usbtest.c 57.3 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1
2
3
4
5
6
7
#include <linux/kernel.h>
#include <linux/errno.h>
#include <linux/init.h>
#include <linux/slab.h>
#include <linux/mm.h>
#include <linux/module.h>
#include <linux/moduleparam.h>
8
#include <linux/scatterlist.h>
9
#include <linux/mutex.h>
Linus Torvalds's avatar
Linus Torvalds committed
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

#include <linux/usb.h>


/*-------------------------------------------------------------------------*/

// FIXME make these public somewhere; usbdevfs.h?
//
struct usbtest_param {
	// inputs
	unsigned		test_num;	/* 0..(TEST_CASES-1) */
	unsigned		iterations;
	unsigned		length;
	unsigned		vary;
	unsigned		sglen;

	// outputs
	struct timeval		duration;
};
#define USBTEST_REQUEST	_IOWR('U', 100, struct usbtest_param)

/*-------------------------------------------------------------------------*/

#define	GENERIC		/* let probe() bind using module params */

/* Some devices that can be used for testing will have "real" drivers.
 * Entries for those need to be enabled here by hand, after disabling
 * that "real" driver.
 */
//#define	IBOT2		/* grab iBOT2 webcams */
//#define	KEYSPAN_19Qi	/* grab un-renumerated serial adapter */

/*-------------------------------------------------------------------------*/

struct usbtest_info {
	const char		*name;
	u8			ep_in;		/* bulk/intr source */
	u8			ep_out;		/* bulk/intr sink */
	unsigned		autoconf : 1;
	unsigned		ctrl_out : 1;
	unsigned		iso : 1;	/* try iso in/out */
	int			alt;
};

/* this is accessed only through usbfs ioctl calls.
 * one ioctl to issue a test ... one lock per device.
 * tests create other threads if they need them.
 * urbs and buffers are allocated dynamically,
 * and data generated deterministically.
 */
struct usbtest_dev {
	struct usb_interface	*intf;
	struct usbtest_info	*info;
	int			in_pipe;
	int			out_pipe;
	int			in_iso_pipe;
	int			out_iso_pipe;
	struct usb_endpoint_descriptor	*iso_in, *iso_out;
68
	struct mutex		lock;
Linus Torvalds's avatar
Linus Torvalds committed
69
70
71
72
73
74
75
76
77
78
79
80
81

#define TBUF_SIZE	256
	u8			*buf;
};

static struct usb_device *testdev_to_usbdev (struct usbtest_dev *test)
{
	return interface_to_usbdev (test->intf);
}

/* set up all urbs so they can be used with either bulk or interrupt */
#define	INTERRUPT_RATE		1	/* msec/transfer */

82
83
84
85
#define ERROR(tdev, fmt, args...) \
	dev_err(&(tdev)->intf->dev , fmt , ## args)
#define WARN(tdev, fmt, args...) \
	dev_warn(&(tdev)->intf->dev , fmt , ## args)
Linus Torvalds's avatar
Linus Torvalds committed
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121

/*-------------------------------------------------------------------------*/

static int
get_endpoints (struct usbtest_dev *dev, struct usb_interface *intf)
{
	int				tmp;
	struct usb_host_interface	*alt;
	struct usb_host_endpoint	*in, *out;
	struct usb_host_endpoint	*iso_in, *iso_out;
	struct usb_device		*udev;

	for (tmp = 0; tmp < intf->num_altsetting; tmp++) {
		unsigned	ep;

		in = out = NULL;
		iso_in = iso_out = NULL;
		alt = intf->altsetting + tmp;

