Version:  2.0.40 2.2.26 2.4.37 3.8 3.9 3.10 3.11 3.12 3.13 3.14 3.15 3.16 3.17 3.18 3.19 4.0 4.1 4.2 4.3 4.4

Linux/drivers/usb/misc/usbtest.c

  1 #include <linux/kernel.h>
  2 #include <linux/errno.h>
  3 #include <linux/init.h>
  4 #include <linux/slab.h>
  5 #include <linux/mm.h>
  6 #include <linux/module.h>
  7 #include <linux/moduleparam.h>
  8 #include <linux/scatterlist.h>
  9 #include <linux/mutex.h>
 10 #include <linux/timer.h>
 11 #include <linux/usb.h>
 12 
 13 #define SIMPLE_IO_TIMEOUT       10000   /* in milliseconds */
 14 
 15 /*-------------------------------------------------------------------------*/
 16 
 17 static int override_alt = -1;
 18 module_param_named(alt, override_alt, int, 0644);
 19 MODULE_PARM_DESC(alt, ">= 0 to override altsetting selection");
 20 static void complicated_callback(struct urb *urb);
 21 
 22 /*-------------------------------------------------------------------------*/
 23 
 24 /* FIXME make these public somewhere; usbdevfs.h? */
 25 struct usbtest_param {
 26         /* inputs */
 27         unsigned                test_num;       /* 0..(TEST_CASES-1) */
 28         unsigned                iterations;
 29         unsigned                length;
 30         unsigned                vary;
 31         unsigned                sglen;
 32 
 33         /* outputs */
 34         struct timeval          duration;
 35 };
 36 #define USBTEST_REQUEST _IOWR('U', 100, struct usbtest_param)
 37 
 38 /*-------------------------------------------------------------------------*/
 39 
 40 #define GENERIC         /* let probe() bind using module params */
 41 
 42 /* Some devices that can be used for testing will have "real" drivers.
 43  * Entries for those need to be enabled here by hand, after disabling
 44  * that "real" driver.
 45  */
 46 //#define       IBOT2           /* grab iBOT2 webcams */
 47 //#define       KEYSPAN_19Qi    /* grab un-renumerated serial adapter */
 48 
 49 /*-------------------------------------------------------------------------*/
 50 
 51 struct usbtest_info {
 52         const char              *name;
 53         u8                      ep_in;          /* bulk/intr source */
 54         u8                      ep_out;         /* bulk/intr sink */
 55         unsigned                autoconf:1;
 56         unsigned                ctrl_out:1;
 57         unsigned                iso:1;          /* try iso in/out */
 58         unsigned                intr:1;         /* try interrupt in/out */
 59         int                     alt;
 60 };
 61 
 62 /* this is accessed only through usbfs ioctl calls.
 63  * one ioctl to issue a test ... one lock per device.
 64  * tests create other threads if they need them.
 65  * urbs and buffers are allocated dynamically,
 66  * and data generated deterministically.
 67  */
 68 struct usbtest_dev {
 69         struct usb_interface    *intf;
 70         struct usbtest_info     *info;
 71         int                     in_pipe;
 72         int                     out_pipe;
 73         int                     in_iso_pipe;
 74         int                     out_iso_pipe;
 75         int                     in_int_pipe;
 76         int                     out_int_pipe;
 77         struct usb_endpoint_descriptor  *iso_in, *iso_out;
 78         struct usb_endpoint_descriptor  *int_in, *int_out;
 79         struct mutex            lock;
 80 
 81 #define TBUF_SIZE       256
 82         u8                      *buf;
 83 };
 84 
 85 static struct usb_device *testdev_to_usbdev(struct usbtest_dev *test)
 86 {
 87         return interface_to_usbdev(test->intf);
 88 }
 89 
 90 /* set up all urbs so they can be used with either bulk or interrupt */
 91 #define INTERRUPT_RATE          1       /* msec/transfer */
 92 
 93 #define ERROR(tdev, fmt, args...) \
 94         dev_err(&(tdev)->intf->dev , fmt , ## args)
 95 #define WARNING(tdev, fmt, args...) \
 96         dev_warn(&(tdev)->intf->dev , fmt , ## args)
 97 
 98 #define GUARD_BYTE      0xA5
 99 #define MAX_SGLEN       128
100 
101 /*-------------------------------------------------------------------------*/
102 
103 static int
104 get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf)
105 {
106         int                             tmp;
107         struct usb_host_interface       *alt;
108         struct usb_host_endpoint        *in, *out;
109         struct usb_host_endpoint        *iso_in, *iso_out;
110         struct usb_host_endpoint        *int_in, *int_out;
111         struct usb_device               *udev;
112 
113         for (tmp = 0; tmp < intf->num_altsetting; tmp++) {
114                 unsigned        ep;
115 
116                 in = out = NULL;
117                 iso_in = iso_out = NULL;
118                 int_in = int_out = NULL;
119                 alt = intf->altsetting + tmp;
120 
121                 if (override_alt >= 0 &&
122                                 override_alt != alt->desc.bAlternateSetting)
123                         continue;
124 
125                 /* take the first altsetting with in-bulk + out-bulk;
126                  * ignore other endpoints and altsettings.
127                  */
128                 for (ep = 0; ep < alt->desc.bNumEndpoints; ep++) {
129                         struct usb_host_endpoint        *e;
130 
131                         e = alt->endpoint + ep;
132                         switch (usb_endpoint_type(&e->desc)) {
133                         case USB_ENDPOINT_XFER_BULK:
134                                 break;
135                         case USB_ENDPOINT_XFER_INT:
136                                 if (dev->info->intr)
137                                         goto try_intr;
138                         case USB_ENDPOINT_XFER_ISOC:
139                                 if (dev->info->iso)
140                                         goto try_iso;
141                                 /* FALLTHROUGH */
142                         default:
143                                 continue;
144                         }
145                         if (usb_endpoint_dir_in(&e->desc)) {
146                                 if (!in)
147                                         in = e;
148                         } else {
149                                 if (!out)
150                                         out = e;
151                         }
152                         continue;
153 try_intr:
154                         if (usb_endpoint_dir_in(&e->desc)) {
155                                 if (!int_in)
156                                         int_in = e;
157                         } else {
158                                 if (!int_out)
159                                         int_out = e;
160                         }
161                         continue;
162 try_iso:
163                         if (usb_endpoint_dir_in(&e->desc)) {
164                                 if (!iso_in)
165                                         iso_in = e;
166                         } else {
167                                 if (!iso_out)
168                                         iso_out = e;
169                         }
170                 }
171                 if ((in && out)  ||  iso_in || iso_out || int_in || int_out)
172                         goto found;
173         }
174         return -EINVAL;
175 
176 found:
177         udev = testdev_to_usbdev(dev);
178         dev->info->alt = alt->desc.bAlternateSetting;
179         if (alt->desc.bAlternateSetting != 0) {
180                 tmp = usb_set_interface(udev,
181                                 alt->desc.bInterfaceNumber,
182                                 alt->desc.bAlternateSetting);
183                 if (tmp < 0)
184                         return tmp;
185         }
186 
187         if (in) {
188                 dev->in_pipe = usb_rcvbulkpipe(udev,
189                         in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
190                 dev->out_pipe = usb_sndbulkpipe(udev,
191                         out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
192         }
193         if (iso_in) {
194                 dev->iso_in = &iso_in->desc;
195                 dev->in_iso_pipe = usb_rcvisocpipe(udev,
196                                 iso_in->desc.bEndpointAddress
197                                         & USB_ENDPOINT_NUMBER_MASK);
198         }
199 
200         if (iso_out) {
201                 dev->iso_out = &iso_out->desc;
202                 dev->out_iso_pipe = usb_sndisocpipe(udev,
203                                 iso_out->desc.bEndpointAddress
204                                         & USB_ENDPOINT_NUMBER_MASK);
205         }
206 
207         if (int_in) {
208                 dev->int_in = &int_in->desc;
209                 dev->in_int_pipe = usb_rcvintpipe(udev,
210                                 int_in->desc.bEndpointAddress
211                                         & USB_ENDPOINT_NUMBER_MASK);
212         }
213 
214         if (int_out) {
215                 dev->int_out = &int_out->desc;
216                 dev->out_int_pipe = usb_sndintpipe(udev,
217                                 int_out->desc.bEndpointAddress
218                                         & USB_ENDPOINT_NUMBER_MASK);
219         }
220         return 0;
221 }
222 
223 /*-------------------------------------------------------------------------*/
224 
225 /* Support for testing basic non-queued I/O streams.
226  *
227  * These just package urbs as requests that can be easily canceled.
228  * Each urb's data buffer is dynamically allocated; callers can fill
229  * them with non-zero test data (or test for it) when appropriate.
230  */
231 
232 static void simple_callback(struct urb *urb)
233 {
234         complete(urb->context);
235 }
236 
237 static struct urb *usbtest_alloc_urb(
238         struct usb_device       *udev,
239         int                     pipe,
240         unsigned long           bytes,
241         unsigned                transfer_flags,
242         unsigned                offset,
243         u8                      bInterval,
244         usb_complete_t          complete_fn)
245 {
246         struct urb              *urb;
247 
248         urb = usb_alloc_urb(0, GFP_KERNEL);
249         if (!urb)
250                 return urb;
251 
252         if (bInterval)
253                 usb_fill_int_urb(urb, udev, pipe, NULL, bytes, complete_fn,
254                                 NULL, bInterval);
255         else
256                 usb_fill_bulk_urb(urb, udev, pipe, NULL, bytes, complete_fn,
257                                 NULL);
258 
259         urb->interval = (udev->speed == USB_SPEED_HIGH)
260                         ? (INTERRUPT_RATE << 3)
261                         : INTERRUPT_RATE;
262         urb->transfer_flags = transfer_flags;
263         if (usb_pipein(pipe))
264                 urb->transfer_flags |= URB_SHORT_NOT_OK;
265 
266         if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
267                 urb->transfer_buffer = usb_alloc_coherent(udev, bytes + offset,
268                         GFP_KERNEL, &urb->transfer_dma);
269         else
270                 urb->transfer_buffer = kmalloc(bytes + offset, GFP_KERNEL);
271 
272         if (!urb->transfer_buffer) {
273                 usb_free_urb(urb);
274                 return NULL;
275         }
276 
277         /* To test unaligned transfers add an offset and fill the
278                 unused memory with a guard value */
279         if (offset) {
280                 memset(urb->transfer_buffer, GUARD_BYTE, offset);
281                 urb->transfer_buffer += offset;
282                 if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
283                         urb->transfer_dma += offset;
284         }
285 
286         /* For inbound transfers use guard byte so that test fails if
287                 data not correctly copied */
288         memset(urb->transfer_buffer,
289                         usb_pipein(urb->pipe) ? GUARD_BYTE : 0,
290                         bytes);
291         return urb;
292 }
293 
294 static struct urb *simple_alloc_urb(
295         struct usb_device       *udev,
296         int                     pipe,
297         unsigned long           bytes,
298         u8                      bInterval)
299 {
300         return usbtest_alloc_urb(udev, pipe, bytes, URB_NO_TRANSFER_DMA_MAP, 0,
301                         bInterval, simple_callback);
302 }
303 
304 static struct urb *complicated_alloc_urb(
305         struct usb_device       *udev,
306         int                     pipe,
307         unsigned long           bytes,
308         u8                      bInterval)
309 {
310         return usbtest_alloc_urb(udev, pipe, bytes, URB_NO_TRANSFER_DMA_MAP, 0,
311                         bInterval, complicated_callback);
312 }
313 
314 static unsigned pattern;
315 static unsigned mod_pattern;
316 module_param_named(pattern, mod_pattern, uint, S_IRUGO | S_IWUSR);
317 MODULE_PARM_DESC(mod_pattern, "i/o pattern (0 == zeroes)");
318 
319 static unsigned get_maxpacket(struct usb_device *udev, int pipe)
320 {
321         struct usb_host_endpoint        *ep;
322 
323         ep = usb_pipe_endpoint(udev, pipe);
324         return le16_to_cpup(&ep->desc.wMaxPacketSize);
325 }
326 
327 static void simple_fill_buf(struct urb *urb)
328 {
329         unsigned        i;
330         u8              *buf = urb->transfer_buffer;
331         unsigned        len = urb->transfer_buffer_length;
332         unsigned        maxpacket;
333 
334         switch (pattern) {
335         default:
336                 /* FALLTHROUGH */
337         case 0:
338                 memset(buf, 0, len);
339                 break;
340         case 1:                 /* mod63 */
341                 maxpacket = get_maxpacket(urb->dev, urb->pipe);
342                 for (i = 0; i < len; i++)
343                         *buf++ = (u8) ((i % maxpacket) % 63);
344                 break;
345         }
346 }
347 
348 static inline unsigned long buffer_offset(void *buf)
349 {
350         return (unsigned long)buf & (ARCH_KMALLOC_MINALIGN - 1);
351 }
352 
353 static int check_guard_bytes(struct usbtest_dev *tdev, struct urb *urb)
354 {
355         u8 *buf = urb->transfer_buffer;
356         u8 *guard = buf - buffer_offset(buf);
357         unsigned i;
358 
359         for (i = 0; guard < buf; i++, guard++) {
360                 if (*guard != GUARD_BYTE) {
361                         ERROR(tdev, "guard byte[%d] %d (not %d)\n",
362                                 i, *guard, GUARD_BYTE);
363                         return -EINVAL;
364                 }
365         }
366         return 0;
367 }
368 
369 static int simple_check_buf(struct usbtest_dev *tdev, struct urb *urb)
370 {
371         unsigned        i;
372         u8              expected;
373         u8              *buf = urb->transfer_buffer;
374         unsigned        len = urb->actual_length;
375         unsigned        maxpacket = get_maxpacket(urb->dev, urb->pipe);
376 
377         int ret = check_guard_bytes(tdev, urb);
378         if (ret)
379                 return ret;
380 
381         for (i = 0; i < len; i++, buf++) {
382                 switch (pattern) {
383                 /* all-zeroes has no synchronization issues */
384                 case 0:
385                         expected = 0;
386                         break;
387                 /* mod63 stays in sync with short-terminated transfers,
388                  * or otherwise when host and gadget agree on how large
389                  * each usb transfer request should be.  resync is done
390                  * with set_interface or set_config.
