drivers/usb/misc/usbtest.c

   1 #include <linux/kernel.h>
   2 #include <linux/errno.h>
   3 #include <linux/init.h>
   4 #include <linux/slab.h>
   5 #include <linux/mm.h>
   6 #include <linux/module.h>
   7 #include <linux/moduleparam.h>
   8 #include <linux/scatterlist.h>
   9 #include <linux/mutex.h>
  10 #include <linux/timer.h>
  11 #include <linux/usb.h>
  12
  13 #define SIMPLE_IO_TIMEOUT       10000   /* in milliseconds */
  14
  15 /*-------------------------------------------------------------------------*/
  16
  17 static int override_alt = -1;
  18 module_param_named(alt, override_alt, int, 0644);
  19 MODULE_PARM_DESC(alt, ">= 0 to override altsetting selection");
  20 static void complicated_callback(struct urb *urb);
  21
  22 /*-------------------------------------------------------------------------*/
  23
  24 /* FIXME make these public somewhere; usbdevfs.h? */
  25 struct usbtest_param {
  26         /* inputs */
  27         unsigned                test_num;       /* 0..(TEST_CASES-1) */
  28         unsigned                iterations;
  29         unsigned                length;
  30         unsigned                vary;
  31         unsigned                sglen;
  32
  33         /* outputs */
  34         struct timeval          duration;
  35 };
  36 #define USBTEST_REQUEST _IOWR('U', 100, struct usbtest_param)
  37
  38 /*-------------------------------------------------------------------------*/
  39
  40 #define GENERIC         /* let probe() bind using module params */
  41
  42 /* Some devices that can be used for testing will have "real" drivers.
  43  * Entries for those need to be enabled here by hand, after disabling
  44  * that "real" driver.
  45  */
  46 //#define       IBOT2           /* grab iBOT2 webcams */
  47 //#define       KEYSPAN_19Qi    /* grab un-renumerated serial adapter */
  48
  49 /*-------------------------------------------------------------------------*/
  50
  51 struct usbtest_info {
  52         const char              *name;
  53         u8                      ep_in;          /* bulk/intr source */
  54         u8                      ep_out;         /* bulk/intr sink */
  55         unsigned                autoconf:1;
  56         unsigned                ctrl_out:1;
  57         unsigned                iso:1;          /* try iso in/out */
  58         unsigned                intr:1;         /* try interrupt in/out */
  59         int                     alt;
  60 };
  61
  62 /* this is accessed only through usbfs ioctl calls.
  63  * one ioctl to issue a test ... one lock per device.
  64  * tests create other threads if they need them.
  65  * urbs and buffers are allocated dynamically,
  66  * and data generated deterministically.
  67  */
  68 struct usbtest_dev {
  69         struct usb_interface    *intf;
  70         struct usbtest_info     *info;
  71         int                     in_pipe;
  72         int                     out_pipe;
  73         int                     in_iso_pipe;
  74         int                     out_iso_pipe;
  75         int                     in_int_pipe;
  76         int                     out_int_pipe;
  77         struct usb_endpoint_descriptor  *iso_in, *iso_out;
  78         struct usb_endpoint_descriptor  *int_in, *int_out;
  79         struct mutex            lock;
  80
  81 #define TBUF_SIZE       256
  82         u8                      *buf;
  83 };
  84
  85 static struct usb_device *testdev_to_usbdev(struct usbtest_dev *test)
  86 {
  87         return interface_to_usbdev(test->intf);
  88 }
  89
  90 /* set up all urbs so they can be used with either bulk or interrupt */
  91 #define INTERRUPT_RATE          1       /* msec/transfer */
  92
  93 #define ERROR(tdev, fmt, args...) \
  94         dev_err(&(tdev)->intf->dev , fmt , ## args)
  95 #define WARNING(tdev, fmt, args...) \
  96         dev_warn(&(tdev)->intf->dev , fmt , ## args)
  97
  98 #define GUARD_BYTE      0xA5
  99 #define MAX_SGLEN       128
 100
 101 /*-------------------------------------------------------------------------*/
 102
 103 static int
 104 get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf)
 105 {
 106         int                             tmp;
 107         struct usb_host_interface       *alt;
 108         struct usb_host_endpoint        *in, *out;
 109         struct usb_host_endpoint        *iso_in, *iso_out;
 110         struct usb_host_endpoint        *int_in, *int_out;
 111         struct usb_device               *udev;
 112
 113         for (tmp = 0; tmp < intf->num_altsetting; tmp++) {
 114                 unsigned        ep;
 115
 116                 in = out = NULL;
 117                 iso_in = iso_out = NULL;
 118                 int_in = int_out = NULL;
 119                 alt = intf->altsetting + tmp;
 120
 121                 if (override_alt >= 0 &&
 122                                 override_alt != alt->desc.bAlternateSetting)
 123                         continue;
 124
 125                 /* take the first altsetting with in-bulk + out-bulk;
 126                  * ignore other endpoints and altsettings.
 127                  */
 128                 for (ep = 0; ep < alt->desc.bNumEndpoints; ep++) {
 129                         struct usb_host_endpoint        *e;
 130
 131                         e = alt->endpoint + ep;
 132                         switch (usb_endpoint_type(&e->desc)) {
 133                         case USB_ENDPOINT_XFER_BULK:
 134                                 break;
 135                         case USB_ENDPOINT_XFER_INT:
 136                                 if (dev->info->intr)
 137                                         goto try_intr;
 138                                 continue;
 139                         case USB_ENDPOINT_XFER_ISOC:
 140                                 if (dev->info->iso)
 141                                         goto try_iso;
 142                                 /* FALLTHROUGH */
 143                         default:
 144                                 continue;
 145                         }
 146                         if (usb_endpoint_dir_in(&e->desc)) {
 147                                 if (!in)
 148                                         in = e;
 149                         } else {
 150                                 if (!out)
 151                                         out = e;
 152                         }
 153                         continue;
 154 try_intr:
 155                         if (usb_endpoint_dir_in(&e->desc)) {
 156                                 if (!int_in)
 157                                         int_in = e;
 158                         } else {
 159                                 if (!int_out)
 160                                         int_out = e;
 161                         }
 162                         continue;
 163 try_iso:
 164                         if (usb_endpoint_dir_in(&e->desc)) {
 165                                 if (!iso_in)
 166                                         iso_in = e;
 167                         } else {
 168                                 if (!iso_out)
 169                                         iso_out = e;
 170                         }
 171                 }
 172                 if ((in && out)  ||  iso_in || iso_out || int_in || int_out)
 173                         goto found;
 174         }
 175         return -EINVAL;
 176
 177 found:
 178         udev = testdev_to_usbdev(dev);
 179         dev->info->alt = alt->desc.bAlternateSetting;
 180         if (alt->desc.bAlternateSetting != 0) {
 181                 tmp = usb_set_interface(udev,
 182                                 alt->desc.bInterfaceNumber,
 183                                 alt->desc.bAlternateSetting);
 184                 if (tmp < 0)
 185                         return tmp;
 186         }
 187
 188         if (in)
 189                 dev->in_pipe = usb_rcvbulkpipe(udev,
 190                         in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
 191         if (out)
 192                 dev->out_pipe = usb_sndbulkpipe(udev,
 193                         out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
 194
 195         if (iso_in) {
 196                 dev->iso_in = &iso_in->desc;
 197                 dev->in_iso_pipe = usb_rcvisocpipe(udev,
 198                                 iso_in->desc.bEndpointAddress
 199                                         & USB_ENDPOINT_NUMBER_MASK);
 200         }
 201
 202         if (iso_out) {
 203                 dev->iso_out = &iso_out->desc;
 204                 dev->out_iso_pipe = usb_sndisocpipe(udev,
 205                                 iso_out->desc.bEndpointAddress
 206                                         & USB_ENDPOINT_NUMBER_MASK);
 207         }
 208
 209         if (int_in) {
 210                 dev->int_in = &int_in->desc;
 211                 dev->in_int_pipe = usb_rcvintpipe(udev,
 212                                 int_in->desc.bEndpointAddress
 213                                         & USB_ENDPOINT_NUMBER_MASK);
 214         }
 215
 216         if (int_out) {
 217                 dev->int_out = &int_out->desc;
 218                 dev->out_int_pipe = usb_sndintpipe(udev,
 219                                 int_out->desc.bEndpointAddress
 220                                         & USB_ENDPOINT_NUMBER_MASK);
 221         }
 222         return 0;
 223 }
 224
 225 /*-------------------------------------------------------------------------*/
 226
 227 /* Support for testing basic non-queued I/O streams.
 228  *
 229  * These just package urbs as requests that can be easily canceled.
 230  * Each urb's data buffer is dynamically allocated; callers can fill
 231  * them with non-zero test data (or test for it) when appropriate.
 232  */
 233
 234 static void simple_callback(struct urb *urb)
 235 {
 236         complete(urb->context);
 237 }
 238
 239 static struct urb *usbtest_alloc_urb(
 240         struct usb_device       *udev,
 241         int                     pipe,
 242         unsigned long           bytes,
 243         unsigned                transfer_flags,
 244         unsigned                offset,
 245         u8                      bInterval,
 246         usb_complete_t          complete_fn)
 247 {
 248         struct urb              *urb;
 249
 250         urb = usb_alloc_urb(0, GFP_KERNEL);
 251         if (!urb)
 252                 return urb;
 253
 254         if (bInterval)
 255                 usb_fill_int_urb(urb, udev, pipe, NULL, bytes, complete_fn,
 256                                 NULL, bInterval);
 257         else
 258                 usb_fill_bulk_urb(urb, udev, pipe, NULL, bytes, complete_fn,
 259                                 NULL);
 260
 261         urb->interval = (udev->speed == USB_SPEED_HIGH)
 262                         ? (INTERRUPT_RATE << 3)
 263                         : INTERRUPT_RATE;
 264         urb->transfer_flags = transfer_flags;
 265         if (usb_pipein(pipe))
 266                 urb->transfer_flags |= URB_SHORT_NOT_OK;
 267
 268         if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 269                 urb->transfer_buffer = usb_alloc_coherent(udev, bytes + offset,
 270                         GFP_KERNEL, &urb->transfer_dma);
 271         else
 272                 urb->transfer_buffer = kmalloc(bytes + offset, GFP_KERNEL);
 273
 274         if (!urb->transfer_buffer) {
 275                 usb_free_urb(urb);
 276                 return NULL;
 277         }
 278
 279         /* To test unaligned transfers add an offset and fill the
 280                 unused memory with a guard value */
 281         if (offset) {
 282                 memset(urb->transfer_buffer, GUARD_BYTE, offset);
 283                 urb->transfer_buffer += offset;
 284                 if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 285                         urb->transfer_dma += offset;
 286         }
 287
 288         /* For inbound transfers use guard byte so that test fails if
 289                 data not correctly copied */
 290         memset(urb->transfer_buffer,
 291                         usb_pipein(urb->pipe) ? GUARD_BYTE : 0,
 292                         bytes);
 293         return urb;
 294 }
 295
 296 static struct urb *simple_alloc_urb(
 297         struct usb_device       *udev,
 298         int                     pipe,
 299         unsigned long           bytes,
 300         u8                      bInterval)
 301 {
 302         return usbtest_alloc_urb(udev, pipe, bytes, URB_NO_TRANSFER_DMA_MAP, 0,
 303                         bInterval, simple_callback);
 304 }
 305
 306 static struct urb *complicated_alloc_urb(
 307         struct usb_device       *udev,
 308         int                     pipe,
 309         unsigned long           bytes,
 310         u8                      bInterval)
 311 {
 312         return usbtest_alloc_urb(udev, pipe, bytes, URB_NO_TRANSFER_DMA_MAP, 0,
 313                         bInterval, complicated_callback);
 314 }
 315
 316 static unsigned pattern;
 317 static unsigned mod_pattern;
 318 module_param_named(pattern, mod_pattern, uint, S_IRUGO | S_IWUSR);
 319 MODULE_PARM_DESC(mod_pattern, "i/o pattern (0 == zeroes)");
 320
 321 static unsigned get_maxpacket(struct usb_device *udev, int pipe)
 322 {
 323         struct usb_host_endpoint        *ep;
 324
 325         ep = usb_pipe_endpoint(udev, pipe);
 326         return le16_to_cpup(&ep->desc.wMaxPacketSize);
 327 }
 328
 329 static void simple_fill_buf(struct urb *urb)
 330 {
 331         unsigned        i;
 332         u8              *buf = urb->transfer_buffer;
 333         unsigned        len = urb->transfer_buffer_length;
 334         unsigned        maxpacket;
 335
 336         switch (pattern) {
 337         default:
 338                 /* FALLTHROUGH */
 339         case 0:
 340                 memset(buf, 0, len);
 341                 break;
 342         case 1:                 /* mod63 */
 343                 maxpacket = get_maxpacket(urb->dev, urb->pipe);
 344                 for (i = 0; i < len; i++)
 345                         *buf++ = (u8) ((i % maxpacket) % 63);
 346                 break;
 347         }
 348 }
 349
 350 static inline unsigned long buffer_offset(void *buf)
 351 {
 352         return (unsigned long)buf & (ARCH_KMALLOC_MINALIGN - 1);
 353 }
 354
 355 static int check_guard_bytes(struct usbtest_dev *tdev, struct urb *urb)
 356 {
 357         u8 *buf = urb->transfer_buffer;
 358         u8 *guard = buf - buffer_offset(buf);
 359         unsigned i;
 360
 361         for (i = 0; guard < buf; i++, guard++) {
 362                 if (*guard != GUARD_BYTE) {
 363                         ERROR(tdev, "guard byte[%d] %d (not %d)\n",
 364                                 i, *guard, GUARD_BYTE);
 365                         return -EINVAL;
 366                 }
 367         }
 368         return 0;
 369 }
 370
 371 static int simple_check_buf(struct usbtest_dev *tdev, struct urb *urb)
 372 {
 373         unsigned        i;
 374         u8              expected;
 375         u8              *buf = urb->transfer_buffer;
 376         unsigned        len = urb->actual_length;
 377         unsigned        maxpacket = get_maxpacket(urb->dev, urb->pipe);
 378
 379         int ret = check_guard_bytes(tdev, urb);
 380         if (ret)
 381                 return ret;
 382
 383         for (i = 0; i < len; i++, buf++) {
 384                 switch (pattern) {
 385                 /* all-zeroes has no synchronization issues */
 386                 case 0:
 387                         expected = 0;
 388                         break;
 389                 /* mod63 stays in sync with short-terminated transfers,
 390                  * or otherwise when host and gadget agree on how large
 391                  * each usb transfer request should be.  resync is done
 392                  * with set_interface or set_config.
