drivers/usb/misc/usbtest.c

   1 #include <linux/kernel.h>
   2 #include <linux/errno.h>
   3 #include <linux/init.h>
   4 #include <linux/slab.h>
   5 #include <linux/mm.h>
   6 #include <linux/module.h>
   7 #include <linux/moduleparam.h>
   8 #include <linux/scatterlist.h>
   9 #include <linux/mutex.h>
  10 #include <linux/timer.h>
  11 #include <linux/usb.h>
  12
  13 #define SIMPLE_IO_TIMEOUT       10000   /* in milliseconds */
  14
  15 /*-------------------------------------------------------------------------*/
  16
  17 static int override_alt = -1;
  18 module_param_named(alt, override_alt, int, 0644);
  19 MODULE_PARM_DESC(alt, ">= 0 to override altsetting selection");
  20
  21 /*-------------------------------------------------------------------------*/
  22
  23 /* FIXME make these public somewhere; usbdevfs.h? */
  24 struct usbtest_param {
  25         /* inputs */
  26         unsigned                test_num;       /* 0..(TEST_CASES-1) */
  27         unsigned                iterations;
  28         unsigned                length;
  29         unsigned                vary;
  30         unsigned                sglen;
  31
  32         /* outputs */
  33         struct timeval          duration;
  34 };
  35 #define USBTEST_REQUEST _IOWR('U', 100, struct usbtest_param)
  36
  37 /*-------------------------------------------------------------------------*/
  38
  39 #define GENERIC         /* let probe() bind using module params */
  40
  41 /* Some devices that can be used for testing will have "real" drivers.
  42  * Entries for those need to be enabled here by hand, after disabling
  43  * that "real" driver.
  44  */
  45 //#define       IBOT2           /* grab iBOT2 webcams */
  46 //#define       KEYSPAN_19Qi    /* grab un-renumerated serial adapter */
  47
  48 /*-------------------------------------------------------------------------*/
  49
  50 struct usbtest_info {
  51         const char              *name;
  52         u8                      ep_in;          /* bulk/intr source */
  53         u8                      ep_out;         /* bulk/intr sink */
  54         unsigned                autoconf:1;
  55         unsigned                ctrl_out:1;
  56         unsigned                iso:1;          /* try iso in/out */
  57         unsigned                intr:1;         /* try interrupt in/out */
  58         int                     alt;
  59 };
  60
  61 /* this is accessed only through usbfs ioctl calls.
  62  * one ioctl to issue a test ... one lock per device.
  63  * tests create other threads if they need them.
  64  * urbs and buffers are allocated dynamically,
  65  * and data generated deterministically.
  66  */
  67 struct usbtest_dev {
  68         struct usb_interface    *intf;
  69         struct usbtest_info     *info;
  70         int                     in_pipe;
  71         int                     out_pipe;
  72         int                     in_iso_pipe;
  73         int                     out_iso_pipe;
  74         int                     in_int_pipe;
  75         int                     out_int_pipe;
  76         struct usb_endpoint_descriptor  *iso_in, *iso_out;
  77         struct usb_endpoint_descriptor  *int_in, *int_out;
  78         struct mutex            lock;
  79
  80 #define TBUF_SIZE       256
  81         u8                      *buf;
  82 };
  83
  84 static struct usb_device *testdev_to_usbdev(struct usbtest_dev *test)
  85 {
  86         return interface_to_usbdev(test->intf);
  87 }
  88
  89 /* set up all urbs so they can be used with either bulk or interrupt */
  90 #define INTERRUPT_RATE          1       /* msec/transfer */
  91
  92 #define ERROR(tdev, fmt, args...) \
  93         dev_err(&(tdev)->intf->dev , fmt , ## args)
  94 #define WARNING(tdev, fmt, args...) \
  95         dev_warn(&(tdev)->intf->dev , fmt , ## args)
  96
  97 #define GUARD_BYTE      0xA5
  98 #define MAX_SGLEN       128
  99
 100 /*-------------------------------------------------------------------------*/
 101
 102 static int
 103 get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf)
 104 {
 105         int                             tmp;
 106         struct usb_host_interface       *alt;
 107         struct usb_host_endpoint        *in, *out;
 108         struct usb_host_endpoint        *iso_in, *iso_out;
 109         struct usb_host_endpoint        *int_in, *int_out;
 110         struct usb_device               *udev;
 111
 112         for (tmp = 0; tmp < intf->num_altsetting; tmp++) {
 113                 unsigned        ep;
 114
 115                 in = out = NULL;
 116                 iso_in = iso_out = NULL;
 117                 int_in = int_out = NULL;
 118                 alt = intf->altsetting + tmp;
 119
 120                 if (override_alt >= 0 &&
 121                                 override_alt != alt->desc.bAlternateSetting)
 122                         continue;
 123
 124                 /* take the first altsetting with in-bulk + out-bulk;
 125                  * ignore other endpoints and altsettings.
 126                  */
 127                 for (ep = 0; ep < alt->desc.bNumEndpoints; ep++) {
 128                         struct usb_host_endpoint        *e;
 129
 130                         e = alt->endpoint + ep;
 131                         switch (usb_endpoint_type(&e->desc)) {
 132                         case USB_ENDPOINT_XFER_BULK:
 133                                 break;
 134                         case USB_ENDPOINT_XFER_INT:
 135                                 if (dev->info->intr)
 136                                         goto try_intr;
 137                         case USB_ENDPOINT_XFER_ISOC:
 138                                 if (dev->info->iso)
 139                                         goto try_iso;
 140                                 /* FALLTHROUGH */
 141                         default:
 142                                 continue;
 143                         }
 144                         if (usb_endpoint_dir_in(&e->desc)) {
 145                                 if (!in)
 146                                         in = e;
 147                         } else {
 148                                 if (!out)
 149                                         out = e;
 150                         }
 151                         continue;
 152 try_intr:
 153                         if (usb_endpoint_dir_in(&e->desc)) {
 154                                 if (!int_in)
 155                                         int_in = e;
 156                         } else {
 157                                 if (!int_out)
 158                                         int_out = e;
 159                         }
 160                         continue;
 161 try_iso:
 162                         if (usb_endpoint_dir_in(&e->desc)) {
 163                                 if (!iso_in)
 164                                         iso_in = e;
 165                         } else {
 166                                 if (!iso_out)
 167                                         iso_out = e;
 168                         }
 169                 }
 170                 if ((in && out)  ||  iso_in || iso_out || int_in || int_out)
 171                         goto found;
 172         }
 173         return -EINVAL;
 174
 175 found:
 176         udev = testdev_to_usbdev(dev);
 177         dev->info->alt = alt->desc.bAlternateSetting;
 178         if (alt->desc.bAlternateSetting != 0) {
 179                 tmp = usb_set_interface(udev,
 180                                 alt->desc.bInterfaceNumber,
 181                                 alt->desc.bAlternateSetting);
 182                 if (tmp < 0)
 183                         return tmp;
 184         }
 185
 186         if (in) {
 187                 dev->in_pipe = usb_rcvbulkpipe(udev,
 188                         in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
 189                 dev->out_pipe = usb_sndbulkpipe(udev,
 190                         out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
 191         }
 192         if (iso_in) {
 193                 dev->iso_in = &iso_in->desc;
 194                 dev->in_iso_pipe = usb_rcvisocpipe(udev,
 195                                 iso_in->desc.bEndpointAddress
 196                                         & USB_ENDPOINT_NUMBER_MASK);
 197         }
 198
 199         if (iso_out) {
 200                 dev->iso_out = &iso_out->desc;
 201                 dev->out_iso_pipe = usb_sndisocpipe(udev,
 202                                 iso_out->desc.bEndpointAddress
 203                                         & USB_ENDPOINT_NUMBER_MASK);
 204         }
 205
 206         if (int_in) {
 207                 dev->int_in = &int_in->desc;
 208                 dev->in_int_pipe = usb_rcvintpipe(udev,
 209                                 int_in->desc.bEndpointAddress
 210                                         & USB_ENDPOINT_NUMBER_MASK);
 211         }
 212
 213         if (int_out) {
 214                 dev->int_out = &int_out->desc;
 215                 dev->out_int_pipe = usb_sndintpipe(udev,
 216                                 int_out->desc.bEndpointAddress
 217                                         & USB_ENDPOINT_NUMBER_MASK);
 218         }
 219         return 0;
 220 }
 221
 222 /*-------------------------------------------------------------------------*/
 223
 224 /* Support for testing basic non-queued I/O streams.
 225  *
 226  * These just package urbs as requests that can be easily canceled.
 227  * Each urb's data buffer is dynamically allocated; callers can fill
 228  * them with non-zero test data (or test for it) when appropriate.
 229  */
 230
 231 static void simple_callback(struct urb *urb)
 232 {
 233         complete(urb->context);
 234 }
 235
 236 static struct urb *usbtest_alloc_urb(
 237         struct usb_device       *udev,
 238         int                     pipe,
 239         unsigned long           bytes,
 240         unsigned                transfer_flags,
 241         unsigned                offset,
 242         u8                      bInterval)
 243 {
 244         struct urb              *urb;
 245
 246         urb = usb_alloc_urb(0, GFP_KERNEL);
 247         if (!urb)
 248                 return urb;
 249
 250         if (bInterval)
 251                 usb_fill_int_urb(urb, udev, pipe, NULL, bytes, simple_callback,
 252                                 NULL, bInterval);
 253         else
 254                 usb_fill_bulk_urb(urb, udev, pipe, NULL, bytes, simple_callback,
 255                                 NULL);
 256
 257         urb->interval = (udev->speed == USB_SPEED_HIGH)
 258                         ? (INTERRUPT_RATE << 3)
 259                         : INTERRUPT_RATE;
 260         urb->transfer_flags = transfer_flags;
 261         if (usb_pipein(pipe))
 262                 urb->transfer_flags |= URB_SHORT_NOT_OK;
 263
 264         if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 265                 urb->transfer_buffer = usb_alloc_coherent(udev, bytes + offset,
 266                         GFP_KERNEL, &urb->transfer_dma);
 267         else
 268                 urb->transfer_buffer = kmalloc(bytes + offset, GFP_KERNEL);
 269
 270         if (!urb->transfer_buffer) {
 271                 usb_free_urb(urb);
 272                 return NULL;
 273         }
 274
 275         /* To test unaligned transfers add an offset and fill the
 276                 unused memory with a guard value */
 277         if (offset) {
 278                 memset(urb->transfer_buffer, GUARD_BYTE, offset);
 279                 urb->transfer_buffer += offset;
 280                 if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 281                         urb->transfer_dma += offset;
 282         }
 283
 284         /* For inbound transfers use guard byte so that test fails if
 285                 data not correctly copied */
 286         memset(urb->transfer_buffer,
 287                         usb_pipein(urb->pipe) ? GUARD_BYTE : 0,
 288                         bytes);
 289         return urb;
 290 }
 291
 292 static struct urb *simple_alloc_urb(
 293         struct usb_device       *udev,
 294         int                     pipe,
 295         unsigned long           bytes,
 296         u8                      bInterval)
 297 {
 298         return usbtest_alloc_urb(udev, pipe, bytes, URB_NO_TRANSFER_DMA_MAP, 0,
 299                         bInterval);
 300 }
 301
 302 static unsigned pattern;
 303 static unsigned mod_pattern;
 304 module_param_named(pattern, mod_pattern, uint, S_IRUGO | S_IWUSR);
 305 MODULE_PARM_DESC(mod_pattern, "i/o pattern (0 == zeroes)");
 306
 307 static inline void simple_fill_buf(struct urb *urb)
 308 {
 309         unsigned        i;
 310         u8              *buf = urb->transfer_buffer;
 311         unsigned        len = urb->transfer_buffer_length;
 312
 313         switch (pattern) {
 314         default:
 315                 /* FALLTHROUGH */
 316         case 0:
 317                 memset(buf, 0, len);
 318                 break;
 319         case 1:                 /* mod63 */
 320                 for (i = 0; i < len; i++)
 321                         *buf++ = (u8) (i % 63);
 322                 break;
 323         }
 324 }
 325
 326 static inline unsigned long buffer_offset(void *buf)
 327 {
 328         return (unsigned long)buf & (ARCH_KMALLOC_MINALIGN - 1);
 329 }
 330
 331 static int check_guard_bytes(struct usbtest_dev *tdev, struct urb *urb)
 332 {
 333         u8 *buf = urb->transfer_buffer;
 334         u8 *guard = buf - buffer_offset(buf);
 335         unsigned i;
 336
 337         for (i = 0; guard < buf; i++, guard++) {
 338                 if (*guard != GUARD_BYTE) {
 339                         ERROR(tdev, "guard byte[%d] %d (not %d)\n",
 340                                 i, *guard, GUARD_BYTE);
 341                         return -EINVAL;
 342                 }
 343         }
 344         return 0;
 345 }
 346
 347 static int simple_check_buf(struct usbtest_dev *tdev, struct urb *urb)
 348 {
 349         unsigned        i;
 350         u8              expected;
 351         u8              *buf = urb->transfer_buffer;
 352         unsigned        len = urb->actual_length;
 353
 354         int ret = check_guard_bytes(tdev, urb);
 355         if (ret)
 356                 return ret;
 357
 358         for (i = 0; i < len; i++, buf++) {
 359                 switch (pattern) {
 360                 /* all-zeroes has no synchronization issues */
 361                 case 0:
 362                         expected = 0;
 363                         break;
 364                 /* mod63 stays in sync with short-terminated transfers,
 365                  * or otherwise when host and gadget agree on how large
 366                  * each usb transfer request should be.  resync is done
 367                  * with set_interface or set_config.
