--;
1863         if (ctx->pending == 0) {
1864                 if (ctx->errors)
1865                         dev_err(&ctx->dev->intf->dev,
1866                                 "iso test, %lu errors out of %lu\n",
1867                                 ctx->errors, ctx->packet_count);
1868                 complete(&ctx->done);
1869         }
1870 done:
1871         spin_unlock(&ctx->lock);
1872 }
1873
1874 static struct urb *iso_alloc_urb(
1875         struct usb_device       *udev,
1876         int                     pipe,
1877         struct usb_endpoint_descriptor  *desc,
1878         long                    bytes,
1879         unsigned offset
1880 )
1881 {
1882         struct urb              *urb;
1883         unsigned                i, maxp, packets;
1884
1885         if (bytes < 0 || !desc)
1886                 return NULL;
1887         maxp = 0x7ff & usb_endpoint_maxp(desc);
1888         maxp *= 1 + (0x3 & (usb_endpoint_maxp(desc) >> 11));
1889         packets = DIV_ROUND_UP(bytes, maxp);
1890
1891         urb = usb_alloc_urb(packets, GFP_KERNEL);
1892         if (!urb)
1893                 return urb;
1894         urb->dev = udev;
1895         urb->pipe = pipe;
1896
1897         urb->number_of_packets = packets;
1898         urb->transfer_buffer_length = bytes;
1899         urb->transfer_buffer = usb_alloc_coherent(udev, bytes + offset,
1900                                                         GFP_KERNEL,
1901                                                         &urb->transfer_dma);
1902         if (!urb->transfer_buffer) {
1903                 usb_free_urb(urb);
1904                 return NULL;
1905         }
1906         if (offset) {
1907                 memset(urb->transfer_buffer, GUARD_BYTE, offset);
1908                 urb->transfer_buffer += offset;
1909                 urb->transfer_dma += offset;
1910         }
1911         /* For inbound transfers use guard byte so that test fails if
1912                 data not correctly copied */
1913         memset(urb->transfer_buffer,
1914                         usb_pipein(urb->pipe) ? GUARD_BYTE : 0,
1915                         bytes);
1916
1917         for (i = 0; i < packets; i++) {
1918                 /* here, only the last packet will be short */
1919                 urb->iso_frame_desc[i].length = min((unsigned) bytes, maxp);
1920                 bytes -= urb->iso_frame_desc[i].length;
1921
1922                 urb->iso_frame_desc[i].offset = maxp * i;
1923         }
1924
1925         urb->complete = complicated_callback;
1926         /* urb->context = SET BY CALLER */
1927         urb->interval = 1 << (desc->bInterval - 1);
1928         urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
1929         return urb;
1930 }
1931
1932 static int
1933 test_queue(struct usbtest_dev *dev, struct usbtest_param *param,
1934                 int pipe, struct usb_endpoint_descriptor *desc, unsigned offset)
1935 {
1936         struct transfer_context context;
1937         struct usb_device       *udev;
1938         unsigned                i;
1939         unsigned long           packets = 0;
1940         int                     status = 0;
1941         struct urb              *urbs[param->sglen];
1942
1943         memset(&context, 0, sizeof(context));
1944         context.count = param->iterations * param->sglen;
1945         context.dev = dev;
1946         context.is_iso = !!desc;
1947         init_completion(&context.done);
1948         spin_lock_init(&context.lock);
1949
1950         udev = testdev_to_usbdev(dev);
1951
1952         for (i = 0; i < param->sglen; i++) {
1953                 if (context.is_iso)
1954                         urbs[i] = iso_alloc_urb(udev, pipe, desc,
1955                                         param->length, offset);
1956                 else
1957                         urbs[i] = complicated_alloc_urb(udev, pipe,
1958                                         param->length, 0);
1959
1960                 if (!urbs[i]) {
1961                         status = -ENOMEM;
1962                         goto fail;
1963                 }
1964                 packets += urbs[i]->number_of_packets;
1965                 urbs[i]->context = &context;
1966         }
1967         packets *= param->iterations;
1968
1969         if (context.is_iso) {
1970                 dev_info(&dev->intf->dev,
1971                         "iso period %d %sframes, wMaxPacket %d, transactions: %d\n",
1972                         1 << (desc->bInterval - 1),
1973                         (udev->speed == USB_SPEED_HIGH) ? "micro" : "",
1974                         usb_endpoint_maxp(desc) & 0x7ff,
1975                         1 + (0x3 & (usb_endpoint_maxp(desc) >> 11)));
1976
1977                 dev_info(&dev->intf->dev,
1978                         "total %lu msec (%lu packets)\n",
1979                         (packets * (1 << (desc->bInterval - 1)))
1980                                 / ((udev->speed == USB_SPEED_HIGH) ? 8 : 1),
1981                         packets);
1982         }
1983
1984         spin_lock_irq(&context.lock);
1985         for (i = 0; i < param->sglen; i++) {
1986                 ++context.pending;
1987                 status = usb_submit_urb(urbs[i], GFP_ATOMIC);
1988                 if (status < 0) {
1989                         ERROR(dev, "submit iso[%d], error %d\n", i, status);
1990                         if (i == 0) {
1991                                 spin_unlock_irq(&context.lock);
1992                                 goto fail;
1993                         }
1994
1995                         simple_free_urb(urbs[i]);
1996                         urbs[i] = NULL;
1997                         context.pending--;
1998                         context.submit_error = 1;
1999                         break;
2000                 }
2001         }
2002         spin_unlock_irq(&context.lock);
2003
2004         wait_for_completion(&context.done);
2005
2006         for (i = 0; i < param->sglen; i++) {
2007                 if (urbs[i])
2008                         simple_free_urb(urbs[i]);
2009         }
2010         /*
2011          * Isochronous transfers are expected to fail sometimes.  As an
2012          * arbitrary limit, we will report an error if any submissions
2013          * fail or if the transfer failure rate is > 10%.
