drivers/usb/misc/usbtest.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 #include <linux/kernel.h>
   3 #include <linux/errno.h>
   4 #include <linux/init.h>
   5 #include <linux/slab.h>
   6 #include <linux/mm.h>
   7 #include <linux/module.h>
   8 #include <linux/moduleparam.h>
   9 #include <linux/scatterlist.h>
  10 #include <linux/mutex.h>
  11 #include <linux/timer.h>
  12 #include <linux/usb.h>
  13
  14 #define SIMPLE_IO_TIMEOUT       10000   /* in milliseconds */
  15
  16 /*-------------------------------------------------------------------------*/
  17
  18 static int override_alt = -1;
  19 module_param_named(alt, override_alt, int, 0644);
  20 MODULE_PARM_DESC(alt, ">= 0 to override altsetting selection");
  21 static void complicated_callback(struct urb *urb);
  22
  23 /*-------------------------------------------------------------------------*/
  24
  25 /* FIXME make these public somewhere; usbdevfs.h? */
  26
  27 /* Parameter for usbtest driver. */
  28 struct usbtest_param_32 {
  29         /* inputs */
  30         __u32           test_num;       /* 0..(TEST_CASES-1) */
  31         __u32           iterations;
  32         __u32           length;
  33         __u32           vary;
  34         __u32           sglen;
  35
  36         /* outputs */
  37         __s32           duration_sec;
  38         __s32           duration_usec;
  39 };
  40
  41 /*
  42  * Compat parameter to the usbtest driver.
  43  * This supports older user space binaries compiled with 64 bit compiler.
  44  */
  45 struct usbtest_param_64 {
  46         /* inputs */
  47         __u32           test_num;       /* 0..(TEST_CASES-1) */
  48         __u32           iterations;
  49         __u32           length;
  50         __u32           vary;
  51         __u32           sglen;
  52
  53         /* outputs */
  54         __s64           duration_sec;
  55         __s64           duration_usec;
  56 };
  57
  58 /* IOCTL interface to the driver. */
  59 #define USBTEST_REQUEST_32    _IOWR('U', 100, struct usbtest_param_32)
  60 /* COMPAT IOCTL interface to the driver. */
  61 #define USBTEST_REQUEST_64    _IOWR('U', 100, struct usbtest_param_64)
  62
  63 /*-------------------------------------------------------------------------*/
  64
  65 #define GENERIC         /* let probe() bind using module params */
  66
  67 /* Some devices that can be used for testing will have "real" drivers.
  68  * Entries for those need to be enabled here by hand, after disabling
  69  * that "real" driver.
  70  */
  71 //#define       IBOT2           /* grab iBOT2 webcams */
  72 //#define       KEYSPAN_19Qi    /* grab un-renumerated serial adapter */
  73
  74 /*-------------------------------------------------------------------------*/
  75
  76 struct usbtest_info {
  77         const char              *name;
  78         u8                      ep_in;          /* bulk/intr source */
  79         u8                      ep_out;         /* bulk/intr sink */
  80         unsigned                autoconf:1;
  81         unsigned                ctrl_out:1;
  82         unsigned                iso:1;          /* try iso in/out */
  83         unsigned                intr:1;         /* try interrupt in/out */
  84         int                     alt;
  85 };
  86
  87 /* this is accessed only through usbfs ioctl calls.
  88  * one ioctl to issue a test ... one lock per device.
  89  * tests create other threads if they need them.
  90  * urbs and buffers are allocated dynamically,
  91  * and data generated deterministically.
  92  */
  93 struct usbtest_dev {
  94         struct usb_interface    *intf;
  95         struct usbtest_info     *info;
  96         int                     in_pipe;
  97         int                     out_pipe;
  98         int                     in_iso_pipe;
  99         int                     out_iso_pipe;
 100         int                     in_int_pipe;
 101         int                     out_int_pipe;
 102         struct usb_endpoint_descriptor  *iso_in, *iso_out;
 103         struct usb_endpoint_descriptor  *int_in, *int_out;
 104         struct mutex            lock;
 105
 106 #define TBUF_SIZE       256
 107         u8                      *buf;
 108 };
 109
 110 static struct usb_device *testdev_to_usbdev(struct usbtest_dev *test)
 111 {
 112         return interface_to_usbdev(test->intf);
 113 }
 114
 115 /* set up all urbs so they can be used with either bulk or interrupt */
 116 #define INTERRUPT_RATE          1       /* msec/transfer */
 117
 118 #define ERROR(tdev, fmt, args...) \
 119         dev_err(&(tdev)->intf->dev , fmt , ## args)
 120 #define WARNING(tdev, fmt, args...) \
 121         dev_warn(&(tdev)->intf->dev , fmt , ## args)
 122
 123 #define GUARD_BYTE      0xA5
 124 #define MAX_SGLEN       128
 125
 126 /*-------------------------------------------------------------------------*/
 127
 128 static inline void endpoint_update(int edi,
 129                                    struct usb_host_endpoint **in,
 130                                    struct usb_host_endpoint **out,
 131                                    struct usb_host_endpoint *e)
 132 {
 133         if (edi) {
 134                 if (!*in)
 135                         *in = e;
 136         } else {
 137                 if (!*out)
 138                         *out = e;
 139         }
 140 }
 141
 142 static int
 143 get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf)
 144 {
 145         int                             tmp;
 146         struct usb_host_interface       *alt;
 147         struct usb_host_endpoint        *in, *out;
 148         struct usb_host_endpoint        *iso_in, *iso_out;
 149         struct usb_host_endpoint        *int_in, *int_out;
 150         struct usb_device               *udev;
 151
 152         for (tmp = 0; tmp < intf->num_altsetting; tmp++) {
 153                 unsigned        ep;
 154
 155                 in = out = NULL;
 156                 iso_in = iso_out = NULL;
 157                 int_in = int_out = NULL;
 158                 alt = intf->altsetting + tmp;
 159
 160                 if (override_alt >= 0 &&
 161                                 override_alt != alt->desc.bAlternateSetting)
 162                         continue;
 163
 164                 /* take the first altsetting with in-bulk + out-bulk;
 165                  * ignore other endpoints and altsettings.
 166                  */
 167                 for (ep = 0; ep < alt->desc.bNumEndpoints; ep++) {
 168                         struct usb_host_endpoint        *e;
 169                         int edi;
 170
 171                         e = alt->endpoint + ep;
 172                         edi = usb_endpoint_dir_in(&e->desc);
 173
 174                         switch (usb_endpoint_type(&e->desc)) {
 175                         case USB_ENDPOINT_XFER_BULK:
 176                                 endpoint_update(edi, &in, &out, e);
 177                                 continue;
 178                         case USB_ENDPOINT_XFER_INT:
 179                                 if (dev->info->intr)
 180                                         endpoint_update(edi, &int_in, &int_out, e);
 181                                 continue;
 182                         case USB_ENDPOINT_XFER_ISOC:
 183                                 if (dev->info->iso)
 184                                         endpoint_update(edi, &iso_in, &iso_out, e);
 185                                 /* FALLTHROUGH */
 186                         default:
 187                                 continue;
 188                         }
 189                 }
 190                 if ((in && out)  ||  iso_in || iso_out || int_in || int_out)
 191                         goto found;
 192         }
 193         return -EINVAL;
 194
 195 found:
 196         udev = testdev_to_usbdev(dev);
 197         dev->info->alt = alt->desc.bAlternateSetting;
 198         if (alt->desc.bAlternateSetting != 0) {
 199                 tmp = usb_set_interface(udev,
 200                                 alt->desc.bInterfaceNumber,
 201                                 alt->desc.bAlternateSetting);
 202                 if (tmp < 0)
 203                         return tmp;
 204         }
 205
 206         if (in)
 207                 dev->in_pipe = usb_rcvbulkpipe(udev,
 208                         in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
 209         if (out)
 210                 dev->out_pipe = usb_sndbulkpipe(udev,
 211                         out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
 212
 213         if (iso_in) {
 214                 dev->iso_in = &iso_in->desc;
 215                 dev->in_iso_pipe = usb_rcvisocpipe(udev,
 216                                 iso_in->desc.bEndpointAddress
 217                                         & USB_ENDPOINT_NUMBER_MASK);
 218         }
 219
 220         if (iso_out) {
 221                 dev->iso_out = &iso_out->desc;
 222                 dev->out_iso_pipe = usb_sndisocpipe(udev,
 223                                 iso_out->desc.bEndpointAddress
 224                                         & USB_ENDPOINT_NUMBER_MASK);
 225         }
 226
 227         if (int_in) {
 228                 dev->int_in = &int_in->desc;
 229                 dev->in_int_pipe = usb_rcvintpipe(udev,
 230                                 int_in->desc.bEndpointAddress
 231                                         & USB_ENDPOINT_NUMBER_MASK);
 232         }
 233
 234         if (int_out) {
 235                 dev->int_out = &int_out->desc;
 236                 dev->out_int_pipe = usb_sndintpipe(udev,
 237                                 int_out->desc.bEndpointAddress
 238                                         & USB_ENDPOINT_NUMBER_MASK);
 239         }
 240         return 0;
 241 }
 242
 243 /*-------------------------------------------------------------------------*/
 244
 245 /* Support for testing basic non-queued I/O streams.
 246  *
 247  * These just package urbs as requests that can be easily canceled.
 248  * Each urb's data buffer is dynamically allocated; callers can fill
 249  * them with non-zero test data (or test for it) when appropriate.
 250  */
 251
 252 static void simple_callback(struct urb *urb)
 253 {
 254         complete(urb->context);
 255 }
 256
 257 static struct urb *usbtest_alloc_urb(
 258         struct usb_device       *udev,
 259         int                     pipe,
 260         unsigned long           bytes,
 261         unsigned                transfer_flags,
 262         unsigned                offset,
 263         u8                      bInterval,
 264         usb_complete_t          complete_fn)
 265 {
 266         struct urb              *urb;
 267
 268         urb = usb_alloc_urb(0, GFP_KERNEL);
 269         if (!urb)
 270                 return urb;
 271
 272         if (bInterval)
 273                 usb_fill_int_urb(urb, udev, pipe, NULL, bytes, complete_fn,
 274                                 NULL, bInterval);
 275         else
 276                 usb_fill_bulk_urb(urb, udev, pipe, NULL, bytes, complete_fn,
 277                                 NULL);
 278
 279         urb->interval = (udev->speed == USB_SPEED_HIGH)
 280                         ? (INTERRUPT_RATE << 3)
 281                         : INTERRUPT_RATE;
 282         urb->transfer_flags = transfer_flags;
 283         if (usb_pipein(pipe))
 284                 urb->transfer_flags |= URB_SHORT_NOT_OK;
 285
 286         if ((bytes + offset) == 0)
 287                 return urb;
 288
 289         if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 290                 urb->transfer_buffer = usb_alloc_coherent(udev, bytes + offset,
 291                         GFP_KERNEL, &urb->transfer_dma);
 292         else
 293                 urb->transfer_buffer = kmalloc(bytes + offset, GFP_KERNEL);
 294
 295         if (!urb->transfer_buffer) {
 296                 usb_free_urb(urb);
 297                 return NULL;
 298         }
 299
 300         /* To test unaligned transfers add an offset and fill the
 301                 unused memory with a guard value */
 302         if (offset) {
 303                 memset(urb->transfer_buffer, GUARD_BYTE, offset);
 304                 urb->transfer_buffer += offset;
 305                 if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 306                         urb->transfer_dma += offset;
 307         }
 308
 309         /* For inbound transfers use guard byte so that test fails if
 310                 data not correctly copied */
 311         memset(urb->transfer_buffer,
 312                         usb_pipein(urb->pipe) ? GUARD_BYTE : 0,
 313                         bytes);
 314         return urb;
 315 }
 316
 317 static struct urb *simple_alloc_urb(
 318         struct usb_device       *udev,
 319         int                     pipe,
 320         unsigned long           bytes,
 321         u8                      bInterval)
 322 {
 323         return usbtest_alloc_urb(udev, pipe, bytes, URB_NO_TRANSFER_DMA_MAP, 0,
 324                         bInterval, simple_callback);
 325 }
 326
 327 static struct urb *complicated_alloc_urb(
 328         struct usb_device       *udev,
 329         int                     pipe,
 330         unsigned long           bytes,
 331         u8                      bInterval)
 332 {
 333         return usbtest_alloc_urb(udev, pipe, bytes, URB_NO_TRANSFER_DMA_MAP, 0,
 334                         bInterval, complicated_callback);
 335 }
 336
 337 static unsigned pattern;
 338 static unsigned mod_pattern;
 339 module_param_named(pattern, mod_pattern, uint, S_IRUGO | S_IWUSR);
 340 MODULE_PARM_DESC(mod_pattern, "i/o pattern (0 == zeroes)");
 341
 342 static unsigned get_maxpacket(struct usb_device *udev, int pipe)
 343 {
 344         struct usb_host_endpoint        *ep;
 345
 346         ep = usb_pipe_endpoint(udev, pipe);
 347         return le16_to_cpup(&ep->desc.wMaxPacketSize);
 348 }
 349
 350 static void simple_fill_buf(struct urb *urb)
 351 {
 352         unsigned        i;
 353         u8              *buf = urb->transfer_buffer;
 354         unsigned        len = urb->transfer_buffer_length;
 355         unsigned        maxpacket;
 356
 357         switch (pattern) {
 358         default:
 359                 /* FALLTHROUGH */
 360         case 0:
 361                 memset(buf, 0, len);
 362                 break;
 363         case 1:                 /* mod63 */
 364                 maxpacket = get_maxpacket(urb->dev, urb->pipe);
 365                 for (i = 0; i < len; i++)
 366                         *buf++ = (u8) ((i % maxpacket) % 63);
 367                 break;
 368         }
 369 }
 370
 371 static inline unsigned long buffer_offset(void *buf)
 372 {
 373         return (unsigned long)buf & (ARCH_KMALLOC_MINALIGN - 1);
 374 }
 375
 376 static int check_guard_bytes(struct usbtest_dev *tdev, struct urb *urb)
 377 {
 378         u8 *buf = urb->transfer_buffer;
 379         u8 *guard = buf - buffer_offset(buf);
 380         unsigned i;
 381
 382         for (i = 0; guard < buf; i++, guard++) {
 383                 if (*guard != GUARD_BYTE) {
 384                         ERROR(tdev, "guard byte[%d] %d (not %d)\n",
 385                                 i, *guard, GUARD_BYTE);
 386                         return -EINVAL;
 387                 }
 388         }
 389         return 0;
 390 }
 391
 392 static int simple_check_buf(struct usbtest_dev *tdev, struct urb *urb)
 393 {
 394         unsigned        i;
 395         u8              expected;
 396         u8              *buf = urb->transfer_buffer;
 397         unsigned        len = urb->actual_length;
 398         unsigned        maxpacket = get_maxpacket(urb->dev, urb->pipe);
 399
 400         int ret = check_guard_bytes(tdev, urb);
 401         if (ret)
 402                 return ret;
 403
 404         for (i = 0; i < len; i++, buf++) {
 405                 switch (pattern) {
 406                 /* all-zeroes has no synchronization issues */
 407                 case 0:
 408                         expected = 0;
 409                         break;
 410                 /* mod63 stays in sync with short-terminated transfers,
 411                  * or otherwise when host and gadget agree on how large
 412                  * each usb transfer request should be.  resync is done
 413                  * with set_interface or set_config.
