drivers/usb/misc/usbtest.c

   1 #include <linux/kernel.h>
   2 #include <linux/errno.h>
   3 #include <linux/init.h>
   4 #include <linux/slab.h>
   5 #include <linux/mm.h>
   6 #include <linux/module.h>
   7 #include <linux/moduleparam.h>
   8 #include <linux/scatterlist.h>
   9 #include <linux/mutex.h>
  10 #include <linux/timer.h>
  11 #include <linux/usb.h>
  12
  13 #define SIMPLE_IO_TIMEOUT       10000   /* in milliseconds */
  14
  15 /*-------------------------------------------------------------------------*/
  16
  17 static int override_alt = -1;
  18 module_param_named(alt, override_alt, int, 0644);
  19 MODULE_PARM_DESC(alt, ">= 0 to override altsetting selection");
  20 static void complicated_callback(struct urb *urb);
  21
  22 /*-------------------------------------------------------------------------*/
  23
  24 /* FIXME make these public somewhere; usbdevfs.h? */
  25
  26 /* Parameter for usbtest driver. */
  27 struct usbtest_param_32 {
  28         /* inputs */
  29         __u32           test_num;       /* 0..(TEST_CASES-1) */
  30         __u32           iterations;
  31         __u32           length;
  32         __u32           vary;
  33         __u32           sglen;
  34
  35         /* outputs */
  36         __s32           duration_sec;
  37         __s32           duration_usec;
  38 };
  39
  40 /*
  41  * Compat parameter to the usbtest driver.
  42  * This supports older user space binaries compiled with 64 bit compiler.
  43  */
  44 struct usbtest_param_64 {
  45         /* inputs */
  46         __u32           test_num;       /* 0..(TEST_CASES-1) */
  47         __u32           iterations;
  48         __u32           length;
  49         __u32           vary;
  50         __u32           sglen;
  51
  52         /* outputs */
  53         __s64           duration_sec;
  54         __s64           duration_usec;
  55 };
  56
  57 /* IOCTL interface to the driver. */
  58 #define USBTEST_REQUEST_32    _IOWR('U', 100, struct usbtest_param_32)
  59 /* COMPAT IOCTL interface to the driver. */
  60 #define USBTEST_REQUEST_64    _IOWR('U', 100, struct usbtest_param_64)
  61
  62 /*-------------------------------------------------------------------------*/
  63
  64 #define GENERIC         /* let probe() bind using module params */
  65
  66 /* Some devices that can be used for testing will have "real" drivers.
  67  * Entries for those need to be enabled here by hand, after disabling
  68  * that "real" driver.
  69  */
  70 //#define       IBOT2           /* grab iBOT2 webcams */
  71 //#define       KEYSPAN_19Qi    /* grab un-renumerated serial adapter */
  72
  73 /*-------------------------------------------------------------------------*/
  74
  75 struct usbtest_info {
  76         const char              *name;
  77         u8                      ep_in;          /* bulk/intr source */
  78         u8                      ep_out;         /* bulk/intr sink */
  79         unsigned                autoconf:1;
  80         unsigned                ctrl_out:1;
  81         unsigned                iso:1;          /* try iso in/out */
  82         unsigned                intr:1;         /* try interrupt in/out */
  83         int                     alt;
  84 };
  85
  86 /* this is accessed only through usbfs ioctl calls.
  87  * one ioctl to issue a test ... one lock per device.
  88  * tests create other threads if they need them.
  89  * urbs and buffers are allocated dynamically,
  90  * and data generated deterministically.
  91  */
  92 struct usbtest_dev {
  93         struct usb_interface    *intf;
  94         struct usbtest_info     *info;
  95         int                     in_pipe;
  96         int                     out_pipe;
  97         int                     in_iso_pipe;
  98         int                     out_iso_pipe;
  99         int                     in_int_pipe;
 100         int                     out_int_pipe;
 101         struct usb_endpoint_descriptor  *iso_in, *iso_out;
 102         struct usb_endpoint_descriptor  *int_in, *int_out;
 103         struct mutex            lock;
 104
 105 #define TBUF_SIZE       256
 106         u8                      *buf;
 107 };
 108
 109 static struct usb_device *testdev_to_usbdev(struct usbtest_dev *test)
 110 {
 111         return interface_to_usbdev(test->intf);
 112 }
 113
 114 /* set up all urbs so they can be used with either bulk or interrupt */
 115 #define INTERRUPT_RATE          1       /* msec/transfer */
 116
 117 #define ERROR(tdev, fmt, args...) \
 118         dev_err(&(tdev)->intf->dev , fmt , ## args)
 119 #define WARNING(tdev, fmt, args...) \
 120         dev_warn(&(tdev)->intf->dev , fmt , ## args)
 121
 122 #define GUARD_BYTE      0xA5
 123 #define MAX_SGLEN       128
 124
 125 /*-------------------------------------------------------------------------*/
 126
 127 static int
 128 get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf)
 129 {
 130         int                             tmp;
 131         struct usb_host_interface       *alt;
 132         struct usb_host_endpoint        *in, *out;
 133         struct usb_host_endpoint        *iso_in, *iso_out;
 134         struct usb_host_endpoint        *int_in, *int_out;
 135         struct usb_device               *udev;
 136
 137         for (tmp = 0; tmp < intf->num_altsetting; tmp++) {
 138                 unsigned        ep;
 139
 140                 in = out = NULL;
 141                 iso_in = iso_out = NULL;
 142                 int_in = int_out = NULL;
 143                 alt = intf->altsetting + tmp;
 144
 145                 if (override_alt >= 0 &&
 146                                 override_alt != alt->desc.bAlternateSetting)
 147                         continue;
 148
 149                 /* take the first altsetting with in-bulk + out-bulk;
 150                  * ignore other endpoints and altsettings.
 151                  */
 152                 for (ep = 0; ep < alt->desc.bNumEndpoints; ep++) {
 153                         struct usb_host_endpoint        *e;
 154
 155                         e = alt->endpoint + ep;
 156                         switch (usb_endpoint_type(&e->desc)) {
 157                         case USB_ENDPOINT_XFER_BULK:
 158                                 break;
 159                         case USB_ENDPOINT_XFER_INT:
 160                                 if (dev->info->intr)
 161                                         goto try_intr;
 162                         case USB_ENDPOINT_XFER_ISOC:
 163                                 if (dev->info->iso)
 164                                         goto try_iso;
 165                                 /* FALLTHROUGH */
 166                         default:
 167                                 continue;
 168                         }
 169                         if (usb_endpoint_dir_in(&e->desc)) {
 170                                 if (!in)
 171                                         in = e;
 172                         } else {
 173                                 if (!out)
 174                                         out = e;
 175                         }
 176                         continue;
 177 try_intr:
 178                         if (usb_endpoint_dir_in(&e->desc)) {
 179                                 if (!int_in)
 180                                         int_in = e;
 181                         } else {
 182                                 if (!int_out)
 183                                         int_out = e;
 184                         }
 185                         continue;
 186 try_iso:
 187                         if (usb_endpoint_dir_in(&e->desc)) {
 188                                 if (!iso_in)
 189                                         iso_in = e;
 190                         } else {
 191                                 if (!iso_out)
 192                                         iso_out = e;
 193                         }
 194                 }
 195                 if ((in && out)  ||  iso_in || iso_out || int_in || int_out)
 196                         goto found;
 197         }
 198         return -EINVAL;
 199
 200 found:
 201         udev = testdev_to_usbdev(dev);
 202         dev->info->alt = alt->desc.bAlternateSetting;
 203         if (alt->desc.bAlternateSetting != 0) {
 204                 tmp = usb_set_interface(udev,
 205                                 alt->desc.bInterfaceNumber,
 206                                 alt->desc.bAlternateSetting);
 207                 if (tmp < 0)
 208                         return tmp;
 209         }
 210
 211         if (in) {
 212                 dev->in_pipe = usb_rcvbulkpipe(udev,
 213                         in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
 214                 dev->out_pipe = usb_sndbulkpipe(udev,
 215                         out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
 216         }
 217         if (iso_in) {
 218                 dev->iso_in = &iso_in->desc;
 219                 dev->in_iso_pipe = usb_rcvisocpipe(udev,
 220                                 iso_in->desc.bEndpointAddress
 221                                         & USB_ENDPOINT_NUMBER_MASK);
 222         }
 223
 224         if (iso_out) {
 225                 dev->iso_out = &iso_out->desc;
 226                 dev->out_iso_pipe = usb_sndisocpipe(udev,
 227                                 iso_out->desc.bEndpointAddress
 228                                         & USB_ENDPOINT_NUMBER_MASK);
 229         }
 230
 231         if (int_in) {
 232                 dev->int_in = &int_in->desc;
 233                 dev->in_int_pipe = usb_rcvintpipe(udev,
 234                                 int_in->desc.bEndpointAddress
 235                                         & USB_ENDPOINT_NUMBER_MASK);
 236         }
 237
 238         if (int_out) {
 239                 dev->int_out = &int_out->desc;
 240                 dev->out_int_pipe = usb_sndintpipe(udev,
 241                                 int_out->desc.bEndpointAddress
 242                                         & USB_ENDPOINT_NUMBER_MASK);
 243         }
 244         return 0;
 245 }
 246
 247 /*-------------------------------------------------------------------------*/
 248
 249 /* Support for testing basic non-queued I/O streams.
 250  *
 251  * These just package urbs as requests that can be easily canceled.
 252  * Each urb's data buffer is dynamically allocated; callers can fill
 253  * them with non-zero test data (or test for it) when appropriate.
 254  */
 255
 256 static void simple_callback(struct urb *urb)
 257 {
 258         complete(urb->context);
 259 }
 260
 261 static struct urb *usbtest_alloc_urb(
 262         struct usb_device       *udev,
 263         int                     pipe,
 264         unsigned long           bytes,
 265         unsigned                transfer_flags,
 266         unsigned                offset,
 267         u8                      bInterval,
 268         usb_complete_t          complete_fn)
 269 {
 270         struct urb              *urb;
 271
 272         urb = usb_alloc_urb(0, GFP_KERNEL);
 273         if (!urb)
 274                 return urb;
 275
 276         if (bInterval)
 277                 usb_fill_int_urb(urb, udev, pipe, NULL, bytes, complete_fn,
 278                                 NULL, bInterval);
 279         else
 280                 usb_fill_bulk_urb(urb, udev, pipe, NULL, bytes, complete_fn,
 281                                 NULL);
 282
 283         urb->interval = (udev->speed == USB_SPEED_HIGH)
 284                         ? (INTERRUPT_RATE << 3)
 285                         : INTERRUPT_RATE;
 286         urb->transfer_flags = transfer_flags;
 287         if (usb_pipein(pipe))
 288                 urb->transfer_flags |= URB_SHORT_NOT_OK;
 289
 290         if ((bytes + offset) == 0)
 291                 return urb;
 292
 293         if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 294                 urb->transfer_buffer = usb_alloc_coherent(udev, bytes + offset,
 295                         GFP_KERNEL, &urb->transfer_dma);
 296         else
 297                 urb->transfer_buffer = kmalloc(bytes + offset, GFP_KERNEL);
 298
 299         if (!urb->transfer_buffer) {
 300                 usb_free_urb(urb);
 301                 return NULL;
 302         }
 303
 304         /* To test unaligned transfers add an offset and fill the
 305                 unused memory with a guard value */
 306         if (offset) {
 307                 memset(urb->transfer_buffer, GUARD_BYTE, offset);
 308                 urb->transfer_buffer += offset;
 309                 if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 310                         urb->transfer_dma += offset;
 311         }
 312
 313         /* For inbound transfers use guard byte so that test fails if
 314                 data not correctly copied */
 315         memset(urb->transfer_buffer,
 316                         usb_pipein(urb->pipe) ? GUARD_BYTE : 0,
 317                         bytes);
 318         return urb;
 319 }
 320
 321 static struct urb *simple_alloc_urb(
 322         struct usb_device       *udev,
 323         int                     pipe,
 324         unsigned long           bytes,
 325         u8                      bInterval)
 326 {
 327         return usbtest_alloc_urb(udev, pipe, bytes, URB_NO_TRANSFER_DMA_MAP, 0,
 328                         bInterval, simple_callback);
 329 }
 330
 331 static struct urb *complicated_alloc_urb(
 332         struct usb_device       *udev,
 333         int                     pipe,
 334         unsigned long           bytes,
 335         u8                      bInterval)
 336 {
 337         return usbtest_alloc_urb(udev, pipe, bytes, URB_NO_TRANSFER_DMA_MAP, 0,
 338                         bInterval, complicated_callback);
 339 }
 340
 341 static unsigned pattern;
 342 static unsigned mod_pattern;
 343 module_param_named(pattern, mod_pattern, uint, S_IRUGO | S_IWUSR);
 344 MODULE_PARM_DESC(mod_pattern, "i/o pattern (0 == zeroes)");
 345
 346 static unsigned get_maxpacket(struct usb_device *udev, int pipe)
 347 {
 348         struct usb_host_endpoint        *ep;
 349
 350         ep = usb_pipe_endpoint(udev, pipe);
 351         return le16_to_cpup(&ep->desc.wMaxPacketSize);
 352 }
 353
 354 static void simple_fill_buf(struct urb *urb)
 355 {
 356         unsigned        i;
 357         u8              *buf = urb->transfer_buffer;
 358         unsigned        len = urb->transfer_buffer_length;
 359         unsigned        maxpacket;
 360
 361         switch (pattern) {
 362         default:
 363                 /* FALLTHROUGH */
 364         case 0:
 365                 memset(buf, 0, len);
 366                 break;
 367         case 1:                 /* mod63 */
 368                 maxpacket = get_maxpacket(urb->dev, urb->pipe);
 369                 for (i = 0; i < len; i++)
 370                         *buf++ = (u8) ((i % maxpacket) % 63);
 371                 break;
 372         }
 373 }
 374
 375 static inline unsigned long buffer_offset(void *buf)
 376 {
 377         return (unsigned long)buf & (ARCH_KMALLOC_MINALIGN - 1);
 378 }
 379
 380 static int check_guard_bytes(struct usbtest_dev *tdev, struct urb *urb)
 381 {
 382         u8 *buf = urb->transfer_buffer;
 383         u8 *guard = buf - buffer_offset(buf);
 384         unsigned i;
 385
 386         for (i = 0; guard < buf; i++, guard++) {
 387                 if (*guard != GUARD_BYTE) {
 388                         ERROR(tdev, "guard byte[%d] %d (not %d)\n",
 389                                 i, *guard, GUARD_BYTE);
 390                         return -EINVAL;
 391                 }
 392         }
 393         return 0;
 394 }
 395
 396 static int simple_check_buf(struct usbtest_dev *tdev, struct urb *urb)
 397 {
 398         unsigned        i;
 399         u8              expected;
 400         u8              *buf = urb->transfer_buffer;
 401         unsigned        len = urb->actual_length;
 402         unsigned        maxpacket = get_maxpacket(urb->dev, urb->pipe);
 403
 404         int ret = check_guard_bytes(tdev, urb);
 405         if (ret)
 406                 return ret;
 407
 408         for (i = 0; i < len; i++, buf++) {
 409                 switch (pattern) {
 410                 /* all-zeroes has no synchronization issues */
 411                 case 0:
 412                         expected = 0;
 413                         break;
 414                 /* mod63 stays in sync with short-terminated transfers,
 415                  * or otherwise when host and gadget agree on how large
 416                  * each usb transfer request should be.  resync is done
 417                  * with set_interface or set_config.