 393                  */
 394                 case 1:                 /* mod63 */
 395                         expected = (i % maxpacket) % 63;
 396                         break;
 397                 /* always fail unsupported patterns */
 398                 default:
 399                         expected = !*buf;
 400                         break;
 401                 }
 402                 if (*buf == expected)
 403                         continue;
 404                 ERROR(tdev, "buf[%d] = %d (not %d)\n", i, *buf, expected);
 405                 return -EINVAL;
 406         }
 407         return 0;
 408 }
 409
 410 static void simple_free_urb(struct urb *urb)
 411 {
 412         unsigned long offset = buffer_offset(urb->transfer_buffer);
 413
 414         if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 415                 usb_free_coherent(
 416                         urb->dev,
 417                         urb->transfer_buffer_length + offset,
 418                         urb->transfer_buffer - offset,
 419                         urb->transfer_dma - offset);
 420         else
 421                 kfree(urb->transfer_buffer - offset);
 422         usb_free_urb(urb);
 423 }
 424
 425 static int simple_io(
 426         struct usbtest_dev      *tdev,
 427         struct urb              *urb,
 428         int                     iterations,
 429         int                     vary,
 430         int                     expected,
 431         const char              *label
 432 )
 433 {
 434         struct usb_device       *udev = urb->dev;
 435         int                     max = urb->transfer_buffer_length;
 436         struct completion       completion;
 437         int                     retval = 0;
 438         unsigned long           expire;
 439
 440         urb->context = &completion;
 441         while (retval == 0 && iterations-- > 0) {
 442                 init_completion(&completion);
 443                 if (usb_pipeout(urb->pipe)) {
 444                         simple_fill_buf(urb);
 445                         urb->transfer_flags |= URB_ZERO_PACKET;
 446                 }
 447                 retval = usb_submit_urb(urb, GFP_KERNEL);
 448                 if (retval != 0)
 449                         break;
 450
 451                 expire = msecs_to_jiffies(SIMPLE_IO_TIMEOUT);
 452                 if (!wait_for_completion_timeout(&completion, expire)) {
 453                         usb_kill_urb(urb);
 454                         retval = (urb->status == -ENOENT ?
 455                                   -ETIMEDOUT : urb->status);
 456                 } else {
 457                         retval = urb->status;
 458                 }
 459
 460                 urb->dev = udev;
 461                 if (retval == 0 && usb_pipein(urb->pipe))
 462                         retval = simple_check_buf(tdev, urb);
 463
 464                 if (vary) {
 465                         int     len = urb->transfer_buffer_length;
 466
 467                         len += vary;
 468                         len %= max;
 469                         if (len == 0)
 470                                 len = (vary < max) ? vary : max;
 471                         urb->transfer_buffer_length = len;
 472                 }
 473
 474                 /* FIXME if endpoint halted, clear halt (and log) */
 475         }
 476         urb->transfer_buffer_length = max;
 477
 478         if (expected != retval)
 479                 dev_err(&udev->dev,
 480                         "%s failed, iterations left %d, status %d (not %d)\n",
 481                                 label, iterations, retval, expected);
 482         return retval;
 483 }
 484
 485
 486 /*-------------------------------------------------------------------------*/
 487
 488 /* We use scatterlist primitives to test queued I/O.
 489  * Yes, this also tests the scatterlist primitives.
 490  */
 491
 492 static void free_sglist(struct scatterlist *sg, int nents)
 493 {
 494         unsigned                i;
 495
 496         if (!sg)
 497                 return;
 498         for (i = 0; i < nents; i++) {
 499                 if (!sg_page(&sg[i]))
 500                         continue;
 501                 kfree(sg_virt(&sg[i]));
 502         }
 503         kfree(sg);
 504 }
 505
 506 static struct scatterlist *
 507 alloc_sglist(int nents, int max, int vary, struct usbtest_dev *dev, int pipe)
 508 {
 509         struct scatterlist      *sg;
 510         unsigned int            n_size = 0;
 511         unsigned                i;
 512         unsigned                size = max;
 513         unsigned                maxpacket =
 514                 get_maxpacket(interface_to_usbdev(dev->intf), pipe);
 515
 516         if (max == 0)
 517                 return NULL;
 518
 519         sg = kmalloc_array(nents, sizeof(*sg), GFP_KERNEL);
 520         if (!sg)
 521                 return NULL;
 522         sg_init_table(sg, nents);
 523
 524         for (i = 0; i < nents; i++) {
 525                 char            *buf;
 526                 unsigned        j;
 527
 528                 buf = kzalloc(size, GFP_KERNEL);
 529                 if (!buf) {
 530                         free_sglist(sg, i);
 531                         return NULL;
 532                 }
 533
 534                 /* kmalloc pages are always physically contiguous! */
 535                 sg_set_buf(&sg[i], buf, size);
 536
 537                 switch (pattern) {
 538                 case 0:
 539                         /* already zeroed */
 540                         break;
 541                 case 1:
 542                         for (j = 0; j < size; j++)
 543                                 *buf++ = (u8) (((j + n_size) % maxpacket) % 63);
 544                         n_size += size;
 545                         break;
 546                 }
 547
 548                 if (vary) {
 549                         size += vary;
 550                         size %= max;
 551                         if (size == 0)
 552                                 size = (vary < max) ? vary : max;
 553                 }
 554         }
 555
 556         return sg;
 557 }
 558
 559 static void sg_timeout(unsigned long _req)
 560 {
 561         struct usb_sg_request   *req = (struct usb_sg_request *) _req;
 562
 563         usb_sg_cancel(req);
 564 }
 565
 566 static int perform_sglist(
 567         struct usbtest_dev      *tdev,
 568         unsigned                iterations,
 569         int                     pipe,
 570         struct usb_sg_request   *req,
 571         struct scatterlist      *sg,
 572         int                     nents
 573 )
 574 {
 575         struct usb_device       *udev = testdev_to_usbdev(tdev);
 576         int                     retval = 0;
 577         struct timer_list       sg_timer;
 578
 579         setup_timer_on_stack(&sg_timer, sg_timeout, (unsigned long) req);
 580
 581         while (retval == 0 && iterations-- > 0) {
 582                 retval = usb_sg_init(req, udev, pipe,
 583                                 (udev->speed == USB_SPEED_HIGH)
 584                                         ? (INTERRUPT_RATE << 3)
 585                                         : INTERRUPT_RATE,
 586                                 sg, nents, 0, GFP_KERNEL);
 587
 588                 if (retval)
 589                         break;
 590                 mod_timer(&sg_timer, jiffies +
 591                                 msecs_to_jiffies(SIMPLE_IO_TIMEOUT));
 592                 usb_sg_wait(req);
 593                 if (!del_timer_sync(&sg_timer))
 594                         retval = -ETIMEDOUT;
 595                 else
 596                         retval = req->status;
 597
 598                 /* FIXME check resulting data pattern */
 599
 600                 /* FIXME if endpoint halted, clear halt (and log) */
 601         }
 602
 603         /* FIXME for unlink or fault handling tests, don't report
 604          * failure if retval is as we expected ...
 605          */
 606         if (retval)
 607                 ERROR(tdev, "perform_sglist failed, "
 608                                 "iterations left %d, status %d\n",
 609                                 iterations, retval);
 610         return retval;
 611 }
 612
 613
 614 /*-------------------------------------------------------------------------*/
 615
 616 /* unqueued control message testing
 617  *
 618  * there's a nice set of device functional requirements in chapter 9 of the
 619  * usb 2.0 spec, which we can apply to ANY device, even ones that don't use
 620  * special test firmware.
 621  *
 622  * we know the device is configured (or suspended) by the time it's visible
 623  * through usbfs.  we can't change that, so we won't test enumeration (which
 624  * worked 'well enough' to get here, this time), power management (ditto),
 625  * or remote wakeup (which needs human interaction).
 626  */
 627
 628 static unsigned realworld = 1;
 629 module_param(realworld, uint, 0);
 630 MODULE_PARM_DESC(realworld, "clear to demand stricter spec compliance");
 631
 632 static int get_altsetting(struct usbtest_dev *dev)
 633 {
 634         struct usb_interface    *iface = dev->intf;
 635         struct usb_device       *udev = interface_to_usbdev(iface);
 636         int                     retval;
 637
 638         retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 639                         USB_REQ_GET_INTERFACE, USB_DIR_IN|USB_RECIP_INTERFACE,
 640                         0, iface->altsetting[0].desc.bInterfaceNumber,
 641                         dev->buf, 1, USB_CTRL_GET_TIMEOUT);
 642         switch (retval) {
 643         case 1:
 644                 return dev->buf[0];
 645         case 0:
 646                 retval = -ERANGE;
 647                 /* FALLTHROUGH */
 648         default:
 649                 return retval;
 650         }
 651 }
 652
 653 static int set_altsetting(struct usbtest_dev *dev, int alternate)
 654 {
 655         struct usb_interface            *iface = dev->intf;
 656         struct usb_device               *udev;
 657
 658         if (alternate < 0 || alternate >= 256)
 659                 return -EINVAL;
 660
 661         udev = interface_to_usbdev(iface);
 662         return usb_set_interface(udev,
 663                         iface->altsetting[0].desc.bInterfaceNumber,
 664                         alternate);
 665 }
 666
 667 static int is_good_config(struct usbtest_dev *tdev, int len)
 668 {
 669         struct usb_config_descriptor    *config;
 670
 671         if (len < sizeof(*config))
 672                 return 0;
 673         config = (struct usb_config_descriptor *) tdev->buf;
 674
 675         switch (config->bDescriptorType) {
 676         case USB_DT_CONFIG:
 677         case USB_DT_OTHER_SPEED_CONFIG:
 678                 if (config->bLength != 9) {
 679                         ERROR(tdev, "bogus config descriptor length\n");
 680                         return 0;
 681                 }
 682                 /* this bit 'must be 1' but often isn't */
 683                 if (!realworld && !(config->bmAttributes & 0x80)) {
 684                         ERROR(tdev, "high bit of config attributes not set\n");
 685                         return 0;
 686                 }
 687                 if (config->bmAttributes & 0x1f) {      /* reserved == 0 */
 688                         ERROR(tdev, "reserved config bits set\n");
 689                         return 0;
 690                 }
 691                 break;
 692         default:
 693                 return 0;
 694         }
 695
 696         if (le16_to_cpu(config->wTotalLength) == len)   /* read it all */
 697                 return 1;
 698         if (le16_to_cpu(config->wTotalLength) >= TBUF_SIZE)     /* max partial read */
 699                 return 1;
 700         ERROR(tdev, "bogus config descriptor read size\n");
 701         return 0;
 702 }
 703
 704 static int is_good_ext(struct usbtest_dev *tdev, u8 *buf)
 705 {
 706         struct usb_ext_cap_descriptor *ext;
 707         u32 attr;
 708
 709         ext = (struct usb_ext_cap_descriptor *) buf;
 710
 711         if (ext->bLength != USB_DT_USB_EXT_CAP_SIZE) {
 712                 ERROR(tdev, "bogus usb 2.0 extension descriptor length\n");
 713                 return 0;
 714         }
 715
 716         attr = le32_to_cpu(ext->bmAttributes);
 717         /* bits[1:15] is used and others are reserved */
 718         if (attr & ~0xfffe) {   /* reserved == 0 */
 719                 ERROR(tdev, "reserved bits set\n");
 720                 return 0;
 721         }
 722
 723         return 1;
 724 }
 725
 726 static int is_good_ss_cap(struct usbtest_dev *tdev, u8 *buf)
 727 {
 728         struct usb_ss_cap_descriptor *ss;
 729
 730         ss = (struct usb_ss_cap_descriptor *) buf;
 731
 732         if (ss->bLength != USB_DT_USB_SS_CAP_SIZE) {
 733                 ERROR(tdev, "bogus superspeed device capability descriptor length\n");
 734                 return 0;
 735         }
 736
 737         /*
 738          * only bit[1] of bmAttributes is used for LTM and others are
 739          * reserved
 740          */
 741         if (ss->bmAttributes & ~0x02) { /* reserved == 0 */
 742                 ERROR(tdev, "reserved bits set in bmAttributes\n");
 743                 return 0;
 744         }
 745
 746         /* bits[0:3] of wSpeedSupported is used and others are reserved */
 747         if (le16_to_cpu(ss->wSpeedSupported) & ~0x0f) { /* reserved == 0 */
 748                 ERROR(tdev, "reserved bits set in wSpeedSupported\n");
 749                 return 0;
 750         }
 751
 752         return 1;
 753 }
 754
 755 static int is_good_con_id(struct usbtest_dev *tdev, u8 *buf)
 756 {
 757         struct usb_ss_container_id_descriptor *con_id;
 758
 759         con_id = (struct usb_ss_container_id_descriptor *) buf;
 760
 761         if (con_id->bLength != USB_DT_USB_SS_CONTN_ID_SIZE) {
 762                 ERROR(tdev, "bogus container id descriptor length\n");
 763                 return 0;
 764         }
 765
 766         if (con_id->bReserved) {        /* reserved == 0 */
 767                 ERROR(tdev, "reserved bits set\n");
 768                 return 0;
 769         }
 770
 771         return 1;
 772 }
 773
 774 /* sanity test for standard requests working with usb_control_mesg() and some
 775  * of the utility functions which use it.