		/* take the first altsetting with in-bulk + out-bulk;
		 * ignore other endpoints and altsetttings.
		 */
		for (ep = 0; ep < alt->desc.bNumEndpoints; ep++) {
			struct usb_host_endpoint	*e;

			e = alt->endpoint + ep;
			switch (e->desc.bmAttributes) {
			case USB_ENDPOINT_XFER_BULK:
				break;
			case USB_ENDPOINT_XFER_ISOC:
				if (dev->info->iso)
					goto try_iso;
				// FALLTHROUGH
			default:
				continue;
			}
122
			if (usb_endpoint_dir_in(&e->desc)) {
Linus Torvalds's avatar
Linus Torvalds committed
123
124
125
126
127
128
129
130
				if (!in)
					in = e;
			} else {
				if (!out)
					out = e;
			}
			continue;
try_iso:
131
			if (usb_endpoint_dir_in(&e->desc)) {
Linus Torvalds's avatar
Linus Torvalds committed
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
				if (!iso_in)
					iso_in = e;
			} else {
				if (!iso_out)
					iso_out = e;
			}
		}
		if ((in && out)  ||  (iso_in && iso_out))
			goto found;
	}
	return -EINVAL;

found:
	udev = testdev_to_usbdev (dev);
	if (alt->desc.bAlternateSetting != 0) {
		tmp = usb_set_interface (udev,
				alt->desc.bInterfaceNumber,
				alt->desc.bAlternateSetting);
		if (tmp < 0)
			return tmp;
	}

	if (in) {
		dev->in_pipe = usb_rcvbulkpipe (udev,
			in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
		dev->out_pipe = usb_sndbulkpipe (udev,
			out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
	}
	if (iso_in) {
		dev->iso_in = &iso_in->desc;
		dev->in_iso_pipe = usb_rcvisocpipe (udev,
				iso_in->desc.bEndpointAddress
					& USB_ENDPOINT_NUMBER_MASK);
		dev->iso_out = &iso_out->desc;
		dev->out_iso_pipe = usb_sndisocpipe (udev,
				iso_out->desc.bEndpointAddress
					& USB_ENDPOINT_NUMBER_MASK);
	}
	return 0;
}

/*-------------------------------------------------------------------------*/

/* Support for testing basic non-queued I/O streams.
 *
 * These just package urbs as requests that can be easily canceled.
 * Each urb's data buffer is dynamically allocated; callers can fill
 * them with non-zero test data (or test for it) when appropriate.
 */

182
static void simple_callback (struct urb *urb)
Linus Torvalds's avatar
Linus Torvalds committed
183
{
184
	complete(urb->context);
Linus Torvalds's avatar
Linus Torvalds committed
185
186
187
188
189
190
191
192
193
194
195
196
}

static struct urb *simple_alloc_urb (
	struct usb_device	*udev,
	int			pipe,
	unsigned long		bytes
)
{
	struct urb		*urb;

	if (bytes < 0)
		return NULL;
197
	urb = usb_alloc_urb (0, GFP_KERNEL);
Linus Torvalds's avatar
Linus Torvalds committed
198
199
200
201
202
203
204
205
206
	if (!urb)
		return urb;
	usb_fill_bulk_urb (urb, udev, pipe, NULL, bytes, simple_callback, NULL);
	urb->interval = (udev->speed == USB_SPEED_HIGH)
			? (INTERRUPT_RATE << 3)
			: INTERRUPT_RATE;
	urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
	if (usb_pipein (pipe))
		urb->transfer_flags |= URB_SHORT_NOT_OK;
207
	urb->transfer_buffer = usb_buffer_alloc (udev, bytes, GFP_KERNEL,
Linus Torvalds's avatar
Linus Torvalds committed
208
209
210
211
212
213
214
215
216
217
218
			&urb->transfer_dma);
	if (!urb->transfer_buffer) {
		usb_free_urb (urb);
		urb = NULL;
	} else
		memset (urb->transfer_buffer, 0, bytes);
	return urb;
}

static unsigned pattern = 0;
module_param (pattern, uint, S_IRUGO);
219
MODULE_PARM_DESC(pattern, "i/o pattern (0 == zeroes)");
Linus Torvalds's avatar
Linus Torvalds committed
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239

static inline void simple_fill_buf (struct urb *urb)
{
	unsigned	i;
	u8		*buf = urb->transfer_buffer;
	unsigned	len = urb->transfer_buffer_length;

	switch (pattern) {
	default:
		// FALLTHROUGH
	case 0:
		memset (buf, 0, len);
		break;
	case 1:			/* mod63 */
		for (i = 0; i < len; i++)
			*buf++ = (u8) (i % 63);
		break;
	}
}