 368                  */
 369                 case 1:                 /* mod63 */
 370                         expected = i % 63;
 371                         break;
 372                 /* always fail unsupported patterns */
 373                 default:
 374                         expected = !*buf;
 375                         break;
 376                 }
 377                 if (*buf == expected)
 378                         continue;
 379                 ERROR(tdev, "buf[%d] = %d (not %d)\n", i, *buf, expected);
 380                 return -EINVAL;
 381         }
 382         return 0;
 383 }
 384
 385 static void simple_free_urb(struct urb *urb)
 386 {
 387         unsigned long offset = buffer_offset(urb->transfer_buffer);
 388
 389         if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 390                 usb_free_coherent(
 391                         urb->dev,
 392                         urb->transfer_buffer_length + offset,
 393                         urb->transfer_buffer - offset,
 394                         urb->transfer_dma - offset);
 395         else
 396                 kfree(urb->transfer_buffer - offset);
 397         usb_free_urb(urb);
 398 }
 399
 400 static int simple_io(
 401         struct usbtest_dev      *tdev,
 402         struct urb              *urb,
 403         int                     iterations,
 404         int                     vary,
 405         int                     expected,
 406         const char              *label
 407 )
 408 {
 409         struct usb_device       *udev = urb->dev;
 410         int                     max = urb->transfer_buffer_length;
 411         struct completion       completion;
 412         int                     retval = 0;
 413         unsigned long           expire;
 414
 415         urb->context = &completion;
 416         while (retval == 0 && iterations-- > 0) {
 417                 init_completion(&completion);
 418                 if (usb_pipeout(urb->pipe)) {
 419                         simple_fill_buf(urb);
 420                         urb->transfer_flags |= URB_ZERO_PACKET;
 421                 }
 422                 retval = usb_submit_urb(urb, GFP_KERNEL);
 423                 if (retval != 0)
 424                         break;
 425
 426                 expire = msecs_to_jiffies(SIMPLE_IO_TIMEOUT);
 427                 if (!wait_for_completion_timeout(&completion, expire)) {
 428                         usb_kill_urb(urb);
 429                         retval = (urb->status == -ENOENT ?
 430                                   -ETIMEDOUT : urb->status);
 431                 } else {
 432                         retval = urb->status;
 433                 }
 434
 435                 urb->dev = udev;
 436                 if (retval == 0 && usb_pipein(urb->pipe))
 437                         retval = simple_check_buf(tdev, urb);
 438
 439                 if (vary) {
 440                         int     len = urb->transfer_buffer_length;
 441
 442                         len += vary;
 443                         len %= max;
 444                         if (len == 0)
 445                                 len = (vary < max) ? vary : max;
 446                         urb->transfer_buffer_length = len;
 447                 }
 448
 449                 /* FIXME if endpoint halted, clear halt (and log) */
 450         }
 451         urb->transfer_buffer_length = max;
 452
 453         if (expected != retval)
 454                 dev_err(&udev->dev,
 455                         "%s failed, iterations left %d, status %d (not %d)\n",
 456                                 label, iterations, retval, expected);
 457         return retval;
 458 }
 459
 460
 461 /*-------------------------------------------------------------------------*/
 462
 463 /* We use scatterlist primitives to test queued I/O.
 464  * Yes, this also tests the scatterlist primitives.
 465  */
 466
 467 static void free_sglist(struct scatterlist *sg, int nents)
 468 {
 469         unsigned                i;
 470
 471         if (!sg)
 472                 return;
 473         for (i = 0; i < nents; i++) {
 474                 if (!sg_page(&sg[i]))
 475                         continue;
 476                 kfree(sg_virt(&sg[i]));
 477         }
 478         kfree(sg);
 479 }
 480
 481 static struct scatterlist *
 482 alloc_sglist(int nents, int max, int vary)
 483 {
 484         struct scatterlist      *sg;
 485         unsigned                i;
 486         unsigned                size = max;
 487
 488         if (max == 0)
 489                 return NULL;
 490
 491         sg = kmalloc_array(nents, sizeof(*sg), GFP_KERNEL);
 492         if (!sg)
 493                 return NULL;
 494         sg_init_table(sg, nents);
 495
 496         for (i = 0; i < nents; i++) {
 497                 char            *buf;
 498                 unsigned        j;
 499
 500                 buf = kzalloc(size, GFP_KERNEL);
 501                 if (!buf) {
 502                         free_sglist(sg, i);
 503                         return NULL;
 504                 }
 505
 506                 /* kmalloc pages are always physically contiguous! */
 507                 sg_set_buf(&sg[i], buf, size);
 508
 509                 switch (pattern) {
 510                 case 0:
 511                         /* already zeroed */
 512                         break;
 513                 case 1:
 514                         for (j = 0; j < size; j++)
 515                                 *buf++ = (u8) (j % 63);
 516                         break;
 517                 }
 518
 519                 if (vary) {
 520                         size += vary;
 521                         size %= max;
 522                         if (size == 0)
 523                                 size = (vary < max) ? vary : max;
 524                 }
 525         }
 526
 527         return sg;
 528 }
 529
 530 static void sg_timeout(unsigned long _req)
 531 {
 532         struct usb_sg_request   *req = (struct usb_sg_request *) _req;
 533
 534         req->status = -ETIMEDOUT;
 535         usb_sg_cancel(req);
 536 }
 537
 538 static int perform_sglist(
 539         struct usbtest_dev      *tdev,
 540         unsigned                iterations,
 541         int                     pipe,
 542         struct usb_sg_request   *req,
 543         struct scatterlist      *sg,
 544         int                     nents
 545 )
 546 {
 547         struct usb_device       *udev = testdev_to_usbdev(tdev);
 548         int                     retval = 0;
 549         struct timer_list       sg_timer;
 550
 551         setup_timer_on_stack(&sg_timer, sg_timeout, (unsigned long) req);
 552
 553         while (retval == 0 && iterations-- > 0) {
 554                 retval = usb_sg_init(req, udev, pipe,
 555                                 (udev->speed == USB_SPEED_HIGH)
 556                                         ? (INTERRUPT_RATE << 3)
 557                                         : INTERRUPT_RATE,
 558                                 sg, nents, 0, GFP_KERNEL);
 559
 560                 if (retval)
 561                         break;
 562                 mod_timer(&sg_timer, jiffies +
 563                                 msecs_to_jiffies(SIMPLE_IO_TIMEOUT));
 564                 usb_sg_wait(req);
 565                 del_timer_sync(&sg_timer);
 566                 retval = req->status;
 567
 568                 /* FIXME check resulting data pattern */
 569
 570                 /* FIXME if endpoint halted, clear halt (and log) */
 571         }
 572
 573         /* FIXME for unlink or fault handling tests, don't report
 574          * failure if retval is as we expected ...
 575          */
 576         if (retval)
 577                 ERROR(tdev, "perform_sglist failed, "
 578                                 "iterations left %d, status %d\n",
 579                                 iterations, retval);
 580         return retval;
 581 }
 582
 583
 584 /*-------------------------------------------------------------------------*/
 585
 586 /* unqueued control message testing
 587  *
 588  * there's a nice set of device functional requirements in chapter 9 of the
 589  * usb 2.0 spec, which we can apply to ANY device, even ones that don't use
 590  * special test firmware.
 591  *
 592  * we know the device is configured (or suspended) by the time it's visible
 593  * through usbfs.  we can't change that, so we won't test enumeration (which
 594  * worked 'well enough' to get here, this time), power management (ditto),
 595  * or remote wakeup (which needs human interaction).
 596  */
 597
 598 static unsigned realworld = 1;
 599 module_param(realworld, uint, 0);
 600 MODULE_PARM_DESC(realworld, "clear to demand stricter spec compliance");
 601
 602 static int get_altsetting(struct usbtest_dev *dev)
 603 {
 604         struct usb_interface    *iface = dev->intf;
 605         struct usb_device       *udev = interface_to_usbdev(iface);
 606         int                     retval;
 607
 608         retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 609                         USB_REQ_GET_INTERFACE, USB_DIR_IN|USB_RECIP_INTERFACE,
 610                         0, iface->altsetting[0].desc.bInterfaceNumber,
 611                         dev->buf, 1, USB_CTRL_GET_TIMEOUT);
 612         switch (retval) {
 613         case 1:
 614                 return dev->buf[0];
 615         case 0:
 616                 retval = -ERANGE;
 617                 /* FALLTHROUGH */
 618         default:
 619                 return retval;
 620         }
 621 }
 622
 623 static int set_altsetting(struct usbtest_dev *dev, int alternate)
 624 {
 625         struct usb_interface            *iface = dev->intf;
 626         struct usb_device               *udev;
 627
 628         if (alternate < 0 || alternate >= 256)
 629                 return -EINVAL;
 630
 631         udev = interface_to_usbdev(iface);
 632         return usb_set_interface(udev,
 633                         iface->altsetting[0].desc.bInterfaceNumber,
 634                         alternate);
 635 }
 636
 637 static int is_good_config(struct usbtest_dev *tdev, int len)
 638 {
 639         struct usb_config_descriptor    *config;
 640
 641         if (len < sizeof(*config))
 642                 return 0;
 643         config = (struct usb_config_descriptor *) tdev->buf;
 644
 645         switch (config->bDescriptorType) {
 646         case USB_DT_CONFIG:
 647         case USB_DT_OTHER_SPEED_CONFIG:
 648                 if (config->bLength != 9) {
 649                         ERROR(tdev, "bogus config descriptor length\n");
 650                         return 0;
 651                 }
 652                 /* this bit 'must be 1' but often isn't */
 653                 if (!realworld && !(config->bmAttributes & 0x80)) {
 654                         ERROR(tdev, "high bit of config attributes not set\n");
 655                         return 0;
 656                 }
 657                 if (config->bmAttributes & 0x1f) {      /* reserved == 0 */
 658                         ERROR(tdev, "reserved config bits set\n");
 659                         return 0;
 660                 }
 661                 break;
 662         default:
 663                 return 0;
 664         }
 665
 666         if (le16_to_cpu(config->wTotalLength) == len)   /* read it all */
 667                 return 1;
 668         if (le16_to_cpu(config->wTotalLength) >= TBUF_SIZE)     /* max partial read */
 669                 return 1;
 670         ERROR(tdev, "bogus config descriptor read size\n");
 671         return 0;
 672 }
 673
 674 static int is_good_ext(struct usbtest_dev *tdev, u8 *buf)
 675 {
 676         struct usb_ext_cap_descriptor *ext;
 677         u32 attr;
 678
 679         ext = (struct usb_ext_cap_descriptor *) buf;
 680
 681         if (ext->bLength != USB_DT_USB_EXT_CAP_SIZE) {
 682                 ERROR(tdev, "bogus usb 2.0 extension descriptor length\n");
 683                 return 0;
 684         }
 685
 686         attr = le32_to_cpu(ext->bmAttributes);
 687         /* bits[1:15] is used and others are reserved */
 688         if (attr & ~0xfffe) {   /* reserved == 0 */
 689                 ERROR(tdev, "reserved bits set\n");
 690                 return 0;
 691         }
 692
 693         return 1;
 694 }
 695
 696 static int is_good_ss_cap(struct usbtest_dev *tdev, u8 *buf)
 697 {
 698         struct usb_ss_cap_descriptor *ss;
 699
 700         ss = (struct usb_ss_cap_descriptor *) buf;
 701
 702         if (ss->bLength != USB_DT_USB_SS_CAP_SIZE) {
 703                 ERROR(tdev, "bogus superspeed device capability descriptor length\n");
 704                 return 0;
 705         }
 706
 707         /*
 708          * only bit[1] of bmAttributes is used for LTM and others are
 709          * reserved
 710          */
 711         if (ss->bmAttributes & ~0x02) { /* reserved == 0 */
 712                 ERROR(tdev, "reserved bits set in bmAttributes\n");
 713                 return 0;
 714         }
 715
 716         /* bits[0:3] of wSpeedSupported is used and others are reserved */
 717         if (le16_to_cpu(ss->wSpeedSupported) & ~0x0f) { /* reserved == 0 */
 718                 ERROR(tdev, "reserved bits set in wSpeedSupported\n");
 719                 return 0;
 720         }
 721
 722         return 1;
 723 }
 724
 725 static int is_good_con_id(struct usbtest_dev *tdev, u8 *buf)
 726 {
 727         struct usb_ss_container_id_descriptor *con_id;
 728
 729         con_id = (struct usb_ss_container_id_descriptor *) buf;
 730
 731         if (con_id->bLength != USB_DT_USB_SS_CONTN_ID_SIZE) {
 732                 ERROR(tdev, "bogus container id descriptor length\n");
 733                 return 0;
 734         }
 735
 736         if (con_id->bReserved) {        /* reserved == 0 */
 737                 ERROR(tdev, "reserved bits set\n");
 738                 return 0;
 739         }
 740
 741         return 1;
 742 }
 743
 744 /* sanity test for standard requests working with usb_control_mesg() and some
 745  * of the utility functions which use it.
