Version:  2.0.40 2.2.26 2.4.37 3.10 3.11 3.12 3.13 3.14 3.15 3.16 3.17 3.18 3.19 4.0 4.1 4.2 4.3 4.4 4.5 4.6 4.7

Linux/drivers/usb/misc/usbtest.c

  1 #include <linux/kernel.h>
  2 #include <linux/errno.h>
  3 #include <linux/init.h>
  4 #include <linux/slab.h>
  5 #include <linux/mm.h>
  6 #include <linux/module.h>
  7 #include <linux/moduleparam.h>
  8 #include <linux/scatterlist.h>
  9 #include <linux/mutex.h>
 10 #include <linux/timer.h>
 11 #include <linux/usb.h>
 12 
 13 #define SIMPLE_IO_TIMEOUT       10000   /* in milliseconds */
 14 
 15 /*-------------------------------------------------------------------------*/
 16 
 17 static int override_alt = -1;
 18 module_param_named(alt, override_alt, int, 0644);
 19 MODULE_PARM_DESC(alt, ">= 0 to override altsetting selection");
 20 static void complicated_callback(struct urb *urb);
 21 
 22 /*-------------------------------------------------------------------------*/
 23 
 24 /* FIXME make these public somewhere; usbdevfs.h? */
 25 
 26 /* Parameter for usbtest driver. */
 27 struct usbtest_param_32 {
 28         /* inputs */
 29         __u32           test_num;       /* 0..(TEST_CASES-1) */
 30         __u32           iterations;
 31         __u32           length;
 32         __u32           vary;
 33         __u32           sglen;
 34 
 35         /* outputs */
 36         __s32           duration_sec;
 37         __s32           duration_usec;
 38 };
 39 
 40 /*
 41  * Compat parameter to the usbtest driver.
 42  * This supports older user space binaries compiled with 64 bit compiler.
 43  */
 44 struct usbtest_param_64 {
 45         /* inputs */
 46         __u32           test_num;       /* 0..(TEST_CASES-1) */
 47         __u32           iterations;
 48         __u32           length;
 49         __u32           vary;
 50         __u32           sglen;
 51 
 52         /* outputs */
 53         __s64           duration_sec;
 54         __s64           duration_usec;
 55 };
 56 
 57 /* IOCTL interface to the driver. */
 58 #define USBTEST_REQUEST_32    _IOWR('U', 100, struct usbtest_param_32)
 59 /* COMPAT IOCTL interface to the driver. */
 60 #define USBTEST_REQUEST_64    _IOWR('U', 100, struct usbtest_param_64)
 61 
 62 /*-------------------------------------------------------------------------*/
 63 
 64 #define GENERIC         /* let probe() bind using module params */
 65 
 66 /* Some devices that can be used for testing will have "real" drivers.
 67  * Entries for those need to be enabled here by hand, after disabling
 68  * that "real" driver.
 69  */
 70 //#define       IBOT2           /* grab iBOT2 webcams */
 71 //#define       KEYSPAN_19Qi    /* grab un-renumerated serial adapter */
 72 
 73 /*-------------------------------------------------------------------------*/
 74 
 75 struct usbtest_info {
 76         const char              *name;
 77         u8                      ep_in;          /* bulk/intr source */
 78         u8                      ep_out;         /* bulk/intr sink */
 79         unsigned                autoconf:1;
 80         unsigned                ctrl_out:1;
 81         unsigned                iso:1;          /* try iso in/out */
 82         unsigned                intr:1;         /* try interrupt in/out */
 83         int                     alt;
 84 };
 85 
 86 /* this is accessed only through usbfs ioctl calls.
 87  * one ioctl to issue a test ... one lock per device.
 88  * tests create other threads if they need them.
 89  * urbs and buffers are allocated dynamically,
 90  * and data generated deterministically.
 91  */
 92 struct usbtest_dev {
 93         struct usb_interface    *intf;
 94         struct usbtest_info     *info;
 95         int                     in_pipe;
 96         int                     out_pipe;
 97         int                     in_iso_pipe;
 98         int                     out_iso_pipe;
 99         int                     in_int_pipe;
100         int                     out_int_pipe;
101         struct usb_endpoint_descriptor  *iso_in, *iso_out;
102         struct usb_endpoint_descriptor  *int_in, *int_out;
103         struct mutex            lock;
104 
105 #define TBUF_SIZE       256
106         u8                      *buf;
107 };
108 
109 static struct usb_device *testdev_to_usbdev(struct usbtest_dev *test)
110 {
111         return interface_to_usbdev(test->intf);
112 }
113 
114 /* set up all urbs so they can be used with either bulk or interrupt */
115 #define INTERRUPT_RATE          1       /* msec/transfer */
116 
117 #define ERROR(tdev, fmt, args...) \
118         dev_err(&(tdev)->intf->dev , fmt , ## args)
119 #define WARNING(tdev, fmt, args...) \
120         dev_warn(&(tdev)->intf->dev , fmt , ## args)
121 
122 #define GUARD_BYTE      0xA5
123 #define MAX_SGLEN       128
124 
125 /*-------------------------------------------------------------------------*/
126 
127 static int
128 get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf)
129 {
130         int                             tmp;
131         struct usb_host_interface       *alt;
132         struct usb_host_endpoint        *in, *out;
133         struct usb_host_endpoint        *iso_in, *iso_out;
134         struct usb_host_endpoint        *int_in, *int_out;
135         struct usb_device               *udev;
136 
137         for (tmp = 0; tmp < intf->num_altsetting; tmp++) {
138                 unsigned        ep;
139 
140                 in = out = NULL;
141                 iso_in = iso_out = NULL;
142                 int_in = int_out = NULL;
143                 alt = intf->altsetting + tmp;
144 
145                 if (override_alt >= 0 &&
146                                 override_alt != alt->desc.bAlternateSetting)
147                         continue;
148 
149                 /* take the first altsetting with in-bulk + out-bulk;
150                  * ignore other endpoints and altsettings.
151                  */
152                 for (ep = 0; ep < alt->desc.bNumEndpoints; ep++) {
153                         struct usb_host_endpoint        *e;
154 
155                         e = alt->endpoint + ep;
156                         switch (usb_endpoint_type(&e->desc)) {
157                         case USB_ENDPOINT_XFER_BULK:
158                                 break;
159                         case USB_ENDPOINT_XFER_INT:
160                                 if (dev->info->intr)
161                                         goto try_intr;
162                         case USB_ENDPOINT_XFER_ISOC:
163                                 if (dev->info->iso)
164                                         goto try_iso;
165                                 /* FALLTHROUGH */
166                         default:
167                                 continue;
168                         }
169                         if (usb_endpoint_dir_in(&e->desc)) {
170                                 if (!in)
171                                         in = e;
172                         } else {
173                                 if (!out)
174                                         out = e;
175                         }
176                         continue;
177 try_intr:
178                         if (usb_endpoint_dir_in(&e->desc)) {
179                                 if (!int_in)
180                                         int_in = e;
181                         } else {
182                                 if (!int_out)
183                                         int_out = e;
184                         }
185                         continue;
186 try_iso:
187                         if (usb_endpoint_dir_in(&e->desc)) {
188                                 if (!iso_in)
189                                         iso_in = e;
190                         } else {
191                                 if (!iso_out)
192                                         iso_out = e;
193                         }
194                 }
195                 if ((in && out)  ||  iso_in || iso_out || int_in || int_out)
196                         goto found;
197         }
198         return -EINVAL;
199 
200 found:
201         udev = testdev_to_usbdev(dev);
202         dev->info->alt = alt->desc.bAlternateSetting;
203         if (alt->desc.bAlternateSetting != 0) {
204                 tmp = usb_set_interface(udev,
205                                 alt->desc.bInterfaceNumber,
206                                 alt->desc.bAlternateSetting);
207                 if (tmp < 0)
208                         return tmp;
209         }
210 
211         if (in) {
212                 dev->in_pipe = usb_rcvbulkpipe(udev,
213                         in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
214                 dev->out_pipe = usb_sndbulkpipe(udev,
215                         out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
216         }
217         if (iso_in) {
218                 dev->iso_in = &iso_in->desc;
219                 dev->in_iso_pipe = usb_rcvisocpipe(udev,
220                                 iso_in->desc.bEndpointAddress
221                                         & USB_ENDPOINT_NUMBER_MASK);
222         }
223 
224         if (iso_out) {
225                 dev->iso_out = &iso_out->desc;
226                 dev->out_iso_pipe = usb_sndisocpipe(udev,
227                                 iso_out->desc.bEndpointAddress
228                                         & USB_ENDPOINT_NUMBER_MASK);
229         }
230 
231         if (int_in) {
232                 dev->int_in = &int_in->desc;
233                 dev->in_int_pipe = usb_rcvintpipe(udev,
234                                 int_in->desc.bEndpointAddress
235                                         & USB_ENDPOINT_NUMBER_MASK);
236         }
237 
238         if (int_out) {
239                 dev->int_out = &int_out->desc;
240                 dev->out_int_pipe = usb_sndintpipe(udev,
241                                 int_out->desc.bEndpointAddress
242                                         & USB_ENDPOINT_NUMBER_MASK);
243         }
244         return 0;
245 }
246 
247 /*-------------------------------------------------------------------------*/
248 
249 /* Support for testing basic non-queued I/O streams.
250  *
251  * These just package urbs as requests that can be easily canceled.
252  * Each urb's data buffer is dynamically allocated; callers can fill
253  * them with non-zero test data (or test for it) when appropriate.
254  */
255 
256 static void simple_callback(struct urb *urb)
257 {
258         complete(urb->context);
259 }
260 
261 static struct urb *usbtest_alloc_urb(
262         struct usb_device       *udev,
263         int                     pipe,
264         unsigned long           bytes,
265         unsigned                transfer_flags,
266         unsigned                offset,
267         u8                      bInterval,
268         usb_complete_t          complete_fn)
269 {
270         struct urb              *urb;
271 
272         urb = usb_alloc_urb(0, GFP_KERNEL);
273         if (!urb)
274                 return urb;
275 
276         if (bInterval)
277                 usb_fill_int_urb(urb, udev, pipe, NULL, bytes, complete_fn,
278                                 NULL, bInterval);
279         else
280                 usb_fill_bulk_urb(urb, udev, pipe, NULL, bytes, complete_fn,
281                                 NULL);
282 
283         urb->interval = (udev->speed == USB_SPEED_HIGH)
284                         ? (INTERRUPT_RATE << 3)
285                         : INTERRUPT_RATE;
286         urb->transfer_flags = transfer_flags;
287         if (usb_pipein(pipe))
288                 urb->transfer_flags |= URB_SHORT_NOT_OK;
289 
290         if ((bytes + offset) == 0)
291                 return urb;
292 
293         if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
294                 urb->transfer_buffer = usb_alloc_coherent(udev, bytes + offset,
295                         GFP_KERNEL, &urb->transfer_dma);
296         else
297                 urb->transfer_buffer = kmalloc(bytes + offset, GFP_KERNEL);
298 
299         if (!urb->transfer_buffer) {
300                 usb_free_urb(urb);
301                 return NULL;
302         }
303 
304         /* To test unaligned transfers add an offset and fill the
305                 unused memory with a guard value */
306         if (offset) {
307                 memset(urb->transfer_buffer, GUARD_BYTE, offset);
308                 urb->transfer_buffer += offset;
309                 if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
310                         urb->transfer_dma += offset;
311         }
312 
313         /* For inbound transfers use guard byte so that test fails if
314                 data not correctly copied */
315         memset(urb->transfer_buffer,
316                         usb_pipein(urb->pipe) ? GUARD_BYTE : 0,
317                         bytes);
318         return urb;
319 }
320 
321 static struct urb *simple_alloc_urb(
322         struct usb_device       *udev,
323         int                     pipe,
324         unsigned long           bytes,
325         u8                      bInterval)
326 {
327         return usbtest_alloc_urb(udev, pipe, bytes, URB_NO_TRANSFER_DMA_MAP, 0,
328                         bInterval, simple_callback);
329 }
330 
331 static struct urb *complicated_alloc_urb(
332         struct usb_device       *udev,
333         int                     pipe,
334         unsigned long           bytes,
335         u8                      bInterval)
336 {
337         return usbtest_alloc_urb(udev, pipe, bytes, URB_NO_TRANSFER_DMA_MAP, 0,
338                         bInterval, complicated_callback);
339 }
340 
341 static unsigned pattern;
342 static unsigned mod_pattern;
343 module_param_named(pattern, mod_pattern, uint, S_IRUGO | S_IWUSR);
344 MODULE_PARM_DESC(mod_pattern, "i/o pattern (0 == zeroes)");
345 
346 static unsigned get_maxpacket(struct usb_device *udev, int pipe)
347 {
348         struct usb_host_endpoint        *ep;
349 
350         ep = usb_pipe_endpoint(udev, pipe);
351         return le16_to_cpup(&ep->desc.wMaxPacketSize);
352 }
353 
354 static void simple_fill_buf(struct urb *urb)
355 {
356         unsigned        i;
357         u8              *buf = urb->transfer_buffer;
358         unsigned        len = urb->transfer_buffer_length;
359         unsigned        maxpacket;
360 
361         switch (pattern) {
362         default:
363                 /* FALLTHROUGH */
364         case 0:
365                 memset(buf, 0, len);
366                 break;
367         case 1:                 /* mod63 */
368                 maxpacket = get_maxpacket(urb->dev, urb->pipe);
369                 for (i = 0; i < len; i++)
370                         *buf++ = (u8) ((i % maxpacket) % 63);
371                 break;
372         }
373 }
374 
375 static inline unsigned long buffer_offset(void *buf)
376 {
377         return (unsigned long)buf & (ARCH_KMALLOC_MINALIGN - 1);
378 }
379 
380 static int check_guard_bytes(struct usbtest_dev *tdev, struct urb *urb)
381 {
382         u8 *buf = urb->transfer_buffer;
383         u8 *guard = buf - buffer_offset(buf);
384         unsigned i;
385 
386         for (i = 0; guard < buf; i++, guard++) {
387                 if (*guard != GUARD_BYTE) {
388                         ERROR(tdev, "guard byte[%d] %d (not %d)\n",
389                                 i, *guard, GUARD_BYTE);
390                         return -EINVAL;
391                 }
392         }
393         return 0;
394 }
395 
396 static int simple_check_buf(struct usbtest_dev *tdev, struct urb *urb)
397 {
398         unsigned        i;
399         u8              expected;
400         u8              *buf = urb->transfer_buffer;
401         unsigned        len = urb->actual_length;
402         unsigned        maxpacket = get_maxpacket(urb->dev, urb->pipe);
403 
404         int ret = check_guard_bytes(tdev, urb);
405         if (ret)
406                 return ret;
407 
408         for (i = 0; i < len; i++, buf++) {
409                 switch (pattern) {
410                 /* all-zeroes has no synchronization issues */
411                 case 0:
412                         expected = 0;
413                         break;
414                 /* mod63 stays in sync with short-terminated transfers,
415                  * or otherwise when host and gadget agree on how large
416                  * each usb transfer request should be.  resync is done
417                  * with set_interface or set_config.
