xref: /linux/drivers/usb/misc/usbtest.c (revision d39d0ed196aa1685bb24771e92f78633c66ac9cb)
1 #include <linux/kernel.h>
2 #include <linux/errno.h>
3 #include <linux/init.h>
4 #include <linux/slab.h>
5 #include <linux/mm.h>
6 #include <linux/module.h>
7 #include <linux/moduleparam.h>
8 #include <linux/scatterlist.h>
9 #include <linux/mutex.h>
10 
11 #include <linux/usb.h>
12 
13 
14 /*-------------------------------------------------------------------------*/
15 
16 // FIXME make these public somewhere; usbdevfs.h?
17 //
18 struct usbtest_param {
19 	// inputs
20 	unsigned		test_num;	/* 0..(TEST_CASES-1) */
21 	unsigned		iterations;
22 	unsigned		length;
23 	unsigned		vary;
24 	unsigned		sglen;
25 
26 	// outputs
27 	struct timeval		duration;
28 };
29 #define USBTEST_REQUEST	_IOWR('U', 100, struct usbtest_param)
30 
31 /*-------------------------------------------------------------------------*/
32 
33 #define	GENERIC		/* let probe() bind using module params */
34 
35 /* Some devices that can be used for testing will have "real" drivers.
36  * Entries for those need to be enabled here by hand, after disabling
37  * that "real" driver.
38  */
39 //#define	IBOT2		/* grab iBOT2 webcams */
40 //#define	KEYSPAN_19Qi	/* grab un-renumerated serial adapter */
41 
42 /*-------------------------------------------------------------------------*/
43 
44 struct usbtest_info {
45 	const char		*name;
46 	u8			ep_in;		/* bulk/intr source */
47 	u8			ep_out;		/* bulk/intr sink */
48 	unsigned		autoconf : 1;
49 	unsigned		ctrl_out : 1;
50 	unsigned		iso : 1;	/* try iso in/out */
51 	int			alt;
52 };
53 
54 /* this is accessed only through usbfs ioctl calls.
55  * one ioctl to issue a test ... one lock per device.
56  * tests create other threads if they need them.
57  * urbs and buffers are allocated dynamically,
58  * and data generated deterministically.
59  */
60 struct usbtest_dev {
61 	struct usb_interface	*intf;
62 	struct usbtest_info	*info;
63 	int			in_pipe;
64 	int			out_pipe;
65 	int			in_iso_pipe;
66 	int			out_iso_pipe;
67 	struct usb_endpoint_descriptor	*iso_in, *iso_out;
68 	struct mutex		lock;
69 
70 #define TBUF_SIZE	256
71 	u8			*buf;
72 };
73 
74 static struct usb_device *testdev_to_usbdev (struct usbtest_dev *test)
75 {
76 	return interface_to_usbdev (test->intf);
77 }
78 
79 /* set up all urbs so they can be used with either bulk or interrupt */
80 #define	INTERRUPT_RATE		1	/* msec/transfer */
81 
82 #define ERROR(tdev, fmt, args...) \
83 	dev_err(&(tdev)->intf->dev , fmt , ## args)
84 #define WARNING(tdev, fmt, args...) \
85 	dev_warn(&(tdev)->intf->dev , fmt , ## args)
86 
87 /*-------------------------------------------------------------------------*/
88 
89 static int
90 get_endpoints (struct usbtest_dev *dev, struct usb_interface *intf)
91 {
92 	int				tmp;
93 	struct usb_host_interface	*alt;
94 	struct usb_host_endpoint	*in, *out;
95 	struct usb_host_endpoint	*iso_in, *iso_out;
96 	struct usb_device		*udev;
97 
98 	for (tmp = 0; tmp < intf->num_altsetting; tmp++) {
99 		unsigned	ep;
100 
101 		in = out = NULL;
102 		iso_in = iso_out = NULL;
103 		alt = intf->altsetting + tmp;
104 
105 		/* take the first altsetting with in-bulk + out-bulk;
106 		 * ignore other endpoints and altsetttings.
107 		 */
108 		for (ep = 0; ep < alt->desc.bNumEndpoints; ep++) {
109 			struct usb_host_endpoint	*e;
110 
111 			e = alt->endpoint + ep;
112 			switch (e->desc.bmAttributes) {
113 			case USB_ENDPOINT_XFER_BULK:
114 				break;
115 			case USB_ENDPOINT_XFER_ISOC:
116 				if (dev->info->iso)
117 					goto try_iso;
118 				// FALLTHROUGH
119 			default:
120 				continue;
121 			}
122 			if (usb_endpoint_dir_in(&e->desc)) {
123 				if (!in)
124 					in = e;
125 			} else {
126 				if (!out)
127 					out = e;
128 			}
129 			continue;
130 try_iso:
131 			if (usb_endpoint_dir_in(&e->desc)) {
132 				if (!iso_in)
133 					iso_in = e;
134 			} else {
135 				if (!iso_out)
136 					iso_out = e;
137 			}
138 		}
139 		if ((in && out)  ||  iso_in || iso_out)
140 			goto found;
141 	}
142 	return -EINVAL;
143 
144 found:
145 	udev = testdev_to_usbdev (dev);
146 	if (alt->desc.bAlternateSetting != 0) {
147 		tmp = usb_set_interface (udev,
148 				alt->desc.bInterfaceNumber,
149 				alt->desc.bAlternateSetting);
150 		if (tmp < 0)
151 			return tmp;
152 	}
153 
154 	if (in) {
155 		dev->in_pipe = usb_rcvbulkpipe (udev,
156 			in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
157 		dev->out_pipe = usb_sndbulkpipe (udev,
158 			out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
159 	}
160 	if (iso_in) {
161 		dev->iso_in = &iso_in->desc;
162 		dev->in_iso_pipe = usb_rcvisocpipe (udev,
163 				iso_in->desc.bEndpointAddress
164 					& USB_ENDPOINT_NUMBER_MASK);
165 	}
166 
167 	if (iso_out) {
168 		dev->iso_out = &iso_out->desc;
169 		dev->out_iso_pipe = usb_sndisocpipe (udev,
170 				iso_out->desc.bEndpointAddress
171 					& USB_ENDPOINT_NUMBER_MASK);
172 	}
173 	return 0;
174 }
175 
176 /*-------------------------------------------------------------------------*/
177 
178 /* Support for testing basic non-queued I/O streams.
179  *
180  * These just package urbs as requests that can be easily canceled.
181  * Each urb's data buffer is dynamically allocated; callers can fill
182  * them with non-zero test data (or test for it) when appropriate.
183  */
184 
185 static void simple_callback (struct urb *urb)
186 {
187 	complete(urb->context);
188 }
189 
190 static struct urb *simple_alloc_urb (
191 	struct usb_device	*udev,
192 	int			pipe,
193 	unsigned long		bytes
194 )
195 {
196 	struct urb		*urb;
197 
198 	urb = usb_alloc_urb (0, GFP_KERNEL);
199 	if (!urb)
200 		return urb;
201 	usb_fill_bulk_urb (urb, udev, pipe, NULL, bytes, simple_callback, NULL);
202 	urb->interval = (udev->speed == USB_SPEED_HIGH)
203 			? (INTERRUPT_RATE << 3)
204 			: INTERRUPT_RATE;
205 	urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
206 	if (usb_pipein (pipe))
207 		urb->transfer_flags |= URB_SHORT_NOT_OK;
208 	urb->transfer_buffer = usb_alloc_coherent (udev, bytes, GFP_KERNEL,
209 			&urb->transfer_dma);
210 	if (!urb->transfer_buffer) {
211 		usb_free_urb (urb);
212 		urb = NULL;
213 	} else
214 		memset (urb->transfer_buffer, 0, bytes);
215 	return urb;
216 }
217 
218 static unsigned pattern = 0;
219 static unsigned mod_pattern;
220 module_param_named(pattern, mod_pattern, uint, S_IRUGO | S_IWUSR);
221 MODULE_PARM_DESC(mod_pattern, "i/o pattern (0 == zeroes)");
222 
223 static inline void simple_fill_buf (struct urb *urb)
224 {
225 	unsigned	i;
226 	u8		*buf = urb->transfer_buffer;
227 	unsigned	len = urb->transfer_buffer_length;
228 
229 	switch (pattern) {
230 	default:
231 		// FALLTHROUGH
232 	case 0:
233 		memset (buf, 0, len);
234 		break;
235 	case 1:			/* mod63 */
236 		for (i = 0; i < len; i++)
237 			*buf++ = (u8) (i % 63);
238 		break;
239 	}
240 }
241 
242 static inline int simple_check_buf(struct usbtest_dev *tdev, struct urb *urb)
243 {
244 	unsigned	i;
245 	u8		expected;
246 	u8		*buf = urb->transfer_buffer;
247 	unsigned	len = urb->actual_length;
248 
249 	for (i = 0; i < len; i++, buf++) {
250 		switch (pattern) {
251 		/* all-zeroes has no synchronization issues */
252 		case 0:
253 			expected = 0;
254 			break;
255 		/* mod63 stays in sync with short-terminated transfers,
256 		 * or otherwise when host and gadget agree on how large
257 		 * each usb transfer request should be.  resync is done
258 		 * with set_interface or set_config.
259 		 */
260 		case 1:			/* mod63 */
261 			expected = i % 63;
262 			break;
263 		/* always fail unsupported patterns */
264 		default:
265 			expected = !*buf;
266 			break;
267 		}
268 		if (*buf == expected)
269 			continue;
270 		ERROR(tdev, "buf[%d] = %d (not %d)\n", i, *buf, expected);
271 		return -EINVAL;
272 	}
273 	return 0;
274 }
275 
276 static void simple_free_urb (struct urb *urb)
277 {
278 	usb_free_coherent(urb->dev, urb->transfer_buffer_length,
279 			  urb->transfer_buffer, urb->transfer_dma);
280 	usb_free_urb (urb);
281 }
282 
283 static int simple_io (
284 	struct usbtest_dev	*tdev,
285 	struct urb		*urb,
286 	int			iterations,
287 	int			vary,
288 	int			expected,
289 	const char		*label
290 )
291 {
292 	struct usb_device	*udev = urb->dev;
293 	int			max = urb->transfer_buffer_length;
294 	struct completion	completion;
295 	int			retval = 0;
296 
297 	urb->context = &completion;
298 	while (retval == 0 && iterations-- > 0) {
299 		init_completion (&completion);
300 		if (usb_pipeout (urb->pipe))
301 			simple_fill_buf (urb);
302 		if ((retval = usb_submit_urb (urb, GFP_KERNEL)) != 0)
303 			break;
304 
305 		/* NOTE:  no timeouts; can't be broken out of by interrupt */
306 		wait_for_completion (&completion);
307 		retval = urb->status;
308 		urb->dev = udev;
309 		if (retval == 0 && usb_pipein (urb->pipe))
310 			retval = simple_check_buf(tdev, urb);
311 
312 		if (vary) {
313 			int	len = urb->transfer_buffer_length;
314 
315 			len += vary;
316 			len %= max;
317 			if (len == 0)
318 				len = (vary < max) ? vary : max;
319 			urb->transfer_buffer_length = len;
320 		}
321 
322 		/* FIXME if endpoint halted, clear halt (and log) */
323 	}
324 	urb->transfer_buffer_length = max;
325 
326 	if (expected != retval)
327 		dev_err(&udev->dev,
328 			"%s failed, iterations left %d, status %d (not %d)\n",
329 				label, iterations, retval, expected);
330 	return retval;
331 }
332 
333 
334 /*-------------------------------------------------------------------------*/
335 
336 /* We use scatterlist primitives to test queued I/O.