 746  *
 747  * this doesn't test how endpoint halts behave or data toggles get set, since
 748  * we won't do I/O to bulk/interrupt endpoints here (which is how to change
 749  * halt or toggle).  toggle testing is impractical without support from hcds.
 750  *
 751  * this avoids failing devices linux would normally work with, by not testing
 752  * config/altsetting operations for devices that only support their defaults.
 753  * such devices rarely support those needless operations.
 754  *
 755  * NOTE that since this is a sanity test, it's not examining boundary cases
 756  * to see if usbcore, hcd, and device all behave right.  such testing would
 757  * involve varied read sizes and other operation sequences.
 758  */
 759 static int ch9_postconfig(struct usbtest_dev *dev)
 760 {
 761         struct usb_interface    *iface = dev->intf;
 762         struct usb_device       *udev = interface_to_usbdev(iface);
 763         int                     i, alt, retval;
 764
 765         /* [9.2.3] if there's more than one altsetting, we need to be able to
 766          * set and get each one.  mostly trusts the descriptors from usbcore.
 767          */
 768         for (i = 0; i < iface->num_altsetting; i++) {
 769
 770                 /* 9.2.3 constrains the range here */
 771                 alt = iface->altsetting[i].desc.bAlternateSetting;
 772                 if (alt < 0 || alt >= iface->num_altsetting) {
 773                         dev_err(&iface->dev,
 774                                         "invalid alt [%d].bAltSetting = %d\n",
 775                                         i, alt);
 776                 }
 777
 778                 /* [real world] get/set unimplemented if there's only one */
 779                 if (realworld && iface->num_altsetting == 1)
 780                         continue;
 781
 782                 /* [9.4.10] set_interface */
 783                 retval = set_altsetting(dev, alt);
 784                 if (retval) {
 785                         dev_err(&iface->dev, "can't set_interface = %d, %d\n",
 786                                         alt, retval);
 787                         return retval;
 788                 }
 789
 790                 /* [9.4.4] get_interface always works */
 791                 retval = get_altsetting(dev);
 792                 if (retval != alt) {
 793                         dev_err(&iface->dev, "get alt should be %d, was %d\n",
 794                                         alt, retval);
 795                         return (retval < 0) ? retval : -EDOM;
 796                 }
 797
 798         }
 799
 800         /* [real world] get_config unimplemented if there's only one */
 801         if (!realworld || udev->descriptor.bNumConfigurations != 1) {
 802                 int     expected = udev->actconfig->desc.bConfigurationValue;
 803
 804                 /* [9.4.2] get_configuration always works
 805                  * ... although some cheap devices (like one TI Hub I've got)
 806                  * won't return config descriptors except before set_config.
 807                  */
 808                 retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 809                                 USB_REQ_GET_CONFIGURATION,
 810                                 USB_DIR_IN | USB_RECIP_DEVICE,
 811                                 0, 0, dev->buf, 1, USB_CTRL_GET_TIMEOUT);
 812                 if (retval != 1 || dev->buf[0] != expected) {
 813                         dev_err(&iface->dev, "get config --> %d %d (1 %d)\n",
 814                                 retval, dev->buf[0], expected);
 815                         return (retval < 0) ? retval : -EDOM;
 816                 }
 817         }
 818
 819         /* there's always [9.4.3] a device descriptor [9.6.1] */
 820         retval = usb_get_descriptor(udev, USB_DT_DEVICE, 0,
 821                         dev->buf, sizeof(udev->descriptor));
 822         if (retval != sizeof(udev->descriptor)) {
 823                 dev_err(&iface->dev, "dev descriptor --> %d\n", retval);
 824                 return (retval < 0) ? retval : -EDOM;
 825         }
 826
 827         /*
 828          * there's always [9.4.3] a bos device descriptor [9.6.2] in USB
 829          * 3.0 spec
 830          */
 831         if (le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0210) {
 832                 struct usb_bos_descriptor *bos = NULL;
 833                 struct usb_dev_cap_header *header = NULL;
 834                 unsigned total, num, length;
 835                 u8 *buf;
 836
 837                 retval = usb_get_descriptor(udev, USB_DT_BOS, 0, dev->buf,
 838                                 sizeof(*udev->bos->desc));
 839                 if (retval != sizeof(*udev->bos->desc)) {
 840                         dev_err(&iface->dev, "bos descriptor --> %d\n", retval);
 841                         return (retval < 0) ? retval : -EDOM;
 842                 }
 843
 844                 bos = (struct usb_bos_descriptor *)dev->buf;
 845                 total = le16_to_cpu(bos->wTotalLength);
 846                 num = bos->bNumDeviceCaps;
 847
 848                 if (total > TBUF_SIZE)
 849                         total = TBUF_SIZE;
 850
 851                 /*
 852                  * get generic device-level capability descriptors [9.6.2]
 853                  * in USB 3.0 spec
 854                  */
 855                 retval = usb_get_descriptor(udev, USB_DT_BOS, 0, dev->buf,
 856                                 total);
 857                 if (retval != total) {
 858                         dev_err(&iface->dev, "bos descriptor set --> %d\n",
 859                                         retval);
 860                         return (retval < 0) ? retval : -EDOM;
 861                 }
 862
 863                 length = sizeof(*udev->bos->desc);
 864                 buf = dev->buf;
 865                 for (i = 0; i < num; i++) {
 866                         buf += length;
 867                         if (buf + sizeof(struct usb_dev_cap_header) >
 868                                         dev->buf + total)
 869                                 break;
 870
 871                         header = (struct usb_dev_cap_header *)buf;
 872                         length = header->bLength;
 873
 874                         if (header->bDescriptorType !=
 875                                         USB_DT_DEVICE_CAPABILITY) {
 876                                 dev_warn(&udev->dev, "not device capability descriptor, skip\n");
 877                                 continue;
 878                         }
 879
 880                         switch (header->bDevCapabilityType) {
 881                         case USB_CAP_TYPE_EXT:
 882                                 if (buf + USB_DT_USB_EXT_CAP_SIZE >
 883                                                 dev->buf + total ||
 884                                                 !is_good_ext(dev, buf)) {
 885                                         dev_err(&iface->dev, "bogus usb 2.0 extension descriptor\n");
 886                                         return -EDOM;
 887                                 }
 888                                 break;
 889                         case USB_SS_CAP_TYPE:
 890                                 if (buf + USB_DT_USB_SS_CAP_SIZE >
 891                                                 dev->buf + total ||
 892                                                 !is_good_ss_cap(dev, buf)) {
 893                                         dev_err(&iface->dev, "bogus superspeed device capability descriptor\n");
 894                                         return -EDOM;
 895                                 }
 896                                 break;
 897                         case CONTAINER_ID_TYPE:
 898                                 if (buf + USB_DT_USB_SS_CONTN_ID_SIZE >
 899                                                 dev->buf + total ||
 900                                                 !is_good_con_id(dev, buf)) {
 901                                         dev_err(&iface->dev, "bogus container id descriptor\n");
 902                                         return -EDOM;
 903                                 }
 904                                 break;
 905                         default:
 906                                 break;
 907                         }
 908                 }
 909         }
 910
 911         /* there's always [9.4.3] at least one config descriptor [9.6.3] */
 912         for (i = 0; i < udev->descriptor.bNumConfigurations; i++) {
 913                 retval = usb_get_descriptor(udev, USB_DT_CONFIG, i,
 914                                 dev->buf, TBUF_SIZE);
 915                 if (!is_good_config(dev, retval)) {
 916                         dev_err(&iface->dev,
 917                                         "config [%d] descriptor --> %d\n",
 918                                         i, retval);
 919                         return (retval < 0) ? retval : -EDOM;
 920                 }
 921
 922                 /* FIXME cross-checking udev->config[i] to make sure usbcore
 923                  * parsed it right (etc) would be good testing paranoia
 924                  */
 925         }
 926
 927         /* and sometimes [9.2.6.6] speed dependent descriptors */
 928         if (le16_to_cpu(udev->descriptor.bcdUSB) == 0x0200) {
 929                 struct usb_qualifier_descriptor *d = NULL;
 930
 931                 /* device qualifier [9.6.2] */
 932                 retval = usb_get_descriptor(udev,
 933                                 USB_DT_DEVICE_QUALIFIER, 0, dev->buf,
 934                                 sizeof(struct usb_qualifier_descriptor));
 935                 if (retval == -EPIPE) {
 936                         if (udev->speed == USB_SPEED_HIGH) {
 937                                 dev_err(&iface->dev,
 938                                                 "hs dev qualifier --> %d\n",
 939                                                 retval);
 940                                 return (retval < 0) ? retval : -EDOM;
 941                         }
 942                         /* usb2.0 but not high-speed capable; fine */
 943                 } else if (retval != sizeof(struct usb_qualifier_descriptor)) {
 944                         dev_err(&iface->dev, "dev qualifier --> %d\n", retval);
 945                         return (retval < 0) ? retval : -EDOM;
 946                 } else
 947                         d = (struct usb_qualifier_descriptor *) dev->buf;
 948
 949                 /* might not have [9.6.2] any other-speed configs [9.6.4] */
 950                 if (d) {
 951                         unsigned max = d->bNumConfigurations;
 952                         for (i = 0; i < max; i++) {
 953                                 retval = usb_get_descriptor(udev,
 954                                         USB_DT_OTHER_SPEED_CONFIG, i,
 955                                         dev->buf, TBUF_SIZE);
 956                                 if (!is_good_config(dev, retval)) {
 957                                         dev_err(&iface->dev,
 958                                                 "other speed config --> %d\n",
 959                                                 retval);
 960                                         return (retval < 0) ? retval : -EDOM;
 961                                 }
 962                         }
 963                 }
 964         }
 965         /* FIXME fetch strings from at least the device descriptor */
 966
 967         /* [9.4.5] get_status always works */
 968         retval = usb_get_status(udev, USB_RECIP_DEVICE, 0, dev->buf);
 969         if (retval) {
 970                 dev_err(&iface->dev, "get dev status --> %d\n", retval);
 971                 return retval;
 972         }
 973
 974         /* FIXME configuration.bmAttributes says if we could try to set/clear
 975          * the device's remote wakeup feature ... if we can, test that here
 976          */
 977
 978         retval = usb_get_status(udev, USB_RECIP_INTERFACE,
 979                         iface->altsetting[0].desc.bInterfaceNumber, dev->buf);
 980         if (retval) {
 981                 dev_err(&iface->dev, "get interface status --> %d\n", retval);
 982                 return retval;
 983         }
 984         /* FIXME get status for each endpoint in the interface */
 985
 986         return 0;
 987 }
 988
 989 /*-------------------------------------------------------------------------*/
 990
 991 /* use ch9 requests to test whether:
 992  *   (a) queues work for control, keeping N subtests queued and
 993  *       active (auto-resubmit) for M loops through the queue.
 994  *   (b) protocol stalls (control-only) will autorecover.
 995  *       it's not like bulk/intr; no halt clearing.
 996  *   (c) short control reads are reported and handled.
 997  *   (d) queues are always processed in-order
 998  */
 999
1000 struct ctrl_ctx {
1001         spinlock_t              lock;
1002         struct usbtest_dev      *dev;
1003         struct completion       complete;
1004         unsigned                count;
1005         unsigned                pending;
1006         int                     status;
1007         struct urb              **urb;
1008         struct usbtest_param    *param;
1009         int                     last;
1010 };
1011
1012 #define NUM_SUBCASES    16              /* how many test subcases here? */
1013
1014 struct subcase {
1015         struct usb_ctrlrequest  setup;
1016         int                     number;
1017         int                     expected;
1018 };
1019
1020 static void ctrl_complete(struct urb *urb)
1021 {
1022         struct ctrl_ctx         *ctx = urb->context;
1023         struct usb_ctrlrequest  *reqp;
1024         struct subcase          *subcase;
1025         int                     status = urb->status;
1026
1027         reqp = (struct usb_ctrlrequest *)urb->setup_packet;
1028         subcase = container_of(reqp, struct subcase, setup);
1029
1030         spin_lock(&ctx->lock);
1031         ctx->count--;
1032         ctx->pending--;
1033
1034         /* queue must transfer and complete in fifo order, unless
1035          * usb_unlink_urb() is used to unlink something not at the
1036          * physical queue head (not tested).
1037          */
1038         if (subcase->number > 0) {
1039                 if ((subcase->number - ctx->last) != 1) {
1040                         ERROR(ctx->dev,
1041                                 "subcase %d completed out of order, last %d\n",
1042                                 subcase->number, ctx->last);
1043                         status = -EDOM;
1044                         ctx->last = subcase->number;
1045                         goto error;
1046                 }
1047         }
1048         ctx->last = subcase->number;
1049
1050         /* succeed or fault in only one way? */
1051         if (status == subcase->expected)
1052                 status = 0;
1053
1054         /* async unlink for cleanup? */
1055         else if (status != -ECONNRESET) {
1056
1057                 /* some faults are allowed, not required */
1058                 if (subcase->expected > 0 && (
1059                           ((status == -subcase->expected        /* happened */
1060                            || status == 0))))                   /* didn't */
1061                         status = 0;
1062                 /* sometimes more than one fault is allowed */
1063                 else if (subcase->number == 12 && status == -EPIPE)
1064                         status = 0;
1065                 else
1066                         ERROR(ctx->dev, "subtest %d error, status %d\n",
1067                                         subcase->number, status);
1068         }
1069
1070         /* unexpected status codes mean errors; ideally, in hardware */
1071         if (status) {
1072 error:
1073                 if (ctx->status == 0) {
1074                         int             i;
1075
1076                         ctx->status = status;
1077                         ERROR(ctx->dev, "control queue %02x.%02x, err %d, "
1078                                         "%d left, subcase %d, len %d/%d\n",
1079                                         reqp->bRequestType, reqp->bRequest,
1080                                         status, ctx->count, subcase->number,
1081                                         urb->actual_length,
1082                                         urb->transfer_buffer_length);
1083
1084                         /* FIXME this "unlink everything" exit route should
1085                          * be a separate test case.