391                  */
392                 case 1:                 /* mod63 */
393                         expected = (i % maxpacket) % 63;
394                         break;
395                 /* always fail unsupported patterns */
396                 default:
397                         expected = !*buf;
398                         break;
399                 }
400                 if (*buf == expected)
401                         continue;
402                 ERROR(tdev, "buf[%d] = %d (not %d)\n", i, *buf, expected);
403                 return -EINVAL;
404         }
405         return 0;
406 }
407 
408 static void simple_free_urb(struct urb *urb)
409 {
410         unsigned long offset = buffer_offset(urb->transfer_buffer);
411 
412         if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
413                 usb_free_coherent(
414                         urb->dev,
415                         urb->transfer_buffer_length + offset,
416                         urb->transfer_buffer - offset,
417                         urb->transfer_dma - offset);
418         else
419                 kfree(urb->transfer_buffer - offset);
420         usb_free_urb(urb);
421 }
422 
423 static int simple_io(
424         struct usbtest_dev      *tdev,
425         struct urb              *urb,
426         int                     iterations,
427         int                     vary,
428         int                     expected,
429         const char              *label
430 )
431 {
432         struct usb_device       *udev = urb->dev;
433         int                     max = urb->transfer_buffer_length;
434         struct completion       completion;
435         int                     retval = 0;
436         unsigned long           expire;
437 
438         urb->context = &completion;
439         while (retval == 0 && iterations-- > 0) {
440                 init_completion(&completion);
441                 if (usb_pipeout(urb->pipe)) {
442                         simple_fill_buf(urb);
443                         urb->transfer_flags |= URB_ZERO_PACKET;
444                 }
445                 retval = usb_submit_urb(urb, GFP_KERNEL);
446                 if (retval != 0)
447                         break;
448 
449                 expire = msecs_to_jiffies(SIMPLE_IO_TIMEOUT);
450                 if (!wait_for_completion_timeout(&completion, expire)) {
451                         usb_kill_urb(urb);
452                         retval = (urb->status == -ENOENT ?
453                                   -ETIMEDOUT : urb->status);
454                 } else {
455                         retval = urb->status;
456                 }
457 
458                 urb->dev = udev;
459                 if (retval == 0 && usb_pipein(urb->pipe))
460                         retval = simple_check_buf(tdev, urb);
461 
462                 if (vary) {
463                         int     len = urb->transfer_buffer_length;
464 
465                         len += vary;
466                         len %= max;
467                         if (len == 0)
468                                 len = (vary < max) ? vary : max;
469                         urb->transfer_buffer_length = len;
470                 }
471 
472                 /* FIXME if endpoint halted, clear halt (and log) */
473         }
474         urb->transfer_buffer_length = max;
475 
476         if (expected != retval)
477                 dev_err(&udev->dev,
478                         "%s failed, iterations left %d, status %d (not %d)\n",
479                                 label, iterations, retval, expected);
480         return retval;
481 }
482 
483 
484 /*-------------------------------------------------------------------------*/
485 
486 /* We use scatterlist primitives to test queued I/O.
487  * Yes, this also tests the scatterlist primitives.
488  */
489 
490 static void free_sglist(struct scatterlist *sg, int nents)
491 {
492         unsigned                i;
493 
494         if (!sg)
495                 return;
496         for (i = 0; i < nents; i++) {
497                 if (!sg_page(&sg[i]))
498                         continue;
499                 kfree(sg_virt(&sg[i]));
500         }
501         kfree(sg);
502 }
503 
504 static struct scatterlist *
505 alloc_sglist(int nents, int max, int vary, struct usbtest_dev *dev, int pipe)
506 {
507         struct scatterlist      *sg;
508         unsigned                i;
509         unsigned                size = max;
510         unsigned                maxpacket =
511                 get_maxpacket(interface_to_usbdev(dev->intf), pipe);
512 
513         if (max == 0)
514                 return NULL;
515 
516         sg = kmalloc_array(nents, sizeof(*sg), GFP_KERNEL);
517         if (!sg)
518                 return NULL;
519         sg_init_table(sg, nents);
520 
521         for (i = 0; i < nents; i++) {
522                 char            *buf;
523                 unsigned        j;
524 
525                 buf = kzalloc(size, GFP_KERNEL);
526                 if (!buf) {
527                         free_sglist(sg, i);
528                         return NULL;
529                 }
530 
531                 /* kmalloc pages are always physically contiguous! */
532                 sg_set_buf(&sg[i], buf, size);
533 
534                 switch (pattern) {
535                 case 0:
536                         /* already zeroed */
537                         break;
538                 case 1:
539                         for (j = 0; j < size; j++)
540                                 *buf++ = (u8) ((j % maxpacket) % 63);
541                         break;
542                 }
543 
544                 if (vary) {
545                         size += vary;
546                         size %= max;
547                         if (size == 0)
548                                 size = (vary < max) ? vary : max;
549                 }
550         }
551 
552         return sg;
553 }
554 
555 static void sg_timeout(unsigned long _req)
556 {
557         struct usb_sg_request   *req = (struct usb_sg_request *) _req;
558 
559         req->status = -ETIMEDOUT;
560         usb_sg_cancel(req);
561 }
562 
563 static int perform_sglist(
564         struct usbtest_dev      *tdev,
565         unsigned                iterations,
566         int                     pipe,
567         struct usb_sg_request   *req,
568         struct scatterlist      *sg,
569         int                     nents
570 )
571 {
572         struct usb_device       *udev = testdev_to_usbdev(tdev);
573         int                     retval = 0;
574         struct timer_list       sg_timer;
575 
576         setup_timer_on_stack(&sg_timer, sg_timeout, (unsigned long) req);
577 
578         while (retval == 0 && iterations-- > 0) {
579                 retval = usb_sg_init(req, udev, pipe,
580                                 (udev->speed == USB_SPEED_HIGH)
581                                         ? (INTERRUPT_RATE << 3)
582                                         : INTERRUPT_RATE,
583                                 sg, nents, 0, GFP_KERNEL);
584 
585                 if (retval)
586                         break;
587                 mod_timer(&sg_timer, jiffies +
588                                 msecs_to_jiffies(SIMPLE_IO_TIMEOUT));
589                 usb_sg_wait(req);
590                 del_timer_sync(&sg_timer);
591                 retval = req->status;
592 
593                 /* FIXME check resulting data pattern */
594 
595                 /* FIXME if endpoint halted, clear halt (and log) */
596         }
597 
598         /* FIXME for unlink or fault handling tests, don't report
599          * failure if retval is as we expected ...
600          */
601         if (retval)
602                 ERROR(tdev, "perform_sglist failed, "
603                                 "iterations left %d, status %d\n",
604                                 iterations, retval);
605         return retval;
606 }
607 
608 
609 /*-------------------------------------------------------------------------*/
610 
611 /* unqueued control message testing
612  *
613  * there's a nice set of device functional requirements in chapter 9 of the
614  * usb 2.0 spec, which we can apply to ANY device, even ones that don't use
615  * special test firmware.
616  *
617  * we know the device is configured (or suspended) by the time it's visible
618  * through usbfs.  we can't change that, so we won't test enumeration (which
619  * worked 'well enough' to get here, this time), power management (ditto),
620  * or remote wakeup (which needs human interaction).
621  */
622 
623 static unsigned realworld = 1;
624 module_param(realworld, uint, 0);
625 MODULE_PARM_DESC(realworld, "clear to demand stricter spec compliance");
626 
627 static int get_altsetting(struct usbtest_dev *dev)
628 {
629         struct usb_interface    *iface = dev->intf;
630         struct usb_device       *udev = interface_to_usbdev(iface);
631         int                     retval;
632 
633         retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
634                         USB_REQ_GET_INTERFACE, USB_DIR_IN|USB_RECIP_INTERFACE,
635                         0, iface->altsetting[0].desc.bInterfaceNumber,
636                         dev->buf, 1, USB_CTRL_GET_TIMEOUT);
637         switch (retval) {
638         case 1:
639                 return dev->buf[0];
640         case 0:
641                 retval = -ERANGE;
642                 /* FALLTHROUGH */
643         default:
644                 return retval;
645         }
646 }
647 
648 static int set_altsetting(struct usbtest_dev *dev, int alternate)
649 {
650         struct usb_interface            *iface = dev->intf;
651         struct usb_device               *udev;
652 
653         if (alternate < 0 || alternate >= 256)
654                 return -EINVAL;
655 
656         udev = interface_to_usbdev(iface);
657         return usb_set_interface(udev,
658                         iface->altsetting[0].desc.bInterfaceNumber,
659                         alternate);
660 }
661 
662 static int is_good_config(struct usbtest_dev *tdev, int len)
663 {
664         struct usb_config_descriptor    *config;
665 
666         if (len < sizeof(*config))
667                 return 0;
668         config = (struct usb_config_descriptor *) tdev->buf;
669 
670         switch (config->bDescriptorType) {
671         case USB_DT_CONFIG:
672         case USB_DT_OTHER_SPEED_CONFIG:
673                 if (config->bLength != 9) {
674                         ERROR(tdev, "bogus config descriptor length\n");
675                         return 0;
676                 }
677                 /* this bit 'must be 1' but often isn't */
678                 if (!realworld && !(config->bmAttributes & 0x80)) {
679                         ERROR(tdev, "high bit of config attributes not set\n");
680                         return 0;
681                 }
682                 if (config->bmAttributes & 0x1f) {      /* reserved == 0 */
683                         ERROR(tdev, "reserved config bits set\n");
684                         return 0;
685                 }
686                 break;
687         default:
688                 return 0;
689         }
690 
691         if (le16_to_cpu(config->wTotalLength) == len)   /* read it all */
692                 return 1;
693         if (le16_to_cpu(config->wTotalLength) >= TBUF_SIZE)     /* max partial read */
694                 return 1;
695         ERROR(tdev, "bogus config descriptor read size\n");
696         return 0;
697 }
698 
699 static int is_good_ext(struct usbtest_dev *tdev, u8 *buf)
700 {
701         struct usb_ext_cap_descriptor *ext;
702         u32 attr;
703 
704         ext = (struct usb_ext_cap_descriptor *) buf;
705 
706         if (ext->bLength != USB_DT_USB_EXT_CAP_SIZE) {
707                 ERROR(tdev, "bogus usb 2.0 extension descriptor length\n");
708                 return 0;
709         }
710 
711         attr = le32_to_cpu(ext->bmAttributes);
712         /* bits[1:15] is used and others are reserved */
713         if (attr & ~0xfffe) {   /* reserved == 0 */
714                 ERROR(tdev, "reserved bits set\n");
715                 return 0;
716         }
717 
718         return 1;
719 }
720 
721 static int is_good_ss_cap(struct usbtest_dev *tdev, u8 *buf)
722 {
723         struct usb_ss_cap_descriptor *ss;
724 
725         ss = (struct usb_ss_cap_descriptor *) buf;
726 
727         if (ss->bLength != USB_DT_USB_SS_CAP_SIZE) {
728                 ERROR(tdev, "bogus superspeed device capability descriptor length\n");
729                 return 0;
730         }
731 
732         /*
733          * only bit[1] of bmAttributes is used for LTM and others are
734          * reserved
735          */
736         if (ss->bmAttributes & ~0x02) { /* reserved == 0 */
737                 ERROR(tdev, "reserved bits set in bmAttributes\n");
738                 return 0;
739         }
740 
741         /* bits[0:3] of wSpeedSupported is used and others are reserved */
742         if (le16_to_cpu(ss->wSpeedSupported) & ~0x0f) { /* reserved == 0 */
743                 ERROR(tdev, "reserved bits set in wSpeedSupported\n");
744                 return 0;
745         }
746 
747         return 1;
748 }
749 
750 static int is_good_con_id(struct usbtest_dev *tdev, u8 *buf)
751 {
752         struct usb_ss_container_id_descriptor *con_id;
753 
754         con_id = (struct usb_ss_container_id_descriptor *) buf;
755 
756         if (con_id->bLength != USB_DT_USB_SS_CONTN_ID_SIZE) {
757                 ERROR(tdev, "bogus container id descriptor length\n");
758                 return 0;
759         }
760 
761         if (con_id->bReserved) {        /* reserved == 0 */
762                 ERROR(tdev, "reserved bits set\n");
763                 return 0;
764         }
765 
766         return 1;
767 }
768 
769 /* sanity test for standard requests working with usb_control_mesg() and some
770  * of the utility functions which use it.
771  *
772  * this doesn't test how endpoint halts behave or data toggles get set, since
773  * we won't do I/O to bulk/interrupt endpoints here (which is how to change
774  * halt or toggle).  toggle testing is impractical without support from hcds.
775  *
776  * this avoids failing devices linux would normally work with, by not testing
777  * config/altsetting operations for devices that only support their defaults.
778  * such devices rarely support those needless operations.