240
static inline int simple_check_buf(struct usbtest_dev *tdev, struct urb *urb)
Linus Torvalds's avatar
Linus Torvalds committed
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
{
	unsigned	i;
	u8		expected;
	u8		*buf = urb->transfer_buffer;
	unsigned	len = urb->actual_length;

	for (i = 0; i < len; i++, buf++) {
		switch (pattern) {
		/* all-zeroes has no synchronization issues */
		case 0:
			expected = 0;
			break;
		/* mod63 stays in sync with short-terminated transfers,
		 * or otherwise when host and gadget agree on how large
		 * each usb transfer request should be.  resync is done
		 * with set_interface or set_config.
		 */
		case 1:			/* mod63 */
			expected = i % 63;
			break;
		/* always fail unsupported patterns */
		default:
			expected = !*buf;
			break;
		}
		if (*buf == expected)
			continue;
268
		ERROR(tdev, "buf[%d] = %d (not %d)\n", i, *buf, expected);
Linus Torvalds's avatar
Linus Torvalds committed
269
270
271
272
273
274
275
276
277
278
279
280
281
		return -EINVAL;
	}
	return 0;
}

static void simple_free_urb (struct urb *urb)
{
	usb_buffer_free (urb->dev, urb->transfer_buffer_length,
			urb->transfer_buffer, urb->transfer_dma);
	usb_free_urb (urb);
}

static int simple_io (
282
	struct usbtest_dev	*tdev,
Linus Torvalds's avatar
Linus Torvalds committed
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
	struct urb		*urb,
	int			iterations,
	int			vary,
	int			expected,
	const char		*label
)
{
	struct usb_device	*udev = urb->dev;
	int			max = urb->transfer_buffer_length;
	struct completion	completion;
	int			retval = 0;

	urb->context = &completion;
	while (retval == 0 && iterations-- > 0) {
		init_completion (&completion);
		if (usb_pipeout (urb->pipe))
			simple_fill_buf (urb);
300
		if ((retval = usb_submit_urb (urb, GFP_KERNEL)) != 0)
Linus Torvalds's avatar
Linus Torvalds committed
301
302
303
304
305
306
307
			break;

		/* NOTE:  no timeouts; can't be broken out of by interrupt */
		wait_for_completion (&completion);
		retval = urb->status;
		urb->dev = udev;
		if (retval == 0 && usb_pipein (urb->pipe))
308
			retval = simple_check_buf(tdev, urb);
Linus Torvalds's avatar
Linus Torvalds committed
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324

		if (vary) {
			int	len = urb->transfer_buffer_length;

			len += vary;
			len %= max;
			if (len == 0)
				len = (vary < max) ? vary : max;
			urb->transfer_buffer_length = len;
		}

		/* FIXME if endpoint halted, clear halt (and log) */
	}
	urb->transfer_buffer_length = max;

	if (expected != retval)
325
		dev_err(&udev->dev,
Linus Torvalds's avatar
Linus Torvalds committed
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
			"%s failed, iterations left %d, status %d (not %d)\n",
				label, iterations, retval, expected);
	return retval;
}


/*-------------------------------------------------------------------------*/

/* We use scatterlist primitives to test queued I/O.
 * Yes, this also tests the scatterlist primitives.
 */

static void free_sglist (struct scatterlist *sg, int nents)
{
	unsigned		i;
341

Linus Torvalds's avatar
Linus Torvalds committed
342
343
344
	if (!sg)
		return;
	for (i = 0; i < nents; i++) {
345
		if (!sg_page(&sg[i]))
Linus Torvalds's avatar
Linus Torvalds committed
346
			continue;
347
		kfree (sg_virt(&sg[i]));
Linus Torvalds's avatar
Linus Torvalds committed
348
349
350
351
352
353
354
355
356
357
358
	}
	kfree (sg);
}

static struct scatterlist *
alloc_sglist (int nents, int max, int vary)
{
	struct scatterlist	*sg;
	unsigned		i;
	unsigned		size = max;