2014          */
2015         if (status != 0)
2016                 ;
2017         else if (context.submit_error)
2018                 status = -EACCES;
2019         else if (context.errors >
2020                         (context.is_iso ? context.packet_count / 10 : 0))
2021                 status = -EIO;
2022         return status;
2023
2024 fail:
2025         for (i = 0; i < param->sglen; i++) {
2026                 if (urbs[i])
2027                         simple_free_urb(urbs[i]);
2028         }
2029         return status;
2030 }
2031
2032 static int test_unaligned_bulk(
2033         struct usbtest_dev *tdev,
2034         int pipe,
2035         unsigned length,
2036         int iterations,
2037         unsigned transfer_flags,
2038         const char *label)
2039 {
2040         int retval;
2041         struct urb *urb = usbtest_alloc_urb(testdev_to_usbdev(tdev),
2042                         pipe, length, transfer_flags, 1, 0, simple_callback);
2043
2044         if (!urb)
2045                 return -ENOMEM;
2046
2047         retval = simple_io(tdev, urb, iterations, 0, 0, label);
2048         simple_free_urb(urb);
2049         return retval;
2050 }
2051
2052 /*-------------------------------------------------------------------------*/
2053
2054 /* We only have this one interface to user space, through usbfs.
2055  * User mode code can scan usbfs to find N different devices (maybe on
2056  * different busses) to use when testing, and allocate one thread per
2057  * test.  So discovery is simplified, and we have no device naming issues.
2058  *
2059  * Don't use these only as stress/load tests.  Use them along with with
2060  * other USB bus activity:  plugging, unplugging, mousing, mp3 playback,
2061  * video capture, and so on.  Run different tests at different times, in
2062  * different sequences.  Nothing here should interact with other devices,
2063  * except indirectly by consuming USB bandwidth and CPU resources for test
2064  * threads and request completion.  But the only way to know that for sure
2065  * is to test when HC queues are in use by many devices.
2066  *
2067  * WARNING:  Because usbfs grabs udev->dev.sem before calling this ioctl(),
2068  * it locks out usbcore in certain code paths.  Notably, if you disconnect
2069  * the device-under-test, hub_wq will wait block forever waiting for the
2070  * ioctl to complete ... so that usb_disconnect() can abort the pending
2071  * urbs and then call usbtest_disconnect().  To abort a test, you're best
2072  * off just killing the userspace task and waiting for it to exit.
2073  */
2074
2075 static int
2076 usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
2077 {
2078         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2079         struct usb_device       *udev = testdev_to_usbdev(dev);
2080         struct usbtest_param    *param = buf;
2081         int                     retval = -EOPNOTSUPP;
2082         struct urb              *urb;
2083         struct scatterlist      *sg;
2084         struct usb_sg_request   req;
2085         struct timeval          start;
2086         unsigned                i;
2087
2088         /* FIXME USBDEVFS_CONNECTINFO doesn't say how fast the device is. */
2089
2090         pattern = mod_pattern;
2091
2092         if (code != USBTEST_REQUEST)
2093                 return -EOPNOTSUPP;
2094
2095         if (param->iterations <= 0)
2096                 return -EINVAL;
2097
2098         if (param->sglen > MAX_SGLEN)
2099                 return -EINVAL;
2100
2101         if (mutex_lock_interruptible(&dev->lock))
2102                 return -ERESTARTSYS;
2103
2104         /* FIXME: What if a system sleep starts while a test is running? */
2105
2106         /* some devices, like ez-usb default devices, need a non-default
2107          * altsetting to have any active endpoints.  some tests change
2108          * altsettings; force a default so most tests don't need to check.
2109          */
2110         if (dev->info->alt >= 0) {
2111                 int     res;
2112
2113                 if (intf->altsetting->desc.bInterfaceNumber) {
2114                         mutex_unlock(&dev->lock);
2115                         return -ENODEV;
2116                 }
2117                 res = set_altsetting(dev, dev->info->alt);
2118                 if (res) {
2119                         dev_err(&intf->dev,
2120                                         "set altsetting to %d failed, %d\n",
2121                                         dev->info->alt, res);
2122                         mutex_unlock(&dev->lock);
2123                         return res;
2124                 }
2125         }
2126
2127         /*
2128          * Just a bunch of test cases that every HCD is expected to handle.