779  *
780  * NOTE that since this is a sanity test, it's not examining boundary cases
781  * to see if usbcore, hcd, and device all behave right.  such testing would
782  * involve varied read sizes and other operation sequences.
783  */
784 static int ch9_postconfig(struct usbtest_dev *dev)
785 {
786         struct usb_interface    *iface = dev->intf;
787         struct usb_device       *udev = interface_to_usbdev(iface);
788         int                     i, alt, retval;
789 
790         /* [9.2.3] if there's more than one altsetting, we need to be able to
791          * set and get each one.  mostly trusts the descriptors from usbcore.
792          */
793         for (i = 0; i < iface->num_altsetting; i++) {
794 
795                 /* 9.2.3 constrains the range here */
796                 alt = iface->altsetting[i].desc.bAlternateSetting;
797                 if (alt < 0 || alt >= iface->num_altsetting) {
798                         dev_err(&iface->dev,
799                                         "invalid alt [%d].bAltSetting = %d\n",
800                                         i, alt);
801                 }
802 
803                 /* [real world] get/set unimplemented if there's only one */
804                 if (realworld && iface->num_altsetting == 1)
805                         continue;
806 
807                 /* [9.4.10] set_interface */
808                 retval = set_altsetting(dev, alt);
809                 if (retval) {
810                         dev_err(&iface->dev, "can't set_interface = %d, %d\n",
811                                         alt, retval);
812                         return retval;
813                 }
814 
815                 /* [9.4.4] get_interface always works */
816                 retval = get_altsetting(dev);
817                 if (retval != alt) {
818                         dev_err(&iface->dev, "get alt should be %d, was %d\n",
819                                         alt, retval);
820                         return (retval < 0) ? retval : -EDOM;
821                 }
822 
823         }
824 
825         /* [real world] get_config unimplemented if there's only one */
826         if (!realworld || udev->descriptor.bNumConfigurations != 1) {
827                 int     expected = udev->actconfig->desc.bConfigurationValue;
828 
829                 /* [9.4.2] get_configuration always works
830                  * ... although some cheap devices (like one TI Hub I've got)
831                  * won't return config descriptors except before set_config.
832                  */
833                 retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
834                                 USB_REQ_GET_CONFIGURATION,
835                                 USB_DIR_IN | USB_RECIP_DEVICE,
836                                 0, 0, dev->buf, 1, USB_CTRL_GET_TIMEOUT);
837                 if (retval != 1 || dev->buf[0] != expected) {
838                         dev_err(&iface->dev, "get config --> %d %d (1 %d)\n",
839                                 retval, dev->buf[0], expected);
840                         return (retval < 0) ? retval : -EDOM;
841                 }
842         }
843 
844         /* there's always [9.4.3] a device descriptor [9.6.1] */
845         retval = usb_get_descriptor(udev, USB_DT_DEVICE, 0,
846                         dev->buf, sizeof(udev->descriptor));
847         if (retval != sizeof(udev->descriptor)) {
848                 dev_err(&iface->dev, "dev descriptor --> %d\n", retval);
849                 return (retval < 0) ? retval : -EDOM;
850         }
851 
852         /*
853          * there's always [9.4.3] a bos device descriptor [9.6.2] in USB
854          * 3.0 spec
855          */
856         if (le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0210) {
857                 struct usb_bos_descriptor *bos = NULL;
858                 struct usb_dev_cap_header *header = NULL;
859                 unsigned total, num, length;
860                 u8 *buf;
861 
862                 retval = usb_get_descriptor(udev, USB_DT_BOS, 0, dev->buf,
863                                 sizeof(*udev->bos->desc));
864                 if (retval != sizeof(*udev->bos->desc)) {
865                         dev_err(&iface->dev, "bos descriptor --> %d\n", retval);
866                         return (retval < 0) ? retval : -EDOM;
867                 }
868 
869                 bos = (struct usb_bos_descriptor *)dev->buf;
870                 total = le16_to_cpu(bos->wTotalLength);
871                 num = bos->bNumDeviceCaps;
872 
873                 if (total > TBUF_SIZE)
874                         total = TBUF_SIZE;
875 
876                 /*
877                  * get generic device-level capability descriptors [9.6.2]
878                  * in USB 3.0 spec
879                  */
880                 retval = usb_get_descriptor(udev, USB_DT_BOS, 0, dev->buf,
881                                 total);
882                 if (retval != total) {
883                         dev_err(&iface->dev, "bos descriptor set --> %d\n",
884                                         retval);
885                         return (retval < 0) ? retval : -EDOM;
886                 }
887 
888                 length = sizeof(*udev->bos->desc);
889                 buf = dev->buf;
890                 for (i = 0; i < num; i++) {
891                         buf += length;
892                         if (buf + sizeof(struct usb_dev_cap_header) >
893                                         dev->buf + total)
894                                 break;
895 
896                         header = (struct usb_dev_cap_header *)buf;
897                         length = header->bLength;
898 
899                         if (header->bDescriptorType !=
900                                         USB_DT_DEVICE_CAPABILITY) {
901                                 dev_warn(&udev->dev, "not device capability descriptor, skip\n");
902                                 continue;
903                         }
904 
905                         switch (header->bDevCapabilityType) {
906                         case USB_CAP_TYPE_EXT:
907                                 if (buf + USB_DT_USB_EXT_CAP_SIZE >
908                                                 dev->buf + total ||
909                                                 !is_good_ext(dev, buf)) {
910                                         dev_err(&iface->dev, "bogus usb 2.0 extension descriptor\n");
911                                         return -EDOM;
912                                 }
913                                 break;
914                         case USB_SS_CAP_TYPE:
915                                 if (buf + USB_DT_USB_SS_CAP_SIZE >
916                                                 dev->buf + total ||
917                                                 !is_good_ss_cap(dev, buf)) {
918                                         dev_err(&iface->dev, "bogus superspeed device capability descriptor\n");
919                                         return -EDOM;
920                                 }
921                                 break;
922                         case CONTAINER_ID_TYPE:
923                                 if (buf + USB_DT_USB_SS_CONTN_ID_SIZE >
924                                                 dev->buf + total ||
925                                                 !is_good_con_id(dev, buf)) {
926                                         dev_err(&iface->dev, "bogus container id descriptor\n");
927                                         return -EDOM;
928                                 }
929                                 break;
930                         default:
931                                 break;
932                         }
933                 }
934         }
935 
936         /* there's always [9.4.3] at least one config descriptor [9.6.3] */
937         for (i = 0; i < udev->descriptor.bNumConfigurations; i++) {
938                 retval = usb_get_descriptor(udev, USB_DT_CONFIG, i,
939                                 dev->buf, TBUF_SIZE);
940                 if (!is_good_config(dev, retval)) {
941                         dev_err(&iface->dev,
942                                         "config [%d] descriptor --> %d\n",
943                                         i, retval);
944                         return (retval < 0) ? retval : -EDOM;
945                 }
946 
947                 /* FIXME cross-checking udev->config[i] to make sure usbcore
948                  * parsed it right (etc) would be good testing paranoia
949                  */
950         }
951 
952         /* and sometimes [9.2.6.6] speed dependent descriptors */
953         if (le16_to_cpu(udev->descriptor.bcdUSB) == 0x0200) {
954                 struct usb_qualifier_descriptor *d = NULL;
955 
956                 /* device qualifier [9.6.2] */
957                 retval = usb_get_descriptor(udev,
958                                 USB_DT_DEVICE_QUALIFIER, 0, dev->buf,
959                                 sizeof(struct usb_qualifier_descriptor));
960                 if (retval == -EPIPE) {
961                         if (udev->speed == USB_SPEED_HIGH) {
962                                 dev_err(&iface->dev,
963                                                 "hs dev qualifier --> %d\n",
964                                                 retval);
965                                 return (retval < 0) ? retval : -EDOM;
966                         }
967                         /* usb2.0 but not high-speed capable; fine */
968                 } else if (retval != sizeof(struct usb_qualifier_descriptor)) {
969                         dev_err(&iface->dev, "dev qualifier --> %d\n", retval);
970                         return (retval < 0) ? retval : -EDOM;
971                 } else
972                         d = (struct usb_qualifier_descriptor *) dev->buf;
973 
974                 /* might not have [9.6.2] any other-speed configs [9.6.4] */
975                 if (d) {
976                         unsigned max = d->bNumConfigurations;
977                         for (i = 0; i < max; i++) {
978                                 retval = usb_get_descriptor(udev,
979                                         USB_DT_OTHER_SPEED_CONFIG, i,
980                                         dev->buf, TBUF_SIZE);
981                                 if (!is_good_config(dev, retval)) {
982                                         dev_err(&iface->dev,
983                                                 "other speed config --> %d\n",
984                                                 retval);
985                                         return (retval < 0) ? retval : -EDOM;
986                                 }
987                         }
988                 }
989         }
990         /* FIXME fetch strings from at least the device descriptor */
991 
992         /* [9.4.5] get_status always works */
993         retval = usb_get_status(udev, USB_RECIP_DEVICE, 0, dev->buf);
994         if (retval) {
995                 dev_err(&iface->dev, "get dev status --> %d\n", retval);
996                 return retval;
997         }
998 
999         /* FIXME configuration.bmAttributes says if we could try to set/clear
1000          * the device's remote wakeup feature ... if we can, test that here
1001          */
1002 
1003         retval = usb_get_status(udev, USB_RECIP_INTERFACE,
1004                         iface->altsetting[0].desc.bInterfaceNumber, dev->buf);
1005         if (retval) {
1006                 dev_err(&iface->dev, "get interface status --> %d\n", retval);
1007                 return retval;
1008         }
1009         /* FIXME get status for each endpoint in the interface */
1010 
1011         return 0;
1012 }
1013 
1014 /*-------------------------------------------------------------------------*/
1015 
1016 /* use ch9 requests to test whether:
1017  *   (a) queues work for control, keeping N subtests queued and
1018  *       active (auto-resubmit) for M loops through the queue.
1019  *   (b) protocol stalls (control-only) will autorecover.
1020  *       it's not like bulk/intr; no halt clearing.
1021  *   (c) short control reads are reported and handled.
1022  *   (d) queues are always processed in-order
1023  */
1024 
1025 struct ctrl_ctx {
1026         spinlock_t              lock;
1027         struct usbtest_dev      *dev;
1028         struct completion       complete;
1029         unsigned                count;
1030         unsigned                pending;
1031         int                     status;
1032         struct urb              **urb;
1033         struct usbtest_param    *param;
1034         int                     last;
1035 };
1036 
1037 #define NUM_SUBCASES    16              /* how many test subcases here? */
1038 
1039 struct subcase {
1040         struct usb_ctrlrequest  setup;
1041         int                     number;
1042         int                     expected;
1043 };
1044 
1045 static void ctrl_complete(struct urb *urb)
1046 {
1047         struct ctrl_ctx         *ctx = urb->context;
1048         struct usb_ctrlrequest  *reqp;
1049         struct subcase          *subcase;
1050         int                     status = urb->status;
1051 
1052         reqp = (struct usb_ctrlrequest *)urb->setup_packet;
1053         subcase = container_of(reqp, struct subcase, setup);
1054 
1055         spin_lock(&ctx->lock);
1056         ctx->count--;
1057         ctx->pending--;
1058 
1059         /* queue must transfer and complete in fifo order, unless
1060          * usb_unlink_urb() is used to unlink something not at the
1061          * physical queue head (not tested).
1062          */
1063         if (subcase->number > 0) {
1064                 if ((subcase->number - ctx->last) != 1) {
1065                         ERROR(ctx->dev,
1066                                 "subcase %d completed out of order, last %d\n",
1067                                 subcase->number, ctx->last);
1068                         status = -EDOM;
1069                         ctx->last = subcase->number;
1070                         goto error;
1071                 }
1072         }
1073         ctx->last = subcase->number;
1074 
1075         /* succeed or fault in only one way? */
1076         if (status == subcase->expected)
1077                 status = 0;
1078 
1079         /* async unlink for cleanup? */
1080         else if (status != -ECONNRESET) {
1081 
1082                 /* some faults are allowed, not required */
1083                 if (subcase->expected > 0 && (
1084                           ((status == -subcase->expected        /* happened */
1085                            || status == 0))))                   /* didn't */
1086                         status = 0;
1087                 /* sometimes more than one fault is allowed */
1088                 else if (subcase->number == 12 && status == -EPIPE)
1089                         status = 0;
1090                 else
1091                         ERROR(ctx->dev, "subtest %d error, status %d\n",
1092                                         subcase->number, status);
1093         }
1094 
1095         /* unexpected status codes mean errors; ideally, in hardware */
1096         if (status) {
1097 error:
1098                 if (ctx->status == 0) {
1099                         int             i;
1100 
1101                         ctx->status = status;
1102                         ERROR(ctx->dev, "control queue %02x.%02x, err %d, "
1103                                         "%d left, subcase %d, len %d/%d\n",
1104                                         reqp->bRequestType, reqp->bRequest,
1105                                         status, ctx->count, subcase->number,
1106                                         urb->actual_length,
1107                                         urb->transfer_buffer_length);
1108 
1109                         /* FIXME this "unlink everything" exit route should
1110                          * be a separate test case.