 414                  */
 415                 case 1:                 /* mod63 */
 416                         expected = (i % maxpacket) % 63;
 417                         break;
 418                 /* always fail unsupported patterns */
 419                 default:
 420                         expected = !*buf;
 421                         break;
 422                 }
 423                 if (*buf == expected)
 424                         continue;
 425                 ERROR(tdev, "buf[%d] = %d (not %d)\n", i, *buf, expected);
 426                 return -EINVAL;
 427         }
 428         return 0;
 429 }
 430
 431 static void simple_free_urb(struct urb *urb)
 432 {
 433         unsigned long offset = buffer_offset(urb->transfer_buffer);
 434
 435         if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)
 436                 usb_free_coherent(
 437                         urb->dev,
 438                         urb->transfer_buffer_length + offset,
 439                         urb->transfer_buffer - offset,
 440                         urb->transfer_dma - offset);
 441         else
 442                 kfree(urb->transfer_buffer - offset);
 443         usb_free_urb(urb);
 444 }
 445
 446 static int simple_io(
 447         struct usbtest_dev      *tdev,
 448         struct urb              *urb,
 449         int                     iterations,
 450         int                     vary,
 451         int                     expected,
 452         const char              *label
 453 )
 454 {
 455         struct usb_device       *udev = urb->dev;
 456         int                     max = urb->transfer_buffer_length;
 457         struct completion       completion;
 458         int                     retval = 0;
 459         unsigned long           expire;
 460
 461         urb->context = &completion;
 462         while (retval == 0 && iterations-- > 0) {
 463                 init_completion(&completion);
 464                 if (usb_pipeout(urb->pipe)) {
 465                         simple_fill_buf(urb);
 466                         urb->transfer_flags |= URB_ZERO_PACKET;
 467                 }
 468                 retval = usb_submit_urb(urb, GFP_KERNEL);
 469                 if (retval != 0)
 470                         break;
 471
 472                 expire = msecs_to_jiffies(SIMPLE_IO_TIMEOUT);
 473                 if (!wait_for_completion_timeout(&completion, expire)) {
 474                         usb_kill_urb(urb);
 475                         retval = (urb->status == -ENOENT ?
 476                                   -ETIMEDOUT : urb->status);
 477                 } else {
 478                         retval = urb->status;
 479                 }
 480
 481                 urb->dev = udev;
 482                 if (retval == 0 && usb_pipein(urb->pipe))
 483                         retval = simple_check_buf(tdev, urb);
 484
 485                 if (vary) {
 486                         int     len = urb->transfer_buffer_length;
 487
 488                         len += vary;
 489                         len %= max;
 490                         if (len == 0)
 491                                 len = (vary < max) ? vary : max;
 492                         urb->transfer_buffer_length = len;
 493                 }
 494
 495                 /* FIXME if endpoint halted, clear halt (and log) */
 496         }
 497         urb->transfer_buffer_length = max;
 498
 499         if (expected != retval)
 500                 dev_err(&udev->dev,
 501                         "%s failed, iterations left %d, status %d (not %d)\n",
 502                                 label, iterations, retval, expected);
 503         return retval;
 504 }
 505
 506
 507 /*-------------------------------------------------------------------------*/
 508
 509 /* We use scatterlist primitives to test queued I/O.
 510  * Yes, this also tests the scatterlist primitives.
 511  */
 512
 513 static void free_sglist(struct scatterlist *sg, int nents)
 514 {
 515         unsigned                i;
 516
 517         if (!sg)
 518                 return;
 519         for (i = 0; i < nents; i++) {
 520                 if (!sg_page(&sg[i]))
 521                         continue;
 522                 kfree(sg_virt(&sg[i]));
 523         }
 524         kfree(sg);
 525 }
 526
 527 static struct scatterlist *
 528 alloc_sglist(int nents, int max, int vary, struct usbtest_dev *dev, int pipe)
 529 {
 530         struct scatterlist      *sg;
 531         unsigned int            n_size = 0;
 532         unsigned                i;
 533         unsigned                size = max;
 534         unsigned                maxpacket =
 535                 get_maxpacket(interface_to_usbdev(dev->intf), pipe);
 536
 537         if (max == 0)
 538                 return NULL;
 539
 540         sg = kmalloc_array(nents, sizeof(*sg), GFP_KERNEL);
 541         if (!sg)
 542                 return NULL;
 543         sg_init_table(sg, nents);
 544
 545         for (i = 0; i < nents; i++) {
 546                 char            *buf;
 547                 unsigned        j;
 548
 549                 buf = kzalloc(size, GFP_KERNEL);
 550                 if (!buf) {
 551                         free_sglist(sg, i);
 552                         return NULL;
 553                 }
 554
 555                 /* kmalloc pages are always physically contiguous! */
 556                 sg_set_buf(&sg[i], buf, size);
 557
 558                 switch (pattern) {
 559                 case 0:
 560                         /* already zeroed */
 561                         break;
 562                 case 1:
 563                         for (j = 0; j < size; j++)
 564                                 *buf++ = (u8) (((j + n_size) % maxpacket) % 63);
 565                         n_size += size;
 566                         break;
 567                 }
 568
 569                 if (vary) {
 570                         size += vary;
 571                         size %= max;
 572                         if (size == 0)
 573                                 size = (vary < max) ? vary : max;
 574                 }
 575         }
 576
 577         return sg;
 578 }
 579
 580 struct sg_timeout {
 581         struct timer_list timer;
 582         struct usb_sg_request *req;
 583 };
 584
 585 static void sg_timeout(struct timer_list *t)
 586 {
 587         struct sg_timeout *timeout = from_timer(timeout, t, timer);
 588
 589         usb_sg_cancel(timeout->req);
 590 }
 591
 592 static int perform_sglist(
 593         struct usbtest_dev      *tdev,
 594         unsigned                iterations,
 595         int                     pipe,
 596         struct usb_sg_request   *req,
 597         struct scatterlist      *sg,
 598         int                     nents
 599 )
 600 {
 601         struct usb_device       *udev = testdev_to_usbdev(tdev);
 602         int                     retval = 0;
 603         struct sg_timeout       timeout = {
 604                 .req = req,
 605         };
 606
 607         timer_setup_on_stack(&timeout.timer, sg_timeout, 0);
 608
 609         while (retval == 0 && iterations-- > 0) {
 610                 retval = usb_sg_init(req, udev, pipe,
 611                                 (udev->speed == USB_SPEED_HIGH)
 612                                         ? (INTERRUPT_RATE << 3)
 613                                         : INTERRUPT_RATE,
 614                                 sg, nents, 0, GFP_KERNEL);
 615
 616                 if (retval)
 617                         break;
 618                 mod_timer(&timeout.timer, jiffies +
 619                                 msecs_to_jiffies(SIMPLE_IO_TIMEOUT));
 620                 usb_sg_wait(req);
 621                 if (!del_timer_sync(&timeout.timer))
 622                         retval = -ETIMEDOUT;
 623                 else
 624                         retval = req->status;
 625                 destroy_timer_on_stack(&timeout.timer);
 626
 627                 /* FIXME check resulting data pattern */
 628
 629                 /* FIXME if endpoint halted, clear halt (and log) */
 630         }
 631
 632         /* FIXME for unlink or fault handling tests, don't report
 633          * failure if retval is as we expected ...
 634          */
 635         if (retval)
 636                 ERROR(tdev, "perform_sglist failed, "
 637                                 "iterations left %d, status %d\n",
 638                                 iterations, retval);
 639         return retval;
 640 }
 641
 642
 643 /*-------------------------------------------------------------------------*/
 644
 645 /* unqueued control message testing
 646  *
 647  * there's a nice set of device functional requirements in chapter 9 of the
 648  * usb 2.0 spec, which we can apply to ANY device, even ones that don't use
 649  * special test firmware.
 650  *
 651  * we know the device is configured (or suspended) by the time it's visible
 652  * through usbfs.  we can't change that, so we won't test enumeration (which
 653  * worked 'well enough' to get here, this time), power management (ditto),
 654  * or remote wakeup (which needs human interaction).
 655  */
 656
 657 static unsigned realworld = 1;
 658 module_param(realworld, uint, 0);
 659 MODULE_PARM_DESC(realworld, "clear to demand stricter spec compliance");
 660
 661 static int get_altsetting(struct usbtest_dev *dev)
 662 {
 663         struct usb_interface    *iface = dev->intf;
 664         struct usb_device       *udev = interface_to_usbdev(iface);
 665         int                     retval;
 666
 667         retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 668                         USB_REQ_GET_INTERFACE, USB_DIR_IN|USB_RECIP_INTERFACE,
 669                         0, iface->altsetting[0].desc.bInterfaceNumber,
 670                         dev->buf, 1, USB_CTRL_GET_TIMEOUT);
 671         switch (retval) {
 672         case 1:
 673                 return dev->buf[0];
 674         case 0:
 675                 retval = -ERANGE;
 676                 /* FALLTHROUGH */
 677         default:
 678                 return retval;
 679         }
 680 }
 681
 682 static int set_altsetting(struct usbtest_dev *dev, int alternate)
 683 {
 684         struct usb_interface            *iface = dev->intf;
 685         struct usb_device               *udev;
 686
 687         if (alternate < 0 || alternate >= 256)
 688                 return -EINVAL;
 689
 690         udev = interface_to_usbdev(iface);
 691         return usb_set_interface(udev,
 692                         iface->altsetting[0].desc.bInterfaceNumber,
 693                         alternate);
 694 }
 695
 696 static int is_good_config(struct usbtest_dev *tdev, int len)
 697 {
 698         struct usb_config_descriptor    *config;
 699
 700         if (len < sizeof(*config))
 701                 return 0;
 702         config = (struct usb_config_descriptor *) tdev->buf;
 703
 704         switch (config->bDescriptorType) {
 705         case USB_DT_CONFIG:
 706         case USB_DT_OTHER_SPEED_CONFIG:
 707                 if (config->bLength != 9) {
 708                         ERROR(tdev, "bogus config descriptor length\n");
 709                         return 0;
 710                 }
 711                 /* this bit 'must be 1' but often isn't */
 712                 if (!realworld && !(config->bmAttributes & 0x80)) {
 713                         ERROR(tdev, "high bit of config attributes not set\n");
 714                         return 0;
 715                 }
 716                 if (config->bmAttributes & 0x1f) {      /* reserved == 0 */
 717                         ERROR(tdev, "reserved config bits set\n");
 718                         return 0;
 719                 }
 720                 break;
 721         default:
 722                 return 0;
 723         }
 724
 725         if (le16_to_cpu(config->wTotalLength) == len)   /* read it all */
 726                 return 1;
 727         if (le16_to_cpu(config->wTotalLength) >= TBUF_SIZE)     /* max partial read */
 728                 return 1;
 729         ERROR(tdev, "bogus config descriptor read size\n");
 730         return 0;
 731 }
 732
 733 static int is_good_ext(struct usbtest_dev *tdev, u8 *buf)
 734 {
 735         struct usb_ext_cap_descriptor *ext;
 736         u32 attr;
 737
 738         ext = (struct usb_ext_cap_descriptor *) buf;
 739
 740         if (ext->bLength != USB_DT_USB_EXT_CAP_SIZE) {
 741                 ERROR(tdev, "bogus usb 2.0 extension descriptor length\n");
 742                 return 0;
 743         }
 744
 745         attr = le32_to_cpu(ext->bmAttributes);
 746         /* bits[1:15] is used and others are reserved */
 747         if (attr & ~0xfffe) {   /* reserved == 0 */
 748                 ERROR(tdev, "reserved bits set\n");
 749                 return 0;
 750         }
 751
 752         return 1;
 753 }
 754
 755 static int is_good_ss_cap(struct usbtest_dev *tdev, u8 *buf)
 756 {
 757         struct usb_ss_cap_descriptor *ss;
 758
 759         ss = (struct usb_ss_cap_descriptor *) buf;
 760
 761         if (ss->bLength != USB_DT_USB_SS_CAP_SIZE) {
 762                 ERROR(tdev, "bogus superspeed device capability descriptor length\n");
 763                 return 0;
 764         }
 765
 766         /*
 767          * only bit[1] of bmAttributes is used for LTM and others are
 768          * reserved
 769          */
 770         if (ss->bmAttributes & ~0x02) { /* reserved == 0 */
 771                 ERROR(tdev, "reserved bits set in bmAttributes\n");
 772                 return 0;
 773         }
 774
 775         /* bits[0:3] of wSpeedSupported is used and others are reserved */
 776         if (le16_to_cpu(ss->wSpeedSupported) & ~0x0f) { /* reserved == 0 */
 777                 ERROR(tdev, "reserved bits set in wSpeedSupported\n");
 778                 return 0;
 779         }
 780
 781         return 1;
 782 }
 783
 784 static int is_good_con_id(struct usbtest_dev *tdev, u8 *buf)
 785 {
 786         struct usb_ss_container_id_descriptor *con_id;
 787
 788         con_id = (struct usb_ss_container_id_descriptor *) buf;
 789
 790         if (con_id->bLength != USB_DT_USB_SS_CONTN_ID_SIZE) {
 791                 ERROR(tdev, "bogus container id descriptor length\n");
 792                 return 0;
 793         }
 794
 795         if (con_id->bReserved) {        /* reserved == 0 */
 796                 ERROR(tdev, "reserved bits set\n");
 797                 return 0;
 798         }
 799
 800         return 1;
 801 }
 802
 803 /* sanity test for standard requests working with usb_control_mesg() and some
 804  * of the utility functions which use it.