 418                  */
 419                 case 1:                 /* mod63 */
 420                         expected = (i % maxpacket) % 63;
 421                         break;
 422                 /* always fail unsupported patterns */
 423                 default:
 424                         expected = !*buf;
 425                         break;
 426                 }
 427                 if (*buf == expected)
 428                         continue;
 429                 ERROR(tdev, "buf[%d] = %d (not %d)\n", i, *buf, expected);
 430                 return -EINVAL;
 431         }
 432         return 0;
 433 }
 434
 435 static void simple_free_urb(struct urb *urb)
 436 {
 437         unsigned long offset = buffer_offset(urb->transfer_buffer);
 438
 439         if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 440                 usb_free_coherent(
 441                         urb->dev,
 442                         urb->transfer_buffer_length + offset,
 443                         urb->transfer_buffer - offset,
 444                         urb->transfer_dma - offset);
 445         else
 446                 kfree(urb->transfer_buffer - offset);
 447         usb_free_urb(urb);
 448 }
 449
 450 static int simple_io(
 451         struct usbtest_dev      *tdev,
 452         struct urb              *urb,
 453         int                     iterations,
 454         int                     vary,
 455         int                     expected,
 456         const char              *label
 457 )
 458 {
 459         struct usb_device       *udev = urb->dev;
 460         int                     max = urb->transfer_buffer_length;
 461         struct completion       completion;
 462         int                     retval = 0;
 463         unsigned long           expire;
 464
 465         urb->context = &completion;
 466         while (retval == 0 && iterations-- > 0) {
 467                 init_completion(&completion);
 468                 if (usb_pipeout(urb->pipe)) {
 469                         simple_fill_buf(urb);
 470                         urb->transfer_flags |= URB_ZERO_PACKET;
 471                 }
 472                 retval = usb_submit_urb(urb, GFP_KERNEL);
 473                 if (retval != 0)
 474                         break;
 475
 476                 expire = msecs_to_jiffies(SIMPLE_IO_TIMEOUT);
 477                 if (!wait_for_completion_timeout(&completion, expire)) {
 478                         usb_kill_urb(urb);
 479                         retval = (urb->status == -ENOENT ?
 480                                   -ETIMEDOUT : urb->status);
 481                 } else {
 482                         retval = urb->status;
 483                 }
 484
 485                 urb->dev = udev;
 486                 if (retval == 0 && usb_pipein(urb->pipe))
 487                         retval = simple_check_buf(tdev, urb);
 488
 489                 if (vary) {
 490                         int     len = urb->transfer_buffer_length;
 491
 492                         len += vary;
 493                         len %= max;
 494                         if (len == 0)
 495                                 len = (vary < max) ? vary : max;
 496                         urb->transfer_buffer_length = len;
 497                 }
 498
 499                 /* FIXME if endpoint halted, clear halt (and log) */
 500         }
 501         urb->transfer_buffer_length = max;
 502
 503         if (expected != retval)
 504                 dev_err(&udev->dev,
 505                         "%s failed, iterations left %d, status %d (not %d)\n",
 506                                 label, iterations, retval, expected);
 507         return retval;
 508 }
 509
 510
 511 /*-------------------------------------------------------------------------*/
 512
 513 /* We use scatterlist primitives to test queued I/O.
 514  * Yes, this also tests the scatterlist primitives.
 515  */
 516
 517 static void free_sglist(struct scatterlist *sg, int nents)
 518 {
 519         unsigned                i;
 520
 521         if (!sg)
 522                 return;
 523         for (i = 0; i < nents; i++) {
 524                 if (!sg_page(&sg[i]))
 525                         continue;
 526                 kfree(sg_virt(&sg[i]));
 527         }
 528         kfree(sg);
 529 }
 530
 531 static struct scatterlist *
 532 alloc_sglist(int nents, int max, int vary, struct usbtest_dev *dev, int pipe)
 533 {
 534         struct scatterlist      *sg;
 535         unsigned int            n_size = 0;
 536         unsigned                i;
 537         unsigned                size = max;
 538         unsigned                maxpacket =
 539                 get_maxpacket(interface_to_usbdev(dev->intf), pipe);
 540
 541         if (max == 0)
 542                 return NULL;
 543
 544         sg = kmalloc_array(nents, sizeof(*sg), GFP_KERNEL);
 545         if (!sg)
 546                 return NULL;
 547         sg_init_table(sg, nents);
 548
 549         for (i = 0; i < nents; i++) {
 550                 char            *buf;
 551                 unsigned        j;
 552
 553                 buf = kzalloc(size, GFP_KERNEL);
 554                 if (!buf) {
 555                         free_sglist(sg, i);
 556                         return NULL;
 557                 }
 558
 559                 /* kmalloc pages are always physically contiguous! */
 560                 sg_set_buf(&sg[i], buf, size);
 561
 562                 switch (pattern) {
 563                 case 0:
 564                         /* already zeroed */
 565                         break;
 566                 case 1:
 567                         for (j = 0; j < size; j++)
 568                                 *buf++ = (u8) (((j + n_size) % maxpacket) % 63);
 569                         n_size += size;
 570                         break;
 571                 }
 572
 573                 if (vary) {
 574                         size += vary;
 575                         size %= max;
 576                         if (size == 0)
 577                                 size = (vary < max) ? vary : max;
 578                 }
 579         }
 580
 581         return sg;
 582 }
 583
 584 static void sg_timeout(unsigned long _req)
 585 {
 586         struct usb_sg_request   *req = (struct usb_sg_request *) _req;
 587
 588         req->status = -ETIMEDOUT;
 589         usb_sg_cancel(req);
 590 }
 591
 592 static int perform_sglist(
 593         struct usbtest_dev      *tdev,
 594         unsigned                iterations,
 595         int                     pipe,
 596         struct usb_sg_request   *req,
 597         struct scatterlist      *sg,
 598         int                     nents
 599 )
 600 {
 601         struct usb_device       *udev = testdev_to_usbdev(tdev);
 602         int                     retval = 0;
 603         struct timer_list       sg_timer;
 604
 605         setup_timer_on_stack(&sg_timer, sg_timeout, (unsigned long) req);
 606
 607         while (retval == 0 && iterations-- > 0) {
 608                 retval = usb_sg_init(req, udev, pipe,
 609                                 (udev->speed == USB_SPEED_HIGH)
 610                                         ? (INTERRUPT_RATE << 3)
 611                                         : INTERRUPT_RATE,
 612                                 sg, nents, 0, GFP_KERNEL);
 613
 614                 if (retval)
 615                         break;
 616                 mod_timer(&sg_timer, jiffies +
 617                                 msecs_to_jiffies(SIMPLE_IO_TIMEOUT));
 618                 usb_sg_wait(req);
 619                 del_timer_sync(&sg_timer);
 620                 retval = req->status;
 621
 622                 /* FIXME check resulting data pattern */
 623
 624                 /* FIXME if endpoint halted, clear halt (and log) */
 625         }
 626
 627         /* FIXME for unlink or fault handling tests, don't report
 628          * failure if retval is as we expected ...
 629          */
 630         if (retval)
 631                 ERROR(tdev, "perform_sglist failed, "
 632                                 "iterations left %d, status %d\n",
 633                                 iterations, retval);
 634         return retval;
 635 }
 636
 637
 638 /*-------------------------------------------------------------------------*/
 639
 640 /* unqueued control message testing
 641  *
 642  * there's a nice set of device functional requirements in chapter 9 of the
 643  * usb 2.0 spec, which we can apply to ANY device, even ones that don't use
 644  * special test firmware.
 645  *
 646  * we know the device is configured (or suspended) by the time it's visible
 647  * through usbfs.  we can't change that, so we won't test enumeration (which
 648  * worked 'well enough' to get here, this time), power management (ditto),
 649  * or remote wakeup (which needs human interaction).
 650  */
 651
 652 static unsigned realworld = 1;
 653 module_param(realworld, uint, 0);
 654 MODULE_PARM_DESC(realworld, "clear to demand stricter spec compliance");
 655
 656 static int get_altsetting(struct usbtest_dev *dev)
 657 {
 658         struct usb_interface    *iface = dev->intf;
 659         struct usb_device       *udev = interface_to_usbdev(iface);
 660         int                     retval;
 661
 662         retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 663                         USB_REQ_GET_INTERFACE, USB_DIR_IN|USB_RECIP_INTERFACE,
 664                         0, iface->altsetting[0].desc.bInterfaceNumber,
 665                         dev->buf, 1, USB_CTRL_GET_TIMEOUT);
 666         switch (retval) {
 667         case 1:
 668                 return dev->buf[0];
 669         case 0:
 670                 retval = -ERANGE;
 671                 /* FALLTHROUGH */
 672         default:
 673                 return retval;
 674         }
 675 }
 676
 677 static int set_altsetting(struct usbtest_dev *dev, int alternate)
 678 {
 679         struct usb_interface            *iface = dev->intf;
 680         struct usb_device               *udev;
 681
 682         if (alternate < 0 || alternate >= 256)
 683                 return -EINVAL;
 684
 685         udev = interface_to_usbdev(iface);
 686         return usb_set_interface(udev,
 687                         iface->altsetting[0].desc.bInterfaceNumber,
 688                         alternate);
 689 }
 690
 691 static int is_good_config(struct usbtest_dev *tdev, int len)
 692 {
 693         struct usb_config_descriptor    *config;
 694
 695         if (len < sizeof(*config))
 696                 return 0;
 697         config = (struct usb_config_descriptor *) tdev->buf;
 698
 699         switch (config->bDescriptorType) {
 700         case USB_DT_CONFIG:
 701         case USB_DT_OTHER_SPEED_CONFIG:
 702                 if (config->bLength != 9) {
 703                         ERROR(tdev, "bogus config descriptor length\n");
 704                         return 0;
 705                 }
 706                 /* this bit 'must be 1' but often isn't */
 707                 if (!realworld && !(config->bmAttributes & 0x80)) {
 708                         ERROR(tdev, "high bit of config attributes not set\n");
 709                         return 0;
 710                 }
 711                 if (config->bmAttributes & 0x1f) {      /* reserved == 0 */
 712                         ERROR(tdev, "reserved config bits set\n");
 713                         return 0;
 714                 }
 715                 break;
 716         default:
 717                 return 0;
 718         }
 719
 720         if (le16_to_cpu(config->wTotalLength) == len)   /* read it all */
 721                 return 1;
 722         if (le16_to_cpu(config->wTotalLength) >= TBUF_SIZE)     /* max partial read */
 723                 return 1;
 724         ERROR(tdev, "bogus config descriptor read size\n");
 725         return 0;
 726 }
 727
 728 static int is_good_ext(struct usbtest_dev *tdev, u8 *buf)
 729 {
 730         struct usb_ext_cap_descriptor *ext;
 731         u32 attr;
 732
 733         ext = (struct usb_ext_cap_descriptor *) buf;
 734
 735         if (ext->bLength != USB_DT_USB_EXT_CAP_SIZE) {
 736                 ERROR(tdev, "bogus usb 2.0 extension descriptor length\n");
 737                 return 0;
 738         }
 739
 740         attr = le32_to_cpu(ext->bmAttributes);
 741         /* bits[1:15] is used and others are reserved */
 742         if (attr & ~0xfffe) {   /* reserved == 0 */
 743                 ERROR(tdev, "reserved bits set\n");
 744                 return 0;
 745         }
 746
 747         return 1;
 748 }
 749
 750 static int is_good_ss_cap(struct usbtest_dev *tdev, u8 *buf)
 751 {
 752         struct usb_ss_cap_descriptor *ss;
 753
 754         ss = (struct usb_ss_cap_descriptor *) buf;
 755
 756         if (ss->bLength != USB_DT_USB_SS_CAP_SIZE) {
 757                 ERROR(tdev, "bogus superspeed device capability descriptor length\n");
 758                 return 0;
 759         }
 760
 761         /*
 762          * only bit[1] of bmAttributes is used for LTM and others are
 763          * reserved
 764          */
 765         if (ss->bmAttributes & ~0x02) { /* reserved == 0 */
 766                 ERROR(tdev, "reserved bits set in bmAttributes\n");
 767                 return 0;
 768         }
 769
 770         /* bits[0:3] of wSpeedSupported is used and others are reserved */
 771         if (le16_to_cpu(ss->wSpeedSupported) & ~0x0f) { /* reserved == 0 */
 772                 ERROR(tdev, "reserved bits set in wSpeedSupported\n");
 773                 return 0;
 774         }
 775
 776         return 1;
 777 }
 778
 779 static int is_good_con_id(struct usbtest_dev *tdev, u8 *buf)
 780 {
 781         struct usb_ss_container_id_descriptor *con_id;
 782
 783         con_id = (struct usb_ss_container_id_descriptor *) buf;
 784
 785         if (con_id->bLength != USB_DT_USB_SS_CONTN_ID_SIZE) {
 786                 ERROR(tdev, "bogus container id descriptor length\n");
 787                 return 0;
 788         }
 789
 790         if (con_id->bReserved) {        /* reserved == 0 */
 791                 ERROR(tdev, "reserved bits set\n");
 792                 return 0;
 793         }
 794
 795         return 1;
 796 }
 797
 798 /* sanity test for standard requests working with usb_control_mesg() and some
 799  * of the utility functions which use it.