1111                          */
1112 
1113                         /* unlink whatever's still pending */
1114                         for (i = 1; i < ctx->param->sglen; i++) {
1115                                 struct urb *u = ctx->urb[
1116                                                         (i + subcase->number)
1117                                                         % ctx->param->sglen];
1118 
1119                                 if (u == urb || !u->dev)
1120                                         continue;
1121                                 spin_unlock(&ctx->lock);
1122                                 status = usb_unlink_urb(u);
1123                                 spin_lock(&ctx->lock);
1124                                 switch (status) {
1125                                 case -EINPROGRESS:
1126                                 case -EBUSY:
1127                                 case -EIDRM:
1128                                         continue;
1129                                 default:
1130                                         ERROR(ctx->dev, "urb unlink --> %d\n",
1131                                                         status);
1132                                 }
1133                         }
1134                         status = ctx->status;
1135                 }
1136         }
1137 
1138         /* resubmit if we need to, else mark this as done */
1139         if ((status == 0) && (ctx->pending < ctx->count)) {
1140                 status = usb_submit_urb(urb, GFP_ATOMIC);
1141                 if (status != 0) {
1142                         ERROR(ctx->dev,
1143                                 "can't resubmit ctrl %02x.%02x, err %d\n",
1144                                 reqp->bRequestType, reqp->bRequest, status);
1145                         urb->dev = NULL;
1146                 } else
1147                         ctx->pending++;
1148         } else
1149                 urb->dev = NULL;
1150 
1151         /* signal completion when nothing's queued */
1152         if (ctx->pending == 0)
1153                 complete(&ctx->complete);
1154         spin_unlock(&ctx->lock);
1155 }
1156 
1157 static int
1158 test_ctrl_queue(struct usbtest_dev *dev, struct usbtest_param *param)
1159 {
1160         struct usb_device       *udev = testdev_to_usbdev(dev);
1161         struct urb              **urb;
1162         struct ctrl_ctx         context;
1163         int                     i;
1164 
1165         if (param->sglen == 0 || param->iterations > UINT_MAX / param->sglen)
1166                 return -EOPNOTSUPP;
1167 
1168         spin_lock_init(&context.lock);
1169         context.dev = dev;
1170         init_completion(&context.complete);
1171         context.count = param->sglen * param->iterations;
1172         context.pending = 0;
1173         context.status = -ENOMEM;
1174         context.param = param;
1175         context.last = -1;
1176 
1177         /* allocate and init the urbs we'll queue.
1178          * as with bulk/intr sglists, sglen is the queue depth; it also
1179          * controls which subtests run (more tests than sglen) or rerun.
1180          */
1181         urb = kcalloc(param->sglen, sizeof(struct urb *), GFP_KERNEL);
1182         if (!urb)
1183                 return -ENOMEM;
1184         for (i = 0; i < param->sglen; i++) {
1185                 int                     pipe = usb_rcvctrlpipe(udev, 0);
1186                 unsigned                len;
1187                 struct urb              *u;
1188                 struct usb_ctrlrequest  req;
1189                 struct subcase          *reqp;
1190 
1191                 /* sign of this variable means:
1192                  *  -: tested code must return this (negative) error code
1193                  *  +: tested code may return this (negative too) error code
1194                  */
1195                 int                     expected = 0;
1196 
1197                 /* requests here are mostly expected to succeed on any
1198                  * device, but some are chosen to trigger protocol stalls
1199                  * or short reads.
1200                  */
1201                 memset(&req, 0, sizeof(req));
1202                 req.bRequest = USB_REQ_GET_DESCRIPTOR;
1203                 req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
1204 
1205                 switch (i % NUM_SUBCASES) {
1206                 case 0:         /* get device descriptor */
1207                         req.wValue = cpu_to_le16(USB_DT_DEVICE << 8);
1208                         len = sizeof(struct usb_device_descriptor);
1209                         break;
1210                 case 1:         /* get first config descriptor (only) */
1211                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1212                         len = sizeof(struct usb_config_descriptor);
1213                         break;
1214                 case 2:         /* get altsetting (OFTEN STALLS) */
1215                         req.bRequest = USB_REQ_GET_INTERFACE;
1216                         req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
1217                         /* index = 0 means first interface */
1218                         len = 1;
1219                         expected = EPIPE;
1220                         break;
1221                 case 3:         /* get interface status */
1222                         req.bRequest = USB_REQ_GET_STATUS;
1223                         req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
1224                         /* interface 0 */
1225                         len = 2;
1226                         break;
1227                 case 4:         /* get device status */
1228                         req.bRequest = USB_REQ_GET_STATUS;
1229                         req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
1230                         len = 2;
1231                         break;
1232                 case 5:         /* get device qualifier (MAY STALL) */
1233                         req.wValue = cpu_to_le16 (USB_DT_DEVICE_QUALIFIER << 8);
1234                         len = sizeof(struct usb_qualifier_descriptor);
1235                         if (udev->speed != USB_SPEED_HIGH)
1236                                 expected = EPIPE;
1237                         break;
1238                 case 6:         /* get first config descriptor, plus interface */
1239                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1240                         len = sizeof(struct usb_config_descriptor);
1241                         len += sizeof(struct usb_interface_descriptor);
1242                         break;
1243                 case 7:         /* get interface descriptor (ALWAYS STALLS) */
1244                         req.wValue = cpu_to_le16 (USB_DT_INTERFACE << 8);
1245                         /* interface == 0 */
1246                         len = sizeof(struct usb_interface_descriptor);
1247                         expected = -EPIPE;
1248                         break;
1249                 /* NOTE: two consecutive stalls in the queue here.
1250                  *  that tests fault recovery a bit more aggressively. */
1251                 case 8:         /* clear endpoint halt (MAY STALL) */
1252                         req.bRequest = USB_REQ_CLEAR_FEATURE;
1253                         req.bRequestType = USB_RECIP_ENDPOINT;
1254                         /* wValue 0 == ep halt */
1255                         /* wIndex 0 == ep0 (shouldn't halt!) */
1256                         len = 0;
1257                         pipe = usb_sndctrlpipe(udev, 0);
1258                         expected = EPIPE;
1259                         break;
1260                 case 9:         /* get endpoint status */
1261                         req.bRequest = USB_REQ_GET_STATUS;
1262                         req.bRequestType = USB_DIR_IN|USB_RECIP_ENDPOINT;
1263                         /* endpoint 0 */
1264                         len = 2;
1265                         break;
1266                 case 10:        /* trigger short read (EREMOTEIO) */
1267                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1268                         len = 1024;
1269                         expected = -EREMOTEIO;
1270                         break;
1271                 /* NOTE: two consecutive _different_ faults in the queue. */
1272                 case 11:        /* get endpoint descriptor (ALWAYS STALLS) */
1273                         req.wValue = cpu_to_le16(USB_DT_ENDPOINT << 8);
1274                         /* endpoint == 0 */
1275                         len = sizeof(struct usb_interface_descriptor);
1276                         expected = EPIPE;
1277                         break;
1278                 /* NOTE: sometimes even a third fault in the queue! */
1279                 case 12:        /* get string 0 descriptor (MAY STALL) */
1280                         req.wValue = cpu_to_le16(USB_DT_STRING << 8);
1281                         /* string == 0, for language IDs */
1282                         len = sizeof(struct usb_interface_descriptor);
1283                         /* may succeed when > 4 languages */
1284                         expected = EREMOTEIO;   /* or EPIPE, if no strings */
1285                         break;
1286                 case 13:        /* short read, resembling case 10 */
1287                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1288                         /* last data packet "should" be DATA1, not DATA0 */
1289                         if (udev->speed == USB_SPEED_SUPER)
1290                                 len = 1024 - 512;
1291                         else
1292                                 len = 1024 - udev->descriptor.bMaxPacketSize0;
1293                         expected = -EREMOTEIO;
1294                         break;
1295                 case 14:        /* short read; try to fill the last packet */
1296                         req.wValue = cpu_to_le16((USB_DT_DEVICE << 8) | 0);
1297                         /* device descriptor size == 18 bytes */
1298                         len = udev->descriptor.bMaxPacketSize0;
1299                         if (udev->speed == USB_SPEED_SUPER)
1300                                 len = 512;
1301                         switch (len) {
1302                         case 8:
1303                                 len = 24;
1304                                 break;
1305                         case 16:
1306                                 len = 32;
1307                                 break;
1308                         }
1309                         expected = -EREMOTEIO;
1310                         break;
1311                 case 15:
1312                         req.wValue = cpu_to_le16(USB_DT_BOS << 8);
1313                         if (udev->bos)
1314                                 len = le16_to_cpu(udev->bos->desc->wTotalLength);
1315                         else
1316                                 len = sizeof(struct usb_bos_descriptor);
1317                         if (le16_to_cpu(udev->descriptor.bcdUSB) < 0x0201)
1318                                 expected = -EPIPE;
1319                         break;
1320                 default:
1321                         ERROR(dev, "bogus number of ctrl queue testcases!\n");
1322                         context.status = -EINVAL;
1323                         goto cleanup;
1324                 }
1325                 req.wLength = cpu_to_le16(len);
1326                 urb[i] = u = simple_alloc_urb(udev, pipe, len, 0);
1327                 if (!u)
1328                         goto cleanup;
1329 
1330                 reqp = kmalloc(sizeof(*reqp), GFP_KERNEL);
1331                 if (!reqp)
1332                         goto cleanup;
1333                 reqp->setup = req;
1334                 reqp->number = i % NUM_SUBCASES;
1335                 reqp->expected = expected;
1336                 u->setup_packet = (char *) &reqp->setup;
1337 
1338                 u->context = &context;
1339                 u->complete = ctrl_complete;
1340         }
1341 
1342         /* queue the urbs */
1343         context.urb = urb;
1344         spin_lock_irq(&context.lock);
1345         for (i = 0; i < param->sglen; i++) {
1346                 context.status = usb_submit_urb(urb[i], GFP_ATOMIC);
1347                 if (context.status != 0) {
1348                         ERROR(dev, "can't submit urb[%d], status %d\n",
1349                                         i, context.status);
1350                         context.count = context.pending;
1351                         break;
1352                 }
1353                 context.pending++;
1354         }
1355         spin_unlock_irq(&context.lock);
1356 
1357         /* FIXME  set timer and time out; provide a disconnect hook */
1358 
1359         /* wait for the last one to complete */
1360         if (context.pending > 0)
1361                 wait_for_completion(&context.complete);
1362 
1363 cleanup:
1364         for (i = 0; i < param->sglen; i++) {
1365                 if (!urb[i])
1366                         continue;
1367                 urb[i]->dev = udev;
1368                 kfree(urb[i]->setup_packet);
1369                 simple_free_urb(urb[i]);
1370         }
1371         kfree(urb);
1372         return context.status;
1373 }
1374 #undef NUM_SUBCASES
1375 
1376 
1377 /*-------------------------------------------------------------------------*/
1378 
1379 static void unlink1_callback(struct urb *urb)
1380 {
1381         int     status = urb->status;
1382 
1383         /* we "know" -EPIPE (stall) never happens */
1384         if (!status)
1385                 status = usb_submit_urb(urb, GFP_ATOMIC);
1386         if (status) {
1387                 urb->status = status;
1388                 complete(urb->context);
1389         }
1390 }
1391 
1392 static int unlink1(struct usbtest_dev *dev, int pipe, int size, int async)
1393 {
1394         struct urb              *urb;
1395         struct completion       completion;
1396         int                     retval = 0;
1397 
1398         init_completion(&completion);
1399         urb = simple_alloc_urb(testdev_to_usbdev(dev), pipe, size, 0);
1400         if (!urb)
1401                 return -ENOMEM;
1402         urb->context = &completion;
1403         urb->complete = unlink1_callback;
1404 
1405         if (usb_pipeout(urb->pipe)) {
1406                 simple_fill_buf(urb);
1407                 urb->transfer_flags |= URB_ZERO_PACKET;
1408         }
1409 
1410         /* keep the endpoint busy.  there are lots of hc/hcd-internal
1411          * states, and testing should get to all of them over time.
1412          *
1413          * FIXME want additional tests for when endpoint is STALLing
1414          * due to errors, or is just NAKing requests.
1415          */
1416         retval = usb_submit_urb(urb, GFP_KERNEL);
1417         if (retval != 0) {
1418                 dev_err(&dev->intf->dev, "submit fail %d\n", retval);
1419                 return retval;
1420         }
1421 
1422         /* unlinking that should always work.  variable delay tests more
1423          * hcd states and code paths, even with little other system load.
1424          */
1425         msleep(jiffies % (2 * INTERRUPT_RATE));
1426         if (async) {
1427                 while (!completion_done(&completion)) {
1428                         retval = usb_unlink_urb(urb);
1429 
1430                         if (retval == 0 && usb_pipein(urb->pipe))
1431                                 retval = simple_check_buf(dev, urb);
1432 
1433                         switch (retval) {
1434                         case -EBUSY:
1435                         case -EIDRM:
1436                                 /* we can't unlink urbs while they're completing
1437                                  * or if they've completed, and we haven't
1438                                  * resubmitted. "normal" drivers would prevent
1439                                  * resubmission, but since we're testing unlink
1440                                  * paths, we can't.
1441                                  */
1442                                 ERROR(dev, "unlink retry\n");
1443                                 continue;
1444                         case 0:
1445                         case -EINPROGRESS:
1446                                 break;
1447 
1448                         default:
1449                                 dev_err(&dev->intf->dev,
1450                                         "unlink fail %d\n", retval);
1451                                 return retval;
1452                         }
1453 
1454                         break;
1455                 }
1456         } else
1457                 usb_kill_urb(urb);
1458 
1459         wait_for_completion(&completion);
1460         retval = urb->status;
1461         simple_free_urb(urb);
1462 
1463         if (async)
1464                 return (retval == -ECONNRESET) ? 0 : retval - 1000;
1465         else
1466                 return (retval == -ENOENT || retval == -EPERM) ?