418                  */
419                 case 1:                 /* mod63 */
420                         expected = (i % maxpacket) % 63;
421                         break;
422                 /* always fail unsupported patterns */
423                 default:
424                         expected = !*buf;
425                         break;
426                 }
427                 if (*buf == expected)
428                         continue;
429                 ERROR(tdev, "buf[%d] = %d (not %d)\n", i, *buf, expected);
430                 return -EINVAL;
431         }
432         return 0;
433 }
434 
435 static void simple_free_urb(struct urb *urb)
436 {
437         unsigned long offset = buffer_offset(urb->transfer_buffer);
438 
439         if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
440                 usb_free_coherent(
441                         urb->dev,
442                         urb->transfer_buffer_length + offset,
443                         urb->transfer_buffer - offset,
444                         urb->transfer_dma - offset);
445         else
446                 kfree(urb->transfer_buffer - offset);
447         usb_free_urb(urb);
448 }
449 
450 static int simple_io(
451         struct usbtest_dev      *tdev,
452         struct urb              *urb,
453         int                     iterations,
454         int                     vary,
455         int                     expected,
456         const char              *label
457 )
458 {
459         struct usb_device       *udev = urb->dev;
460         int                     max = urb->transfer_buffer_length;
461         struct completion       completion;
462         int                     retval = 0;
463         unsigned long           expire;
464 
465         urb->context = &completion;
466         while (retval == 0 && iterations-- > 0) {
467                 init_completion(&completion);
468                 if (usb_pipeout(urb->pipe)) {
469                         simple_fill_buf(urb);
470                         urb->transfer_flags |= URB_ZERO_PACKET;
471                 }
472                 retval = usb_submit_urb(urb, GFP_KERNEL);
473                 if (retval != 0)
474                         break;
475 
476                 expire = msecs_to_jiffies(SIMPLE_IO_TIMEOUT);
477                 if (!wait_for_completion_timeout(&completion, expire)) {
478                         usb_kill_urb(urb);
479                         retval = (urb->status == -ENOENT ?
480                                   -ETIMEDOUT : urb->status);
481                 } else {
482                         retval = urb->status;
483                 }
484 
485                 urb->dev = udev;
486                 if (retval == 0 && usb_pipein(urb->pipe))
487                         retval = simple_check_buf(tdev, urb);
488 
489                 if (vary) {
490                         int     len = urb->transfer_buffer_length;
491 
492                         len += vary;
493                         len %= max;
494                         if (len == 0)
495                                 len = (vary < max) ? vary : max;
496                         urb->transfer_buffer_length = len;
497                 }
498 
499                 /* FIXME if endpoint halted, clear halt (and log) */
500         }
501         urb->transfer_buffer_length = max;
502 
503         if (expected != retval)
504                 dev_err(&udev->dev,
505                         "%s failed, iterations left %d, status %d (not %d)\n",
506                                 label, iterations, retval, expected);
507         return retval;
508 }
509 
510 
511 /*-------------------------------------------------------------------------*/
512 
513 /* We use scatterlist primitives to test queued I/O.
514  * Yes, this also tests the scatterlist primitives.
515  */
516 
517 static void free_sglist(struct scatterlist *sg, int nents)
518 {
519         unsigned                i;
520 
521         if (!sg)
522                 return;
523         for (i = 0; i < nents; i++) {
524                 if (!sg_page(&sg[i]))
525                         continue;
526                 kfree(sg_virt(&sg[i]));
527         }
528         kfree(sg);
529 }
530 
531 static struct scatterlist *
532 alloc_sglist(int nents, int max, int vary, struct usbtest_dev *dev, int pipe)
533 {
534         struct scatterlist      *sg;
535         unsigned int            n_size = 0;
536         unsigned                i;
537         unsigned                size = max;
538         unsigned                maxpacket =
539                 get_maxpacket(interface_to_usbdev(dev->intf), pipe);
540 
541         if (max == 0)
542                 return NULL;
543 
544         sg = kmalloc_array(nents, sizeof(*sg), GFP_KERNEL);
545         if (!sg)
546                 return NULL;
547         sg_init_table(sg, nents);
548 
549         for (i = 0; i < nents; i++) {
550                 char            *buf;
551                 unsigned        j;
552 
553                 buf = kzalloc(size, GFP_KERNEL);
554                 if (!buf) {
555                         free_sglist(sg, i);
556                         return NULL;
557                 }
558 
559                 /* kmalloc pages are always physically contiguous! */
560                 sg_set_buf(&sg[i], buf, size);
561 
562                 switch (pattern) {
563                 case 0:
564                         /* already zeroed */
565                         break;
566                 case 1:
567                         for (j = 0; j < size; j++)
568                                 *buf++ = (u8) (((j + n_size) % maxpacket) % 63);
569                         n_size += size;
570                         break;
571                 }
572 
573                 if (vary) {
574                         size += vary;
575                         size %= max;
576                         if (size == 0)
577                                 size = (vary < max) ? vary : max;
578                 }
579         }
580 
581         return sg;
582 }
583 
584 static void sg_timeout(unsigned long _req)
585 {
586         struct usb_sg_request   *req = (struct usb_sg_request *) _req;
587 
588         req->status = -ETIMEDOUT;
589         usb_sg_cancel(req);
590 }
591 
592 static int perform_sglist(
593         struct usbtest_dev      *tdev,
594         unsigned                iterations,
595         int                     pipe,
596         struct usb_sg_request   *req,
597         struct scatterlist      *sg,
598         int                     nents
599 )
600 {
601         struct usb_device       *udev = testdev_to_usbdev(tdev);
602         int                     retval = 0;
603         struct timer_list       sg_timer;
604 
605         setup_timer_on_stack(&sg_timer, sg_timeout, (unsigned long) req);
606 
607         while (retval == 0 && iterations-- > 0) {
608                 retval = usb_sg_init(req, udev, pipe,
609                                 (udev->speed == USB_SPEED_HIGH)
610                                         ? (INTERRUPT_RATE << 3)
611                                         : INTERRUPT_RATE,
612                                 sg, nents, 0, GFP_KERNEL);
613 
614                 if (retval)
615                         break;
616                 mod_timer(&sg_timer, jiffies +
617                                 msecs_to_jiffies(SIMPLE_IO_TIMEOUT));
618                 usb_sg_wait(req);
619                 del_timer_sync(&sg_timer);
620                 retval = req->status;
621 
622                 /* FIXME check resulting data pattern */
623 
624                 /* FIXME if endpoint halted, clear halt (and log) */
625         }
626 
627         /* FIXME for unlink or fault handling tests, don't report
628          * failure if retval is as we expected ...
629          */
630         if (retval)
631                 ERROR(tdev, "perform_sglist failed, "
632                                 "iterations left %d, status %d\n",
633                                 iterations, retval);
634         return retval;
635 }
636 
637 
638 /*-------------------------------------------------------------------------*/
639 
640 /* unqueued control message testing
641  *
642  * there's a nice set of device functional requirements in chapter 9 of the
643  * usb 2.0 spec, which we can apply to ANY device, even ones that don't use
644  * special test firmware.
645  *
646  * we know the device is configured (or suspended) by the time it's visible
647  * through usbfs.  we can't change that, so we won't test enumeration (which
648  * worked 'well enough' to get here, this time), power management (ditto),
649  * or remote wakeup (which needs human interaction).
650  */
651 
652 static unsigned realworld = 1;
653 module_param(realworld, uint, 0);
654 MODULE_PARM_DESC(realworld, "clear to demand stricter spec compliance");
655 
656 static int get_altsetting(struct usbtest_dev *dev)
657 {
658         struct usb_interface    *iface = dev->intf;
659         struct usb_device       *udev = interface_to_usbdev(iface);
660         int                     retval;
661 
662         retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
663                         USB_REQ_GET_INTERFACE, USB_DIR_IN|USB_RECIP_INTERFACE,
664                         0, iface->altsetting[0].desc.bInterfaceNumber,
665                         dev->buf, 1, USB_CTRL_GET_TIMEOUT);
666         switch (retval) {
667         case 1:
668                 return dev->buf[0];
669         case 0:
670                 retval = -ERANGE;
671                 /* FALLTHROUGH */
672         default:
673                 return retval;
674         }
675 }
676 
677 static int set_altsetting(struct usbtest_dev *dev, int alternate)
678 {
679         struct usb_interface            *iface = dev->intf;
680         struct usb_device               *udev;
681 
682         if (alternate < 0 || alternate >= 256)
683                 return -EINVAL;
684 
685         udev = interface_to_usbdev(iface);
686         return usb_set_interface(udev,
687                         iface->altsetting[0].desc.bInterfaceNumber,
688                         alternate);
689 }
690 
691 static int is_good_config(struct usbtest_dev *tdev, int len)
692 {
693         struct usb_config_descriptor    *config;
694 
695         if (len < sizeof(*config))
696                 return 0;
697         config = (struct usb_config_descriptor *) tdev->buf;
698 
699         switch (config->bDescriptorType) {
700         case USB_DT_CONFIG:
701         case USB_DT_OTHER_SPEED_CONFIG:
702                 if (config->bLength != 9) {
703                         ERROR(tdev, "bogus config descriptor length\n");
704                         return 0;
705                 }
706                 /* this bit 'must be 1' but often isn't */
707                 if (!realworld && !(config->bmAttributes & 0x80)) {
708                         ERROR(tdev, "high bit of config attributes not set\n");
709                         return 0;
710                 }
711                 if (config->bmAttributes & 0x1f) {      /* reserved == 0 */
712                         ERROR(tdev, "reserved config bits set\n");
713                         return 0;
714                 }
715                 break;
716         default:
717                 return 0;
718         }
719 
720         if (le16_to_cpu(config->wTotalLength) == len)   /* read it all */
721                 return 1;
722         if (le16_to_cpu(config->wTotalLength) >= TBUF_SIZE)     /* max partial read */
723                 return 1;
724         ERROR(tdev, "bogus config descriptor read size\n");
725         return 0;
726 }
727 
728 static int is_good_ext(struct usbtest_dev *tdev, u8 *buf)
729 {
730         struct usb_ext_cap_descriptor *ext;
731         u32 attr;
732 
733         ext = (struct usb_ext_cap_descriptor *) buf;
734 
735         if (ext->bLength != USB_DT_USB_EXT_CAP_SIZE) {
736                 ERROR(tdev, "bogus usb 2.0 extension descriptor length\n");
737                 return 0;
738         }
739 
740         attr = le32_to_cpu(ext->bmAttributes);
741         /* bits[1:15] is used and others are reserved */
742         if (attr & ~0xfffe) {   /* reserved == 0 */
743                 ERROR(tdev, "reserved bits set\n");
744                 return 0;
745         }
746 
747         return 1;
748 }
749 
750 static int is_good_ss_cap(struct usbtest_dev *tdev, u8 *buf)
751 {
752         struct usb_ss_cap_descriptor *ss;
753 
754         ss = (struct usb_ss_cap_descriptor *) buf;
755 
756         if (ss->bLength != USB_DT_USB_SS_CAP_SIZE) {
757                 ERROR(tdev, "bogus superspeed device capability descriptor length\n");
758                 return 0;
759         }
760 
761         /*
762          * only bit[1] of bmAttributes is used for LTM and others are
763          * reserved
764          */
765         if (ss->bmAttributes & ~0x02) { /* reserved == 0 */
766                 ERROR(tdev, "reserved bits set in bmAttributes\n");
767                 return 0;
768         }
769 
770         /* bits[0:3] of wSpeedSupported is used and others are reserved */
771         if (le16_to_cpu(ss->wSpeedSupported) & ~0x0f) { /* reserved == 0 */
772                 ERROR(tdev, "reserved bits set in wSpeedSupported\n");
773                 return 0;
774         }
775 
776         return 1;
777 }
778 
779 static int is_good_con_id(struct usbtest_dev *tdev, u8 *buf)
780 {
781         struct usb_ss_container_id_descriptor *con_id;
782 
783         con_id = (struct usb_ss_container_id_descriptor *) buf;
784 
785         if (con_id->bLength != USB_DT_USB_SS_CONTN_ID_SIZE) {
786                 ERROR(tdev, "bogus container id descriptor length\n");
787                 return 0;
788         }
789 
790         if (con_id->bReserved) {        /* reserved == 0 */
791                 ERROR(tdev, "reserved bits set\n");
792                 return 0;
793         }
794 
795         return 1;
796 }
797 
798 /* sanity test for standard requests working with usb_control_mesg() and some
799  * of the utility functions which use it.