337  * Yes, this also tests the scatterlist primitives.
338  */
339 
340 static void free_sglist (struct scatterlist *sg, int nents)
341 {
342 	unsigned		i;
343 
344 	if (!sg)
345 		return;
346 	for (i = 0; i < nents; i++) {
347 		if (!sg_page(&sg[i]))
348 			continue;
349 		kfree (sg_virt(&sg[i]));
350 	}
351 	kfree (sg);
352 }
353 
354 static struct scatterlist *
355 alloc_sglist (int nents, int max, int vary)
356 {
357 	struct scatterlist	*sg;
358 	unsigned		i;
359 	unsigned		size = max;
360 
361 	sg = kmalloc (nents * sizeof *sg, GFP_KERNEL);
362 	if (!sg)
363 		return NULL;
364 	sg_init_table(sg, nents);
365 
366 	for (i = 0; i < nents; i++) {
367 		char		*buf;
368 		unsigned	j;
369 
370 		buf = kzalloc (size, GFP_KERNEL);
371 		if (!buf) {
372 			free_sglist (sg, i);
373 			return NULL;
374 		}
375 
376 		/* kmalloc pages are always physically contiguous! */
377 		sg_set_buf(&sg[i], buf, size);
378 
379 		switch (pattern) {
380 		case 0:
381 			/* already zeroed */
382 			break;
383 		case 1:
384 			for (j = 0; j < size; j++)
385 				*buf++ = (u8) (j % 63);
386 			break;
387 		}
388 
389 		if (vary) {
390 			size += vary;
391 			size %= max;
392 			if (size == 0)
393 				size = (vary < max) ? vary : max;
394 		}
395 	}
396 
397 	return sg;
398 }
399 
400 static int perform_sglist (
401 	struct usbtest_dev	*tdev,
402 	unsigned		iterations,
403 	int			pipe,
404 	struct usb_sg_request	*req,
405 	struct scatterlist	*sg,
406 	int			nents
407 )
408 {
409 	struct usb_device	*udev = testdev_to_usbdev(tdev);
410 	int			retval = 0;
411 
412 	while (retval == 0 && iterations-- > 0) {
413 		retval = usb_sg_init (req, udev, pipe,
414 				(udev->speed == USB_SPEED_HIGH)
415 					? (INTERRUPT_RATE << 3)
416 					: INTERRUPT_RATE,
417 				sg, nents, 0, GFP_KERNEL);
418 
419 		if (retval)
420 			break;
421 		usb_sg_wait (req);
422 		retval = req->status;
423 
424 		/* FIXME check resulting data pattern */
425 
426 		/* FIXME if endpoint halted, clear halt (and log) */
427 	}
428 
429 	// FIXME for unlink or fault handling tests, don't report
430 	// failure if retval is as we expected ...
431 
432 	if (retval)
433 		ERROR(tdev, "perform_sglist failed, "
434 				"iterations left %d, status %d\n",
435 				iterations, retval);
436 	return retval;
437 }
438 
439 
440 /*-------------------------------------------------------------------------*/
441 
442 /* unqueued control message testing
443  *
444  * there's a nice set of device functional requirements in chapter 9 of the
445  * usb 2.0 spec, which we can apply to ANY device, even ones that don't use
446  * special test firmware.
447  *
448  * we know the device is configured (or suspended) by the time it's visible
449  * through usbfs.  we can't change that, so we won't test enumeration (which
450  * worked 'well enough' to get here, this time), power management (ditto),
451  * or remote wakeup (which needs human interaction).
452  */
453 
454 static unsigned realworld = 1;
455 module_param (realworld, uint, 0);
456 MODULE_PARM_DESC (realworld, "clear to demand stricter spec compliance");
457 
458 static int get_altsetting (struct usbtest_dev *dev)
459 {
460 	struct usb_interface	*iface = dev->intf;
461 	struct usb_device	*udev = interface_to_usbdev (iface);
462 	int			retval;
463 
464 	retval = usb_control_msg (udev, usb_rcvctrlpipe (udev, 0),
465 			USB_REQ_GET_INTERFACE, USB_DIR_IN|USB_RECIP_INTERFACE,
466 			0, iface->altsetting [0].desc.bInterfaceNumber,
467 			dev->buf, 1, USB_CTRL_GET_TIMEOUT);
468 	switch (retval) {
469 	case 1:
470 		return dev->buf [0];
471 	case 0:
472 		retval = -ERANGE;
473 		// FALLTHROUGH
474 	default:
475 		return retval;
476 	}
477 }
478 
479 static int set_altsetting (struct usbtest_dev *dev, int alternate)
480 {
481 	struct usb_interface		*iface = dev->intf;
482 	struct usb_device		*udev;
483 
484 	if (alternate < 0 || alternate >= 256)
485 		return -EINVAL;
486 
487 	udev = interface_to_usbdev (iface);
488 	return usb_set_interface (udev,
489 			iface->altsetting [0].desc.bInterfaceNumber,
490 			alternate);
491 }
492 
493 static int is_good_config(struct usbtest_dev *tdev, int len)
494 {
495 	struct usb_config_descriptor	*config;
496 
497 	if (len < sizeof *config)
498 		return 0;
499 	config = (struct usb_config_descriptor *) tdev->buf;
500 
501 	switch (config->bDescriptorType) {
502 	case USB_DT_CONFIG:
503 	case USB_DT_OTHER_SPEED_CONFIG:
504 		if (config->bLength != 9) {
505 			ERROR(tdev, "bogus config descriptor length\n");
506 			return 0;
507 		}
508 		/* this bit 'must be 1' but often isn't */
509 		if (!realworld && !(config->bmAttributes & 0x80)) {
510 			ERROR(tdev, "high bit of config attributes not set\n");
511 			return 0;
512 		}
513 		if (config->bmAttributes & 0x1f) {	/* reserved == 0 */
514 			ERROR(tdev, "reserved config bits set\n");
515 			return 0;
516 		}
517 		break;
518 	default:
519 		return 0;
520 	}
521 
522 	if (le16_to_cpu(config->wTotalLength) == len)		/* read it all */
523 		return 1;
524 	if (le16_to_cpu(config->wTotalLength) >= TBUF_SIZE)		/* max partial read */
525 		return 1;
526 	ERROR(tdev, "bogus config descriptor read size\n");
527 	return 0;
528 }
529 
530 /* sanity test for standard requests working with usb_control_mesg() and some
531  * of the utility functions which use it.
532  *
533  * this doesn't test how endpoint halts behave or data toggles get set, since
534  * we won't do I/O to bulk/interrupt endpoints here (which is how to change
535  * halt or toggle).  toggle testing is impractical without support from hcds.
536  *
537  * this avoids failing devices linux would normally work with, by not testing
538  * config/altsetting operations for devices that only support their defaults.
539  * such devices rarely support those needless operations.
540  *
541  * NOTE that since this is a sanity test, it's not examining boundary cases
542  * to see if usbcore, hcd, and device all behave right.  such testing would
543  * involve varied read sizes and other operation sequences.
544  */
545 static int ch9_postconfig (struct usbtest_dev *dev)
546 {
547 	struct usb_interface	*iface = dev->intf;
548 	struct usb_device	*udev = interface_to_usbdev (iface);
549 	int			i, alt, retval;
550 
551 	/* [9.2.3] if there's more than one altsetting, we need to be able to
552 	 * set and get each one.  mostly trusts the descriptors from usbcore.
553 	 */
554 	for (i = 0; i < iface->num_altsetting; i++) {
555 
556 		/* 9.2.3 constrains the range here */
557 		alt = iface->altsetting [i].desc.bAlternateSetting;
558 		if (alt < 0 || alt >= iface->num_altsetting) {
559 			dev_err(&iface->dev,
560 					"invalid alt [%d].bAltSetting = %d\n",
561 					i, alt);
562 		}
563 
564 		/* [real world] get/set unimplemented if there's only one */
565 		if (realworld && iface->num_altsetting == 1)
566 			continue;
567 
568 		/* [9.4.10] set_interface */
569 		retval = set_altsetting (dev, alt);
570 		if (retval) {
571 			dev_err(&iface->dev, "can't set_interface = %d, %d\n",
572 					alt, retval);
573 			return retval;
574 		}
575 
576 		/* [9.4.4] get_interface always works */
577 		retval = get_altsetting (dev);
578 		if (retval != alt) {
579 			dev_err(&iface->dev, "get alt should be %d, was %d\n",
580 					alt, retval);
581 			return (retval < 0) ? retval : -EDOM;
582 		}
583 
584 	}
585 
586 	/* [real world] get_config unimplemented if there's only one */
587 	if (!realworld || udev->descriptor.bNumConfigurations != 1) {
588 		int	expected = udev->actconfig->desc.bConfigurationValue;
589 
590 		/* [9.4.2] get_configuration always works
591 		 * ... although some cheap devices (like one TI Hub I've got)
592 		 * won't return config descriptors except before set_config.