1467                                 0 : retval - 2000;
1468 }
1469 
1470 static int unlink_simple(struct usbtest_dev *dev, int pipe, int len)
1471 {
1472         int                     retval = 0;
1473 
1474         /* test sync and async paths */
1475         retval = unlink1(dev, pipe, len, 1);
1476         if (!retval)
1477                 retval = unlink1(dev, pipe, len, 0);
1478         return retval;
1479 }
1480 
1481 /*-------------------------------------------------------------------------*/
1482 
1483 struct queued_ctx {
1484         struct completion       complete;
1485         atomic_t                pending;
1486         unsigned                num;
1487         int                     status;
1488         struct urb              **urbs;
1489 };
1490 
1491 static void unlink_queued_callback(struct urb *urb)
1492 {
1493         int                     status = urb->status;
1494         struct queued_ctx       *ctx = urb->context;
1495 
1496         if (ctx->status)
1497                 goto done;
1498         if (urb == ctx->urbs[ctx->num - 4] || urb == ctx->urbs[ctx->num - 2]) {
1499                 if (status == -ECONNRESET)
1500                         goto done;
1501                 /* What error should we report if the URB completed normally? */
1502         }
1503         if (status != 0)
1504                 ctx->status = status;
1505 
1506  done:
1507         if (atomic_dec_and_test(&ctx->pending))
1508                 complete(&ctx->complete);
1509 }
1510 
1511 static int unlink_queued(struct usbtest_dev *dev, int pipe, unsigned num,
1512                 unsigned size)
1513 {
1514         struct queued_ctx       ctx;
1515         struct usb_device       *udev = testdev_to_usbdev(dev);
1516         void                    *buf;
1517         dma_addr_t              buf_dma;
1518         int                     i;
1519         int                     retval = -ENOMEM;
1520 
1521         init_completion(&ctx.complete);
1522         atomic_set(&ctx.pending, 1);    /* One more than the actual value */
1523         ctx.num = num;
1524         ctx.status = 0;
1525 
1526         buf = usb_alloc_coherent(udev, size, GFP_KERNEL, &buf_dma);
1527         if (!buf)
1528                 return retval;
1529         memset(buf, 0, size);
1530 
1531         /* Allocate and init the urbs we'll queue */
1532         ctx.urbs = kcalloc(num, sizeof(struct urb *), GFP_KERNEL);
1533         if (!ctx.urbs)
1534                 goto free_buf;
1535         for (i = 0; i < num; i++) {
1536                 ctx.urbs[i] = usb_alloc_urb(0, GFP_KERNEL);
1537                 if (!ctx.urbs[i])
1538                         goto free_urbs;
1539                 usb_fill_bulk_urb(ctx.urbs[i], udev, pipe, buf, size,
1540                                 unlink_queued_callback, &ctx);
1541                 ctx.urbs[i]->transfer_dma = buf_dma;
1542                 ctx.urbs[i]->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
1543 
1544                 if (usb_pipeout(ctx.urbs[i]->pipe)) {
1545                         simple_fill_buf(ctx.urbs[i]);
1546                         ctx.urbs[i]->transfer_flags |= URB_ZERO_PACKET;
1547                 }
1548         }
1549 
1550         /* Submit all the URBs and then unlink URBs num - 4 and num - 2. */
1551         for (i = 0; i < num; i++) {
1552                 atomic_inc(&ctx.pending);
1553                 retval = usb_submit_urb(ctx.urbs[i], GFP_KERNEL);
1554                 if (retval != 0) {
1555                         dev_err(&dev->intf->dev, "submit urbs[%d] fail %d\n",
1556                                         i, retval);
1557                         atomic_dec(&ctx.pending);
1558                         ctx.status = retval;
1559                         break;
1560                 }
1561         }
1562         if (i == num) {
1563                 usb_unlink_urb(ctx.urbs[num - 4]);
1564                 usb_unlink_urb(ctx.urbs[num - 2]);
1565         } else {
1566                 while (--i >= 0)
1567                         usb_unlink_urb(ctx.urbs[i]);
1568         }
1569 
1570         if (atomic_dec_and_test(&ctx.pending))          /* The extra count */
1571                 complete(&ctx.complete);
1572         wait_for_completion(&ctx.complete);
1573         retval = ctx.status;
1574 
1575  free_urbs:
1576         for (i = 0; i < num; i++)
1577                 usb_free_urb(ctx.urbs[i]);
1578         kfree(ctx.urbs);
1579  free_buf:
1580         usb_free_coherent(udev, size, buf, buf_dma);
1581         return retval;
1582 }
1583 
1584 /*-------------------------------------------------------------------------*/
1585 
1586 static int verify_not_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
1587 {
1588         int     retval;
1589         u16     status;
1590 
1591         /* shouldn't look or act halted */
1592         retval = usb_get_status(urb->dev, USB_RECIP_ENDPOINT, ep, &status);
1593         if (retval < 0) {
1594                 ERROR(tdev, "ep %02x couldn't get no-halt status, %d\n",
1595                                 ep, retval);
1596                 return retval;
1597         }
1598         if (status != 0) {
1599                 ERROR(tdev, "ep %02x bogus status: %04x != 0\n", ep, status);
1600                 return -EINVAL;
1601         }
1602         retval = simple_io(tdev, urb, 1, 0, 0, __func__);
1603         if (retval != 0)
1604                 return -EINVAL;
1605         return 0;
1606 }
1607 
1608 static int verify_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
1609 {
1610         int     retval;
1611         u16     status;
1612 
1613         /* should look and act halted */
1614         retval = usb_get_status(urb->dev, USB_RECIP_ENDPOINT, ep, &status);
1615         if (retval < 0) {
1616                 ERROR(tdev, "ep %02x couldn't get halt status, %d\n",
1617                                 ep, retval);
1618                 return retval;
1619         }
1620         if (status != 1) {
1621                 ERROR(tdev, "ep %02x bogus status: %04x != 1\n", ep, status);
1622                 return -EINVAL;
1623         }
1624         retval = simple_io(tdev, urb, 1, 0, -EPIPE, __func__);
1625         if (retval != -EPIPE)
1626                 return -EINVAL;
1627         retval = simple_io(tdev, urb, 1, 0, -EPIPE, "verify_still_halted");
1628         if (retval != -EPIPE)
1629                 return -EINVAL;
1630         return 0;
1631 }
1632 
1633 static int test_halt(struct usbtest_dev *tdev, int ep, struct urb *urb)
1634 {
1635         int     retval;
1636 
1637         /* shouldn't look or act halted now */
1638         retval = verify_not_halted(tdev, ep, urb);
1639         if (retval < 0)
1640                 return retval;
1641 
1642         /* set halt (protocol test only), verify it worked */
1643         retval = usb_control_msg(urb->dev, usb_sndctrlpipe(urb->dev, 0),
1644                         USB_REQ_SET_FEATURE, USB_RECIP_ENDPOINT,
1645                         USB_ENDPOINT_HALT, ep,
1646                         NULL, 0, USB_CTRL_SET_TIMEOUT);
1647         if (retval < 0) {
1648                 ERROR(tdev, "ep %02x couldn't set halt, %d\n", ep, retval);
1649                 return retval;
1650         }
1651         retval = verify_halted(tdev, ep, urb);
1652         if (retval < 0) {
1653                 int ret;
1654 
1655                 /* clear halt anyways, else further tests will fail */
1656                 ret = usb_clear_halt(urb->dev, urb->pipe);
1657                 if (ret)
1658                         ERROR(tdev, "ep %02x couldn't clear halt, %d\n",
1659                               ep, ret);
1660 
1661                 return retval;
1662         }
1663 
1664         /* clear halt (tests API + protocol), verify it worked */
1665         retval = usb_clear_halt(urb->dev, urb->pipe);
1666         if (retval < 0) {
1667                 ERROR(tdev, "ep %02x couldn't clear halt, %d\n", ep, retval);
1668                 return retval;
1669         }
1670         retval = verify_not_halted(tdev, ep, urb);
1671         if (retval < 0)
1672                 return retval;
1673 
1674         /* NOTE:  could also verify SET_INTERFACE clear halts ... */
1675 
1676         return 0;
1677 }
1678 
1679 static int halt_simple(struct usbtest_dev *dev)
1680 {
1681         int                     ep;
1682         int                     retval = 0;
1683         struct urb              *urb;
1684         struct usb_device       *udev = testdev_to_usbdev(dev);
1685 
1686         if (udev->speed == USB_SPEED_SUPER)
1687                 urb = simple_alloc_urb(udev, 0, 1024, 0);
1688         else
1689                 urb = simple_alloc_urb(udev, 0, 512, 0);
1690         if (urb == NULL)
1691                 return -ENOMEM;
1692 
1693         if (dev->in_pipe) {
1694                 ep = usb_pipeendpoint(dev->in_pipe) | USB_DIR_IN;
1695                 urb->pipe = dev->in_pipe;
1696                 retval = test_halt(dev, ep, urb);
1697                 if (retval < 0)
1698                         goto done;
1699         }
1700 
1701         if (dev->out_pipe) {
1702                 ep = usb_pipeendpoint(dev->out_pipe);
1703                 urb->pipe = dev->out_pipe;
1704                 retval = test_halt(dev, ep, urb);
1705         }
1706 done:
1707         simple_free_urb(urb);
1708         return retval;
1709 }
1710 
1711 /*-------------------------------------------------------------------------*/
1712 
1713 /* Control OUT tests use the vendor control requests from Intel's
1714  * USB 2.0 compliance test device:  write a buffer, read it back.
1715  *
1716  * Intel's spec only _requires_ that it work for one packet, which
1717  * is pretty weak.   Some HCDs place limits here; most devices will
1718  * need to be able to handle more than one OUT data packet.  We'll
1719  * try whatever we're told to try.
1720  */
1721 static int ctrl_out(struct usbtest_dev *dev,
1722                 unsigned count, unsigned length, unsigned vary, unsigned offset)
1723 {
1724         unsigned                i, j, len;
1725         int                     retval;
1726         u8                      *buf;
1727         char                    *what = "?";
1728         struct usb_device       *udev;
1729 
1730         if (length < 1 || length > 0xffff || vary >= length)
1731                 return -EINVAL;
1732 
1733         buf = kmalloc(length + offset, GFP_KERNEL);
1734         if (!buf)
1735                 return -ENOMEM;
1736 
1737         buf += offset;
1738         udev = testdev_to_usbdev(dev);
1739         len = length;
1740         retval = 0;
1741 
1742         /* NOTE:  hardware might well act differently if we pushed it
1743          * with lots back-to-back queued requests.
1744          */
1745         for (i = 0; i < count; i++) {
1746                 /* write patterned data */
1747                 for (j = 0; j < len; j++)
1748                         buf[j] = (u8)(i + j);
1749                 retval = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
1750                                 0x5b, USB_DIR_OUT|USB_TYPE_VENDOR,
1751                                 0, 0, buf, len, USB_CTRL_SET_TIMEOUT);
1752                 if (retval != len) {
1753                         what = "write";
1754                         if (retval >= 0) {
1755                                 ERROR(dev, "ctrl_out, wlen %d (expected %d)\n",
1756                                                 retval, len);
1757                                 retval = -EBADMSG;
1758                         }
1759                         break;
1760                 }
1761 
1762                 /* read it back -- assuming nothing intervened!!  */
1763                 retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
1764                                 0x5c, USB_DIR_IN|USB_TYPE_VENDOR,
1765                                 0, 0, buf, len, USB_CTRL_GET_TIMEOUT);
1766                 if (retval != len) {
1767                         what = "read";
1768                         if (retval >= 0) {
1769                                 ERROR(dev, "ctrl_out, rlen %d (expected %d)\n",
1770                                                 retval, len);
1771                                 retval = -EBADMSG;
1772                         }
1773                         break;
1774                 }
1775 
1776                 /* fail if we can't verify */
1777                 for (j = 0; j < len; j++) {
1778                         if (buf[j] != (u8)(i + j)) {
1779                                 ERROR(dev, "ctrl_out, byte %d is %d not %d\n",
1780                                         j, buf[j], (u8)(i + j));
1781                                 retval = -EBADMSG;
1782                                 break;
1783                         }
1784                 }
1785                 if (retval < 0) {
1786                         what = "verify";
1787                         break;
1788                 }
1789 
1790                 len += vary;
1791 
1792                 /* [real world] the "zero bytes IN" case isn't really used.
1793                  * hardware can easily trip up in this weird case, since its
1794                  * status stage is IN, not OUT like other ep0in transfers.