 776  *
 777  * this doesn't test how endpoint halts behave or data toggles get set, since
 778  * we won't do I/O to bulk/interrupt endpoints here (which is how to change
 779  * halt or toggle).  toggle testing is impractical without support from hcds.
 780  *
 781  * this avoids failing devices linux would normally work with, by not testing
 782  * config/altsetting operations for devices that only support their defaults.
 783  * such devices rarely support those needless operations.
 784  *
 785  * NOTE that since this is a sanity test, it's not examining boundary cases
 786  * to see if usbcore, hcd, and device all behave right.  such testing would
 787  * involve varied read sizes and other operation sequences.
 788  */
 789 static int ch9_postconfig(struct usbtest_dev *dev)
 790 {
 791         struct usb_interface    *iface = dev->intf;
 792         struct usb_device       *udev = interface_to_usbdev(iface);
 793         int                     i, alt, retval;
 794
 795         /* [9.2.3] if there's more than one altsetting, we need to be able to
 796          * set and get each one.  mostly trusts the descriptors from usbcore.
 797          */
 798         for (i = 0; i < iface->num_altsetting; i++) {
 799
 800                 /* 9.2.3 constrains the range here */
 801                 alt = iface->altsetting[i].desc.bAlternateSetting;
 802                 if (alt < 0 || alt >= iface->num_altsetting) {
 803                         dev_err(&iface->dev,
 804                                         "invalid alt [%d].bAltSetting = %d\n",
 805                                         i, alt);
 806                 }
 807
 808                 /* [real world] get/set unimplemented if there's only one */
 809                 if (realworld && iface->num_altsetting == 1)
 810                         continue;
 811
 812                 /* [9.4.10] set_interface */
 813                 retval = set_altsetting(dev, alt);
 814                 if (retval) {
 815                         dev_err(&iface->dev, "can't set_interface = %d, %d\n",
 816                                         alt, retval);
 817                         return retval;
 818                 }
 819
 820                 /* [9.4.4] get_interface always works */
 821                 retval = get_altsetting(dev);
 822                 if (retval != alt) {
 823                         dev_err(&iface->dev, "get alt should be %d, was %d\n",
 824                                         alt, retval);
 825                         return (retval < 0) ? retval : -EDOM;
 826                 }
 827
 828         }
 829
 830         /* [real world] get_config unimplemented if there's only one */
 831         if (!realworld || udev->descriptor.bNumConfigurations != 1) {
 832                 int     expected = udev->actconfig->desc.bConfigurationValue;
 833
 834                 /* [9.4.2] get_configuration always works
 835                  * ... although some cheap devices (like one TI Hub I've got)
 836                  * won't return config descriptors except before set_config.
 837                  */
 838                 retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 839                                 USB_REQ_GET_CONFIGURATION,
 840                                 USB_DIR_IN | USB_RECIP_DEVICE,
 841                                 0, 0, dev->buf, 1, USB_CTRL_GET_TIMEOUT);
 842                 if (retval != 1 || dev->buf[0] != expected) {
 843                         dev_err(&iface->dev, "get config --> %d %d (1 %d)\n",
 844                                 retval, dev->buf[0], expected);
 845                         return (retval < 0) ? retval : -EDOM;
 846                 }
 847         }
 848
 849         /* there's always [9.4.3] a device descriptor [9.6.1] */
 850         retval = usb_get_descriptor(udev, USB_DT_DEVICE, 0,
 851                         dev->buf, sizeof(udev->descriptor));
 852         if (retval != sizeof(udev->descriptor)) {
 853                 dev_err(&iface->dev, "dev descriptor --> %d\n", retval);
 854                 return (retval < 0) ? retval : -EDOM;
 855         }
 856
 857         /*
 858          * there's always [9.4.3] a bos device descriptor [9.6.2] in USB
 859          * 3.0 spec
 860          */
 861         if (le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0210) {
 862                 struct usb_bos_descriptor *bos = NULL;
 863                 struct usb_dev_cap_header *header = NULL;
 864                 unsigned total, num, length;
 865                 u8 *buf;
 866
 867                 retval = usb_get_descriptor(udev, USB_DT_BOS, 0, dev->buf,
 868                                 sizeof(*udev->bos->desc));
 869                 if (retval != sizeof(*udev->bos->desc)) {
 870                         dev_err(&iface->dev, "bos descriptor --> %d\n", retval);
 871                         return (retval < 0) ? retval : -EDOM;
 872                 }
 873
 874                 bos = (struct usb_bos_descriptor *)dev->buf;
 875                 total = le16_to_cpu(bos->wTotalLength);
 876                 num = bos->bNumDeviceCaps;
 877
 878                 if (total > TBUF_SIZE)
 879                         total = TBUF_SIZE;
 880
 881                 /*
 882                  * get generic device-level capability descriptors [9.6.2]
 883                  * in USB 3.0 spec
 884                  */
 885                 retval = usb_get_descriptor(udev, USB_DT_BOS, 0, dev->buf,
 886                                 total);
 887                 if (retval != total) {
 888                         dev_err(&iface->dev, "bos descriptor set --> %d\n",
 889                                         retval);
 890                         return (retval < 0) ? retval : -EDOM;
 891                 }
 892
 893                 length = sizeof(*udev->bos->desc);
 894                 buf = dev->buf;
 895                 for (i = 0; i < num; i++) {
 896                         buf += length;
 897                         if (buf + sizeof(struct usb_dev_cap_header) >
 898                                         dev->buf + total)
 899                                 break;
 900
 901                         header = (struct usb_dev_cap_header *)buf;
 902                         length = header->bLength;
 903
 904                         if (header->bDescriptorType !=
 905                                         USB_DT_DEVICE_CAPABILITY) {
 906                                 dev_warn(&udev->dev, "not device capability descriptor, skip\n");
 907                                 continue;
 908                         }
 909
 910                         switch (header->bDevCapabilityType) {
 911                         case USB_CAP_TYPE_EXT:
 912                                 if (buf + USB_DT_USB_EXT_CAP_SIZE >
 913                                                 dev->buf + total ||
 914                                                 !is_good_ext(dev, buf)) {
 915                                         dev_err(&iface->dev, "bogus usb 2.0 extension descriptor\n");
 916                                         return -EDOM;
 917                                 }
 918                                 break;
 919                         case USB_SS_CAP_TYPE:
 920                                 if (buf + USB_DT_USB_SS_CAP_SIZE >
 921                                                 dev->buf + total ||
 922                                                 !is_good_ss_cap(dev, buf)) {
 923                                         dev_err(&iface->dev, "bogus superspeed device capability descriptor\n");
 924                                         return -EDOM;
 925                                 }
 926                                 break;
 927                         case CONTAINER_ID_TYPE:
 928                                 if (buf + USB_DT_USB_SS_CONTN_ID_SIZE >
 929                                                 dev->buf + total ||
 930                                                 !is_good_con_id(dev, buf)) {
 931                                         dev_err(&iface->dev, "bogus container id descriptor\n");
 932                                         return -EDOM;
 933                                 }
 934                                 break;
 935                         default:
 936                                 break;
 937                         }
 938                 }
 939         }
 940
 941         /* there's always [9.4.3] at least one config descriptor [9.6.3] */
 942         for (i = 0; i < udev->descriptor.bNumConfigurations; i++) {
 943                 retval = usb_get_descriptor(udev, USB_DT_CONFIG, i,
 944                                 dev->buf, TBUF_SIZE);
 945                 if (!is_good_config(dev, retval)) {
 946                         dev_err(&iface->dev,
 947                                         "config [%d] descriptor --> %d\n",
 948                                         i, retval);
 949                         return (retval < 0) ? retval : -EDOM;
 950                 }
 951
 952                 /* FIXME cross-checking udev->config[i] to make sure usbcore
 953                  * parsed it right (etc) would be good testing paranoia
 954                  */
 955         }
 956
 957         /* and sometimes [9.2.6.6] speed dependent descriptors */
 958         if (le16_to_cpu(udev->descriptor.bcdUSB) == 0x0200) {
 959                 struct usb_qualifier_descriptor *d = NULL;
 960
 961                 /* device qualifier [9.6.2] */
 962                 retval = usb_get_descriptor(udev,
 963                                 USB_DT_DEVICE_QUALIFIER, 0, dev->buf,
 964                                 sizeof(struct usb_qualifier_descriptor));
 965                 if (retval == -EPIPE) {
 966                         if (udev->speed == USB_SPEED_HIGH) {
 967                                 dev_err(&iface->dev,
 968                                                 "hs dev qualifier --> %d\n",
 969                                                 retval);
 970                                 return (retval < 0) ? retval : -EDOM;
 971                         }
 972                         /* usb2.0 but not high-speed capable; fine */
 973                 } else if (retval != sizeof(struct usb_qualifier_descriptor)) {
 974                         dev_err(&iface->dev, "dev qualifier --> %d\n", retval);
 975                         return (retval < 0) ? retval : -EDOM;
 976                 } else
 977                         d = (struct usb_qualifier_descriptor *) dev->buf;
 978
 979                 /* might not have [9.6.2] any other-speed configs [9.6.4] */
 980                 if (d) {
 981                         unsigned max = d->bNumConfigurations;
 982                         for (i = 0; i < max; i++) {
 983                                 retval = usb_get_descriptor(udev,
 984                                         USB_DT_OTHER_SPEED_CONFIG, i,
 985                                         dev->buf, TBUF_SIZE);
 986                                 if (!is_good_config(dev, retval)) {
 987                                         dev_err(&iface->dev,
 988                                                 "other speed config --> %d\n",
 989                                                 retval);
 990                                         return (retval < 0) ? retval : -EDOM;
 991                                 }
 992                         }
 993                 }
 994         }
 995         /* FIXME fetch strings from at least the device descriptor */
 996
 997         /* [9.4.5] get_status always works */
 998         retval = usb_get_status(udev, USB_RECIP_DEVICE, 0, dev->buf);
 999         if (retval) {
1000                 dev_err(&iface->dev, "get dev status --> %d\n", retval);
1001                 return retval;
1002         }
1003
1004         /* FIXME configuration.bmAttributes says if we could try to set/clear
1005          * the device's remote wakeup feature ... if we can, test that here
1006          */
1007
1008         retval = usb_get_status(udev, USB_RECIP_INTERFACE,
1009                         iface->altsetting[0].desc.bInterfaceNumber, dev->buf);
1010         if (retval) {
1011                 dev_err(&iface->dev, "get interface status --> %d\n", retval);
1012                 return retval;
1013         }
1014         /* FIXME get status for each endpoint in the interface */
1015
1016         return 0;
1017 }
1018
1019 /*-------------------------------------------------------------------------*/
1020
1021 /* use ch9 requests to test whether:
1022  *   (a) queues work for control, keeping N subtests queued and
1023  *       active (auto-resubmit) for M loops through the queue.
1024  *   (b) protocol stalls (control-only) will autorecover.
1025  *       it's not like bulk/intr; no halt clearing.
1026  *   (c) short control reads are reported and handled.
1027  *   (d) queues are always processed in-order
1028  */
1029
1030 struct ctrl_ctx {
1031         spinlock_t              lock;
1032         struct usbtest_dev      *dev;
1033         struct completion       complete;
1034         unsigned                count;
1035         unsigned                pending;
1036         int                     status;
1037         struct urb              **urb;
1038         struct usbtest_param    *param;
1039         int                     last;
1040 };
1041
1042 #define NUM_SUBCASES    16              /* how many test subcases here? */
1043
1044 struct subcase {
1045         struct usb_ctrlrequest  setup;
1046         int                     number;
1047         int                     expected;
1048 };
1049
1050 static void ctrl_complete(struct urb *urb)
1051 {
1052         struct ctrl_ctx         *ctx = urb->context;
1053         struct usb_ctrlrequest  *reqp;
1054         struct subcase          *subcase;
1055         int                     status = urb->status;
1056
1057         reqp = (struct usb_ctrlrequest *)urb->setup_packet;
1058         subcase = container_of(reqp, struct subcase, setup);
1059
1060         spin_lock(&ctx->lock);
1061         ctx->count--;
1062         ctx->pending--;
1063
1064         /* queue must transfer and complete in fifo order, unless
1065          * usb_unlink_urb() is used to unlink something not at the
1066          * physical queue head (not tested).