593 		 */
594 		retval = usb_control_msg (udev, usb_rcvctrlpipe (udev, 0),
595 				USB_REQ_GET_CONFIGURATION,
596 				USB_DIR_IN | USB_RECIP_DEVICE,
597 				0, 0, dev->buf, 1, USB_CTRL_GET_TIMEOUT);
598 		if (retval != 1 || dev->buf [0] != expected) {
599 			dev_err(&iface->dev, "get config --> %d %d (1 %d)\n",
600 				retval, dev->buf[0], expected);
601 			return (retval < 0) ? retval : -EDOM;
602 		}
603 	}
604 
605 	/* there's always [9.4.3] a device descriptor [9.6.1] */
606 	retval = usb_get_descriptor (udev, USB_DT_DEVICE, 0,
607 			dev->buf, sizeof udev->descriptor);
608 	if (retval != sizeof udev->descriptor) {
609 		dev_err(&iface->dev, "dev descriptor --> %d\n", retval);
610 		return (retval < 0) ? retval : -EDOM;
611 	}
612 
613 	/* there's always [9.4.3] at least one config descriptor [9.6.3] */
614 	for (i = 0; i < udev->descriptor.bNumConfigurations; i++) {
615 		retval = usb_get_descriptor (udev, USB_DT_CONFIG, i,
616 				dev->buf, TBUF_SIZE);
617 		if (!is_good_config(dev, retval)) {
618 			dev_err(&iface->dev,
619 					"config [%d] descriptor --> %d\n",
620 					i, retval);
621 			return (retval < 0) ? retval : -EDOM;
622 		}
623 
624 		// FIXME cross-checking udev->config[i] to make sure usbcore
625 		// parsed it right (etc) would be good testing paranoia
626 	}
627 
628 	/* and sometimes [9.2.6.6] speed dependent descriptors */
629 	if (le16_to_cpu(udev->descriptor.bcdUSB) == 0x0200) {
630 		struct usb_qualifier_descriptor		*d = NULL;
631 
632 		/* device qualifier [9.6.2] */
633 		retval = usb_get_descriptor (udev,
634 				USB_DT_DEVICE_QUALIFIER, 0, dev->buf,
635 				sizeof (struct usb_qualifier_descriptor));
636 		if (retval == -EPIPE) {
637 			if (udev->speed == USB_SPEED_HIGH) {
638 				dev_err(&iface->dev,
639 						"hs dev qualifier --> %d\n",
640 						retval);
641 				return (retval < 0) ? retval : -EDOM;
642 			}
643 			/* usb2.0 but not high-speed capable; fine */
644 		} else if (retval != sizeof (struct usb_qualifier_descriptor)) {
645 			dev_err(&iface->dev, "dev qualifier --> %d\n", retval);
646 			return (retval < 0) ? retval : -EDOM;
647 		} else
648 			d = (struct usb_qualifier_descriptor *) dev->buf;
649 
650 		/* might not have [9.6.2] any other-speed configs [9.6.4] */
651 		if (d) {
652 			unsigned max = d->bNumConfigurations;
653 			for (i = 0; i < max; i++) {
654 				retval = usb_get_descriptor (udev,
655 					USB_DT_OTHER_SPEED_CONFIG, i,
656 					dev->buf, TBUF_SIZE);
657 				if (!is_good_config(dev, retval)) {
658 					dev_err(&iface->dev,
659 						"other speed config --> %d\n",
660 						retval);
661 					return (retval < 0) ? retval : -EDOM;
662 				}
663 			}
664 		}
665 	}
666 	// FIXME fetch strings from at least the device descriptor
667 
668 	/* [9.4.5] get_status always works */
669 	retval = usb_get_status (udev, USB_RECIP_DEVICE, 0, dev->buf);
670 	if (retval != 2) {
671 		dev_err(&iface->dev, "get dev status --> %d\n", retval);
672 		return (retval < 0) ? retval : -EDOM;
673 	}
674 
675 	// FIXME configuration.bmAttributes says if we could try to set/clear
676 	// the device's remote wakeup feature ... if we can, test that here
677 
678 	retval = usb_get_status (udev, USB_RECIP_INTERFACE,
679 			iface->altsetting [0].desc.bInterfaceNumber, dev->buf);
680 	if (retval != 2) {
681 		dev_err(&iface->dev, "get interface status --> %d\n", retval);
682 		return (retval < 0) ? retval : -EDOM;
683 	}
684 	// FIXME get status for each endpoint in the interface
685 
686 	return 0;
687 }
688 
689 /*-------------------------------------------------------------------------*/
690 
691 /* use ch9 requests to test whether:
692  *   (a) queues work for control, keeping N subtests queued and
693  *       active (auto-resubmit) for M loops through the queue.
694  *   (b) protocol stalls (control-only) will autorecover.
695  *       it's not like bulk/intr; no halt clearing.
696  *   (c) short control reads are reported and handled.
697  *   (d) queues are always processed in-order
698  */
699 
700 struct ctrl_ctx {
701 	spinlock_t		lock;
702 	struct usbtest_dev	*dev;
703 	struct completion	complete;
704 	unsigned		count;
705 	unsigned		pending;
706 	int			status;
707 	struct urb		**urb;
708 	struct usbtest_param	*param;
709 	int			last;
710 };
711 
712 #define NUM_SUBCASES	15		/* how many test subcases here? */
713 
714 struct subcase {
715 	struct usb_ctrlrequest	setup;
716 	int			number;
717 	int			expected;
718 };
719 
720 static void ctrl_complete (struct urb *urb)
721 {
722 	struct ctrl_ctx		*ctx = urb->context;
723 	struct usb_ctrlrequest	*reqp;
724 	struct subcase		*subcase;
725 	int			status = urb->status;
726 
727 	reqp = (struct usb_ctrlrequest *)urb->setup_packet;
728 	subcase = container_of (reqp, struct subcase, setup);
729 
730 	spin_lock (&ctx->lock);
731 	ctx->count--;
732 	ctx->pending--;
733 
734 	/* queue must transfer and complete in fifo order, unless
735 	 * usb_unlink_urb() is used to unlink something not at the
736 	 * physical queue head (not tested).
737 	 */
738 	if (subcase->number > 0) {
739 		if ((subcase->number - ctx->last) != 1) {
740 			ERROR(ctx->dev,
741 				"subcase %d completed out of order, last %d\n",
742 				subcase->number, ctx->last);
743 			status = -EDOM;
744 			ctx->last = subcase->number;
745 			goto error;
746 		}
747 	}
748 	ctx->last = subcase->number;
749 
750 	/* succeed or fault in only one way? */
751 	if (status == subcase->expected)
752 		status = 0;
753 
754 	/* async unlink for cleanup? */
755 	else if (status != -ECONNRESET) {
756 
757 		/* some faults are allowed, not required */
758 		if (subcase->expected > 0 && (
759 			  ((status == -subcase->expected	/* happened */
760 			   || status == 0))))			/* didn't */
761 			status = 0;
762 		/* sometimes more than one fault is allowed */
763 		else if (subcase->number == 12 && status == -EPIPE)
764 			status = 0;
765 		else
766 			ERROR(ctx->dev, "subtest %d error, status %d\n",
767 					subcase->number, status);
768 	}
769 
770 	/* unexpected status codes mean errors; ideally, in hardware */
771 	if (status) {
772 error:
773 		if (ctx->status == 0) {
774 			int		i;
775 
776 			ctx->status = status;
777 			ERROR(ctx->dev, "control queue %02x.%02x, err %d, "
778 					"%d left, subcase %d, len %d/%d\n",
779 					reqp->bRequestType, reqp->bRequest,
780 					status, ctx->count, subcase->number,
781 					urb->actual_length,
782 					urb->transfer_buffer_length);
783 
784 			/* FIXME this "unlink everything" exit route should
785 			 * be a separate test case.
786 			 */
787 
788 			/* unlink whatever's still pending */
789 			for (i = 1; i < ctx->param->sglen; i++) {
790 				struct urb	*u = ctx->urb [
791 						(i + subcase->number)
792 						% ctx->param->sglen];
793 
794 				if (u == urb || !u->dev)
795 					continue;
796 				spin_unlock(&ctx->lock);
797 				status = usb_unlink_urb (u);
798 				spin_lock(&ctx->lock);
799 				switch (status) {
800 				case -EINPROGRESS:
801 				case -EBUSY:
802 				case -EIDRM:
803 					continue;
804 				default:
805 					ERROR(ctx->dev, "urb unlink --> %d\n",
806 							status);
807 				}
808 			}
809 			status = ctx->status;
810 		}
811 	}
812 
813 	/* resubmit if we need to, else mark this as done */
814 	if ((status == 0) && (ctx->pending < ctx->count)) {
815 		if ((status = usb_submit_urb (urb, GFP_ATOMIC)) != 0) {
816 			ERROR(ctx->dev,
817 				"can't resubmit ctrl %02x.%02x, err %d\n",
818 				reqp->bRequestType, reqp->bRequest, status);
819 			urb->dev = NULL;
820 		} else
821 			ctx->pending++;
822 	} else
823 		urb->dev = NULL;
824 
825 	/* signal completion when nothing's queued */
826 	if (ctx->pending == 0)
827 		complete (&ctx->complete);
828 	spin_unlock (&ctx->lock);
829 }
830 
831 static int
832 test_ctrl_queue (struct usbtest_dev *dev, struct usbtest_param *param)
833 {
834 	struct usb_device	*udev = testdev_to_usbdev (dev);
835 	struct urb		**urb;
836 	struct ctrl_ctx		context;
837 	int			i;
838 
839 	spin_lock_init (&context.lock);
840 	context.dev = dev;
841 	init_completion (&context.complete);
842 	context.count = param->sglen * param->iterations;
843 	context.pending = 0;
844 	context.status = -ENOMEM;
845 	context.param = param;
846 	context.last = -1;
847 
848 	/* allocate and init the urbs we'll queue.
849 	 * as with bulk/intr sglists, sglen is the queue depth; it also
850 	 * controls which subtests run (more tests than sglen) or rerun.
851 	 */
852 	urb = kcalloc(param->sglen, sizeof(struct urb *), GFP_KERNEL);
853 	if (!urb)
854 		return -ENOMEM;
855 	for (i = 0; i < param->sglen; i++) {
856 		int			pipe = usb_rcvctrlpipe (udev, 0);
857 		unsigned		len;
858 		struct urb		*u;
859 		struct usb_ctrlrequest	req;
860 		struct subcase		*reqp;
861 
862 		/* sign of this variable means:
863 		 *  -: tested code must return this (negative) error code
864 		 *  +: tested code may return this (negative too) error code
865 		 */
866 		int			expected = 0;
867 
868 		/* requests here are mostly expected to succeed on any
869 		 * device, but some are chosen to trigger protocol stalls
870 		 * or short reads.