1795                  */
1796                 if (len > length)
1797                         len = realworld ? 1 : 0;
1798         }
1799 
1800         if (retval < 0)
1801                 ERROR(dev, "ctrl_out %s failed, code %d, count %d\n",
1802                         what, retval, i);
1803 
1804         kfree(buf - offset);
1805         return retval;
1806 }
1807 
1808 /*-------------------------------------------------------------------------*/
1809 
1810 /* ISO/BULK tests ... mimics common usage
1811  *  - buffer length is split into N packets (mostly maxpacket sized)
1812  *  - multi-buffers according to sglen
1813  */
1814 
1815 struct transfer_context {
1816         unsigned                count;
1817         unsigned                pending;
1818         spinlock_t              lock;
1819         struct completion       done;
1820         int                     submit_error;
1821         unsigned long           errors;
1822         unsigned long           packet_count;
1823         struct usbtest_dev      *dev;
1824         bool                    is_iso;
1825 };
1826 
1827 static void complicated_callback(struct urb *urb)
1828 {
1829         struct transfer_context *ctx = urb->context;
1830 
1831         spin_lock(&ctx->lock);
1832         ctx->count--;
1833 
1834         ctx->packet_count += urb->number_of_packets;
1835         if (urb->error_count > 0)
1836                 ctx->errors += urb->error_count;
1837         else if (urb->status != 0)
1838                 ctx->errors += (ctx->is_iso ? urb->number_of_packets : 1);
1839         else if (urb->actual_length != urb->transfer_buffer_length)
1840                 ctx->errors++;
1841         else if (check_guard_bytes(ctx->dev, urb) != 0)
1842                 ctx->errors++;
1843 
1844         if (urb->status == 0 && ctx->count > (ctx->pending - 1)
1845                         && !ctx->submit_error) {
1846                 int status = usb_submit_urb(urb, GFP_ATOMIC);
1847                 switch (status) {
1848                 case 0:
1849                         goto done;
1850                 default:
1851                         dev_err(&ctx->dev->intf->dev,
1852                                         "iso resubmit err %d\n",
1853                                         status);
1854                         /* FALLTHROUGH */
1855                 case -ENODEV:                   /* disconnected */
1856                 case -ESHUTDOWN:                /* endpoint disabled */
1857                         ctx->submit_error = 1;
1858                         break;
1859                 }
1860         }
1861 
1862         ctx->pending--;
1863         if (ctx->pending == 0) {
1864                 if (ctx->errors)
1865                         dev_err(&ctx->dev->intf->dev,
1866                                 "iso test, %lu errors out of %lu\n",
1867                                 ctx->errors, ctx->packet_count);
1868                 complete(&ctx->done);
1869         }
1870 done:
1871         spin_unlock(&ctx->lock);
1872 }
1873 
1874 static struct urb *iso_alloc_urb(
1875         struct usb_device       *udev,
1876         int                     pipe,
1877         struct usb_endpoint_descriptor  *desc,
1878         long                    bytes,
1879         unsigned offset
1880 )
1881 {
1882         struct urb              *urb;
1883         unsigned                i, maxp, packets;
1884 
1885         if (bytes < 0 || !desc)
1886                 return NULL;
1887         maxp = 0x7ff & usb_endpoint_maxp(desc);
1888         maxp *= 1 + (0x3 & (usb_endpoint_maxp(desc) >> 11));
1889         packets = DIV_ROUND_UP(bytes, maxp);
1890 
1891         urb = usb_alloc_urb(packets, GFP_KERNEL);
1892         if (!urb)
1893                 return urb;
1894         urb->dev = udev;
1895         urb->pipe = pipe;
1896 
1897         urb->number_of_packets = packets;
1898         urb->transfer_buffer_length = bytes;
1899         urb->transfer_buffer = usb_alloc_coherent(udev, bytes + offset,
1900                                                         GFP_KERNEL,
1901                                                         &urb->transfer_dma);
1902         if (!urb->transfer_buffer) {
1903                 usb_free_urb(urb);
1904                 return NULL;
1905         }
1906         if (offset) {
1907                 memset(urb->transfer_buffer, GUARD_BYTE, offset);
1908                 urb->transfer_buffer += offset;
1909                 urb->transfer_dma += offset;
1910         }
1911         /* For inbound transfers use guard byte so that test fails if
1912                 data not correctly copied */
1913         memset(urb->transfer_buffer,
1914                         usb_pipein(urb->pipe) ? GUARD_BYTE : 0,
1915                         bytes);
1916 
1917         for (i = 0; i < packets; i++) {
1918                 /* here, only the last packet will be short */
1919                 urb->iso_frame_desc[i].length = min((unsigned) bytes, maxp);
1920                 bytes -= urb->iso_frame_desc[i].length;
1921 
1922                 urb->iso_frame_desc[i].offset = maxp * i;
1923         }
1924 
1925         urb->complete = complicated_callback;
1926         /* urb->context = SET BY CALLER */
1927         urb->interval = 1 << (desc->bInterval - 1);
1928         urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
1929         return urb;
1930 }
1931 
1932 static int
1933 test_queue(struct usbtest_dev *dev, struct usbtest_param *param,
1934                 int pipe, struct usb_endpoint_descriptor *desc, unsigned offset)
1935 {
1936         struct transfer_context context;
1937         struct usb_device       *udev;
1938         unsigned                i;
1939         unsigned long           packets = 0;
1940         int                     status = 0;
1941         struct urb              *urbs[param->sglen];
1942 
1943         memset(&context, 0, sizeof(context));
1944         context.count = param->iterations * param->sglen;
1945         context.dev = dev;
1946         context.is_iso = !!desc;
1947         init_completion(&context.done);
1948         spin_lock_init(&context.lock);
1949 
1950         udev = testdev_to_usbdev(dev);
1951 
1952         for (i = 0; i < param->sglen; i++) {
1953                 if (context.is_iso)
1954                         urbs[i] = iso_alloc_urb(udev, pipe, desc,
1955                                         param->length, offset);
1956                 else
1957                         urbs[i] = complicated_alloc_urb(udev, pipe,
1958                                         param->length, 0);
1959 
1960                 if (!urbs[i]) {
1961                         status = -ENOMEM;
1962                         goto fail;
1963                 }
1964                 packets += urbs[i]->number_of_packets;
1965                 urbs[i]->context = &context;
1966         }
1967         packets *= param->iterations;
1968 
1969         if (context.is_iso) {
1970                 dev_info(&dev->intf->dev,
1971                         "iso period %d %sframes, wMaxPacket %d, transactions: %d\n",
1972                         1 << (desc->bInterval - 1),
1973                         (udev->speed == USB_SPEED_HIGH) ? "micro" : "",
1974                         usb_endpoint_maxp(desc) & 0x7ff,
1975                         1 + (0x3 & (usb_endpoint_maxp(desc) >> 11)));
1976 
1977                 dev_info(&dev->intf->dev,
1978                         "total %lu msec (%lu packets)\n",
1979                         (packets * (1 << (desc->bInterval - 1)))
1980                                 / ((udev->speed == USB_SPEED_HIGH) ? 8 : 1),
1981                         packets);
1982         }
1983 
1984         spin_lock_irq(&context.lock);
1985         for (i = 0; i < param->sglen; i++) {
1986                 ++context.pending;
1987                 status = usb_submit_urb(urbs[i], GFP_ATOMIC);
1988                 if (status < 0) {
1989                         ERROR(dev, "submit iso[%d], error %d\n", i, status);
1990                         if (i == 0) {
1991                                 spin_unlock_irq(&context.lock);
1992                                 goto fail;
1993                         }
1994 
1995                         simple_free_urb(urbs[i]);
1996                         urbs[i] = NULL;
1997                         context.pending--;
1998                         context.submit_error = 1;
1999                         break;
2000                 }
2001         }
2002         spin_unlock_irq(&context.lock);
2003 
2004         wait_for_completion(&context.done);
2005 
2006         for (i = 0; i < param->sglen; i++) {
2007                 if (urbs[i])
2008                         simple_free_urb(urbs[i]);
2009         }
2010         /*
2011          * Isochronous transfers are expected to fail sometimes.  As an
2012          * arbitrary limit, we will report an error if any submissions
2013          * fail or if the transfer failure rate is > 10%.
2014          */
2015         if (status != 0)
2016                 ;
2017         else if (context.submit_error)
2018                 status = -EACCES;
2019         else if (context.errors >
2020                         (context.is_iso ? context.packet_count / 10 : 0))
2021                 status = -EIO;
2022         return status;
2023 
2024 fail:
2025         for (i = 0; i < param->sglen; i++) {
2026                 if (urbs[i])
2027                         simple_free_urb(urbs[i]);
2028         }
2029         return status;
2030 }
2031 
2032 static int test_unaligned_bulk(
2033         struct usbtest_dev *tdev,
2034         int pipe,
2035         unsigned length,
2036         int iterations,
2037         unsigned transfer_flags,
2038         const char *label)
2039 {
2040         int retval;
2041         struct urb *urb = usbtest_alloc_urb(testdev_to_usbdev(tdev),
2042                         pipe, length, transfer_flags, 1, 0, simple_callback);
2043 
2044         if (!urb)
2045                 return -ENOMEM;
2046 
2047         retval = simple_io(tdev, urb, iterations, 0, 0, label);
2048         simple_free_urb(urb);
2049         return retval;
2050 }
2051 
2052 /*-------------------------------------------------------------------------*/
2053 
2054 /* We only have this one interface to user space, through usbfs.
2055  * User mode code can scan usbfs to find N different devices (maybe on
2056  * different busses) to use when testing, and allocate one thread per
2057  * test.  So discovery is simplified, and we have no device naming issues.
2058  *
2059  * Don't use these only as stress/load tests.  Use them along with with
2060  * other USB bus activity:  plugging, unplugging, mousing, mp3 playback,
2061  * video capture, and so on.  Run different tests at different times, in
2062  * different sequences.  Nothing here should interact with other devices,
2063  * except indirectly by consuming USB bandwidth and CPU resources for test
2064  * threads and request completion.  But the only way to know that for sure
2065  * is to test when HC queues are in use by many devices.
2066  *
2067  * WARNING:  Because usbfs grabs udev->dev.sem before calling this ioctl(),
2068  * it locks out usbcore in certain code paths.  Notably, if you disconnect
2069  * the device-under-test, hub_wq will wait block forever waiting for the
2070  * ioctl to complete ... so that usb_disconnect() can abort the pending
2071  * urbs and then call usbtest_disconnect().  To abort a test, you're best
2072  * off just killing the userspace task and waiting for it to exit.
2073  */
2074 
2075 static int
2076 usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
2077 {
2078         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2079         struct usb_device       *udev = testdev_to_usbdev(dev);
2080         struct usbtest_param    *param = buf;
2081         int                     retval = -EOPNOTSUPP;
2082         struct urb              *urb;
2083         struct scatterlist      *sg;
2084         struct usb_sg_request   req;
2085         struct timeval          start;
2086         unsigned                i;
2087 
2088         /* FIXME USBDEVFS_CONNECTINFO doesn't say how fast the device is. */
2089 
2090         pattern = mod_pattern;
2091 
2092         if (code != USBTEST_REQUEST)
2093                 return -EOPNOTSUPP;
2094 
2095         if (param->iterations <= 0)
2096                 return -EINVAL;
2097 
2098         if (param->sglen > MAX_SGLEN)
2099                 return -EINVAL;
2100 
2101         if (mutex_lock_interruptible(&dev->lock))
2102                 return -ERESTARTSYS;
2103 
2104         /* FIXME: What if a system sleep starts while a test is running? */
2105 
2106         /* some devices, like ez-usb default devices, need a non-default
2107          * altsetting to have any active endpoints.  some tests change
2108          * altsettings; force a default so most tests don't need to check.
2109          */
2110         if (dev->info->alt >= 0) {
2111                 int     res;
2112 
2113                 if (intf->altsetting->desc.bInterfaceNumber) {
2114                         mutex_unlock(&dev->lock);
2115                         return -ENODEV;
2116                 }
2117                 res = set_altsetting(dev, dev->info->alt);
2118                 if (res) {
2119                         dev_err(&intf->dev,
2120                                         "set altsetting to %d failed, %d\n",
2121                                         dev->info->alt, res);
2122                         mutex_unlock(&dev->lock);
2123                         return res;
2124                 }
2125         }
2126 
2127         /*
2128          * Just a bunch of test cases that every HCD is expected to handle.
2129          *
2130          * Some may need specific firmware, though it'd be good to have
2131          * one firmware image to handle all the test cases.
2132          *
2133          * FIXME add more tests!  cancel requests, verify the data, control
2134          * queueing, concurrent read+write threads, and so on.