1067          */
1068         if (subcase->number > 0) {
1069                 if ((subcase->number - ctx->last) != 1) {
1070                         ERROR(ctx->dev,
1071                                 "subcase %d completed out of order, last %d\n",
1072                                 subcase->number, ctx->last);
1073                         status = -EDOM;
1074                         ctx->last = subcase->number;
1075                         goto error;
1076                 }
1077         }
1078         ctx->last = subcase->number;
1079
1080         /* succeed or fault in only one way? */
1081         if (status == subcase->expected)
1082                 status = 0;
1083
1084         /* async unlink for cleanup? */
1085         else if (status != -ECONNRESET) {
1086
1087                 /* some faults are allowed, not required */
1088                 if (subcase->expected > 0 && (
1089                           ((status == -subcase->expected        /* happened */
1090                            || status == 0))))                   /* didn't */
1091                         status = 0;
1092                 /* sometimes more than one fault is allowed */
1093                 else if (subcase->number == 12 && status == -EPIPE)
1094                         status = 0;
1095                 else
1096                         ERROR(ctx->dev, "subtest %d error, status %d\n",
1097                                         subcase->number, status);
1098         }
1099
1100         /* unexpected status codes mean errors; ideally, in hardware */
1101         if (status) {
1102 error:
1103                 if (ctx->status == 0) {
1104                         int             i;
1105
1106                         ctx->status = status;
1107                         ERROR(ctx->dev, "control queue %02x.%02x, err %d, "
1108                                         "%d left, subcase %d, len %d/%d\n",
1109                                         reqp->bRequestType, reqp->bRequest,
1110                                         status, ctx->count, subcase->number,
1111                                         urb->actual_length,
1112                                         urb->transfer_buffer_length);
1113
1114                         /* FIXME this "unlink everything" exit route should
1115                          * be a separate test case.
1116                          */
1117
1118                         /* unlink whatever's still pending */
1119                         for (i = 1; i < ctx->param->sglen; i++) {
1120                                 struct urb *u = ctx->urb[
1121                                                         (i + subcase->number)
1122                                                         % ctx->param->sglen];
1123
1124                                 if (u == urb || !u->dev)
1125                                         continue;
1126                                 spin_unlock(&ctx->lock);
1127                                 status = usb_unlink_urb(u);
1128                                 spin_lock(&ctx->lock);
1129                                 switch (status) {
1130                                 case -EINPROGRESS:
1131                                 case -EBUSY:
1132                                 case -EIDRM:
1133                                         continue;
1134                                 default:
1135                                         ERROR(ctx->dev, "urb unlink --> %d\n",
1136                                                         status);
1137                                 }
1138                         }
1139                         status = ctx->status;
1140                 }
1141         }
1142
1143         /* resubmit if we need to, else mark this as done */
1144         if ((status == 0) && (ctx->pending < ctx->count)) {
1145                 status = usb_submit_urb(urb, GFP_ATOMIC);
1146                 if (status != 0) {
1147                         ERROR(ctx->dev,
1148                                 "can't resubmit ctrl %02x.%02x, err %d\n",
1149                                 reqp->bRequestType, reqp->bRequest, status);
1150                         urb->dev = NULL;
1151                 } else
1152                         ctx->pending++;
1153         } else
1154                 urb->dev = NULL;
1155
1156         /* signal completion when nothing's queued */
1157         if (ctx->pending == 0)
1158                 complete(&ctx->complete);
1159         spin_unlock(&ctx->lock);
1160 }
1161
1162 static int
1163 test_ctrl_queue(struct usbtest_dev *dev, struct usbtest_param *param)
1164 {
1165         struct usb_device       *udev = testdev_to_usbdev(dev);
1166         struct urb              **urb;
1167         struct ctrl_ctx         context;
1168         int                     i;
1169
1170         if (param->sglen == 0 || param->iterations > UINT_MAX / param->sglen)
1171                 return -EOPNOTSUPP;
1172
1173         spin_lock_init(&context.lock);
1174         context.dev = dev;
1175         init_completion(&context.complete);
1176         context.count = param->sglen * param->iterations;
1177         context.pending = 0;
1178         context.status = -ENOMEM;
1179         context.param = param;
1180         context.last = -1;
1181
1182         /* allocate and init the urbs we'll queue.
1183          * as with bulk/intr sglists, sglen is the queue depth; it also
1184          * controls which subtests run (more tests than sglen) or rerun.
1185          */
1186         urb = kcalloc(param->sglen, sizeof(struct urb *), GFP_KERNEL);
1187         if (!urb)
1188                 return -ENOMEM;
1189         for (i = 0; i < param->sglen; i++) {
1190                 int                     pipe = usb_rcvctrlpipe(udev, 0);
1191                 unsigned                len;
1192                 struct urb              *u;
1193                 struct usb_ctrlrequest  req;
1194                 struct subcase          *reqp;
1195
1196                 /* sign of this variable means:
1197                  *  -: tested code must return this (negative) error code
1198                  *  +: tested code may return this (negative too) error code
1199                  */
1200                 int                     expected = 0;
1201
1202                 /* requests here are mostly expected to succeed on any
1203                  * device, but some are chosen to trigger protocol stalls
1204                  * or short reads.
1205                  */
1206                 memset(&req, 0, sizeof(req));
1207                 req.bRequest = USB_REQ_GET_DESCRIPTOR;
1208                 req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
1209
1210                 switch (i % NUM_SUBCASES) {
1211                 case 0:         /* get device descriptor */
1212                         req.wValue = cpu_to_le16(USB_DT_DEVICE << 8);
1213                         len = sizeof(struct usb_device_descriptor);
1214                         break;
1215                 case 1:         /* get first config descriptor (only) */
1216                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1217                         len = sizeof(struct usb_config_descriptor);
1218                         break;
1219                 case 2:         /* get altsetting (OFTEN STALLS) */
1220                         req.bRequest = USB_REQ_GET_INTERFACE;
1221                         req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
1222                         /* index = 0 means first interface */
1223                         len = 1;
1224                         expected = EPIPE;
1225                         break;
1226                 case 3:         /* get interface status */
1227                         req.bRequest = USB_REQ_GET_STATUS;
1228                         req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
1229                         /* interface 0 */
1230                         len = 2;
1231                         break;
1232                 case 4:         /* get device status */
1233                         req.bRequest = USB_REQ_GET_STATUS;
1234                         req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
1235                         len = 2;
1236                         break;
1237                 case 5:         /* get device qualifier (MAY STALL) */
1238                         req.wValue = cpu_to_le16 (USB_DT_DEVICE_QUALIFIER << 8);
1239                         len = sizeof(struct usb_qualifier_descriptor);
1240                         if (udev->speed != USB_SPEED_HIGH)
1241                                 expected = EPIPE;
1242                         break;
1243                 case 6:         /* get first config descriptor, plus interface */
1244                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1245                         len = sizeof(struct usb_config_descriptor);
1246                         len += sizeof(struct usb_interface_descriptor);
1247                         break;
1248                 case 7:         /* get interface descriptor (ALWAYS STALLS) */
1249                         req.wValue = cpu_to_le16 (USB_DT_INTERFACE << 8);
1250                         /* interface == 0 */
1251                         len = sizeof(struct usb_interface_descriptor);
1252                         expected = -EPIPE;
1253                         break;
1254                 /* NOTE: two consecutive stalls in the queue here.
1255                  *  that tests fault recovery a bit more aggressively. */
1256                 case 8:         /* clear endpoint halt (MAY STALL) */
1257                         req.bRequest = USB_REQ_CLEAR_FEATURE;
1258                         req.bRequestType = USB_RECIP_ENDPOINT;
1259                         /* wValue 0 == ep halt */
1260                         /* wIndex 0 == ep0 (shouldn't halt!) */
1261                         len = 0;
1262                         pipe = usb_sndctrlpipe(udev, 0);
1263                         expected = EPIPE;
1264                         break;
1265                 case 9:         /* get endpoint status */
1266                         req.bRequest = USB_REQ_GET_STATUS;
1267                         req.bRequestType = USB_DIR_IN|USB_RECIP_ENDPOINT;
1268                         /* endpoint 0 */
1269                         len = 2;
1270                         break;
1271                 case 10:        /* trigger short read (EREMOTEIO) */
1272                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1273                         len = 1024;
1274                         expected = -EREMOTEIO;
1275                         break;
1276                 /* NOTE: two consecutive _different_ faults in the queue. */
1277                 case 11:        /* get endpoint descriptor (ALWAYS STALLS) */
1278                         req.wValue = cpu_to_le16(USB_DT_ENDPOINT << 8);
1279                         /* endpoint == 0 */
1280                         len = sizeof(struct usb_interface_descriptor);
1281                         expected = EPIPE;
1282                         break;
1283                 /* NOTE: sometimes even a third fault in the queue! */
1284                 case 12:        /* get string 0 descriptor (MAY STALL) */
1285                         req.wValue = cpu_to_le16(USB_DT_STRING << 8);
1286                         /* string == 0, for language IDs */
1287                         len = sizeof(struct usb_interface_descriptor);
1288                         /* may succeed when > 4 languages */
1289                         expected = EREMOTEIO;   /* or EPIPE, if no strings */
1290                         break;
1291                 case 13:        /* short read, resembling case 10 */
1292                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1293                         /* last data packet "should" be DATA1, not DATA0 */
1294                         if (udev->speed == USB_SPEED_SUPER)
1295                                 len = 1024 - 512;
1296                         else
1297                                 len = 1024 - udev->descriptor.bMaxPacketSize0;
1298                         expected = -EREMOTEIO;
1299                         break;
1300                 case 14:        /* short read; try to fill the last packet */
1301                         req.wValue = cpu_to_le16((USB_DT_DEVICE << 8) | 0);
1302                         /* device descriptor size == 18 bytes */
1303                         len = udev->descriptor.bMaxPacketSize0;
1304                         if (udev->speed == USB_SPEED_SUPER)
1305                                 len = 512;
1306                         switch (len) {
1307                         case 8:
1308                                 len = 24;
1309                                 break;
1310                         case 16:
1311                                 len = 32;
1312                                 break;
1313                         }
1314                         expected = -EREMOTEIO;
1315                         break;
1316                 case 15:
1317                         req.wValue = cpu_to_le16(USB_DT_BOS << 8);
1318                         if (udev->bos)
1319                                 len = le16_to_cpu(udev->bos->desc->wTotalLength);
1320                         else
1321                                 len = sizeof(struct usb_bos_descriptor);
1322                         if (le16_to_cpu(udev->descriptor.bcdUSB) < 0x0201)
1323                                 expected = -EPIPE;
1324                         break;
1325                 default:
1326                         ERROR(dev, "bogus number of ctrl queue testcases!\n");
1327                         context.status = -EINVAL;
1328                         goto cleanup;
1329                 }
1330                 req.wLength = cpu_to_le16(len);
1331                 urb[i] = u = simple_alloc_urb(udev, pipe, len, 0);
1332                 if (!u)
1333                         goto cleanup;
1334
1335                 reqp = kmalloc(sizeof(*reqp), GFP_KERNEL);
1336                 if (!reqp)
1337                         goto cleanup;
1338                 reqp->setup = req;
1339                 reqp->number = i % NUM_SUBCASES;
1340                 reqp->expected = expected;
1341                 u->setup_packet = (char *) &reqp->setup;
1342
1343                 u->context = &context;
1344                 u->complete = ctrl_complete;
1345         }
1346
1347         /* queue the urbs */
1348         context.urb = urb;
1349         spin_lock_irq(&context.lock);
1350         for (i = 0; i < param->sglen; i++) {
1351                 context.status = usb_submit_urb(urb[i], GFP_ATOMIC);
1352                 if (context.status != 0) {
1353                         ERROR(dev, "can't submit urb[%d], status %d\n",
1354                                         i, context.status);
1355                         context.count = context.pending;
1356                         break;
1357                 }
1358                 context.pending++;
1359         }
1360         spin_unlock_irq(&context.lock);
1361
1362         /* FIXME  set timer and time out; provide a disconnect hook */
1363
1364         /* wait for the last one to complete */
1365         if (context.pending > 0)
1366                 wait_for_completion(&context.complete);
1367
1368 cleanup:
1369         for (i = 0; i < param->sglen; i++) {
1370                 if (!urb[i])
1371                         continue;
1372                 urb[i]->dev = udev;
1373                 kfree(urb[i]->setup_packet);
1374                 simple_free_urb(urb[i]);
1375         }
1376         kfree(urb);
1377         return context.status;
1378 }
1379 #undef NUM_SUBCASES
1380
1381
1382 /*-------------------------------------------------------------------------*/
1383
1384 static void unlink1_callback(struct urb *urb)
1385 {
1386         int     status = urb->status;
1387
1388         /* we "know" -EPIPE (stall) never happens */
1389         if (!status)
1390                 status = usb_submit_urb(urb, GFP_ATOMIC);
1391         if (status) {
1392                 urb->status = status;
1393                 complete(urb->context);
1394         }
1395 }
1396
1397 static int unlink1(struct usbtest_dev *dev, int pipe, int size, int async)
1398 {
1399         struct urb              *urb;
1400         struct completion       completion;
1401         int                     retval = 0;
1402
1403         init_completion(&completion);
1404         urb = simple_alloc_urb(testdev_to_usbdev(dev), pipe, size, 0);
1405         if (!urb)
1406                 return -ENOMEM;
1407         urb->context = &completion;
1408         urb->complete = unlink1_callback;
1409
1410         if (usb_pipeout(urb->pipe)) {
1411                 simple_fill_buf(urb);
1412                 urb->transfer_flags |= URB_ZERO_PACKET;
1413         }
1414
1415         /* keep the endpoint busy.  there are lots of hc/hcd-internal
1416          * states, and testing should get to all of them over time.
1417          *
1418          * FIXME want additional tests for when endpoint is STALLing
1419          * due to errors, or is just NAKing requests.
1420          */
1421         retval = usb_submit_urb(urb, GFP_KERNEL);
1422         if (retval != 0) {
1423                 dev_err(&dev->intf->dev, "submit fail %d\n", retval);
1424                 return retval;
1425         }
1426
1427         /* unlinking that should always work.  variable delay tests more
1428          * hcd states and code paths, even with little other system load.