2129          *
2130          * Some may need specific firmware, though it'd be good to have
2131          * one firmware image to handle all the test cases.
2132          *
2133          * FIXME add more tests!  cancel requests, verify the data, control
2134          * queueing, concurrent read+write threads, and so on.
2135          */
2136         do_gettimeofday(&start);
2137         switch (param->test_num) {
2138
2139         case 0:
2140                 dev_info(&intf->dev, "TEST 0:  NOP\n");
2141                 retval = 0;
2142                 break;
2143
2144         /* Simple non-queued bulk I/O tests */
2145         case 1:
2146                 if (dev->out_pipe == 0)
2147                         break;
2148                 dev_info(&intf->dev,
2149                                 "TEST 1:  write %d bytes %u times\n",
2150                                 param->length, param->iterations);
2151                 urb = simple_alloc_urb(udev, dev->out_pipe, param->length, 0);
2152                 if (!urb) {
2153                         retval = -ENOMEM;
2154                         break;
2155                 }
2156                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2157                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test1");
2158                 simple_free_urb(urb);
2159                 break;
2160         case 2:
2161                 if (dev->in_pipe == 0)
2162                         break;
2163                 dev_info(&intf->dev,
2164                                 "TEST 2:  read %d bytes %u times\n",
2165                                 param->length, param->iterations);
2166                 urb = simple_alloc_urb(udev, dev->in_pipe, param->length, 0);
2167                 if (!urb) {
2168                         retval = -ENOMEM;
2169                         break;
2170                 }
2171                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2172                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test2");
2173                 simple_free_urb(urb);
2174                 break;
2175         case 3:
2176                 if (dev->out_pipe == 0 || param->vary == 0)
2177                         break;
2178                 dev_info(&intf->dev,
2179                                 "TEST 3:  write/%d 0..%d bytes %u times\n",
2180                                 param->vary, param->length, param->iterations);
2181                 urb = simple_alloc_urb(udev, dev->out_pipe, param->length, 0);
2182                 if (!urb) {
2183                         retval = -ENOMEM;
2184                         break;
2185                 }
2186                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2187                 retval = simple_io(dev, urb, param->iterations, param->vary,
2188                                         0, "test3");
2189                 simple_free_urb(urb);
2190                 break;
2191         case 4:
2192                 if (dev->in_pipe == 0 || param->vary == 0)
2193                         break;
2194                 dev_info(&intf->dev,
2195                                 "TEST 4:  read/%d 0..%d bytes %u times\n",
2196                                 param->vary, param->length, param->iterations);
2197                 urb = simple_alloc_urb(udev, dev->in_pipe, param->length, 0);
2198                 if (!urb) {
2199                         retval = -ENOMEM;
2200                         break;
2201                 }
2202                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2203                 retval = simple_io(dev, urb, param->iterations, param->vary,
2204                                         0, "test4");
2205                 simple_free_urb(urb);
2206                 break;
2207
2208         /* Queued bulk I/O tests */
2209         case 5:
2210                 if (dev->out_pipe == 0 || param->sglen == 0)
2211                         break;
2212                 dev_info(&intf->dev,
2213                         "TEST 5:  write %d sglists %d entries of %d bytes\n",
2214                                 param->iterations,
2215                                 param->sglen, param->length);
2216                 sg = alloc_sglist(param->sglen, param->length,
2217                                 0, dev, dev->out_pipe);
2218                 if (!sg) {
2219                         retval = -ENOMEM;
2220                         break;
2221                 }
2222                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2223                 retval = perform_sglist(dev, param->iterations, dev->out_pipe,
2224                                 &req, sg, param->sglen);
2225                 free_sglist(sg, param->sglen);
2226                 break;
2227
2228         case 6:
2229                 if (dev->in_pipe == 0 || param->sglen == 0)
2230                         break;
2231                 dev_info(&intf->dev,
2232                         "TEST 6:  read %d sglists %d entries of %d bytes\n",
2233                                 param->iterations,
2234                                 param->sglen, param->length);
2235                 sg = alloc_sglist(param->sglen, param->length,
2236                                 0, dev, dev->in_pipe);
2237                 if (!sg) {
2238                         retval = -ENOMEM;
2239                         break;
2240                 }
2241                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2242                 retval = perform_sglist(dev, param->iterations, dev->in_pipe,
2243                                 &req, sg, param->sglen);
2244                 free_sglist(sg, param->sglen);
2245                 break;
2246         case 7:
2247                 if (dev->out_pipe == 0 || param->sglen == 0 || param->vary == 0)
2248                         break;
2249                 dev_info(&intf->dev,
2250                         "TEST 7:  write/%d %d sglists %d entries 0..%d bytes\n",