2135          */
2136         do_gettimeofday(&start);
2137         switch (param->test_num) {
2138 
2139         case 0:
2140                 dev_info(&intf->dev, "TEST 0:  NOP\n");
2141                 retval = 0;
2142                 break;
2143 
2144         /* Simple non-queued bulk I/O tests */
2145         case 1:
2146                 if (dev->out_pipe == 0)
2147                         break;
2148                 dev_info(&intf->dev,
2149                                 "TEST 1:  write %d bytes %u times\n",
2150                                 param->length, param->iterations);
2151                 urb = simple_alloc_urb(udev, dev->out_pipe, param->length, 0);
2152                 if (!urb) {
2153                         retval = -ENOMEM;
2154                         break;
2155                 }
2156                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2157                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test1");
2158                 simple_free_urb(urb);
2159                 break;
2160         case 2:
2161                 if (dev->in_pipe == 0)
2162                         break;
2163                 dev_info(&intf->dev,
2164                                 "TEST 2:  read %d bytes %u times\n",
2165                                 param->length, param->iterations);
2166                 urb = simple_alloc_urb(udev, dev->in_pipe, param->length, 0);
2167                 if (!urb) {
2168                         retval = -ENOMEM;
2169                         break;
2170                 }
2171                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2172                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test2");
2173                 simple_free_urb(urb);
2174                 break;
2175         case 3:
2176                 if (dev->out_pipe == 0 || param->vary == 0)
2177                         break;
2178                 dev_info(&intf->dev,
2179                                 "TEST 3:  write/%d 0..%d bytes %u times\n",
2180                                 param->vary, param->length, param->iterations);
2181                 urb = simple_alloc_urb(udev, dev->out_pipe, param->length, 0);
2182                 if (!urb) {
2183                         retval = -ENOMEM;
2184                         break;
2185                 }
2186                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2187                 retval = simple_io(dev, urb, param->iterations, param->vary,
2188                                         0, "test3");
2189                 simple_free_urb(urb);
2190                 break;
2191         case 4:
2192                 if (dev->in_pipe == 0 || param->vary == 0)
2193                         break;
2194                 dev_info(&intf->dev,
2195                                 "TEST 4:  read/%d 0..%d bytes %u times\n",
2196                                 param->vary, param->length, param->iterations);
2197                 urb = simple_alloc_urb(udev, dev->in_pipe, param->length, 0);
2198                 if (!urb) {
2199                         retval = -ENOMEM;
2200                         break;
2201                 }
2202                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2203                 retval = simple_io(dev, urb, param->iterations, param->vary,
2204                                         0, "test4");
2205                 simple_free_urb(urb);
2206                 break;
2207 
2208         /* Queued bulk I/O tests */
2209         case 5:
2210                 if (dev->out_pipe == 0 || param->sglen == 0)
2211                         break;
2212                 dev_info(&intf->dev,
2213                         "TEST 5:  write %d sglists %d entries of %d bytes\n",
2214                                 param->iterations,
2215                                 param->sglen, param->length);
2216                 sg = alloc_sglist(param->sglen, param->length,
2217                                 0, dev, dev->out_pipe);
2218                 if (!sg) {
2219                         retval = -ENOMEM;
2220                         break;
2221                 }
2222                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2223                 retval = perform_sglist(dev, param->iterations, dev->out_pipe,
2224                                 &req, sg, param->sglen);
2225                 free_sglist(sg, param->sglen);
2226                 break;
2227 
2228         case 6:
2229                 if (dev->in_pipe == 0 || param->sglen == 0)
2230                         break;
2231                 dev_info(&intf->dev,
2232                         "TEST 6:  read %d sglists %d entries of %d bytes\n",
2233                                 param->iterations,
2234                                 param->sglen, param->length);
2235                 sg = alloc_sglist(param->sglen, param->length,
2236                                 0, dev, dev->in_pipe);
2237                 if (!sg) {
2238                         retval = -ENOMEM;
2239                         break;
2240                 }
2241                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2242                 retval = perform_sglist(dev, param->iterations, dev->in_pipe,
2243                                 &req, sg, param->sglen);
2244                 free_sglist(sg, param->sglen);
2245                 break;
2246         case 7:
2247                 if (dev->out_pipe == 0 || param->sglen == 0 || param->vary == 0)
2248                         break;
2249                 dev_info(&intf->dev,
2250                         "TEST 7:  write/%d %d sglists %d entries 0..%d bytes\n",
2251                                 param->vary, param->iterations,
2252                                 param->sglen, param->length);
2253                 sg = alloc_sglist(param->sglen, param->length,
2254                                 param->vary, dev, dev->out_pipe);
2255                 if (!sg) {
2256                         retval = -ENOMEM;
2257                         break;
2258                 }
2259                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2260                 retval = perform_sglist(dev, param->iterations, dev->out_pipe,
2261                                 &req, sg, param->sglen);
2262                 free_sglist(sg, param->sglen);
2263                 break;
2264         case 8:
2265                 if (dev->in_pipe == 0 || param->sglen == 0 || param->vary == 0)
2266                         break;
2267                 dev_info(&intf->dev,
2268                         "TEST 8:  read/%d %d sglists %d entries 0..%d bytes\n",
2269                                 param->vary, param->iterations,
2270                                 param->sglen, param->length);
2271                 sg = alloc_sglist(param->sglen, param->length,
2272                                 param->vary, dev, dev->in_pipe);
2273                 if (!sg) {
2274                         retval = -ENOMEM;
2275                         break;
2276                 }
2277                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2278                 retval = perform_sglist(dev, param->iterations, dev->in_pipe,
2279                                 &req, sg, param->sglen);
2280                 free_sglist(sg, param->sglen);
2281                 break;
2282 
2283         /* non-queued sanity tests for control (chapter 9 subset) */
2284         case 9:
2285                 retval = 0;
2286                 dev_info(&intf->dev,
2287                         "TEST 9:  ch9 (subset) control tests, %d times\n",
2288                                 param->iterations);
2289                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2290                         retval = ch9_postconfig(dev);
2291                 if (retval)
2292                         dev_err(&intf->dev, "ch9 subset failed, "
2293                                         "iterations left %d\n", i);
2294                 break;
2295 
2296         /* queued control messaging */
2297         case 10:
2298                 retval = 0;
2299                 dev_info(&intf->dev,
2300                                 "TEST 10:  queue %d control calls, %d times\n",
2301                                 param->sglen,
2302                                 param->iterations);
2303                 retval = test_ctrl_queue(dev, param);
2304                 break;
2305 
2306         /* simple non-queued unlinks (ring with one urb) */
2307         case 11:
2308                 if (dev->in_pipe == 0 || !param->length)
2309                         break;
2310                 retval = 0;
2311                 dev_info(&intf->dev, "TEST 11:  unlink %d reads of %d\n",
2312                                 param->iterations, param->length);
2313                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2314                         retval = unlink_simple(dev, dev->in_pipe,
2315                                                 param->length);
2316                 if (retval)
2317                         dev_err(&intf->dev, "unlink reads failed %d, "
2318                                 "iterations left %d\n", retval, i);
2319                 break;
2320         case 12:
2321                 if (dev->out_pipe == 0 || !param->length)
2322                         break;
2323                 retval = 0;
2324                 dev_info(&intf->dev, "TEST 12:  unlink %d writes of %d\n",
2325                                 param->iterations, param->length);
2326                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2327                         retval = unlink_simple(dev, dev->out_pipe,
2328                                                 param->length);
2329                 if (retval)
2330                         dev_err(&intf->dev, "unlink writes failed %d, "
2331                                 "iterations left %d\n", retval, i);
2332                 break;
2333 
2334         /* ep halt tests */
2335         case 13:
2336                 if (dev->out_pipe == 0 && dev->in_pipe == 0)
2337                         break;
2338                 retval = 0;
2339                 dev_info(&intf->dev, "TEST 13:  set/clear %d halts\n",
2340                                 param->iterations);
2341                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2342                         retval = halt_simple(dev);
2343 
2344                 if (retval)
2345                         ERROR(dev, "halts failed, iterations left %d\n", i);
2346                 break;
2347 
2348         /* control write tests */
2349         case 14:
2350                 if (!dev->info->ctrl_out)
2351                         break;
2352                 dev_info(&intf->dev, "TEST 14:  %d ep0out, %d..%d vary %d\n",
2353                                 param->iterations,
2354                                 realworld ? 1 : 0, param->length,
2355                                 param->vary);
2356                 retval = ctrl_out(dev, param->iterations,
2357                                 param->length, param->vary, 0);
2358                 break;
2359 
2360         /* iso write tests */
2361         case 15:
2362                 if (dev->out_iso_pipe == 0 || param->sglen == 0)
2363                         break;
2364                 dev_info(&intf->dev,
2365                         "TEST 15:  write %d iso, %d entries of %d bytes\n",
2366                                 param->iterations,
2367                                 param->sglen, param->length);
2368                 /* FIRMWARE:  iso sink */
2369                 retval = test_queue(dev, param,
2370                                 dev->out_iso_pipe, dev->iso_out, 0);
2371                 break;
2372 
2373         /* iso read tests */
2374         case 16:
2375                 if (dev->in_iso_pipe == 0 || param->sglen == 0)
2376                         break;
2377                 dev_info(&intf->dev,
2378                         "TEST 16:  read %d iso, %d entries of %d bytes\n",
2379                                 param->iterations,
2380                                 param->sglen, param->length);
2381                 /* FIRMWARE:  iso source */
2382                 retval = test_queue(dev, param,
2383                                 dev->in_iso_pipe, dev->iso_in, 0);
2384                 break;
2385 
2386         /* FIXME scatterlist cancel (needs helper thread) */
2387 
2388         /* Tests for bulk I/O using DMA mapping by core and odd address */
2389         case 17:
2390                 if (dev->out_pipe == 0)
2391                         break;
2392                 dev_info(&intf->dev,
2393                         "TEST 17:  write odd addr %d bytes %u times core map\n",
2394                         param->length, param->iterations);
2395 
2396                 retval = test_unaligned_bulk(
2397                                 dev, dev->out_pipe,
2398                                 param->length, param->iterations,
2399                                 0, "test17");
2400                 break;
2401 
2402         case 18:
2403                 if (dev->in_pipe == 0)
2404                         break;
2405                 dev_info(&intf->dev,
2406                         "TEST 18:  read odd addr %d bytes %u times core map\n",
2407                         param->length, param->iterations);
2408 
2409                 retval = test_unaligned_bulk(
2410                                 dev, dev->in_pipe,
2411                                 param->length, param->iterations,
2412                                 0, "test18");
2413                 break;
2414 
2415         /* Tests for bulk I/O using premapped coherent buffer and odd address */
2416         case 19:
2417                 if (dev->out_pipe == 0)
2418                         break;
2419                 dev_info(&intf->dev,
2420                         "TEST 19:  write odd addr %d bytes %u times premapped\n",
2421                         param->length, param->iterations);
2422 
2423                 retval = test_unaligned_bulk(
2424                                 dev, dev->out_pipe,
2425                                 param->length, param->iterations,
2426                                 URB_NO_TRANSFER_DMA_MAP, "test19");
2427                 break;
2428 
2429         case 20:
2430                 if (dev->in_pipe == 0)
2431                         break;
2432                 dev_info(&intf->dev,
2433                         "TEST 20:  read odd addr %d bytes %u times premapped\n",
2434                         param->length, param->iterations);
2435 
2436                 retval = test_unaligned_bulk(
2437                                 dev, dev->in_pipe,
2438                                 param->length, param->iterations,
2439                                 URB_NO_TRANSFER_DMA_MAP, "test20");
2440                 break;
2441 
2442         /* control write tests with unaligned buffer */
2443         case 21:
2444                 if (!dev->info->ctrl_out)
2445                         break;
2446                 dev_info(&intf->dev,
2447                                 "TEST 21:  %d ep0out odd addr, %d..%d vary %d\n",
2448                                 param->iterations,
2449                                 realworld ? 1 : 0, param->length,
2450                                 param->vary);
2451                 retval = ctrl_out(dev, param->iterations,
2452                                 param->length, param->vary, 1);
2453                 break;
2454 
2455         /* unaligned iso tests */
2456         case 22:
2457                 if (dev->out_iso_pipe == 0 || param->sglen == 0)
2458                         break;
2459                 dev_info(&intf->dev,
2460                         "TEST 22:  write %d iso odd, %d entries of %d bytes\n",
2461                                 param->iterations,
2462                                 param->sglen, param->length);
2463                 retval = test_queue(dev, param,
2464                                 dev->out_iso_pipe, dev->iso_out, 1);
2465                 break;
2466 
2467         case 23:
2468                 if (dev->in_iso_pipe == 0 || param->sglen == 0)
2469                         break;
2470                 dev_info(&intf->dev,
2471                         "TEST 23:  read %d iso odd, %d entries of %d bytes\n",
2472                                 param->iterations,
2473                                 param->sglen, param->length);
2474                 retval = test_queue(dev, param,
2475                                 dev->in_iso_pipe, dev->iso_in, 1);
2476                 break;
2477 
2478         /* unlink URBs from a bulk-OUT queue */
2479         case 24:
2480                 if (dev->out_pipe == 0 || !param->length || param->sglen < 4)
2481                         break;
2482                 retval = 0;
2483                 dev_info(&intf->dev, "TEST 24:  unlink from %d queues of "
2484                                 "%d %d-byte writes\n",
2485                                 param->iterations, param->sglen, param->length);
2486                 for (i = param->iterations; retval == 0 && i > 0; --i) {
2487                         retval = unlink_queued(dev, dev->out_pipe,
2488                                                 param->sglen, param->length);
2489                         if (retval) {
2490                                 dev_err(&intf->dev,
2491                                         "unlink queued writes failed %d, "
2492                                         "iterations left %d\n", retval, i);
2493                                 break;
2494                         }
2495                 }
2496                 break;
2497 
2498         /* Simple non-queued interrupt I/O tests */
2499         case 25:
2500                 if (dev->out_int_pipe == 0)
2501                         break;
2502                 dev_info(&intf->dev,
2503                                 "TEST 25: write %d bytes %u times\n",
2504                                 param->length, param->iterations);
2505                 urb = simple_alloc_urb(udev, dev->out_int_pipe, param->length,
2506                                 dev->int_out->bInterval);
2507                 if (!urb) {
2508                         retval = -ENOMEM;
2509                         break;
2510                 }
2511                 /* FIRMWARE: interrupt sink (maybe accepts short writes) */
2512                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test25");
2513                 simple_free_urb(urb);
2514                 break;
2515         case 26:
2516                 if (dev->in_int_pipe == 0)
2517                         break;
2518                 dev_info(&intf->dev,
2519                                 "TEST 26: read %d bytes %u times\n",
2520                                 param->length, param->iterations);
2521                 urb = simple_alloc_urb(udev, dev->in_int_pipe, param->length,
2522                                 dev->int_in->bInterval);
2523                 if (!urb) {
2524                         retval = -ENOMEM;
2525                         break;
2526                 }
2527                 /* FIRMWARE: interrupt source (maybe generates short writes) */
2528                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test26");
2529                 simple_free_urb(urb);
2530                 break;
2531         case 27:
2532                 /* We do performance test, so ignore data compare */
2533                 if (dev->out_pipe == 0 || param->sglen == 0 || pattern != 0)
2534                         break;
2535                 dev_info(&intf->dev,
2536                         "TEST 27: bulk write %dMbytes\n", (param->iterations *
2537                         param->sglen * param->length) / (1024 * 1024));
2538                 retval = test_queue(dev, param,
2539                                 dev->out_pipe, NULL, 0);
2540                 break;
2541         case 28:
2542                 if (dev->in_pipe == 0 || param->sglen == 0 || pattern != 0)
2543                         break;
2544                 dev_info(&intf->dev,
2545                         "TEST 28: bulk read %dMbytes\n", (param->iterations *
2546                         param->sglen * param->length) / (1024 * 1024));
2547                 retval = test_queue(dev, param,
2548                                 dev->in_pipe, NULL, 0);
2549                 break;
2550         }
2551         do_gettimeofday(&param->duration);
2552         param->duration.tv_sec -= start.tv_sec;
2553         param->duration.tv_usec -= start.tv_usec;
2554         if (param->duration.tv_usec < 0) {
2555                 param->duration.tv_usec += 1000 * 1000;
2556                 param->duration.tv_sec -= 1;
2557         }
2558         mutex_unlock(&dev->lock);
2559         return retval;
2560 }
2561 
2562 /*-------------------------------------------------------------------------*/
2563 
2564 static unsigned force_interrupt;
2565 module_param(force_interrupt, uint, 0);
2566 MODULE_PARM_DESC(force_interrupt, "0 = test default; else interrupt");
2567 
2568 #ifdef  GENERIC
2569 static unsigned short vendor;
2570 module_param(vendor, ushort, 0);
2571 MODULE_PARM_DESC(vendor, "vendor code (from usb-if)");
2572 
2573 static unsigned short product;
2574 module_param(product, ushort, 0);
2575 MODULE_PARM_DESC(product, "product code (from vendor)");
2576 #endif
2577 
2578 static int
2579 usbtest_probe(struct usb_interface *intf, const struct usb_device_id *id)
2580 {
2581         struct usb_device       *udev;
2582         struct usbtest_dev      *dev;
2583         struct usbtest_info     *info;
2584         char                    *rtest, *wtest;
2585         char                    *irtest, *iwtest;
2586         char                    *intrtest, *intwtest;
2587 
2588         udev = interface_to_usbdev(intf);
2589 
2590 #ifdef  GENERIC
2591         /* specify devices by module parameters? */
2592         if (id->match_flags == 0) {
2593                 /* vendor match required, product match optional */
2594                 if (!vendor || le16_to_cpu(udev->descriptor.idVendor) != (u16)vendor)
2595                         return -ENODEV;
2596                 if (product && le16_to_cpu(udev->descriptor.idProduct) != (u16)product)
2597                         return -ENODEV;
2598                 dev_info(&intf->dev, "matched module params, "
2599                                         "vend=0x%04x prod=0x%04x\n",
2600                                 le16_to_cpu(udev->descriptor.idVendor),
2601                                 le16_to_cpu(udev->descriptor.idProduct));
2602         }
2603 #endif
2604 
2605         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
2606         if (!dev)
2607                 return -ENOMEM;
2608         info = (struct usbtest_info *) id->driver_info;
2609         dev->info = info;
2610         mutex_init(&dev->lock);
2611 
2612         dev->intf = intf;
2613 
2614         /* cacheline-aligned scratch for i/o */
2615         dev->buf = kmalloc(TBUF_SIZE, GFP_KERNEL);
2616         if (dev->buf == NULL) {
2617                 kfree(dev);
2618                 return -ENOMEM;
2619         }
2620 
2621         /* NOTE this doesn't yet test the handful of difference that are
2622          * visible with high speed interrupts:  bigger maxpacket (1K) and
2623          * "high bandwidth" modes (up to 3 packets/uframe).