1086                          */
1087
1088                         /* unlink whatever's still pending */
1089                         for (i = 1; i < ctx->param->sglen; i++) {
1090                                 struct urb *u = ctx->urb[
1091                                                         (i + subcase->number)
1092                                                         % ctx->param->sglen];
1093
1094                                 if (u == urb || !u->dev)
1095                                         continue;
1096                                 spin_unlock(&ctx->lock);
1097                                 status = usb_unlink_urb(u);
1098                                 spin_lock(&ctx->lock);
1099                                 switch (status) {
1100                                 case -EINPROGRESS:
1101                                 case -EBUSY:
1102                                 case -EIDRM:
1103                                         continue;
1104                                 default:
1105                                         ERROR(ctx->dev, "urb unlink --> %d\n",
1106                                                         status);
1107                                 }
1108                         }
1109                         status = ctx->status;
1110                 }
1111         }
1112
1113         /* resubmit if we need to, else mark this as done */
1114         if ((status == 0) && (ctx->pending < ctx->count)) {
1115                 status = usb_submit_urb(urb, GFP_ATOMIC);
1116                 if (status != 0) {
1117                         ERROR(ctx->dev,
1118                                 "can't resubmit ctrl %02x.%02x, err %d\n",
1119                                 reqp->bRequestType, reqp->bRequest, status);
1120                         urb->dev = NULL;
1121                 } else
1122                         ctx->pending++;
1123         } else
1124                 urb->dev = NULL;
1125
1126         /* signal completion when nothing's queued */
1127         if (ctx->pending == 0)
1128                 complete(&ctx->complete);
1129         spin_unlock(&ctx->lock);
1130 }
1131
1132 static int
1133 test_ctrl_queue(struct usbtest_dev *dev, struct usbtest_param *param)
1134 {
1135         struct usb_device       *udev = testdev_to_usbdev(dev);
1136         struct urb              **urb;
1137         struct ctrl_ctx         context;
1138         int                     i;
1139
1140         if (param->sglen == 0 || param->iterations > UINT_MAX / param->sglen)
1141                 return -EOPNOTSUPP;
1142
1143         spin_lock_init(&context.lock);
1144         context.dev = dev;
1145         init_completion(&context.complete);
1146         context.count = param->sglen * param->iterations;
1147         context.pending = 0;
1148         context.status = -ENOMEM;
1149         context.param = param;
1150         context.last = -1;
1151
1152         /* allocate and init the urbs we'll queue.
1153          * as with bulk/intr sglists, sglen is the queue depth; it also
1154          * controls which subtests run (more tests than sglen) or rerun.
1155          */
1156         urb = kcalloc(param->sglen, sizeof(struct urb *), GFP_KERNEL);
1157         if (!urb)
1158                 return -ENOMEM;
1159         for (i = 0; i < param->sglen; i++) {
1160                 int                     pipe = usb_rcvctrlpipe(udev, 0);
1161                 unsigned                len;
1162                 struct urb              *u;
1163                 struct usb_ctrlrequest  req;
1164                 struct subcase          *reqp;
1165
1166                 /* sign of this variable means:
1167                  *  -: tested code must return this (negative) error code
1168                  *  +: tested code may return this (negative too) error code
1169                  */
1170                 int                     expected = 0;
1171
1172                 /* requests here are mostly expected to succeed on any
1173                  * device, but some are chosen to trigger protocol stalls
1174                  * or short reads.
1175                  */
1176                 memset(&req, 0, sizeof(req));
1177                 req.bRequest = USB_REQ_GET_DESCRIPTOR;
1178                 req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
1179
1180                 switch (i % NUM_SUBCASES) {
1181                 case 0:         /* get device descriptor */
1182                         req.wValue = cpu_to_le16(USB_DT_DEVICE << 8);
1183                         len = sizeof(struct usb_device_descriptor);
1184                         break;
1185                 case 1:         /* get first config descriptor (only) */
1186                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1187                         len = sizeof(struct usb_config_descriptor);
1188                         break;
1189                 case 2:         /* get altsetting (OFTEN STALLS) */
1190                         req.bRequest = USB_REQ_GET_INTERFACE;
1191                         req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
1192                         /* index = 0 means first interface */
1193                         len = 1;
1194                         expected = EPIPE;
1195                         break;
1196                 case 3:         /* get interface status */
1197                         req.bRequest = USB_REQ_GET_STATUS;
1198                         req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
1199                         /* interface 0 */
1200                         len = 2;
1201                         break;
1202                 case 4:         /* get device status */
1203                         req.bRequest = USB_REQ_GET_STATUS;
1204                         req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
1205                         len = 2;
1206                         break;
1207                 case 5:         /* get device qualifier (MAY STALL) */
1208                         req.wValue = cpu_to_le16 (USB_DT_DEVICE_QUALIFIER << 8);
1209                         len = sizeof(struct usb_qualifier_descriptor);
1210                         if (udev->speed != USB_SPEED_HIGH)
1211                                 expected = EPIPE;
1212                         break;
1213                 case 6:         /* get first config descriptor, plus interface */
1214                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1215                         len = sizeof(struct usb_config_descriptor);
1216                         len += sizeof(struct usb_interface_descriptor);
1217                         break;
1218                 case 7:         /* get interface descriptor (ALWAYS STALLS) */
1219                         req.wValue = cpu_to_le16 (USB_DT_INTERFACE << 8);
1220                         /* interface == 0 */
1221                         len = sizeof(struct usb_interface_descriptor);
1222                         expected = -EPIPE;
1223                         break;
1224                 /* NOTE: two consecutive stalls in the queue here.
1225                  *  that tests fault recovery a bit more aggressively. */
1226                 case 8:         /* clear endpoint halt (MAY STALL) */
1227                         req.bRequest = USB_REQ_CLEAR_FEATURE;
1228                         req.bRequestType = USB_RECIP_ENDPOINT;
1229                         /* wValue 0 == ep halt */
1230                         /* wIndex 0 == ep0 (shouldn't halt!) */
1231                         len = 0;
1232                         pipe = usb_sndctrlpipe(udev, 0);
1233                         expected = EPIPE;
1234                         break;
1235                 case 9:         /* get endpoint status */
1236                         req.bRequest = USB_REQ_GET_STATUS;
1237                         req.bRequestType = USB_DIR_IN|USB_RECIP_ENDPOINT;
1238                         /* endpoint 0 */
1239                         len = 2;
1240                         break;
1241                 case 10:        /* trigger short read (EREMOTEIO) */
1242                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1243                         len = 1024;
1244                         expected = -EREMOTEIO;
1245                         break;
1246                 /* NOTE: two consecutive _different_ faults in the queue. */
1247                 case 11:        /* get endpoint descriptor (ALWAYS STALLS) */
1248                         req.wValue = cpu_to_le16(USB_DT_ENDPOINT << 8);
1249                         /* endpoint == 0 */
1250                         len = sizeof(struct usb_interface_descriptor);
1251                         expected = EPIPE;
1252                         break;
1253                 /* NOTE: sometimes even a third fault in the queue! */
1254                 case 12:        /* get string 0 descriptor (MAY STALL) */
1255                         req.wValue = cpu_to_le16(USB_DT_STRING << 8);
1256                         /* string == 0, for language IDs */
1257                         len = sizeof(struct usb_interface_descriptor);
1258                         /* may succeed when > 4 languages */
1259                         expected = EREMOTEIO;   /* or EPIPE, if no strings */
1260                         break;
1261                 case 13:        /* short read, resembling case 10 */
1262                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1263                         /* last data packet "should" be DATA1, not DATA0 */
1264                         if (udev->speed == USB_SPEED_SUPER)
1265                                 len = 1024 - 512;
1266                         else
1267                                 len = 1024 - udev->descriptor.bMaxPacketSize0;
1268                         expected = -EREMOTEIO;
1269                         break;
1270                 case 14:        /* short read; try to fill the last packet */
1271                         req.wValue = cpu_to_le16((USB_DT_DEVICE << 8) | 0);
1272                         /* device descriptor size == 18 bytes */
1273                         len = udev->descriptor.bMaxPacketSize0;
1274                         if (udev->speed == USB_SPEED_SUPER)
1275                                 len = 512;
1276                         switch (len) {
1277                         case 8:
1278                                 len = 24;
1279                                 break;
1280                         case 16:
1281                                 len = 32;
1282                                 break;
1283                         }
1284                         expected = -EREMOTEIO;
1285                         break;
1286                 case 15:
1287                         req.wValue = cpu_to_le16(USB_DT_BOS << 8);
1288                         if (udev->bos)
1289                                 len = le16_to_cpu(udev->bos->desc->wTotalLength);
1290                         else
1291                                 len = sizeof(struct usb_bos_descriptor);
1292                         if (le16_to_cpu(udev->descriptor.bcdUSB) < 0x0201)
1293                                 expected = -EPIPE;
1294                         break;
1295                 default:
1296                         ERROR(dev, "bogus number of ctrl queue testcases!\n");
1297                         context.status = -EINVAL;
1298                         goto cleanup;
1299                 }
1300                 req.wLength = cpu_to_le16(len);
1301                 urb[i] = u = simple_alloc_urb(udev, pipe, len, 0);
1302                 if (!u)
1303                         goto cleanup;
1304
1305                 reqp = kmalloc(sizeof(*reqp), GFP_KERNEL);
1306                 if (!reqp)
1307                         goto cleanup;
1308                 reqp->setup = req;
1309                 reqp->number = i % NUM_SUBCASES;
1310                 reqp->expected = expected;
1311                 u->setup_packet = (char *) &reqp->setup;
1312
1313                 u->context = &context;
1314                 u->complete = ctrl_complete;
1315         }
1316
1317         /* queue the urbs */
1318         context.urb = urb;
1319         spin_lock_irq(&context.lock);
1320         for (i = 0; i < param->sglen; i++) {
1321                 context.status = usb_submit_urb(urb[i], GFP_ATOMIC);
1322                 if (context.status != 0) {
1323                         ERROR(dev, "can't submit urb[%d], status %d\n",
1324                                         i, context.status);
1325                         context.count = context.pending;
1326                         break;
1327                 }
1328                 context.pending++;
1329         }
1330         spin_unlock_irq(&context.lock);
1331
1332         /* FIXME  set timer and time out; provide a disconnect hook */
1333
1334         /* wait for the last one to complete */
1335         if (context.pending > 0)
1336                 wait_for_completion(&context.complete);
1337
1338 cleanup:
1339         for (i = 0; i < param->sglen; i++) {
1340                 if (!urb[i])
1341                         continue;
1342                 urb[i]->dev = udev;
1343                 kfree(urb[i]->setup_packet);
1344                 simple_free_urb(urb[i]);
1345         }
1346         kfree(urb);
1347         return context.status;
1348 }
1349 #undef NUM_SUBCASES
1350
1351
1352 /*-------------------------------------------------------------------------*/
1353
1354 static void unlink1_callback(struct urb *urb)
1355 {
1356         int     status = urb->status;
1357
1358         /* we "know" -EPIPE (stall) never happens */
1359         if (!status)
1360                 status = usb_submit_urb(urb, GFP_ATOMIC);
1361         if (status) {
1362                 urb->status = status;
1363                 complete(urb->context);
1364         }
1365 }
1366
1367 static int unlink1(struct usbtest_dev *dev, int pipe, int size, int async)
1368 {
1369         struct urb              *urb;
1370         struct completion       completion;
1371         int                     retval = 0;
1372
1373         init_completion(&completion);
1374         urb = simple_alloc_urb(testdev_to_usbdev(dev), pipe, size, 0);
1375         if (!urb)
1376                 return -ENOMEM;
1377         urb->context = &completion;
1378         urb->complete = unlink1_callback;
1379
1380         if (usb_pipeout(urb->pipe)) {
1381                 simple_fill_buf(urb);
1382                 urb->transfer_flags |= URB_ZERO_PACKET;
1383         }
1384
1385         /* keep the endpoint busy.  there are lots of hc/hcd-internal
1386          * states, and testing should get to all of them over time.
1387          *
1388          * FIXME want additional tests for when endpoint is STALLing
1389          * due to errors, or is just NAKing requests.
1390          */
1391         retval = usb_submit_urb(urb, GFP_KERNEL);
1392         if (retval != 0) {
1393                 dev_err(&dev->intf->dev, "submit fail %d\n", retval);
1394                 return retval;
1395         }
1396
1397         /* unlinking that should always work.  variable delay tests more
1398          * hcd states and code paths, even with little other system load.