2251                                 param->vary, param->iterations,
2252                                 param->sglen, param->length);
2253                 sg = alloc_sglist(param->sglen, param->length,
2254                                 param->vary, dev, dev->out_pipe);
2255                 if (!sg) {
2256                         retval = -ENOMEM;
2257                         break;
2258                 }
2259                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2260                 retval = perform_sglist(dev, param->iterations, dev->out_pipe,
2261                                 &req, sg, param->sglen);
2262                 free_sglist(sg, param->sglen);
2263                 break;
2264         case 8:
2265                 if (dev->in_pipe == 0 || param->sglen == 0 || param->vary == 0)
2266                         break;
2267                 dev_info(&intf->dev,
2268                         "TEST 8:  read/%d %d sglists %d entries 0..%d bytes\n",
2269                                 param->vary, param->iterations,
2270                                 param->sglen, param->length);
2271                 sg = alloc_sglist(param->sglen, param->length,
2272                                 param->vary, dev, dev->in_pipe);
2273                 if (!sg) {
2274                         retval = -ENOMEM;
2275                         break;
2276                 }
2277                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2278                 retval = perform_sglist(dev, param->iterations, dev->in_pipe,
2279                                 &req, sg, param->sglen);
2280                 free_sglist(sg, param->sglen);
2281                 break;
2282
2283         /* non-queued sanity tests for control (chapter 9 subset) */
2284         case 9:
2285                 retval = 0;
2286                 dev_info(&intf->dev,
2287                         "TEST 9:  ch9 (subset) control tests, %d times\n",
2288                                 param->iterations);
2289                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2290                         retval = ch9_postconfig(dev);
2291                 if (retval)
2292                         dev_err(&intf->dev, "ch9 subset failed, "
2293                                         "iterations left %d\n", i);
2294                 break;
2295
2296         /* queued control messaging */
2297         case 10:
2298                 retval = 0;
2299                 dev_info(&intf->dev,
2300                                 "TEST 10:  queue %d control calls, %d times\n",
2301                                 param->sglen,
2302                                 param->iterations);
2303                 retval = test_ctrl_queue(dev, param);
2304                 break;
2305
2306         /* simple non-queued unlinks (ring with one urb) */
2307         case 11:
2308                 if (dev->in_pipe == 0 || !param->length)
2309                         break;
2310                 retval = 0;
2311                 dev_info(&intf->dev, "TEST 11:  unlink %d reads of %d\n",
2312                                 param->iterations, param->length);
2313                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2314                         retval = unlink_simple(dev, dev->in_pipe,
2315                                                 param->length);
2316                 if (retval)
2317                         dev_err(&intf->dev, "unlink reads failed %d, "
2318                                 "iterations left %d\n", retval, i);
2319                 break;
2320         case 12:
2321                 if (dev->out_pipe == 0 || !param->length)
2322                         break;
2323                 retval = 0;
2324                 dev_info(&intf->dev, "TEST 12:  unlink %d writes of %d\n",
2325                                 param->iterations, param->length);
2326                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2327                         retval = unlink_simple(dev, dev->out_pipe,
2328                                                 param->length);
2329                 if (retval)
2330                         dev_err(&intf->dev, "unlink writes failed %d, "
2331                                 "iterations left %d\n", retval, i);
2332                 break;
2333
2334         /* ep halt tests */
2335         case 13:
2336                 if (dev->out_pipe == 0 && dev->in_pipe == 0)
2337                         break;
2338                 retval = 0;
2339                 dev_info(&intf->dev, "TEST 13:  set/clear %d halts\n",
2340                                 param->iterations);
2341                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2342                         retval = halt_simple(dev);
2343
2344                 if (retval)
2345                         ERROR(dev, "halts failed, iterations left %d\n", i);
2346                 break;
2347
2348         /* control write tests */
2349         case 14:
2350                 if (!dev->info->ctrl_out)
2351                         break;
2352                 dev_info(&intf->dev, "TEST 14:  %d ep0out, %d..%d vary %d\n",
2353                                 param->iterations,
2354                                 realworld ? 1 : 0, param->length,
2355                                 param->vary);
2356                 retval = ctrl_out(dev, param->iterations,
2357                                 param->length, param->vary, 0);
2358                 break;
2359
2360         /* iso write tests */
2361         case 15:
2362                 if (dev->out_iso_pipe == 0 || param->sglen == 0)
2363                         break;
2364                 dev_info(&intf->dev,
2365                         "TEST 15:  write %d iso, %d entries of %d bytes\n",
2366                                 param->iterations,
2367                                 param->sglen, param->length);
2368                 /* FIRMWARE:  iso sink */