2624          */
2625         rtest = wtest = "";
2626         irtest = iwtest = "";
2627         intrtest = intwtest = "";
2628         if (force_interrupt || udev->speed == USB_SPEED_LOW) {
2629                 if (info->ep_in) {
2630                         dev->in_pipe = usb_rcvintpipe(udev, info->ep_in);
2631                         rtest = " intr-in";
2632                 }
2633                 if (info->ep_out) {
2634                         dev->out_pipe = usb_sndintpipe(udev, info->ep_out);
2635                         wtest = " intr-out";
2636                 }
2637         } else {
2638                 if (override_alt >= 0 || info->autoconf) {
2639                         int status;
2640 
2641                         status = get_endpoints(dev, intf);
2642                         if (status < 0) {
2643                                 WARNING(dev, "couldn't get endpoints, %d\n",
2644                                                 status);
2645                                 kfree(dev->buf);
2646                                 kfree(dev);
2647                                 return status;
2648                         }
2649                         /* may find bulk or ISO pipes */
2650                 } else {
2651                         if (info->ep_in)
2652                                 dev->in_pipe = usb_rcvbulkpipe(udev,
2653                                                         info->ep_in);
2654                         if (info->ep_out)
2655                                 dev->out_pipe = usb_sndbulkpipe(udev,
2656                                                         info->ep_out);
2657                 }
2658                 if (dev->in_pipe)
2659                         rtest = " bulk-in";
2660                 if (dev->out_pipe)
2661                         wtest = " bulk-out";
2662                 if (dev->in_iso_pipe)
2663                         irtest = " iso-in";
2664                 if (dev->out_iso_pipe)
2665                         iwtest = " iso-out";
2666                 if (dev->in_int_pipe)
2667                         intrtest = " int-in";
2668                 if (dev->out_int_pipe)
2669                         intwtest = " int-out";
2670         }
2671 
2672         usb_set_intfdata(intf, dev);
2673         dev_info(&intf->dev, "%s\n", info->name);
2674         dev_info(&intf->dev, "%s {control%s%s%s%s%s%s%s} tests%s\n",
2675                         usb_speed_string(udev->speed),
2676                         info->ctrl_out ? " in/out" : "",
2677                         rtest, wtest,
2678                         irtest, iwtest,
2679                         intrtest, intwtest,
2680                         info->alt >= 0 ? " (+alt)" : "");
2681         return 0;
2682 }
2683 
2684 static int usbtest_suspend(struct usb_interface *intf, pm_message_t message)
2685 {
2686         return 0;
2687 }
2688 
2689 static int usbtest_resume(struct usb_interface *intf)
2690 {
2691         return 0;
2692 }
2693 
2694 
2695 static void usbtest_disconnect(struct usb_interface *intf)
2696 {
2697         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2698 
2699         usb_set_intfdata(intf, NULL);
2700         dev_dbg(&intf->dev, "disconnect\n");
2701         kfree(dev);
2702 }
2703 
2704 /* Basic testing only needs a device that can source or sink bulk traffic.
2705  * Any device can test control transfers (default with GENERIC binding).
2706  *
2707  * Several entries work with the default EP0 implementation that's built
2708  * into EZ-USB chips.  There's a default vendor ID which can be overridden
2709  * by (very) small config EEPROMS, but otherwise all these devices act
2710  * identically until firmware is loaded:  only EP0 works.  It turns out
2711  * to be easy to make other endpoints work, without modifying that EP0
2712  * behavior.  For now, we expect that kind of firmware.
2713  */
2714 
2715 /* an21xx or fx versions of ez-usb */
2716 static struct usbtest_info ez1_info = {
2717         .name           = "EZ-USB device",
2718         .ep_in          = 2,
2719         .ep_out         = 2,
2720         .alt            = 1,
2721 };
2722 
2723 /* fx2 version of ez-usb */
2724 static struct usbtest_info ez2_info = {
2725         .name           = "FX2 device",
2726         .ep_in          = 6,
2727         .ep_out         = 2,
2728         .alt            = 1,
2729 };
2730 
2731 /* ezusb family device with dedicated usb test firmware,
2732  */
2733 static struct usbtest_info fw_info = {
2734         .name           = "usb test device",
2735         .ep_in          = 2,
2736         .ep_out         = 2,
2737         .alt            = 1,
2738         .autoconf       = 1,            /* iso and ctrl_out need autoconf */
2739         .ctrl_out       = 1,
2740         .iso            = 1,            /* iso_ep's are #8 in/out */
2741 };
2742 
2743 /* peripheral running Linux and 'zero.c' test firmware, or
2744  * its user-mode cousin. different versions of this use
2745  * different hardware with the same vendor/product codes.
2746  * host side MUST rely on the endpoint descriptors.
2747  */
2748 static struct usbtest_info gz_info = {
2749         .name           = "Linux gadget zero",
2750         .autoconf       = 1,
2751         .ctrl_out       = 1,
2752         .iso            = 1,
2753         .intr           = 1,
2754         .alt            = 0,
2755 };
2756 
2757 static struct usbtest_info um_info = {
2758         .name           = "Linux user mode test driver",
2759         .autoconf       = 1,
2760         .alt            = -1,
2761 };
2762 
2763 static struct usbtest_info um2_info = {
2764         .name           = "Linux user mode ISO test driver",
2765         .autoconf       = 1,
2766         .iso            = 1,
2767         .alt            = -1,
2768 };
2769 
2770 #ifdef IBOT2
2771 /* this is a nice source of high speed bulk data;
2772  * uses an FX2, with firmware provided in the device
2773  */
2774 static struct usbtest_info ibot2_info = {
2775         .name           = "iBOT2 webcam",
2776         .ep_in          = 2,
2777         .alt            = -1,
2778 };
2779 #endif
2780 
2781 #ifdef GENERIC
2782 /* we can use any device to test control traffic */
2783 static struct usbtest_info generic_info = {
2784         .name           = "Generic USB device",
2785         .alt            = -1,
2786 };
2787 #endif
2788 
2789 
2790 static const struct usb_device_id id_table[] = {
2791 
2792         /*-------------------------------------------------------------*/
2793 
2794         /* EZ-USB devices which download firmware to replace (or in our
2795          * case augment) the default device implementation.
2796          */
2797 
2798         /* generic EZ-USB FX controller */
2799         { USB_DEVICE(0x0547, 0x2235),
2800                 .driver_info = (unsigned long) &ez1_info,
2801         },
2802 
2803         /* CY3671 development board with EZ-USB FX */
2804         { USB_DEVICE(0x0547, 0x0080),
2805                 .driver_info = (unsigned long) &ez1_info,
2806         },
2807 
2808         /* generic EZ-USB FX2 controller (or development board) */
2809         { USB_DEVICE(0x04b4, 0x8613),
2810                 .driver_info = (unsigned long) &ez2_info,
2811         },
2812 
2813         /* re-enumerated usb test device firmware */
2814         { USB_DEVICE(0xfff0, 0xfff0),
2815                 .driver_info = (unsigned long) &fw_info,
2816         },
2817 
2818         /* "Gadget Zero" firmware runs under Linux */
2819         { USB_DEVICE(0x0525, 0xa4a0),
2820                 .driver_info = (unsigned long) &gz_info,
2821         },
2822 
2823         /* so does a user-mode variant */
2824         { USB_DEVICE(0x0525, 0xa4a4),
2825                 .driver_info = (unsigned long) &um_info,
2826         },
2827 
2828         /* ... and a user-mode variant that talks iso */
2829         { USB_DEVICE(0x0525, 0xa4a3),
2830                 .driver_info = (unsigned long) &um2_info,
2831         },
2832 
2833 #ifdef KEYSPAN_19Qi
2834         /* Keyspan 19qi uses an21xx (original EZ-USB) */
2835         /* this does not coexist with the real Keyspan 19qi driver! */
2836         { USB_DEVICE(0x06cd, 0x010b),
2837                 .driver_info = (unsigned long) &ez1_info,
2838         },
2839 #endif
2840 
2841         /*-------------------------------------------------------------*/
2842 
2843 #ifdef IBOT2
2844         /* iBOT2 makes a nice source of high speed bulk-in data */
2845         /* this does not coexist with a real iBOT2 driver! */
2846         { USB_DEVICE(0x0b62, 0x0059),
2847                 .driver_info = (unsigned long) &ibot2_info,
2848         },
2849 #endif
2850 
2851         /*-------------------------------------------------------------*/
2852 
2853 #ifdef GENERIC
2854         /* module params can specify devices to use for control tests */
2855         { .driver_info = (unsigned long) &generic_info, },
2856 #endif
2857 
2858         /*-------------------------------------------------------------*/
2859 
2860         { }
2861 };
2862 MODULE_DEVICE_TABLE(usb, id_table);
2863 
2864 static struct usb_driver usbtest_driver = {
2865         .name =         "usbtest",
2866         .id_table =     id_table,
2867         .probe =        usbtest_probe,
2868         .unlocked_ioctl = usbtest_ioctl,
2869         .disconnect =   usbtest_disconnect,
2870         .suspend =      usbtest_suspend,
2871         .resume =       usbtest_resume,
2872 };
2873 
2874 /*-------------------------------------------------------------------------*/
2875 
2876 static int __init usbtest_init(void)
2877 {
2878 #ifdef GENERIC
2879         if (vendor)
2880                 pr_debug("params: vend=0x%04x prod=0x%04x\n", vendor, product);
2881 #endif
2882         return usb_register(&usbtest_driver);
2883 }
2884 module_init(usbtest_init);
2885 
2886 static void __exit usbtest_exit(void)
2887 {
2888         usb_deregister(&usbtest_driver);
2889 }
2890 module_exit(usbtest_exit);
2891 
2892 MODULE_DESCRIPTION("USB Core/HCD Testing Driver");
2893 MODULE_LICENSE("GPL");
2894 
2895 

This page was automatically generated by LXR 0.3.1 (source).  •  Linux is a registered trademark of Linus Torvalds  •  Contact us