800  *
801  * this doesn't test how endpoint halts behave or data toggles get set, since
802  * we won't do I/O to bulk/interrupt endpoints here (which is how to change
803  * halt or toggle).  toggle testing is impractical without support from hcds.
804  *
805  * this avoids failing devices linux would normally work with, by not testing
806  * config/altsetting operations for devices that only support their defaults.
807  * such devices rarely support those needless operations.
808  *
809  * NOTE that since this is a sanity test, it's not examining boundary cases
810  * to see if usbcore, hcd, and device all behave right.  such testing would
811  * involve varied read sizes and other operation sequences.
812  */
813 static int ch9_postconfig(struct usbtest_dev *dev)
814 {
815         struct usb_interface    *iface = dev->intf;
816         struct usb_device       *udev = interface_to_usbdev(iface);
817         int                     i, alt, retval;
818 
819         /* [9.2.3] if there's more than one altsetting, we need to be able to
820          * set and get each one.  mostly trusts the descriptors from usbcore.
821          */
822         for (i = 0; i < iface->num_altsetting; i++) {
823 
824                 /* 9.2.3 constrains the range here */
825                 alt = iface->altsetting[i].desc.bAlternateSetting;
826                 if (alt < 0 || alt >= iface->num_altsetting) {
827                         dev_err(&iface->dev,
828                                         "invalid alt [%d].bAltSetting = %d\n",
829                                         i, alt);
830                 }
831 
832                 /* [real world] get/set unimplemented if there's only one */
833                 if (realworld && iface->num_altsetting == 1)
834                         continue;
835 
836                 /* [9.4.10] set_interface */
837                 retval = set_altsetting(dev, alt);
838                 if (retval) {
839                         dev_err(&iface->dev, "can't set_interface = %d, %d\n",
840                                         alt, retval);
841                         return retval;
842                 }
843 
844                 /* [9.4.4] get_interface always works */
845                 retval = get_altsetting(dev);
846                 if (retval != alt) {
847                         dev_err(&iface->dev, "get alt should be %d, was %d\n",
848                                         alt, retval);
849                         return (retval < 0) ? retval : -EDOM;
850                 }
851 
852         }
853 
854         /* [real world] get_config unimplemented if there's only one */
855         if (!realworld || udev->descriptor.bNumConfigurations != 1) {
856                 int     expected = udev->actconfig->desc.bConfigurationValue;
857 
858                 /* [9.4.2] get_configuration always works
859                  * ... although some cheap devices (like one TI Hub I've got)
860                  * won't return config descriptors except before set_config.
861                  */
862                 retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
863                                 USB_REQ_GET_CONFIGURATION,
864                                 USB_DIR_IN | USB_RECIP_DEVICE,
865                                 0, 0, dev->buf, 1, USB_CTRL_GET_TIMEOUT);
866                 if (retval != 1 || dev->buf[0] != expected) {
867                         dev_err(&iface->dev, "get config --> %d %d (1 %d)\n",
868                                 retval, dev->buf[0], expected);
869                         return (retval < 0) ? retval : -EDOM;
870                 }
871         }
872 
873         /* there's always [9.4.3] a device descriptor [9.6.1] */
874         retval = usb_get_descriptor(udev, USB_DT_DEVICE, 0,
875                         dev->buf, sizeof(udev->descriptor));
876         if (retval != sizeof(udev->descriptor)) {
877                 dev_err(&iface->dev, "dev descriptor --> %d\n", retval);
878                 return (retval < 0) ? retval : -EDOM;
879         }
880 
881         /*
882          * there's always [9.4.3] a bos device descriptor [9.6.2] in USB
883          * 3.0 spec
884          */
885         if (le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0210) {
886                 struct usb_bos_descriptor *bos = NULL;
887                 struct usb_dev_cap_header *header = NULL;
888                 unsigned total, num, length;
889                 u8 *buf;
890 
891                 retval = usb_get_descriptor(udev, USB_DT_BOS, 0, dev->buf,
892                                 sizeof(*udev->bos->desc));
893                 if (retval != sizeof(*udev->bos->desc)) {
894                         dev_err(&iface->dev, "bos descriptor --> %d\n", retval);
895                         return (retval < 0) ? retval : -EDOM;
896                 }
897 
898                 bos = (struct usb_bos_descriptor *)dev->buf;
899                 total = le16_to_cpu(bos->wTotalLength);
900                 num = bos->bNumDeviceCaps;
901 
902                 if (total > TBUF_SIZE)
903                         total = TBUF_SIZE;
904 
905                 /*
906                  * get generic device-level capability descriptors [9.6.2]
907                  * in USB 3.0 spec
908                  */
909                 retval = usb_get_descriptor(udev, USB_DT_BOS, 0, dev->buf,
910                                 total);
911                 if (retval != total) {
912                         dev_err(&iface->dev, "bos descriptor set --> %d\n",
913                                         retval);
914                         return (retval < 0) ? retval : -EDOM;
915                 }
916 
917                 length = sizeof(*udev->bos->desc);
918                 buf = dev->buf;
919                 for (i = 0; i < num; i++) {
920                         buf += length;
921                         if (buf + sizeof(struct usb_dev_cap_header) >
922                                         dev->buf + total)
923                                 break;
924 
925                         header = (struct usb_dev_cap_header *)buf;
926                         length = header->bLength;
927 
928                         if (header->bDescriptorType !=
929                                         USB_DT_DEVICE_CAPABILITY) {
930                                 dev_warn(&udev->dev, "not device capability descriptor, skip\n");
931                                 continue;
932                         }
933 
934                         switch (header->bDevCapabilityType) {
935                         case USB_CAP_TYPE_EXT:
936                                 if (buf + USB_DT_USB_EXT_CAP_SIZE >
937                                                 dev->buf + total ||
938                                                 !is_good_ext(dev, buf)) {
939                                         dev_err(&iface->dev, "bogus usb 2.0 extension descriptor\n");
940                                         return -EDOM;
941                                 }
942                                 break;
943                         case USB_SS_CAP_TYPE:
944                                 if (buf + USB_DT_USB_SS_CAP_SIZE >
945                                                 dev->buf + total ||
946                                                 !is_good_ss_cap(dev, buf)) {
947                                         dev_err(&iface->dev, "bogus superspeed device capability descriptor\n");
948                                         return -EDOM;
949                                 }
950                                 break;
951                         case CONTAINER_ID_TYPE:
952                                 if (buf + USB_DT_USB_SS_CONTN_ID_SIZE >
953                                                 dev->buf + total ||
954                                                 !is_good_con_id(dev, buf)) {
955                                         dev_err(&iface->dev, "bogus container id descriptor\n");
956                                         return -EDOM;
957                                 }
958                                 break;
959                         default:
960                                 break;
961                         }
962                 }
963         }
964 
965         /* there's always [9.4.3] at least one config descriptor [9.6.3] */
966         for (i = 0; i < udev->descriptor.bNumConfigurations; i++) {
967                 retval = usb_get_descriptor(udev, USB_DT_CONFIG, i,
968                                 dev->buf, TBUF_SIZE);
969                 if (!is_good_config(dev, retval)) {
970                         dev_err(&iface->dev,
971                                         "config [%d] descriptor --> %d\n",
972                                         i, retval);
973                         return (retval < 0) ? retval : -EDOM;
974                 }
975 
976                 /* FIXME cross-checking udev->config[i] to make sure usbcore
977                  * parsed it right (etc) would be good testing paranoia
978                  */
979         }
980 
981         /* and sometimes [9.2.6.6] speed dependent descriptors */
982         if (le16_to_cpu(udev->descriptor.bcdUSB) == 0x0200) {
983                 struct usb_qualifier_descriptor *d = NULL;
984 
985                 /* device qualifier [9.6.2] */
986                 retval = usb_get_descriptor(udev,
987                                 USB_DT_DEVICE_QUALIFIER, 0, dev->buf,
988                                 sizeof(struct usb_qualifier_descriptor));
989                 if (retval == -EPIPE) {
990                         if (udev->speed == USB_SPEED_HIGH) {
991                                 dev_err(&iface->dev,
992                                                 "hs dev qualifier --> %d\n",
993                                                 retval);
994                                 return (retval < 0) ? retval : -EDOM;
995                         }
996                         /* usb2.0 but not high-speed capable; fine */
997                 } else if (retval != sizeof(struct usb_qualifier_descriptor)) {
998                         dev_err(&iface->dev, "dev qualifier --> %d\n", retval);
999                         return (retval < 0) ? retval : -EDOM;
1000                 } else
1001                         d = (struct usb_qualifier_descriptor *) dev->buf;
1002 
1003                 /* might not have [9.6.2] any other-speed configs [9.6.4] */
1004                 if (d) {
1005                         unsigned max = d->bNumConfigurations;
1006                         for (i = 0; i < max; i++) {
1007                                 retval = usb_get_descriptor(udev,
1008                                         USB_DT_OTHER_SPEED_CONFIG, i,
1009                                         dev->buf, TBUF_SIZE);
1010                                 if (!is_good_config(dev, retval)) {
1011                                         dev_err(&iface->dev,
1012                                                 "other speed config --> %d\n",
1013                                                 retval);
1014                                         return (retval < 0) ? retval : -EDOM;
1015                                 }
1016                         }
1017                 }
1018         }
1019         /* FIXME fetch strings from at least the device descriptor */
1020 
1021         /* [9.4.5] get_status always works */
1022         retval = usb_get_status(udev, USB_RECIP_DEVICE, 0, dev->buf);
1023         if (retval) {
1024                 dev_err(&iface->dev, "get dev status --> %d\n", retval);
1025                 return retval;
1026         }
1027 
1028         /* FIXME configuration.bmAttributes says if we could try to set/clear
1029          * the device's remote wakeup feature ... if we can, test that here
1030          */
1031 
1032         retval = usb_get_status(udev, USB_RECIP_INTERFACE,
1033                         iface->altsetting[0].desc.bInterfaceNumber, dev->buf);
1034         if (retval) {
1035                 dev_err(&iface->dev, "get interface status --> %d\n", retval);
1036                 return retval;
1037         }
1038         /* FIXME get status for each endpoint in the interface */
1039 
1040         return 0;
1041 }
1042 
1043 /*-------------------------------------------------------------------------*/
1044 
1045 /* use ch9 requests to test whether:
1046  *   (a) queues work for control, keeping N subtests queued and
1047  *       active (auto-resubmit) for M loops through the queue.
1048  *   (b) protocol stalls (control-only) will autorecover.
1049  *       it's not like bulk/intr; no halt clearing.
1050  *   (c) short control reads are reported and handled.
1051  *   (d) queues are always processed in-order
1052  */
1053 
1054 struct ctrl_ctx {
1055         spinlock_t              lock;
1056         struct usbtest_dev      *dev;
1057         struct completion       complete;
1058         unsigned                count;
1059         unsigned                pending;
1060         int                     status;
1061         struct urb              **urb;
1062         struct usbtest_param_32 *param;
1063         int                     last;
1064 };
1065 
1066 #define NUM_SUBCASES    16              /* how many test subcases here? */
1067 
1068 struct subcase {
1069         struct usb_ctrlrequest  setup;
1070         int                     number;
1071         int                     expected;
1072 };
1073 
1074 static void ctrl_complete(struct urb *urb)
1075 {
1076         struct ctrl_ctx         *ctx = urb->context;
1077         struct usb_ctrlrequest  *reqp;
1078         struct subcase          *subcase;
1079         int                     status = urb->status;
1080 
1081         reqp = (struct usb_ctrlrequest *)urb->setup_packet;
1082         subcase = container_of(reqp, struct subcase, setup);
1083 
1084         spin_lock(&ctx->lock);
1085         ctx->count--;
1086         ctx->pending--;
1087 
1088         /* queue must transfer and complete in fifo order, unless
1089          * usb_unlink_urb() is used to unlink something not at the
1090          * physical queue head (not tested).
1091          */
1092         if (subcase->number > 0) {
1093                 if ((subcase->number - ctx->last) != 1) {
1094                         ERROR(ctx->dev,
1095                                 "subcase %d completed out of order, last %d\n",
1096                                 subcase->number, ctx->last);
1097                         status = -EDOM;
1098                         ctx->last = subcase->number;
1099                         goto error;
1100                 }
1101         }
1102         ctx->last = subcase->number;
1103 
1104         /* succeed or fault in only one way? */
1105         if (status == subcase->expected)
1106                 status = 0;
1107 
1108         /* async unlink for cleanup? */
1109         else if (status != -ECONNRESET) {
1110 
1111                 /* some faults are allowed, not required */
1112                 if (subcase->expected > 0 && (
1113                           ((status == -subcase->expected        /* happened */
1114                            || status == 0))))                   /* didn't */
1115                         status = 0;
1116                 /* sometimes more than one fault is allowed */
1117                 else if (subcase->number == 12 && status == -EPIPE)
1118                         status = 0;
1119                 else
1120                         ERROR(ctx->dev, "subtest %d error, status %d\n",
1121                                         subcase->number, status);
1122         }
1123 
1124         /* unexpected status codes mean errors; ideally, in hardware */
1125         if (status) {
1126 error:
1127                 if (ctx->status == 0) {
1128                         int             i;
1129 
1130                         ctx->status = status;
1131                         ERROR(ctx->dev, "control queue %02x.%02x, err %d, "
1132                                         "%d left, subcase %d, len %d/%d\n",
1133                                         reqp->bRequestType, reqp->bRequest,
1134                                         status, ctx->count, subcase->number,
1135                                         urb->actual_length,
1136                                         urb->transfer_buffer_length);
1137 
1138                         /* FIXME this "unlink everything" exit route should
1139                          * be a separate test case.