 805  *
 806  * this doesn't test how endpoint halts behave or data toggles get set, since
 807  * we won't do I/O to bulk/interrupt endpoints here (which is how to change
 808  * halt or toggle).  toggle testing is impractical without support from hcds.
 809  *
 810  * this avoids failing devices linux would normally work with, by not testing
 811  * config/altsetting operations for devices that only support their defaults.
 812  * such devices rarely support those needless operations.
 813  *
 814  * NOTE that since this is a sanity test, it's not examining boundary cases
 815  * to see if usbcore, hcd, and device all behave right.  such testing would
 816  * involve varied read sizes and other operation sequences.
 817  */
 818 static int ch9_postconfig(struct usbtest_dev *dev)
 819 {
 820         struct usb_interface    *iface = dev->intf;
 821         struct usb_device       *udev = interface_to_usbdev(iface);
 822         int                     i, alt, retval;
 823
 824         /* [9.2.3] if there's more than one altsetting, we need to be able to
 825          * set and get each one.  mostly trusts the descriptors from usbcore.
 826          */
 827         for (i = 0; i < iface->num_altsetting; i++) {
 828
 829                 /* 9.2.3 constrains the range here */
 830                 alt = iface->altsetting[i].desc.bAlternateSetting;
 831                 if (alt < 0 || alt >= iface->num_altsetting) {
 832                         dev_err(&iface->dev,
 833                                         "invalid alt [%d].bAltSetting = %d\n",
 834                                         i, alt);
 835                 }
 836
 837                 /* [real world] get/set unimplemented if there's only one */
 838                 if (realworld && iface->num_altsetting == 1)
 839                         continue;
 840
 841                 /* [9.4.10] set_interface */
 842                 retval = set_altsetting(dev, alt);
 843                 if (retval) {
 844                         dev_err(&iface->dev, "can't set_interface = %d, %d\n",
 845                                         alt, retval);
 846                         return retval;
 847                 }
 848
 849                 /* [9.4.4] get_interface always works */
 850                 retval = get_altsetting(dev);
 851                 if (retval != alt) {
 852                         dev_err(&iface->dev, "get alt should be %d, was %d\n",
 853                                         alt, retval);
 854                         return (retval < 0) ? retval : -EDOM;
 855                 }
 856
 857         }
 858
 859         /* [real world] get_config unimplemented if there's only one */
 860         if (!realworld || udev->descriptor.bNumConfigurations != 1) {
 861                 int     expected = udev->actconfig->desc.bConfigurationValue;
 862
 863                 /* [9.4.2] get_configuration always works
 864                  * ... although some cheap devices (like one TI Hub I've got)
 865                  * won't return config descriptors except before set_config.
 866                  */
 867                 retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 868                                 USB_REQ_GET_CONFIGURATION,
 869                                 USB_DIR_IN | USB_RECIP_DEVICE,
 870                                 0, 0, dev->buf, 1, USB_CTRL_GET_TIMEOUT);
 871                 if (retval != 1 || dev->buf[0] != expected) {
 872                         dev_err(&iface->dev, "get config --> %d %d (1 %d)\n",
 873                                 retval, dev->buf[0], expected);
 874                         return (retval < 0) ? retval : -EDOM;
 875                 }
 876         }
 877
 878         /* there's always [9.4.3] a device descriptor [9.6.1] */
 879         retval = usb_get_descriptor(udev, USB_DT_DEVICE, 0,
 880                         dev->buf, sizeof(udev->descriptor));
 881         if (retval != sizeof(udev->descriptor)) {
 882                 dev_err(&iface->dev, "dev descriptor --> %d\n", retval);
 883                 return (retval < 0) ? retval : -EDOM;
 884         }
 885
 886         /*
 887          * there's always [9.4.3] a bos device descriptor [9.6.2] in USB
 888          * 3.0 spec
 889          */
 890         if (le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0210) {
 891                 struct usb_bos_descriptor *bos = NULL;
 892                 struct usb_dev_cap_header *header = NULL;
 893                 unsigned total, num, length;
 894                 u8 *buf;
 895
 896                 retval = usb_get_descriptor(udev, USB_DT_BOS, 0, dev->buf,
 897                                 sizeof(*udev->bos->desc));
 898                 if (retval != sizeof(*udev->bos->desc)) {
 899                         dev_err(&iface->dev, "bos descriptor --> %d\n", retval);
 900                         return (retval < 0) ? retval : -EDOM;
 901                 }
 902
 903                 bos = (struct usb_bos_descriptor *)dev->buf;
 904                 total = le16_to_cpu(bos->wTotalLength);
 905                 num = bos->bNumDeviceCaps;
 906
 907                 if (total > TBUF_SIZE)
 908                         total = TBUF_SIZE;
 909
 910                 /*
 911                  * get generic device-level capability descriptors [9.6.2]
 912                  * in USB 3.0 spec
 913                  */
 914                 retval = usb_get_descriptor(udev, USB_DT_BOS, 0, dev->buf,
 915                                 total);
 916                 if (retval != total) {
 917                         dev_err(&iface->dev, "bos descriptor set --> %d\n",
 918                                         retval);
 919                         return (retval < 0) ? retval : -EDOM;
 920                 }
 921
 922                 length = sizeof(*udev->bos->desc);
 923                 buf = dev->buf;
 924                 for (i = 0; i < num; i++) {
 925                         buf += length;
 926                         if (buf + sizeof(struct usb_dev_cap_header) >
 927                                         dev->buf + total)
 928                                 break;
 929
 930                         header = (struct usb_dev_cap_header *)buf;
 931                         length = header->bLength;
 932
 933                         if (header->bDescriptorType !=
 934                                         USB_DT_DEVICE_CAPABILITY) {
 935                                 dev_warn(&udev->dev, "not device capability descriptor, skip\n");
 936                                 continue;
 937                         }
 938
 939                         switch (header->bDevCapabilityType) {
 940                         case USB_CAP_TYPE_EXT:
 941                                 if (buf + USB_DT_USB_EXT_CAP_SIZE >
 942                                                 dev->buf + total ||
 943                                                 !is_good_ext(dev, buf)) {
 944                                         dev_err(&iface->dev, "bogus usb 2.0 extension descriptor\n");
 945                                         return -EDOM;
 946                                 }
 947                                 break;
 948                         case USB_SS_CAP_TYPE:
 949                                 if (buf + USB_DT_USB_SS_CAP_SIZE >
 950                                                 dev->buf + total ||
 951                                                 !is_good_ss_cap(dev, buf)) {
 952                                         dev_err(&iface->dev, "bogus superspeed device capability descriptor\n");
 953                                         return -EDOM;
 954                                 }
 955                                 break;
 956                         case CONTAINER_ID_TYPE:
 957                                 if (buf + USB_DT_USB_SS_CONTN_ID_SIZE >
 958                                                 dev->buf + total ||
 959                                                 !is_good_con_id(dev, buf)) {
 960                                         dev_err(&iface->dev, "bogus container id descriptor\n");
 961                                         return -EDOM;
 962                                 }
 963                                 break;
 964                         default:
 965                                 break;
 966                         }
 967                 }
 968         }
 969
 970         /* there's always [9.4.3] at least one config descriptor [9.6.3] */
 971         for (i = 0; i < udev->descriptor.bNumConfigurations; i++) {
 972                 retval = usb_get_descriptor(udev, USB_DT_CONFIG, i,
 973                                 dev->buf, TBUF_SIZE);
 974                 if (!is_good_config(dev, retval)) {
 975                         dev_err(&iface->dev,
 976                                         "config [%d] descriptor --> %d\n",
 977                                         i, retval);
 978                         return (retval < 0) ? retval : -EDOM;
 979                 }
 980
 981                 /* FIXME cross-checking udev->config[i] to make sure usbcore
 982                  * parsed it right (etc) would be good testing paranoia
 983                  */
 984         }
 985
 986         /* and sometimes [9.2.6.6] speed dependent descriptors */
 987         if (le16_to_cpu(udev->descriptor.bcdUSB) == 0x0200) {
 988                 struct usb_qualifier_descriptor *d = NULL;
 989
 990                 /* device qualifier [9.6.2] */
 991                 retval = usb_get_descriptor(udev,
 992                                 USB_DT_DEVICE_QUALIFIER, 0, dev->buf,
 993                                 sizeof(struct usb_qualifier_descriptor));
 994                 if (retval == -EPIPE) {
 995                         if (udev->speed == USB_SPEED_HIGH) {
 996                                 dev_err(&iface->dev,
 997                                                 "hs dev qualifier --> %d\n",
 998                                                 retval);
 999                                 return retval;
1000                         }
1001                         /* usb2.0 but not high-speed capable; fine */
1002                 } else if (retval != sizeof(struct usb_qualifier_descriptor)) {
1003                         dev_err(&iface->dev, "dev qualifier --> %d\n", retval);
1004                         return (retval < 0) ? retval : -EDOM;
1005                 } else
1006                         d = (struct usb_qualifier_descriptor *) dev->buf;
1007
1008                 /* might not have [9.6.2] any other-speed configs [9.6.4] */
1009                 if (d) {
1010                         unsigned max = d->bNumConfigurations;
1011                         for (i = 0; i < max; i++) {
1012                                 retval = usb_get_descriptor(udev,
1013                                         USB_DT_OTHER_SPEED_CONFIG, i,
1014                                         dev->buf, TBUF_SIZE);
1015                                 if (!is_good_config(dev, retval)) {
1016                                         dev_err(&iface->dev,
1017                                                 "other speed config --> %d\n",
1018                                                 retval);
1019                                         return (retval < 0) ? retval : -EDOM;
1020                                 }
1021                         }
1022                 }
1023         }
1024         /* FIXME fetch strings from at least the device descriptor */
1025
1026         /* [9.4.5] get_status always works */
1027         retval = usb_get_std_status(udev, USB_RECIP_DEVICE, 0, dev->buf);
1028         if (retval) {
1029                 dev_err(&iface->dev, "get dev status --> %d\n", retval);
1030                 return retval;
1031         }
1032
1033         /* FIXME configuration.bmAttributes says if we could try to set/clear
1034          * the device's remote wakeup feature ... if we can, test that here
1035          */
1036
1037         retval = usb_get_std_status(udev, USB_RECIP_INTERFACE,
1038                         iface->altsetting[0].desc.bInterfaceNumber, dev->buf);
1039         if (retval) {
1040                 dev_err(&iface->dev, "get interface status --> %d\n", retval);
1041                 return retval;
1042         }
1043         /* FIXME get status for each endpoint in the interface */
1044
1045         return 0;
1046 }
1047
1048 /*-------------------------------------------------------------------------*/
1049
1050 /* use ch9 requests to test whether:
1051  *   (a) queues work for control, keeping N subtests queued and
1052  *       active (auto-resubmit) for M loops through the queue.
1053  *   (b) protocol stalls (control-only) will autorecover.
1054  *       it's not like bulk/intr; no halt clearing.
1055  *   (c) short control reads are reported and handled.
1056  *   (d) queues are always processed in-order
1057  */
1058
1059 struct ctrl_ctx {
1060         spinlock_t              lock;
1061         struct usbtest_dev      *dev;
1062         struct completion       complete;
1063         unsigned                count;
1064         unsigned                pending;
1065         int                     status;
1066         struct urb              **urb;
1067         struct usbtest_param_32 *param;
1068         int                     last;
1069 };
1070
1071 #define NUM_SUBCASES    16              /* how many test subcases here? */
1072
1073 struct subcase {
1074         struct usb_ctrlrequest  setup;
1075         int                     number;
1076         int                     expected;
1077 };
1078
1079 static void ctrl_complete(struct urb *urb)
1080 {
1081         struct ctrl_ctx         *ctx = urb->context;
1082         struct usb_ctrlrequest  *reqp;
1083         struct subcase          *subcase;
1084         int                     status = urb->status;
1085
1086         reqp = (struct usb_ctrlrequest *)urb->setup_packet;
1087         subcase = container_of(reqp, struct subcase, setup);
1088
1089         spin_lock(&ctx->lock);
1090         ctx->count--;
1091         ctx->pending--;
1092
1093         /* queue must transfer and complete in fifo order, unless
1094          * usb_unlink_urb() is used to unlink something not at the
1095          * physical queue head (not tested).