1399          */
1400         msleep(jiffies % (2 * INTERRUPT_RATE));
1401         if (async) {
1402                 while (!completion_done(&completion)) {
1403                         retval = usb_unlink_urb(urb);
1404
1405                         if (retval == 0 && usb_pipein(urb->pipe))
1406                                 retval = simple_check_buf(dev, urb);
1407
1408                         switch (retval) {
1409                         case -EBUSY:
1410                         case -EIDRM:
1411                                 /* we can't unlink urbs while they're completing
1412                                  * or if they've completed, and we haven't
1413                                  * resubmitted. "normal" drivers would prevent
1414                                  * resubmission, but since we're testing unlink
1415                                  * paths, we can't.
1416                                  */
1417                                 ERROR(dev, "unlink retry\n");
1418                                 continue;
1419                         case 0:
1420                         case -EINPROGRESS:
1421                                 break;
1422
1423                         default:
1424                                 dev_err(&dev->intf->dev,
1425                                         "unlink fail %d\n", retval);
1426                                 return retval;
1427                         }
1428
1429                         break;
1430                 }
1431         } else
1432                 usb_kill_urb(urb);
1433
1434         wait_for_completion(&completion);
1435         retval = urb->status;
1436         simple_free_urb(urb);
1437
1438         if (async)
1439                 return (retval == -ECONNRESET) ? 0 : retval - 1000;
1440         else
1441                 return (retval == -ENOENT || retval == -EPERM) ?
1442                                 0 : retval - 2000;
1443 }
1444
1445 static int unlink_simple(struct usbtest_dev *dev, int pipe, int len)
1446 {
1447         int                     retval = 0;
1448
1449         /* test sync and async paths */
1450         retval = unlink1(dev, pipe, len, 1);
1451         if (!retval)
1452                 retval = unlink1(dev, pipe, len, 0);
1453         return retval;
1454 }
1455
1456 /*-------------------------------------------------------------------------*/
1457
1458 struct queued_ctx {
1459         struct completion       complete;
1460         atomic_t                pending;
1461         unsigned                num;
1462         int                     status;
1463         struct urb              **urbs;
1464 };
1465
1466 static void unlink_queued_callback(struct urb *urb)
1467 {
1468         int                     status = urb->status;
1469         struct queued_ctx       *ctx = urb->context;
1470
1471         if (ctx->status)
1472                 goto done;
1473         if (urb == ctx->urbs[ctx->num - 4] || urb == ctx->urbs[ctx->num - 2]) {
1474                 if (status == -ECONNRESET)
1475                         goto done;
1476                 /* What error should we report if the URB completed normally? */
1477         }
1478         if (status != 0)
1479                 ctx->status = status;
1480
1481  done:
1482         if (atomic_dec_and_test(&ctx->pending))
1483                 complete(&ctx->complete);
1484 }
1485
1486 static int unlink_queued(struct usbtest_dev *dev, int pipe, unsigned num,
1487                 unsigned size)
1488 {
1489         struct queued_ctx       ctx;
1490         struct usb_device       *udev = testdev_to_usbdev(dev);
1491         void                    *buf;
1492         dma_addr_t              buf_dma;
1493         int                     i;
1494         int                     retval = -ENOMEM;
1495
1496         init_completion(&ctx.complete);
1497         atomic_set(&ctx.pending, 1);    /* One more than the actual value */
1498         ctx.num = num;
1499         ctx.status = 0;
1500
1501         buf = usb_alloc_coherent(udev, size, GFP_KERNEL, &buf_dma);
1502         if (!buf)
1503                 return retval;
1504         memset(buf, 0, size);
1505
1506         /* Allocate and init the urbs we'll queue */
1507         ctx.urbs = kcalloc(num, sizeof(struct urb *), GFP_KERNEL);
1508         if (!ctx.urbs)
1509                 goto free_buf;
1510         for (i = 0; i < num; i++) {
1511                 ctx.urbs[i] = usb_alloc_urb(0, GFP_KERNEL);
1512                 if (!ctx.urbs[i])
1513                         goto free_urbs;
1514                 usb_fill_bulk_urb(ctx.urbs[i], udev, pipe, buf, size,
1515                                 unlink_queued_callback, &ctx);
1516                 ctx.urbs[i]->transfer_dma = buf_dma;
1517                 ctx.urbs[i]->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
1518
1519                 if (usb_pipeout(ctx.urbs[i]->pipe)) {
1520                         simple_fill_buf(ctx.urbs[i]);
1521                         ctx.urbs[i]->transfer_flags |= URB_ZERO_PACKET;
1522                 }
1523         }
1524
1525         /* Submit all the URBs and then unlink URBs num - 4 and num - 2. */
1526         for (i = 0; i < num; i++) {
1527                 atomic_inc(&ctx.pending);
1528                 retval = usb_submit_urb(ctx.urbs[i], GFP_KERNEL);
1529                 if (retval != 0) {
1530                         dev_err(&dev->intf->dev, "submit urbs[%d] fail %d\n",
1531                                         i, retval);
1532                         atomic_dec(&ctx.pending);
1533                         ctx.status = retval;
1534                         break;
1535                 }
1536         }
1537         if (i == num) {
1538                 usb_unlink_urb(ctx.urbs[num - 4]);
1539                 usb_unlink_urb(ctx.urbs[num - 2]);
1540         } else {
1541                 while (--i >= 0)
1542                         usb_unlink_urb(ctx.urbs[i]);
1543         }
1544
1545         if (atomic_dec_and_test(&ctx.pending))          /* The extra count */
1546                 complete(&ctx.complete);
1547         wait_for_completion(&ctx.complete);
1548         retval = ctx.status;
1549
1550  free_urbs:
1551         for (i = 0; i < num; i++)
1552                 usb_free_urb(ctx.urbs[i]);
1553         kfree(ctx.urbs);
1554  free_buf:
1555         usb_free_coherent(udev, size, buf, buf_dma);
1556         return retval;
1557 }
1558
1559 /*-------------------------------------------------------------------------*/
1560
1561 static int verify_not_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
1562 {
1563         int     retval;
1564         u16     status;
1565
1566         /* shouldn't look or act halted */
1567         retval = usb_get_status(urb->dev, USB_RECIP_ENDPOINT, ep, &status);
1568         if (retval < 0) {
1569                 ERROR(tdev, "ep %02x couldn't get no-halt status, %d\n",
1570                                 ep, retval);
1571                 return retval;
1572         }
1573         if (status != 0) {
1574                 ERROR(tdev, "ep %02x bogus status: %04x != 0\n", ep, status);
1575                 return -EINVAL;
1576         }
1577         retval = simple_io(tdev, urb, 1, 0, 0, __func__);
1578         if (retval != 0)
1579                 return -EINVAL;
1580         return 0;
1581 }
1582
1583 static int verify_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
1584 {
1585         int     retval;
1586         u16     status;
1587
1588         /* should look and act halted */
1589         retval = usb_get_status(urb->dev, USB_RECIP_ENDPOINT, ep, &status);
1590         if (retval < 0) {
1591                 ERROR(tdev, "ep %02x couldn't get halt status, %d\n",
1592                                 ep, retval);
1593                 return retval;
1594         }
1595         if (status != 1) {
1596                 ERROR(tdev, "ep %02x bogus status: %04x != 1\n", ep, status);
1597                 return -EINVAL;
1598         }
1599         retval = simple_io(tdev, urb, 1, 0, -EPIPE, __func__);
1600         if (retval != -EPIPE)
1601                 return -EINVAL;
1602         retval = simple_io(tdev, urb, 1, 0, -EPIPE, "verify_still_halted");
1603         if (retval != -EPIPE)
1604                 return -EINVAL;
1605         return 0;
1606 }
1607
1608 static int test_halt(struct usbtest_dev *tdev, int ep, struct urb *urb)
1609 {
1610         int     retval;
1611
1612         /* shouldn't look or act halted now */
1613         retval = verify_not_halted(tdev, ep, urb);
1614         if (retval < 0)
1615                 return retval;
1616
1617         /* set halt (protocol test only), verify it worked */
1618         retval = usb_control_msg(urb->dev, usb_sndctrlpipe(urb->dev, 0),
1619                         USB_REQ_SET_FEATURE, USB_RECIP_ENDPOINT,
1620                         USB_ENDPOINT_HALT, ep,
1621                         NULL, 0, USB_CTRL_SET_TIMEOUT);
1622         if (retval < 0) {
1623                 ERROR(tdev, "ep %02x couldn't set halt, %d\n", ep, retval);
1624                 return retval;
1625         }
1626         retval = verify_halted(tdev, ep, urb);
1627         if (retval < 0) {
1628                 int ret;
1629
1630                 /* clear halt anyways, else further tests will fail */
1631                 ret = usb_clear_halt(urb->dev, urb->pipe);
1632                 if (ret)
1633                         ERROR(tdev, "ep %02x couldn't clear halt, %d\n",
1634                               ep, ret);
1635
1636                 return retval;
1637         }
1638
1639         /* clear halt (tests API + protocol), verify it worked */
1640         retval = usb_clear_halt(urb->dev, urb->pipe);
1641         if (retval < 0) {
1642                 ERROR(tdev, "ep %02x couldn't clear halt, %d\n", ep, retval);
1643                 return retval;
1644         }
1645         retval = verify_not_halted(tdev, ep, urb);
1646         if (retval < 0)
1647                 return retval;
1648
1649         /* NOTE:  could also verify SET_INTERFACE clear halts ... */
1650
1651         return 0;
1652 }
1653
1654 static int halt_simple(struct usbtest_dev *dev)
1655 {
1656         int                     ep;
1657         int                     retval = 0;
1658         struct urb              *urb;
1659         struct usb_device       *udev = testdev_to_usbdev(dev);
1660
1661         if (udev->speed == USB_SPEED_SUPER)
1662                 urb = simple_alloc_urb(udev, 0, 1024, 0);
1663         else
1664                 urb = simple_alloc_urb(udev, 0, 512, 0);
1665         if (urb == NULL)
1666                 return -ENOMEM;
1667
1668         if (dev->in_pipe) {
1669                 ep = usb_pipeendpoint(dev->in_pipe) | USB_DIR_IN;
1670                 urb->pipe = dev->in_pipe;
1671                 retval = test_halt(dev, ep, urb);
1672                 if (retval < 0)
1673                         goto done;
1674         }
1675
1676         if (dev->out_pipe) {
1677                 ep = usb_pipeendpoint(dev->out_pipe);
1678                 urb->pipe = dev->out_pipe;
1679                 retval = test_halt(dev, ep, urb);
1680         }
1681 done:
1682         simple_free_urb(urb);
1683         return retval;
1684 }
1685
1686 /*-------------------------------------------------------------------------*/
1687
1688 /* Control OUT tests use the vendor control requests from Intel's
1689  * USB 2.0 compliance test device:  write a buffer, read it back.
1690  *
1691  * Intel's spec only _requires_ that it work for one packet, which
1692  * is pretty weak.   Some HCDs place limits here; most devices will
1693  * need to be able to handle more than one OUT data packet.  We'll
1694  * try whatever we're told to try.
1695  */
1696 static int ctrl_out(struct usbtest_dev *dev,
1697                 unsigned count, unsigned length, unsigned vary, unsigned offset)
1698 {
1699         unsigned                i, j, len;
1700         int                     retval;
1701         u8                      *buf;
1702         char                    *what = "?";
1703         struct usb_device       *udev;
1704
1705         if (length < 1 || length > 0xffff || vary >= length)
1706                 return -EINVAL;
1707
1708         buf = kmalloc(length + offset, GFP_KERNEL);
1709         if (!buf)
1710                 return -ENOMEM;
1711
1712         buf += offset;
1713         udev = testdev_to_usbdev(dev);
1714         len = length;
1715         retval = 0;
1716
1717         /* NOTE:  hardware might well act differently if we pushed it
1718          * with lots back-to-back queued requests.
1719          */
1720         for (i = 0; i < count; i++) {
1721                 /* write patterned data */
1722                 for (j = 0; j < len; j++)
1723                         buf[j] = i + j;
1724                 retval = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
1725                                 0x5b, USB_DIR_OUT|USB_TYPE_VENDOR,
1726                                 0, 0, buf, len, USB_CTRL_SET_TIMEOUT);
1727                 if (retval != len) {
1728                         what = "write";
1729                         if (retval >= 0) {
1730                                 ERROR(dev, "ctrl_out, wlen %d (expected %d)\n",
1731                                                 retval, len);
1732                                 retval = -EBADMSG;
1733                         }
1734                         break;
1735                 }
1736
1737                 /* read it back -- assuming nothing intervened!!  */
1738                 retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
1739                                 0x5c, USB_DIR_IN|USB_TYPE_VENDOR,
1740                                 0, 0, buf, len, USB_CTRL_GET_TIMEOUT);
1741                 if (retval != len) {
1742                         what = "read";
1743                         if (retval >= 0) {
1744                                 ERROR(dev, "ctrl_out, rlen %d (expected %d)\n",
1745                                                 retval, len);
1746                                 retval = -EBADMSG;
1747                         }
1748                         break;
1749                 }
1750
1751                 /* fail if we can't verify */
1752                 for (j = 0; j < len; j++) {
1753                         if (buf[j] != (u8) (i + j)) {
1754                                 ERROR(dev, "ctrl_out, byte %d is %d not %d\n",
1755                                         j, buf[j], (u8) i + j);
1756                                 retval = -EBADMSG;
1757                                 break;
1758                         }
1759                 }
1760                 if (retval < 0) {
1761                         what = "verify";
1762                         break;
1763                 }
1764
1765                 len += vary;
1766
1767                 /* [real world] the "zero bytes IN" case isn't really used.