 800  *
 801  * this doesn't test how endpoint halts behave or data toggles get set, since
 802  * we won't do I/O to bulk/interrupt endpoints here (which is how to change
 803  * halt or toggle).  toggle testing is impractical without support from hcds.
 804  *
 805  * this avoids failing devices linux would normally work with, by not testing
 806  * config/altsetting operations for devices that only support their defaults.
 807  * such devices rarely support those needless operations.
 808  *
 809  * NOTE that since this is a sanity test, it's not examining boundary cases
 810  * to see if usbcore, hcd, and device all behave right.  such testing would
 811  * involve varied read sizes and other operation sequences.
 812  */
 813 static int ch9_postconfig(struct usbtest_dev *dev)
 814 {
 815         struct usb_interface    *iface = dev->intf;
 816         struct usb_device       *udev = interface_to_usbdev(iface);
 817         int                     i, alt, retval;
 818
 819         /* [9.2.3] if there's more than one altsetting, we need to be able to
 820          * set and get each one.  mostly trusts the descriptors from usbcore.
 821          */
 822         for (i = 0; i < iface->num_altsetting; i++) {
 823
 824                 /* 9.2.3 constrains the range here */
 825                 alt = iface->altsetting[i].desc.bAlternateSetting;
 826                 if (alt < 0 || alt >= iface->num_altsetting) {
 827                         dev_err(&iface->dev,
 828                                         "invalid alt [%d].bAltSetting = %d\n",
 829                                         i, alt);
 830                 }
 831
 832                 /* [real world] get/set unimplemented if there's only one */
 833                 if (realworld && iface->num_altsetting == 1)
 834                         continue;
 835
 836                 /* [9.4.10] set_interface */
 837                 retval = set_altsetting(dev, alt);
 838                 if (retval) {
 839                         dev_err(&iface->dev, "can't set_interface = %d, %d\n",
 840                                         alt, retval);
 841                         return retval;
 842                 }
 843
 844                 /* [9.4.4] get_interface always works */
 845                 retval = get_altsetting(dev);
 846                 if (retval != alt) {
 847                         dev_err(&iface->dev, "get alt should be %d, was %d\n",
 848                                         alt, retval);
 849                         return (retval < 0) ? retval : -EDOM;
 850                 }
 851
 852         }
 853
 854         /* [real world] get_config unimplemented if there's only one */
 855         if (!realworld || udev->descriptor.bNumConfigurations != 1) {
 856                 int     expected = udev->actconfig->desc.bConfigurationValue;
 857
 858                 /* [9.4.2] get_configuration always works
 859                  * ... although some cheap devices (like one TI Hub I've got)
 860                  * won't return config descriptors except before set_config.
 861                  */
 862                 retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 863                                 USB_REQ_GET_CONFIGURATION,
 864                                 USB_DIR_IN | USB_RECIP_DEVICE,
 865                                 0, 0, dev->buf, 1, USB_CTRL_GET_TIMEOUT);
 866                 if (retval != 1 || dev->buf[0] != expected) {
 867                         dev_err(&iface->dev, "get config --> %d %d (1 %d)\n",
 868                                 retval, dev->buf[0], expected);
 869                         return (retval < 0) ? retval : -EDOM;
 870                 }
 871         }
 872
 873         /* there's always [9.4.3] a device descriptor [9.6.1] */
 874         retval = usb_get_descriptor(udev, USB_DT_DEVICE, 0,
 875                         dev->buf, sizeof(udev->descriptor));
 876         if (retval != sizeof(udev->descriptor)) {
 877                 dev_err(&iface->dev, "dev descriptor --> %d\n", retval);
 878                 return (retval < 0) ? retval : -EDOM;
 879         }
 880
 881         /*
 882          * there's always [9.4.3] a bos device descriptor [9.6.2] in USB
 883          * 3.0 spec
 884          */
 885         if (le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0210) {
 886                 struct usb_bos_descriptor *bos = NULL;
 887                 struct usb_dev_cap_header *header = NULL;
 888                 unsigned total, num, length;
 889                 u8 *buf;
 890
 891                 retval = usb_get_descriptor(udev, USB_DT_BOS, 0, dev->buf,
 892                                 sizeof(*udev->bos->desc));
 893                 if (retval != sizeof(*udev->bos->desc)) {
 894                         dev_err(&iface->dev, "bos descriptor --> %d\n", retval);
 895                         return (retval < 0) ? retval : -EDOM;
 896                 }
 897
 898                 bos = (struct usb_bos_descriptor *)dev->buf;
 899                 total = le16_to_cpu(bos->wTotalLength);
 900                 num = bos->bNumDeviceCaps;
 901
 902                 if (total > TBUF_SIZE)
 903                         total = TBUF_SIZE;
 904
 905                 /*
 906                  * get generic device-level capability descriptors [9.6.2]
 907                  * in USB 3.0 spec
 908                  */
 909                 retval = usb_get_descriptor(udev, USB_DT_BOS, 0, dev->buf,
 910                                 total);
 911                 if (retval != total) {
 912                         dev_err(&iface->dev, "bos descriptor set --> %d\n",
 913                                         retval);
 914                         return (retval < 0) ? retval : -EDOM;
 915                 }
 916
 917                 length = sizeof(*udev->bos->desc);
 918                 buf = dev->buf;
 919                 for (i = 0; i < num; i++) {
 920                         buf += length;
 921                         if (buf + sizeof(struct usb_dev_cap_header) >
 922                                         dev->buf + total)
 923                                 break;
 924
 925                         header = (struct usb_dev_cap_header *)buf;
 926                         length = header->bLength;
 927
 928                         if (header->bDescriptorType !=
 929                                         USB_DT_DEVICE_CAPABILITY) {
 930                                 dev_warn(&udev->dev, "not device capability descriptor, skip\n");
 931                                 continue;
 932                         }
 933
 934                         switch (header->bDevCapabilityType) {
 935                         case USB_CAP_TYPE_EXT:
 936                                 if (buf + USB_DT_USB_EXT_CAP_SIZE >
 937                                                 dev->buf + total ||
 938                                                 !is_good_ext(dev, buf)) {
 939                                         dev_err(&iface->dev, "bogus usb 2.0 extension descriptor\n");
 940                                         return -EDOM;
 941                                 }
 942                                 break;
 943                         case USB_SS_CAP_TYPE:
 944                                 if (buf + USB_DT_USB_SS_CAP_SIZE >
 945                                                 dev->buf + total ||
 946                                                 !is_good_ss_cap(dev, buf)) {
 947                                         dev_err(&iface->dev, "bogus superspeed device capability descriptor\n");
 948                                         return -EDOM;
 949                                 }
 950                                 break;
 951                         case CONTAINER_ID_TYPE:
 952                                 if (buf + USB_DT_USB_SS_CONTN_ID_SIZE >
 953                                                 dev->buf + total ||
 954                                                 !is_good_con_id(dev, buf)) {
 955                                         dev_err(&iface->dev, "bogus container id descriptor\n");
 956                                         return -EDOM;
 957                                 }
 958                                 break;
 959                         default:
 960                                 break;
 961                         }
 962                 }
 963         }
 964
 965         /* there's always [9.4.3] at least one config descriptor [9.6.3] */
 966         for (i = 0; i < udev->descriptor.bNumConfigurations; i++) {
 967                 retval = usb_get_descriptor(udev, USB_DT_CONFIG, i,
 968                                 dev->buf, TBUF_SIZE);
 969                 if (!is_good_config(dev, retval)) {
 970                         dev_err(&iface->dev,
 971                                         "config [%d] descriptor --> %d\n",
 972                                         i, retval);
 973                         return (retval < 0) ? retval : -EDOM;
 974                 }
 975
 976                 /* FIXME cross-checking udev->config[i] to make sure usbcore
 977                  * parsed it right (etc) would be good testing paranoia
 978                  */
 979         }
 980
 981         /* and sometimes [9.2.6.6] speed dependent descriptors */
 982         if (le16_to_cpu(udev->descriptor.bcdUSB) == 0x0200) {
 983                 struct usb_qualifier_descriptor *d = NULL;
 984
 985                 /* device qualifier [9.6.2] */
 986                 retval = usb_get_descriptor(udev,
 987                                 USB_DT_DEVICE_QUALIFIER, 0, dev->buf,
 988                                 sizeof(struct usb_qualifier_descriptor));
 989                 if (retval == -EPIPE) {
 990                         if (udev->speed == USB_SPEED_HIGH) {
 991                                 dev_err(&iface->dev,
 992                                                 "hs dev qualifier --> %d\n",
 993                                                 retval);
 994                                 return (retval < 0) ? retval : -EDOM;
 995                         }
 996                         /* usb2.0 but not high-speed capable; fine */
 997                 } else if (retval != sizeof(struct usb_qualifier_descriptor)) {
 998                         dev_err(&iface->dev, "dev qualifier --> %d\n", retval);
 999                         return (retval < 0) ? retval : -EDOM;
1000                 } else
1001                         d = (struct usb_qualifier_descriptor *) dev->buf;
1002
1003                 /* might not have [9.6.2] any other-speed configs [9.6.4] */
1004                 if (d) {
1005                         unsigned max = d->bNumConfigurations;
1006                         for (i = 0; i < max; i++) {
1007                                 retval = usb_get_descriptor(udev,
1008                                         USB_DT_OTHER_SPEED_CONFIG, i,
1009                                         dev->buf, TBUF_SIZE);
1010                                 if (!is_good_config(dev, retval)) {
1011                                         dev_err(&iface->dev,
1012                                                 "other speed config --> %d\n",
1013                                                 retval);
1014                                         return (retval < 0) ? retval : -EDOM;
1015                                 }
1016                         }
1017                 }
1018         }
1019         /* FIXME fetch strings from at least the device descriptor */
1020
1021         /* [9.4.5] get_status always works */
1022         retval = usb_get_status(udev, USB_RECIP_DEVICE, 0, dev->buf);
1023         if (retval) {
1024                 dev_err(&iface->dev, "get dev status --> %d\n", retval);
1025                 return retval;
1026         }
1027
1028         /* FIXME configuration.bmAttributes says if we could try to set/clear
1029          * the device's remote wakeup feature ... if we can, test that here
1030          */
1031
1032         retval = usb_get_status(udev, USB_RECIP_INTERFACE,
1033                         iface->altsetting[0].desc.bInterfaceNumber, dev->buf);
1034         if (retval) {
1035                 dev_err(&iface->dev, "get interface status --> %d\n", retval);
1036                 return retval;
1037         }
1038         /* FIXME get status for each endpoint in the interface */
1039
1040         return 0;
1041 }
1042
1043 /*-------------------------------------------------------------------------*/
1044
1045 /* use ch9 requests to test whether:
1046  *   (a) queues work for control, keeping N subtests queued and
1047  *       active (auto-resubmit) for M loops through the queue.
1048  *   (b) protocol stalls (control-only) will autorecover.
1049  *       it's not like bulk/intr; no halt clearing.
1050  *   (c) short control reads are reported and handled.
1051  *   (d) queues are always processed in-order
1052  */
1053
1054 struct ctrl_ctx {
1055         spinlock_t              lock;
1056         struct usbtest_dev      *dev;
1057         struct completion       complete;
1058         unsigned                count;
1059         unsigned                pending;
1060         int                     status;
1061         struct urb              **urb;
1062         struct usbtest_param_32 *param;
1063         int                     last;
1064 };
1065
1066 #define NUM_SUBCASES    16              /* how many test subcases here? */
1067
1068 struct subcase {
1069         struct usb_ctrlrequest  setup;
1070         int                     number;
1071         int                     expected;
1072 };
1073
1074 static void ctrl_complete(struct urb *urb)
1075 {
1076         struct ctrl_ctx         *ctx = urb->context;
1077         struct usb_ctrlrequest  *reqp;
1078         struct subcase          *subcase;
1079         int                     status = urb->status;
1080
1081         reqp = (struct usb_ctrlrequest *)urb->setup_packet;
1082         subcase = container_of(reqp, struct subcase, setup);
1083
1084         spin_lock(&ctx->lock);
1085         ctx->count--;
1086         ctx->pending--;
1087
1088         /* queue must transfer and complete in fifo order, unless
1089          * usb_unlink_urb() is used to unlink something not at the
1090          * physical queue head (not tested).