1096          */
1097         if (subcase->number > 0) {
1098                 if ((subcase->number - ctx->last) != 1) {
1099                         ERROR(ctx->dev,
1100                                 "subcase %d completed out of order, last %d\n",
1101                                 subcase->number, ctx->last);
1102                         status = -EDOM;
1103                         ctx->last = subcase->number;
1104                         goto error;
1105                 }
1106         }
1107         ctx->last = subcase->number;
1108
1109         /* succeed or fault in only one way? */
1110         if (status == subcase->expected)
1111                 status = 0;
1112
1113         /* async unlink for cleanup? */
1114         else if (status != -ECONNRESET) {
1115
1116                 /* some faults are allowed, not required */
1117                 if (subcase->expected > 0 && (
1118                           ((status == -subcase->expected        /* happened */
1119                            || status == 0))))                   /* didn't */
1120                         status = 0;
1121                 /* sometimes more than one fault is allowed */
1122                 else if (subcase->number == 12 && status == -EPIPE)
1123                         status = 0;
1124                 else
1125                         ERROR(ctx->dev, "subtest %d error, status %d\n",
1126                                         subcase->number, status);
1127         }
1128
1129         /* unexpected status codes mean errors; ideally, in hardware */
1130         if (status) {
1131 error:
1132                 if (ctx->status == 0) {
1133                         int             i;
1134
1135                         ctx->status = status;
1136                         ERROR(ctx->dev, "control queue %02x.%02x, err %d, "
1137                                         "%d left, subcase %d, len %d/%d\n",
1138                                         reqp->bRequestType, reqp->bRequest,
1139                                         status, ctx->count, subcase->number,
1140                                         urb->actual_length,
1141                                         urb->transfer_buffer_length);
1142
1143                         /* FIXME this "unlink everything" exit route should
1144                          * be a separate test case.
1145                          */
1146
1147                         /* unlink whatever's still pending */
1148                         for (i = 1; i < ctx->param->sglen; i++) {
1149                                 struct urb *u = ctx->urb[
1150                                                         (i + subcase->number)
1151                                                         % ctx->param->sglen];
1152
1153                                 if (u == urb || !u->dev)
1154                                         continue;
1155                                 spin_unlock(&ctx->lock);
1156                                 status = usb_unlink_urb(u);
1157                                 spin_lock(&ctx->lock);
1158                                 switch (status) {
1159                                 case -EINPROGRESS:
1160                                 case -EBUSY:
1161                                 case -EIDRM:
1162                                         continue;
1163                                 default:
1164                                         ERROR(ctx->dev, "urb unlink --> %d\n",
1165                                                         status);
1166                                 }
1167                         }
1168                         status = ctx->status;
1169                 }
1170         }
1171
1172         /* resubmit if we need to, else mark this as done */
1173         if ((status == 0) && (ctx->pending < ctx->count)) {
1174                 status = usb_submit_urb(urb, GFP_ATOMIC);
1175                 if (status != 0) {
1176                         ERROR(ctx->dev,
1177                                 "can't resubmit ctrl %02x.%02x, err %d\n",
1178                                 reqp->bRequestType, reqp->bRequest, status);
1179                         urb->dev = NULL;
1180                 } else
1181                         ctx->pending++;
1182         } else
1183                 urb->dev = NULL;
1184
1185         /* signal completion when nothing's queued */
1186         if (ctx->pending == 0)
1187                 complete(&ctx->complete);
1188         spin_unlock(&ctx->lock);
1189 }
1190
1191 static int
1192 test_ctrl_queue(struct usbtest_dev *dev, struct usbtest_param_32 *param)
1193 {
1194         struct usb_device       *udev = testdev_to_usbdev(dev);
1195         struct urb              **urb;
1196         struct ctrl_ctx         context;
1197         int                     i;
1198
1199         if (param->sglen == 0 || param->iterations > UINT_MAX / param->sglen)
1200                 return -EOPNOTSUPP;
1201
1202         spin_lock_init(&context.lock);
1203         context.dev = dev;
1204         init_completion(&context.complete);
1205         context.count = param->sglen * param->iterations;
1206         context.pending = 0;
1207         context.status = -ENOMEM;
1208         context.param = param;
1209         context.last = -1;
1210
1211         /* allocate and init the urbs we'll queue.
1212          * as with bulk/intr sglists, sglen is the queue depth; it also
1213          * controls which subtests run (more tests than sglen) or rerun.
1214          */
1215         urb = kcalloc(param->sglen, sizeof(struct urb *), GFP_KERNEL);
1216         if (!urb)
1217                 return -ENOMEM;
1218         for (i = 0; i < param->sglen; i++) {
1219                 int                     pipe = usb_rcvctrlpipe(udev, 0);
1220                 unsigned                len;
1221                 struct urb              *u;
1222                 struct usb_ctrlrequest  req;
1223                 struct subcase          *reqp;
1224
1225                 /* sign of this variable means:
1226                  *  -: tested code must return this (negative) error code
1227                  *  +: tested code may return this (negative too) error code
1228                  */
1229                 int                     expected = 0;
1230
1231                 /* requests here are mostly expected to succeed on any
1232                  * device, but some are chosen to trigger protocol stalls
1233                  * or short reads.
1234                  */
1235                 memset(&req, 0, sizeof(req));
1236                 req.bRequest = USB_REQ_GET_DESCRIPTOR;
1237                 req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
1238
1239                 switch (i % NUM_SUBCASES) {
1240                 case 0:         /* get device descriptor */
1241                         req.wValue = cpu_to_le16(USB_DT_DEVICE << 8);
1242                         len = sizeof(struct usb_device_descriptor);
1243                         break;
1244                 case 1:         /* get first config descriptor (only) */
1245                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1246                         len = sizeof(struct usb_config_descriptor);
1247                         break;
1248                 case 2:         /* get altsetting (OFTEN STALLS) */
1249                         req.bRequest = USB_REQ_GET_INTERFACE;
1250                         req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
1251                         /* index = 0 means first interface */
1252                         len = 1;
1253                         expected = EPIPE;
1254                         break;
1255                 case 3:         /* get interface status */
1256                         req.bRequest = USB_REQ_GET_STATUS;
1257                         req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
1258                         /* interface 0 */
1259                         len = 2;
1260                         break;
1261                 case 4:         /* get device status */
1262                         req.bRequest = USB_REQ_GET_STATUS;
1263                         req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
1264                         len = 2;
1265                         break;
1266                 case 5:         /* get device qualifier (MAY STALL) */
1267                         req.wValue = cpu_to_le16 (USB_DT_DEVICE_QUALIFIER << 8);
1268                         len = sizeof(struct usb_qualifier_descriptor);
1269                         if (udev->speed != USB_SPEED_HIGH)
1270                                 expected = EPIPE;
1271                         break;
1272                 case 6:         /* get first config descriptor, plus interface */
1273                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1274                         len = sizeof(struct usb_config_descriptor);
1275                         len += sizeof(struct usb_interface_descriptor);
1276                         break;
1277                 case 7:         /* get interface descriptor (ALWAYS STALLS) */
1278                         req.wValue = cpu_to_le16 (USB_DT_INTERFACE << 8);
1279                         /* interface == 0 */
1280                         len = sizeof(struct usb_interface_descriptor);
1281                         expected = -EPIPE;
1282                         break;
1283                 /* NOTE: two consecutive stalls in the queue here.
1284                  *  that tests fault recovery a bit more aggressively. */
1285                 case 8:         /* clear endpoint halt (MAY STALL) */
1286                         req.bRequest = USB_REQ_CLEAR_FEATURE;
1287                         req.bRequestType = USB_RECIP_ENDPOINT;
1288                         /* wValue 0 == ep halt */
1289                         /* wIndex 0 == ep0 (shouldn't halt!) */
1290                         len = 0;
1291                         pipe = usb_sndctrlpipe(udev, 0);
1292                         expected = EPIPE;
1293                         break;
1294                 case 9:         /* get endpoint status */
1295                         req.bRequest = USB_REQ_GET_STATUS;
1296                         req.bRequestType = USB_DIR_IN|USB_RECIP_ENDPOINT;
1297                         /* endpoint 0 */
1298                         len = 2;
1299                         break;
1300                 case 10:        /* trigger short read (EREMOTEIO) */
1301                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1302                         len = 1024;
1303                         expected = -EREMOTEIO;
1304                         break;
1305                 /* NOTE: two consecutive _different_ faults in the queue. */
1306                 case 11:        /* get endpoint descriptor (ALWAYS STALLS) */
1307                         req.wValue = cpu_to_le16(USB_DT_ENDPOINT << 8);
1308                         /* endpoint == 0 */
1309                         len = sizeof(struct usb_interface_descriptor);
1310                         expected = EPIPE;
1311                         break;
1312                 /* NOTE: sometimes even a third fault in the queue! */
1313                 case 12:        /* get string 0 descriptor (MAY STALL) */
1314                         req.wValue = cpu_to_le16(USB_DT_STRING << 8);
1315                         /* string == 0, for language IDs */
1316                         len = sizeof(struct usb_interface_descriptor);
1317                         /* may succeed when > 4 languages */
1318                         expected = EREMOTEIO;   /* or EPIPE, if no strings */
1319                         break;
1320                 case 13:        /* short read, resembling case 10 */
1321                         req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
1322                         /* last data packet "should" be DATA1, not DATA0 */
1323                         if (udev->speed == USB_SPEED_SUPER)
1324                                 len = 1024 - 512;
1325                         else
1326                                 len = 1024 - udev->descriptor.bMaxPacketSize0;
1327                         expected = -EREMOTEIO;
1328                         break;
1329                 case 14:        /* short read; try to fill the last packet */
1330                         req.wValue = cpu_to_le16((USB_DT_DEVICE << 8) | 0);
1331                         /* device descriptor size == 18 bytes */
1332                         len = udev->descriptor.bMaxPacketSize0;
1333                         if (udev->speed == USB_SPEED_SUPER)
1334                                 len = 512;
1335                         switch (len) {
1336                         case 8:
1337                                 len = 24;
1338                                 break;
1339                         case 16:
1340                                 len = 32;
1341                                 break;
1342                         }
1343                         expected = -EREMOTEIO;
1344                         break;
1345                 case 15:
1346                         req.wValue = cpu_to_le16(USB_DT_BOS << 8);
1347                         if (udev->bos)
1348                                 len = le16_to_cpu(udev->bos->desc->wTotalLength);
1349                         else
1350                                 len = sizeof(struct usb_bos_descriptor);
1351                         if (le16_to_cpu(udev->descriptor.bcdUSB) < 0x0201)
1352                                 expected = -EPIPE;
1353                         break;
1354                 default:
1355                         ERROR(dev, "bogus number of ctrl queue testcases!\n");
1356                         context.status = -EINVAL;
1357                         goto cleanup;
1358                 }
1359                 req.wLength = cpu_to_le16(len);
1360                 urb[i] = u = simple_alloc_urb(udev, pipe, len, 0);
1361                 if (!u)
1362                         goto cleanup;
1363
1364                 reqp = kmalloc(sizeof(*reqp), GFP_KERNEL);
1365                 if (!reqp)
1366                         goto cleanup;
1367                 reqp->setup = req;
1368                 reqp->number = i % NUM_SUBCASES;
1369                 reqp->expected = expected;
1370                 u->setup_packet = (char *) &reqp->setup;
1371
1372                 u->context = &context;
1373                 u->complete = ctrl_complete;
1374         }
1375
1376         /* queue the urbs */
1377         context.urb = urb;
1378         spin_lock_irq(&context.lock);
1379         for (i = 0; i < param->sglen; i++) {
1380                 context.status = usb_submit_urb(urb[i], GFP_ATOMIC);
1381                 if (context.status != 0) {
1382                         ERROR(dev, "can't submit urb[%d], status %d\n",
1383                                         i, context.status);
1384                         context.count = context.pending;
1385                         break;
1386                 }
1387                 context.pending++;
1388         }
1389         spin_unlock_irq(&context.lock);
1390
1391         /* FIXME  set timer and time out; provide a disconnect hook */
1392
1393         /* wait for the last one to complete */
1394         if (context.pending > 0)
1395                 wait_for_completion(&context.complete);
1396
1397 cleanup:
1398         for (i = 0; i < param->sglen; i++) {
1399                 if (!urb[i])
1400                         continue;
1401                 urb[i]->dev = udev;
1402                 kfree(urb[i]->setup_packet);
1403                 simple_free_urb(urb[i]);
1404         }
1405         kfree(urb);
1406         return context.status;
1407 }
1408 #undef NUM_SUBCASES
1409
1410
1411 /*-------------------------------------------------------------------------*/
1412
1413 static void unlink1_callback(struct urb *urb)
1414 {
1415         int     status = urb->status;
1416
1417         /* we "know" -EPIPE (stall) never happens */
1418         if (!status)
1419                 status = usb_submit_urb(urb, GFP_ATOMIC);
1420         if (status) {
1421                 urb->status = status;
1422                 complete(urb->context);
1423         }
1424 }
1425
1426 static int unlink1(struct usbtest_dev *dev, int pipe, int size, int async)
1427 {
1428         struct urb              *urb;
1429         struct completion       completion;
1430         int                     retval = 0;
1431
1432         init_completion(&completion);
1433         urb = simple_alloc_urb(testdev_to_usbdev(dev), pipe, size, 0);
1434         if (!urb)
1435                 return -ENOMEM;
1436         urb->context = &completion;
1437         urb->complete = unlink1_callback;
1438
1439         if (usb_pipeout(urb->pipe)) {
1440                 simple_fill_buf(urb);
1441                 urb->transfer_flags |= URB_ZERO_PACKET;
1442         }
1443
1444         /* keep the endpoint busy.  there are lots of hc/hcd-internal
1445          * states, and testing should get to all of them over time.
1446          *
1447          * FIXME want additional tests for when endpoint is STALLing
1448          * due to errors, or is just NAKing requests.
1449          */
1450         retval = usb_submit_urb(urb, GFP_KERNEL);
1451         if (retval != 0) {
1452                 dev_err(&dev->intf->dev, "submit fail %d\n", retval);
1453                 return retval;
1454         }
1455
1456         /* unlinking that should always work.  variable delay tests more
1457          * hcd states and code paths, even with little other system load.
1458          */
1459         msleep(jiffies % (2 * INTERRUPT_RATE));
1460         if (async) {
1461                 while (!completion_done(&completion)) {
1462                         retval = usb_unlink_urb(urb);
1463
1464                         if (retval == 0 && usb_pipein(urb->pipe))
1465                                 retval = simple_check_buf(dev, urb);
1466
1467                         switch (retval) {
1468                         case -EBUSY:
1469                         case -EIDRM:
1470                                 /* we can't unlink urbs while they're completing
1471                                  * or if they've completed, and we haven't
1472                                  * resubmitted. "normal" drivers would prevent
1473                                  * resubmission, but since we're testing unlink
1474                                  * paths, we can't.