1768                  * hardware can easily trip up in this weird case, since its
1769                  * status stage is IN, not OUT like other ep0in transfers.
1770                  */
1771                 if (len > length)
1772                         len = realworld ? 1 : 0;
1773         }
1774
1775         if (retval < 0)
1776                 ERROR(dev, "ctrl_out %s failed, code %d, count %d\n",
1777                         what, retval, i);
1778
1779         kfree(buf - offset);
1780         return retval;
1781 }
1782
1783 /*-------------------------------------------------------------------------*/
1784
1785 /* ISO tests ... mimics common usage
1786  *  - buffer length is split into N packets (mostly maxpacket sized)
1787  *  - multi-buffers according to sglen
1788  */
1789
1790 struct iso_context {
1791         unsigned                count;
1792         unsigned                pending;
1793         spinlock_t              lock;
1794         struct completion       done;
1795         int                     submit_error;
1796         unsigned long           errors;
1797         unsigned long           packet_count;
1798         struct usbtest_dev      *dev;
1799 };
1800
1801 static void iso_callback(struct urb *urb)
1802 {
1803         struct iso_context      *ctx = urb->context;
1804
1805         spin_lock(&ctx->lock);
1806         ctx->count--;
1807
1808         ctx->packet_count += urb->number_of_packets;
1809         if (urb->error_count > 0)
1810                 ctx->errors += urb->error_count;
1811         else if (urb->status != 0)
1812                 ctx->errors += urb->number_of_packets;
1813         else if (urb->actual_length != urb->transfer_buffer_length)
1814                 ctx->errors++;
1815         else if (check_guard_bytes(ctx->dev, urb) != 0)
1816                 ctx->errors++;
1817
1818         if (urb->status == 0 && ctx->count > (ctx->pending - 1)
1819                         && !ctx->submit_error) {
1820                 int status = usb_submit_urb(urb, GFP_ATOMIC);
1821                 switch (status) {
1822                 case 0:
1823                         goto done;
1824                 default:
1825                         dev_err(&ctx->dev->intf->dev,
1826                                         "iso resubmit err %d\n",
1827                                         status);
1828                         /* FALLTHROUGH */
1829                 case -ENODEV:                   /* disconnected */
1830                 case -ESHUTDOWN:                /* endpoint disabled */
1831                         ctx->submit_error = 1;
1832                         break;
1833                 }
1834         }
1835
1836         ctx->pending--;
1837         if (ctx->pending == 0) {
1838                 if (ctx->errors)
1839                         dev_err(&ctx->dev->intf->dev,
1840                                 "iso test, %lu errors out of %lu\n",
1841                                 ctx->errors, ctx->packet_count);
1842                 complete(&ctx->done);
1843         }
1844 done:
1845         spin_unlock(&ctx->lock);
1846 }
1847
1848 static struct urb *iso_alloc_urb(
1849         struct usb_device       *udev,
1850         int                     pipe,
1851         struct usb_endpoint_descriptor  *desc,
1852         long                    bytes,
1853         unsigned offset
1854 )
1855 {
1856         struct urb              *urb;
1857         unsigned                i, maxp, packets;
1858
1859         if (bytes < 0 || !desc)
1860                 return NULL;
1861         maxp = 0x7ff & usb_endpoint_maxp(desc);
1862         maxp *= 1 + (0x3 & (usb_endpoint_maxp(desc) >> 11));
1863         packets = DIV_ROUND_UP(bytes, maxp);
1864
1865         urb = usb_alloc_urb(packets, GFP_KERNEL);
1866         if (!urb)
1867                 return urb;
1868         urb->dev = udev;
1869         urb->pipe = pipe;
1870
1871         urb->number_of_packets = packets;
1872         urb->transfer_buffer_length = bytes;
1873         urb->transfer_buffer = usb_alloc_coherent(udev, bytes + offset,
1874                                                         GFP_KERNEL,
1875                                                         &urb->transfer_dma);
1876         if (!urb->transfer_buffer) {
1877                 usb_free_urb(urb);
1878                 return NULL;
1879         }
1880         if (offset) {
1881                 memset(urb->transfer_buffer, GUARD_BYTE, offset);
1882                 urb->transfer_buffer += offset;
1883                 urb->transfer_dma += offset;
1884         }
1885         /* For inbound transfers use guard byte so that test fails if
1886                 data not correctly copied */
1887         memset(urb->transfer_buffer,
1888                         usb_pipein(urb->pipe) ? GUARD_BYTE : 0,
1889                         bytes);
1890
1891         for (i = 0; i < packets; i++) {
1892                 /* here, only the last packet will be short */
1893                 urb->iso_frame_desc[i].length = min((unsigned) bytes, maxp);
1894                 bytes -= urb->iso_frame_desc[i].length;
1895
1896                 urb->iso_frame_desc[i].offset = maxp * i;
1897         }
1898
1899         urb->complete = iso_callback;
1900         /* urb->context = SET BY CALLER */
1901         urb->interval = 1 << (desc->bInterval - 1);
1902         urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
1903         return urb;
1904 }
1905
1906 static int
1907 test_iso_queue(struct usbtest_dev *dev, struct usbtest_param *param,
1908                 int pipe, struct usb_endpoint_descriptor *desc, unsigned offset)
1909 {
1910         struct iso_context      context;
1911         struct usb_device       *udev;
1912         unsigned                i;
1913         unsigned long           packets = 0;
1914         int                     status = 0;
1915         struct urb              *urbs[param->sglen];
1916
1917         memset(&context, 0, sizeof(context));
1918         context.count = param->iterations * param->sglen;
1919         context.dev = dev;
1920         init_completion(&context.done);
1921         spin_lock_init(&context.lock);
1922
1923         memset(urbs, 0, sizeof(urbs));
1924         udev = testdev_to_usbdev(dev);
1925         dev_info(&dev->intf->dev,
1926                 "iso period %d %sframes, wMaxPacket %d, transactions: %d\n",
1927                 1 << (desc->bInterval - 1),
1928                 (udev->speed == USB_SPEED_HIGH) ? "micro" : "",
1929                 usb_endpoint_maxp(desc) & 0x7ff,
1930                 1 + (0x3 & (usb_endpoint_maxp(desc) >> 11)));
1931
1932         for (i = 0; i < param->sglen; i++) {
1933                 urbs[i] = iso_alloc_urb(udev, pipe, desc,
1934                                         param->length, offset);
1935                 if (!urbs[i]) {
1936                         status = -ENOMEM;
1937                         goto fail;
1938                 }
1939                 packets += urbs[i]->number_of_packets;
1940                 urbs[i]->context = &context;
1941         }
1942         packets *= param->iterations;
1943         dev_info(&dev->intf->dev,
1944                 "total %lu msec (%lu packets)\n",
1945                 (packets * (1 << (desc->bInterval - 1)))
1946                         / ((udev->speed == USB_SPEED_HIGH) ? 8 : 1),
1947                 packets);
1948
1949         spin_lock_irq(&context.lock);
1950         for (i = 0; i < param->sglen; i++) {
1951                 ++context.pending;
1952                 status = usb_submit_urb(urbs[i], GFP_ATOMIC);
1953                 if (status < 0) {
1954                         ERROR(dev, "submit iso[%d], error %d\n", i, status);
1955                         if (i == 0) {
1956                                 spin_unlock_irq(&context.lock);
1957                                 goto fail;
1958                         }
1959
1960                         simple_free_urb(urbs[i]);
1961                         urbs[i] = NULL;
1962                         context.pending--;
1963                         context.submit_error = 1;
1964                         break;
1965                 }
1966         }
1967         spin_unlock_irq(&context.lock);
1968
1969         wait_for_completion(&context.done);
1970
1971         for (i = 0; i < param->sglen; i++) {
1972                 if (urbs[i])
1973                         simple_free_urb(urbs[i]);
1974         }
1975         /*
1976          * Isochronous transfers are expected to fail sometimes.  As an
1977          * arbitrary limit, we will report an error if any submissions
1978          * fail or if the transfer failure rate is > 10%.
1979          */
1980         if (status != 0)
1981                 ;
1982         else if (context.submit_error)
1983                 status = -EACCES;
1984         else if (context.errors > context.packet_count / 10)
1985                 status = -EIO;
1986         return status;
1987
1988 fail:
1989         for (i = 0; i < param->sglen; i++) {
1990                 if (urbs[i])
1991                         simple_free_urb(urbs[i]);
1992         }
1993         return status;
1994 }
1995
1996 static int test_unaligned_bulk(
1997         struct usbtest_dev *tdev,
1998         int pipe,
1999         unsigned length,
2000         int iterations,
2001         unsigned transfer_flags,
2002         const char *label)
2003 {
2004         int retval;
2005         struct urb *urb = usbtest_alloc_urb(
2006                 testdev_to_usbdev(tdev), pipe, length, transfer_flags, 1, 0);
2007
2008         if (!urb)
2009                 return -ENOMEM;
2010
2011         retval = simple_io(tdev, urb, iterations, 0, 0, label);
2012         simple_free_urb(urb);
2013         return retval;
2014 }
2015
2016 /*-------------------------------------------------------------------------*/
2017
2018 /* We only have this one interface to user space, through usbfs.
2019  * User mode code can scan usbfs to find N different devices (maybe on
2020  * different busses) to use when testing, and allocate one thread per
2021  * test.  So discovery is simplified, and we have no device naming issues.
2022  *
2023  * Don't use these only as stress/load tests.  Use them along with with
2024  * other USB bus activity:  plugging, unplugging, mousing, mp3 playback,
2025  * video capture, and so on.  Run different tests at different times, in
2026  * different sequences.  Nothing here should interact with other devices,
2027  * except indirectly by consuming USB bandwidth and CPU resources for test
2028  * threads and request completion.  But the only way to know that for sure
2029  * is to test when HC queues are in use by many devices.
2030  *
2031  * WARNING:  Because usbfs grabs udev->dev.sem before calling this ioctl(),
2032  * it locks out usbcore in certain code paths.  Notably, if you disconnect
2033  * the device-under-test, hub_wq will wait block forever waiting for the
2034  * ioctl to complete ... so that usb_disconnect() can abort the pending
2035  * urbs and then call usbtest_disconnect().  To abort a test, you're best
2036  * off just killing the userspace task and waiting for it to exit.
2037  */
2038
2039 static int
2040 usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
2041 {
2042         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2043         struct usb_device       *udev = testdev_to_usbdev(dev);
2044         struct usbtest_param    *param = buf;
2045         int                     retval = -EOPNOTSUPP;
2046         struct urb              *urb;
2047         struct scatterlist      *sg;
2048         struct usb_sg_request   req;
2049         struct timeval          start;
2050         unsigned                i;
2051
2052         /* FIXME USBDEVFS_CONNECTINFO doesn't say how fast the device is. */
2053
2054         pattern = mod_pattern;
2055
2056         if (code != USBTEST_REQUEST)
2057                 return -EOPNOTSUPP;
2058
2059         if (param->iterations <= 0)
2060                 return -EINVAL;
2061
2062         if (param->sglen > MAX_SGLEN)
2063                 return -EINVAL;
2064
2065         if (mutex_lock_interruptible(&dev->lock))
2066                 return -ERESTARTSYS;
2067
2068         /* FIXME: What if a system sleep starts while a test is running? */
2069
2070         /* some devices, like ez-usb default devices, need a non-default
2071          * altsetting to have any active endpoints.  some tests change
2072          * altsettings; force a default so most tests don't need to check.
2073          */
2074         if (dev->info->alt >= 0) {
2075                 int     res;
2076
2077                 if (intf->altsetting->desc.bInterfaceNumber) {
2078                         mutex_unlock(&dev->lock);
2079                         return -ENODEV;
2080                 }
2081                 res = set_altsetting(dev, dev->info->alt);
2082                 if (res) {
2083                         dev_err(&intf->dev,
2084                                         "set altsetting to %d failed, %d\n",
2085                                         dev->info->alt, res);
2086                         mutex_unlock(&dev->lock);
2087                         return res;
2088                 }
2089         }
2090
2091         /*
2092          * Just a bunch of test cases that every HCD is expected to handle.
2093          *
2094          * Some may need specific firmware, though it'd be good to have
2095          * one firmware image to handle all the test cases.
2096          *
2097          * FIXME add more tests!  cancel requests, verify the data, control
2098          * queueing, concurrent read+write threads, and so on.