871 		 */
872 		memset (&req, 0, sizeof req);
873 		req.bRequest = USB_REQ_GET_DESCRIPTOR;
874 		req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
875 
876 		switch (i % NUM_SUBCASES) {
877 		case 0:		// get device descriptor
878 			req.wValue = cpu_to_le16 (USB_DT_DEVICE << 8);
879 			len = sizeof (struct usb_device_descriptor);
880 			break;
881 		case 1:		// get first config descriptor (only)
882 			req.wValue = cpu_to_le16 ((USB_DT_CONFIG << 8) | 0);
883 			len = sizeof (struct usb_config_descriptor);
884 			break;
885 		case 2:		// get altsetting (OFTEN STALLS)
886 			req.bRequest = USB_REQ_GET_INTERFACE;
887 			req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
888 			// index = 0 means first interface
889 			len = 1;
890 			expected = EPIPE;
891 			break;
892 		case 3:		// get interface status
893 			req.bRequest = USB_REQ_GET_STATUS;
894 			req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
895 			// interface 0
896 			len = 2;
897 			break;
898 		case 4:		// get device status
899 			req.bRequest = USB_REQ_GET_STATUS;
900 			req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
901 			len = 2;
902 			break;
903 		case 5:		// get device qualifier (MAY STALL)
904 			req.wValue = cpu_to_le16 (USB_DT_DEVICE_QUALIFIER << 8);
905 			len = sizeof (struct usb_qualifier_descriptor);
906 			if (udev->speed != USB_SPEED_HIGH)
907 				expected = EPIPE;
908 			break;
909 		case 6:		// get first config descriptor, plus interface
910 			req.wValue = cpu_to_le16 ((USB_DT_CONFIG << 8) | 0);
911 			len = sizeof (struct usb_config_descriptor);
912 			len += sizeof (struct usb_interface_descriptor);
913 			break;
914 		case 7:		// get interface descriptor (ALWAYS STALLS)
915 			req.wValue = cpu_to_le16 (USB_DT_INTERFACE << 8);
916 			// interface == 0
917 			len = sizeof (struct usb_interface_descriptor);
918 			expected = -EPIPE;
919 			break;
920 		// NOTE: two consecutive stalls in the queue here.
921 		// that tests fault recovery a bit more aggressively.
922 		case 8:		// clear endpoint halt (MAY STALL)
923 			req.bRequest = USB_REQ_CLEAR_FEATURE;
924 			req.bRequestType = USB_RECIP_ENDPOINT;
925 			// wValue 0 == ep halt
926 			// wIndex 0 == ep0 (shouldn't halt!)
927 			len = 0;
928 			pipe = usb_sndctrlpipe (udev, 0);
929 			expected = EPIPE;
930 			break;
931 		case 9:		// get endpoint status
932 			req.bRequest = USB_REQ_GET_STATUS;
933 			req.bRequestType = USB_DIR_IN|USB_RECIP_ENDPOINT;
934 			// endpoint 0
935 			len = 2;
936 			break;
937 		case 10:	// trigger short read (EREMOTEIO)
938 			req.wValue = cpu_to_le16 ((USB_DT_CONFIG << 8) | 0);
939 			len = 1024;
940 			expected = -EREMOTEIO;
941 			break;
942 		// NOTE: two consecutive _different_ faults in the queue.
943 		case 11:	// get endpoint descriptor (ALWAYS STALLS)
944 			req.wValue = cpu_to_le16 (USB_DT_ENDPOINT << 8);
945 			// endpoint == 0
946 			len = sizeof (struct usb_interface_descriptor);
947 			expected = EPIPE;
948 			break;
949 		// NOTE: sometimes even a third fault in the queue!
950 		case 12:	// get string 0 descriptor (MAY STALL)
951 			req.wValue = cpu_to_le16 (USB_DT_STRING << 8);
952 			// string == 0, for language IDs
953 			len = sizeof (struct usb_interface_descriptor);
954 			// may succeed when > 4 languages
955 			expected = EREMOTEIO;	// or EPIPE, if no strings
956 			break;
957 		case 13:	// short read, resembling case 10
958 			req.wValue = cpu_to_le16 ((USB_DT_CONFIG << 8) | 0);
959 			// last data packet "should" be DATA1, not DATA0
960 			len = 1024 - udev->descriptor.bMaxPacketSize0;
961 			expected = -EREMOTEIO;
962 			break;
963 		case 14:	// short read; try to fill the last packet
964 			req.wValue = cpu_to_le16 ((USB_DT_DEVICE << 8) | 0);
965 			/* device descriptor size == 18 bytes */
966 			len = udev->descriptor.bMaxPacketSize0;
967 			switch (len) {
968 			case 8:		len = 24; break;
969 			case 16:	len = 32; break;
970 			}
971 			expected = -EREMOTEIO;
972 			break;
973 		default:
974 			ERROR(dev, "bogus number of ctrl queue testcases!\n");
975 			context.status = -EINVAL;
976 			goto cleanup;
977 		}
978 		req.wLength = cpu_to_le16 (len);
979 		urb [i] = u = simple_alloc_urb (udev, pipe, len);
980 		if (!u)
981 			goto cleanup;
982 
983 		reqp = kmalloc(sizeof *reqp, GFP_KERNEL);
984 		if (!reqp)
985 			goto cleanup;
986 		reqp->setup = req;
987 		reqp->number = i % NUM_SUBCASES;
988 		reqp->expected = expected;
989 		u->setup_packet = (char *) &reqp->setup;
990 
991 		u->context = &context;
992 		u->complete = ctrl_complete;
993 	}
994 
995 	/* queue the urbs */
996 	context.urb = urb;
997 	spin_lock_irq (&context.lock);
998 	for (i = 0; i < param->sglen; i++) {
999 		context.status = usb_submit_urb (urb [i], GFP_ATOMIC);
1000 		if (context.status != 0) {
1001 			ERROR(dev, "can't submit urb[%d], status %d\n",
1002 					i, context.status);
1003 			context.count = context.pending;
1004 			break;
1005 		}
1006 		context.pending++;
1007 	}
1008 	spin_unlock_irq (&context.lock);
1009 
1010 	/* FIXME  set timer and time out; provide a disconnect hook */
1011 
1012 	/* wait for the last one to complete */
1013 	if (context.pending > 0)
1014 		wait_for_completion (&context.complete);
1015 
1016 cleanup:
1017 	for (i = 0; i < param->sglen; i++) {
1018 		if (!urb [i])
1019 			continue;
1020 		urb [i]->dev = udev;
1021 		kfree(urb[i]->setup_packet);
1022 		simple_free_urb (urb [i]);
1023 	}
1024 	kfree (urb);
1025 	return context.status;
1026 }
1027 #undef NUM_SUBCASES
1028 
1029 
1030 /*-------------------------------------------------------------------------*/
1031 
1032 static void unlink1_callback (struct urb *urb)
1033 {
1034 	int	status = urb->status;
1035 
1036 	// we "know" -EPIPE (stall) never happens
1037 	if (!status)
1038 		status = usb_submit_urb (urb, GFP_ATOMIC);
1039 	if (status) {
1040 		urb->status = status;
1041 		complete(urb->context);
1042 	}
1043 }
1044 
1045 static int unlink1 (struct usbtest_dev *dev, int pipe, int size, int async)
1046 {
1047 	struct urb		*urb;
1048 	struct completion	completion;
1049 	int			retval = 0;
1050 
1051 	init_completion (&completion);
1052 	urb = simple_alloc_urb (testdev_to_usbdev (dev), pipe, size);
1053 	if (!urb)
1054 		return -ENOMEM;
1055 	urb->context = &completion;
1056 	urb->complete = unlink1_callback;
1057 
1058 	/* keep the endpoint busy.  there are lots of hc/hcd-internal
1059 	 * states, and testing should get to all of them over time.
1060 	 *
1061 	 * FIXME want additional tests for when endpoint is STALLing
1062 	 * due to errors, or is just NAKing requests.
1063 	 */
1064 	if ((retval = usb_submit_urb (urb, GFP_KERNEL)) != 0) {
1065 		dev_err(&dev->intf->dev, "submit fail %d\n", retval);
1066 		return retval;
1067 	}
1068 
1069 	/* unlinking that should always work.  variable delay tests more
1070 	 * hcd states and code paths, even with little other system load.
1071 	 */
1072 	msleep (jiffies % (2 * INTERRUPT_RATE));
1073 	if (async) {
1074 		while (!completion_done(&completion)) {
1075 			retval = usb_unlink_urb(urb);
1076 
1077 			switch (retval) {
1078 			case -EBUSY:
1079 			case -EIDRM:
1080 				/* we can't unlink urbs while they're completing
1081 				 * or if they've completed, and we haven't
1082 				 * resubmitted. "normal" drivers would prevent
1083 				 * resubmission, but since we're testing unlink
1084 				 * paths, we can't.
1085 				 */
1086 				ERROR(dev, "unlink retry\n");
1087 				continue;
1088 			case 0:
1089 			case -EINPROGRESS:
1090 				break;
1091 
1092 			default:
1093 				dev_err(&dev->intf->dev,
1094 					"unlink fail %d\n", retval);
1095 				return retval;
1096 			}
1097 
1098 			break;
1099 		}
1100 	} else
1101 		usb_kill_urb (urb);
1102 
1103 	wait_for_completion (&completion);
1104 	retval = urb->status;
1105 	simple_free_urb (urb);
1106 
1107 	if (async)
1108 		return (retval == -ECONNRESET) ? 0 : retval - 1000;
1109 	else
1110 		return (retval == -ENOENT || retval == -EPERM) ?