1140                          */
1141 
1142                         /* unlink whatever's still pending */
1143                         for (i = 1; i < ctx->param->sglen; i++) {
1144                                 struct urb *u = ctx->urb[
1145                                                         (i + subcase->number)
1146                                                         % ctx->param->sglen];
1147 
1148                                 if (u == urb || !u->dev)
1149                                         continue;
1150                                 spin_unlock(&ctx->lock);
1151                                 status = usb_unlink_urb(u);
1152                                 spin_lock(&ctx->lock);
1153                                 switch (status) {
1154                                 case -EINPROGRESS:
1155                                 case -EBUSY:
1156                                 case -EIDRM:
1157                                         continue;
1158                                 default:
1159                                         ERROR(ctx->dev, "urb unlink --> %d\n",
1160                                                         status);
1161                                 }
1162                         }
1163                         status = ctx->status;
1164                 }
1165         }
1166 
1167         /* resubmit if we need to, else mark this as done */
1168         if ((status == 0) && (ctx->pending < ctx->count)) {
1169                 status = usb_submit_urb(urb, GFP_ATOMIC);
1170                 if (status != 0) {
1171                         ERROR(ctx->dev,
1172                                 "can't resubmit ctrl %02x.%02x, err %d\n",
1173                                 reqp->bRequestType, reqp->bRequest, status);
1174                         urb->dev = NULL;
1175                 } else
1176                         ctx->pending++;
1177         } else
1178                 urb->dev = NULL;
1179 
1180         /* signal completion when nothing's queued */
1181         if (ctx->pending == 0)
1182                 complete(&ctx->complete);
1183         spin_unlock(&ctx->lock);
1184 }
1185 
1186 static int
1187 test_ctrl_queue(struct usbtest_dev *dev, struct usbtest_param_32 *param)
1188 {
1189         struct usb_device       *udev = testdev_to_usbdev(dev);
1190         struct urb              **urb;
1191         struct ctrl_ctx         context;
1192         int                     i;
1193 
1194         if (param->sglen == 0 || param->iterations > UINT_MAX / param->sglen)
1195                 return -EOPNOTSUPP;
1196 
1197         spin_lock_init(&context.lock);
1198         context.dev = dev;
1199         init_completion(&context.complete);
1200         context.count = param->sglen * param->iterations;
1201         context.pending = 0;
1202         context.status = -ENOMEM;
1203         context.param = param;
1204         context.last = -1;
1205 
1206         /* allocate and init the urbs we'll queue.
1207          * as with bulk/intr sglists, sglen is the queue depth; it also
1208          * controls which subtests run (more tests than sglen) or rerun.
1209          */
1210         urb = kcalloc(param->sglen, sizeof(struct urb *), GFP_KERNEL);
1211         if (!urb)
1212                 return -ENOMEM;
1213         for (i = 0; i < param->sglen; i++) {
1214                 int                     pipe = usb_rcvctrlpipe(udev, 0);
1215                 unsigned                len;
1216                 struct urb              *u;
1217                 struct usb_ctrlrequest  req;
1218                 struct subcase          *reqp;
1219 
1220                 /* sign of this variable means:
1221                  *  -: tested code must return this (negative) error code
1222                  *  +: tested code may return this (negative too) error code
1223                  */
1224                 int                     expected = 0;
1225 
1226                 /* requests here are mostly expected to succeed on any
1227                  * device, but some are chosen to trigger protocol stalls
1228                  * or short reads.
1229                  */
1230                 memset(&req, 0, sizeof(req));
1231                 req.bRequest = USB_REQ_GET_DESCRIPTOR;
1232                 req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
1233 
1234                 switch (i % NUM_SUBCASES) {
1235                 case 0:         /* get device descriptor */
1236                         req.wValue = cpu_to_le16(USB_DT_DEVICE << 8);
1237                         len = sizeof(struct usb_device_descriptor);
1238                         break;
1239                 case 1:         /* get first config descriptor (only) */
1240                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1241                         len = sizeof(struct usb_config_descriptor);
1242                         break;
1243                 case 2:         /* get altsetting (OFTEN STALLS) */
1244                         req.bRequest = USB_REQ_GET_INTERFACE;
1245                         req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
1246                         /* index = 0 means first interface */
1247                         len = 1;
1248                         expected = EPIPE;
1249                         break;
1250                 case 3:         /* get interface status */
1251                         req.bRequest = USB_REQ_GET_STATUS;
1252                         req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
1253                         /* interface 0 */
1254                         len = 2;
1255                         break;
1256                 case 4:         /* get device status */
1257                         req.bRequest = USB_REQ_GET_STATUS;
1258                         req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
1259                         len = 2;
1260                         break;
1261                 case 5:         /* get device qualifier (MAY STALL) */
1262                         req.wValue = cpu_to_le16 (USB_DT_DEVICE_QUALIFIER << 8);
1263                         len = sizeof(struct usb_qualifier_descriptor);
1264                         if (udev->speed != USB_SPEED_HIGH)
1265                                 expected = EPIPE;
1266                         break;
1267                 case 6:         /* get first config descriptor, plus interface */
1268                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1269                         len = sizeof(struct usb_config_descriptor);
1270                         len += sizeof(struct usb_interface_descriptor);
1271                         break;
1272                 case 7:         /* get interface descriptor (ALWAYS STALLS) */
1273                         req.wValue = cpu_to_le16 (USB_DT_INTERFACE << 8);
1274                         /* interface == 0 */
1275                         len = sizeof(struct usb_interface_descriptor);
1276                         expected = -EPIPE;
1277                         break;
1278                 /* NOTE: two consecutive stalls in the queue here.
1279                  *  that tests fault recovery a bit more aggressively. */
1280                 case 8:         /* clear endpoint halt (MAY STALL) */
1281                         req.bRequest = USB_REQ_CLEAR_FEATURE;
1282                         req.bRequestType = USB_RECIP_ENDPOINT;
1283                         /* wValue 0 == ep halt */
1284                         /* wIndex 0 == ep0 (shouldn't halt!) */
1285                         len = 0;
1286                         pipe = usb_sndctrlpipe(udev, 0);
1287                         expected = EPIPE;
1288                         break;
1289                 case 9:         /* get endpoint status */
1290                         req.bRequest = USB_REQ_GET_STATUS;
1291                         req.bRequestType = USB_DIR_IN|USB_RECIP_ENDPOINT;
1292                         /* endpoint 0 */
1293                         len = 2;
1294                         break;
1295                 case 10:        /* trigger short read (EREMOTEIO) */
1296                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1297                         len = 1024;
1298                         expected = -EREMOTEIO;
1299                         break;
1300                 /* NOTE: two consecutive _different_ faults in the queue. */
1301                 case 11:        /* get endpoint descriptor (ALWAYS STALLS) */
1302                         req.wValue = cpu_to_le16(USB_DT_ENDPOINT << 8);
1303                         /* endpoint == 0 */
1304                         len = sizeof(struct usb_interface_descriptor);
1305                         expected = EPIPE;
1306                         break;
1307                 /* NOTE: sometimes even a third fault in the queue! */
1308                 case 12:        /* get string 0 descriptor (MAY STALL) */
1309                         req.wValue = cpu_to_le16(USB_DT_STRING << 8);
1310                         /* string == 0, for language IDs */
1311                         len = sizeof(struct usb_interface_descriptor);
1312                         /* may succeed when > 4 languages */
1313                         expected = EREMOTEIO;   /* or EPIPE, if no strings */
1314                         break;
1315                 case 13:        /* short read, resembling case 10 */
1316                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1317                         /* last data packet "should" be DATA1, not DATA0 */
1318                         if (udev->speed == USB_SPEED_SUPER)
1319                                 len = 1024 - 512;
1320                         else
1321                                 len = 1024 - udev->descriptor.bMaxPacketSize0;
1322                         expected = -EREMOTEIO;
1323                         break;
1324                 case 14:        /* short read; try to fill the last packet */
1325                         req.wValue = cpu_to_le16((USB_DT_DEVICE << 8) | 0);
1326                         /* device descriptor size == 18 bytes */
1327                         len = udev->descriptor.bMaxPacketSize0;
1328                         if (udev->speed == USB_SPEED_SUPER)
1329                                 len = 512;
1330                         switch (len) {
1331                         case 8:
1332                                 len = 24;
1333                                 break;
1334                         case 16:
1335                                 len = 32;
1336                                 break;
1337                         }
1338                         expected = -EREMOTEIO;
1339                         break;
1340                 case 15:
1341                         req.wValue = cpu_to_le16(USB_DT_BOS << 8);
1342                         if (udev->bos)
1343                                 len = le16_to_cpu(udev->bos->desc->wTotalLength);
1344                         else
1345                                 len = sizeof(struct usb_bos_descriptor);
1346                         if (le16_to_cpu(udev->descriptor.bcdUSB) < 0x0201)
1347                                 expected = -EPIPE;
1348                         break;
1349                 default:
1350                         ERROR(dev, "bogus number of ctrl queue testcases!\n");
1351                         context.status = -EINVAL;
1352                         goto cleanup;
1353                 }
1354                 req.wLength = cpu_to_le16(len);
1355                 urb[i] = u = simple_alloc_urb(udev, pipe, len, 0);
1356                 if (!u)
1357                         goto cleanup;
1358 
1359                 reqp = kmalloc(sizeof(*reqp), GFP_KERNEL);
1360                 if (!reqp)
1361                         goto cleanup;
1362                 reqp->setup = req;
1363                 reqp->number = i % NUM_SUBCASES;
1364                 reqp->expected = expected;
1365                 u->setup_packet = (char *) &reqp->setup;
1366 
1367                 u->context = &context;
1368                 u->complete = ctrl_complete;
1369         }
1370 
1371         /* queue the urbs */
1372         context.urb = urb;
1373         spin_lock_irq(&context.lock);
1374         for (i = 0; i < param->sglen; i++) {
1375                 context.status = usb_submit_urb(urb[i], GFP_ATOMIC);
1376                 if (context.status != 0) {
1377                         ERROR(dev, "can't submit urb[%d], status %d\n",
1378                                         i, context.status);
1379                         context.count = context.pending;
1380                         break;
1381                 }
1382                 context.pending++;
1383         }
1384         spin_unlock_irq(&context.lock);
1385 
1386         /* FIXME  set timer and time out; provide a disconnect hook */
1387 
1388         /* wait for the last one to complete */
1389         if (context.pending > 0)
1390                 wait_for_completion(&context.complete);
1391 
1392 cleanup:
1393         for (i = 0; i < param->sglen; i++) {
1394                 if (!urb[i])
1395                         continue;
1396                 urb[i]->dev = udev;
1397                 kfree(urb[i]->setup_packet);
1398                 simple_free_urb(urb[i]);
1399         }
1400         kfree(urb);
1401         return context.status;
1402 }
1403 #undef NUM_SUBCASES
1404 
1405 
1406 /*-------------------------------------------------------------------------*/
1407 
1408 static void unlink1_callback(struct urb *urb)
1409 {
1410         int     status = urb->status;
1411 
1412         /* we "know" -EPIPE (stall) never happens */
1413         if (!status)
1414                 status = usb_submit_urb(urb, GFP_ATOMIC);
1415         if (status) {
1416                 urb->status = status;
1417                 complete(urb->context);
1418         }
1419 }
1420 
1421 static int unlink1(struct usbtest_dev *dev, int pipe, int size, int async)
1422 {
1423         struct urb              *urb;
1424         struct completion       completion;
1425         int                     retval = 0;
1426 
1427         init_completion(&completion);
1428         urb = simple_alloc_urb(testdev_to_usbdev(dev), pipe, size, 0);
1429         if (!urb)
1430                 return -ENOMEM;
1431         urb->context = &completion;
1432         urb->complete = unlink1_callback;
1433 
1434         if (usb_pipeout(urb->pipe)) {
1435                 simple_fill_buf(urb);
1436                 urb->transfer_flags |= URB_ZERO_PACKET;
1437         }
1438 
1439         /* keep the endpoint busy.  there are lots of hc/hcd-internal
1440          * states, and testing should get to all of them over time.
1441          *
1442          * FIXME want additional tests for when endpoint is STALLing
1443          * due to errors, or is just NAKing requests.
1444          */
1445         retval = usb_submit_urb(urb, GFP_KERNEL);
1446         if (retval != 0) {
1447                 dev_err(&dev->intf->dev, "submit fail %d\n", retval);
1448                 return retval;
1449         }
1450 
1451         /* unlinking that should always work.  variable delay tests more
1452          * hcd states and code paths, even with little other system load.
1453          */
1454         msleep(jiffies % (2 * INTERRUPT_RATE));
1455         if (async) {
1456                 while (!completion_done(&completion)) {
1457                         retval = usb_unlink_urb(urb);
1458 
1459                         if (retval == 0 && usb_pipein(urb->pipe))
1460                                 retval = simple_check_buf(dev, urb);
1461 
1462                         switch (retval) {
1463                         case -EBUSY:
1464                         case -EIDRM:
1465                                 /* we can't unlink urbs while they're completing
1466                                  * or if they've completed, and we haven't
1467                                  * resubmitted. "normal" drivers would prevent
1468                                  * resubmission, but since we're testing unlink
1469                                  * paths, we can't.
1470                                  */
1471                                 ERROR(dev, "unlink retry\n");
1472                                 continue;
1473                         case 0:
1474                         case -EINPROGRESS:
1475                                 break;
1476 
1477                         default:
1478                                 dev_err(&dev->intf->dev,
1479                                         "unlink fail %d\n", retval);
1480                                 return retval;
1481                         }
1482 
1483                         break;
1484                 }
1485         } else
1486                 usb_kill_urb(urb);
1487 
1488         wait_for_completion(&completion);
1489         retval = urb->status;
1490         simple_free_urb(urb);
1491 
1492         if (async)
1493                 return (retval == -ECONNRESET) ? 0 : retval - 1000;
1494         else
1495                 return (retval == -ENOENT || retval == -EPERM) ?