2099          */
2100         do_gettimeofday(&start);
2101         switch (param->test_num) {
2102
2103         case 0:
2104                 dev_info(&intf->dev, "TEST 0:  NOP\n");
2105                 retval = 0;
2106                 break;
2107
2108         /* Simple non-queued bulk I/O tests */
2109         case 1:
2110                 if (dev->out_pipe == 0)
2111                         break;
2112                 dev_info(&intf->dev,
2113                                 "TEST 1:  write %d bytes %u times\n",
2114                                 param->length, param->iterations);
2115                 urb = simple_alloc_urb(udev, dev->out_pipe, param->length, 0);
2116                 if (!urb) {
2117                         retval = -ENOMEM;
2118                         break;
2119                 }
2120                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2121                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test1");
2122                 simple_free_urb(urb);
2123                 break;
2124         case 2:
2125                 if (dev->in_pipe == 0)
2126                         break;
2127                 dev_info(&intf->dev,
2128                                 "TEST 2:  read %d bytes %u times\n",
2129                                 param->length, param->iterations);
2130                 urb = simple_alloc_urb(udev, dev->in_pipe, param->length, 0);
2131                 if (!urb) {
2132                         retval = -ENOMEM;
2133                         break;
2134                 }
2135                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2136                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test2");
2137                 simple_free_urb(urb);
2138                 break;
2139         case 3:
2140                 if (dev->out_pipe == 0 || param->vary == 0)
2141                         break;
2142                 dev_info(&intf->dev,
2143                                 "TEST 3:  write/%d 0..%d bytes %u times\n",
2144                                 param->vary, param->length, param->iterations);
2145                 urb = simple_alloc_urb(udev, dev->out_pipe, param->length, 0);
2146                 if (!urb) {
2147                         retval = -ENOMEM;
2148                         break;
2149                 }
2150                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2151                 retval = simple_io(dev, urb, param->iterations, param->vary,
2152                                         0, "test3");
2153                 simple_free_urb(urb);
2154                 break;
2155         case 4:
2156                 if (dev->in_pipe == 0 || param->vary == 0)
2157                         break;
2158                 dev_info(&intf->dev,
2159                                 "TEST 4:  read/%d 0..%d bytes %u times\n",
2160                                 param->vary, param->length, param->iterations);
2161                 urb = simple_alloc_urb(udev, dev->in_pipe, param->length, 0);
2162                 if (!urb) {
2163                         retval = -ENOMEM;
2164                         break;
2165                 }
2166                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2167                 retval = simple_io(dev, urb, param->iterations, param->vary,
2168                                         0, "test4");
2169                 simple_free_urb(urb);
2170                 break;
2171
2172         /* Queued bulk I/O tests */
2173         case 5:
2174                 if (dev->out_pipe == 0 || param->sglen == 0)
2175                         break;
2176                 dev_info(&intf->dev,
2177                         "TEST 5:  write %d sglists %d entries of %d bytes\n",
2178                                 param->iterations,
2179                                 param->sglen, param->length);
2180                 sg = alloc_sglist(param->sglen, param->length, 0);
2181                 if (!sg) {
2182                         retval = -ENOMEM;
2183                         break;
2184                 }
2185                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2186                 retval = perform_sglist(dev, param->iterations, dev->out_pipe,
2187                                 &req, sg, param->sglen);
2188                 free_sglist(sg, param->sglen);
2189                 break;
2190
2191         case 6:
2192                 if (dev->in_pipe == 0 || param->sglen == 0)
2193                         break;
2194                 dev_info(&intf->dev,
2195                         "TEST 6:  read %d sglists %d entries of %d bytes\n",
2196                                 param->iterations,
2197                                 param->sglen, param->length);
2198                 sg = alloc_sglist(param->sglen, param->length, 0);
2199                 if (!sg) {
2200                         retval = -ENOMEM;
2201                         break;
2202                 }
2203                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2204                 retval = perform_sglist(dev, param->iterations, dev->in_pipe,
2205                                 &req, sg, param->sglen);
2206                 free_sglist(sg, param->sglen);
2207                 break;
2208         case 7:
2209                 if (dev->out_pipe == 0 || param->sglen == 0 || param->vary == 0)
2210                         break;
2211                 dev_info(&intf->dev,
2212                         "TEST 7:  write/%d %d sglists %d entries 0..%d bytes\n",
2213                                 param->vary, param->iterations,
2214                                 param->sglen, param->length);
2215                 sg = alloc_sglist(param->sglen, param->length, param->vary);
2216                 if (!sg) {
2217                         retval = -ENOMEM;
2218                         break;
2219                 }
2220                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2221                 retval = perform_sglist(dev, param->iterations, dev->out_pipe,
2222                                 &req, sg, param->sglen);
2223                 free_sglist(sg, param->sglen);
2224                 break;
2225         case 8:
2226                 if (dev->in_pipe == 0 || param->sglen == 0 || param->vary == 0)
2227                         break;
2228                 dev_info(&intf->dev,
2229                         "TEST 8:  read/%d %d sglists %d entries 0..%d bytes\n",
2230                                 param->vary, param->iterations,
2231                                 param->sglen, param->length);
2232                 sg = alloc_sglist(param->sglen, param->length, param->vary);
2233                 if (!sg) {
2234                         retval = -ENOMEM;
2235                         break;
2236                 }
2237                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2238                 retval = perform_sglist(dev, param->iterations, dev->in_pipe,
2239                                 &req, sg, param->sglen);
2240                 free_sglist(sg, param->sglen);
2241                 break;
2242
2243         /* non-queued sanity tests for control (chapter 9 subset) */
2244         case 9:
2245                 retval = 0;
2246                 dev_info(&intf->dev,
2247                         "TEST 9:  ch9 (subset) control tests, %d times\n",
2248                                 param->iterations);
2249                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2250                         retval = ch9_postconfig(dev);
2251                 if (retval)
2252                         dev_err(&intf->dev, "ch9 subset failed, "
2253                                         "iterations left %d\n", i);
2254                 break;
2255
2256         /* queued control messaging */
2257         case 10:
2258                 retval = 0;
2259                 dev_info(&intf->dev,
2260                                 "TEST 10:  queue %d control calls, %d times\n",
2261                                 param->sglen,
2262                                 param->iterations);
2263                 retval = test_ctrl_queue(dev, param);
2264                 break;
2265
2266         /* simple non-queued unlinks (ring with one urb) */
2267         case 11:
2268                 if (dev->in_pipe == 0 || !param->length)
2269                         break;
2270                 retval = 0;
2271                 dev_info(&intf->dev, "TEST 11:  unlink %d reads of %d\n",
2272                                 param->iterations, param->length);
2273                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2274                         retval = unlink_simple(dev, dev->in_pipe,
2275                                                 param->length);
2276                 if (retval)
2277                         dev_err(&intf->dev, "unlink reads failed %d, "
2278                                 "iterations left %d\n", retval, i);
2279                 break;
2280         case 12:
2281                 if (dev->out_pipe == 0 || !param->length)
2282                         break;
2283                 retval = 0;
2284                 dev_info(&intf->dev, "TEST 12:  unlink %d writes of %d\n",
2285                                 param->iterations, param->length);
2286                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2287                         retval = unlink_simple(dev, dev->out_pipe,
2288                                                 param->length);
2289                 if (retval)
2290                         dev_err(&intf->dev, "unlink writes failed %d, "
2291                                 "iterations left %d\n", retval, i);
2292                 break;
2293
2294         /* ep halt tests */
2295         case 13:
2296                 if (dev->out_pipe == 0 && dev->in_pipe == 0)
2297                         break;
2298                 retval = 0;
2299                 dev_info(&intf->dev, "TEST 13:  set/clear %d halts\n",
2300                                 param->iterations);
2301                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2302                         retval = halt_simple(dev);
2303
2304                 if (retval)
2305                         ERROR(dev, "halts failed, iterations left %d\n", i);
2306                 break;
2307
2308         /* control write tests */
2309         case 14:
2310                 if (!dev->info->ctrl_out)
2311                         break;
2312                 dev_info(&intf->dev, "TEST 14:  %d ep0out, %d..%d vary %d\n",
2313                                 param->iterations,
2314                                 realworld ? 1 : 0, param->length,
2315                                 param->vary);
2316                 retval = ctrl_out(dev, param->iterations,
2317                                 param->length, param->vary, 0);
2318                 break;
2319
2320         /* iso write tests */
2321         case 15:
2322                 if (dev->out_iso_pipe == 0 || param->sglen == 0)
2323                         break;
2324                 dev_info(&intf->dev,
2325                         "TEST 15:  write %d iso, %d entries of %d bytes\n",
2326                                 param->iterations,
2327                                 param->sglen, param->length);
2328                 /* FIRMWARE:  iso sink */
2329                 retval = test_iso_queue(dev, param,
2330                                 dev->out_iso_pipe, dev->iso_out, 0);
2331                 break;
2332
2333         /* iso read tests */
2334         case 16:
2335                 if (dev->in_iso_pipe == 0 || param->sglen == 0)
2336                         break;
2337                 dev_info(&intf->dev,
2338                         "TEST 16:  read %d iso, %d entries of %d bytes\n",
2339                                 param->iterations,
2340                                 param->sglen, param->length);
2341                 /* FIRMWARE:  iso source */
2342                 retval = test_iso_queue(dev, param,
2343                                 dev->in_iso_pipe, dev->iso_in, 0);
2344                 break;
2345
2346         /* FIXME scatterlist cancel (needs helper thread) */
2347
2348         /* Tests for bulk I/O using DMA mapping by core and odd address */
2349         case 17:
2350                 if (dev->out_pipe == 0)
2351                         break;
2352                 dev_info(&intf->dev,
2353                         "TEST 17:  write odd addr %d bytes %u times core map\n",
2354                         param->length, param->iterations);
2355
2356                 retval = test_unaligned_bulk(
2357                                 dev, dev->out_pipe,
2358                                 param->length, param->iterations,
2359                                 0, "test17");
2360                 break;
2361
2362         case 18:
2363                 if (dev->in_pipe == 0)
2364                         break;
2365                 dev_info(&intf->dev,
2366                         "TEST 18:  read odd addr %d bytes %u times core map\n",
2367                         param->length, param->iterations);
2368
2369                 retval = test_unaligned_bulk(
2370                                 dev, dev->in_pipe,
2371                                 param->length, param->iterations,
2372                                 0, "test18");
2373                 break;
2374
2375         /* Tests for bulk I/O using premapped coherent buffer and odd address */
2376         case 19:
2377                 if (dev->out_pipe == 0)
2378                         break;
2379                 dev_info(&intf->dev,
2380                         "TEST 19:  write odd addr %d bytes %u times premapped\n",
2381                         param->length, param->iterations);
2382
2383                 retval = test_unaligned_bulk(
2384                                 dev, dev->out_pipe,
2385                                 param->length, param->iterations,
2386                                 URB_NO_TRANSFER_DMA_MAP, "test19");
2387                 break;
2388
2389         case 20:
2390                 if (dev->in_pipe == 0)
2391                         break;
2392                 dev_info(&intf->dev,
2393                         "TEST 20:  read odd addr %d bytes %u times premapped\n",
2394                         param->length, param->iterations);
2395
2396                 retval = test_unaligned_bulk(
2397                                 dev, dev->in_pipe,
2398                                 param->length, param->iterations,
2399                                 URB_NO_TRANSFER_DMA_MAP, "test20");
2400                 break;
2401
2402         /* control write tests with unaligned buffer */
2403         case 21:
2404                 if (!dev->info->ctrl_out)
2405                         break;
2406                 dev_info(&intf->dev,
2407                                 "TEST 21:  %d ep0out odd addr, %d..%d vary %d\n",
2408                                 param->iterations,
2409                                 realworld ? 1 : 0, param->length,
2410                                 param->vary);
2411                 retval = ctrl_out(dev, param->iterations,
2412                                 param->length, param->vary, 1);
2413                 break;
2414
2415         /* unaligned iso tests */
2416         case 22:
2417                 if (dev->out_iso_pipe == 0 || param->sglen == 0)
2418                         break;
2419                 dev_info(&intf->dev,
2420                         "TEST 22:  write %d iso odd, %d entries of %d bytes\n",
2421                                 param->iterations,
2422                                 param->sglen, param->length);
2423                 retval = test_iso_queue(dev, param,
2424                                 dev->out_iso_pipe, dev->iso_out, 1);
2425                 break;
2426
2427         case 23:
2428                 if (dev->in_iso_pipe == 0 || param->sglen == 0)
2429                         break;
2430                 dev_info(&intf->dev,
2431                         "TEST 23:  read %d iso odd, %d entries of %d bytes\n",
2432                                 param->iterations,
2433                                 param->sglen, param->length);
2434                 retval = test_iso_queue(dev, param,
2435                                 dev->in_iso_pipe, dev->iso_in, 1);
2436                 break;
2437
2438         /* unlink URBs from a bulk-OUT queue */
2439         case 24:
2440                 if (dev->out_pipe == 0 || !param->length || param->sglen < 4)
2441                         break;
2442                 retval = 0;
2443                 dev_info(&intf->dev, "TEST 24:  unlink from %d queues of "
2444                                 "%d %d-byte writes\n",
2445                                 param->iterations, param->sglen, param->length);
2446                 for (i = param->iterations; retval == 0 && i > 0; --i) {
2447                         retval = unlink_queued(dev, dev->out_pipe,
2448                                                 param->sglen, param->length);
2449                         if (retval) {
2450                                 dev_err(&intf->dev,
2451                                         "unlink queued writes failed %d, "
2452                                         "iterations left %d\n", retval, i);
2453                                 break;
2454                         }
2455                 }
2456                 break;
2457
2458         /* Simple non-queued interrupt I/O tests */
2459         case 25:
2460                 if (dev->out_int_pipe == 0)
2461                         break;
2462                 dev_info(&intf->dev,
2463                                 "TEST 25: write %d bytes %u times\n",
2464                                 param->length, param->iterations);
2465                 urb = simple_alloc_urb(udev, dev->out_int_pipe, param->length,
2466                                 dev->int_out->bInterval);
2467                 if (!urb) {
2468                         retval = -ENOMEM;
2469                         break;
2470                 }
2471                 /* FIRMWARE: interrupt sink (maybe accepts short writes) */
2472                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test25");
2473                 simple_free_urb(urb);
2474                 break;
2475         case 26:
2476                 if (dev->in_int_pipe == 0)
2477                         break;
2478                 dev_info(&intf->dev,
2479                                 "TEST 26: read %d bytes %u times\n",
2480                                 param->length, param->iterations);
2481                 urb = simple_alloc_urb(udev, dev->in_int_pipe, param->length,
2482                                 dev->int_in->bInterval);
2483                 if (!urb) {
2484                         retval = -ENOMEM;
2485                         break;
2486                 }
2487                 /* FIRMWARE: interrupt source (maybe generates short writes) */
2488                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test26");
2489                 simple_free_urb(urb);
2490                 break;
2491         }
2492         do_gettimeofday(&param->duration);
2493         param->duration.tv_sec -= start.tv_sec;
2494         param->duration.tv_usec -= start.tv_usec;
2495         if (param->duration.tv_usec < 0) {
2496                 param->duration.tv_usec += 1000 * 1000;
2497                 param->duration.tv_sec -= 1;
2498         }
2499         mutex_unlock(&dev->lock);
2500         return retval;
2501 }
2502
2503 /*-------------------------------------------------------------------------*/
2504
2505 static unsigned force_interrupt;
2506 module_param(force_interrupt, uint, 0);
2507 MODULE_PARM_DESC(force_interrupt, "0 = test default; else interrupt");
2508
2509 #ifdef  GENERIC
2510 static unsigned short vendor;
2511 module_param(vendor, ushort, 0);
2512 MODULE_PARM_DESC(vendor, "vendor code (from usb-if)");
2513
2514 static unsigned short product;
2515 module_param(product, ushort, 0);
2516 MODULE_PARM_DESC(product, "product code (from vendor)");
2517 #endif
2518
2519 static int
2520 usbtest_probe(struct usb_interface *intf, const struct usb_device_id *id)
2521 {
2522         struct usb_device       *udev;
2523         struct usbtest_dev      *dev;
2524         struct usbtest_info     *info;
2525         char                    *rtest, *wtest;
2526         char                    *irtest, *iwtest;
2527         char                    *intrtest, *intwtest;
2528
2529         udev = interface_to_usbdev(intf);
2530
2531 #ifdef  GENERIC
2532         /* specify devices by module parameters? */
2533         if (id->match_flags == 0) {
2534                 /* vendor match required, product match optional */
2535                 if (!vendor || le16_to_cpu(udev->descriptor.idVendor) != (u16)vendor)
2536                         return -ENODEV;
2537                 if (product && le16_to_cpu(udev->descriptor.idProduct) != (u16)product)
2538                         return -ENODEV;
2539                 dev_info(&intf->dev, "matched module params, "
2540                                         "vend=0x%04x prod=0x%04x\n",
2541                                 le16_to_cpu(udev->descriptor.idVendor),
2542                                 le16_to_cpu(udev->descriptor.idProduct));
2543         }
2544 #endif
2545
2546         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
2547         if (!dev)
2548                 return -ENOMEM;
2549         info = (struct usbtest_info *) id->driver_info;
2550         dev->info = info;
2551         mutex_init(&dev->lock);
2552
2553         dev->intf = intf;
2554
2555         /* cacheline-aligned scratch for i/o */
2556         dev->buf = kmalloc(TBUF_SIZE, GFP_KERNEL);
2557         if (dev->buf == NULL) {
2558                 kfree(dev);
2559                 return -ENOMEM;
2560         }
2561
2562         /* NOTE this doesn't yet test the handful of difference that are
2563          * visible with high speed interrupts:  bigger maxpacket (1K) and
2564          * "high bandwidth" modes (up to 3 packets/uframe).