1475                                  */
1476                                 ERROR(dev, "unlink retry\n");
1477                                 continue;
1478                         case 0:
1479                         case -EINPROGRESS:
1480                                 break;
1481
1482                         default:
1483                                 dev_err(&dev->intf->dev,
1484                                         "unlink fail %d\n", retval);
1485                                 return retval;
1486                         }
1487
1488                         break;
1489                 }
1490         } else
1491                 usb_kill_urb(urb);
1492
1493         wait_for_completion(&completion);
1494         retval = urb->status;
1495         simple_free_urb(urb);
1496
1497         if (async)
1498                 return (retval == -ECONNRESET) ? 0 : retval - 1000;
1499         else
1500                 return (retval == -ENOENT || retval == -EPERM) ?
1501                                 0 : retval - 2000;
1502 }
1503
1504 static int unlink_simple(struct usbtest_dev *dev, int pipe, int len)
1505 {
1506         int                     retval = 0;
1507
1508         /* test sync and async paths */
1509         retval = unlink1(dev, pipe, len, 1);
1510         if (!retval)
1511                 retval = unlink1(dev, pipe, len, 0);
1512         return retval;
1513 }
1514
1515 /*-------------------------------------------------------------------------*/
1516
1517 struct queued_ctx {
1518         struct completion       complete;
1519         atomic_t                pending;
1520         unsigned                num;
1521         int                     status;
1522         struct urb              **urbs;
1523 };
1524
1525 static void unlink_queued_callback(struct urb *urb)
1526 {
1527         int                     status = urb->status;
1528         struct queued_ctx       *ctx = urb->context;
1529
1530         if (ctx->status)
1531                 goto done;
1532         if (urb == ctx->urbs[ctx->num - 4] || urb == ctx->urbs[ctx->num - 2]) {
1533                 if (status == -ECONNRESET)
1534                         goto done;
1535                 /* What error should we report if the URB completed normally? */
1536         }
1537         if (status != 0)
1538                 ctx->status = status;
1539
1540  done:
1541         if (atomic_dec_and_test(&ctx->pending))
1542                 complete(&ctx->complete);
1543 }
1544
1545 static int unlink_queued(struct usbtest_dev *dev, int pipe, unsigned num,
1546                 unsigned size)
1547 {
1548         struct queued_ctx       ctx;
1549         struct usb_device       *udev = testdev_to_usbdev(dev);
1550         void                    *buf;
1551         dma_addr_t              buf_dma;
1552         int                     i;
1553         int                     retval = -ENOMEM;
1554
1555         init_completion(&ctx.complete);
1556         atomic_set(&ctx.pending, 1);    /* One more than the actual value */
1557         ctx.num = num;
1558         ctx.status = 0;
1559
1560         buf = usb_alloc_coherent(udev, size, GFP_KERNEL, &buf_dma);
1561         if (!buf)
1562                 return retval;
1563         memset(buf, 0, size);
1564
1565         /* Allocate and init the urbs we'll queue */
1566         ctx.urbs = kcalloc(num, sizeof(struct urb *), GFP_KERNEL);
1567         if (!ctx.urbs)
1568                 goto free_buf;
1569         for (i = 0; i < num; i++) {
1570                 ctx.urbs[i] = usb_alloc_urb(0, GFP_KERNEL);
1571                 if (!ctx.urbs[i])
1572                         goto free_urbs;
1573                 usb_fill_bulk_urb(ctx.urbs[i], udev, pipe, buf, size,
1574                                 unlink_queued_callback, &ctx);
1575                 ctx.urbs[i]->transfer_dma = buf_dma;
1576                 ctx.urbs[i]->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
1577
1578                 if (usb_pipeout(ctx.urbs[i]->pipe)) {
1579                         simple_fill_buf(ctx.urbs[i]);
1580                         ctx.urbs[i]->transfer_flags |= URB_ZERO_PACKET;
1581                 }
1582         }
1583
1584         /* Submit all the URBs and then unlink URBs num - 4 and num - 2. */
1585         for (i = 0; i < num; i++) {
1586                 atomic_inc(&ctx.pending);
1587                 retval = usb_submit_urb(ctx.urbs[i], GFP_KERNEL);
1588                 if (retval != 0) {
1589                         dev_err(&dev->intf->dev, "submit urbs[%d] fail %d\n",
1590                                         i, retval);
1591                         atomic_dec(&ctx.pending);
1592                         ctx.status = retval;
1593                         break;
1594                 }
1595         }
1596         if (i == num) {
1597                 usb_unlink_urb(ctx.urbs[num - 4]);
1598                 usb_unlink_urb(ctx.urbs[num - 2]);
1599         } else {
1600                 while (--i >= 0)
1601                         usb_unlink_urb(ctx.urbs[i]);
1602         }
1603
1604         if (atomic_dec_and_test(&ctx.pending))          /* The extra count */
1605                 complete(&ctx.complete);
1606         wait_for_completion(&ctx.complete);
1607         retval = ctx.status;
1608
1609  free_urbs:
1610         for (i = 0; i < num; i++)
1611                 usb_free_urb(ctx.urbs[i]);
1612         kfree(ctx.urbs);
1613  free_buf:
1614         usb_free_coherent(udev, size, buf, buf_dma);
1615         return retval;
1616 }
1617
1618 /*-------------------------------------------------------------------------*/
1619
1620 static int verify_not_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
1621 {
1622         int     retval;
1623         u16     status;
1624
1625         /* shouldn't look or act halted */
1626         retval = usb_get_std_status(urb->dev, USB_RECIP_ENDPOINT, ep, &status);
1627         if (retval < 0) {
1628                 ERROR(tdev, "ep %02x couldn't get no-halt status, %d\n",
1629                                 ep, retval);
1630                 return retval;
1631         }
1632         if (status != 0) {
1633                 ERROR(tdev, "ep %02x bogus status: %04x != 0\n", ep, status);
1634                 return -EINVAL;
1635         }
1636         retval = simple_io(tdev, urb, 1, 0, 0, __func__);
1637         if (retval != 0)
1638                 return -EINVAL;
1639         return 0;
1640 }
1641
1642 static int verify_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
1643 {
1644         int     retval;
1645         u16     status;
1646
1647         /* should look and act halted */
1648         retval = usb_get_std_status(urb->dev, USB_RECIP_ENDPOINT, ep, &status);
1649         if (retval < 0) {
1650                 ERROR(tdev, "ep %02x couldn't get halt status, %d\n",
1651                                 ep, retval);
1652                 return retval;
1653         }
1654         if (status != 1) {
1655                 ERROR(tdev, "ep %02x bogus status: %04x != 1\n", ep, status);
1656                 return -EINVAL;
1657         }
1658         retval = simple_io(tdev, urb, 1, 0, -EPIPE, __func__);
1659         if (retval != -EPIPE)
1660                 return -EINVAL;
1661         retval = simple_io(tdev, urb, 1, 0, -EPIPE, "verify_still_halted");
1662         if (retval != -EPIPE)
1663                 return -EINVAL;
1664         return 0;
1665 }
1666
1667 static int test_halt(struct usbtest_dev *tdev, int ep, struct urb *urb)
1668 {
1669         int     retval;
1670
1671         /* shouldn't look or act halted now */
1672         retval = verify_not_halted(tdev, ep, urb);
1673         if (retval < 0)
1674                 return retval;
1675
1676         /* set halt (protocol test only), verify it worked */
1677         retval = usb_control_msg(urb->dev, usb_sndctrlpipe(urb->dev, 0),
1678                         USB_REQ_SET_FEATURE, USB_RECIP_ENDPOINT,
1679                         USB_ENDPOINT_HALT, ep,
1680                         NULL, 0, USB_CTRL_SET_TIMEOUT);
1681         if (retval < 0) {
1682                 ERROR(tdev, "ep %02x couldn't set halt, %d\n", ep, retval);
1683                 return retval;
1684         }
1685         retval = verify_halted(tdev, ep, urb);
1686         if (retval < 0) {
1687                 int ret;
1688
1689                 /* clear halt anyways, else further tests will fail */
1690                 ret = usb_clear_halt(urb->dev, urb->pipe);
1691                 if (ret)
1692                         ERROR(tdev, "ep %02x couldn't clear halt, %d\n",
1693                               ep, ret);
1694
1695                 return retval;
1696         }
1697
1698         /* clear halt (tests API + protocol), verify it worked */
1699         retval = usb_clear_halt(urb->dev, urb->pipe);
1700         if (retval < 0) {
1701                 ERROR(tdev, "ep %02x couldn't clear halt, %d\n", ep, retval);
1702                 return retval;
1703         }
1704         retval = verify_not_halted(tdev, ep, urb);
1705         if (retval < 0)
1706                 return retval;
1707
1708         /* NOTE:  could also verify SET_INTERFACE clear halts ... */
1709
1710         return 0;
1711 }
1712
1713 static int halt_simple(struct usbtest_dev *dev)
1714 {
1715         int                     ep;
1716         int                     retval = 0;
1717         struct urb              *urb;
1718         struct usb_device       *udev = testdev_to_usbdev(dev);
1719
1720         if (udev->speed == USB_SPEED_SUPER)
1721                 urb = simple_alloc_urb(udev, 0, 1024, 0);
1722         else
1723                 urb = simple_alloc_urb(udev, 0, 512, 0);
1724         if (urb == NULL)
1725                 return -ENOMEM;
1726
1727         if (dev->in_pipe) {
1728                 ep = usb_pipeendpoint(dev->in_pipe) | USB_DIR_IN;
1729                 urb->pipe = dev->in_pipe;
1730                 retval = test_halt(dev, ep, urb);
1731                 if (retval < 0)
1732                         goto done;
1733         }
1734
1735         if (dev->out_pipe) {
1736                 ep = usb_pipeendpoint(dev->out_pipe);
1737                 urb->pipe = dev->out_pipe;
1738                 retval = test_halt(dev, ep, urb);
1739         }
1740 done:
1741         simple_free_urb(urb);
1742         return retval;
1743 }
1744
1745 /*-------------------------------------------------------------------------*/
1746
1747 /* Control OUT tests use the vendor control requests from Intel's
1748  * USB 2.0 compliance test device:  write a buffer, read it back.
1749  *
1750  * Intel's spec only _requires_ that it work for one packet, which
1751  * is pretty weak.   Some HCDs place limits here; most devices will
1752  * need to be able to handle more than one OUT data packet.  We'll
1753  * try whatever we're told to try.
1754  */
1755 static int ctrl_out(struct usbtest_dev *dev,
1756                 unsigned count, unsigned length, unsigned vary, unsigned offset)
1757 {
1758         unsigned                i, j, len;
1759         int                     retval;
1760         u8                      *buf;
1761         char                    *what = "?";
1762         struct usb_device       *udev;
1763
1764         if (length < 1 || length > 0xffff || vary >= length)
1765                 return -EINVAL;
1766
1767         buf = kmalloc(length + offset, GFP_KERNEL);
1768         if (!buf)
1769                 return -ENOMEM;
1770
1771         buf += offset;
1772         udev = testdev_to_usbdev(dev);
1773         len = length;
1774         retval = 0;
1775
1776         /* NOTE:  hardware might well act differently if we pushed it
1777          * with lots back-to-back queued requests.
1778          */
1779         for (i = 0; i < count; i++) {
1780                 /* write patterned data */
1781                 for (j = 0; j < len; j++)
1782                         buf[j] = (u8)(i + j);
1783                 retval = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
1784                                 0x5b, USB_DIR_OUT|USB_TYPE_VENDOR,
1785                                 0, 0, buf, len, USB_CTRL_SET_TIMEOUT);
1786                 if (retval != len) {
1787                         what = "write";
1788                         if (retval >= 0) {
1789                                 ERROR(dev, "ctrl_out, wlen %d (expected %d)\n",
1790                                                 retval, len);
1791                                 retval = -EBADMSG;
1792                         }
1793                         break;
1794                 }
1795
1796                 /* read it back -- assuming nothing intervened!!  */
1797                 retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
1798                                 0x5c, USB_DIR_IN|USB_TYPE_VENDOR,
1799                                 0, 0, buf, len, USB_CTRL_GET_TIMEOUT);
1800                 if (retval != len) {
1801                         what = "read";
1802                         if (retval >= 0) {
1803                                 ERROR(dev, "ctrl_out, rlen %d (expected %d)\n",
1804                                                 retval, len);
1805                                 retval = -EBADMSG;
1806                         }
1807                         break;
1808                 }
1809
1810                 /* fail if we can't verify */
1811                 for (j = 0; j < len; j++) {
1812                         if (buf[j] != (u8)(i + j)) {
1813                                 ERROR(dev, "ctrl_out, byte %d is %d not %d\n",
1814                                         j, buf[j], (u8)(i + j));
1815                                 retval = -EBADMSG;
1816                                 break;
1817                         }
1818                 }
1819                 if (retval < 0) {
1820                         what = "verify";
1821                         break;
1822                 }
1823
1824                 len += vary;
1825
1826                 /* [real world] the "zero bytes IN" case isn't really used.
1827                  * hardware can easily trip up in this weird case, since its
1828                  * status stage is IN, not OUT like other ep0in transfers.