1496                                 0 : retval - 2000;
1497 }
1498 
1499 static int unlink_simple(struct usbtest_dev *dev, int pipe, int len)
1500 {
1501         int                     retval = 0;
1502 
1503         /* test sync and async paths */
1504         retval = unlink1(dev, pipe, len, 1);
1505         if (!retval)
1506                 retval = unlink1(dev, pipe, len, 0);
1507         return retval;
1508 }
1509 
1510 /*-------------------------------------------------------------------------*/
1511 
1512 struct queued_ctx {
1513         struct completion       complete;
1514         atomic_t                pending;
1515         unsigned                num;
1516         int                     status;
1517         struct urb              **urbs;
1518 };
1519 
1520 static void unlink_queued_callback(struct urb *urb)
1521 {
1522         int                     status = urb->status;
1523         struct queued_ctx       *ctx = urb->context;
1524 
1525         if (ctx->status)
1526                 goto done;
1527         if (urb == ctx->urbs[ctx->num - 4] || urb == ctx->urbs[ctx->num - 2]) {
1528                 if (status == -ECONNRESET)
1529                         goto done;
1530                 /* What error should we report if the URB completed normally? */
1531         }
1532         if (status != 0)
1533                 ctx->status = status;
1534 
1535  done:
1536         if (atomic_dec_and_test(&ctx->pending))
1537                 complete(&ctx->complete);
1538 }
1539 
1540 static int unlink_queued(struct usbtest_dev *dev, int pipe, unsigned num,
1541                 unsigned size)
1542 {
1543         struct queued_ctx       ctx;
1544         struct usb_device       *udev = testdev_to_usbdev(dev);
1545         void                    *buf;
1546         dma_addr_t              buf_dma;
1547         int                     i;
1548         int                     retval = -ENOMEM;
1549 
1550         init_completion(&ctx.complete);
1551         atomic_set(&ctx.pending, 1);    /* One more than the actual value */
1552         ctx.num = num;
1553         ctx.status = 0;
1554 
1555         buf = usb_alloc_coherent(udev, size, GFP_KERNEL, &buf_dma);
1556         if (!buf)
1557                 return retval;
1558         memset(buf, 0, size);
1559 
1560         /* Allocate and init the urbs we'll queue */
1561         ctx.urbs = kcalloc(num, sizeof(struct urb *), GFP_KERNEL);
1562         if (!ctx.urbs)
1563                 goto free_buf;
1564         for (i = 0; i < num; i++) {
1565                 ctx.urbs[i] = usb_alloc_urb(0, GFP_KERNEL);
1566                 if (!ctx.urbs[i])
1567                         goto free_urbs;
1568                 usb_fill_bulk_urb(ctx.urbs[i], udev, pipe, buf, size,
1569                                 unlink_queued_callback, &ctx);
1570                 ctx.urbs[i]->transfer_dma = buf_dma;
1571                 ctx.urbs[i]->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
1572 
1573                 if (usb_pipeout(ctx.urbs[i]->pipe)) {
1574                         simple_fill_buf(ctx.urbs[i]);
1575                         ctx.urbs[i]->transfer_flags |= URB_ZERO_PACKET;
1576                 }
1577         }
1578 
1579         /* Submit all the URBs and then unlink URBs num - 4 and num - 2. */
1580         for (i = 0; i < num; i++) {
1581                 atomic_inc(&ctx.pending);
1582                 retval = usb_submit_urb(ctx.urbs[i], GFP_KERNEL);
1583                 if (retval != 0) {
1584                         dev_err(&dev->intf->dev, "submit urbs[%d] fail %d\n",
1585                                         i, retval);
1586                         atomic_dec(&ctx.pending);
1587                         ctx.status = retval;
1588                         break;
1589                 }
1590         }
1591         if (i == num) {
1592                 usb_unlink_urb(ctx.urbs[num - 4]);
1593                 usb_unlink_urb(ctx.urbs[num - 2]);
1594         } else {
1595                 while (--i >= 0)
1596                         usb_unlink_urb(ctx.urbs[i]);
1597         }
1598 
1599         if (atomic_dec_and_test(&ctx.pending))          /* The extra count */
1600                 complete(&ctx.complete);
1601         wait_for_completion(&ctx.complete);
1602         retval = ctx.status;
1603 
1604  free_urbs:
1605         for (i = 0; i < num; i++)
1606                 usb_free_urb(ctx.urbs[i]);
1607         kfree(ctx.urbs);
1608  free_buf:
1609         usb_free_coherent(udev, size, buf, buf_dma);
1610         return retval;
1611 }
1612 
1613 /*-------------------------------------------------------------------------*/
1614 
1615 static int verify_not_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
1616 {
1617         int     retval;
1618         u16     status;
1619 
1620         /* shouldn't look or act halted */
1621         retval = usb_get_status(urb->dev, USB_RECIP_ENDPOINT, ep, &status);
1622         if (retval < 0) {
1623                 ERROR(tdev, "ep %02x couldn't get no-halt status, %d\n",
1624                                 ep, retval);
1625                 return retval;
1626         }
1627         if (status != 0) {
1628                 ERROR(tdev, "ep %02x bogus status: %04x != 0\n", ep, status);
1629                 return -EINVAL;
1630         }
1631         retval = simple_io(tdev, urb, 1, 0, 0, __func__);
1632         if (retval != 0)
1633                 return -EINVAL;
1634         return 0;
1635 }
1636 
1637 static int verify_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
1638 {
1639         int     retval;
1640         u16     status;
1641 
1642         /* should look and act halted */
1643         retval = usb_get_status(urb->dev, USB_RECIP_ENDPOINT, ep, &status);
1644         if (retval < 0) {
1645                 ERROR(tdev, "ep %02x couldn't get halt status, %d\n",
1646                                 ep, retval);
1647                 return retval;
1648         }
1649         if (status != 1) {
1650                 ERROR(tdev, "ep %02x bogus status: %04x != 1\n", ep, status);
1651                 return -EINVAL;
1652         }
1653         retval = simple_io(tdev, urb, 1, 0, -EPIPE, __func__);
1654         if (retval != -EPIPE)
1655                 return -EINVAL;
1656         retval = simple_io(tdev, urb, 1, 0, -EPIPE, "verify_still_halted");
1657         if (retval != -EPIPE)
1658                 return -EINVAL;
1659         return 0;
1660 }
1661 
1662 static int test_halt(struct usbtest_dev *tdev, int ep, struct urb *urb)
1663 {
1664         int     retval;
1665 
1666         /* shouldn't look or act halted now */
1667         retval = verify_not_halted(tdev, ep, urb);
1668         if (retval < 0)
1669                 return retval;
1670 
1671         /* set halt (protocol test only), verify it worked */
1672         retval = usb_control_msg(urb->dev, usb_sndctrlpipe(urb->dev, 0),
1673                         USB_REQ_SET_FEATURE, USB_RECIP_ENDPOINT,
1674                         USB_ENDPOINT_HALT, ep,
1675                         NULL, 0, USB_CTRL_SET_TIMEOUT);
1676         if (retval < 0) {
1677                 ERROR(tdev, "ep %02x couldn't set halt, %d\n", ep, retval);
1678                 return retval;
1679         }
1680         retval = verify_halted(tdev, ep, urb);
1681         if (retval < 0) {
1682                 int ret;
1683 
1684                 /* clear halt anyways, else further tests will fail */
1685                 ret = usb_clear_halt(urb->dev, urb->pipe);
1686                 if (ret)
1687                         ERROR(tdev, "ep %02x couldn't clear halt, %d\n",
1688                               ep, ret);
1689 
1690                 return retval;
1691         }
1692 
1693         /* clear halt (tests API + protocol), verify it worked */
1694         retval = usb_clear_halt(urb->dev, urb->pipe);
1695         if (retval < 0) {
1696                 ERROR(tdev, "ep %02x couldn't clear halt, %d\n", ep, retval);
1697                 return retval;
1698         }
1699         retval = verify_not_halted(tdev, ep, urb);
1700         if (retval < 0)
1701                 return retval;
1702 
1703         /* NOTE:  could also verify SET_INTERFACE clear halts ... */
1704 
1705         return 0;
1706 }
1707 
1708 static int halt_simple(struct usbtest_dev *dev)
1709 {
1710         int                     ep;
1711         int                     retval = 0;
1712         struct urb              *urb;
1713         struct usb_device       *udev = testdev_to_usbdev(dev);
1714 
1715         if (udev->speed == USB_SPEED_SUPER)
1716                 urb = simple_alloc_urb(udev, 0, 1024, 0);
1717         else
1718                 urb = simple_alloc_urb(udev, 0, 512, 0);
1719         if (urb == NULL)
1720                 return -ENOMEM;
1721 
1722         if (dev->in_pipe) {
1723                 ep = usb_pipeendpoint(dev->in_pipe) | USB_DIR_IN;
1724                 urb->pipe = dev->in_pipe;
1725                 retval = test_halt(dev, ep, urb);
1726                 if (retval < 0)
1727                         goto done;
1728         }
1729 
1730         if (dev->out_pipe) {
1731                 ep = usb_pipeendpoint(dev->out_pipe);
1732                 urb->pipe = dev->out_pipe;
1733                 retval = test_halt(dev, ep, urb);
1734         }
1735 done:
1736         simple_free_urb(urb);
1737         return retval;
1738 }
1739 
1740 /*-------------------------------------------------------------------------*/
1741 
1742 /* Control OUT tests use the vendor control requests from Intel's
1743  * USB 2.0 compliance test device:  write a buffer, read it back.
1744  *
1745  * Intel's spec only _requires_ that it work for one packet, which
1746  * is pretty weak.   Some HCDs place limits here; most devices will
1747  * need to be able to handle more than one OUT data packet.  We'll
1748  * try whatever we're told to try.
1749  */
1750 static int ctrl_out(struct usbtest_dev *dev,
1751                 unsigned count, unsigned length, unsigned vary, unsigned offset)
1752 {
1753         unsigned                i, j, len;
1754         int                     retval;
1755         u8                      *buf;
1756         char                    *what = "?";
1757         struct usb_device       *udev;
1758 
1759         if (length < 1 || length > 0xffff || vary >= length)
1760                 return -EINVAL;
1761 
1762         buf = kmalloc(length + offset, GFP_KERNEL);
1763         if (!buf)
1764                 return -ENOMEM;
1765 
1766         buf += offset;
1767         udev = testdev_to_usbdev(dev);
1768         len = length;
1769         retval = 0;
1770 
1771         /* NOTE:  hardware might well act differently if we pushed it
1772          * with lots back-to-back queued requests.
1773          */
1774         for (i = 0; i < count; i++) {
1775                 /* write patterned data */
1776                 for (j = 0; j < len; j++)
1777                         buf[j] = (u8)(i + j);
1778                 retval = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
1779                                 0x5b, USB_DIR_OUT|USB_TYPE_VENDOR,
1780                                 0, 0, buf, len, USB_CTRL_SET_TIMEOUT);
1781                 if (retval != len) {
1782                         what = "write";
1783                         if (retval >= 0) {
1784                                 ERROR(dev, "ctrl_out, wlen %d (expected %d)\n",
1785                                                 retval, len);
1786                                 retval = -EBADMSG;
1787                         }
1788                         break;
1789                 }
1790 
1791                 /* read it back -- assuming nothing intervened!!  */
1792                 retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
1793                                 0x5c, USB_DIR_IN|USB_TYPE_VENDOR,
1794                                 0, 0, buf, len, USB_CTRL_GET_TIMEOUT);
1795                 if (retval != len) {
1796                         what = "read";
1797                         if (retval >= 0) {
1798                                 ERROR(dev, "ctrl_out, rlen %d (expected %d)\n",
1799                                                 retval, len);
1800                                 retval = -EBADMSG;
1801                         }
1802                         break;
1803                 }
1804 
1805                 /* fail if we can't verify */
1806                 for (j = 0; j < len; j++) {
1807                         if (buf[j] != (u8)(i + j)) {
1808                                 ERROR(dev, "ctrl_out, byte %d is %d not %d\n",
1809                                         j, buf[j], (u8)(i + j));
1810                                 retval = -EBADMSG;
1811                                 break;
1812                         }
1813                 }
1814                 if (retval < 0) {
1815                         what = "verify";
1816                         break;
1817                 }
1818 
1819                 len += vary;
1820 
1821                 /* [real world] the "zero bytes IN" case isn't really used.
1822                  * hardware can easily trip up in this weird case, since its
1823                  * status stage is IN, not OUT like other ep0in transfers.