2369                 retval = test_queue(dev, param,
2370                                 dev->out_iso_pipe, dev->iso_out, 0);
2371                 break;
2372
2373         /* iso read tests */
2374         case 16:
2375                 if (dev->in_iso_pipe == 0 || param->sglen == 0)
2376                         break;
2377                 dev_info(&intf->dev,
2378                         "TEST 16:  read %d iso, %d entries of %d bytes\n",
2379                                 param->iterations,
2380                                 param->sglen, param->length);
2381                 /* FIRMWARE:  iso source */
2382                 retval = test_queue(dev, param,
2383                                 dev->in_iso_pipe, dev->iso_in, 0);
2384                 break;
2385
2386         /* FIXME scatterlist cancel (needs helper thread) */
2387
2388         /* Tests for bulk I/O using DMA mapping by core and odd address */
2389         case 17:
2390                 if (dev->out_pipe == 0)
2391                         break;
2392                 dev_info(&intf->dev,
2393                         "TEST 17:  write odd addr %d bytes %u times core map\n",
2394                         param->length, param->iterations);
2395
2396                 retval = test_unaligned_bulk(
2397                                 dev, dev->out_pipe,
2398                                 param->length, param->iterations,
2399                                 0, "test17");
2400                 break;
2401
2402         case 18:
2403                 if (dev->in_pipe == 0)
2404                         break;
2405                 dev_info(&intf->dev,
2406                         "TEST 18:  read odd addr %d bytes %u times core map\n",
2407                         param->length, param->iterations);
2408
2409                 retval = test_unaligned_bulk(
2410                                 dev, dev->in_pipe,
2411                                 param->length, param->iterations,
2412                                 0, "test18");
2413                 break;
2414
2415         /* Tests for bulk I/O using premapped coherent buffer and odd address */
2416         case 19:
2417                 if (dev->out_pipe == 0)
2418                         break;
2419                 dev_info(&intf->dev,
2420                         "TEST 19:  write odd addr %d bytes %u times premapped\n",
2421                         param->length, param->iterations);
2422
2423                 retval = test_unaligned_bulk(
2424                                 dev, dev->out_pipe,
2425                                 param->length, param->iterations,
2426                                 URB_NO_TRANSFER_DMA_MAP, "test19");
2427                 break;
2428
2429         case 20:
2430                 if (dev->in_pipe == 0)
2431                         break;
2432                 dev_info(&intf->dev,
2433                         "TEST 20:  read odd addr %d bytes %u times premapped\n",
2434                         param->length, param->iterations);
2435
2436                 retval = test_unaligned_bulk(
2437                                 dev, dev->in_pipe,
2438                                 param->length, param->iterations,
2439                                 URB_NO_TRANSFER_DMA_MAP, "test20");
2440                 break;
2441
2442         /* control write tests with unaligned buffer */
2443         case 21:
2444                 if (!dev->info->ctrl_out)
2445                         break;
2446                 dev_info(&intf->dev,
2447                                 "TEST 21:  %d ep0out odd addr, %d..%d vary %d\n",
2448                                 param->iterations,
2449                                 realworld ? 1 : 0, param->length,
2450                                 param->vary);
2451                 retval = ctrl_out(dev, param->iterations,
2452                                 param->length, param->vary, 1);
2453                 break;
2454
2455         /* unaligned iso tests */
2456         case 22:
2457                 if (dev->out_iso_pipe == 0 || param->sglen == 0)
2458                         break;
2459                 dev_info(&intf->dev,
2460                         "TEST 22:  write %d iso odd, %d entries of %d bytes\n",
2461                                 param->iterations,
2462                                 param->sglen, param->length);
2463                 retval = test_queue(dev, param,
2464                                 dev->out_iso_pipe, dev->iso_out, 1);
2465                 break;
2466
2467         case 23:
2468                 if (dev->in_iso_pipe == 0 || param->sglen == 0)
2469                         break;
2470                 dev_info(&intf->dev,
2471                         "TEST 23:  read %d iso odd, %d entries of %d bytes\n",
2472                                 param->iterations,
2473                                 param->sglen, param->length);
2474                 retval = test_queue(dev, param,
2475                                 dev->in_iso_pipe, dev->iso_in, 1);
2476                 break;
2477
2478         /* unlink URBs from a bulk-OUT queue */
2479         case 24:
2480                 if (dev->out_pipe == 0 || !param->length || param->sglen < 4)
2481                         break;
2482                 retval = 0;
2483                 dev_info(&intf->dev, "TEST 24:  unlink from %d queues of "
2484                                 "%d %d-byte writes\n",
2485                                 param->iterations, param->sglen, param->length);
2486                 for (i = param->iterations; retval == 0 && i > 0; --i) {
2487                         retval = unlink_queued(dev, dev->out_pipe,
2488                                                 param->sglen, param->length);
2489                         if (retval) {
2490                                 dev_err(&intf->dev,
2491                                         "unlink queued writes failed %d, "