1091          */
1092         if (subcase->number > 0) {
1093                 if ((subcase->number - ctx->last) != 1) {
1094                         ERROR(ctx->dev,
1095                                 "subcase %d completed out of order, last %d\n",
1096                                 subcase->number, ctx->last);
1097                         status = -EDOM;
1098                         ctx->last = subcase->number;
1099                         goto error;
1100                 }
1101         }
1102         ctx->last = subcase->number;
1103
1104         /* succeed or fault in only one way? */
1105         if (status == subcase->expected)
1106                 status = 0;
1107
1108         /* async unlink for cleanup? */
1109         else if (status != -ECONNRESET) {
1110
1111                 /* some faults are allowed, not required */
1112                 if (subcase->expected > 0 && (
1113                           ((status == -subcase->expected        /* happened */
1114                            || status == 0))))                   /* didn't */
1115                         status = 0;
1116                 /* sometimes more than one fault is allowed */
1117                 else if (subcase->number == 12 && status == -EPIPE)
1118                         status = 0;
1119                 else
1120                         ERROR(ctx->dev, "subtest %d error, status %d\n",
1121                                         subcase->number, status);
1122         }
1123
1124         /* unexpected status codes mean errors; ideally, in hardware */
1125         if (status) {
1126 error:
1127                 if (ctx->status == 0) {
1128                         int             i;
1129
1130                         ctx->status = status;
1131                         ERROR(ctx->dev, "control queue %02x.%02x, err %d, "
1132                                         "%d left, subcase %d, len %d/%d\n",
1133                                         reqp->bRequestType, reqp->bRequest,
1134                                         status, ctx->count, subcase->number,
1135                                         urb->actual_length,
1136                                         urb->transfer_buffer_length);
1137
1138                         /* FIXME this "unlink everything" exit route should
1139                          * be a separate test case.
1140                          */
1141
1142                         /* unlink whatever's still pending */
1143                         for (i = 1; i < ctx->param->sglen; i++) {
1144                                 struct urb *u = ctx->urb[
1145                                                         (i + subcase->number)
1146                                                         % ctx->param->sglen];
1147
1148                                 if (u == urb || !u->dev)
1149                                         continue;
1150                                 spin_unlock(&ctx->lock);
1151                                 status = usb_unlink_urb(u);
1152                                 spin_lock(&ctx->lock);
1153                                 switch (status) {
1154                                 case -EINPROGRESS:
1155                                 case -EBUSY:
1156                                 case -EIDRM:
1157                                         continue;
1158                                 default:
1159                                         ERROR(ctx->dev, "urb unlink --> %d\n",
1160                                                         status);
1161                                 }
1162                         }
1163                         status = ctx->status;
1164                 }
1165         }
1166
1167         /* resubmit if we need to, else mark this as done */
1168         if ((status == 0) && (ctx->pending < ctx->count)) {
1169                 status = usb_submit_urb(urb, GFP_ATOMIC);
1170                 if (status != 0) {
1171                         ERROR(ctx->dev,
1172                                 "can't resubmit ctrl %02x.%02x, err %d\n",
1173                                 reqp->bRequestType, reqp->bRequest, status);
1174                         urb->dev = NULL;
1175                 } else
1176                         ctx->pending++;
1177         } else
1178                 urb->dev = NULL;
1179
1180         /* signal completion when nothing's queued */
1181         if (ctx->pending == 0)
1182                 complete(&ctx->complete);
1183         spin_unlock(&ctx->lock);
1184 }
1185
1186 static int
1187 test_ctrl_queue(struct usbtest_dev *dev, struct usbtest_param_32 *param)
1188 {
1189         struct usb_device       *udev = testdev_to_usbdev(dev);
1190         struct urb              **urb;
1191         struct ctrl_ctx         context;
1192         int                     i;
1193
1194         if (param->sglen == 0 || param->iterations > UINT_MAX / param->sglen)
1195                 return -EOPNOTSUPP;
1196
1197         spin_lock_init(&context.lock);
1198         context.dev = dev;
1199         init_completion(&context.complete);
1200         context.count = param->sglen * param->iterations;
1201         context.pending = 0;
1202         context.status = -ENOMEM;
1203         context.param = param;
1204         context.last = -1;
1205
1206         /* allocate and init the urbs we'll queue.
1207          * as with bulk/intr sglists, sglen is the queue depth; it also
1208          * controls which subtests run (more tests than sglen) or rerun.
1209          */
1210         urb = kcalloc(param->sglen, sizeof(struct urb *), GFP_KERNEL);
1211         if (!urb)
1212                 return -ENOMEM;
1213         for (i = 0; i < param->sglen; i++) {
1214                 int                     pipe = usb_rcvctrlpipe(udev, 0);
1215                 unsigned                len;
1216                 struct urb              *u;
1217                 struct usb_ctrlrequest  req;
1218                 struct subcase          *reqp;
1219
1220                 /* sign of this variable means:
1221                  *  -: tested code must return this (negative) error code
1222                  *  +: tested code may return this (negative too) error code
1223                  */
1224                 int                     expected = 0;
1225
1226                 /* requests here are mostly expected to succeed on any
1227                  * device, but some are chosen to trigger protocol stalls
1228                  * or short reads.
1229                  */
1230                 memset(&req, 0, sizeof(req));
1231                 req.bRequest = USB_REQ_GET_DESCRIPTOR;
1232                 req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
1233
1234                 switch (i % NUM_SUBCASES) {
1235                 case 0:         /* get device descriptor */
1236                         req.wValue = cpu_to_le16(USB_DT_DEVICE << 8);
1237                         len = sizeof(struct usb_device_descriptor);
1238                         break;
1239                 case 1:         /* get first config descriptor (only) */
1240                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1241                         len = sizeof(struct usb_config_descriptor);
1242                         break;
1243                 case 2:         /* get altsetting (OFTEN STALLS) */
1244                         req.bRequest = USB_REQ_GET_INTERFACE;
1245                         req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
1246                         /* index = 0 means first interface */
1247                         len = 1;
1248                         expected = EPIPE;
1249                         break;
1250                 case 3:         /* get interface status */
1251                         req.bRequest = USB_REQ_GET_STATUS;
1252                         req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
1253                         /* interface 0 */
1254                         len = 2;
1255                         break;
1256                 case 4:         /* get device status */
1257                         req.bRequest = USB_REQ_GET_STATUS;
1258                         req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
1259                         len = 2;
1260                         break;
1261                 case 5:         /* get device qualifier (MAY STALL) */
1262                         req.wValue = cpu_to_le16 (USB_DT_DEVICE_QUALIFIER << 8);
1263                         len = sizeof(struct usb_qualifier_descriptor);
1264                         if (udev->speed != USB_SPEED_HIGH)
1265                                 expected = EPIPE;
1266                         break;
1267                 case 6:         /* get first config descriptor, plus interface */
1268                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1269                         len = sizeof(struct usb_config_descriptor);
1270                         len += sizeof(struct usb_interface_descriptor);
1271                         break;
1272                 case 7:         /* get interface descriptor (ALWAYS STALLS) */
1273                         req.wValue = cpu_to_le16 (USB_DT_INTERFACE << 8);
1274                         /* interface == 0 */
1275                         len = sizeof(struct usb_interface_descriptor);
1276                         expected = -EPIPE;
1277                         break;
1278                 /* NOTE: two consecutive stalls in the queue here.
1279                  *  that tests fault recovery a bit more aggressively. */
1280                 case 8:         /* clear endpoint halt (MAY STALL) */
1281                         req.bRequest = USB_REQ_CLEAR_FEATURE;
1282                         req.bRequestType = USB_RECIP_ENDPOINT;
1283                         /* wValue 0 == ep halt */
1284                         /* wIndex 0 == ep0 (shouldn't halt!) */
1285                         len = 0;
1286                         pipe = usb_sndctrlpipe(udev, 0);
1287                         expected = EPIPE;
1288                         break;
1289                 case 9:         /* get endpoint status */
1290                         req.bRequest = USB_REQ_GET_STATUS;
1291                         req.bRequestType = USB_DIR_IN|USB_RECIP_ENDPOINT;
1292                         /* endpoint 0 */
1293                         len = 2;
1294                         break;
1295                 case 10:        /* trigger short read (EREMOTEIO) */
1296                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1297                         len = 1024;
1298                         expected = -EREMOTEIO;
1299                         break;
1300                 /* NOTE: two consecutive _different_ faults in the queue. */
1301                 case 11:        /* get endpoint descriptor (ALWAYS STALLS) */
1302                         req.wValue = cpu_to_le16(USB_DT_ENDPOINT << 8);
1303                         /* endpoint == 0 */
1304                         len = sizeof(struct usb_interface_descriptor);
1305                         expected = EPIPE;
1306                         break;
1307                 /* NOTE: sometimes even a third fault in the queue! */
1308                 case 12:        /* get string 0 descriptor (MAY STALL) */
1309                         req.wValue = cpu_to_le16(USB_DT_STRING << 8);
1310                         /* string == 0, for language IDs */
1311                         len = sizeof(struct usb_interface_descriptor);
1312                         /* may succeed when > 4 languages */
1313                         expected = EREMOTEIO;   /* or EPIPE, if no strings */
1314                         break;
1315                 case 13:        /* short read, resembling case 10 */
1316                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1317                         /* last data packet "should" be DATA1, not DATA0 */
1318                         if (udev->speed == USB_SPEED_SUPER)
1319                                 len = 1024 - 512;
1320                         else
1321                                 len = 1024 - udev->descriptor.bMaxPacketSize0;
1322                         expected = -EREMOTEIO;
1323                         break;
1324                 case 14:        /* short read; try to fill the last packet */
1325                         req.wValue = cpu_to_le16((USB_DT_DEVICE << 8) | 0);
1326                         /* device descriptor size == 18 bytes */
1327                         len = udev->descriptor.bMaxPacketSize0;
1328                         if (udev->speed == USB_SPEED_SUPER)
1329                                 len = 512;
1330                         switch (len) {
1331                         case 8:
1332                                 len = 24;
1333                                 break;
1334                         case 16:
1335                                 len = 32;
1336                                 break;
1337                         }
1338                         expected = -EREMOTEIO;
1339                         break;
1340                 case 15:
1341                         req.wValue = cpu_to_le16(USB_DT_BOS << 8);
1342                         if (udev->bos)
1343                                 len = le16_to_cpu(udev->bos->desc->wTotalLength);
1344                         else
1345                                 len = sizeof(struct usb_bos_descriptor);
1346                         if (le16_to_cpu(udev->descriptor.bcdUSB) < 0x0201)
1347                                 expected = -EPIPE;
1348                         break;
1349                 default:
1350                         ERROR(dev, "bogus number of ctrl queue testcases!\n");
1351                         context.status = -EINVAL;
1352                         goto cleanup;
1353                 }
1354                 req.wLength = cpu_to_le16(len);
1355                 urb[i] = u = simple_alloc_urb(udev, pipe, len, 0);
1356                 if (!u)
1357                         goto cleanup;
1358
1359                 reqp = kmalloc(sizeof(*reqp), GFP_KERNEL);
1360                 if (!reqp)
1361                         goto cleanup;
1362                 reqp->setup = req;
1363                 reqp->number = i % NUM_SUBCASES;
1364                 reqp->expected = expected;
1365                 u->setup_packet = (char *) &reqp->setup;
1366
1367                 u->context = &context;
1368                 u->complete = ctrl_complete;
1369         }
1370
1371         /* queue the urbs */
1372         context.urb = urb;
1373         spin_lock_irq(&context.lock);
1374         for (i = 0; i < param->sglen; i++) {
1375                 context.status = usb_submit_urb(urb[i], GFP_ATOMIC);
1376                 if (context.status != 0) {
1377                         ERROR(dev, "can't submit urb[%d], status %d\n",
1378                                         i, context.status);
1379                         context.count = context.pending;
1380                         break;
1381                 }
1382                 context.pending++;
1383         }
1384         spin_unlock_irq(&context.lock);
1385
1386         /* FIXME  set timer and time out; provide a disconnect hook */
1387
1388         /* wait for the last one to complete */
1389         if (context.pending > 0)
1390                 wait_for_completion(&context.complete);
1391
1392 cleanup:
1393         for (i = 0; i < param->sglen; i++) {
1394                 if (!urb[i])
1395                         continue;
1396                 urb[i]->dev = udev;
1397                 kfree(urb[i]->setup_packet);
1398                 simple_free_urb(urb[i]);
1399         }
1400         kfree(urb);
1401         return context.status;
1402 }
1403 #undef NUM_SUBCASES
1404
1405
1406 /*-------------------------------------------------------------------------*/
1407
1408 static void unlink1_callback(struct urb *urb)
1409 {
1410         int     status = urb->status;
1411
1412         /* we "know" -EPIPE (stall) never happens */
1413         if (!status)
1414                 status = usb_submit_urb(urb, GFP_ATOMIC);
1415         if (status) {
1416                 urb->status = status;
1417                 complete(urb->context);
1418         }
1419 }
1420
1421 static int unlink1(struct usbtest_dev *dev, int pipe, int size, int async)
1422 {
1423         struct urb              *urb;
1424         struct completion       completion;
1425         int                     retval = 0;
1426
1427         init_completion(&completion);
1428         urb = simple_alloc_urb(testdev_to_usbdev(dev), pipe, size, 0);
1429         if (!urb)
1430                 return -ENOMEM;
1431         urb->context = &completion;
1432         urb->complete = unlink1_callback;
1433
1434         if (usb_pipeout(urb->pipe)) {
1435                 simple_fill_buf(urb);
1436                 urb->transfer_flags |= URB_ZERO_PACKET;
1437         }
1438
1439         /* keep the endpoint busy.  there are lots of hc/hcd-internal
1440          * states, and testing should get to all of them over time.
1441          *
1442          * FIXME want additional tests for when endpoint is STALLing
1443          * due to errors, or is just NAKing requests.
1444          */
1445         retval = usb_submit_urb(urb, GFP_KERNEL);
1446         if (retval != 0) {
1447                 dev_err(&dev->intf->dev, "submit fail %d\n", retval);
1448                 return retval;
1449         }
1450
1451         /* unlinking that should always work.  variable delay tests more
1452          * hcd states and code paths, even with little other system load.
1453          */
1454         msleep(jiffies % (2 * INTERRUPT_RATE));
1455         if (async) {
1456                 while (!completion_done(&completion)) {
1457                         retval = usb_unlink_urb(urb);
1458
1459                         if (retval == 0 && usb_pipein(urb->pipe))
1460                                 retval = simple_check_buf(dev, urb);
1461
1462                         switch (retval) {
1463                         case -EBUSY:
1464                         case -EIDRM:
1465                                 /* we can't unlink urbs while they're completing
1466                                  * or if they've completed, and we haven't
1467                                  * resubmitted. "normal" drivers would prevent
1468                                  * resubmission, but since we're testing unlink
1469                                  * paths, we can't.