1429          */
1430         msleep(jiffies % (2 * INTERRUPT_RATE));
1431         if (async) {
1432                 while (!completion_done(&completion)) {
1433                         retval = usb_unlink_urb(urb);
1434
1435                         if (retval == 0 && usb_pipein(urb->pipe))
1436                                 retval = simple_check_buf(dev, urb);
1437
1438                         switch (retval) {
1439                         case -EBUSY:
1440                         case -EIDRM:
1441                                 /* we can't unlink urbs while they're completing
1442                                  * or if they've completed, and we haven't
1443                                  * resubmitted. "normal" drivers would prevent
1444                                  * resubmission, but since we're testing unlink
1445                                  * paths, we can't.
1446                                  */
1447                                 ERROR(dev, "unlink retry\n");
1448                                 continue;
1449                         case 0:
1450                         case -EINPROGRESS:
1451                                 break;
1452
1453                         default:
1454                                 dev_err(&dev->intf->dev,
1455                                         "unlink fail %d\n", retval);
1456                                 return retval;
1457                         }
1458
1459                         break;
1460                 }
1461         } else
1462                 usb_kill_urb(urb);
1463
1464         wait_for_completion(&completion);
1465         retval = urb->status;
1466         simple_free_urb(urb);
1467
1468         if (async)
1469                 return (retval == -ECONNRESET) ? 0 : retval - 1000;
1470         else
1471                 return (retval == -ENOENT || retval == -EPERM) ?
1472                                 0 : retval - 2000;
1473 }
1474
1475 static int unlink_simple(struct usbtest_dev *dev, int pipe, int len)
1476 {
1477         int                     retval = 0;
1478
1479         /* test sync and async paths */
1480         retval = unlink1(dev, pipe, len, 1);
1481         if (!retval)
1482                 retval = unlink1(dev, pipe, len, 0);
1483         return retval;
1484 }
1485
1486 /*-------------------------------------------------------------------------*/
1487
1488 struct queued_ctx {
1489         struct completion       complete;
1490         atomic_t                pending;
1491         unsigned                num;
1492         int                     status;
1493         struct urb              **urbs;
1494 };
1495
1496 static void unlink_queued_callback(struct urb *urb)
1497 {
1498         int                     status = urb->status;
1499         struct queued_ctx       *ctx = urb->context;
1500
1501         if (ctx->status)
1502                 goto done;
1503         if (urb == ctx->urbs[ctx->num - 4] || urb == ctx->urbs[ctx->num - 2]) {
1504                 if (status == -ECONNRESET)
1505                         goto done;
1506                 /* What error should we report if the URB completed normally? */
1507         }
1508         if (status != 0)
1509                 ctx->status = status;
1510
1511  done:
1512         if (atomic_dec_and_test(&ctx->pending))
1513                 complete(&ctx->complete);
1514 }
1515
1516 static int unlink_queued(struct usbtest_dev *dev, int pipe, unsigned num,
1517                 unsigned size)
1518 {
1519         struct queued_ctx       ctx;
1520         struct usb_device       *udev = testdev_to_usbdev(dev);
1521         void                    *buf;
1522         dma_addr_t              buf_dma;
1523         int                     i;
1524         int                     retval = -ENOMEM;
1525
1526         init_completion(&ctx.complete);
1527         atomic_set(&ctx.pending, 1);    /* One more than the actual value */
1528         ctx.num = num;
1529         ctx.status = 0;
1530
1531         buf = usb_alloc_coherent(udev, size, GFP_KERNEL, &buf_dma);
1532         if (!buf)
1533                 return retval;
1534         memset(buf, 0, size);
1535
1536         /* Allocate and init the urbs we'll queue */
1537         ctx.urbs = kcalloc(num, sizeof(struct urb *), GFP_KERNEL);
1538         if (!ctx.urbs)
1539                 goto free_buf;
1540         for (i = 0; i < num; i++) {
1541                 ctx.urbs[i] = usb_alloc_urb(0, GFP_KERNEL);
1542                 if (!ctx.urbs[i])
1543                         goto free_urbs;
1544                 usb_fill_bulk_urb(ctx.urbs[i], udev, pipe, buf, size,
1545                                 unlink_queued_callback, &ctx);
1546                 ctx.urbs[i]->transfer_dma = buf_dma;
1547                 ctx.urbs[i]->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
1548
1549                 if (usb_pipeout(ctx.urbs[i]->pipe)) {
1550                         simple_fill_buf(ctx.urbs[i]);
1551                         ctx.urbs[i]->transfer_flags |= URB_ZERO_PACKET;
1552                 }
1553         }
1554
1555         /* Submit all the URBs and then unlink URBs num - 4 and num - 2. */
1556         for (i = 0; i < num; i++) {
1557                 atomic_inc(&ctx.pending);
1558                 retval = usb_submit_urb(ctx.urbs[i], GFP_KERNEL);
1559                 if (retval != 0) {
1560                         dev_err(&dev->intf->dev, "submit urbs[%d] fail %d\n",
1561                                         i, retval);
1562                         atomic_dec(&ctx.pending);
1563                         ctx.status = retval;
1564                         break;
1565                 }
1566         }
1567         if (i == num) {
1568                 usb_unlink_urb(ctx.urbs[num - 4]);
1569                 usb_unlink_urb(ctx.urbs[num - 2]);
1570         } else {
1571                 while (--i >= 0)
1572                         usb_unlink_urb(ctx.urbs[i]);
1573         }
1574
1575         if (atomic_dec_and_test(&ctx.pending))          /* The extra count */
1576                 complete(&ctx.complete);
1577         wait_for_completion(&ctx.complete);
1578         retval = ctx.status;
1579
1580  free_urbs:
1581         for (i = 0; i < num; i++)
1582                 usb_free_urb(ctx.urbs[i]);
1583         kfree(ctx.urbs);
1584  free_buf:
1585         usb_free_coherent(udev, size, buf, buf_dma);
1586         return retval;
1587 }
1588
1589 /*-------------------------------------------------------------------------*/
1590
1591 static int verify_not_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
1592 {
1593         int     retval;
1594         u16     status;
1595
1596         /* shouldn't look or act halted */
1597         retval = usb_get_status(urb->dev, USB_RECIP_ENDPOINT, ep, &status);
1598         if (retval < 0) {
1599                 ERROR(tdev, "ep %02x couldn't get no-halt status, %d\n",
1600                                 ep, retval);
1601                 return retval;
1602         }
1603         if (status != 0) {
1604                 ERROR(tdev, "ep %02x bogus status: %04x != 0\n", ep, status);
1605                 return -EINVAL;
1606         }
1607         retval = simple_io(tdev, urb, 1, 0, 0, __func__);
1608         if (retval != 0)
1609                 return -EINVAL;
1610         return 0;
1611 }
1612
1613 static int verify_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
1614 {
1615         int     retval;
1616         u16     status;
1617
1618         /* should look and act halted */
1619         retval = usb_get_status(urb->dev, USB_RECIP_ENDPOINT, ep, &status);
1620         if (retval < 0) {
1621                 ERROR(tdev, "ep %02x couldn't get halt status, %d\n",
1622                                 ep, retval);
1623                 return retval;
1624         }
1625         if (status != 1) {
1626                 ERROR(tdev, "ep %02x bogus status: %04x != 1\n", ep, status);
1627                 return -EINVAL;
1628         }
1629         retval = simple_io(tdev, urb, 1, 0, -EPIPE, __func__);
1630         if (retval != -EPIPE)
1631                 return -EINVAL;
1632         retval = simple_io(tdev, urb, 1, 0, -EPIPE, "verify_still_halted");
1633         if (retval != -EPIPE)
1634                 return -EINVAL;
1635         return 0;
1636 }
1637
1638 static int test_halt(struct usbtest_dev *tdev, int ep, struct urb *urb)
1639 {
1640         int     retval;
1641
1642         /* shouldn't look or act halted now */
1643         retval = verify_not_halted(tdev, ep, urb);
1644         if (retval < 0)
1645                 return retval;
1646
1647         /* set halt (protocol test only), verify it worked */
1648         retval = usb_control_msg(urb->dev, usb_sndctrlpipe(urb->dev, 0),
1649                         USB_REQ_SET_FEATURE, USB_RECIP_ENDPOINT,
1650                         USB_ENDPOINT_HALT, ep,
1651                         NULL, 0, USB_CTRL_SET_TIMEOUT);
1652         if (retval < 0) {
1653                 ERROR(tdev, "ep %02x couldn't set halt, %d\n", ep, retval);
1654                 return retval;
1655         }
1656         retval = verify_halted(tdev, ep, urb);
1657         if (retval < 0) {
1658                 int ret;
1659
1660                 /* clear halt anyways, else further tests will fail */
1661                 ret = usb_clear_halt(urb->dev, urb->pipe);
1662                 if (ret)
1663                         ERROR(tdev, "ep %02x couldn't clear halt, %d\n",
1664                               ep, ret);
1665
1666                 return retval;
1667         }
1668
1669         /* clear halt (tests API + protocol), verify it worked */
1670         retval = usb_clear_halt(urb->dev, urb->pipe);
1671         if (retval < 0) {
1672                 ERROR(tdev, "ep %02x couldn't clear halt, %d\n", ep, retval);
1673                 return retval;
1674         }
1675         retval = verify_not_halted(tdev, ep, urb);
1676         if (retval < 0)
1677                 return retval;
1678
1679         /* NOTE:  could also verify SET_INTERFACE clear halts ... */
1680
1681         return 0;
1682 }
1683
1684 static int halt_simple(struct usbtest_dev *dev)
1685 {
1686         int                     ep;
1687         int                     retval = 0;
1688         struct urb              *urb;
1689         struct usb_device       *udev = testdev_to_usbdev(dev);
1690
1691         if (udev->speed == USB_SPEED_SUPER)
1692                 urb = simple_alloc_urb(udev, 0, 1024, 0);
1693         else
1694                 urb = simple_alloc_urb(udev, 0, 512, 0);
1695         if (urb == NULL)
1696                 return -ENOMEM;
1697
1698         if (dev->in_pipe) {
1699                 ep = usb_pipeendpoint(dev->in_pipe) | USB_DIR_IN;
1700                 urb->pipe = dev->in_pipe;
1701                 retval = test_halt(dev, ep, urb);
1702                 if (retval < 0)
1703                         goto done;
1704         }
1705
1706         if (dev->out_pipe) {
1707                 ep = usb_pipeendpoint(dev->out_pipe);
1708                 urb->pipe = dev->out_pipe;
1709                 retval = test_halt(dev, ep, urb);
1710         }
1711 done:
1712         simple_free_urb(urb);
1713         return retval;
1714 }
1715
1716 /*-------------------------------------------------------------------------*/
1717
1718 /* Control OUT tests use the vendor control requests from Intel's
1719  * USB 2.0 compliance test device:  write a buffer, read it back.
1720  *
1721  * Intel's spec only _requires_ that it work for one packet, which
1722  * is pretty weak.   Some HCDs place limits here; most devices will
1723  * need to be able to handle more than one OUT data packet.  We'll
1724  * try whatever we're told to try.
1725  */
1726 static int ctrl_out(struct usbtest_dev *dev,
1727                 unsigned count, unsigned length, unsigned vary, unsigned offset)
1728 {
1729         unsigned                i, j, len;
1730         int                     retval;
1731         u8                      *buf;
1732         char                    *what = "?";
1733         struct usb_device       *udev;
1734
1735         if (length < 1 || length > 0xffff || vary >= length)
1736                 return -EINVAL;
1737
1738         buf = kmalloc(length + offset, GFP_KERNEL);
1739         if (!buf)
1740                 return -ENOMEM;
1741
1742         buf += offset;
1743         udev = testdev_to_usbdev(dev);
1744         len = length;
1745         retval = 0;
1746
1747         /* NOTE:  hardware might well act differently if we pushed it
1748          * with lots back-to-back queued requests.
1749          */
1750         for (i = 0; i < count; i++) {
1751                 /* write patterned data */
1752                 for (j = 0; j < len; j++)
1753                         buf[j] = (u8)(i + j);
1754                 retval = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
1755                                 0x5b, USB_DIR_OUT|USB_TYPE_VENDOR,
1756                                 0, 0, buf, len, USB_CTRL_SET_TIMEOUT);
1757                 if (retval != len) {
1758                         what = "write";
1759                         if (retval >= 0) {
1760                                 ERROR(dev, "ctrl_out, wlen %d (expected %d)\n",
1761                                                 retval, len);
1762                                 retval = -EBADMSG;
1763                         }
1764                         break;
1765                 }
1766
1767                 /* read it back -- assuming nothing intervened!!  */
1768                 retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
1769                                 0x5c, USB_DIR_IN|USB_TYPE_VENDOR,
1770                                 0, 0, buf, len, USB_CTRL_GET_TIMEOUT);
1771                 if (retval != len) {
1772                         what = "read";
1773                         if (retval >= 0) {
1774                                 ERROR(dev, "ctrl_out, rlen %d (expected %d)\n",
1775                                                 retval, len);
1776                                 retval = -EBADMSG;
1777                         }
1778                         break;
1779                 }
1780
1781                 /* fail if we can't verify */
1782                 for (j = 0; j < len; j++) {
1783                         if (buf[j] != (u8)(i + j)) {
1784                                 ERROR(dev, "ctrl_out, byte %d is %d not %d\n",
1785                                         j, buf[j], (u8)(i + j));
1786                                 retval = -EBADMSG;
1787                                 break;
1788                         }
1789                 }
1790                 if (retval < 0) {
1791                         what = "verify";
1792                         break;
1793                 }
1794
1795                 len += vary;
1796
1797                 /* [real world] the "zero bytes IN" case isn't really used.
1798                  * hardware can easily trip up in this weird case, since its
1799                  * status stage is IN, not OUT like other ep0in transfers.