2492                                         "iterations left %d\n", retval, i);
2493                                 break;
2494                         }
2495                 }
2496                 break;
2497
2498         /* Simple non-queued interrupt I/O tests */
2499         case 25:
2500                 if (dev->out_int_pipe == 0)
2501                         break;
2502                 dev_info(&intf->dev,
2503                                 "TEST 25: write %d bytes %u times\n",
2504                                 param->length, param->iterations);
2505                 urb = simple_alloc_urb(udev, dev->out_int_pipe, param->length,
2506                                 dev->int_out->bInterval);
2507                 if (!urb) {
2508                         retval = -ENOMEM;
2509                         break;
2510                 }
2511                 /* FIRMWARE: interrupt sink (maybe accepts short writes) */
2512                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test25");
2513                 simple_free_urb(urb);
2514                 break;
2515         case 26:
2516                 if (dev->in_int_pipe == 0)
2517                         break;
2518                 dev_info(&intf->dev,
2519                                 "TEST 26: read %d bytes %u times\n",
2520                                 param->length, param->iterations);
2521                 urb = simple_alloc_urb(udev, dev->in_int_pipe, param->length,
2522                                 dev->int_in->bInterval);
2523                 if (!urb) {
2524                         retval = -ENOMEM;
2525                         break;
2526                 }
2527                 /* FIRMWARE: interrupt source (maybe generates short writes) */
2528                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test26");
2529                 simple_free_urb(urb);
2530                 break;
2531         case 27:
2532                 /* We do performance test, so ignore data compare */
2533                 if (dev->out_pipe == 0 || param->sglen == 0 || pattern != 0)
2534                         break;
2535                 dev_info(&intf->dev,
2536                         "TEST 27: bulk write %dMbytes\n", (param->iterations *
2537                         param->sglen * param->length) / (1024 * 1024));
2538                 retval = test_queue(dev, param,
2539                                 dev->out_pipe, NULL, 0);
2540                 break;
2541         case 28:
2542                 if (dev->in_pipe == 0 || param->sglen == 0 || pattern != 0)
2543                         break;
2544                 dev_info(&intf->dev,
2545                         "TEST 28: bulk read %dMbytes\n", (param->iterations *
2546                         param->sglen * param->length) / (1024 * 1024));
2547                 retval = test_queue(dev, param,
2548                                 dev->in_pipe, NULL, 0);
2549                 break;
2550         }
2551         do_gettimeofday(&param->duration);
2552         param->duration.tv_sec -= start.tv_sec;
2553         param->duration.tv_usec -= start.tv_usec;
2554         if (param->duration.tv_usec < 0) {
2555                 param->duration.tv_usec += 1000 * 1000;
2556                 param->duration.tv_sec -= 1;
2557         }
2558         mutex_unlock(&dev->lock);
2559         return retval;
2560 }
2561
2562 /*-------------------------------------------------------------------------*/
2563
2564 static unsigned force_interrupt;
2565 module_param(force_interrupt, uint, 0);
2566 MODULE_PARM_DESC(force_interrupt, "0 = test default; else interrupt");
2567
2568 #ifdef  GENERIC
2569 static unsigned short vendor;
2570 module_param(vendor, ushort, 0);
2571 MODULE_PARM_DESC(vendor, "vendor code (from usb-if)");
2572
2573 static unsigned short product;
2574 module_param(product, ushort, 0);
2575 MODULE_PARM_DESC(product, "product code (from vendor)");
2576 #endif
2577
2578 static int
2579 usbtest_probe(struct usb_interface *intf, const struct usb_device_id *id)
2580 {
2581         struct usb_device       *udev;
2582         struct usbtest_dev      *dev;
2583         struct usbtest_info     *info;
2584         char                    *rtest, *wtest;
2585         char                    *irtest, *iwtest;
2586         char                    *intrtest, *intwtest;
2587
2588         udev = interface_to_usbdev(intf);
2589
2590 #ifdef  GENERIC
2591         /* specify devices by module parameters? */
2592         if (id->match_flags == 0) {
2593                 /* vendor match required, product match optional */
2594                 if (!vendor || le16_to_cpu(udev->descriptor.idVendor) != (u16)vendor)
2595                         return -ENODEV;
2596                 if (product && le16_to_cpu(udev->descriptor.idProduct) != (u16)product)
2597                         return -ENODEV;
2598                 dev_info(&intf->dev, "matched module params, "
2599                                         "vend=0x%04x prod=0x%04x\n",
2600                                 le16_to_cpu(udev->descriptor.idVendor),
2601                                 le16_to_cpu(udev->descriptor.idProduct));
2602         }
2603 #endif
2604
2605         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
2606         if (!dev)
2607                 return -ENOMEM;
2608         info = (struct usbtest_info *) id->driver_info;
2609         dev->info = info;
2610         mutex_init(&dev->lock);
2611
2612         dev->intf = intf;
2613
2614         /* cacheline-aligned scratch for i/o */
2615         dev->buf = kmalloc(TBUF_SIZE, GFP_KERNEL);
2616         if (dev->buf == NULL) {
2617                 kfree(dev);
2618                 return -ENOMEM;
2619         }
2620
2621         /* NOTE this doesn't yet test the handful of difference that are
2622          * visible with high speed interrupts:  bigger maxpacket (1K) and
2623          * "high bandwidth" modes (up to 3 packets/uframe).