1470                                  */
1471                                 ERROR(dev, "unlink retry\n");
1472                                 continue;
1473                         case 0:
1474                         case -EINPROGRESS:
1475                                 break;
1476
1477                         default:
1478                                 dev_err(&dev->intf->dev,
1479                                         "unlink fail %d\n", retval);
1480                                 return retval;
1481                         }
1482
1483                         break;
1484                 }
1485         } else
1486                 usb_kill_urb(urb);
1487
1488         wait_for_completion(&completion);
1489         retval = urb->status;
1490         simple_free_urb(urb);
1491
1492         if (async)
1493                 return (retval == -ECONNRESET) ? 0 : retval - 1000;
1494         else
1495                 return (retval == -ENOENT || retval == -EPERM) ?
1496                                 0 : retval - 2000;
1497 }
1498
1499 static int unlink_simple(struct usbtest_dev *dev, int pipe, int len)
1500 {
1501         int                     retval = 0;
1502
1503         /* test sync and async paths */
1504         retval = unlink1(dev, pipe, len, 1);
1505         if (!retval)
1506                 retval = unlink1(dev, pipe, len, 0);
1507         return retval;
1508 }
1509
1510 /*-------------------------------------------------------------------------*/
1511
1512 struct queued_ctx {
1513         struct completion       complete;
1514         atomic_t                pending;
1515         unsigned                num;
1516         int                     status;
1517         struct urb              **urbs;
1518 };
1519
1520 static void unlink_queued_callback(struct urb *urb)
1521 {
1522         int                     status = urb->status;
1523         struct queued_ctx       *ctx = urb->context;
1524
1525         if (ctx->status)
1526                 goto done;
1527         if (urb == ctx->urbs[ctx->num - 4] || urb == ctx->urbs[ctx->num - 2]) {
1528                 if (status == -ECONNRESET)
1529                         goto done;
1530                 /* What error should we report if the URB completed normally? */
1531         }
1532         if (status != 0)
1533                 ctx->status = status;
1534
1535  done:
1536         if (atomic_dec_and_test(&ctx->pending))
1537                 complete(&ctx->complete);
1538 }
1539
1540 static int unlink_queued(struct usbtest_dev *dev, int pipe, unsigned num,
1541                 unsigned size)
1542 {
1543         struct queued_ctx       ctx;
1544         struct usb_device       *udev = testdev_to_usbdev(dev);
1545         void                    *buf;
1546         dma_addr_t              buf_dma;
1547         int                     i;
1548         int                     retval = -ENOMEM;
1549
1550         init_completion(&ctx.complete);
1551         atomic_set(&ctx.pending, 1);    /* One more than the actual value */
1552         ctx.num = num;
1553         ctx.status = 0;
1554
1555         buf = usb_alloc_coherent(udev, size, GFP_KERNEL, &buf_dma);
1556         if (!buf)
1557                 return retval;
1558         memset(buf, 0, size);
1559
1560         /* Allocate and init the urbs we'll queue */
1561         ctx.urbs = kcalloc(num, sizeof(struct urb *), GFP_KERNEL);
1562         if (!ctx.urbs)
1563                 goto free_buf;
1564         for (i = 0; i < num; i++) {
1565                 ctx.urbs[i] = usb_alloc_urb(0, GFP_KERNEL);
1566                 if (!ctx.urbs[i])
1567                         goto free_urbs;
1568                 usb_fill_bulk_urb(ctx.urbs[i], udev, pipe, buf, size,
1569                                 unlink_queued_callback, &ctx);
1570                 ctx.urbs[i]->transfer_dma = buf_dma;
1571                 ctx.urbs[i]->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
1572
1573                 if (usb_pipeout(ctx.urbs[i]->pipe)) {
1574                         simple_fill_buf(ctx.urbs[i]);
1575                         ctx.urbs[i]->transfer_flags |= URB_ZERO_PACKET;
1576                 }
1577         }
1578
1579         /* Submit all the URBs and then unlink URBs num - 4 and num - 2. */
1580         for (i = 0; i < num; i++) {
1581                 atomic_inc(&ctx.pending);
1582                 retval = usb_submit_urb(ctx.urbs[i], GFP_KERNEL);
1583                 if (retval != 0) {
1584                         dev_err(&dev->intf->dev, "submit urbs[%d] fail %d\n",
1585                                         i, retval);
1586                         atomic_dec(&ctx.pending);
1587                         ctx.status = retval;
1588                         break;
1589                 }
1590         }
1591         if (i == num) {
1592                 usb_unlink_urb(ctx.urbs[num - 4]);
1593                 usb_unlink_urb(ctx.urbs[num - 2]);
1594         } else {
1595                 while (--i >= 0)
1596                         usb_unlink_urb(ctx.urbs[i]);
1597         }
1598
1599         if (atomic_dec_and_test(&ctx.pending))          /* The extra count */
1600                 complete(&ctx.complete);
1601         wait_for_completion(&ctx.complete);
1602         retval = ctx.status;
1603
1604  free_urbs:
1605         for (i = 0; i < num; i++)
1606                 usb_free_urb(ctx.urbs[i]);
1607         kfree(ctx.urbs);
1608  free_buf:
1609         usb_free_coherent(udev, size, buf, buf_dma);
1610         return retval;
1611 }
1612
1613 /*-------------------------------------------------------------------------*/
1614
1615 static int verify_not_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
1616 {
1617         int     retval;
1618         u16     status;
1619
1620         /* shouldn't look or act halted */
1621         retval = usb_get_status(urb->dev, USB_RECIP_ENDPOINT, ep, &status);
1622         if (retval < 0) {
1623                 ERROR(tdev, "ep %02x couldn't get no-halt status, %d\n",
1624                                 ep, retval);
1625                 return retval;
1626         }
1627         if (status != 0) {
1628                 ERROR(tdev, "ep %02x bogus status: %04x != 0\n", ep, status);
1629                 return -EINVAL;
1630         }
1631         retval = simple_io(tdev, urb, 1, 0, 0, __func__);
1632         if (retval != 0)
1633                 return -EINVAL;
1634         return 0;
1635 }
1636
1637 static int verify_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
1638 {
1639         int     retval;
1640         u16     status;
1641
1642         /* should look and act halted */
1643         retval = usb_get_status(urb->dev, USB_RECIP_ENDPOINT, ep, &status);
1644         if (retval < 0) {
1645                 ERROR(tdev, "ep %02x couldn't get halt status, %d\n",
1646                                 ep, retval);
1647                 return retval;
1648         }
1649         if (status != 1) {
1650                 ERROR(tdev, "ep %02x bogus status: %04x != 1\n", ep, status);
1651                 return -EINVAL;
1652         }
1653         retval = simple_io(tdev, urb, 1, 0, -EPIPE, __func__);
1654         if (retval != -EPIPE)
1655                 return -EINVAL;
1656         retval = simple_io(tdev, urb, 1, 0, -EPIPE, "verify_still_halted");
1657         if (retval != -EPIPE)
1658                 return -EINVAL;
1659         return 0;
1660 }
1661
1662 static int test_halt(struct usbtest_dev *tdev, int ep, struct urb *urb)
1663 {
1664         int     retval;
1665
1666         /* shouldn't look or act halted now */
1667         retval = verify_not_halted(tdev, ep, urb);
1668         if (retval < 0)
1669                 return retval;
1670
1671         /* set halt (protocol test only), verify it worked */
1672         retval = usb_control_msg(urb->dev, usb_sndctrlpipe(urb->dev, 0),
1673                         USB_REQ_SET_FEATURE, USB_RECIP_ENDPOINT,
1674                         USB_ENDPOINT_HALT, ep,
1675                         NULL, 0, USB_CTRL_SET_TIMEOUT);
1676         if (retval < 0) {
1677                 ERROR(tdev, "ep %02x couldn't set halt, %d\n", ep, retval);
1678                 return retval;
1679         }
1680         retval = verify_halted(tdev, ep, urb);
1681         if (retval < 0) {
1682                 int ret;
1683
1684                 /* clear halt anyways, else further tests will fail */
1685                 ret = usb_clear_halt(urb->dev, urb->pipe);
1686                 if (ret)
1687                         ERROR(tdev, "ep %02x couldn't clear halt, %d\n",
1688                               ep, ret);
1689
1690                 return retval;
1691         }
1692
1693         /* clear halt (tests API + protocol), verify it worked */
1694         retval = usb_clear_halt(urb->dev, urb->pipe);
1695         if (retval < 0) {
1696                 ERROR(tdev, "ep %02x couldn't clear halt, %d\n", ep, retval);
1697                 return retval;
1698         }
1699         retval = verify_not_halted(tdev, ep, urb);
1700         if (retval < 0)
1701                 return retval;
1702
1703         /* NOTE:  could also verify SET_INTERFACE clear halts ... */
1704
1705         return 0;
1706 }
1707
1708 static int halt_simple(struct usbtest_dev *dev)
1709 {
1710         int                     ep;
1711         int                     retval = 0;
1712         struct urb              *urb;
1713         struct usb_device       *udev = testdev_to_usbdev(dev);
1714
1715         if (udev->speed == USB_SPEED_SUPER)
1716                 urb = simple_alloc_urb(udev, 0, 1024, 0);
1717         else
1718                 urb = simple_alloc_urb(udev, 0, 512, 0);
1719         if (urb == NULL)
1720                 return -ENOMEM;
1721
1722         if (dev->in_pipe) {
1723                 ep = usb_pipeendpoint(dev->in_pipe) | USB_DIR_IN;
1724                 urb->pipe = dev->in_pipe;
1725                 retval = test_halt(dev, ep, urb);
1726                 if (retval < 0)
1727                         goto done;
1728         }
1729
1730         if (dev->out_pipe) {
1731                 ep = usb_pipeendpoint(dev->out_pipe);
1732                 urb->pipe = dev->out_pipe;
1733                 retval = test_halt(dev, ep, urb);
1734         }
1735 done:
1736         simple_free_urb(urb);
1737         return retval;
1738 }
1739
1740 /*-------------------------------------------------------------------------*/
1741
1742 /* Control OUT tests use the vendor control requests from Intel's
1743  * USB 2.0 compliance test device:  write a buffer, read it back.
1744  *
1745  * Intel's spec only _requires_ that it work for one packet, which
1746  * is pretty weak.   Some HCDs place limits here; most devices will
1747  * need to be able to handle more than one OUT data packet.  We'll
1748  * try whatever we're told to try.
1749  */
1750 static int ctrl_out(struct usbtest_dev *dev,
1751                 unsigned count, unsigned length, unsigned vary, unsigned offset)
1752 {
1753         unsigned                i, j, len;
1754         int                     retval;
1755         u8                      *buf;
1756         char                    *what = "?";
1757         struct usb_device       *udev;
1758
1759         if (length < 1 || length > 0xffff || vary >= length)
1760                 return -EINVAL;
1761
1762         buf = kmalloc(length + offset, GFP_KERNEL);
1763         if (!buf)
1764                 return -ENOMEM;
1765
1766         buf += offset;
1767         udev = testdev_to_usbdev(dev);
1768         len = length;
1769         retval = 0;
1770
1771         /* NOTE:  hardware might well act differently if we pushed it
1772          * with lots back-to-back queued requests.
1773          */
1774         for (i = 0; i < count; i++) {
1775                 /* write patterned data */
1776                 for (j = 0; j < len; j++)
1777                         buf[j] = (u8)(i + j);
1778                 retval = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
1779                                 0x5b, USB_DIR_OUT|USB_TYPE_VENDOR,
1780                                 0, 0, buf, len, USB_CTRL_SET_TIMEOUT);
1781                 if (retval != len) {
1782                         what = "write";
1783                         if (retval >= 0) {
1784                                 ERROR(dev, "ctrl_out, wlen %d (expected %d)\n",
1785                                                 retval, len);
1786                                 retval = -EBADMSG;
1787                         }
1788                         break;
1789                 }
1790
1791                 /* read it back -- assuming nothing intervened!!  */
1792                 retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
1793                                 0x5c, USB_DIR_IN|USB_TYPE_VENDOR,
1794                                 0, 0, buf, len, USB_CTRL_GET_TIMEOUT);
1795                 if (retval != len) {
1796                         what = "read";
1797                         if (retval >= 0) {
1798                                 ERROR(dev, "ctrl_out, rlen %d (expected %d)\n",
1799                                                 retval, len);
1800                                 retval = -EBADMSG;
1801                         }
1802                         break;
1803                 }
1804
1805                 /* fail if we can't verify */
1806                 for (j = 0; j < len; j++) {
1807                         if (buf[j] != (u8)(i + j)) {
1808                                 ERROR(dev, "ctrl_out, byte %d is %d not %d\n",
1809                                         j, buf[j], (u8)(i + j));
1810                                 retval = -EBADMSG;
1811                                 break;
1812                         }
1813                 }
1814                 if (retval < 0) {
1815                         what = "verify";
1816                         break;
1817                 }
1818
1819                 len += vary;
1820
1821                 /* [real world] the "zero bytes IN" case isn't really used.
1822                  * hardware can easily trip up in this weird case, since its
1823                  * status stage is IN, not OUT like other ep0in transfers.