1800                  */
1801                 if (len > length)
1802                         len = realworld ? 1 : 0;
1803         }
1804
1805         if (retval < 0)
1806                 ERROR(dev, "ctrl_out %s failed, code %d, count %d\n",
1807                         what, retval, i);
1808
1809         kfree(buf - offset);
1810         return retval;
1811 }
1812
1813 /*-------------------------------------------------------------------------*/
1814
1815 /* ISO/BULK tests ... mimics common usage
1816  *  - buffer length is split into N packets (mostly maxpacket sized)
1817  *  - multi-buffers according to sglen
1818  */
1819
1820 struct transfer_context {
1821         unsigned                count;
1822         unsigned                pending;
1823         spinlock_t              lock;
1824         struct completion       done;
1825         int                     submit_error;
1826         unsigned long           errors;
1827         unsigned long           packet_count;
1828         struct usbtest_dev      *dev;
1829         bool                    is_iso;
1830 };
1831
1832 static void complicated_callback(struct urb *urb)
1833 {
1834         struct transfer_context *ctx = urb->context;
1835
1836         spin_lock(&ctx->lock);
1837         ctx->count--;
1838
1839         ctx->packet_count += urb->number_of_packets;
1840         if (urb->error_count > 0)
1841                 ctx->errors += urb->error_count;
1842         else if (urb->status != 0)
1843                 ctx->errors += (ctx->is_iso ? urb->number_of_packets : 1);
1844         else if (urb->actual_length != urb->transfer_buffer_length)
1845                 ctx->errors++;
1846         else if (check_guard_bytes(ctx->dev, urb) != 0)
1847                 ctx->errors++;
1848
1849         if (urb->status == 0 && ctx->count > (ctx->pending - 1)
1850                         && !ctx->submit_error) {
1851                 int status = usb_submit_urb(urb, GFP_ATOMIC);
1852                 switch (status) {
1853                 case 0:
1854                         goto done;
1855                 default:
1856                         dev_err(&ctx->dev->intf->dev,
1857                                         "iso resubmit err %d\n",
1858                                         status);
1859                         /* FALLTHROUGH */
1860                 case -ENODEV:                   /* disconnected */
1861                 case -ESHUTDOWN:                /* endpoint disabled */
1862                         ctx->submit_error = 1;
1863                         break;
1864                 }
1865         }
1866
1867         ctx->pending--;
1868         if (ctx->pending == 0) {
1869                 if (ctx->errors)
1870                         dev_err(&ctx->dev->intf->dev,
1871                                 "iso test, %lu errors out of %lu\n",
1872                                 ctx->errors, ctx->packet_count);
1873                 complete(&ctx->done);
1874         }
1875 done:
1876         spin_unlock(&ctx->lock);
1877 }
1878
1879 static struct urb *iso_alloc_urb(
1880         struct usb_device       *udev,
1881         int                     pipe,
1882         struct usb_endpoint_descriptor  *desc,
1883         long                    bytes,
1884         unsigned offset
1885 )
1886 {
1887         struct urb              *urb;
1888         unsigned                i, maxp, packets;
1889
1890         if (bytes < 0 || !desc)
1891                 return NULL;
1892         maxp = 0x7ff & usb_endpoint_maxp(desc);
1893         maxp *= 1 + (0x3 & (usb_endpoint_maxp(desc) >> 11));
1894         packets = DIV_ROUND_UP(bytes, maxp);
1895
1896         urb = usb_alloc_urb(packets, GFP_KERNEL);
1897         if (!urb)
1898                 return urb;
1899         urb->dev = udev;
1900         urb->pipe = pipe;
1901
1902         urb->number_of_packets = packets;
1903         urb->transfer_buffer_length = bytes;
1904         urb->transfer_buffer = usb_alloc_coherent(udev, bytes + offset,
1905                                                         GFP_KERNEL,
1906                                                         &urb->transfer_dma);
1907         if (!urb->transfer_buffer) {
1908                 usb_free_urb(urb);
1909                 return NULL;
1910         }
1911         if (offset) {
1912                 memset(urb->transfer_buffer, GUARD_BYTE, offset);
1913                 urb->transfer_buffer += offset;
1914                 urb->transfer_dma += offset;
1915         }
1916         /* For inbound transfers use guard byte so that test fails if
1917                 data not correctly copied */
1918         memset(urb->transfer_buffer,
1919                         usb_pipein(urb->pipe) ? GUARD_BYTE : 0,
1920                         bytes);
1921
1922         for (i = 0; i < packets; i++) {
1923                 /* here, only the last packet will be short */
1924                 urb->iso_frame_desc[i].length = min((unsigned) bytes, maxp);
1925                 bytes -= urb->iso_frame_desc[i].length;
1926
1927                 urb->iso_frame_desc[i].offset = maxp * i;
1928         }
1929
1930         urb->complete = complicated_callback;
1931         /* urb->context = SET BY CALLER */
1932         urb->interval = 1 << (desc->bInterval - 1);
1933         urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
1934         return urb;
1935 }
1936
1937 static int
1938 test_queue(struct usbtest_dev *dev, struct usbtest_param *param,
1939                 int pipe, struct usb_endpoint_descriptor *desc, unsigned offset)
1940 {
1941         struct transfer_context context;
1942         struct usb_device       *udev;
1943         unsigned                i;
1944         unsigned long           packets = 0;
1945         int                     status = 0;
1946         struct urb              *urbs[param->sglen];
1947
1948         memset(&context, 0, sizeof(context));
1949         context.count = param->iterations * param->sglen;
1950         context.dev = dev;
1951         context.is_iso = !!desc;
1952         init_completion(&context.done);
1953         spin_lock_init(&context.lock);
1954
1955         udev = testdev_to_usbdev(dev);
1956
1957         for (i = 0; i < param->sglen; i++) {
1958                 if (context.is_iso)
1959                         urbs[i] = iso_alloc_urb(udev, pipe, desc,
1960                                         param->length, offset);
1961                 else
1962                         urbs[i] = complicated_alloc_urb(udev, pipe,
1963                                         param->length, 0);
1964
1965                 if (!urbs[i]) {
1966                         status = -ENOMEM;
1967                         goto fail;
1968                 }
1969                 packets += urbs[i]->number_of_packets;
1970                 urbs[i]->context = &context;
1971         }
1972         packets *= param->iterations;
1973
1974         if (context.is_iso) {
1975                 dev_info(&dev->intf->dev,
1976                         "iso period %d %sframes, wMaxPacket %d, transactions: %d\n",
1977                         1 << (desc->bInterval - 1),
1978                         (udev->speed == USB_SPEED_HIGH) ? "micro" : "",
1979                         usb_endpoint_maxp(desc) & 0x7ff,
1980                         1 + (0x3 & (usb_endpoint_maxp(desc) >> 11)));
1981
1982                 dev_info(&dev->intf->dev,
1983                         "total %lu msec (%lu packets)\n",
1984                         (packets * (1 << (desc->bInterval - 1)))
1985                                 / ((udev->speed == USB_SPEED_HIGH) ? 8 : 1),
1986                         packets);
1987         }
1988
1989         spin_lock_irq(&context.lock);
1990         for (i = 0; i < param->sglen; i++) {
1991                 ++context.pending;
1992                 status = usb_submit_urb(urbs[i], GFP_ATOMIC);
1993                 if (status < 0) {
1994                         ERROR(dev, "submit iso[%d], error %d\n", i, status);
1995                         if (i == 0) {
1996                                 spin_unlock_irq(&context.lock);
1997                                 goto fail;
1998                         }
1999
2000                         simple_free_urb(urbs[i]);
2001                         urbs[i] = NULL;
2002                         context.pending--;
2003                         context.submit_error = 1;
2004                         break;
2005                 }
2006         }
2007         spin_unlock_irq(&context.lock);
2008
2009         wait_for_completion(&context.done);
2010
2011         for (i = 0; i < param->sglen; i++) {
2012                 if (urbs[i])
2013                         simple_free_urb(urbs[i]);
2014         }
2015         /*
2016          * Isochronous transfers are expected to fail sometimes.  As an
2017          * arbitrary limit, we will report an error if any submissions
2018          * fail or if the transfer failure rate is > 10%.
2019          */
2020         if (status != 0)
2021                 ;
2022         else if (context.submit_error)
2023                 status = -EACCES;
2024         else if (context.errors >
2025                         (context.is_iso ? context.packet_count / 10 : 0))
2026                 status = -EIO;
2027         return status;
2028
2029 fail:
2030         for (i = 0; i < param->sglen; i++) {
2031                 if (urbs[i])
2032                         simple_free_urb(urbs[i]);
2033         }
2034         return status;
2035 }
2036
2037 static int test_unaligned_bulk(
2038         struct usbtest_dev *tdev,
2039         int pipe,
2040         unsigned length,
2041         int iterations,
2042         unsigned transfer_flags,
2043         const char *label)
2044 {
2045         int retval;
2046         struct urb *urb = usbtest_alloc_urb(testdev_to_usbdev(tdev),
2047                         pipe, length, transfer_flags, 1, 0, simple_callback);
2048
2049         if (!urb)
2050                 return -ENOMEM;
2051
2052         retval = simple_io(tdev, urb, iterations, 0, 0, label);
2053         simple_free_urb(urb);
2054         return retval;
2055 }
2056
2057 /*-------------------------------------------------------------------------*/
2058
2059 /* We only have this one interface to user space, through usbfs.
2060  * User mode code can scan usbfs to find N different devices (maybe on
2061  * different busses) to use when testing, and allocate one thread per
2062  * test.  So discovery is simplified, and we have no device naming issues.
2063  *
2064  * Don't use these only as stress/load tests.  Use them along with with
2065  * other USB bus activity:  plugging, unplugging, mousing, mp3 playback,
2066  * video capture, and so on.  Run different tests at different times, in
2067  * different sequences.  Nothing here should interact with other devices,
2068  * except indirectly by consuming USB bandwidth and CPU resources for test
2069  * threads and request completion.  But the only way to know that for sure
2070  * is to test when HC queues are in use by many devices.
2071  *
2072  * WARNING:  Because usbfs grabs udev->dev.sem before calling this ioctl(),
2073  * it locks out usbcore in certain code paths.  Notably, if you disconnect
2074  * the device-under-test, hub_wq will wait block forever waiting for the
2075  * ioctl to complete ... so that usb_disconnect() can abort the pending
2076  * urbs and then call usbtest_disconnect().  To abort a test, you're best
2077  * off just killing the userspace task and waiting for it to exit.
2078  */
2079
2080 static int
2081 usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
2082 {
2083         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2084         struct usb_device       *udev = testdev_to_usbdev(dev);
2085         struct usbtest_param    *param = buf;
2086         int                     retval = -EOPNOTSUPP;
2087         struct urb              *urb;
2088         struct scatterlist      *sg;
2089         struct usb_sg_request   req;
2090         struct timeval          start;
2091         unsigned                i;
2092
2093         /* FIXME USBDEVFS_CONNECTINFO doesn't say how fast the device is. */
2094
2095         pattern = mod_pattern;
2096
2097         if (code != USBTEST_REQUEST)
2098                 return -EOPNOTSUPP;
2099
2100         if (param->iterations <= 0)
2101                 return -EINVAL;
2102
2103         if (param->sglen > MAX_SGLEN)
2104                 return -EINVAL;
2105
2106         if (mutex_lock_interruptible(&dev->lock))
2107                 return -ERESTARTSYS;
2108
2109         /* FIXME: What if a system sleep starts while a test is running? */
2110
2111         /* some devices, like ez-usb default devices, need a non-default
2112          * altsetting to have any active endpoints.  some tests change
2113          * altsettings; force a default so most tests don't need to check.
2114          */
2115         if (dev->info->alt >= 0) {
2116                 int     res;
2117
2118                 if (intf->altsetting->desc.bInterfaceNumber) {
2119                         mutex_unlock(&dev->lock);
2120                         return -ENODEV;
2121                 }
2122                 res = set_altsetting(dev, dev->info->alt);
2123                 if (res) {
2124                         dev_err(&intf->dev,
2125                                         "set altsetting to %d failed, %d\n",
2126                                         dev->info->alt, res);
2127                         mutex_unlock(&dev->lock);
2128                         return res;
2129                 }
2130         }
2131
2132         /*
2133          * Just a bunch of test cases that every HCD is expected to handle.
2134          *
2135          * Some may need specific firmware, though it'd be good to have
2136          * one firmware image to handle all the test cases.
2137          *
2138          * FIXME add more tests!  cancel requests, verify the data, control
2139          * queueing, concurrent read+write threads, and so on.