2565          */
2566         rtest = wtest = "";
2567         irtest = iwtest = "";
2568         intrtest = intwtest = "";
2569         if (force_interrupt || udev->speed == USB_SPEED_LOW) {
2570                 if (info->ep_in) {
2571                         dev->in_pipe = usb_rcvintpipe(udev, info->ep_in);
2572                         rtest = " intr-in";
2573                 }
2574                 if (info->ep_out) {
2575                         dev->out_pipe = usb_sndintpipe(udev, info->ep_out);
2576                         wtest = " intr-out";
2577                 }
2578         } else {
2579                 if (override_alt >= 0 || info->autoconf) {
2580                         int status;
2581
2582                         status = get_endpoints(dev, intf);
2583                         if (status < 0) {
2584                                 WARNING(dev, "couldn't get endpoints, %d\n",
2585                                                 status);
2586                                 kfree(dev->buf);
2587                                 kfree(dev);
2588                                 return status;
2589                         }
2590                         /* may find bulk or ISO pipes */
2591                 } else {
2592                         if (info->ep_in)
2593                                 dev->in_pipe = usb_rcvbulkpipe(udev,
2594                                                         info->ep_in);
2595                         if (info->ep_out)
2596                                 dev->out_pipe = usb_sndbulkpipe(udev,
2597                                                         info->ep_out);
2598                 }
2599                 if (dev->in_pipe)
2600                         rtest = " bulk-in";
2601                 if (dev->out_pipe)
2602                         wtest = " bulk-out";
2603                 if (dev->in_iso_pipe)
2604                         irtest = " iso-in";
2605                 if (dev->out_iso_pipe)
2606                         iwtest = " iso-out";
2607                 if (dev->in_int_pipe)
2608                         intrtest = " int-in";
2609                 if (dev->out_int_pipe)
2610                         intwtest = " int-out";
2611         }
2612
2613         usb_set_intfdata(intf, dev);
2614         dev_info(&intf->dev, "%s\n", info->name);
2615         dev_info(&intf->dev, "%s {control%s%s%s%s%s%s%s} tests%s\n",
2616                         usb_speed_string(udev->speed),
2617                         info->ctrl_out ? " in/out" : "",
2618                         rtest, wtest,
2619                         irtest, iwtest,
2620                         intrtest, intwtest,
2621                         info->alt >= 0 ? " (+alt)" : "");
2622         return 0;
2623 }
2624
2625 static int usbtest_suspend(struct usb_interface *intf, pm_message_t message)
2626 {
2627         return 0;
2628 }
2629
2630 static int usbtest_resume(struct usb_interface *intf)
2631 {
2632         return 0;
2633 }
2634
2635
2636 static void usbtest_disconnect(struct usb_interface *intf)
2637 {
2638         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2639
2640         usb_set_intfdata(intf, NULL);
2641         dev_dbg(&intf->dev, "disconnect\n");
2642         kfree(dev);
2643 }
2644
2645 /* Basic testing only needs a device that can source or sink bulk traffic.
2646  * Any device can test control transfers (default with GENERIC binding).
2647  *
2648  * Several entries work with the default EP0 implementation that's built
2649  * into EZ-USB chips.  There's a default vendor ID which can be overridden
2650  * by (very) small config EEPROMS, but otherwise all these devices act
2651  * identically until firmware is loaded:  only EP0 works.  It turns out
2652  * to be easy to make other endpoints work, without modifying that EP0
2653  * behavior.  For now, we expect that kind of firmware.
2654  */
2655
2656 /* an21xx or fx versions of ez-usb */
2657 static struct usbtest_info ez1_info = {
2658         .name           = "EZ-USB device",
2659         .ep_in          = 2,
2660         .ep_out         = 2,
2661         .alt            = 1,
2662 };
2663
2664 /* fx2 version of ez-usb */
2665 static struct usbtest_info ez2_info = {
2666         .name           = "FX2 device",
2667         .ep_in          = 6,
2668         .ep_out         = 2,
2669         .alt            = 1,
2670 };
2671
2672 /* ezusb family device with dedicated usb test firmware,
2673  */
2674 static struct usbtest_info fw_info = {
2675         .name           = "usb test device",
2676         .ep_in          = 2,
2677         .ep_out         = 2,
2678         .alt            = 1,
2679         .autoconf       = 1,            /* iso and ctrl_out need autoconf */
2680         .ctrl_out       = 1,
2681         .iso            = 1,            /* iso_ep's are #8 in/out */
2682 };
2683
2684 /* peripheral running Linux and 'zero.c' test firmware, or
2685  * its user-mode cousin. different versions of this use
2686  * different hardware with the same vendor/product codes.
2687  * host side MUST rely on the endpoint descriptors.
2688  */
2689 static struct usbtest_info gz_info = {
2690         .name           = "Linux gadget zero",
2691         .autoconf       = 1,
2692         .ctrl_out       = 1,
2693         .iso            = 1,
2694         .intr           = 1,
2695         .alt            = 0,
2696 };
2697
2698 static struct usbtest_info um_info = {
2699         .name           = "Linux user mode test driver",
2700         .autoconf       = 1,
2701         .alt            = -1,
2702 };
2703
2704 static struct usbtest_info um2_info = {
2705         .name           = "Linux user mode ISO test driver",
2706         .autoconf       = 1,
2707         .iso            = 1,
2708         .alt            = -1,
2709 };
2710
2711 #ifdef IBOT2
2712 /* this is a nice source of high speed bulk data;
2713  * uses an FX2, with firmware provided in the device
2714  */
2715 static struct usbtest_info ibot2_info = {
2716         .name           = "iBOT2 webcam",
2717         .ep_in          = 2,
2718         .alt            = -1,
2719 };
2720 #endif
2721
2722 #ifdef GENERIC
2723 /* we can use any device to test control traffic */
2724 static struct usbtest_info generic_info = {
2725         .name           = "Generic USB device",
2726         .alt            = -1,
2727 };
2728 #endif
2729
2730
2731 static const struct usb_device_id id_table[] = {
2732
2733         /*-------------------------------------------------------------*/
2734
2735         /* EZ-USB devices which download firmware to replace (or in our
2736          * case augment) the default device implementation.
2737          */
2738
2739         /* generic EZ-USB FX controller */
2740         { USB_DEVICE(0x0547, 0x2235),
2741                 .driver_info = (unsigned long) &ez1_info,
2742         },
2743
2744         /* CY3671 development board with EZ-USB FX */
2745         { USB_DEVICE(0x0547, 0x0080),
2746                 .driver_info = (unsigned long) &ez1_info,
2747         },
2748
2749         /* generic EZ-USB FX2 controller (or development board) */
2750         { USB_DEVICE(0x04b4, 0x8613),
2751                 .driver_info = (unsigned long) &ez2_info,
2752         },
2753
2754         /* re-enumerated usb test device firmware */
2755         { USB_DEVICE(0xfff0, 0xfff0),
2756                 .driver_info = (unsigned long) &fw_info,
2757         },
2758
2759         /* "Gadget Zero" firmware runs under Linux */
2760         { USB_DEVICE(0x0525, 0xa4a0),
2761                 .driver_info = (unsigned long) &gz_info,
2762         },
2763
2764         /* so does a user-mode variant */
2765         { USB_DEVICE(0x0525, 0xa4a4),
2766                 .driver_info = (unsigned long) &um_info,
2767         },
2768
2769         /* ... and a user-mode variant that talks iso */
2770         { USB_DEVICE(0x0525, 0xa4a3),
2771                 .driver_info = (unsigned long) &um2_info,
2772         },
2773
2774 #ifdef KEYSPAN_19Qi
2775         /* Keyspan 19qi uses an21xx (original EZ-USB) */
2776         /* this does not coexist with the real Keyspan 19qi driver! */
2777         { USB_DEVICE(0x06cd, 0x010b),
2778                 .driver_info = (unsigned long) &ez1_info,
2779         },
2780 #endif
2781
2782         /*-------------------------------------------------------------*/
2783
2784 #ifdef IBOT2
2785         /* iBOT2 makes a nice source of high speed bulk-in data */
2786         /* this does not coexist with a real iBOT2 driver! */
2787         { USB_DEVICE(0x0b62, 0x0059),
2788                 .driver_info = (unsigned long) &ibot2_info,
2789         },
2790 #endif
2791
2792         /*-------------------------------------------------------------*/
2793
2794 #ifdef GENERIC
2795         /* module params can specify devices to use for control tests */
2796         { .driver_info = (unsigned long) &generic_info, },
2797 #endif
2798
2799         /*-------------------------------------------------------------*/
2800
2801         { }
2802 };
2803 MODULE_DEVICE_TABLE(usb, id_table);
2804
2805 static struct usb_driver usbtest_driver = {
2806         .name =         "usbtest",
2807         .id_table =     id_table,
2808         .probe =        usbtest_probe,
2809         .unlocked_ioctl = usbtest_ioctl,
2810         .disconnect =   usbtest_disconnect,
2811         .suspend =      usbtest_suspend,
2812         .resume =       usbtest_resume,
2813 };
2814
2815 /*-------------------------------------------------------------------------*/
2816
2817 static int __init usbtest_init(void)
2818 {
2819 #ifdef GENERIC
2820         if (vendor)
2821                 pr_debug("params: vend=0x%04x prod=0x%04x\n", vendor, product);
2822 #endif
2823         return usb_register(&usbtest_driver);
2824 }
2825 module_init(usbtest_init);
2826
2827 static void __exit usbtest_exit(void)
2828 {
2829         usb_deregister(&usbtest_driver);
2830 }
2831 module_exit(usbtest_exit);
2832
2833 MODULE_DESCRIPTION("USB Core/HCD Testing Driver");
2834 MODULE_LICENSE("GPL");
2835