2624          */
2625         rtest = wtest = "";
2626         irtest = iwtest = "";
2627         intrtest = intwtest = "";
2628         if (force_interrupt || udev->speed == USB_SPEED_LOW) {
2629                 if (info->ep_in) {
2630                         dev->in_pipe = usb_rcvintpipe(udev, info->ep_in);
2631                         rtest = " intr-in";
2632                 }
2633                 if (info->ep_out) {
2634                         dev->out_pipe = usb_sndintpipe(udev, info->ep_out);
2635                         wtest = " intr-out";
2636                 }
2637         } else {
2638                 if (override_alt >= 0 || info->autoconf) {
2639                         int status;
2640
2641                         status = get_endpoints(dev, intf);
2642                         if (status < 0) {
2643                                 WARNING(dev, "couldn't get endpoints, %d\n",
2644                                                 status);
2645                                 kfree(dev->buf);
2646                                 kfree(dev);
2647                                 return status;
2648                         }
2649                         /* may find bulk or ISO pipes */
2650                 } else {
2651                         if (info->ep_in)
2652                                 dev->in_pipe = usb_rcvbulkpipe(udev,
2653                                                         info->ep_in);
2654                         if (info->ep_out)
2655                                 dev->out_pipe = usb_sndbulkpipe(udev,
2656                                                         info->ep_out);
2657                 }
2658                 if (dev->in_pipe)
2659                         rtest = " bulk-in";
2660                 if (dev->out_pipe)
2661                         wtest = " bulk-out";
2662                 if (dev->in_iso_pipe)
2663                         irtest = " iso-in";
2664                 if (dev->out_iso_pipe)
2665                         iwtest = " iso-out";
2666                 if (dev->in_int_pipe)
2667                         intrtest = " int-in";
2668                 if (dev->out_int_pipe)
2669                         intwtest = " int-out";
2670         }
2671
2672         usb_set_intfdata(intf, dev);
2673         dev_info(&intf->dev, "%s\n", info->name);
2674         dev_info(&intf->dev, "%s {control%s%s%s%s%s%s%s} tests%s\n",
2675                         usb_speed_string(udev->speed),
2676                         info->ctrl_out ? " in/out" : "",
2677                         rtest, wtest,
2678                         irtest, iwtest,
2679                         intrtest, intwtest,
2680                         info->alt >= 0 ? " (+alt)" : "");
2681         return 0;
2682 }
2683
2684 static int usbtest_suspend(struct usb_interface *intf, pm_message_t message)
2685 {
2686         return 0;
2687 }
2688
2689 static int usbtest_resume(struct usb_interface *intf)
2690 {
2691         return 0;
2692 }
2693
2694
2695 static void usbtest_disconnect(struct usb_interface *intf)
2696 {
2697         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2698
2699         usb_set_intfdata(intf, NULL);
2700         dev_dbg(&intf->dev, "disconnect\n");
2701         kfree(dev);
2702 }
2703
2704 /* Basic testing only needs a device that can source or sink bulk traffic.
2705  * Any device can test control transfers (default with GENERIC binding).
2706  *
2707  * Several entries work with the default EP0 implementation that's built
2708  * into EZ-USB chips.  There's a default vendor ID which can be overridden
2709  * by (very) small config EEPROMS, but otherwise all these devices act
2710  * identically until firmware is loaded:  only EP0 works.  It turns out
2711  * to be easy to make other endpoints work, without modifying that EP0
2712  * behavior.  For now, we expect that kind of firmware.
2713  */
2714
2715 /* an21xx or fx versions of ez-usb */
2716 static struct usbtest_info ez1_info = {
2717         .name           = "EZ-USB device",
2718         .ep_in          = 2,
2719         .ep_out         = 2,
2720         .alt            = 1,
2721 };
2722
2723 /* fx2 version of ez-usb */
2724 static struct usbtest_info ez2_info = {
2725         .name           = "FX2 device",
2726         .ep_in          = 6,
2727         .ep_out         = 2,
2728         .alt            = 1,
2729 };
2730
2731 /* ezusb family device with dedicated usb test firmware,
2732  */
2733 static struct usbtest_info fw_info = {
2734         .name           = "usb test device",
2735         .ep_in          = 2,
2736         .ep_out         = 2,
2737         .alt            = 1,
2738         .autoconf       = 1,            /* iso and ctrl_out need autoconf */
2739         .ctrl_out       = 1,
2740         .iso            = 1,            /* iso_ep's are #8 in/out */
2741 };
2742
2743 /* peripheral running Linux and 'zero.c' test firmware, or
2744  * its user-mode cousin. different versions of this use
2745  * different hardware with the same vendor/product codes.
2746  * host side MUST rely on the endpoint descriptors.