1111 				0 : retval - 2000;
1112 }
1113 
1114 static int unlink_simple (struct usbtest_dev *dev, int pipe, int len)
1115 {
1116 	int			retval = 0;
1117 
1118 	/* test sync and async paths */
1119 	retval = unlink1 (dev, pipe, len, 1);
1120 	if (!retval)
1121 		retval = unlink1 (dev, pipe, len, 0);
1122 	return retval;
1123 }
1124 
1125 /*-------------------------------------------------------------------------*/
1126 
1127 static int verify_not_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
1128 {
1129 	int	retval;
1130 	u16	status;
1131 
1132 	/* shouldn't look or act halted */
1133 	retval = usb_get_status (urb->dev, USB_RECIP_ENDPOINT, ep, &status);
1134 	if (retval < 0) {
1135 		ERROR(tdev, "ep %02x couldn't get no-halt status, %d\n",
1136 				ep, retval);
1137 		return retval;
1138 	}
1139 	if (status != 0) {
1140 		ERROR(tdev, "ep %02x bogus status: %04x != 0\n", ep, status);
1141 		return -EINVAL;
1142 	}
1143 	retval = simple_io(tdev, urb, 1, 0, 0, __func__);
1144 	if (retval != 0)
1145 		return -EINVAL;
1146 	return 0;
1147 }
1148 
1149 static int verify_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
1150 {
1151 	int	retval;
1152 	u16	status;
1153 
1154 	/* should look and act halted */
1155 	retval = usb_get_status (urb->dev, USB_RECIP_ENDPOINT, ep, &status);
1156 	if (retval < 0) {
1157 		ERROR(tdev, "ep %02x couldn't get halt status, %d\n",
1158 				ep, retval);
1159 		return retval;
1160 	}
1161 	le16_to_cpus(&status);
1162 	if (status != 1) {
1163 		ERROR(tdev, "ep %02x bogus status: %04x != 1\n", ep, status);
1164 		return -EINVAL;
1165 	}
1166 	retval = simple_io(tdev, urb, 1, 0, -EPIPE, __func__);
1167 	if (retval != -EPIPE)
1168 		return -EINVAL;
1169 	retval = simple_io(tdev, urb, 1, 0, -EPIPE, "verify_still_halted");
1170 	if (retval != -EPIPE)
1171 		return -EINVAL;
1172 	return 0;
1173 }
1174 
1175 static int test_halt(struct usbtest_dev *tdev, int ep, struct urb *urb)
1176 {
1177 	int	retval;
1178 
1179 	/* shouldn't look or act halted now */
1180 	retval = verify_not_halted(tdev, ep, urb);
1181 	if (retval < 0)
1182 		return retval;
1183 
1184 	/* set halt (protocol test only), verify it worked */
1185 	retval = usb_control_msg (urb->dev, usb_sndctrlpipe (urb->dev, 0),
1186 			USB_REQ_SET_FEATURE, USB_RECIP_ENDPOINT,
1187 			USB_ENDPOINT_HALT, ep,
1188 			NULL, 0, USB_CTRL_SET_TIMEOUT);
1189 	if (retval < 0) {
1190 		ERROR(tdev, "ep %02x couldn't set halt, %d\n", ep, retval);
1191 		return retval;
1192 	}
1193 	retval = verify_halted(tdev, ep, urb);
1194 	if (retval < 0)
1195 		return retval;
1196 
1197 	/* clear halt (tests API + protocol), verify it worked */
1198 	retval = usb_clear_halt (urb->dev, urb->pipe);
1199 	if (retval < 0) {
1200 		ERROR(tdev, "ep %02x couldn't clear halt, %d\n", ep, retval);
1201 		return retval;
1202 	}
1203 	retval = verify_not_halted(tdev, ep, urb);
1204 	if (retval < 0)
1205 		return retval;
1206 
1207 	/* NOTE:  could also verify SET_INTERFACE clear halts ... */
1208 
1209 	return 0;
1210 }
1211 
1212 static int halt_simple (struct usbtest_dev *dev)
1213 {
1214 	int		ep;
1215 	int		retval = 0;
1216 	struct urb	*urb;
1217 
1218 	urb = simple_alloc_urb (testdev_to_usbdev (dev), 0, 512);
1219 	if (urb == NULL)
1220 		return -ENOMEM;
1221 
1222 	if (dev->in_pipe) {
1223 		ep = usb_pipeendpoint (dev->in_pipe) | USB_DIR_IN;
1224 		urb->pipe = dev->in_pipe;
1225 		retval = test_halt(dev, ep, urb);
1226 		if (retval < 0)
1227 			goto done;
1228 	}
1229 
1230 	if (dev->out_pipe) {
1231 		ep = usb_pipeendpoint (dev->out_pipe);
1232 		urb->pipe = dev->out_pipe;
1233 		retval = test_halt(dev, ep, urb);
1234 	}
1235 done:
1236 	simple_free_urb (urb);
1237 	return retval;
1238 }
1239 
1240 /*-------------------------------------------------------------------------*/
1241 
1242 /* Control OUT tests use the vendor control requests from Intel's
1243  * USB 2.0 compliance test device:  write a buffer, read it back.
1244  *
1245  * Intel's spec only _requires_ that it work for one packet, which
1246  * is pretty weak.   Some HCDs place limits here; most devices will
1247  * need to be able to handle more than one OUT data packet.  We'll
1248  * try whatever we're told to try.
1249  */
1250 static int ctrl_out (struct usbtest_dev *dev,
1251 		unsigned count, unsigned length, unsigned vary)
1252 {
1253 	unsigned		i, j, len;
1254 	int			retval;
1255 	u8			*buf;
1256 	char			*what = "?";
1257 	struct usb_device	*udev;
1258 
1259 	if (length < 1 || length > 0xffff || vary >= length)
1260 		return -EINVAL;
1261 
1262 	buf = kmalloc(length, GFP_KERNEL);
1263 	if (!buf)
1264 		return -ENOMEM;
1265 
1266 	udev = testdev_to_usbdev (dev);
1267 	len = length;
1268 	retval = 0;
1269 
1270 	/* NOTE:  hardware might well act differently if we pushed it
1271 	 * with lots back-to-back queued requests.
1272 	 */
1273 	for (i = 0; i < count; i++) {
1274 		/* write patterned data */
1275 		for (j = 0; j < len; j++)
1276 			buf [j] = i + j;
1277 		retval = usb_control_msg (udev, usb_sndctrlpipe (udev,0),
1278 				0x5b, USB_DIR_OUT|USB_TYPE_VENDOR,
1279 				0, 0, buf, len, USB_CTRL_SET_TIMEOUT);
1280 		if (retval != len) {
1281 			what = "write";
1282 			if (retval >= 0) {
1283 				ERROR(dev, "ctrl_out, wlen %d (expected %d)\n",
1284 						retval, len);
1285 				retval = -EBADMSG;
1286 			}
1287 			break;
1288 		}
1289 
1290 		/* read it back -- assuming nothing intervened!!  */
1291 		retval = usb_control_msg (udev, usb_rcvctrlpipe (udev,0),
1292 				0x5c, USB_DIR_IN|USB_TYPE_VENDOR,
1293 				0, 0, buf, len, USB_CTRL_GET_TIMEOUT);
1294 		if (retval != len) {
1295 			what = "read";
1296 			if (retval >= 0) {
1297 				ERROR(dev, "ctrl_out, rlen %d (expected %d)\n",
1298 						retval, len);
1299 				retval = -EBADMSG;
1300 			}
1301 			break;
1302 		}
1303 
1304 		/* fail if we can't verify */
1305 		for (j = 0; j < len; j++) {
1306 			if (buf [j] != (u8) (i + j)) {
1307 				ERROR(dev, "ctrl_out, byte %d is %d not %d\n",
1308 					j, buf [j], (u8) i + j);
1309 				retval = -EBADMSG;
1310 				break;
1311 			}
1312 		}
1313 		if (retval < 0) {
1314 			what = "verify";
1315 			break;
1316 		}
1317 
1318 		len += vary;
1319 
1320 		/* [real world] the "zero bytes IN" case isn't really used.
1321 		 * hardware can easily trip up in this weird case, since its
1322 		 * status stage is IN, not OUT like other ep0in transfers.
1323 		 */
1324 		if (len > length)
1325 			len = realworld ? 1 : 0;
1326 	}
1327 
1328 	if (retval < 0)
1329 		ERROR (dev, "ctrl_out %s failed, code %d, count %d\n",
1330 			what, retval, i);
1331 
1332 	kfree (buf);
1333 	return retval;
1334 }
1335 
1336 /*-------------------------------------------------------------------------*/
1337 
1338 /* ISO tests ... mimics common usage
1339  *  - buffer length is split into N packets (mostly maxpacket sized)
1340  *  - multi-buffers according to sglen
1341  */
1342 
1343 struct iso_context {
1344 	unsigned		count;
1345 	unsigned		pending;
1346 	spinlock_t		lock;
1347 	struct completion	done;
1348 	int			submit_error;
1349 	unsigned long		errors;
1350 	unsigned long		packet_count;
1351 	struct usbtest_dev	*dev;
1352 };
1353 
1354 static void iso_callback (struct urb *urb)
1355 {
1356 	struct iso_context	*ctx = urb->context;
1357 
1358 	spin_lock(&ctx->lock);
1359 	ctx->count--;
1360 
1361 	ctx->packet_count += urb->number_of_packets;
1362 	if (urb->error_count > 0)
1363 		ctx->errors += urb->error_count;
1364 	else if (urb->status != 0)
1365 		ctx->errors += urb->number_of_packets;
1366 
1367 	if (urb->status == 0 && ctx->count > (ctx->pending - 1)
1368 			&& !ctx->submit_error) {
1369 		int status = usb_submit_urb (urb, GFP_ATOMIC);
1370 		switch (status) {
1371 		case 0:
1372 			goto done;
1373 		default:
1374 			dev_err(&ctx->dev->intf->dev,
1375 					"iso resubmit err %d\n",
1376 					status);
1377 			/* FALLTHROUGH */