1824                  */
1825                 if (len > length)
1826                         len = realworld ? 1 : 0;
1827         }
1828
1829         if (retval < 0)
1830                 ERROR(dev, "ctrl_out %s failed, code %d, count %d\n",
1831                         what, retval, i);
1832
1833         kfree(buf - offset);
1834         return retval;
1835 }
1836
1837 /*-------------------------------------------------------------------------*/
1838
1839 /* ISO/BULK tests ... mimics common usage
1840  *  - buffer length is split into N packets (mostly maxpacket sized)
1841  *  - multi-buffers according to sglen
1842  */
1843
1844 struct transfer_context {
1845         unsigned                count;
1846         unsigned                pending;
1847         spinlock_t              lock;
1848         struct completion       done;
1849         int                     submit_error;
1850         unsigned long           errors;
1851         unsigned long           packet_count;
1852         struct usbtest_dev      *dev;
1853         bool                    is_iso;
1854 };
1855
1856 static void complicated_callback(struct urb *urb)
1857 {
1858         struct transfer_context *ctx = urb->context;
1859
1860         spin_lock(&ctx->lock);
1861         ctx->count--;
1862
1863         ctx->packet_count += urb->number_of_packets;
1864         if (urb->error_count > 0)
1865                 ctx->errors += urb->error_count;
1866         else if (urb->status != 0)
1867                 ctx->errors += (ctx->is_iso ? urb->number_of_packets : 1);
1868         else if (urb->actual_length != urb->transfer_buffer_length)
1869                 ctx->errors++;
1870         else if (check_guard_bytes(ctx->dev, urb) != 0)
1871                 ctx->errors++;
1872
1873         if (urb->status == 0 && ctx->count > (ctx->pending - 1)
1874                         && !ctx->submit_error) {
1875                 int status = usb_submit_urb(urb, GFP_ATOMIC);
1876                 switch (status) {
1877                 case 0:
1878                         goto done;
1879                 default:
1880                         dev_err(&ctx->dev->intf->dev,
1881                                         "resubmit err %d\n",
1882                                         status);
1883                         /* FALLTHROUGH */
1884                 case -ENODEV:                   /* disconnected */
1885                 case -ESHUTDOWN:                /* endpoint disabled */
1886                         ctx->submit_error = 1;
1887                         break;
1888                 }
1889         }
1890
1891         ctx->pending--;
1892         if (ctx->pending == 0) {
1893                 if (ctx->errors)
1894                         dev_err(&ctx->dev->intf->dev,
1895                                 "during the test, %lu errors out of %lu\n",
1896                                 ctx->errors, ctx->packet_count);
1897                 complete(&ctx->done);
1898         }
1899 done:
1900         spin_unlock(&ctx->lock);
1901 }
1902
1903 static struct urb *iso_alloc_urb(
1904         struct usb_device       *udev,
1905         int                     pipe,
1906         struct usb_endpoint_descriptor  *desc,
1907         long                    bytes,
1908         unsigned offset
1909 )
1910 {
1911         struct urb              *urb;
1912         unsigned                i, maxp, packets;
1913
1914         if (bytes < 0 || !desc)
1915                 return NULL;
1916         maxp = 0x7ff & usb_endpoint_maxp(desc);
1917         maxp *= 1 + (0x3 & (usb_endpoint_maxp(desc) >> 11));
1918         packets = DIV_ROUND_UP(bytes, maxp);
1919
1920         urb = usb_alloc_urb(packets, GFP_KERNEL);
1921         if (!urb)
1922                 return urb;
1923         urb->dev = udev;
1924         urb->pipe = pipe;
1925
1926         urb->number_of_packets = packets;
1927         urb->transfer_buffer_length = bytes;
1928         urb->transfer_buffer = usb_alloc_coherent(udev, bytes + offset,
1929                                                         GFP_KERNEL,
1930                                                         &urb->transfer_dma);
1931         if (!urb->transfer_buffer) {
1932                 usb_free_urb(urb);
1933                 return NULL;
1934         }
1935         if (offset) {
1936                 memset(urb->transfer_buffer, GUARD_BYTE, offset);
1937                 urb->transfer_buffer += offset;
1938                 urb->transfer_dma += offset;
1939         }
1940         /* For inbound transfers use guard byte so that test fails if
1941                 data not correctly copied */
1942         memset(urb->transfer_buffer,
1943                         usb_pipein(urb->pipe) ? GUARD_BYTE : 0,
1944                         bytes);
1945
1946         for (i = 0; i < packets; i++) {
1947                 /* here, only the last packet will be short */
1948                 urb->iso_frame_desc[i].length = min((unsigned) bytes, maxp);
1949                 bytes -= urb->iso_frame_desc[i].length;
1950
1951                 urb->iso_frame_desc[i].offset = maxp * i;
1952         }
1953
1954         urb->complete = complicated_callback;
1955         /* urb->context = SET BY CALLER */
1956         urb->interval = 1 << (desc->bInterval - 1);
1957         urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
1958         return urb;
1959 }
1960
1961 static int
1962 test_queue(struct usbtest_dev *dev, struct usbtest_param_32 *param,
1963                 int pipe, struct usb_endpoint_descriptor *desc, unsigned offset)
1964 {
1965         struct transfer_context context;
1966         struct usb_device       *udev;
1967         unsigned                i;
1968         unsigned long           packets = 0;
1969         int                     status = 0;
1970         struct urb              *urbs[param->sglen];
1971
1972         memset(&context, 0, sizeof(context));
1973         context.count = param->iterations * param->sglen;
1974         context.dev = dev;
1975         context.is_iso = !!desc;
1976         init_completion(&context.done);
1977         spin_lock_init(&context.lock);
1978
1979         udev = testdev_to_usbdev(dev);
1980
1981         for (i = 0; i < param->sglen; i++) {
1982                 if (context.is_iso)
1983                         urbs[i] = iso_alloc_urb(udev, pipe, desc,
1984                                         param->length, offset);
1985                 else
1986                         urbs[i] = complicated_alloc_urb(udev, pipe,
1987                                         param->length, 0);
1988
1989                 if (!urbs[i]) {
1990                         status = -ENOMEM;
1991                         goto fail;
1992                 }
1993                 packets += urbs[i]->number_of_packets;
1994                 urbs[i]->context = &context;
1995         }
1996         packets *= param->iterations;
1997
1998         if (context.is_iso) {
1999                 dev_info(&dev->intf->dev,
2000                         "iso period %d %sframes, wMaxPacket %d, transactions: %d\n",
2001                         1 << (desc->bInterval - 1),
2002                         (udev->speed == USB_SPEED_HIGH) ? "micro" : "",
2003                         usb_endpoint_maxp(desc) & 0x7ff,
2004                         1 + (0x3 & (usb_endpoint_maxp(desc) >> 11)));
2005
2006                 dev_info(&dev->intf->dev,
2007                         "total %lu msec (%lu packets)\n",
2008                         (packets * (1 << (desc->bInterval - 1)))
2009                                 / ((udev->speed == USB_SPEED_HIGH) ? 8 : 1),
2010                         packets);
2011         }
2012
2013         spin_lock_irq(&context.lock);
2014         for (i = 0; i < param->sglen; i++) {
2015                 ++context.pending;
2016                 status = usb_submit_urb(urbs[i], GFP_ATOMIC);
2017                 if (status < 0) {
2018                         ERROR(dev, "submit iso[%d], error %d\n", i, status);
2019                         if (i == 0) {
2020                                 spin_unlock_irq(&context.lock);
2021                                 goto fail;
2022                         }
2023
2024                         simple_free_urb(urbs[i]);
2025                         urbs[i] = NULL;
2026                         context.pending--;
2027                         context.submit_error = 1;
2028                         break;
2029                 }
2030         }
2031         spin_unlock_irq(&context.lock);
2032
2033         wait_for_completion(&context.done);
2034
2035         for (i = 0; i < param->sglen; i++) {
2036                 if (urbs[i])
2037                         simple_free_urb(urbs[i]);
2038         }
2039         /*
2040          * Isochronous transfers are expected to fail sometimes.  As an
2041          * arbitrary limit, we will report an error if any submissions
2042          * fail or if the transfer failure rate is > 10%.
2043          */
2044         if (status != 0)
2045                 ;
2046         else if (context.submit_error)
2047                 status = -EACCES;
2048         else if (context.errors >
2049                         (context.is_iso ? context.packet_count / 10 : 0))
2050                 status = -EIO;
2051         return status;
2052
2053 fail:
2054         for (i = 0; i < param->sglen; i++) {
2055                 if (urbs[i])
2056                         simple_free_urb(urbs[i]);
2057         }
2058         return status;
2059 }
2060
2061 static int test_unaligned_bulk(
2062         struct usbtest_dev *tdev,
2063         int pipe,
2064         unsigned length,
2065         int iterations,
2066         unsigned transfer_flags,
2067         const char *label)
2068 {
2069         int retval;
2070         struct urb *urb = usbtest_alloc_urb(testdev_to_usbdev(tdev),
2071                         pipe, length, transfer_flags, 1, 0, simple_callback);
2072
2073         if (!urb)
2074                 return -ENOMEM;
2075
2076         retval = simple_io(tdev, urb, iterations, 0, 0, label);
2077         simple_free_urb(urb);
2078         return retval;
2079 }
2080
2081 /* Run tests. */
2082 static int
2083 usbtest_do_ioctl(struct usb_interface *intf, struct usbtest_param_32 *param)
2084 {
2085         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2086         struct usb_device       *udev = testdev_to_usbdev(dev);
2087         struct urb              *urb;
2088         struct scatterlist      *sg;
2089         struct usb_sg_request   req;
2090         unsigned                i;
2091         int     retval = -EOPNOTSUPP;
2092
2093         if (param->iterations <= 0)
2094                 return -EINVAL;
2095         /*
2096          * Just a bunch of test cases that every HCD is expected to handle.
2097          *
2098          * Some may need specific firmware, though it'd be good to have
2099          * one firmware image to handle all the test cases.
2100          *
2101          * FIXME add more tests!  cancel requests, verify the data, control
2102          * queueing, concurrent read+write threads, and so on.
2103          */
2104         switch (param->test_num) {
2105
2106         case 0:
2107                 dev_info(&intf->dev, "TEST 0:  NOP\n");
2108                 retval = 0;
2109                 break;
2110
2111         /* Simple non-queued bulk I/O tests */
2112         case 1:
2113                 if (dev->out_pipe == 0)
2114                         break;
2115                 dev_info(&intf->dev,
2116                                 "TEST 1:  write %d bytes %u times\n",
2117                                 param->length, param->iterations);
2118                 urb = simple_alloc_urb(udev, dev->out_pipe, param->length, 0);
2119                 if (!urb) {
2120                         retval = -ENOMEM;
2121                         break;
2122                 }
2123                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2124                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test1");
2125                 simple_free_urb(urb);
2126                 break;
2127         case 2:
2128                 if (dev->in_pipe == 0)
2129                         break;
2130                 dev_info(&intf->dev,
2131                                 "TEST 2:  read %d bytes %u times\n",
2132                                 param->length, param->iterations);
2133                 urb = simple_alloc_urb(udev, dev->in_pipe, param->length, 0);
2134                 if (!urb) {
2135                         retval = -ENOMEM;
2136                         break;
2137                 }
2138                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2139                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test2");
2140                 simple_free_urb(urb);
2141                 break;
2142         case 3:
2143                 if (dev->out_pipe == 0 || param->vary == 0)
2144                         break;
2145                 dev_info(&intf->dev,
2146                                 "TEST 3:  write/%d 0..%d bytes %u times\n",
2147                                 param->vary, param->length, param->iterations);
2148                 urb = simple_alloc_urb(udev, dev->out_pipe, param->length, 0);
2149                 if (!urb) {
2150                         retval = -ENOMEM;
2151                         break;
2152                 }
2153                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2154                 retval = simple_io(dev, urb, param->iterations, param->vary,
2155                                         0, "test3");
2156                 simple_free_urb(urb);
2157                 break;
2158         case 4:
2159                 if (dev->in_pipe == 0 || param->vary == 0)
2160                         break;
2161                 dev_info(&intf->dev,
2162                                 "TEST 4:  read/%d 0..%d bytes %u times\n",
2163                                 param->vary, param->length, param->iterations);
2164                 urb = simple_alloc_urb(udev, dev->in_pipe, param->length, 0);
2165                 if (!urb) {
2166                         retval = -ENOMEM;
2167                         break;
2168                 }
2169                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2170                 retval = simple_io(dev, urb, param->iterations, param->vary,
2171                                         0, "test4");
2172                 simple_free_urb(urb);
2173                 break;
2174
2175         /* Queued bulk I/O tests */
2176         case 5:
2177                 if (dev->out_pipe == 0 || param->sglen == 0)
2178                         break;
2179                 dev_info(&intf->dev,
2180                         "TEST 5:  write %d sglists %d entries of %d bytes\n",
2181                                 param->iterations,
2182                                 param->sglen, param->length);
2183                 sg = alloc_sglist(param->sglen, param->length,
2184                                 0, dev, dev->out_pipe);
2185                 if (!sg) {
2186                         retval = -ENOMEM;
2187                         break;
2188                 }
2189                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2190                 retval = perform_sglist(dev, param->iterations, dev->out_pipe,
2191                                 &req, sg, param->sglen);
2192                 free_sglist(sg, param->sglen);
2193                 break;
2194
2195         case 6:
2196                 if (dev->in_pipe == 0 || param->sglen == 0)
2197                         break;
2198                 dev_info(&intf->dev,
2199                         "TEST 6:  read %d sglists %d entries of %d bytes\n",
2200                                 param->iterations,
2201                                 param->sglen, param->length);
2202                 sg = alloc_sglist(param->sglen, param->length,
2203                                 0, dev, dev->in_pipe);
2204                 if (!sg) {
2205                         retval = -ENOMEM;
2206                         break;
2207                 }
2208                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2209                 retval = perform_sglist(dev, param->iterations, dev->in_pipe,
2210                                 &req, sg, param->sglen);
2211                 free_sglist(sg, param->sglen);
2212                 break;
2213         case 7:
2214                 if (dev->out_pipe == 0 || param->sglen == 0 || param->vary == 0)
2215                         break;
2216                 dev_info(&intf->dev,
2217                         "TEST 7:  write/%d %d sglists %d entries 0..%d bytes\n",
2218                                 param->vary, param->iterations,
2219                                 param->sglen, param->length);
2220                 sg = alloc_sglist(param->sglen, param->length,
2221                                 param->vary, dev, dev->out_pipe);