1829                  */
1830                 if (len > length)
1831                         len = realworld ? 1 : 0;
1832         }
1833
1834         if (retval < 0)
1835                 ERROR(dev, "ctrl_out %s failed, code %d, count %d\n",
1836                         what, retval, i);
1837
1838         kfree(buf - offset);
1839         return retval;
1840 }
1841
1842 /*-------------------------------------------------------------------------*/
1843
1844 /* ISO/BULK tests ... mimics common usage
1845  *  - buffer length is split into N packets (mostly maxpacket sized)
1846  *  - multi-buffers according to sglen
1847  */
1848
1849 struct transfer_context {
1850         unsigned                count;
1851         unsigned                pending;
1852         spinlock_t              lock;
1853         struct completion       done;
1854         int                     submit_error;
1855         unsigned long           errors;
1856         unsigned long           packet_count;
1857         struct usbtest_dev      *dev;
1858         bool                    is_iso;
1859 };
1860
1861 static void complicated_callback(struct urb *urb)
1862 {
1863         struct transfer_context *ctx = urb->context;
1864
1865         spin_lock(&ctx->lock);
1866         ctx->count--;
1867
1868         ctx->packet_count += urb->number_of_packets;
1869         if (urb->error_count > 0)
1870                 ctx->errors += urb->error_count;
1871         else if (urb->status != 0)
1872                 ctx->errors += (ctx->is_iso ? urb->number_of_packets : 1);
1873         else if (urb->actual_length != urb->transfer_buffer_length)
1874                 ctx->errors++;
1875         else if (check_guard_bytes(ctx->dev, urb) != 0)
1876                 ctx->errors++;
1877
1878         if (urb->status == 0 && ctx->count > (ctx->pending - 1)
1879                         && !ctx->submit_error) {
1880                 int status = usb_submit_urb(urb, GFP_ATOMIC);
1881                 switch (status) {
1882                 case 0:
1883                         goto done;
1884                 default:
1885                         dev_err(&ctx->dev->intf->dev,
1886                                         "resubmit err %d\n",
1887                                         status);
1888                         /* FALLTHROUGH */
1889                 case -ENODEV:                   /* disconnected */
1890                 case -ESHUTDOWN:                /* endpoint disabled */
1891                         ctx->submit_error = 1;
1892                         break;
1893                 }
1894         }
1895
1896         ctx->pending--;
1897         if (ctx->pending == 0) {
1898                 if (ctx->errors)
1899                         dev_err(&ctx->dev->intf->dev,
1900                                 "during the test, %lu errors out of %lu\n",
1901                                 ctx->errors, ctx->packet_count);
1902                 complete(&ctx->done);
1903         }
1904 done:
1905         spin_unlock(&ctx->lock);
1906 }
1907
1908 static struct urb *iso_alloc_urb(
1909         struct usb_device       *udev,
1910         int                     pipe,
1911         struct usb_endpoint_descriptor  *desc,
1912         long                    bytes,
1913         unsigned offset
1914 )
1915 {
1916         struct urb              *urb;
1917         unsigned                i, maxp, packets;
1918
1919         if (bytes < 0 || !desc)
1920                 return NULL;
1921         maxp = usb_endpoint_maxp(desc);
1922         maxp *= usb_endpoint_maxp_mult(desc);
1923         packets = DIV_ROUND_UP(bytes, maxp);
1924
1925         urb = usb_alloc_urb(packets, GFP_KERNEL);
1926         if (!urb)
1927                 return urb;
1928         urb->dev = udev;
1929         urb->pipe = pipe;
1930
1931         urb->number_of_packets = packets;
1932         urb->transfer_buffer_length = bytes;
1933         urb->transfer_buffer = usb_alloc_coherent(udev, bytes + offset,
1934                                                         GFP_KERNEL,
1935                                                         &urb->transfer_dma);
1936         if (!urb->transfer_buffer) {
1937                 usb_free_urb(urb);
1938                 return NULL;
1939         }
1940         if (offset) {
1941                 memset(urb->transfer_buffer, GUARD_BYTE, offset);
1942                 urb->transfer_buffer += offset;
1943                 urb->transfer_dma += offset;
1944         }
1945         /* For inbound transfers use guard byte so that test fails if
1946                 data not correctly copied */
1947         memset(urb->transfer_buffer,
1948                         usb_pipein(urb->pipe) ? GUARD_BYTE : 0,
1949                         bytes);
1950
1951         for (i = 0; i < packets; i++) {
1952                 /* here, only the last packet will be short */
1953                 urb->iso_frame_desc[i].length = min((unsigned) bytes, maxp);
1954                 bytes -= urb->iso_frame_desc[i].length;
1955
1956                 urb->iso_frame_desc[i].offset = maxp * i;
1957         }
1958
1959         urb->complete = complicated_callback;
1960         /* urb->context = SET BY CALLER */
1961         urb->interval = 1 << (desc->bInterval - 1);
1962         urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
1963         return urb;
1964 }
1965
1966 static int
1967 test_queue(struct usbtest_dev *dev, struct usbtest_param_32 *param,
1968                 int pipe, struct usb_endpoint_descriptor *desc, unsigned offset)
1969 {
1970         struct transfer_context context;
1971         struct usb_device       *udev;
1972         unsigned                i;
1973         unsigned long           packets = 0;
1974         int                     status = 0;
1975         struct urb              *urbs[param->sglen];
1976
1977         if (!param->sglen || param->iterations > UINT_MAX / param->sglen)
1978                 return -EINVAL;
1979
1980         memset(&context, 0, sizeof(context));
1981         context.count = param->iterations * param->sglen;
1982         context.dev = dev;
1983         context.is_iso = !!desc;
1984         init_completion(&context.done);
1985         spin_lock_init(&context.lock);
1986
1987         udev = testdev_to_usbdev(dev);
1988
1989         for (i = 0; i < param->sglen; i++) {
1990                 if (context.is_iso)
1991                         urbs[i] = iso_alloc_urb(udev, pipe, desc,
1992                                         param->length, offset);
1993                 else
1994                         urbs[i] = complicated_alloc_urb(udev, pipe,
1995                                         param->length, 0);
1996
1997                 if (!urbs[i]) {
1998                         status = -ENOMEM;
1999                         goto fail;
2000                 }
2001                 packets += urbs[i]->number_of_packets;
2002                 urbs[i]->context = &context;
2003         }
2004         packets *= param->iterations;
2005
2006         if (context.is_iso) {
2007                 dev_info(&dev->intf->dev,
2008                         "iso period %d %sframes, wMaxPacket %d, transactions: %d\n",
2009                         1 << (desc->bInterval - 1),
2010                         (udev->speed == USB_SPEED_HIGH) ? "micro" : "",
2011                         usb_endpoint_maxp(desc),
2012                         usb_endpoint_maxp_mult(desc));
2013
2014                 dev_info(&dev->intf->dev,
2015                         "total %lu msec (%lu packets)\n",
2016                         (packets * (1 << (desc->bInterval - 1)))
2017                                 / ((udev->speed == USB_SPEED_HIGH) ? 8 : 1),
2018                         packets);
2019         }
2020
2021         spin_lock_irq(&context.lock);
2022         for (i = 0; i < param->sglen; i++) {
2023                 ++context.pending;
2024                 status = usb_submit_urb(urbs[i], GFP_ATOMIC);
2025                 if (status < 0) {
2026                         ERROR(dev, "submit iso[%d], error %d\n", i, status);
2027                         if (i == 0) {
2028                                 spin_unlock_irq(&context.lock);
2029                                 goto fail;
2030                         }
2031
2032                         simple_free_urb(urbs[i]);
2033                         urbs[i] = NULL;
2034                         context.pending--;
2035                         context.submit_error = 1;
2036                         break;
2037                 }
2038         }
2039         spin_unlock_irq(&context.lock);
2040
2041         wait_for_completion(&context.done);
2042
2043         for (i = 0; i < param->sglen; i++) {
2044                 if (urbs[i])
2045                         simple_free_urb(urbs[i]);
2046         }
2047         /*
2048          * Isochronous transfers are expected to fail sometimes.  As an
2049          * arbitrary limit, we will report an error if any submissions
2050          * fail or if the transfer failure rate is > 10%.
2051          */
2052         if (status != 0)
2053                 ;
2054         else if (context.submit_error)
2055                 status = -EACCES;
2056         else if (context.errors >
2057                         (context.is_iso ? context.packet_count / 10 : 0))
2058                 status = -EIO;
2059         return status;
2060
2061 fail:
2062         for (i = 0; i < param->sglen; i++) {
2063                 if (urbs[i])
2064                         simple_free_urb(urbs[i]);
2065         }
2066         return status;
2067 }
2068
2069 static int test_unaligned_bulk(
2070         struct usbtest_dev *tdev,
2071         int pipe,
2072         unsigned length,
2073         int iterations,
2074         unsigned transfer_flags,
2075         const char *label)
2076 {
2077         int retval;
2078         struct urb *urb = usbtest_alloc_urb(testdev_to_usbdev(tdev),
2079                         pipe, length, transfer_flags, 1, 0, simple_callback);
2080
2081         if (!urb)
2082                 return -ENOMEM;
2083
2084         retval = simple_io(tdev, urb, iterations, 0, 0, label);
2085         simple_free_urb(urb);
2086         return retval;
2087 }
2088
2089 /* Run tests. */
2090 static int
2091 usbtest_do_ioctl(struct usb_interface *intf, struct usbtest_param_32 *param)
2092 {
2093         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2094         struct usb_device       *udev = testdev_to_usbdev(dev);
2095         struct urb              *urb;
2096         struct scatterlist      *sg;
2097         struct usb_sg_request   req;
2098         unsigned                i;
2099         int     retval = -EOPNOTSUPP;
2100
2101         if (param->iterations <= 0)
2102                 return -EINVAL;
2103         if (param->sglen > MAX_SGLEN)
2104                 return -EINVAL;
2105         /*
2106          * Just a bunch of test cases that every HCD is expected to handle.
2107          *
2108          * Some may need specific firmware, though it'd be good to have
2109          * one firmware image to handle all the test cases.
2110          *
2111          * FIXME add more tests!  cancel requests, verify the data, control
2112          * queueing, concurrent read+write threads, and so on.
2113          */
2114         switch (param->test_num) {
2115
2116         case 0:
2117                 dev_info(&intf->dev, "TEST 0:  NOP\n");
2118                 retval = 0;
2119                 break;
2120
2121         /* Simple non-queued bulk I/O tests */
2122         case 1:
2123                 if (dev->out_pipe == 0)
2124                         break;
2125                 dev_info(&intf->dev,
2126                                 "TEST 1:  write %d bytes %u times\n",
2127                                 param->length, param->iterations);
2128                 urb = simple_alloc_urb(udev, dev->out_pipe, param->length, 0);
2129                 if (!urb) {
2130                         retval = -ENOMEM;
2131                         break;
2132                 }
2133                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2134                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test1");
2135                 simple_free_urb(urb);
2136                 break;
2137         case 2:
2138                 if (dev->in_pipe == 0)
2139                         break;
2140                 dev_info(&intf->dev,
2141                                 "TEST 2:  read %d bytes %u times\n",
2142                                 param->length, param->iterations);
2143                 urb = simple_alloc_urb(udev, dev->in_pipe, param->length, 0);
2144                 if (!urb) {
2145                         retval = -ENOMEM;
2146                         break;
2147                 }
2148                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2149                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test2");
2150                 simple_free_urb(urb);
2151                 break;
2152         case 3:
2153                 if (dev->out_pipe == 0 || param->vary == 0)
2154                         break;
2155                 dev_info(&intf->dev,
2156                                 "TEST 3:  write/%d 0..%d bytes %u times\n",
2157                                 param->vary, param->length, param->iterations);
2158                 urb = simple_alloc_urb(udev, dev->out_pipe, param->length, 0);
2159                 if (!urb) {
2160                         retval = -ENOMEM;
2161                         break;
2162                 }
2163                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2164                 retval = simple_io(dev, urb, param->iterations, param->vary,
2165                                         0, "test3");
2166                 simple_free_urb(urb);
2167                 break;
2168         case 4:
2169                 if (dev->in_pipe == 0 || param->vary == 0)
2170                         break;
2171                 dev_info(&intf->dev,
2172                                 "TEST 4:  read/%d 0..%d bytes %u times\n",
2173                                 param->vary, param->length, param->iterations);
2174                 urb = simple_alloc_urb(udev, dev->in_pipe, param->length, 0);
2175                 if (!urb) {
2176                         retval = -ENOMEM;
2177                         break;
2178                 }
2179                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2180                 retval = simple_io(dev, urb, param->iterations, param->vary,
2181                                         0, "test4");
2182                 simple_free_urb(urb);
2183                 break;
2184
2185         /* Queued bulk I/O tests */
2186         case 5:
2187                 if (dev->out_pipe == 0 || param->sglen == 0)
2188                         break;
2189                 dev_info(&intf->dev,
2190                         "TEST 5:  write %d sglists %d entries of %d bytes\n",
2191                                 param->iterations,
2192                                 param->sglen, param->length);
2193                 sg = alloc_sglist(param->sglen, param->length,
2194                                 0, dev, dev->out_pipe);
2195                 if (!sg) {
2196                         retval = -ENOMEM;
2197                         break;
2198                 }
2199                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2200                 retval = perform_sglist(dev, param->iterations, dev->out_pipe,
2201                                 &req, sg, param->sglen);
2202                 free_sglist(sg, param->sglen);
2203                 break;
2204
2205         case 6:
2206                 if (dev->in_pipe == 0 || param->sglen == 0)
2207                         break;
2208                 dev_info(&intf->dev,
2209                         "TEST 6:  read %d sglists %d entries of %d bytes\n",
2210                                 param->iterations,
2211                                 param->sglen, param->length);
2212                 sg = alloc_sglist(param->sglen, param->length,
2213                                 0, dev, dev->in_pipe);
2214                 if (!sg) {
2215                         retval = -ENOMEM;
2216                         break;
2217                 }
2218                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2219                 retval = perform_sglist(dev, param->iterations, dev->in_pipe,
2220                                 &req, sg, param->sglen);
2221                 free_sglist(sg, param->sglen);
2222                 break;
2223         case 7:
2224                 if (dev->out_pipe == 0 || param->sglen == 0 || param->vary == 0)
2225                         break;
2226                 dev_info(&intf->dev,
2227                         "TEST 7:  write/%d %d sglists %d entries 0..%d bytes\n",
2228                                 param->vary, param->iterations,
2229                                 param->sglen, param->length);
2230                 sg = alloc_sglist(param->sglen, param->length,