1378 		case -ENODEV:			/* disconnected */
1379 		case -ESHUTDOWN:		/* endpoint disabled */
1380 			ctx->submit_error = 1;
1381 			break;
1382 		}
1383 	}
1384 
1385 	ctx->pending--;
1386 	if (ctx->pending == 0) {
1387 		if (ctx->errors)
1388 			dev_err(&ctx->dev->intf->dev,
1389 				"iso test, %lu errors out of %lu\n",
1390 				ctx->errors, ctx->packet_count);
1391 		complete (&ctx->done);
1392 	}
1393 done:
1394 	spin_unlock(&ctx->lock);
1395 }
1396 
1397 static struct urb *iso_alloc_urb (
1398 	struct usb_device	*udev,
1399 	int			pipe,
1400 	struct usb_endpoint_descriptor	*desc,
1401 	long			bytes
1402 )
1403 {
1404 	struct urb		*urb;
1405 	unsigned		i, maxp, packets;
1406 
1407 	if (bytes < 0 || !desc)
1408 		return NULL;
1409 	maxp = 0x7ff & le16_to_cpu(desc->wMaxPacketSize);
1410 	maxp *= 1 + (0x3 & (le16_to_cpu(desc->wMaxPacketSize) >> 11));
1411 	packets = DIV_ROUND_UP(bytes, maxp);
1412 
1413 	urb = usb_alloc_urb (packets, GFP_KERNEL);
1414 	if (!urb)
1415 		return urb;
1416 	urb->dev = udev;
1417 	urb->pipe = pipe;
1418 
1419 	urb->number_of_packets = packets;
1420 	urb->transfer_buffer_length = bytes;
1421 	urb->transfer_buffer = usb_alloc_coherent (udev, bytes, GFP_KERNEL,
1422 			&urb->transfer_dma);
1423 	if (!urb->transfer_buffer) {
1424 		usb_free_urb (urb);
1425 		return NULL;
1426 	}
1427 	memset (urb->transfer_buffer, 0, bytes);
1428 	for (i = 0; i < packets; i++) {
1429 		/* here, only the last packet will be short */
1430 		urb->iso_frame_desc[i].length = min ((unsigned) bytes, maxp);
1431 		bytes -= urb->iso_frame_desc[i].length;
1432 
1433 		urb->iso_frame_desc[i].offset = maxp * i;
1434 	}
1435 
1436 	urb->complete = iso_callback;
1437 	// urb->context = SET BY CALLER
1438 	urb->interval = 1 << (desc->bInterval - 1);
1439 	urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
1440 	return urb;
1441 }
1442 
1443 static int
1444 test_iso_queue (struct usbtest_dev *dev, struct usbtest_param *param,
1445 		int pipe, struct usb_endpoint_descriptor *desc)
1446 {
1447 	struct iso_context	context;
1448 	struct usb_device	*udev;
1449 	unsigned		i;
1450 	unsigned long		packets = 0;
1451 	int			status = 0;
1452 	struct urb		*urbs[10];	/* FIXME no limit */
1453 
1454 	if (param->sglen > 10)
1455 		return -EDOM;
1456 
1457 	memset(&context, 0, sizeof context);
1458 	context.count = param->iterations * param->sglen;
1459 	context.dev = dev;
1460 	init_completion (&context.done);
1461 	spin_lock_init (&context.lock);
1462 
1463 	memset (urbs, 0, sizeof urbs);
1464 	udev = testdev_to_usbdev (dev);
1465 	dev_info(&dev->intf->dev,
1466 		"... iso period %d %sframes, wMaxPacket %04x\n",
1467 		1 << (desc->bInterval - 1),
1468 		(udev->speed == USB_SPEED_HIGH) ? "micro" : "",
1469 		le16_to_cpu(desc->wMaxPacketSize));
1470 
1471 	for (i = 0; i < param->sglen; i++) {
1472 		urbs [i] = iso_alloc_urb (udev, pipe, desc,
1473 				param->length);
1474 		if (!urbs [i]) {
1475 			status = -ENOMEM;
1476 			goto fail;
1477 		}
1478 		packets += urbs[i]->number_of_packets;
1479 		urbs [i]->context = &context;
1480 	}
1481 	packets *= param->iterations;
1482 	dev_info(&dev->intf->dev,
1483 		"... total %lu msec (%lu packets)\n",
1484 		(packets * (1 << (desc->bInterval - 1)))
1485 			/ ((udev->speed == USB_SPEED_HIGH) ? 8 : 1),
1486 		packets);
1487 
1488 	spin_lock_irq (&context.lock);
1489 	for (i = 0; i < param->sglen; i++) {
1490 		++context.pending;
1491 		status = usb_submit_urb (urbs [i], GFP_ATOMIC);
1492 		if (status < 0) {
1493 			ERROR (dev, "submit iso[%d], error %d\n", i, status);
1494 			if (i == 0) {
1495 				spin_unlock_irq (&context.lock);
1496 				goto fail;
1497 			}
1498 
1499 			simple_free_urb (urbs [i]);
1500 			urbs[i] = NULL;
1501 			context.pending--;
1502 			context.submit_error = 1;
1503 			break;
1504 		}
1505 	}
1506 	spin_unlock_irq (&context.lock);
1507 
1508 	wait_for_completion (&context.done);
1509 
1510 	for (i = 0; i < param->sglen; i++) {
1511 		if (urbs[i])
1512 			simple_free_urb(urbs[i]);
1513 	}
1514 	/*
1515 	 * Isochronous transfers are expected to fail sometimes.  As an
1516 	 * arbitrary limit, we will report an error if any submissions
1517 	 * fail or if the transfer failure rate is > 10%.
1518 	 */
1519 	if (status != 0)
1520 		;
1521 	else if (context.submit_error)
1522 		status = -EACCES;
1523 	else if (context.errors > context.packet_count / 10)
1524 		status = -EIO;
1525 	return status;
1526 
1527 fail:
1528 	for (i = 0; i < param->sglen; i++) {
1529 		if (urbs [i])
1530 			simple_free_urb (urbs [i]);
1531 	}
1532 	return status;
1533 }
1534 
1535 /*-------------------------------------------------------------------------*/
1536 
1537 /* We only have this one interface to user space, through usbfs.
1538  * User mode code can scan usbfs to find N different devices (maybe on
1539  * different busses) to use when testing, and allocate one thread per
1540  * test.  So discovery is simplified, and we have no device naming issues.
1541  *
1542  * Don't use these only as stress/load tests.  Use them along with with
1543  * other USB bus activity:  plugging, unplugging, mousing, mp3 playback,
1544  * video capture, and so on.  Run different tests at different times, in
1545  * different sequences.  Nothing here should interact with other devices,
1546  * except indirectly by consuming USB bandwidth and CPU resources for test
1547  * threads and request completion.  But the only way to know that for sure
1548  * is to test when HC queues are in use by many devices.
1549  *
1550  * WARNING:  Because usbfs grabs udev->dev.sem before calling this ioctl(),
1551  * it locks out usbcore in certain code paths.  Notably, if you disconnect
1552  * the device-under-test, khubd will wait block forever waiting for the
1553  * ioctl to complete ... so that usb_disconnect() can abort the pending
1554  * urbs and then call usbtest_disconnect().  To abort a test, you're best
1555  * off just killing the userspace task and waiting for it to exit.
1556  */
1557 
1558 /* No BKL needed */
1559 static int
1560 usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
1561 {
1562 	struct usbtest_dev	*dev = usb_get_intfdata (intf);
1563 	struct usb_device	*udev = testdev_to_usbdev (dev);
1564 	struct usbtest_param	*param = buf;
1565 	int			retval = -EOPNOTSUPP;
1566 	struct urb		*urb;
1567 	struct scatterlist	*sg;
1568 	struct usb_sg_request	req;
1569 	struct timeval		start;
1570 	unsigned		i;
1571 
1572 	// FIXME USBDEVFS_CONNECTINFO doesn't say how fast the device is.
1573 
1574 	pattern = mod_pattern;
1575 
1576 	if (code != USBTEST_REQUEST)
1577 		return -EOPNOTSUPP;
1578 
1579 	if (param->iterations <= 0)
1580 		return -EINVAL;
1581 
1582 	if (mutex_lock_interruptible(&dev->lock))
1583 		return -ERESTARTSYS;
1584 
1585 	/* FIXME: What if a system sleep starts while a test is running? */
1586 
1587 	/* some devices, like ez-usb default devices, need a non-default
1588 	 * altsetting to have any active endpoints.  some tests change
1589 	 * altsettings; force a default so most tests don't need to check.
1590 	 */
1591 	if (dev->info->alt >= 0) {
1592 		int	res;
1593 
1594 		if (intf->altsetting->desc.bInterfaceNumber) {
1595 			mutex_unlock(&dev->lock);
1596 			return -ENODEV;
1597 		}
1598 		res = set_altsetting (dev, dev->info->alt);
1599 		if (res) {
1600 			dev_err (&intf->dev,
1601 					"set altsetting to %d failed, %d\n",
1602 					dev->info->alt, res);
1603 			mutex_unlock(&dev->lock);
1604 			return res;
1605 		}
1606 	}
1607 
1608 	/*
1609 	 * Just a bunch of test cases that every HCD is expected to handle.
1610 	 *
1611 	 * Some may need specific firmware, though it'd be good to have
1612 	 * one firmware image to handle all the test cases.
1613 	 *
1614 	 * FIXME add more tests!  cancel requests, verify the data, control
1615 	 * queueing, concurrent read+write threads, and so on.