1824                  */
1825                 if (len > length)
1826                         len = realworld ? 1 : 0;
1827         }
1828 
1829         if (retval < 0)
1830                 ERROR(dev, "ctrl_out %s failed, code %d, count %d\n",
1831                         what, retval, i);
1832 
1833         kfree(buf - offset);
1834         return retval;
1835 }
1836 
1837 /*-------------------------------------------------------------------------*/
1838 
1839 /* ISO/BULK tests ... mimics common usage
1840  *  - buffer length is split into N packets (mostly maxpacket sized)
1841  *  - multi-buffers according to sglen
1842  */
1843 
1844 struct transfer_context {
1845         unsigned                count;
1846         unsigned                pending;
1847         spinlock_t              lock;
1848         struct completion       done;
1849         int                     submit_error;
1850         unsigned long           errors;
1851         unsigned long           packet_count;
1852         struct usbtest_dev      *dev;
1853         bool                    is_iso;
1854 };
1855 
1856 static void complicated_callback(struct urb *urb)
1857 {
1858         struct transfer_context *ctx = urb->context;
1859 
1860         spin_lock(&ctx->lock);
1861         ctx->count--;
1862 
1863         ctx->packet_count += urb->number_of_packets;
1864         if (urb->error_count > 0)
1865                 ctx->errors += urb->error_count;
1866         else if (urb->status != 0)
1867                 ctx->errors += (ctx->is_iso ? urb->number_of_packets : 1);
1868         else if (urb->actual_length != urb->transfer_buffer_length)
1869                 ctx->errors++;
1870         else if (check_guard_bytes(ctx->dev, urb) != 0)
1871                 ctx->errors++;
1872 
1873         if (urb->status == 0 && ctx->count > (ctx->pending - 1)
1874                         && !ctx->submit_error) {
1875                 int status = usb_submit_urb(urb, GFP_ATOMIC);
1876                 switch (status) {
1877                 case 0:
1878                         goto done;
1879                 default:
1880                         dev_err(&ctx->dev->intf->dev,
1881                                         "resubmit err %d\n",
1882                                         status);
1883                         /* FALLTHROUGH */
1884                 case -ENODEV:                   /* disconnected */
1885                 case -ESHUTDOWN:                /* endpoint disabled */
1886                         ctx->submit_error = 1;
1887                         break;
1888                 }
1889         }
1890 
1891         ctx->pending--;
1892         if (ctx->pending == 0) {
1893                 if (ctx->errors)
1894                         dev_err(&ctx->dev->intf->dev,
1895                                 "during the test, %lu errors out of %lu\n",
1896                                 ctx->errors, ctx->packet_count);
1897                 complete(&ctx->done);
1898         }
1899 done:
1900         spin_unlock(&ctx->lock);
1901 }
1902 
1903 static struct urb *iso_alloc_urb(
1904         struct usb_device       *udev,
1905         int                     pipe,
1906         struct usb_endpoint_descriptor  *desc,
1907         long                    bytes,
1908         unsigned offset
1909 )
1910 {
1911         struct urb              *urb;
1912         unsigned                i, maxp, packets;
1913 
1914         if (bytes < 0 || !desc)
1915                 return NULL;
1916         maxp = 0x7ff & usb_endpoint_maxp(desc);
1917         maxp *= 1 + (0x3 & (usb_endpoint_maxp(desc) >> 11));
1918         packets = DIV_ROUND_UP(bytes, maxp);
1919 
1920         urb = usb_alloc_urb(packets, GFP_KERNEL);
1921         if (!urb)
1922                 return urb;
1923         urb->dev = udev;
1924         urb->pipe = pipe;
1925 
1926         urb->number_of_packets = packets;
1927         urb->transfer_buffer_length = bytes;
1928         urb->transfer_buffer = usb_alloc_coherent(udev, bytes + offset,
1929                                                         GFP_KERNEL,
1930                                                         &urb->transfer_dma);
1931         if (!urb->transfer_buffer) {
1932                 usb_free_urb(urb);
1933                 return NULL;
1934         }
1935         if (offset) {
1936                 memset(urb->transfer_buffer, GUARD_BYTE, offset);
1937                 urb->transfer_buffer += offset;
1938                 urb->transfer_dma += offset;
1939         }
1940         /* For inbound transfers use guard byte so that test fails if
1941                 data not correctly copied */
1942         memset(urb->transfer_buffer,
1943                         usb_pipein(urb->pipe) ? GUARD_BYTE : 0,
1944                         bytes);
1945 
1946         for (i = 0; i < packets; i++) {
1947                 /* here, only the last packet will be short */
1948                 urb->iso_frame_desc[i].length = min((unsigned) bytes, maxp);
1949                 bytes -= urb->iso_frame_desc[i].length;
1950 
1951                 urb->iso_frame_desc[i].offset = maxp * i;
1952         }
1953 
1954         urb->complete = complicated_callback;
1955         /* urb->context = SET BY CALLER */
1956         urb->interval = 1 << (desc->bInterval - 1);
1957         urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
1958         return urb;
1959 }
1960 
1961 static int
1962 test_queue(struct usbtest_dev *dev, struct usbtest_param_32 *param,
1963                 int pipe, struct usb_endpoint_descriptor *desc, unsigned offset)
1964 {
1965         struct transfer_context context;
1966         struct usb_device       *udev;
1967         unsigned                i;
1968         unsigned long           packets = 0;
1969         int                     status = 0;
1970         struct urb              *urbs[param->sglen];
1971 
1972         memset(&context, 0, sizeof(context));
1973         context.count = param->iterations * param->sglen;
1974         context.dev = dev;
1975         context.is_iso = !!desc;
1976         init_completion(&context.done);
1977         spin_lock_init(&context.lock);
1978 
1979         udev = testdev_to_usbdev(dev);
1980 
1981         for (i = 0; i < param->sglen; i++) {
1982                 if (context.is_iso)
1983                         urbs[i] = iso_alloc_urb(udev, pipe, desc,
1984                                         param->length, offset);
1985                 else
1986                         urbs[i] = complicated_alloc_urb(udev, pipe,
1987                                         param->length, 0);
1988 
1989                 if (!urbs[i]) {
1990                         status = -ENOMEM;
1991                         goto fail;
1992                 }
1993                 packets += urbs[i]->number_of_packets;
1994                 urbs[i]->context = &context;
1995         }
1996         packets *= param->iterations;
1997 
1998         if (context.is_iso) {
1999                 dev_info(&dev->intf->dev,
2000                         "iso period %d %sframes, wMaxPacket %d, transactions: %d\n",
2001                         1 << (desc->bInterval - 1),
2002                         (udev->speed == USB_SPEED_HIGH) ? "micro" : "",
2003                         usb_endpoint_maxp(desc) & 0x7ff,
2004                         1 + (0x3 & (usb_endpoint_maxp(desc) >> 11)));
2005 
2006                 dev_info(&dev->intf->dev,
2007                         "total %lu msec (%lu packets)\n",
2008                         (packets * (1 << (desc->bInterval - 1)))
2009                                 / ((udev->speed == USB_SPEED_HIGH) ? 8 : 1),
2010                         packets);
2011         }
2012 
2013         spin_lock_irq(&context.lock);
2014         for (i = 0; i < param->sglen; i++) {
2015                 ++context.pending;
2016                 status = usb_submit_urb(urbs[i], GFP_ATOMIC);
2017                 if (status < 0) {
2018                         ERROR(dev, "submit iso[%d], error %d\n", i, status);
2019                         if (i == 0) {
2020                                 spin_unlock_irq(&context.lock);
2021                                 goto fail;
2022                         }
2023 
2024                         simple_free_urb(urbs[i]);
2025                         urbs[i] = NULL;
2026                         context.pending--;
2027                         context.submit_error = 1;
2028                         break;
2029                 }
2030         }
2031         spin_unlock_irq(&context.lock);
2032 
2033         wait_for_completion(&context.done);
2034 
2035         for (i = 0; i < param->sglen; i++) {
2036                 if (urbs[i])
2037                         simple_free_urb(urbs[i]);
2038         }
2039         /*
2040          * Isochronous transfers are expected to fail sometimes.  As an
2041          * arbitrary limit, we will report an error if any submissions
2042          * fail or if the transfer failure rate is > 10%.
2043          */
2044         if (status != 0)
2045                 ;
2046         else if (context.submit_error)
2047                 status = -EACCES;
2048         else if (context.errors >
2049                         (context.is_iso ? context.packet_count / 10 : 0))
2050                 status = -EIO;
2051         return status;
2052 
2053 fail:
2054         for (i = 0; i < param->sglen; i++) {
2055                 if (urbs[i])
2056                         simple_free_urb(urbs[i]);
2057         }
2058         return status;
2059 }
2060 
2061 static int test_unaligned_bulk(
2062         struct usbtest_dev *tdev,
2063         int pipe,
2064         unsigned length,
2065         int iterations,
2066         unsigned transfer_flags,
2067         const char *label)
2068 {
2069         int retval;
2070         struct urb *urb = usbtest_alloc_urb(testdev_to_usbdev(tdev),
2071                         pipe, length, transfer_flags, 1, 0, simple_callback);
2072 
2073         if (!urb)
2074                 return -ENOMEM;
2075 
2076         retval = simple_io(tdev, urb, iterations, 0, 0, label);
2077         simple_free_urb(urb);
2078         return retval;
2079 }
2080 
2081 /* Run tests. */
2082 static int
2083 usbtest_do_ioctl(struct usb_interface *intf, struct usbtest_param_32 *param)
2084 {
2085         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2086         struct usb_device       *udev = testdev_to_usbdev(dev);
2087         struct urb              *urb;
2088         struct scatterlist      *sg;
2089         struct usb_sg_request   req;
2090         unsigned                i;
2091         int     retval = -EOPNOTSUPP;
2092 
2093         if (param->iterations <= 0)
2094                 return -EINVAL;
2095         /*
2096          * Just a bunch of test cases that every HCD is expected to handle.
2097          *
2098          * Some may need specific firmware, though it'd be good to have
2099          * one firmware image to handle all the test cases.
2100          *
2101          * FIXME add more tests!  cancel requests, verify the data, control
2102          * queueing, concurrent read+write threads, and so on.
2103          */
2104         switch (param->test_num) {
2105 
2106         case 0:
2107                 dev_info(&intf->dev, "TEST 0:  NOP\n");
2108                 retval = 0;
2109                 break;
2110 
2111         /* Simple non-queued bulk I/O tests */
2112         case 1:
2113                 if (dev->out_pipe == 0)
2114                         break;
2115                 dev_info(&intf->dev,
2116                                 "TEST 1:  write %d bytes %u times\n",
2117                                 param->length, param->iterations);
2118                 urb = simple_alloc_urb(udev, dev->out_pipe, param->length, 0);
2119                 if (!urb) {
2120                         retval = -ENOMEM;
2121                         break;
2122                 }
2123                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2124                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test1");
2125                 simple_free_urb(urb);
2126                 break;
2127         case 2:
2128                 if (dev->in_pipe == 0)
2129                         break;
2130                 dev_info(&intf->dev,
2131                                 "TEST 2:  read %d bytes %u times\n",
2132                                 param->length, param->iterations);
2133                 urb = simple_alloc_urb(udev, dev->in_pipe, param->length, 0);
2134                 if (!urb) {
2135                         retval = -ENOMEM;
2136                         break;
2137                 }
2138                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2139                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test2");
2140                 simple_free_urb(urb);
2141                 break;
2142         case 3:
2143                 if (dev->out_pipe == 0 || param->vary == 0)
2144                         break;
2145                 dev_info(&intf->dev,
2146                                 "TEST 3:  write/%d 0..%d bytes %u times\n",
2147                                 param->vary, param->length, param->iterations);
2148                 urb = simple_alloc_urb(udev, dev->out_pipe, param->length, 0);
2149                 if (!urb) {
2150                         retval = -ENOMEM;
2151                         break;
2152                 }
2153                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2154                 retval = simple_io(dev, urb, param->iterations, param->vary,
2155                                         0, "test3");
2156                 simple_free_urb(urb);
2157                 break;
2158         case 4:
2159                 if (dev->in_pipe == 0 || param->vary == 0)
2160                         break;
2161                 dev_info(&intf->dev,
2162                                 "TEST 4:  read/%d 0..%d bytes %u times\n",
2163                                 param->vary, param->length, param->iterations);
2164                 urb = simple_alloc_urb(udev, dev->in_pipe, param->length, 0);
2165                 if (!urb) {
2166                         retval = -ENOMEM;
2167                         break;
2168                 }
2169                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2170                 retval = simple_io(dev, urb, param->iterations, param->vary,
2171                                         0, "test4");
2172                 simple_free_urb(urb);
2173                 break;
2174 
2175         /* Queued bulk I/O tests */
2176         case 5:
2177                 if (dev->out_pipe == 0 || param->sglen == 0)
2178                         break;
2179                 dev_info(&intf->dev,
2180                         "TEST 5:  write %d sglists %d entries of %d bytes\n",
2181                                 param->iterations,
2182                                 param->sglen, param->length);
2183                 sg = alloc_sglist(param->sglen, param->length,
2184                                 0, dev, dev->out_pipe);
2185                 if (!sg) {
2186                         retval = -ENOMEM;
2187                         break;
2188                 }
2189                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2190                 retval = perform_sglist(dev, param->iterations, dev->out_pipe,
2191                                 &req, sg, param->sglen);
2192                 free_sglist(sg, param->sglen);
2193                 break;
2194 
2195         case 6:
2196                 if (dev->in_pipe == 0 || param->sglen == 0)
2197                         break;
2198                 dev_info(&intf->dev,
2199                         "TEST 6:  read %d sglists %d entries of %d bytes\n",
2200                                 param->iterations,
2201                                 param->sglen, param->length);
2202                 sg = alloc_sglist(param->sglen, param->length,
2203                                 0, dev, dev->in_pipe);
2204                 if (!sg) {
2205                         retval = -ENOMEM;
2206                         break;
2207                 }
2208                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2209                 retval = perform_sglist(dev, param->iterations, dev->in_pipe,
2210                                 &req, sg, param->sglen);
2211                 free_sglist(sg, param->sglen);
2212                 break;
2213         case 7:
2214                 if (dev->out_pipe == 0 || param->sglen == 0 || param->vary == 0)
2215                         break;
2216                 dev_info(&intf->dev,
2217                         "TEST 7:  write/%d %d sglists %d entries 0..%d bytes\n",
2218                                 param->vary, param->iterations,
2219                                 param->sglen, param->length);
2220                 sg = alloc_sglist(param->sglen, param->length,
2221                                 param->vary, dev, dev->out_pipe);