2140          */
2141         do_gettimeofday(&start);
2142         switch (param->test_num) {
2143
2144         case 0:
2145                 dev_info(&intf->dev, "TEST 0:  NOP\n");
2146                 retval = 0;
2147                 break;
2148
2149         /* Simple non-queued bulk I/O tests */
2150         case 1:
2151                 if (dev->out_pipe == 0)
2152                         break;
2153                 dev_info(&intf->dev,
2154                                 "TEST 1:  write %d bytes %u times\n",
2155                                 param->length, param->iterations);
2156                 urb = simple_alloc_urb(udev, dev->out_pipe, param->length, 0);
2157                 if (!urb) {
2158                         retval = -ENOMEM;
2159                         break;
2160                 }
2161                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2162                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test1");
2163                 simple_free_urb(urb);
2164                 break;
2165         case 2:
2166                 if (dev->in_pipe == 0)
2167                         break;
2168                 dev_info(&intf->dev,
2169                                 "TEST 2:  read %d bytes %u times\n",
2170                                 param->length, param->iterations);
2171                 urb = simple_alloc_urb(udev, dev->in_pipe, param->length, 0);
2172                 if (!urb) {
2173                         retval = -ENOMEM;
2174                         break;
2175                 }
2176                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2177                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test2");
2178                 simple_free_urb(urb);
2179                 break;
2180         case 3:
2181                 if (dev->out_pipe == 0 || param->vary == 0)
2182                         break;
2183                 dev_info(&intf->dev,
2184                                 "TEST 3:  write/%d 0..%d bytes %u times\n",
2185                                 param->vary, param->length, param->iterations);
2186                 urb = simple_alloc_urb(udev, dev->out_pipe, param->length, 0);
2187                 if (!urb) {
2188                         retval = -ENOMEM;
2189                         break;
2190                 }
2191                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2192                 retval = simple_io(dev, urb, param->iterations, param->vary,
2193                                         0, "test3");
2194                 simple_free_urb(urb);
2195                 break;
2196         case 4:
2197                 if (dev->in_pipe == 0 || param->vary == 0)
2198                         break;
2199                 dev_info(&intf->dev,
2200                                 "TEST 4:  read/%d 0..%d bytes %u times\n",
2201                                 param->vary, param->length, param->iterations);
2202                 urb = simple_alloc_urb(udev, dev->in_pipe, param->length, 0);
2203                 if (!urb) {
2204                         retval = -ENOMEM;
2205                         break;
2206                 }
2207                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2208                 retval = simple_io(dev, urb, param->iterations, param->vary,
2209                                         0, "test4");
2210                 simple_free_urb(urb);
2211                 break;
2212
2213         /* Queued bulk I/O tests */
2214         case 5:
2215                 if (dev->out_pipe == 0 || param->sglen == 0)
2216                         break;
2217                 dev_info(&intf->dev,
2218                         "TEST 5:  write %d sglists %d entries of %d bytes\n",
2219                                 param->iterations,
2220                                 param->sglen, param->length);
2221                 sg = alloc_sglist(param->sglen, param->length,
2222                                 0, dev, dev->out_pipe);
2223                 if (!sg) {
2224                         retval = -ENOMEM;
2225                         break;
2226                 }
2227                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2228                 retval = perform_sglist(dev, param->iterations, dev->out_pipe,
2229                                 &req, sg, param->sglen);
2230                 free_sglist(sg, param->sglen);
2231                 break;
2232
2233         case 6:
2234                 if (dev->in_pipe == 0 || param->sglen == 0)
2235                         break;
2236                 dev_info(&intf->dev,
2237                         "TEST 6:  read %d sglists %d entries of %d bytes\n",
2238                                 param->iterations,
2239                                 param->sglen, param->length);
2240                 sg = alloc_sglist(param->sglen, param->length,
2241                                 0, dev, dev->in_pipe);
2242                 if (!sg) {
2243                         retval = -ENOMEM;
2244                         break;
2245                 }
2246                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2247                 retval = perform_sglist(dev, param->iterations, dev->in_pipe,
2248                                 &req, sg, param->sglen);
2249                 free_sglist(sg, param->sglen);
2250                 break;
2251         case 7:
2252                 if (dev->out_pipe == 0 || param->sglen == 0 || param->vary == 0)
2253                         break;
2254                 dev_info(&intf->dev,
2255                         "TEST 7:  write/%d %d sglists %d entries 0..%d bytes\n",
2256                                 param->vary, param->iterations,
2257                                 param->sglen, param->length);
2258                 sg = alloc_sglist(param->sglen, param->length,
2259                                 param->vary, dev, dev->out_pipe);
2260                 if (!sg) {
2261                         retval = -ENOMEM;
2262                         break;
2263                 }
2264                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2265                 retval = perform_sglist(dev, param->iterations, dev->out_pipe,
2266                                 &req, sg, param->sglen);
2267                 free_sglist(sg, param->sglen);
2268                 break;
2269         case 8:
2270                 if (dev->in_pipe == 0 || param->sglen == 0 || param->vary == 0)
2271                         break;
2272                 dev_info(&intf->dev,
2273                         "TEST 8:  read/%d %d sglists %d entries 0..%d bytes\n",
2274                                 param->vary, param->iterations,
2275                                 param->sglen, param->length);
2276                 sg = alloc_sglist(param->sglen, param->length,
2277                                 param->vary, dev, dev->in_pipe);
2278                 if (!sg) {
2279                         retval = -ENOMEM;
2280                         break;
2281                 }
2282                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2283                 retval = perform_sglist(dev, param->iterations, dev->in_pipe,
2284                                 &req, sg, param->sglen);
2285                 free_sglist(sg, param->sglen);
2286                 break;
2287
2288         /* non-queued sanity tests for control (chapter 9 subset) */
2289         case 9:
2290                 retval = 0;
2291                 dev_info(&intf->dev,
2292                         "TEST 9:  ch9 (subset) control tests, %d times\n",
2293                                 param->iterations);
2294                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2295                         retval = ch9_postconfig(dev);
2296                 if (retval)
2297                         dev_err(&intf->dev, "ch9 subset failed, "
2298                                         "iterations left %d\n", i);
2299                 break;
2300
2301         /* queued control messaging */
2302         case 10:
2303                 retval = 0;
2304                 dev_info(&intf->dev,
2305                                 "TEST 10:  queue %d control calls, %d times\n",
2306                                 param->sglen,
2307                                 param->iterations);
2308                 retval = test_ctrl_queue(dev, param);
2309                 break;
2310
2311         /* simple non-queued unlinks (ring with one urb) */
2312         case 11:
2313                 if (dev->in_pipe == 0 || !param->length)
2314                         break;
2315                 retval = 0;
2316                 dev_info(&intf->dev, "TEST 11:  unlink %d reads of %d\n",
2317                                 param->iterations, param->length);
2318                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2319                         retval = unlink_simple(dev, dev->in_pipe,
2320                                                 param->length);
2321                 if (retval)
2322                         dev_err(&intf->dev, "unlink reads failed %d, "
2323                                 "iterations left %d\n", retval, i);
2324                 break;
2325         case 12:
2326                 if (dev->out_pipe == 0 || !param->length)
2327                         break;
2328                 retval = 0;
2329                 dev_info(&intf->dev, "TEST 12:  unlink %d writes of %d\n",
2330                                 param->iterations, param->length);
2331                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2332                         retval = unlink_simple(dev, dev->out_pipe,
2333                                                 param->length);
2334                 if (retval)
2335                         dev_err(&intf->dev, "unlink writes failed %d, "
2336                                 "iterations left %d\n", retval, i);
2337                 break;
2338
2339         /* ep halt tests */
2340         case 13:
2341                 if (dev->out_pipe == 0 && dev->in_pipe == 0)
2342                         break;
2343                 retval = 0;
2344                 dev_info(&intf->dev, "TEST 13:  set/clear %d halts\n",
2345                                 param->iterations);
2346                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2347                         retval = halt_simple(dev);
2348
2349                 if (retval)
2350                         ERROR(dev, "halts failed, iterations left %d\n", i);
2351                 break;
2352
2353         /* control write tests */
2354         case 14:
2355                 if (!dev->info->ctrl_out)
2356                         break;
2357                 dev_info(&intf->dev, "TEST 14:  %d ep0out, %d..%d vary %d\n",
2358                                 param->iterations,
2359                                 realworld ? 1 : 0, param->length,
2360                                 param->vary);
2361                 retval = ctrl_out(dev, param->iterations,
2362                                 param->length, param->vary, 0);
2363                 break;
2364
2365         /* iso write tests */
2366         case 15:
2367                 if (dev->out_iso_pipe == 0 || param->sglen == 0)
2368                         break;
2369                 dev_info(&intf->dev,
2370                         "TEST 15:  write %d iso, %d entries of %d bytes\n",
2371                                 param->iterations,
2372                                 param->sglen, param->length);
2373                 /* FIRMWARE:  iso sink */
2374                 retval = test_queue(dev, param,
2375                                 dev->out_iso_pipe, dev->iso_out, 0);
2376                 break;
2377
2378         /* iso read tests */
2379         case 16:
2380                 if (dev->in_iso_pipe == 0 || param->sglen == 0)
2381                         break;
2382                 dev_info(&intf->dev,
2383                         "TEST 16:  read %d iso, %d entries of %d bytes\n",
2384                                 param->iterations,
2385                                 param->sglen, param->length);
2386                 /* FIRMWARE:  iso source */
2387                 retval = test_queue(dev, param,
2388                                 dev->in_iso_pipe, dev->iso_in, 0);
2389                 break;
2390
2391         /* FIXME scatterlist cancel (needs helper thread) */
2392
2393         /* Tests for bulk I/O using DMA mapping by core and odd address */
2394         case 17:
2395                 if (dev->out_pipe == 0)
2396                         break;
2397                 dev_info(&intf->dev,
2398                         "TEST 17:  write odd addr %d bytes %u times core map\n",
2399                         param->length, param->iterations);
2400
2401                 retval = test_unaligned_bulk(
2402                                 dev, dev->out_pipe,
2403                                 param->length, param->iterations,
2404                                 0, "test17");
2405                 break;
2406
2407         case 18:
2408                 if (dev->in_pipe == 0)
2409                         break;
2410                 dev_info(&intf->dev,
2411                         "TEST 18:  read odd addr %d bytes %u times core map\n",
2412                         param->length, param->iterations);
2413
2414                 retval = test_unaligned_bulk(
2415                                 dev, dev->in_pipe,
2416                                 param->length, param->iterations,
2417                                 0, "test18");
2418                 break;
2419
2420         /* Tests for bulk I/O using premapped coherent buffer and odd address */
2421         case 19:
2422                 if (dev->out_pipe == 0)
2423                         break;
2424                 dev_info(&intf->dev,
2425                         "TEST 19:  write odd addr %d bytes %u times premapped\n",
2426                         param->length, param->iterations);
2427
2428                 retval = test_unaligned_bulk(
2429                                 dev, dev->out_pipe,
2430                                 param->length, param->iterations,
2431                                 URB_NO_TRANSFER_DMA_MAP, "test19");
2432                 break;
2433
2434         case 20:
2435                 if (dev->in_pipe == 0)
2436                         break;
2437                 dev_info(&intf->dev,
2438                         "TEST 20:  read odd addr %d bytes %u times premapped\n",
2439                         param->length, param->iterations);
2440
2441                 retval = test_unaligned_bulk(
2442                                 dev, dev->in_pipe,
2443                                 param->length, param->iterations,
2444                                 URB_NO_TRANSFER_DMA_MAP, "test20");
2445                 break;
2446
2447         /* control write tests with unaligned buffer */
2448         case 21:
2449                 if (!dev->info->ctrl_out)
2450                         break;
2451                 dev_info(&intf->dev,
2452                                 "TEST 21:  %d ep0out odd addr, %d..%d vary %d\n",
2453                                 param->iterations,
2454                                 realworld ? 1 : 0, param->length,
2455                                 param->vary);
2456                 retval = ctrl_out(dev, param->iterations,
2457                                 param->length, param->vary, 1);
2458                 break;
2459
2460         /* unaligned iso tests */
2461         case 22:
2462                 if (dev->out_iso_pipe == 0 || param->sglen == 0)
2463                         break;
2464                 dev_info(&intf->dev,
2465                         "TEST 22:  write %d iso odd, %d entries of %d bytes\n",
2466                                 param->iterations,
2467                                 param->sglen, param->length);
2468                 retval = test_queue(dev, param,
2469                                 dev->out_iso_pipe, dev->iso_out, 1);
2470                 break;
2471
2472         case 23:
2473                 if (dev->in_iso_pipe == 0 || param->sglen == 0)
2474                         break;
2475                 dev_info(&intf->dev,
2476                         "TEST 23:  read %d iso odd, %d entries of %d bytes\n",
2477                                 param->iterations,
2478                                 param->sglen, param->length);
2479                 retval = test_queue(dev, param,
2480                                 dev->in_iso_pipe, dev->iso_in, 1);
2481                 break;
2482
2483         /* unlink URBs from a bulk-OUT queue */
2484         case 24:
2485                 if (dev->out_pipe == 0 || !param->length || param->sglen < 4)
2486                         break;
2487                 retval = 0;
2488                 dev_info(&intf->dev, "TEST 24:  unlink from %d queues of "
2489                                 "%d %d-byte writes\n",
2490                                 param->iterations, param->sglen, param->length);
2491                 for (i = param->iterations; retval == 0 && i > 0; --i) {
2492                         retval = unlink_queued(dev, dev->out_pipe,
2493                                                 param->sglen, param->length);
2494                         if (retval) {
2495                                 dev_err(&intf->dev,
2496                                         "unlink queued writes failed %d, "
2497                                         "iterations left %d\n", retval, i);
2498                                 break;
2499                         }
2500                 }
2501                 break;
2502
2503         /* Simple non-queued interrupt I/O tests */
2504         case 25:
2505                 if (dev->out_int_pipe == 0)
2506                         break;
2507                 dev_info(&intf->dev,
2508                                 "TEST 25: write %d bytes %u times\n",
2509                                 param->length, param->iterations);
2510                 urb = simple_alloc_urb(udev, dev->out_int_pipe, param->length,
2511                                 dev->int_out->bInterval);
2512                 if (!urb) {
2513                         retval = -ENOMEM;
2514                         break;
2515                 }
2516                 /* FIRMWARE: interrupt sink (maybe accepts short writes) */
2517                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test25");
2518                 simple_free_urb(urb);
2519                 break;
2520         case 26:
2521                 if (dev->in_int_pipe == 0)
2522                         break;
2523                 dev_info(&intf->dev,
2524                                 "TEST 26: read %d bytes %u times\n",
2525                                 param->length, param->iterations);
2526                 urb = simple_alloc_urb(udev, dev->in_int_pipe, param->length,
2527                                 dev->int_in->bInterval);
2528                 if (!urb) {
2529                         retval = -ENOMEM;
2530                         break;
2531                 }
2532                 /* FIRMWARE: interrupt source (maybe generates short writes) */
2533                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test26");
2534                 simple_free_urb(urb);
2535                 break;
2536         case 27:
2537                 /* We do performance test, so ignore data compare */
2538                 if (dev->out_pipe == 0 || param->sglen == 0 || pattern != 0)
2539                         break;
2540                 dev_info(&intf->dev,
2541                         "TEST 27: bulk write %dMbytes\n", (param->iterations *
2542                         param->sglen * param->length) / (1024 * 1024));
2543                 retval = test_queue(dev, param,
2544                                 dev->out_pipe, NULL, 0);
2545                 break;
2546         case 28:
2547                 if (dev->in_pipe == 0 || param->sglen == 0 || pattern != 0)
2548                         break;
2549                 dev_info(&intf->dev,
2550                         "TEST 28: bulk read %dMbytes\n", (param->iterations *
2551                         param->sglen * param->length) / (1024 * 1024));
2552                 retval = test_queue(dev, param,
2553                                 dev->in_pipe, NULL, 0);
2554                 break;
2555         }
2556         do_gettimeofday(&param->duration);
2557         param->duration.tv_sec -= start.tv_sec;
2558         param->duration.tv_usec -= start.tv_usec;
2559         if (param->duration.tv_usec < 0) {
2560                 param->duration.tv_usec += 1000 * 1000;
2561                 param->duration.tv_sec -= 1;
2562         }
2563         mutex_unlock(&dev->lock);
2564         return retval;
2565 }
2566
2567 /*-------------------------------------------------------------------------*/
2568
2569 static unsigned force_interrupt;
2570 module_param(force_interrupt, uint, 0);
2571 MODULE_PARM_DESC(force_interrupt, "0 = test default; else interrupt");
2572
2573 #ifdef  GENERIC
2574 static unsigned short vendor;
2575 module_param(vendor, ushort, 0);
2576 MODULE_PARM_DESC(vendor, "vendor code (from usb-if)");
2577
2578 static unsigned short product;
2579 module_param(product, ushort, 0);
2580 MODULE_PARM_DESC(product, "product code (from vendor)");
2581 #endif
2582
2583 static int
2584 usbtest_probe(struct usb_interface *intf, const struct usb_device_id *id)
2585 {
2586         struct usb_device       *udev;
2587         struct usbtest_dev      *dev;
2588         struct usbtest_info     *info;
2589         char                    *rtest, *wtest;
2590         char                    *irtest, *iwtest;
2591         char                    *intrtest, *intwtest;
2592
2593         udev = interface_to_usbdev(intf);
2594
2595 #ifdef  GENERIC
2596         /* specify devices by module parameters? */
2597         if (id->match_flags == 0) {
2598                 /* vendor match required, product match optional */
2599                 if (!vendor || le16_to_cpu(udev->descriptor.idVendor) != (u16)vendor)
2600                         return -ENODEV;
2601                 if (product && le16_to_cpu(udev->descriptor.idProduct) != (u16)product)
2602                         return -ENODEV;
2603                 dev_info(&intf->dev, "matched module params, "
2604                                         "vend=0x%04x prod=0x%04x\n",
2605                                 le16_to_cpu(udev->descriptor.idVendor),
2606                                 le16_to_cpu(udev->descriptor.idProduct));
2607         }
2608 #endif
2609
2610         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
2611         if (!dev)
2612                 return -ENOMEM;
2613         info = (struct usbtest_info *) id->driver_info;
2614         dev->info = info;
2615         mutex_init(&dev->lock);
2616
2617         dev->intf = intf;
2618
2619         /* cacheline-aligned scratch for i/o */
2620         dev->buf = kmalloc(TBUF_SIZE, GFP_KERNEL);
2621         if (dev->buf == NULL) {
2622                 kfree(dev);
2623                 return -ENOMEM;
2624         }
2625
2626         /* NOTE this doesn't yet test the handful of difference that are
2627          * visible with high speed interrupts:  bigger maxpacket (1K) and
2628          * "high bandwidth" modes (up to 3 packets/uframe).