2231                                 param->vary, dev, dev->out_pipe);
2232                 if (!sg) {
2233                         retval = -ENOMEM;
2234                         break;
2235                 }
2236                 /* FIRMWARE:  bulk sink (maybe accepts short writes) */
2237                 retval = perform_sglist(dev, param->iterations, dev->out_pipe,
2238                                 &req, sg, param->sglen);
2239                 free_sglist(sg, param->sglen);
2240                 break;
2241         case 8:
2242                 if (dev->in_pipe == 0 || param->sglen == 0 || param->vary == 0)
2243                         break;
2244                 dev_info(&intf->dev,
2245                         "TEST 8:  read/%d %d sglists %d entries 0..%d bytes\n",
2246                                 param->vary, param->iterations,
2247                                 param->sglen, param->length);
2248                 sg = alloc_sglist(param->sglen, param->length,
2249                                 param->vary, dev, dev->in_pipe);
2250                 if (!sg) {
2251                         retval = -ENOMEM;
2252                         break;
2253                 }
2254                 /* FIRMWARE:  bulk source (maybe generates short writes) */
2255                 retval = perform_sglist(dev, param->iterations, dev->in_pipe,
2256                                 &req, sg, param->sglen);
2257                 free_sglist(sg, param->sglen);
2258                 break;
2259
2260         /* non-queued sanity tests for control (chapter 9 subset) */
2261         case 9:
2262                 retval = 0;
2263                 dev_info(&intf->dev,
2264                         "TEST 9:  ch9 (subset) control tests, %d times\n",
2265                                 param->iterations);
2266                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2267                         retval = ch9_postconfig(dev);
2268                 if (retval)
2269                         dev_err(&intf->dev, "ch9 subset failed, "
2270                                         "iterations left %d\n", i);
2271                 break;
2272
2273         /* queued control messaging */
2274         case 10:
2275                 retval = 0;
2276                 dev_info(&intf->dev,
2277                                 "TEST 10:  queue %d control calls, %d times\n",
2278                                 param->sglen,
2279                                 param->iterations);
2280                 retval = test_ctrl_queue(dev, param);
2281                 break;
2282
2283         /* simple non-queued unlinks (ring with one urb) */
2284         case 11:
2285                 if (dev->in_pipe == 0 || !param->length)
2286                         break;
2287                 retval = 0;
2288                 dev_info(&intf->dev, "TEST 11:  unlink %d reads of %d\n",
2289                                 param->iterations, param->length);
2290                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2291                         retval = unlink_simple(dev, dev->in_pipe,
2292                                                 param->length);
2293                 if (retval)
2294                         dev_err(&intf->dev, "unlink reads failed %d, "
2295                                 "iterations left %d\n", retval, i);
2296                 break;
2297         case 12:
2298                 if (dev->out_pipe == 0 || !param->length)
2299                         break;
2300                 retval = 0;
2301                 dev_info(&intf->dev, "TEST 12:  unlink %d writes of %d\n",
2302                                 param->iterations, param->length);
2303                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2304                         retval = unlink_simple(dev, dev->out_pipe,
2305                                                 param->length);
2306                 if (retval)
2307                         dev_err(&intf->dev, "unlink writes failed %d, "
2308                                 "iterations left %d\n", retval, i);
2309                 break;
2310
2311         /* ep halt tests */
2312         case 13:
2313                 if (dev->out_pipe == 0 && dev->in_pipe == 0)
2314                         break;
2315                 retval = 0;
2316                 dev_info(&intf->dev, "TEST 13:  set/clear %d halts\n",
2317                                 param->iterations);
2318                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
2319                         retval = halt_simple(dev);
2320
2321                 if (retval)
2322                         ERROR(dev, "halts failed, iterations left %d\n", i);
2323                 break;
2324
2325         /* control write tests */
2326         case 14:
2327                 if (!dev->info->ctrl_out)
2328                         break;
2329                 dev_info(&intf->dev, "TEST 14:  %d ep0out, %d..%d vary %d\n",
2330                                 param->iterations,
2331                                 realworld ? 1 : 0, param->length,
2332                                 param->vary);
2333                 retval = ctrl_out(dev, param->iterations,
2334                                 param->length, param->vary, 0);
2335                 break;
2336
2337         /* iso write tests */
2338         case 15:
2339                 if (dev->out_iso_pipe == 0 || param->sglen == 0)
2340                         break;
2341                 dev_info(&intf->dev,
2342                         "TEST 15:  write %d iso, %d entries of %d bytes\n",
2343                                 param->iterations,
2344                                 param->sglen, param->length);
2345                 /* FIRMWARE:  iso sink */
2346                 retval = test_queue(dev, param,
2347                                 dev->out_iso_pipe, dev->iso_out, 0);
2348                 break;
2349
2350         /* iso read tests */
2351         case 16:
2352                 if (dev->in_iso_pipe == 0 || param->sglen == 0)
2353                         break;
2354                 dev_info(&intf->dev,
2355                         "TEST 16:  read %d iso, %d entries of %d bytes\n",
2356                                 param->iterations,
2357                                 param->sglen, param->length);
2358                 /* FIRMWARE:  iso source */
2359                 retval = test_queue(dev, param,
2360                                 dev->in_iso_pipe, dev->iso_in, 0);
2361                 break;
2362
2363         /* FIXME scatterlist cancel (needs helper thread) */
2364
2365         /* Tests for bulk I/O using DMA mapping by core and odd address */
2366         case 17:
2367                 if (dev->out_pipe == 0)
2368                         break;
2369                 dev_info(&intf->dev,
2370                         "TEST 17:  write odd addr %d bytes %u times core map\n",
2371                         param->length, param->iterations);
2372
2373                 retval = test_unaligned_bulk(
2374                                 dev, dev->out_pipe,
2375                                 param->length, param->iterations,
2376                                 0, "test17");
2377                 break;
2378
2379         case 18:
2380                 if (dev->in_pipe == 0)
2381                         break;
2382                 dev_info(&intf->dev,
2383                         "TEST 18:  read odd addr %d bytes %u times core map\n",
2384                         param->length, param->iterations);
2385
2386                 retval = test_unaligned_bulk(
2387                                 dev, dev->in_pipe,
2388                                 param->length, param->iterations,
2389                                 0, "test18");
2390                 break;
2391
2392         /* Tests for bulk I/O using premapped coherent buffer and odd address */
2393         case 19:
2394                 if (dev->out_pipe == 0)
2395                         break;
2396                 dev_info(&intf->dev,
2397                         "TEST 19:  write odd addr %d bytes %u times premapped\n",
2398                         param->length, param->iterations);
2399
2400                 retval = test_unaligned_bulk(
2401                                 dev, dev->out_pipe,
2402                                 param->length, param->iterations,
2403                                 URB_NO_TRANSFER_DMA_MAP, "test19");
2404                 break;
2405
2406         case 20:
2407                 if (dev->in_pipe == 0)
2408                         break;
2409                 dev_info(&intf->dev,
2410                         "TEST 20:  read odd addr %d bytes %u times premapped\n",
2411                         param->length, param->iterations);
2412
2413                 retval = test_unaligned_bulk(
2414                                 dev, dev->in_pipe,
2415                                 param->length, param->iterations,
2416                                 URB_NO_TRANSFER_DMA_MAP, "test20");
2417                 break;
2418
2419         /* control write tests with unaligned buffer */
2420         case 21:
2421                 if (!dev->info->ctrl_out)
2422                         break;
2423                 dev_info(&intf->dev,
2424                                 "TEST 21:  %d ep0out odd addr, %d..%d vary %d\n",
2425                                 param->iterations,
2426                                 realworld ? 1 : 0, param->length,
2427                                 param->vary);
2428                 retval = ctrl_out(dev, param->iterations,
2429                                 param->length, param->vary, 1);
2430                 break;
2431
2432         /* unaligned iso tests */
2433         case 22:
2434                 if (dev->out_iso_pipe == 0 || param->sglen == 0)
2435                         break;
2436                 dev_info(&intf->dev,
2437                         "TEST 22:  write %d iso odd, %d entries of %d bytes\n",
2438                                 param->iterations,
2439                                 param->sglen, param->length);
2440                 retval = test_queue(dev, param,
2441                                 dev->out_iso_pipe, dev->iso_out, 1);
2442                 break;
2443
2444         case 23:
2445                 if (dev->in_iso_pipe == 0 || param->sglen == 0)
2446                         break;
2447                 dev_info(&intf->dev,
2448                         "TEST 23:  read %d iso odd, %d entries of %d bytes\n",
2449                                 param->iterations,
2450                                 param->sglen, param->length);
2451                 retval = test_queue(dev, param,
2452                                 dev->in_iso_pipe, dev->iso_in, 1);
2453                 break;
2454
2455         /* unlink URBs from a bulk-OUT queue */
2456         case 24:
2457                 if (dev->out_pipe == 0 || !param->length || param->sglen < 4)
2458                         break;
2459                 retval = 0;
2460                 dev_info(&intf->dev, "TEST 24:  unlink from %d queues of "
2461                                 "%d %d-byte writes\n",
2462                                 param->iterations, param->sglen, param->length);
2463                 for (i = param->iterations; retval == 0 && i > 0; --i) {
2464                         retval = unlink_queued(dev, dev->out_pipe,
2465                                                 param->sglen, param->length);
2466                         if (retval) {
2467                                 dev_err(&intf->dev,
2468                                         "unlink queued writes failed %d, "
2469                                         "iterations left %d\n", retval, i);
2470                                 break;
2471                         }
2472                 }
2473                 break;
2474
2475         /* Simple non-queued interrupt I/O tests */
2476         case 25:
2477                 if (dev->out_int_pipe == 0)
2478                         break;
2479                 dev_info(&intf->dev,
2480                                 "TEST 25: write %d bytes %u times\n",
2481                                 param->length, param->iterations);
2482                 urb = simple_alloc_urb(udev, dev->out_int_pipe, param->length,
2483                                 dev->int_out->bInterval);
2484                 if (!urb) {
2485                         retval = -ENOMEM;
2486                         break;
2487                 }
2488                 /* FIRMWARE: interrupt sink (maybe accepts short writes) */
2489                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test25");
2490                 simple_free_urb(urb);
2491                 break;
2492         case 26:
2493                 if (dev->in_int_pipe == 0)
2494                         break;
2495                 dev_info(&intf->dev,
2496                                 "TEST 26: read %d bytes %u times\n",
2497                                 param->length, param->iterations);
2498                 urb = simple_alloc_urb(udev, dev->in_int_pipe, param->length,
2499                                 dev->int_in->bInterval);
2500                 if (!urb) {
2501                         retval = -ENOMEM;
2502                         break;
2503                 }
2504                 /* FIRMWARE: interrupt source (maybe generates short writes) */
2505                 retval = simple_io(dev, urb, param->iterations, 0, 0, "test26");
2506                 simple_free_urb(urb);
2507                 break;
2508         case 27:
2509                 /* We do performance test, so ignore data compare */
2510                 if (dev->out_pipe == 0 || param->sglen == 0 || pattern != 0)
2511                         break;
2512                 dev_info(&intf->dev,
2513                         "TEST 27: bulk write %dMbytes\n", (param->iterations *
2514                         param->sglen * param->length) / (1024 * 1024));
2515                 retval = test_queue(dev, param,
2516                                 dev->out_pipe, NULL, 0);
2517                 break;
2518         case 28:
2519                 if (dev->in_pipe == 0 || param->sglen == 0 || pattern != 0)
2520                         break;
2521                 dev_info(&intf->dev,
2522                         "TEST 28: bulk read %dMbytes\n", (param->iterations *
2523                         param->sglen * param->length) / (1024 * 1024));
2524                 retval = test_queue(dev, param,
2525                                 dev->in_pipe, NULL, 0);
2526                 break;
2527         }
2528         return retval;
2529 }
2530
2531 /*-------------------------------------------------------------------------*/
2532
2533 /* We only have this one interface to user space, through usbfs.
2534  * User mode code can scan usbfs to find N different devices (maybe on
2535  * different busses) to use when testing, and allocate one thread per
2536  * test.  So discovery is simplified, and we have no device naming issues.
2537  *
2538  * Don't use these only as stress/load tests.  Use them along with with
2539  * other USB bus activity:  plugging, unplugging, mousing, mp3 playback,
2540  * video capture, and so on.  Run different tests at different times, in
2541  * different sequences.  Nothing here should interact with other devices,
2542  * except indirectly by consuming USB bandwidth and CPU resources for test
2543  * threads and request completion.  But the only way to know that for sure
2544  * is to test when HC queues are in use by many devices.
2545  *
2546  * WARNING:  Because usbfs grabs udev->dev.sem before calling this ioctl(),
2547  * it locks out usbcore in certain code paths.  Notably, if you disconnect
2548  * the device-under-test, hub_wq will wait block forever waiting for the
2549  * ioctl to complete ... so that usb_disconnect() can abort the pending
2550  * urbs and then call usbtest_disconnect().  To abort a test, you're best
2551  * off just killing the userspace task and waiting for it to exit.
2552  */
2553
2554 static int
2555 usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
2556 {
2557
2558         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2559         struct usbtest_param_64 *param_64 = buf;
2560         struct usbtest_param_32 temp;
2561         struct usbtest_param_32 *param_32 = buf;
2562         struct timespec64 start;
2563         struct timespec64 end;
2564         struct timespec64 duration;
2565         int retval = -EOPNOTSUPP;
2566
2567         /* FIXME USBDEVFS_CONNECTINFO doesn't say how fast the device is. */
2568
2569         pattern = mod_pattern;
2570
2571         if (mutex_lock_interruptible(&dev->lock))
2572                 return -ERESTARTSYS;
2573
2574         /* FIXME: What if a system sleep starts while a test is running? */
2575
2576         /* some devices, like ez-usb default devices, need a non-default
2577          * altsetting to have any active endpoints.  some tests change
2578          * altsettings; force a default so most tests don't need to check.