2222                 if (!sg) {
2223                         retval = -ENOMEM;
2224                         break;
2225                 }
2226                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2227                 retval = perform_sglist(dev, param->iterations, dev->out_pipe,
2228                                 &req, sg, param->sglen);
2229                 free_sglist(sg, param->sglen);
2230                 break;
2231         case 8:
2232                 if (dev->in_pipe == 0 || param->sglen == 0 || param->vary == 0)
2233                         break;
2234                 dev_info(&intf->dev,
2235                         "TEST 8:  read/%d %d sglists %d entries 0..%d bytes\n",
2236                                 param->vary, param->iterations,
2237                                 param->sglen, param->length);
2238                 sg = alloc_sglist(param->sglen, param->length,
2239                                 param->vary, dev, dev->in_pipe);
2240                 if (!sg) {
2241                         retval = -ENOMEM;
2242                         break;
2243                 }
2244                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2245                 retval = perform_sglist(dev, param->iterations, dev->in_pipe,
2246                                 &req, sg, param->sglen);
2247                 free_sglist(sg, param->sglen);
2248                 break;
2249 
2250         /* non-queued sanity tests for control (chapter 9 subset) */
2251         case 9:
2252                 retval = 0;
2253                 dev_info(&intf->dev,
2254                         "TEST 9:  ch9 (subset) control tests, %d times\n",
2255                                 param->iterations);
2256                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2257                         retval = ch9_postconfig(dev);
2258                 if (retval)
2259                         dev_err(&intf->dev, "ch9 subset failed, "
2260                                         "iterations left %d\n", i);
2261                 break;
2262 
2263         /* queued control messaging */
2264         case 10:
2265                 retval = 0;
2266                 dev_info(&intf->dev,
2267                                 "TEST 10:  queue %d control calls, %d times\n",
2268                                 param->sglen,
2269                                 param->iterations);
2270                 retval = test_ctrl_queue(dev, param);
2271                 break;
2272 
2273         /* simple non-queued unlinks (ring with one urb) */
2274         case 11:
2275                 if (dev->in_pipe == 0 || !param->length)
2276                         break;
2277                 retval = 0;
2278                 dev_info(&intf->dev, "TEST 11:  unlink %d reads of %d\n",
2279                                 param->iterations, param->length);
2280                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2281                         retval = unlink_simple(dev, dev->in_pipe,
2282                                                 param->length);
2283                 if (retval)
2284                         dev_err(&intf->dev, "unlink reads failed %d, "
2285                                 "iterations left %d\n", retval, i);
2286                 break;
2287         case 12:
2288                 if (dev->out_pipe == 0 || !param->length)
2289                         break;
2290                 retval = 0;
2291                 dev_info(&intf->dev, "TEST 12:  unlink %d writes of %d\n",
2292                                 param->iterations, param->length);
2293                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2294                         retval = unlink_simple(dev, dev->out_pipe,
2295                                                 param->length);
2296                 if (retval)
2297                         dev_err(&intf->dev, "unlink writes failed %d, "
2298                                 "iterations left %d\n", retval, i);
2299                 break;
2300 
2301         /* ep halt tests */
2302         case 13:
2303                 if (dev->out_pipe == 0 && dev->in_pipe == 0)
2304                         break;
2305                 retval = 0;
2306                 dev_info(&intf->dev, "TEST 13:  set/clear %d halts\n",
2307                                 param->iterations);
2308                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2309                         retval = halt_simple(dev);
2310 
2311                 if (retval)
2312                         ERROR(dev, "halts failed, iterations left %d\n", i);
2313                 break;
2314 
2315         /* control write tests */
2316         case 14:
2317                 if (!dev->info->ctrl_out)
2318                         break;
2319                 dev_info(&intf->dev, "TEST 14:  %d ep0out, %d..%d vary %d\n",
2320                                 param->iterations,
2321                                 realworld ? 1 : 0, param->length,
2322                                 param->vary);
2323                 retval = ctrl_out(dev, param->iterations,
2324                                 param->length, param->vary, 0);
2325                 break;
2326 
2327         /* iso write tests */
2328         case 15:
2329                 if (dev->out_iso_pipe == 0 || param->sglen == 0)
2330                         break;
2331                 dev_info(&intf->dev,
2332                         "TEST 15:  write %d iso, %d entries of %d bytes\n",
2333                                 param->iterations,
2334                                 param->sglen, param->length);
2335                 /* FIRMWARE:  iso sink */
2336                 retval = test_queue(dev, param,
2337                                 dev->out_iso_pipe, dev->iso_out, 0);
2338                 break;
2339 
2340         /* iso read tests */
2341         case 16:
2342                 if (dev->in_iso_pipe == 0 || param->sglen == 0)
2343                         break;
2344                 dev_info(&intf->dev,
2345                         "TEST 16:  read %d iso, %d entries of %d bytes\n",
2346                                 param->iterations,
2347                                 param->sglen, param->length);
2348                 /* FIRMWARE:  iso source */
2349                 retval = test_queue(dev, param,
2350                                 dev->in_iso_pipe, dev->iso_in, 0);
2351                 break;
2352 
2353         /* FIXME scatterlist cancel (needs helper thread) */
2354 
2355         /* Tests for bulk I/O using DMA mapping by core and odd address */
2356         case 17:
2357                 if (dev->out_pipe == 0)
2358                         break;
2359                 dev_info(&intf->dev,
2360                         "TEST 17:  write odd addr %d bytes %u times core map\n",
2361                         param->length, param->iterations);
2362 
2363                 retval = test_unaligned_bulk(
2364                                 dev, dev->out_pipe,
2365                                 param->length, param->iterations,
2366                                 0, "test17");
2367                 break;
2368 
2369         case 18:
2370                 if (dev->in_pipe == 0)
2371                         break;
2372                 dev_info(&intf->dev,
2373                         "TEST 18:  read odd addr %d bytes %u times core map\n",
2374                         param->length, param->iterations);
2375 
2376                 retval = test_unaligned_bulk(
2377                                 dev, dev->in_pipe,
2378                                 param->length, param->iterations,
2379                                 0, "test18");
2380                 break;
2381 
2382         /* Tests for bulk I/O using premapped coherent buffer and odd address */
2383         case 19:
2384                 if (dev->out_pipe == 0)
2385                         break;
2386                 dev_info(&intf->dev,
2387                         "TEST 19:  write odd addr %d bytes %u times premapped\n",
2388                         param->length, param->iterations);
2389 
2390                 retval = test_unaligned_bulk(
2391                                 dev, dev->out_pipe,
2392                                 param->length, param->iterations,
2393                                 URB_NO_TRANSFER_DMA_MAP, "test19");
2394                 break;
2395 
2396         case 20:
2397                 if (dev->in_pipe == 0)
2398                         break;
2399                 dev_info(&intf->dev,
2400                         "TEST 20:  read odd addr %d bytes %u times premapped\n",
2401                         param->length, param->iterations);
2402 
2403                 retval = test_unaligned_bulk(
2404                                 dev, dev->in_pipe,
2405                                 param->length, param->iterations,
2406                                 URB_NO_TRANSFER_DMA_MAP, "test20");
2407                 break;
2408 
2409         /* control write tests with unaligned buffer */
2410         case 21:
2411                 if (!dev->info->ctrl_out)
2412                         break;
2413                 dev_info(&intf->dev,
2414                                 "TEST 21:  %d ep0out odd addr, %d..%d vary %d\n",
2415                                 param->iterations,
2416                                 realworld ? 1 : 0, param->length,
2417                                 param->vary);
2418                 retval = ctrl_out(dev, param->iterations,
2419                                 param->length, param->vary, 1);
2420                 break;
2421 
2422         /* unaligned iso tests */
2423         case 22:
2424                 if (dev->out_iso_pipe == 0 || param->sglen == 0)
2425                         break;
2426                 dev_info(&intf->dev,
2427                         "TEST 22:  write %d iso odd, %d entries of %d bytes\n",
2428                                 param->iterations,
2429                                 param->sglen, param->length);
2430                 retval = test_queue(dev, param,
2431                                 dev->out_iso_pipe, dev->iso_out, 1);
2432                 break;
2433 
2434         case 23:
2435                 if (dev->in_iso_pipe == 0 || param->sglen == 0)
2436                         break;
2437                 dev_info(&intf->dev,
2438                         "TEST 23:  read %d iso odd, %d entries of %d bytes\n",
2439                                 param->iterations,
2440                                 param->sglen, param->length);
2441                 retval = test_queue(dev, param,
2442                                 dev->in_iso_pipe, dev->iso_in, 1);
2443                 break;
2444 
2445         /* unlink URBs from a bulk-OUT queue */
2446         case 24:
2447                 if (dev->out_pipe == 0 || !param->length || param->sglen < 4)
2448                         break;
2449                 retval = 0;
2450                 dev_info(&intf->dev, "TEST 24:  unlink from %d queues of "
2451                                 "%d %d-byte writes\n",
2452                                 param->iterations, param->sglen, param->length);
2453                 for (i = param->iterations; retval == 0 && i > 0; --i) {
2454                         retval = unlink_queued(dev, dev->out_pipe,
2455                                                 param->sglen, param->length);
2456                         if (retval) {
2457                                 dev_err(&intf->dev,
2458                                         "unlink queued writes failed %d, "
2459                                         "iterations left %d\n", retval, i);
2460                                 break;
2461                         }
2462                 }
2463                 break;
2464 
2465         /* Simple non-queued interrupt I/O tests */
2466         case 25:
2467                 if (dev->out_int_pipe == 0)
2468                         break;
2469                 dev_info(&intf->dev,
2470                                 "TEST 25: write %d bytes %u times\n",
2471                                 param->length, param->iterations);
2472                 urb = simple_alloc_urb(udev, dev->out_int_pipe, param->length,
2473                                 dev->int_out->bInterval);
2474                 if (!urb) {
2475                         retval = -ENOMEM;
2476                         break;
2477                 }
2478                 /* FIRMWARE: interrupt sink (maybe accepts short writes) */
2479                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test25");
2480                 simple_free_urb(urb);
2481                 break;
2482         case 26:
2483                 if (dev->in_int_pipe == 0)
2484                         break;
2485                 dev_info(&intf->dev,
2486                                 "TEST 26: read %d bytes %u times\n",
2487                                 param->length, param->iterations);
2488                 urb = simple_alloc_urb(udev, dev->in_int_pipe, param->length,
2489                                 dev->int_in->bInterval);
2490                 if (!urb) {
2491                         retval = -ENOMEM;
2492                         break;
2493                 }
2494                 /* FIRMWARE: interrupt source (maybe generates short writes) */
2495                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test26");
2496                 simple_free_urb(urb);
2497                 break;
2498         case 27:
2499                 /* We do performance test, so ignore data compare */
2500                 if (dev->out_pipe == 0 || param->sglen == 0 || pattern != 0)
2501                         break;
2502                 dev_info(&intf->dev,
2503                         "TEST 27: bulk write %dMbytes\n", (param->iterations *
2504                         param->sglen * param->length) / (1024 * 1024));
2505                 retval = test_queue(dev, param,
2506                                 dev->out_pipe, NULL, 0);
2507                 break;
2508         case 28:
2509                 if (dev->in_pipe == 0 || param->sglen == 0 || pattern != 0)
2510                         break;
2511                 dev_info(&intf->dev,
2512                         "TEST 28: bulk read %dMbytes\n", (param->iterations *
2513                         param->sglen * param->length) / (1024 * 1024));
2514                 retval = test_queue(dev, param,
2515                                 dev->in_pipe, NULL, 0);
2516                 break;
2517         }
2518         return retval;
2519 }
2520 
2521 /*-------------------------------------------------------------------------*/
2522 
2523 /* We only have this one interface to user space, through usbfs.
2524  * User mode code can scan usbfs to find N different devices (maybe on
2525  * different busses) to use when testing, and allocate one thread per
2526  * test.  So discovery is simplified, and we have no device naming issues.
2527  *
2528  * Don't use these only as stress/load tests.  Use them along with with
2529  * other USB bus activity:  plugging, unplugging, mousing, mp3 playback,
2530  * video capture, and so on.  Run different tests at different times, in
2531  * different sequences.  Nothing here should interact with other devices,
2532  * except indirectly by consuming USB bandwidth and CPU resources for test
2533  * threads and request completion.  But the only way to know that for sure
2534  * is to test when HC queues are in use by many devices.
2535  *
2536  * WARNING:  Because usbfs grabs udev->dev.sem before calling this ioctl(),
2537  * it locks out usbcore in certain code paths.  Notably, if you disconnect
2538  * the device-under-test, hub_wq will wait block forever waiting for the
2539  * ioctl to complete ... so that usb_disconnect() can abort the pending
2540  * urbs and then call usbtest_disconnect().  To abort a test, you're best
2541  * off just killing the userspace task and waiting for it to exit.
2542  */
2543 
2544 static int
2545 usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
2546 {
2547 
2548         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2549         struct usbtest_param_64 *param_64 = buf;
2550         struct usbtest_param_32 temp;
2551         struct usbtest_param_32 *param_32 = buf;
2552         struct timespec64 start;
2553         struct timespec64 end;
2554         struct timespec64 duration;
2555         int retval = -EOPNOTSUPP;
2556 
2557         /* FIXME USBDEVFS_CONNECTINFO doesn't say how fast the device is. */
2558 
2559         pattern = mod_pattern;
2560 
2561         if (mutex_lock_interruptible(&dev->lock))
2562                 return -ERESTARTSYS;
2563 
2564         /* FIXME: What if a system sleep starts while a test is running? */
2565 
2566         /* some devices, like ez-usb default devices, need a non-default
2567          * altsetting to have any active endpoints.  some tests change
2568          * altsettings; force a default so most tests don't need to check.