2222                 if (!sg) {
2223                         retval = -ENOMEM;
2224                         break;
2225                 }
2226                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2227                 retval = perform_sglist(dev, param->iterations, dev->out_pipe,
2228                                 &req, sg, param->sglen);
2229                 free_sglist(sg, param->sglen);
2230                 break;
2231         case 8:
2232                 if (dev->in_pipe == 0 || param->sglen == 0 || param->vary == 0)
2233                         break;
2234                 dev_info(&intf->dev,
2235                         "TEST 8:  read/%d %d sglists %d entries 0..%d bytes\n",
2236                                 param->vary, param->iterations,
2237                                 param->sglen, param->length);
2238                 sg = alloc_sglist(param->sglen, param->length,
2239                                 param->vary, dev, dev->in_pipe);
2240                 if (!sg) {
2241                         retval = -ENOMEM;
2242                         break;
2243                 }
2244                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2245                 retval = perform_sglist(dev, param->iterations, dev->in_pipe,
2246                                 &req, sg, param->sglen);
2247                 free_sglist(sg, param->sglen);
2248                 break;
2249
2250         /* non-queued sanity tests for control (chapter 9 subset) */
2251         case 9:
2252                 retval = 0;
2253                 dev_info(&intf->dev,
2254                         "TEST 9:  ch9 (subset) control tests, %d times\n",
2255                                 param->iterations);
2256                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2257                         retval = ch9_postconfig(dev);
2258                 if (retval)
2259                         dev_err(&intf->dev, "ch9 subset failed, "
2260                                         "iterations left %d\n", i);
2261                 break;
2262
2263         /* queued control messaging */
2264         case 10:
2265                 retval = 0;
2266                 dev_info(&intf->dev,
2267                                 "TEST 10:  queue %d control calls, %d times\n",
2268                                 param->sglen,
2269                                 param->iterations);
2270                 retval = test_ctrl_queue(dev, param);
2271                 break;
2272
2273         /* simple non-queued unlinks (ring with one urb) */
2274         case 11:
2275                 if (dev->in_pipe == 0 || !param->length)
2276                         break;
2277                 retval = 0;
2278                 dev_info(&intf->dev, "TEST 11:  unlink %d reads of %d\n",
2279                                 param->iterations, param->length);
2280                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2281                         retval = unlink_simple(dev, dev->in_pipe,
2282                                                 param->length);
2283                 if (retval)
2284                         dev_err(&intf->dev, "unlink reads failed %d, "
2285                                 "iterations left %d\n", retval, i);
2286                 break;
2287         case 12:
2288                 if (dev->out_pipe == 0 || !param->length)
2289                         break;
2290                 retval = 0;
2291                 dev_info(&intf->dev, "TEST 12:  unlink %d writes of %d\n",
2292                                 param->iterations, param->length);
2293                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2294                         retval = unlink_simple(dev, dev->out_pipe,
2295                                                 param->length);
2296                 if (retval)
2297                         dev_err(&intf->dev, "unlink writes failed %d, "
2298                                 "iterations left %d\n", retval, i);
2299                 break;
2300
2301         /* ep halt tests */
2302         case 13:
2303                 if (dev->out_pipe == 0 && dev->in_pipe == 0)
2304                         break;
2305                 retval = 0;
2306                 dev_info(&intf->dev, "TEST 13:  set/clear %d halts\n",
2307                                 param->iterations);
2308                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2309                         retval = halt_simple(dev);
2310
2311                 if (retval)
2312                         ERROR(dev, "halts failed, iterations left %d\n", i);
2313                 break;
2314
2315         /* control write tests */
2316         case 14:
2317                 if (!dev->info->ctrl_out)
2318                         break;
2319                 dev_info(&intf->dev, "TEST 14:  %d ep0out, %d..%d vary %d\n",
2320                                 param->iterations,
2321                                 realworld ? 1 : 0, param->length,
2322                                 param->vary);
2323                 retval = ctrl_out(dev, param->iterations,
2324                                 param->length, param->vary, 0);
2325                 break;
2326
2327         /* iso write tests */
2328         case 15:
2329                 if (dev->out_iso_pipe == 0 || param->sglen == 0)
2330                         break;
2331                 dev_info(&intf->dev,
2332                         "TEST 15:  write %d iso, %d entries of %d bytes\n",
2333                                 param->iterations,
2334                                 param->sglen, param->length);
2335                 /* FIRMWARE:  iso sink */
2336                 retval = test_queue(dev, param,
2337                                 dev->out_iso_pipe, dev->iso_out, 0);
2338                 break;
2339
2340         /* iso read tests */
2341         case 16:
2342                 if (dev->in_iso_pipe == 0 || param->sglen == 0)
2343                         break;
2344                 dev_info(&intf->dev,
2345                         "TEST 16:  read %d iso, %d entries of %d bytes\n",
2346                                 param->iterations,
2347                                 param->sglen, param->length);
2348                 /* FIRMWARE:  iso source */
2349                 retval = test_queue(dev, param,
2350                                 dev->in_iso_pipe, dev->iso_in, 0);
2351                 break;
2352
2353         /* FIXME scatterlist cancel (needs helper thread) */
2354
2355         /* Tests for bulk I/O using DMA mapping by core and odd address */
2356         case 17:
2357                 if (dev->out_pipe == 0)
2358                         break;
2359                 dev_info(&intf->dev,
2360                         "TEST 17:  write odd addr %d bytes %u times core map\n",
2361                         param->length, param->iterations);
2362
2363                 retval = test_unaligned_bulk(
2364                                 dev, dev->out_pipe,
2365                                 param->length, param->iterations,
2366                                 0, "test17");
2367                 break;
2368
2369         case 18:
2370                 if (dev->in_pipe == 0)
2371                         break;
2372                 dev_info(&intf->dev,
2373                         "TEST 18:  read odd addr %d bytes %u times core map\n",
2374                         param->length, param->iterations);
2375
2376                 retval = test_unaligned_bulk(
2377                                 dev, dev->in_pipe,
2378                                 param->length, param->iterations,
2379                                 0, "test18");
2380                 break;
2381
2382         /* Tests for bulk I/O using premapped coherent buffer and odd address */
2383         case 19:
2384                 if (dev->out_pipe == 0)
2385                         break;
2386                 dev_info(&intf->dev,
2387                         "TEST 19:  write odd addr %d bytes %u times premapped\n",
2388                         param->length, param->iterations);
2389
2390                 retval = test_unaligned_bulk(
2391                                 dev, dev->out_pipe,
2392                                 param->length, param->iterations,
2393                                 URB_NO_TRANSFER_DMA_MAP, "test19");
2394                 break;
2395
2396         case 20:
2397                 if (dev->in_pipe == 0)
2398                         break;
2399                 dev_info(&intf->dev,
2400                         "TEST 20:  read odd addr %d bytes %u times premapped\n",
2401                         param->length, param->iterations);
2402
2403                 retval = test_unaligned_bulk(
2404                                 dev, dev->in_pipe,
2405                                 param->length, param->iterations,
2406                                 URB_NO_TRANSFER_DMA_MAP, "test20");
2407                 break;
2408
2409         /* control write tests with unaligned buffer */
2410         case 21:
2411                 if (!dev->info->ctrl_out)
2412                         break;
2413                 dev_info(&intf->dev,
2414                                 "TEST 21:  %d ep0out odd addr, %d..%d vary %d\n",
2415                                 param->iterations,
2416                                 realworld ? 1 : 0, param->length,
2417                                 param->vary);
2418                 retval = ctrl_out(dev, param->iterations,
2419                                 param->length, param->vary, 1);
2420                 break;
2421
2422         /* unaligned iso tests */
2423         case 22:
2424                 if (dev->out_iso_pipe == 0 || param->sglen == 0)
2425                         break;
2426                 dev_info(&intf->dev,
2427                         "TEST 22:  write %d iso odd, %d entries of %d bytes\n",
2428                                 param->iterations,
2429                                 param->sglen, param->length);
2430                 retval = test_queue(dev, param,
2431                                 dev->out_iso_pipe, dev->iso_out, 1);
2432                 break;
2433
2434         case 23:
2435                 if (dev->in_iso_pipe == 0 || param->sglen == 0)
2436                         break;
2437                 dev_info(&intf->dev,
2438                         "TEST 23:  read %d iso odd, %d entries of %d bytes\n",
2439                                 param->iterations,
2440                                 param->sglen, param->length);
2441                 retval = test_queue(dev, param,
2442                                 dev->in_iso_pipe, dev->iso_in, 1);
2443                 break;
2444
2445         /* unlink URBs from a bulk-OUT queue */
2446         case 24:
2447                 if (dev->out_pipe == 0 || !param->length || param->sglen < 4)
2448                         break;
2449                 retval = 0;
2450                 dev_info(&intf->dev, "TEST 24:  unlink from %d queues of "
2451                                 "%d %d-byte writes\n",
2452                                 param->iterations, param->sglen, param->length);
2453                 for (i = param->iterations; retval == 0 && i > 0; --i) {
2454                         retval = unlink_queued(dev, dev->out_pipe,
2455                                                 param->sglen, param->length);
2456                         if (retval) {
2457                                 dev_err(&intf->dev,
2458                                         "unlink queued writes failed %d, "
2459                                         "iterations left %d\n", retval, i);
2460                                 break;
2461                         }
2462                 }
2463                 break;
2464
2465         /* Simple non-queued interrupt I/O tests */
2466         case 25:
2467                 if (dev->out_int_pipe == 0)
2468                         break;
2469                 dev_info(&intf->dev,
2470                                 "TEST 25: write %d bytes %u times\n",
2471                                 param->length, param->iterations);
2472                 urb = simple_alloc_urb(udev, dev->out_int_pipe, param->length,
2473                                 dev->int_out->bInterval);
2474                 if (!urb) {
2475                         retval = -ENOMEM;
2476                         break;
2477                 }
2478                 /* FIRMWARE: interrupt sink (maybe accepts short writes) */
2479                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test25");
2480                 simple_free_urb(urb);
2481                 break;
2482         case 26:
2483                 if (dev->in_int_pipe == 0)
2484                         break;
2485                 dev_info(&intf->dev,
2486                                 "TEST 26: read %d bytes %u times\n",
2487                                 param->length, param->iterations);
2488                 urb = simple_alloc_urb(udev, dev->in_int_pipe, param->length,
2489                                 dev->int_in->bInterval);
2490                 if (!urb) {
2491                         retval = -ENOMEM;
2492                         break;
2493                 }
2494                 /* FIRMWARE: interrupt source (maybe generates short writes) */
2495                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test26");
2496                 simple_free_urb(urb);
2497                 break;
2498         case 27:
2499                 /* We do performance test, so ignore data compare */
2500                 if (dev->out_pipe == 0 || param->sglen == 0 || pattern != 0)
2501                         break;
2502                 dev_info(&intf->dev,
2503                         "TEST 27: bulk write %dMbytes\n", (param->iterations *
2504                         param->sglen * param->length) / (1024 * 1024));
2505                 retval = test_queue(dev, param,
2506                                 dev->out_pipe, NULL, 0);
2507                 break;
2508         case 28:
2509                 if (dev->in_pipe == 0 || param->sglen == 0 || pattern != 0)
2510                         break;
2511                 dev_info(&intf->dev,
2512                         "TEST 28: bulk read %dMbytes\n", (param->iterations *
2513                         param->sglen * param->length) / (1024 * 1024));
2514                 retval = test_queue(dev, param,
2515                                 dev->in_pipe, NULL, 0);
2516                 break;
2517         }
2518         return retval;
2519 }
2520
2521 /*-------------------------------------------------------------------------*/
2522
2523 /* We only have this one interface to user space, through usbfs.
2524  * User mode code can scan usbfs to find N different devices (maybe on
2525  * different busses) to use when testing, and allocate one thread per
2526  * test.  So discovery is simplified, and we have no device naming issues.
2527  *
2528  * Don't use these only as stress/load tests.  Use them along with with
2529  * other USB bus activity:  plugging, unplugging, mousing, mp3 playback,
2530  * video capture, and so on.  Run different tests at different times, in
2531  * different sequences.  Nothing here should interact with other devices,
2532  * except indirectly by consuming USB bandwidth and CPU resources for test
2533  * threads and request completion.  But the only way to know that for sure
2534  * is to test when HC queues are in use by many devices.
2535  *
2536  * WARNING:  Because usbfs grabs udev->dev.sem before calling this ioctl(),
2537  * it locks out usbcore in certain code paths.  Notably, if you disconnect
2538  * the device-under-test, hub_wq will wait block forever waiting for the
2539  * ioctl to complete ... so that usb_disconnect() can abort the pending
2540  * urbs and then call usbtest_disconnect().  To abort a test, you're best
2541  * off just killing the userspace task and waiting for it to exit.
2542  */
2543
2544 static int
2545 usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
2546 {
2547
2548         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2549         struct usbtest_param_64 *param_64 = buf;
2550         struct usbtest_param_32 temp;
2551         struct usbtest_param_32 *param_32 = buf;
2552         struct timespec64 start;
2553         struct timespec64 end;
2554         struct timespec64 duration;
2555         int retval = -EOPNOTSUPP;
2556
2557         /* FIXME USBDEVFS_CONNECTINFO doesn't say how fast the device is. */
2558
2559         pattern = mod_pattern;
2560
2561         if (mutex_lock_interruptible(&dev->lock))
2562                 return -ERESTARTSYS;
2563
2564         /* FIXME: What if a system sleep starts while a test is running? */
2565
2566         /* some devices, like ez-usb default devices, need a non-default
2567          * altsetting to have any active endpoints.  some tests change
2568          * altsettings; force a default so most tests don't need to check.