1616 	 */
1617 	do_gettimeofday (&start);
1618 	switch (param->test_num) {
1619 
1620 	case 0:
1621 		dev_info(&intf->dev, "TEST 0:  NOP\n");
1622 		retval = 0;
1623 		break;
1624 
1625 	/* Simple non-queued bulk I/O tests */
1626 	case 1:
1627 		if (dev->out_pipe == 0)
1628 			break;
1629 		dev_info(&intf->dev,
1630 				"TEST 1:  write %d bytes %u times\n",
1631 				param->length, param->iterations);
1632 		urb = simple_alloc_urb (udev, dev->out_pipe, param->length);
1633 		if (!urb) {
1634 			retval = -ENOMEM;
1635 			break;
1636 		}
1637 		// FIRMWARE:  bulk sink (maybe accepts short writes)
1638 		retval = simple_io(dev, urb, param->iterations, 0, 0, "test1");
1639 		simple_free_urb (urb);
1640 		break;
1641 	case 2:
1642 		if (dev->in_pipe == 0)
1643 			break;
1644 		dev_info(&intf->dev,
1645 				"TEST 2:  read %d bytes %u times\n",
1646 				param->length, param->iterations);
1647 		urb = simple_alloc_urb (udev, dev->in_pipe, param->length);
1648 		if (!urb) {
1649 			retval = -ENOMEM;
1650 			break;
1651 		}
1652 		// FIRMWARE:  bulk source (maybe generates short writes)
1653 		retval = simple_io(dev, urb, param->iterations, 0, 0, "test2");
1654 		simple_free_urb (urb);
1655 		break;
1656 	case 3:
1657 		if (dev->out_pipe == 0 || param->vary == 0)
1658 			break;
1659 		dev_info(&intf->dev,
1660 				"TEST 3:  write/%d 0..%d bytes %u times\n",
1661 				param->vary, param->length, param->iterations);
1662 		urb = simple_alloc_urb (udev, dev->out_pipe, param->length);
1663 		if (!urb) {
1664 			retval = -ENOMEM;
1665 			break;
1666 		}
1667 		// FIRMWARE:  bulk sink (maybe accepts short writes)
1668 		retval = simple_io(dev, urb, param->iterations, param->vary,
1669 					0, "test3");
1670 		simple_free_urb (urb);
1671 		break;
1672 	case 4:
1673 		if (dev->in_pipe == 0 || param->vary == 0)
1674 			break;
1675 		dev_info(&intf->dev,
1676 				"TEST 4:  read/%d 0..%d bytes %u times\n",
1677 				param->vary, param->length, param->iterations);
1678 		urb = simple_alloc_urb (udev, dev->in_pipe, param->length);
1679 		if (!urb) {
1680 			retval = -ENOMEM;
1681 			break;
1682 		}
1683 		// FIRMWARE:  bulk source (maybe generates short writes)
1684 		retval = simple_io(dev, urb, param->iterations, param->vary,
1685 					0, "test4");
1686 		simple_free_urb (urb);
1687 		break;
1688 
1689 	/* Queued bulk I/O tests */
1690 	case 5:
1691 		if (dev->out_pipe == 0 || param->sglen == 0)
1692 			break;
1693 		dev_info(&intf->dev,
1694 			"TEST 5:  write %d sglists %d entries of %d bytes\n",
1695 				param->iterations,
1696 				param->sglen, param->length);
1697 		sg = alloc_sglist (param->sglen, param->length, 0);
1698 		if (!sg) {
1699 			retval = -ENOMEM;
1700 			break;
1701 		}
1702 		// FIRMWARE:  bulk sink (maybe accepts short writes)
1703 		retval = perform_sglist(dev, param->iterations, dev->out_pipe,
1704 				&req, sg, param->sglen);
1705 		free_sglist (sg, param->sglen);
1706 		break;
1707 
1708 	case 6:
1709 		if (dev->in_pipe == 0 || param->sglen == 0)
1710 			break;
1711 		dev_info(&intf->dev,
1712 			"TEST 6:  read %d sglists %d entries of %d bytes\n",
1713 				param->iterations,
1714 				param->sglen, param->length);
1715 		sg = alloc_sglist (param->sglen, param->length, 0);
1716 		if (!sg) {
1717 			retval = -ENOMEM;
1718 			break;
1719 		}
1720 		// FIRMWARE:  bulk source (maybe generates short writes)
1721 		retval = perform_sglist(dev, param->iterations, dev->in_pipe,
1722 				&req, sg, param->sglen);
1723 		free_sglist (sg, param->sglen);
1724 		break;
1725 	case 7:
1726 		if (dev->out_pipe == 0 || param->sglen == 0 || param->vary == 0)
1727 			break;
1728 		dev_info(&intf->dev,
1729 			"TEST 7:  write/%d %d sglists %d entries 0..%d bytes\n",
1730 				param->vary, param->iterations,
1731 				param->sglen, param->length);
1732 		sg = alloc_sglist (param->sglen, param->length, param->vary);
1733 		if (!sg) {
1734 			retval = -ENOMEM;
1735 			break;
1736 		}
1737 		// FIRMWARE:  bulk sink (maybe accepts short writes)
1738 		retval = perform_sglist(dev, param->iterations, dev->out_pipe,
1739 				&req, sg, param->sglen);
1740 		free_sglist (sg, param->sglen);
1741 		break;
1742 	case 8:
1743 		if (dev->in_pipe == 0 || param->sglen == 0 || param->vary == 0)
1744 			break;
1745 		dev_info(&intf->dev,
1746 			"TEST 8:  read/%d %d sglists %d entries 0..%d bytes\n",
1747 				param->vary, param->iterations,
1748 				param->sglen, param->length);
1749 		sg = alloc_sglist (param->sglen, param->length, param->vary);
1750 		if (!sg) {
1751 			retval = -ENOMEM;
1752 			break;
1753 		}
1754 		// FIRMWARE:  bulk source (maybe generates short writes)
1755 		retval = perform_sglist(dev, param->iterations, dev->in_pipe,
1756 				&req, sg, param->sglen);
1757 		free_sglist (sg, param->sglen);
1758 		break;
1759 
1760 	/* non-queued sanity tests for control (chapter 9 subset) */
1761 	case 9:
1762 		retval = 0;
1763 		dev_info(&intf->dev,
1764 			"TEST 9:  ch9 (subset) control tests, %d times\n",
1765 				param->iterations);
1766 		for (i = param->iterations; retval == 0 && i--; /* NOP */)
1767 			retval = ch9_postconfig (dev);
1768 		if (retval)
1769 			dev_err(&intf->dev, "ch9 subset failed, "
1770 					"iterations left %d\n", i);
1771 		break;
1772 
1773 	/* queued control messaging */
1774 	case 10:
1775 		if (param->sglen == 0)
1776 			break;
1777 		retval = 0;
1778 		dev_info(&intf->dev,
1779 				"TEST 10:  queue %d control calls, %d times\n",
1780 				param->sglen,
1781 				param->iterations);
1782 		retval = test_ctrl_queue (dev, param);
1783 		break;
1784 
1785 	/* simple non-queued unlinks (ring with one urb) */
1786 	case 11:
1787 		if (dev->in_pipe == 0 || !param->length)
1788 			break;
1789 		retval = 0;
1790 		dev_info(&intf->dev, "TEST 11:  unlink %d reads of %d\n",
1791 				param->iterations, param->length);
1792 		for (i = param->iterations; retval == 0 && i--; /* NOP */)
1793 			retval = unlink_simple (dev, dev->in_pipe,
1794 						param->length);
1795 		if (retval)
1796 			dev_err(&intf->dev, "unlink reads failed %d, "
1797 				"iterations left %d\n", retval, i);
1798 		break;
1799 	case 12:
1800 		if (dev->out_pipe == 0 || !param->length)
1801 			break;
1802 		retval = 0;
1803 		dev_info(&intf->dev, "TEST 12:  unlink %d writes of %d\n",
1804 				param->iterations, param->length);
1805 		for (i = param->iterations; retval == 0 && i--; /* NOP */)
1806 			retval = unlink_simple (dev, dev->out_pipe,
1807 						param->length);
1808 		if (retval)
1809 			dev_err(&intf->dev, "unlink writes failed %d, "
1810 				"iterations left %d\n", retval, i);
1811 		break;
1812 
1813 	/* ep halt tests */
1814 	case 13:
1815 		if (dev->out_pipe == 0 && dev->in_pipe == 0)
1816 			break;
1817 		retval = 0;
1818 		dev_info(&intf->dev, "TEST 13:  set/clear %d halts\n",
1819 				param->iterations);
1820 		for (i = param->iterations; retval == 0 && i--; /* NOP */)
1821 			retval = halt_simple (dev);
1822 
1823 		if (retval)
1824 			ERROR(dev, "halts failed, iterations left %d\n", i);
1825 		break;
1826 
1827 	/* control write tests */
1828 	case 14:
1829 		if (!dev->info->ctrl_out)
1830 			break;
1831 		dev_info(&intf->dev, "TEST 14:  %d ep0out, %d..%d vary %d\n",
1832 				param->iterations,
1833 				realworld ? 1 : 0, param->length,
1834 				param->vary);
1835 		retval = ctrl_out(dev, param->iterations,
1836 				param->length, param->vary);
1837 		break;
1838 
1839 	/* iso write tests */
1840 	case 15:
1841 		if (dev->out_iso_pipe == 0 || param->sglen == 0)
1842 			break;
1843 		dev_info(&intf->dev,
1844 			"TEST 15:  write %d iso, %d entries of %d bytes\n",
1845 				param->iterations,
1846 				param->sglen, param->length);
1847 		// FIRMWARE:  iso sink
1848 		retval = test_iso_queue (dev, param,
1849 				dev->out_iso_pipe, dev->iso_out);
1850 		break;
1851 
1852 	/* iso read tests */
1853 	case 16:
1854 		if (dev->in_iso_pipe == 0 || param->sglen == 0)
1855 			break;
1856 		dev_info(&intf->dev,
1857 			"TEST 16:  read %d iso, %d entries of %d bytes\n",
1858 				param->iterations,
1859 				param->sglen, param->length);
1860 		// FIRMWARE:  iso source
1861 		retval = test_iso_queue (dev, param,
1862 				dev->in_iso_pipe, dev->iso_in);
1863 		break;
1864 
1865 	// FIXME unlink from queue (ring with N urbs)
1866 
1867 	// FIXME scatterlist cancel (needs helper thread)
1868 
1869 	}
1870 	do_gettimeofday (&param->duration);
1871 	param->duration.tv_sec -= start.tv_sec;
1872 	param->duration.tv_usec -= start.tv_usec;
1873 	if (param->duration.tv_usec < 0) {
1874 		param->duration.tv_usec += 1000 * 1000;
1875 		param->duration.tv_sec -= 1;
1876 	}
1877 	mutex_unlock(&dev->lock);
1878 	return retval;
1879 }
1880 
1881 /*-------------------------------------------------------------------------*/
1882 
1883 static unsigned force_interrupt = 0;
1884 module_param (force_interrupt, uint, 0);
1885 MODULE_PARM_DESC (force_interrupt, "0 = test default; else interrupt");
1886 
1887 #ifdef	GENERIC
1888 static unsigned short vendor;
1889 module_param(vendor, ushort, 0);
1890 MODULE_PARM_DESC (vendor, "vendor code (from usb-if)");
1891 
1892 static unsigned short product;
1893 module_param(product, ushort, 0);
1894 MODULE_PARM_DESC (product, "product code (from vendor)");
1895 #endif
1896 
1897 static int
1898 usbtest_probe (struct usb_interface *intf, const struct usb_device_id *id)
1899 {
1900 	struct usb_device	*udev;
1901 	struct usbtest_dev	*dev;
1902 	struct usbtest_info	*info;
1903 	char			*rtest, *wtest;
1904 	char			*irtest, *iwtest;
1905 
1906 	udev = interface_to_usbdev (intf);
1907 
1908 #ifdef	GENERIC
1909 	/* specify devices by module parameters? */
1910 	if (id->match_flags == 0) {
1911 		/* vendor match required, product match optional */
1912 		if (!vendor || le16_to_cpu(udev->descriptor.idVendor) != (u16)vendor)
1913 			return -ENODEV;
1914 		if (product && le16_to_cpu(udev->descriptor.idProduct) != (u16)product)
1915 			return -ENODEV;
1916 		dev_info(&intf->dev, "matched module params, "
1917 					"vend=0x%04x prod=0x%04x\n",
1918 				le16_to_cpu(udev->descriptor.idVendor),
1919 				le16_to_cpu(udev->descriptor.idProduct));
1920 	}
1921 #endif
1922 
1923 	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
1924 	if (!dev)
1925 		return -ENOMEM;
1926 	info = (struct usbtest_info *) id->driver_info;
1927 	dev->info = info;
1928 	mutex_init(&dev->lock);
1929 
1930 	dev->intf = intf;
1931 
1932 	/* cacheline-aligned scratch for i/o */
1933 	if ((dev->buf = kmalloc (TBUF_SIZE, GFP_KERNEL)) == NULL) {
1934 		kfree (dev);
1935 		return -ENOMEM;
1936 	}
1937 
1938 	/* NOTE this doesn't yet test the handful of difference that are
1939 	 * visible with high speed interrupts:  bigger maxpacket (1K) and
1940 	 * "high bandwidth" modes (up to 3 packets/uframe).