2569          */
2570         if (dev->info->alt >= 0) {
2571                 if (intf->altsetting->desc.bInterfaceNumber) {
2572                         retval = -ENODEV;
2573                         goto free_mutex;
2574                 }
2575                 retval = set_altsetting(dev, dev->info->alt);
2576                 if (retval) {
2577                         dev_err(&intf->dev,
2578                                         "set altsetting to %d failed, %d\n",
2579                                         dev->info->alt, retval);
2580                         goto free_mutex;
2581                 }
2582         }
2583 
2584         switch (code) {
2585         case USBTEST_REQUEST_64:
2586                 temp.test_num = param_64->test_num;
2587                 temp.iterations = param_64->iterations;
2588                 temp.length = param_64->length;
2589                 temp.sglen = param_64->sglen;
2590                 temp.vary = param_64->vary;
2591                 param_32 = &temp;
2592                 break;
2593 
2594         case USBTEST_REQUEST_32:
2595                 break;
2596 
2597         default:
2598                 retval = -EOPNOTSUPP;
2599                 goto free_mutex;
2600         }
2601 
2602         ktime_get_ts64(&start);
2603 
2604         retval = usbtest_do_ioctl(intf, param_32);
2605         if (retval)
2606                 goto free_mutex;
2607 
2608         ktime_get_ts64(&end);
2609 
2610         duration = timespec64_sub(end, start);
2611 
2612         temp.duration_sec = duration.tv_sec;
2613         temp.duration_usec = duration.tv_nsec/NSEC_PER_USEC;
2614 
2615         switch (code) {
2616         case USBTEST_REQUEST_32:
2617                 param_32->duration_sec = temp.duration_sec;
2618                 param_32->duration_usec = temp.duration_usec;
2619                 break;
2620 
2621         case USBTEST_REQUEST_64:
2622                 param_64->duration_sec = temp.duration_sec;
2623                 param_64->duration_usec = temp.duration_usec;
2624                 break;
2625         }
2626 
2627 free_mutex:
2628         mutex_unlock(&dev->lock);
2629         return retval;
2630 }
2631 
2632 /*-------------------------------------------------------------------------*/
2633 
2634 static unsigned force_interrupt;
2635 module_param(force_interrupt, uint, 0);
2636 MODULE_PARM_DESC(force_interrupt, "0 = test default; else interrupt");
2637 
2638 #ifdef  GENERIC
2639 static unsigned short vendor;
2640 module_param(vendor, ushort, 0);
2641 MODULE_PARM_DESC(vendor, "vendor code (from usb-if)");
2642 
2643 static unsigned short product;
2644 module_param(product, ushort, 0);
2645 MODULE_PARM_DESC(product, "product code (from vendor)");
2646 #endif
2647 
2648 static int
2649 usbtest_probe(struct usb_interface *intf, const struct usb_device_id *id)
2650 {
2651         struct usb_device       *udev;
2652         struct usbtest_dev      *dev;
2653         struct usbtest_info     *info;
2654         char                    *rtest, *wtest;
2655         char                    *irtest, *iwtest;
2656         char                    *intrtest, *intwtest;
2657 
2658         udev = interface_to_usbdev(intf);
2659 
2660 #ifdef  GENERIC
2661         /* specify devices by module parameters? */
2662         if (id->match_flags == 0) {
2663                 /* vendor match required, product match optional */
2664                 if (!vendor || le16_to_cpu(udev->descriptor.idVendor) != (u16)vendor)
2665                         return -ENODEV;
2666                 if (product && le16_to_cpu(udev->descriptor.idProduct) != (u16)product)
2667                         return -ENODEV;
2668                 dev_info(&intf->dev, "matched module params, "
2669                                         "vend=0x%04x prod=0x%04x\n",
2670                                 le16_to_cpu(udev->descriptor.idVendor),
2671                                 le16_to_cpu(udev->descriptor.idProduct));
2672         }
2673 #endif
2674 
2675         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
2676         if (!dev)
2677                 return -ENOMEM;
2678         info = (struct usbtest_info *) id->driver_info;
2679         dev->info = info;
2680         mutex_init(&dev->lock);
2681 
2682         dev->intf = intf;
2683 
2684         /* cacheline-aligned scratch for i/o */
2685         dev->buf = kmalloc(TBUF_SIZE, GFP_KERNEL);
2686         if (dev->buf == NULL) {
2687                 kfree(dev);
2688                 return -ENOMEM;
2689         }
2690 
2691         /* NOTE this doesn't yet test the handful of difference that are
2692          * visible with high speed interrupts:  bigger maxpacket (1K) and
2693          * "high bandwidth" modes (up to 3 packets/uframe).
2694          */
2695         rtest = wtest = "";
2696         irtest = iwtest = "";
2697         intrtest = intwtest = "";
2698         if (force_interrupt || udev->speed == USB_SPEED_LOW) {
2699                 if (info->ep_in) {
2700                         dev->in_pipe = usb_rcvintpipe(udev, info->ep_in);
2701                         rtest = " intr-in";
2702                 }
2703                 if (info->ep_out) {
2704                         dev->out_pipe = usb_sndintpipe(udev, info->ep_out);
2705                         wtest = " intr-out";
2706                 }
2707         } else {
2708                 if (override_alt >= 0 || info->autoconf) {
2709                         int status;
2710 
2711                         status = get_endpoints(dev, intf);
2712                         if (status < 0) {
2713                                 WARNING(dev, "couldn't get endpoints, %d\n",
2714                                                 status);
2715                                 kfree(dev->buf);
2716                                 kfree(dev);
2717                                 return status;
2718                         }
2719                         /* may find bulk or ISO pipes */
2720                 } else {
2721                         if (info->ep_in)
2722                                 dev->in_pipe = usb_rcvbulkpipe(udev,
2723                                                         info->ep_in);
2724                         if (info->ep_out)
2725                                 dev->out_pipe = usb_sndbulkpipe(udev,
2726                                                         info->ep_out);
2727                 }
2728                 if (dev->in_pipe)
2729                         rtest = " bulk-in";
2730                 if (dev->out_pipe)
2731                         wtest = " bulk-out";
2732                 if (dev->in_iso_pipe)
2733                         irtest = " iso-in";
2734                 if (dev->out_iso_pipe)
2735                         iwtest = " iso-out";
2736                 if (dev->in_int_pipe)
2737                         intrtest = " int-in";
2738                 if (dev->out_int_pipe)
2739                         intwtest = " int-out";
2740         }
2741 
2742         usb_set_intfdata(intf, dev);
2743         dev_info(&intf->dev, "%s\n", info->name);
2744         dev_info(&intf->dev, "%s {control%s%s%s%s%s%s%s} tests%s\n",
2745                         usb_speed_string(udev->speed),
2746                         info->ctrl_out ? " in/out" : "",
2747                         rtest, wtest,
2748                         irtest, iwtest,
2749                         intrtest, intwtest,
2750                         info->alt >= 0 ? " (+alt)" : "");
2751         return 0;
2752 }
2753 
2754 static int usbtest_suspend(struct usb_interface *intf, pm_message_t message)
2755 {
2756         return 0;
2757 }
2758 
2759 static int usbtest_resume(struct usb_interface *intf)
2760 {
2761         return 0;
2762 }
2763 
2764 
2765 static void usbtest_disconnect(struct usb_interface *intf)
2766 {
2767         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2768 
2769         usb_set_intfdata(intf, NULL);
2770         dev_dbg(&intf->dev, "disconnect\n");
2771         kfree(dev);
2772 }
2773 
2774 /* Basic testing only needs a device that can source or sink bulk traffic.
2775  * Any device can test control transfers (default with GENERIC binding).
2776  *
2777  * Several entries work with the default EP0 implementation that's built
2778  * into EZ-USB chips.  There's a default vendor ID which can be overridden
2779  * by (very) small config EEPROMS, but otherwise all these devices act
2780  * identically until firmware is loaded:  only EP0 works.  It turns out
2781  * to be easy to make other endpoints work, without modifying that EP0
2782  * behavior.  For now, we expect that kind of firmware.
2783  */
2784 
2785 /* an21xx or fx versions of ez-usb */
2786 static struct usbtest_info ez1_info = {
2787         .name           = "EZ-USB device",
2788         .ep_in          = 2,
2789         .ep_out         = 2,
2790         .alt            = 1,
2791 };
2792 
2793 /* fx2 version of ez-usb */
2794 static struct usbtest_info ez2_info = {
2795         .name           = "FX2 device",
2796         .ep_in          = 6,
2797         .ep_out         = 2,
2798         .alt            = 1,
2799 };
2800 
2801 /* ezusb family device with dedicated usb test firmware,
2802  */
2803 static struct usbtest_info fw_info = {
2804         .name           = "usb test device",
2805         .ep_in          = 2,
2806         .ep_out         = 2,
2807         .alt            = 1,
2808         .autoconf       = 1,            /* iso and ctrl_out need autoconf */
2809         .ctrl_out       = 1,
2810         .iso            = 1,            /* iso_ep's are #8 in/out */
2811 };
2812 
2813 /* peripheral running Linux and 'zero.c' test firmware, or
2814  * its user-mode cousin. different versions of this use
2815  * different hardware with the same vendor/product codes.
2816  * host side MUST rely on the endpoint descriptors.
2817  */
2818 static struct usbtest_info gz_info = {
2819         .name           = "Linux gadget zero",
2820         .autoconf       = 1,
2821         .ctrl_out       = 1,
2822         .iso            = 1,
2823         .intr           = 1,
2824         .alt            = 0,
2825 };
2826 
2827 static struct usbtest_info um_info = {
2828         .name           = "Linux user mode test driver",
2829         .autoconf       = 1,
2830         .alt            = -1,
2831 };
2832 
2833 static struct usbtest_info um2_info = {
2834         .name           = "Linux user mode ISO test driver",
2835         .autoconf       = 1,
2836         .iso            = 1,
2837         .alt            = -1,
2838 };
2839 
2840 #ifdef IBOT2
2841 /* this is a nice source of high speed bulk data;
2842  * uses an FX2, with firmware provided in the device
2843  */
2844 static struct usbtest_info ibot2_info = {
2845         .name           = "iBOT2 webcam",
2846         .ep_in          = 2,
2847         .alt            = -1,
2848 };
2849 #endif
2850 
2851 #ifdef GENERIC
2852 /* we can use any device to test control traffic */
2853 static struct usbtest_info generic_info = {
2854         .name           = "Generic USB device",
2855         .alt            = -1,
2856 };
2857 #endif
2858 
2859 
2860 static const struct usb_device_id id_table[] = {
2861 
2862         /*-------------------------------------------------------------*/
2863 
2864         /* EZ-USB devices which download firmware to replace (or in our
2865          * case augment) the default device implementation.
2866          */
2867 
2868         /* generic EZ-USB FX controller */
2869         { USB_DEVICE(0x0547, 0x2235),
2870                 .driver_info = (unsigned long) &ez1_info,
2871         },
2872 
2873         /* CY3671 development board with EZ-USB FX */
2874         { USB_DEVICE(0x0547, 0x0080),
2875                 .driver_info = (unsigned long) &ez1_info,
2876         },
2877 
2878         /* generic EZ-USB FX2 controller (or development board) */
2879         { USB_DEVICE(0x04b4, 0x8613),
2880                 .driver_info = (unsigned long) &ez2_info,
2881         },
2882 
2883         /* re-enumerated usb test device firmware */
2884         { USB_DEVICE(0xfff0, 0xfff0),
2885                 .driver_info = (unsigned long) &fw_info,
2886         },
2887 
2888         /* "Gadget Zero" firmware runs under Linux */
2889         { USB_DEVICE(0x0525, 0xa4a0),
2890                 .driver_info = (unsigned long) &gz_info,
2891         },
2892 
2893         /* so does a user-mode variant */
2894         { USB_DEVICE(0x0525, 0xa4a4),
2895                 .driver_info = (unsigned long) &um_info,
2896         },
2897 
2898         /* ... and a user-mode variant that talks iso */
2899         { USB_DEVICE(0x0525, 0xa4a3),
2900                 .driver_info = (unsigned long) &um2_info,
2901         },
2902 
2903 #ifdef KEYSPAN_19Qi
2904         /* Keyspan 19qi uses an21xx (original EZ-USB) */
2905         /* this does not coexist with the real Keyspan 19qi driver! */
2906         { USB_DEVICE(0x06cd, 0x010b),
2907                 .driver_info = (unsigned long) &ez1_info,
2908         },
2909 #endif
2910 
2911         /*-------------------------------------------------------------*/
2912 
2913 #ifdef IBOT2
2914         /* iBOT2 makes a nice source of high speed bulk-in data */
2915         /* this does not coexist with a real iBOT2 driver! */
2916         { USB_DEVICE(0x0b62, 0x0059),
2917                 .driver_info = (unsigned long) &ibot2_info,
2918         },
2919 #endif
2920 
2921         /*-------------------------------------------------------------*/
2922 
2923 #ifdef GENERIC
2924         /* module params can specify devices to use for control tests */
2925         { .driver_info = (unsigned long) &generic_info, },
2926 #endif
2927 
2928         /*-------------------------------------------------------------*/
2929 
2930         { }
2931 };
2932 MODULE_DEVICE_TABLE(usb, id_table);
2933 
2934 static struct usb_driver usbtest_driver = {
2935         .name =         "usbtest",
2936         .id_table =     id_table,
2937         .probe =        usbtest_probe,
2938         .unlocked_ioctl = usbtest_ioctl,
2939         .disconnect =   usbtest_disconnect,
2940         .suspend =      usbtest_suspend,
2941         .resume =       usbtest_resume,
2942 };
2943 
2944 /*-------------------------------------------------------------------------*/
2945 
2946 static int __init usbtest_init(void)
2947 {
2948 #ifdef GENERIC
2949         if (vendor)
2950                 pr_debug("params: vend=0x%04x prod=0x%04x\n", vendor, product);
2951 #endif
2952         return usb_register(&usbtest_driver);
2953 }
2954 module_init(usbtest_init);
2955 
2956 static void __exit usbtest_exit(void)
2957 {
2958         usb_deregister(&usbtest_driver);
2959 }
2960 module_exit(usbtest_exit);
2961 
2962 MODULE_DESCRIPTION("USB Core/HCD Testing Driver");
2963 MODULE_LICENSE("GPL");
2964 
2965 

This page was automatically generated by LXR 0.3.1 (source).  •  Linux is a registered trademark of Linus Torvalds  •  Contact us