2629          */
2630         rtest = wtest = "";
2631         irtest = iwtest = "";
2632         intrtest = intwtest = "";
2633         if (force_interrupt || udev->speed == USB_SPEED_LOW) {
2634                 if (info->ep_in) {
2635                         dev->in_pipe = usb_rcvintpipe(udev, info->ep_in);
2636                         rtest = " intr-in";
2637                 }
2638                 if (info->ep_out) {
2639                         dev->out_pipe = usb_sndintpipe(udev, info->ep_out);
2640                         wtest = " intr-out";
2641                 }
2642         } else {
2643                 if (override_alt >= 0 || info->autoconf) {
2644                         int status;
2645
2646                         status = get_endpoints(dev, intf);
2647                         if (status < 0) {
2648                                 WARNING(dev, "couldn't get endpoints, %d\n",
2649                                                 status);
2650                                 kfree(dev->buf);
2651                                 kfree(dev);
2652                                 return status;
2653                         }
2654                         /* may find bulk or ISO pipes */
2655                 } else {
2656                         if (info->ep_in)
2657                                 dev->in_pipe = usb_rcvbulkpipe(udev,
2658                                                         info->ep_in);
2659                         if (info->ep_out)
2660                                 dev->out_pipe = usb_sndbulkpipe(udev,
2661                                                         info->ep_out);
2662                 }
2663                 if (dev->in_pipe)
2664                         rtest = " bulk-in";
2665                 if (dev->out_pipe)
2666                         wtest = " bulk-out";
2667                 if (dev->in_iso_pipe)
2668                         irtest = " iso-in";
2669                 if (dev->out_iso_pipe)
2670                         iwtest = " iso-out";
2671                 if (dev->in_int_pipe)
2672                         intrtest = " int-in";
2673                 if (dev->out_int_pipe)
2674                         intwtest = " int-out";
2675         }
2676
2677         usb_set_intfdata(intf, dev);
2678         dev_info(&intf->dev, "%s\n", info->name);
2679         dev_info(&intf->dev, "%s {control%s%s%s%s%s%s%s} tests%s\n",
2680                         usb_speed_string(udev->speed),
2681                         info->ctrl_out ? " in/out" : "",
2682                         rtest, wtest,
2683                         irtest, iwtest,
2684                         intrtest, intwtest,
2685                         info->alt >= 0 ? " (+alt)" : "");
2686         return 0;
2687 }
2688
2689 static int usbtest_suspend(struct usb_interface *intf, pm_message_t message)
2690 {
2691         return 0;
2692 }
2693
2694 static int usbtest_resume(struct usb_interface *intf)
2695 {
2696         return 0;
2697 }
2698
2699
2700 static void usbtest_disconnect(struct usb_interface *intf)
2701 {
2702         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2703
2704         usb_set_intfdata(intf, NULL);
2705         dev_dbg(&intf->dev, "disconnect\n");
2706         kfree(dev->buf);
2707         kfree(dev);
2708 }
2709
2710 /* Basic testing only needs a device that can source or sink bulk traffic.
2711  * Any device can test control transfers (default with GENERIC binding).
2712  *
2713  * Several entries work with the default EP0 implementation that's built
2714  * into EZ-USB chips.  There's a default vendor ID which can be overridden
2715  * by (very) small config EEPROMS, but otherwise all these devices act
2716  * identically until firmware is loaded:  only EP0 works.  It turns out
2717  * to be easy to make other endpoints work, without modifying that EP0
2718  * behavior.  For now, we expect that kind of firmware.
2719  */
2720
2721 /* an21xx or fx versions of ez-usb */
2722 static struct usbtest_info ez1_info = {
2723         .name           = "EZ-USB device",
2724         .ep_in          = 2,
2725         .ep_out         = 2,
2726         .alt            = 1,
2727 };
2728
2729 /* fx2 version of ez-usb */
2730 static struct usbtest_info ez2_info = {
2731         .name           = "FX2 device",
2732         .ep_in          = 6,
2733         .ep_out         = 2,
2734         .alt            = 1,
2735 };
2736
2737 /* ezusb family device with dedicated usb test firmware,
2738  */
2739 static struct usbtest_info fw_info = {
2740         .name           = "usb test device",
2741         .ep_in          = 2,
2742         .ep_out         = 2,
2743         .alt            = 1,
2744         .autoconf       = 1,            /* iso and ctrl_out need autoconf */
2745         .ctrl_out       = 1,
2746         .iso            = 1,            /* iso_ep's are #8 in/out */
2747 };
2748
2749 /* peripheral running Linux and 'zero.c' test firmware, or
2750  * its user-mode cousin. different versions of this use
2751  * different hardware with the same vendor/product codes.
2752  * host side MUST rely on the endpoint descriptors.
2753  */
2754 static struct usbtest_info gz_info = {
2755         .name           = "Linux gadget zero",
2756         .autoconf       = 1,
2757         .ctrl_out       = 1,
2758         .iso            = 1,
2759         .intr           = 1,
2760         .alt            = 0,
2761 };
2762
2763 static struct usbtest_info um_info = {
2764         .name           = "Linux user mode test driver",
2765         .autoconf       = 1,
2766         .alt            = -1,
2767 };
2768
2769 static struct usbtest_info um2_info = {
2770         .name           = "Linux user mode ISO test driver",
2771         .autoconf       = 1,
2772         .iso            = 1,
2773         .alt            = -1,
2774 };
2775
2776 #ifdef IBOT2
2777 /* this is a nice source of high speed bulk data;
2778  * uses an FX2, with firmware provided in the device
2779  */
2780 static struct usbtest_info ibot2_info = {
2781         .name           = "iBOT2 webcam",
2782         .ep_in          = 2,
2783         .alt            = -1,
2784 };
2785 #endif
2786
2787 #ifdef GENERIC
2788 /* we can use any device to test control traffic */
2789 static struct usbtest_info generic_info = {
2790         .name           = "Generic USB device",
2791         .alt            = -1,
2792 };
2793 #endif
2794
2795
2796 static const struct usb_device_id id_table[] = {
2797
2798         /*-------------------------------------------------------------*/
2799
2800         /* EZ-USB devices which download firmware to replace (or in our
2801          * case augment) the default device implementation.
2802          */
2803
2804         /* generic EZ-USB FX controller */
2805         { USB_DEVICE(0x0547, 0x2235),
2806                 .driver_info = (unsigned long) &ez1_info,
2807         },
2808
2809         /* CY3671 development board with EZ-USB FX */
2810         { USB_DEVICE(0x0547, 0x0080),
2811                 .driver_info = (unsigned long) &ez1_info,
2812         },
2813
2814         /* generic EZ-USB FX2 controller (or development board) */
2815         { USB_DEVICE(0x04b4, 0x8613),
2816                 .driver_info = (unsigned long) &ez2_info,
2817         },
2818
2819         /* re-enumerated usb test device firmware */
2820         { USB_DEVICE(0xfff0, 0xfff0),
2821                 .driver_info = (unsigned long) &fw_info,
2822         },
2823
2824         /* "Gadget Zero" firmware runs under Linux */
2825         { USB_DEVICE(0x0525, 0xa4a0),
2826                 .driver_info = (unsigned long) &gz_info,
2827         },
2828
2829         /* so does a user-mode variant */
2830         { USB_DEVICE(0x0525, 0xa4a4),
2831                 .driver_info = (unsigned long) &um_info,
2832         },
2833
2834         /* ... and a user-mode variant that talks iso */
2835         { USB_DEVICE(0x0525, 0xa4a3),
2836                 .driver_info = (unsigned long) &um2_info,
2837         },
2838
2839 #ifdef KEYSPAN_19Qi
2840         /* Keyspan 19qi uses an21xx (original EZ-USB) */
2841         /* this does not coexist with the real Keyspan 19qi driver! */
2842         { USB_DEVICE(0x06cd, 0x010b),
2843                 .driver_info = (unsigned long) &ez1_info,
2844         },
2845 #endif
2846
2847         /*-------------------------------------------------------------*/
2848
2849 #ifdef IBOT2
2850         /* iBOT2 makes a nice source of high speed bulk-in data */
2851         /* this does not coexist with a real iBOT2 driver! */
2852         { USB_DEVICE(0x0b62, 0x0059),
2853                 .driver_info = (unsigned long) &ibot2_info,
2854         },
2855 #endif
2856
2857         /*-------------------------------------------------------------*/
2858
2859 #ifdef GENERIC
2860         /* module params can specify devices to use for control tests */
2861         { .driver_info = (unsigned long) &generic_info, },
2862 #endif
2863
2864         /*-------------------------------------------------------------*/
2865
2866         { }
2867 };
2868 MODULE_DEVICE_TABLE(usb, id_table);
2869
2870 static struct usb_driver usbtest_driver = {
2871         .name =         "usbtest",
2872         .id_table =     id_table,
2873         .probe =        usbtest_probe,
2874         .unlocked_ioctl = usbtest_ioctl,
2875         .disconnect =   usbtest_disconnect,
2876         .suspend =      usbtest_suspend,
2877         .resume =       usbtest_resume,
2878 };
2879
2880 /*-------------------------------------------------------------------------*/
2881
2882 static int __init usbtest_init(void)
2883 {
2884 #ifdef GENERIC
2885         if (vendor)
2886                 pr_debug("params: vend=0x%04x prod=0x%04x\n", vendor, product);
2887 #endif
2888         return usb_register(&usbtest_driver);
2889 }
2890 module_init(usbtest_init);
2891
2892 static void __exit usbtest_exit(void)
2893 {
2894         usb_deregister(&usbtest_driver);
2895 }
2896 module_exit(usbtest_exit);
2897
2898 MODULE_DESCRIPTION("USB Core/HCD Testing Driver");
2899 MODULE_LICENSE("GPL");
2900