2569          */
2570         if (dev->info->alt >= 0) {
2571                 if (intf->altsetting->desc.bInterfaceNumber) {
2572                         retval = -ENODEV;
2573                         goto free_mutex;
2574                 }
2575                 retval = set_altsetting(dev, dev->info->alt);
2576                 if (retval) {
2577                         dev_err(&intf->dev,
2578                                         "set altsetting to %d failed, %d\n",
2579                                         dev->info->alt, retval);
2580                         goto free_mutex;
2581                 }
2582         }
2583
2584         switch (code) {
2585         case USBTEST_REQUEST_64:
2586                 temp.test_num = param_64->test_num;
2587                 temp.iterations = param_64->iterations;
2588                 temp.length = param_64->length;
2589                 temp.sglen = param_64->sglen;
2590                 temp.vary = param_64->vary;
2591                 param_32 = &temp;
2592                 break;
2593
2594         case USBTEST_REQUEST_32:
2595                 break;
2596
2597         default:
2598                 retval = -EOPNOTSUPP;
2599                 goto free_mutex;
2600         }
2601
2602         ktime_get_ts64(&start);
2603
2604         retval = usbtest_do_ioctl(intf, param_32);
2605         if (retval)
2606                 goto free_mutex;
2607
2608         ktime_get_ts64(&end);
2609
2610         duration = timespec64_sub(end, start);
2611
2612         temp.duration_sec = duration.tv_sec;
2613         temp.duration_usec = duration.tv_nsec/NSEC_PER_USEC;
2614
2615         switch (code) {
2616         case USBTEST_REQUEST_32:
2617                 param_32->duration_sec = temp.duration_sec;
2618                 param_32->duration_usec = temp.duration_usec;
2619                 break;
2620
2621         case USBTEST_REQUEST_64:
2622                 param_64->duration_sec = temp.duration_sec;
2623                 param_64->duration_usec = temp.duration_usec;
2624                 break;
2625         }
2626
2627 free_mutex:
2628         mutex_unlock(&dev->lock);
2629         return retval;
2630 }
2631
2632 /*-------------------------------------------------------------------------*/
2633
2634 static unsigned force_interrupt;
2635 module_param(force_interrupt, uint, 0);
2636 MODULE_PARM_DESC(force_interrupt, "0 = test default; else interrupt");
2637
2638 #ifdef  GENERIC
2639 static unsigned short vendor;
2640 module_param(vendor, ushort, 0);
2641 MODULE_PARM_DESC(vendor, "vendor code (from usb-if)");
2642
2643 static unsigned short product;
2644 module_param(product, ushort, 0);
2645 MODULE_PARM_DESC(product, "product code (from vendor)");
2646 #endif
2647
2648 static int
2649 usbtest_probe(struct usb_interface *intf, const struct usb_device_id *id)
2650 {
2651         struct usb_device       *udev;
2652         struct usbtest_dev      *dev;
2653         struct usbtest_info     *info;
2654         char                    *rtest, *wtest;
2655         char                    *irtest, *iwtest;
2656         char                    *intrtest, *intwtest;
2657
2658         udev = interface_to_usbdev(intf);
2659
2660 #ifdef  GENERIC
2661         /* specify devices by module parameters? */
2662         if (id->match_flags == 0) {
2663                 /* vendor match required, product match optional */
2664                 if (!vendor || le16_to_cpu(udev->descriptor.idVendor) != (u16)vendor)
2665                         return -ENODEV;
2666                 if (product && le16_to_cpu(udev->descriptor.idProduct) != (u16)product)
2667                         return -ENODEV;
2668                 dev_info(&intf->dev, "matched module params, "
2669                                         "vend=0x%04x prod=0x%04x\n",
2670                                 le16_to_cpu(udev->descriptor.idVendor),
2671                                 le16_to_cpu(udev->descriptor.idProduct));
2672         }
2673 #endif
2674
2675         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
2676         if (!dev)
2677                 return -ENOMEM;
2678         info = (struct usbtest_info *) id->driver_info;
2679         dev->info = info;
2680         mutex_init(&dev->lock);
2681
2682         dev->intf = intf;
2683
2684         /* cacheline-aligned scratch for i/o */
2685         dev->buf = kmalloc(TBUF_SIZE, GFP_KERNEL);
2686         if (dev->buf == NULL) {
2687                 kfree(dev);
2688                 return -ENOMEM;
2689         }
2690
2691         /* NOTE this doesn't yet test the handful of difference that are
2692          * visible with high speed interrupts:  bigger maxpacket (1K) and
2693          * "high bandwidth" modes (up to 3 packets/uframe).
2694          */
2695         rtest = wtest = "";
2696         irtest = iwtest = "";
2697         intrtest = intwtest = "";
2698         if (force_interrupt || udev->speed == USB_SPEED_LOW) {
2699                 if (info->ep_in) {
2700                         dev->in_pipe = usb_rcvintpipe(udev, info->ep_in);
2701                         rtest = " intr-in";
2702                 }
2703                 if (info->ep_out) {
2704                         dev->out_pipe = usb_sndintpipe(udev, info->ep_out);
2705                         wtest = " intr-out";
2706                 }
2707         } else {
2708                 if (override_alt >= 0 || info->autoconf) {
2709                         int status;
2710
2711                         status = get_endpoints(dev, intf);
2712                         if (status < 0) {
2713                                 WARNING(dev, "couldn't get endpoints, %d\n",
2714                                                 status);
2715                                 kfree(dev->buf);
2716                                 kfree(dev);
2717                                 return status;
2718                         }
2719                         /* may find bulk or ISO pipes */
2720                 } else {
2721                         if (info->ep_in)
2722                                 dev->in_pipe = usb_rcvbulkpipe(udev,
2723                                                         info->ep_in);
2724                         if (info->ep_out)
2725                                 dev->out_pipe = usb_sndbulkpipe(udev,
2726                                                         info->ep_out);
2727                 }
2728                 if (dev->in_pipe)
2729                         rtest = " bulk-in";
2730                 if (dev->out_pipe)
2731                         wtest = " bulk-out";
2732                 if (dev->in_iso_pipe)
2733                         irtest = " iso-in";
2734                 if (dev->out_iso_pipe)
2735                         iwtest = " iso-out";
2736                 if (dev->in_int_pipe)
2737                         intrtest = " int-in";
2738                 if (dev->out_int_pipe)
2739                         intwtest = " int-out";
2740         }
2741
2742         usb_set_intfdata(intf, dev);
2743         dev_info(&intf->dev, "%s\n", info->name);
2744         dev_info(&intf->dev, "%s {control%s%s%s%s%s%s%s} tests%s\n",
2745                         usb_speed_string(udev->speed),
2746                         info->ctrl_out ? " in/out" : "",
2747                         rtest, wtest,
2748                         irtest, iwtest,
2749                         intrtest, intwtest,
2750                         info->alt >= 0 ? " (+alt)" : "");
2751         return 0;
2752 }
2753
2754 static int usbtest_suspend(struct usb_interface *intf, pm_message_t message)
2755 {
2756         return 0;
2757 }
2758
2759 static int usbtest_resume(struct usb_interface *intf)
2760 {
2761         return 0;
2762 }
2763
2764
2765 static void usbtest_disconnect(struct usb_interface *intf)
2766 {
2767         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2768
2769         usb_set_intfdata(intf, NULL);
2770         dev_dbg(&intf->dev, "disconnect\n");
2771         kfree(dev);
2772 }
2773
2774 /* Basic testing only needs a device that can source or sink bulk traffic.
2775  * Any device can test control transfers (default with GENERIC binding).
2776  *
2777  * Several entries work with the default EP0 implementation that's built
2778  * into EZ-USB chips.  There's a default vendor ID which can be overridden
2779  * by (very) small config EEPROMS, but otherwise all these devices act
2780  * identically until firmware is loaded:  only EP0 works.  It turns out
2781  * to be easy to make other endpoints work, without modifying that EP0
2782  * behavior.  For now, we expect that kind of firmware.
2783  */
2784
2785 /* an21xx or fx versions of ez-usb */
2786 static struct usbtest_info ez1_info = {
2787         .name           = "EZ-USB device",
2788         .ep_in          = 2,
2789         .ep_out         = 2,
2790         .alt            = 1,
2791 };
2792
2793 /* fx2 version of ez-usb */
2794 static struct usbtest_info ez2_info = {
2795         .name           = "FX2 device",
2796         .ep_in          = 6,
2797         .ep_out         = 2,
2798         .alt            = 1,
2799 };
2800
2801 /* ezusb family device with dedicated usb test firmware,
2802  */
2803 static struct usbtest_info fw_info = {
2804         .name           = "usb test device",
2805         .ep_in          = 2,
2806         .ep_out         = 2,
2807         .alt            = 1,
2808         .autoconf       = 1,            /* iso and ctrl_out need autoconf */
2809         .ctrl_out       = 1,
2810         .iso            = 1,            /* iso_ep's are #8 in/out */
2811 };
2812
2813 /* peripheral running Linux and 'zero.c' test firmware, or
2814  * its user-mode cousin. different versions of this use
2815  * different hardware with the same vendor/product codes.
2816  * host side MUST rely on the endpoint descriptors.
2817  */
2818 static struct usbtest_info gz_info = {
2819         .name           = "Linux gadget zero",
2820         .autoconf       = 1,
2821         .ctrl_out       = 1,
2822         .iso            = 1,
2823         .intr           = 1,
2824         .alt            = 0,
2825 };
2826
2827 static struct usbtest_info um_info = {
2828         .name           = "Linux user mode test driver",
2829         .autoconf       = 1,
2830         .alt            = -1,
2831 };
2832
2833 static struct usbtest_info um2_info = {
2834         .name           = "Linux user mode ISO test driver",
2835         .autoconf       = 1,
2836         .iso            = 1,
2837         .alt            = -1,
2838 };
2839
2840 #ifdef IBOT2
2841 /* this is a nice source of high speed bulk data;
2842  * uses an FX2, with firmware provided in the device
2843  */
2844 static struct usbtest_info ibot2_info = {
2845         .name           = "iBOT2 webcam",
2846         .ep_in          = 2,
2847         .alt            = -1,
2848 };
2849 #endif
2850
2851 #ifdef GENERIC
2852 /* we can use any device to test control traffic */
2853 static struct usbtest_info generic_info = {
2854         .name           = "Generic USB device",
2855         .alt            = -1,
2856 };
2857 #endif
2858
2859
2860 static const struct usb_device_id id_table[] = {
2861
2862         /*-------------------------------------------------------------*/
2863
2864         /* EZ-USB devices which download firmware to replace (or in our
2865          * case augment) the default device implementation.
2866          */
2867
2868         /* generic EZ-USB FX controller */
2869         { USB_DEVICE(0x0547, 0x2235),
2870                 .driver_info = (unsigned long) &ez1_info,
2871         },
2872
2873         /* CY3671 development board with EZ-USB FX */
2874         { USB_DEVICE(0x0547, 0x0080),
2875                 .driver_info = (unsigned long) &ez1_info,
2876         },
2877
2878         /* generic EZ-USB FX2 controller (or development board) */
2879         { USB_DEVICE(0x04b4, 0x8613),
2880                 .driver_info = (unsigned long) &ez2_info,
2881         },
2882
2883         /* re-enumerated usb test device firmware */
2884         { USB_DEVICE(0xfff0, 0xfff0),
2885                 .driver_info = (unsigned long) &fw_info,
2886         },
2887
2888         /* "Gadget Zero" firmware runs under Linux */
2889         { USB_DEVICE(0x0525, 0xa4a0),
2890                 .driver_info = (unsigned long) &gz_info,
2891         },
2892
2893         /* so does a user-mode variant */
2894         { USB_DEVICE(0x0525, 0xa4a4),
2895                 .driver_info = (unsigned long) &um_info,
2896         },
2897
2898         /* ... and a user-mode variant that talks iso */
2899         { USB_DEVICE(0x0525, 0xa4a3),
2900                 .driver_info = (unsigned long) &um2_info,
2901         },
2902
2903 #ifdef KEYSPAN_19Qi
2904         /* Keyspan 19qi uses an21xx (original EZ-USB) */
2905         /* this does not coexist with the real Keyspan 19qi driver! */
2906         { USB_DEVICE(0x06cd, 0x010b),
2907                 .driver_info = (unsigned long) &ez1_info,
2908         },
2909 #endif
2910
2911         /*-------------------------------------------------------------*/
2912
2913 #ifdef IBOT2
2914         /* iBOT2 makes a nice source of high speed bulk-in data */
2915         /* this does not coexist with a real iBOT2 driver! */
2916         { USB_DEVICE(0x0b62, 0x0059),
2917                 .driver_info = (unsigned long) &ibot2_info,
2918         },
2919 #endif
2920
2921         /*-------------------------------------------------------------*/
2922
2923 #ifdef GENERIC
2924         /* module params can specify devices to use for control tests */
2925         { .driver_info = (unsigned long) &generic_info, },
2926 #endif
2927
2928         /*-------------------------------------------------------------*/
2929
2930         { }
2931 };
2932 MODULE_DEVICE_TABLE(usb, id_table);
2933
2934 static struct usb_driver usbtest_driver = {
2935         .name =         "usbtest",
2936         .id_table =     id_table,
2937         .probe =        usbtest_probe,
2938         .unlocked_ioctl = usbtest_ioctl,
2939         .disconnect =   usbtest_disconnect,
2940         .suspend =      usbtest_suspend,
2941         .resume =       usbtest_resume,
2942 };
2943
2944 /*-------------------------------------------------------------------------*/
2945
2946 static int __init usbtest_init(void)
2947 {
2948 #ifdef GENERIC
2949         if (vendor)
2950                 pr_debug("params: vend=0x%04x prod=0x%04x\n", vendor, product);
2951 #endif
2952         return usb_register(&usbtest_driver);
2953 }
2954 module_init(usbtest_init);
2955
2956 static void __exit usbtest_exit(void)
2957 {
2958         usb_deregister(&usbtest_driver);
2959 }
2960 module_exit(usbtest_exit);
2961
2962 MODULE_DESCRIPTION("USB Core/HCD Testing Driver");
2963 MODULE_LICENSE("GPL");
2964