1941 	 */
1942 	rtest = wtest = "";
1943 	irtest = iwtest = "";
1944 	if (force_interrupt || udev->speed == USB_SPEED_LOW) {
1945 		if (info->ep_in) {
1946 			dev->in_pipe = usb_rcvintpipe (udev, info->ep_in);
1947 			rtest = " intr-in";
1948 		}
1949 		if (info->ep_out) {
1950 			dev->out_pipe = usb_sndintpipe (udev, info->ep_out);
1951 			wtest = " intr-out";
1952 		}
1953 	} else {
1954 		if (info->autoconf) {
1955 			int status;
1956 
1957 			status = get_endpoints (dev, intf);
1958 			if (status < 0) {
1959 				WARNING(dev, "couldn't get endpoints, %d\n",
1960 						status);
1961 				return status;
1962 			}
1963 			/* may find bulk or ISO pipes */
1964 		} else {
1965 			if (info->ep_in)
1966 				dev->in_pipe = usb_rcvbulkpipe (udev,
1967 							info->ep_in);
1968 			if (info->ep_out)
1969 				dev->out_pipe = usb_sndbulkpipe (udev,
1970 							info->ep_out);
1971 		}
1972 		if (dev->in_pipe)
1973 			rtest = " bulk-in";
1974 		if (dev->out_pipe)
1975 			wtest = " bulk-out";
1976 		if (dev->in_iso_pipe)
1977 			irtest = " iso-in";
1978 		if (dev->out_iso_pipe)
1979 			iwtest = " iso-out";
1980 	}
1981 
1982 	usb_set_intfdata (intf, dev);
1983 	dev_info (&intf->dev, "%s\n", info->name);
1984 	dev_info (&intf->dev, "%s speed {control%s%s%s%s%s} tests%s\n",
1985 			({ char *tmp;
1986 			switch (udev->speed) {
1987 			case USB_SPEED_LOW: tmp = "low"; break;
1988 			case USB_SPEED_FULL: tmp = "full"; break;
1989 			case USB_SPEED_HIGH: tmp = "high"; break;
1990 			default: tmp = "unknown"; break;
1991 			}; tmp; }),
1992 			info->ctrl_out ? " in/out" : "",
1993 			rtest, wtest,
1994 			irtest, iwtest,
1995 			info->alt >= 0 ? " (+alt)" : "");
1996 	return 0;
1997 }
1998 
1999 static int usbtest_suspend (struct usb_interface *intf, pm_message_t message)
2000 {
2001 	return 0;
2002 }
2003 
2004 static int usbtest_resume (struct usb_interface *intf)
2005 {
2006 	return 0;
2007 }
2008 
2009 
2010 static void usbtest_disconnect (struct usb_interface *intf)
2011 {
2012 	struct usbtest_dev	*dev = usb_get_intfdata (intf);
2013 
2014 	usb_set_intfdata (intf, NULL);
2015 	dev_dbg (&intf->dev, "disconnect\n");
2016 	kfree (dev);
2017 }
2018 
2019 /* Basic testing only needs a device that can source or sink bulk traffic.
2020  * Any device can test control transfers (default with GENERIC binding).
2021  *
2022  * Several entries work with the default EP0 implementation that's built
2023  * into EZ-USB chips.  There's a default vendor ID which can be overridden
2024  * by (very) small config EEPROMS, but otherwise all these devices act
2025  * identically until firmware is loaded:  only EP0 works.  It turns out
2026  * to be easy to make other endpoints work, without modifying that EP0
2027  * behavior.  For now, we expect that kind of firmware.
2028  */
2029 
2030 /* an21xx or fx versions of ez-usb */
2031 static struct usbtest_info ez1_info = {
2032 	.name		= "EZ-USB device",
2033 	.ep_in		= 2,
2034 	.ep_out		= 2,
2035 	.alt		= 1,
2036 };
2037 
2038 /* fx2 version of ez-usb */
2039 static struct usbtest_info ez2_info = {
2040 	.name		= "FX2 device",
2041 	.ep_in		= 6,
2042 	.ep_out		= 2,
2043 	.alt		= 1,
2044 };
2045 
2046 /* ezusb family device with dedicated usb test firmware,
2047  */
2048 static struct usbtest_info fw_info = {
2049 	.name		= "usb test device",
2050 	.ep_in		= 2,
2051 	.ep_out		= 2,
2052 	.alt		= 1,
2053 	.autoconf	= 1,		// iso and ctrl_out need autoconf
2054 	.ctrl_out	= 1,
2055 	.iso		= 1,		// iso_ep's are #8 in/out
2056 };
2057 
2058 /* peripheral running Linux and 'zero.c' test firmware, or
2059  * its user-mode cousin. different versions of this use
2060  * different hardware with the same vendor/product codes.
2061  * host side MUST rely on the endpoint descriptors.
2062  */
2063 static struct usbtest_info gz_info = {
2064 	.name		= "Linux gadget zero",
2065 	.autoconf	= 1,
2066 	.ctrl_out	= 1,
2067 	.alt		= 0,
2068 };
2069 
2070 static struct usbtest_info um_info = {
2071 	.name		= "Linux user mode test driver",
2072 	.autoconf	= 1,
2073 	.alt		= -1,
2074 };
2075 
2076 static struct usbtest_info um2_info = {
2077 	.name		= "Linux user mode ISO test driver",
2078 	.autoconf	= 1,
2079 	.iso		= 1,
2080 	.alt		= -1,
2081 };
2082 
2083 #ifdef IBOT2
2084 /* this is a nice source of high speed bulk data;
2085  * uses an FX2, with firmware provided in the device
2086  */
2087 static struct usbtest_info ibot2_info = {
2088 	.name		= "iBOT2 webcam",
2089 	.ep_in		= 2,
2090 	.alt		= -1,
2091 };
2092 #endif
2093 
2094 #ifdef GENERIC
2095 /* we can use any device to test control traffic */
2096 static struct usbtest_info generic_info = {
2097 	.name		= "Generic USB device",
2098 	.alt		= -1,
2099 };
2100 #endif
2101 
2102 
2103 static const struct usb_device_id id_table[] = {
2104 
2105 	/*-------------------------------------------------------------*/
2106 
2107 	/* EZ-USB devices which download firmware to replace (or in our
2108 	 * case augment) the default device implementation.
2109 	 */
2110 
2111 	/* generic EZ-USB FX controller */
2112 	{ USB_DEVICE (0x0547, 0x2235),
2113 		.driver_info = (unsigned long) &ez1_info,
2114 		},
2115 
2116 	/* CY3671 development board with EZ-USB FX */
2117 	{ USB_DEVICE (0x0547, 0x0080),
2118 		.driver_info = (unsigned long) &ez1_info,
2119 		},
2120 
2121 	/* generic EZ-USB FX2 controller (or development board) */
2122 	{ USB_DEVICE (0x04b4, 0x8613),
2123 		.driver_info = (unsigned long) &ez2_info,
2124 		},
2125 
2126 	/* re-enumerated usb test device firmware */
2127 	{ USB_DEVICE (0xfff0, 0xfff0),
2128 		.driver_info = (unsigned long) &fw_info,
2129 		},
2130 
2131 	/* "Gadget Zero" firmware runs under Linux */
2132 	{ USB_DEVICE (0x0525, 0xa4a0),
2133 		.driver_info = (unsigned long) &gz_info,
2134 		},
2135 
2136 	/* so does a user-mode variant */
2137 	{ USB_DEVICE (0x0525, 0xa4a4),
2138 		.driver_info = (unsigned long) &um_info,
2139 		},
2140 
2141 	/* ... and a user-mode variant that talks iso */
2142 	{ USB_DEVICE (0x0525, 0xa4a3),
2143 		.driver_info = (unsigned long) &um2_info,
2144 		},
2145 
2146 #ifdef KEYSPAN_19Qi
2147 	/* Keyspan 19qi uses an21xx (original EZ-USB) */
2148 	// this does not coexist with the real Keyspan 19qi driver!
2149 	{ USB_DEVICE (0x06cd, 0x010b),
2150 		.driver_info = (unsigned long) &ez1_info,
2151 		},
2152 #endif
2153 
2154 	/*-------------------------------------------------------------*/
2155 
2156 #ifdef IBOT2
2157 	/* iBOT2 makes a nice source of high speed bulk-in data */
2158 	// this does not coexist with a real iBOT2 driver!
2159 	{ USB_DEVICE (0x0b62, 0x0059),
2160 		.driver_info = (unsigned long) &ibot2_info,
2161 		},
2162 #endif
2163 
2164 	/*-------------------------------------------------------------*/
2165 
2166 #ifdef GENERIC
2167 	/* module params can specify devices to use for control tests */
2168 	{ .driver_info = (unsigned long) &generic_info, },
2169 #endif
2170 
2171 	/*-------------------------------------------------------------*/
2172 
2173 	{ }
2174 };
2175 MODULE_DEVICE_TABLE (usb, id_table);
2176 
2177 static struct usb_driver usbtest_driver = {
2178 	.name =		"usbtest",
2179 	.id_table =	id_table,
2180 	.probe =	usbtest_probe,
2181 	.unlocked_ioctl = usbtest_ioctl,
2182 	.disconnect =	usbtest_disconnect,
2183 	.suspend =	usbtest_suspend,
2184 	.resume =	usbtest_resume,
2185 };
2186 
2187 /*-------------------------------------------------------------------------*/
2188 
2189 static int __init usbtest_init (void)
2190 {
2191 #ifdef GENERIC
2192 	if (vendor)
2193 		pr_debug("params: vend=0x%04x prod=0x%04x\n", vendor, product);
2194 #endif
2195 	return usb_register (&usbtest_driver);
2196 }
2197 module_init (usbtest_init);
2198 
2199 static void __exit usbtest_exit (void)
2200 {
2201 	usb_deregister (&usbtest_driver);
2202 }
2203 module_exit (usbtest_exit);
2204 
2205 MODULE_DESCRIPTION ("USB Core/HCD Testing Driver");
2206 MODULE_LICENSE ("GPL");
2207 
2208