2579          */
2580         if (dev->info->alt >= 0) {
2581                 if (intf->altsetting->desc.bInterfaceNumber) {
2582                         retval = -ENODEV;
2583                         goto free_mutex;
2584                 }
2585                 retval = set_altsetting(dev, dev->info->alt);
2586                 if (retval) {
2587                         dev_err(&intf->dev,
2588                                         "set altsetting to %d failed, %d\n",
2589                                         dev->info->alt, retval);
2590                         goto free_mutex;
2591                 }
2592         }
2593
2594         switch (code) {
2595         case USBTEST_REQUEST_64:
2596                 temp.test_num = param_64->test_num;
2597                 temp.iterations = param_64->iterations;
2598                 temp.length = param_64->length;
2599                 temp.sglen = param_64->sglen;
2600                 temp.vary = param_64->vary;
2601                 param_32 = &temp;
2602                 break;
2603
2604         case USBTEST_REQUEST_32:
2605                 break;
2606
2607         default:
2608                 retval = -EOPNOTSUPP;
2609                 goto free_mutex;
2610         }
2611
2612         ktime_get_ts64(&start);
2613
2614         retval = usbtest_do_ioctl(intf, param_32);
2615         if (retval < 0)
2616                 goto free_mutex;
2617
2618         ktime_get_ts64(&end);
2619
2620         duration = timespec64_sub(end, start);
2621
2622         temp.duration_sec = duration.tv_sec;
2623         temp.duration_usec = duration.tv_nsec/NSEC_PER_USEC;
2624
2625         switch (code) {
2626         case USBTEST_REQUEST_32:
2627                 param_32->duration_sec = temp.duration_sec;
2628                 param_32->duration_usec = temp.duration_usec;
2629                 break;
2630
2631         case USBTEST_REQUEST_64:
2632                 param_64->duration_sec = temp.duration_sec;
2633                 param_64->duration_usec = temp.duration_usec;
2634                 break;
2635         }
2636
2637 free_mutex:
2638         mutex_unlock(&dev->lock);
2639         return retval;
2640 }
2641
2642 /*-------------------------------------------------------------------------*/
2643
2644 static unsigned force_interrupt;
2645 module_param(force_interrupt, uint, 0);
2646 MODULE_PARM_DESC(force_interrupt, "0 = test default; else interrupt");
2647
2648 #ifdef  GENERIC
2649 static unsigned short vendor;
2650 module_param(vendor, ushort, 0);
2651 MODULE_PARM_DESC(vendor, "vendor code (from usb-if)");
2652
2653 static unsigned short product;
2654 module_param(product, ushort, 0);
2655 MODULE_PARM_DESC(product, "product code (from vendor)");
2656 #endif
2657
2658 static int
2659 usbtest_probe(struct usb_interface *intf, const struct usb_device_id *id)
2660 {
2661         struct usb_device       *udev;
2662         struct usbtest_dev      *dev;
2663         struct usbtest_info     *info;
2664         char                    *rtest, *wtest;
2665         char                    *irtest, *iwtest;
2666         char                    *intrtest, *intwtest;
2667
2668         udev = interface_to_usbdev(intf);
2669
2670 #ifdef  GENERIC
2671         /* specify devices by module parameters? */
2672         if (id->match_flags == 0) {
2673                 /* vendor match required, product match optional */
2674                 if (!vendor || le16_to_cpu(udev->descriptor.idVendor) != (u16)vendor)
2675                         return -ENODEV;
2676                 if (product && le16_to_cpu(udev->descriptor.idProduct) != (u16)product)
2677                         return -ENODEV;
2678                 dev_info(&intf->dev, "matched module params, "
2679                                         "vend=0x%04x prod=0x%04x\n",
2680                                 le16_to_cpu(udev->descriptor.idVendor),
2681                                 le16_to_cpu(udev->descriptor.idProduct));
2682         }
2683 #endif
2684
2685         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
2686         if (!dev)
2687                 return -ENOMEM;
2688         info = (struct usbtest_info *) id->driver_info;
2689         dev->info = info;
2690         mutex_init(&dev->lock);
2691
2692         dev->intf = intf;
2693
2694         /* cacheline-aligned scratch for i/o */
2695         dev->buf = kmalloc(TBUF_SIZE, GFP_KERNEL);
2696         if (dev->buf == NULL) {
2697                 kfree(dev);
2698                 return -ENOMEM;
2699         }
2700
2701         /* NOTE this doesn't yet test the handful of difference that are
2702          * visible with high speed interrupts:  bigger maxpacket (1K) and
2703          * "high bandwidth" modes (up to 3 packets/uframe).
2704          */
2705         rtest = wtest = "";
2706         irtest = iwtest = "";
2707         intrtest = intwtest = "";
2708         if (force_interrupt || udev->speed == USB_SPEED_LOW) {
2709                 if (info->ep_in) {
2710                         dev->in_pipe = usb_rcvintpipe(udev, info->ep_in);
2711                         rtest = " intr-in";
2712                 }
2713                 if (info->ep_out) {
2714                         dev->out_pipe = usb_sndintpipe(udev, info->ep_out);
2715                         wtest = " intr-out";
2716                 }
2717         } else {
2718                 if (override_alt >= 0 || info->autoconf) {
2719                         int status;
2720
2721                         status = get_endpoints(dev, intf);
2722                         if (status < 0) {
2723                                 WARNING(dev, "couldn't get endpoints, %d\n",
2724                                                 status);
2725                                 kfree(dev->buf);
2726                                 kfree(dev);
2727                                 return status;
2728                         }
2729                         /* may find bulk or ISO pipes */
2730                 } else {
2731                         if (info->ep_in)
2732                                 dev->in_pipe = usb_rcvbulkpipe(udev,
2733                                                         info->ep_in);
2734                         if (info->ep_out)
2735                                 dev->out_pipe = usb_sndbulkpipe(udev,
2736                                                         info->ep_out);
2737                 }
2738                 if (dev->in_pipe)
2739                         rtest = " bulk-in";
2740                 if (dev->out_pipe)
2741                         wtest = " bulk-out";
2742                 if (dev->in_iso_pipe)
2743                         irtest = " iso-in";
2744                 if (dev->out_iso_pipe)
2745                         iwtest = " iso-out";
2746                 if (dev->in_int_pipe)
2747                         intrtest = " int-in";
2748                 if (dev->out_int_pipe)
2749                         intwtest = " int-out";
2750         }
2751
2752         usb_set_intfdata(intf, dev);
2753         dev_info(&intf->dev, "%s\n", info->name);
2754         dev_info(&intf->dev, "%s {control%s%s%s%s%s%s%s} tests%s\n",
2755                         usb_speed_string(udev->speed),
2756                         info->ctrl_out ? " in/out" : "",
2757                         rtest, wtest,
2758                         irtest, iwtest,
2759                         intrtest, intwtest,
2760                         info->alt >= 0 ? " (+alt)" : "");
2761         return 0;
2762 }
2763
2764 static int usbtest_suspend(struct usb_interface *intf, pm_message_t message)
2765 {
2766         return 0;
2767 }
2768
2769 static int usbtest_resume(struct usb_interface *intf)
2770 {
2771         return 0;
2772 }
2773
2774
2775 static void usbtest_disconnect(struct usb_interface *intf)
2776 {
2777         struct usbtest_dev      *dev = usb_get_intfdata(intf);
2778
2779         usb_set_intfdata(intf, NULL);
2780         dev_dbg(&intf->dev, "disconnect\n");
2781         kfree(dev);
2782 }
2783
2784 /* Basic testing only needs a device that can source or sink bulk traffic.
2785  * Any device can test control transfers (default with GENERIC binding).
2786  *
2787  * Several entries work with the default EP0 implementation that's built
2788  * into EZ-USB chips.  There's a default vendor ID which can be overridden
2789  * by (very) small config EEPROMS, but otherwise all these devices act
2790  * identically until firmware is loaded:  only EP0 works.  It turns out
2791  * to be easy to make other endpoints work, without modifying that EP0
2792  * behavior.  For now, we expect that kind of firmware.
2793  */
2794
2795 /* an21xx or fx versions of ez-usb */
2796 static struct usbtest_info ez1_info = {
2797         .name           = "EZ-USB device",
2798         .ep_in          = 2,
2799         .ep_out         = 2,
2800         .alt            = 1,
2801 };
2802
2803 /* fx2 version of ez-usb */
2804 static struct usbtest_info ez2_info = {
2805         .name           = "FX2 device",
2806         .ep_in          = 6,
2807         .ep_out         = 2,
2808         .alt            = 1,
2809 };
2810
2811 /* ezusb family device with dedicated usb test firmware,
2812  */
2813 static struct usbtest_info fw_info = {
2814         .name           = "usb test device",
2815         .ep_in          = 2,
2816         .ep_out         = 2,
2817         .alt            = 1,
2818         .autoconf       = 1,            /* iso and ctrl_out need autoconf */
2819         .ctrl_out       = 1,
2820         .iso            = 1,            /* iso_ep's are #8 in/out */
2821 };
2822
2823 /* peripheral running Linux and 'zero.c' test firmware, or
2824  * its user-mode cousin. different versions of this use
2825  * different hardware with the same vendor/product codes.
2826  * host side MUST rely on the endpoint descriptors.
2827  */
2828 static struct usbtest_info gz_info = {
2829         .name           = "Linux gadget zero",
2830         .autoconf       = 1,
2831         .ctrl_out       = 1,
2832         .iso            = 1,
2833         .intr           = 1,
2834         .alt            = 0,
2835 };
2836
2837 static struct usbtest_info um_info = {
2838         .name           = "Linux user mode test driver",
2839         .autoconf       = 1,
2840         .alt            = -1,
2841 };
2842
2843 static struct usbtest_info um2_info = {
2844         .name           = "Linux user mode ISO test driver",
2845         .autoconf       = 1,
2846         .iso            = 1,
2847         .alt            = -1,
2848 };
2849
2850 #ifdef IBOT2
2851 /* this is a nice source of high speed bulk data;
2852  * uses an FX2, with firmware provided in the device
2853  */
2854 static struct usbtest_info ibot2_info = {
2855         .name           = "iBOT2 webcam",
2856         .ep_in          = 2,
2857         .alt            = -1,
2858 };
2859 #endif
2860
2861 #ifdef GENERIC
2862 /* we can use any device to test control traffic */
2863 static struct usbtest_info generic_info = {
2864         .name           = "Generic USB device",
2865         .alt            = -1,
2866 };
2867 #endif
2868
2869
2870 static const struct usb_device_id id_table[] = {
2871
2872         /*-------------------------------------------------------------*/
2873
2874         /* EZ-USB devices which download firmware to replace (or in our
2875          * case augment) the default device implementation.
2876          */
2877
2878         /* generic EZ-USB FX controller */
2879         { USB_DEVICE(0x0547, 0x2235),
2880                 .driver_info = (unsigned long) &ez1_info,
2881         },
2882
2883         /* CY3671 development board with EZ-USB FX */
2884         { USB_DEVICE(0x0547, 0x0080),
2885                 .driver_info = (unsigned long) &ez1_info,
2886         },
2887
2888         /* generic EZ-USB FX2 controller (or development board) */
2889         { USB_DEVICE(0x04b4, 0x8613),
2890                 .driver_info = (unsigned long) &ez2_info,
2891         },
2892
2893         /* re-enumerated usb test device firmware */
2894         { USB_DEVICE(0xfff0, 0xfff0),
2895                 .driver_info = (unsigned long) &fw_info,
2896         },
2897
2898         /* "Gadget Zero" firmware runs under Linux */
2899         { USB_DEVICE(0x0525, 0xa4a0),
2900                 .driver_info = (unsigned long) &gz_info,
2901         },
2902
2903         /* so does a user-mode variant */
2904         { USB_DEVICE(0x0525, 0xa4a4),
2905                 .driver_info = (unsigned long) &um_info,
2906         },
2907
2908         /* ... and a user-mode variant that talks iso */
2909         { USB_DEVICE(0x0525, 0xa4a3),
2910                 .driver_info = (unsigned long) &um2_info,
2911         },
2912
2913 #ifdef KEYSPAN_19Qi
2914         /* Keyspan 19qi uses an21xx (original EZ-USB) */
2915         /* this does not coexist with the real Keyspan 19qi driver! */
2916         { USB_DEVICE(0x06cd, 0x010b),
2917                 .driver_info = (unsigned long) &ez1_info,
2918         },
2919 #endif
2920
2921         /*-------------------------------------------------------------*/
2922
2923 #ifdef IBOT2
2924         /* iBOT2 makes a nice source of high speed bulk-in data */
2925         /* this does not coexist with a real iBOT2 driver! */
2926         { USB_DEVICE(0x0b62, 0x0059),
2927                 .driver_info = (unsigned long) &ibot2_info,
2928         },
2929 #endif
2930
2931         /*-------------------------------------------------------------*/
2932
2933 #ifdef GENERIC
2934         /* module params can specify devices to use for control tests */
2935         { .driver_info = (unsigned long) &generic_info, },
2936 #endif
2937
2938         /*-------------------------------------------------------------*/
2939
2940         { }
2941 };
2942 MODULE_DEVICE_TABLE(usb, id_table);
2943
2944 static struct usb_driver usbtest_driver = {
2945         .name =         "usbtest",
2946         .id_table =     id_table,
2947         .probe =        usbtest_probe,
2948         .unlocked_ioctl = usbtest_ioctl,
2949         .disconnect =   usbtest_disconnect,
2950         .suspend =      usbtest_suspend,
2951         .resume =       usbtest_resume,
2952 };
2953
2954 /*-------------------------------------------------------------------------*/
2955
2956 static int __init usbtest_init(void)
2957 {
2958 #ifdef GENERIC
2959         if (vendor)
2960                 pr_debug("params: vend=0x%04x prod=0x%04x\n", vendor, product);
2961 #endif
2962         return usb_register(&usbtest_driver);
2963 }
2964 module_init(usbtest_init);
2965
2966 static void __exit usbtest_exit(void)
2967 {
2968         usb_deregister(&usbtest_driver);
2969 }
2970 module_exit(usbtest_exit);
2971
2972 MODULE_DESCRIPTION("USB Core/HCD Testing Driver");
2973 MODULE_LICENSE("GPL");
2974