2747  */
2748 static struct usbtest_info gz_info = {
2749         .name           = "Linux gadget zero",
2750         .autoconf       = 1,
2751         .ctrl_out       = 1,
2752         .iso            = 1,
2753         .intr           = 1,
2754         .alt            = 0,
2755 };
2756
2757 static struct usbtest_info um_info = {
2758         .name           = "Linux user mode test driver",
2759         .autoconf       = 1,
2760         .alt            = -1,
2761 };
2762
2763 static struct usbtest_info um2_info = {
2764         .name           = "Linux user mode ISO test driver",
2765         .autoconf       = 1,
2766         .iso            = 1,
2767         .alt            = -1,
2768 };
2769
2770 #ifdef IBOT2
2771 /* this is a nice source of high speed bulk data;
2772  * uses an FX2, with firmware provided in the device
2773  */
2774 static struct usbtest_info ibot2_info = {
2775         .name           = "iBOT2 webcam",
2776         .ep_in          = 2,
2777         .alt            = -1,
2778 };
2779 #endif
2780
2781 #ifdef GENERIC
2782 /* we can use any device to test control traffic */
2783 static struct usbtest_info generic_info = {
2784         .name           = "Generic USB device",
2785         .alt            = -1,
2786 };
2787 #endif
2788
2789
2790 static const struct usb_device_id id_table[] = {
2791
2792         /*-------------------------------------------------------------*/
2793
2794         /* EZ-USB devices which download firmware to replace (or in our
2795          * case augment) the default device implementation.
2796          */
2797
2798         /* generic EZ-USB FX controller */
2799         { USB_DEVICE(0x0547, 0x2235),
2800                 .driver_info = (unsigned long) &ez1_info,
2801         },
2802
2803         /* CY3671 development board with EZ-USB FX */
2804         { USB_DEVICE(0x0547, 0x0080),
2805                 .driver_info = (unsigned long) &ez1_info,
2806         },
2807
2808         /* generic EZ-USB FX2 controller (or development board) */
2809         { USB_DEVICE(0x04b4, 0x8613),
2810                 .driver_info = (unsigned long) &ez2_info,
2811         },
2812
2813         /* re-enumerated usb test device firmware */
2814         { USB_DEVICE(0xfff0, 0xfff0),
2815                 .driver_info = (unsigned long) &fw_info,
2816         },
2817
2818         /* "Gadget Zero" firmware runs under Linux */
2819         { USB_DEVICE(0x0525, 0xa4a0),
2820                 .driver_info = (unsigned long) &gz_info,
2821         },
2822
2823         /* so does a user-mode variant */
2824         { USB_DEVICE(0x0525, 0xa4a4),
2825                 .driver_info = (unsigned long) &um_info,
2826         },
2827
2828         /* ... and a user-mode variant that talks iso */
2829         { USB_DEVICE(0x0525, 0xa4a3),
2830                 .driver_info = (unsigned long) &um2_info,
2831         },
2832
2833 #ifdef KEYSPAN_19Qi
2834         /* Keyspan 19qi uses an21xx (original EZ-USB) */
2835         /* this does not coexist with the real Keyspan 19qi driver! */
2836         { USB_DEVICE(0x06cd, 0x010b),
2837                 .driver_info = (unsigned long) &ez1_info,
2838         },
2839 #endif
2840
2841         /*-------------------------------------------------------------*/
2842
2843 #ifdef IBOT2
2844         /* iBOT2 makes a nice source of high speed bulk-in data */
2845         /* this does not coexist with a real iBOT2 driver! */
2846         { USB_DEVICE(0x0b62, 0x0059),
2847                 .driver_info = (unsigned long) &ibot2_info,
2848         },
2849 #endif
2850
2851         /*-------------------------------------------------------------*/
2852
2853 #ifdef GENERIC
2854         /* module params can specify devices to use for control tests */
2855         { .driver_info = (unsigned long) &generic_info, },
2856 #endif
2857
2858         /*-------------------------------------------------------------*/
2859
2860         { }
2861 };
2862 MODULE_DEVICE_TABLE(usb, id_table);
2863
2864 static struct usb_driver usbtest_driver = {
2865         .name =         "usbtest",
2866         .id_table =     id_table,
2867         .probe =        usbtest_probe,
2868         .unlocked_ioctl = usbtest_ioctl,
2869         .disconnect =   usbtest_disconnect,
2870         .suspend =      usbtest_suspend,
2871         .resume =       usbtest_resume,
2872 };
2873
2874 /*-------------------------------------------------------------------------*/
2875
2876 static int __init usbtest_init(void)
2877 {
2878 #ifdef GENERIC
2879         if (vendor)
2880                 pr_debug("params: vend=0x%04x prod=0x%04x\n", vendor, product);
2881 #endif
2882         return usb_register(&usbtest_driver);
2883 }
2884 module_init(usbtest_init);
2885
2886 static void __exit usbtest_exit(void)
2887 {
2888         usb_deregister(&usbtest_driver);
2889 }
2890 module_exit(usbtest_exit);
2891
2892 MODULE_DESCRIPTION("USB Core/HCD Testing Driver");
2893 MODULE_LICENSE("GPL");
2894