359
	sg = kmalloc (nents * sizeof *sg, GFP_KERNEL);
Linus Torvalds's avatar
Linus Torvalds committed
360
361
	if (!sg)
		return NULL;
362
	sg_init_table(sg, nents);
Linus Torvalds's avatar
Linus Torvalds committed
363
364
365

	for (i = 0; i < nents; i++) {
		char		*buf;
366
		unsigned	j;
Linus Torvalds's avatar
Linus Torvalds committed
367

368
		buf = kzalloc (size, GFP_KERNEL);
Linus Torvalds's avatar
Linus Torvalds committed
369
370
371
372
373
374
		if (!buf) {
			free_sglist (sg, i);
			return NULL;
		}

		/* kmalloc pages are always physically contiguous! */
375
		sg_set_buf(&sg[i], buf, size);
Linus Torvalds's avatar
Linus Torvalds committed
376

377
378
379
380
381
382
383
384
385
386
		switch (pattern) {
		case 0:
			/* already zeroed */
			break;
		case 1:
			for (j = 0; j < size; j++)
				*buf++ = (u8) (j % 63);
			break;
		}

Linus Torvalds's avatar
Linus Torvalds committed
387
388
389
390
391
392
393
394
395
396
397
398
		if (vary) {
			size += vary;
			size %= max;
			if (size == 0)
				size = (vary < max) ? vary : max;
		}
	}

	return sg;
}

static int perform_sglist (
399
	struct usbtest_dev	*tdev,
Linus Torvalds's avatar
Linus Torvalds committed
400
401
402
403
404
405
406
	unsigned		iterations,
	int			pipe,
	struct usb_sg_request	*req,
	struct scatterlist	*sg,
	int			nents
)
{
407
	struct usb_device	*udev = testdev_to_usbdev(tdev);
Linus Torvalds's avatar
Linus Torvalds committed
408
409
410
411
412
413
414
	int			retval = 0;

	while (retval == 0 && iterations-- > 0) {
		retval = usb_sg_init (req, udev, pipe,
				(udev->speed == USB_SPEED_HIGH)
					? (INTERRUPT_RATE << 3)
					: INTERRUPT_RATE,
415
				sg, nents, 0, GFP_KERNEL);
416

Linus Torvalds's avatar
Linus Torvalds committed
417
418
419
420
421
		if (retval)
			break;
		usb_sg_wait (req);
		retval = req->status;

422
423
		/* FIXME check resulting data pattern */

Linus Torvalds's avatar
Linus Torvalds committed
424
425
426
427
428
429
430
		/* FIXME if endpoint halted, clear halt (and log) */
	}

	// FIXME for unlink or fault handling tests, don't report
	// failure if retval is as we expected ...

	if (retval)
431
432
		ERROR(tdev, "perform_sglist failed, "
				"iterations left %d, status %d\n",
Linus Torvalds's avatar
Linus Torvalds committed
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
				iterations, retval);
	return retval;
}


/*-------------------------------------------------------------------------*/

/* unqueued control message testing
 *
 * there's a nice set of device functional requirements in chapter 9 of the
 * usb 2.0 spec, which we can apply to ANY device, even ones that don't use
 * special test firmware.
 *
 * we know the device is configured (or suspended) by the time it's visible
 * through usbfs.  we can't change that, so we won't test enumeration (which
 * worked 'well enough' to get here, this time), power management (ditto),
 * or remote wakeup (which needs human interaction).
 */

static unsigned realworld = 1;
module_param (realworld, uint, 0);
David Brownell's avatar
David Brownell committed
454
MODULE_PARM_DESC (realworld, "clear to demand stricter spec compliance");
Linus Torvalds's avatar
Linus Torvalds committed
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490

static int get_altsetting (struct usbtest_dev *dev)
{
	struct usb_interface	*iface = dev->intf;
	struct usb_device	*udev = interface_to_usbdev (iface);
	int			retval;

	retval = usb_control_msg (udev, usb_rcvctrlpipe (udev, 0),
			USB_REQ_GET_INTERFACE, USB_DIR_IN|USB_RECIP_INTERFACE,
			0, iface->altsetting [0].desc.bInterfaceNumber,
			dev->buf, 1, USB_CTRL_GET_TIMEOUT);
	switch (retval) {
	case 1:
		return dev->buf [0];
	case 0:
		retval = -ERANGE;
		// FALLTHROUGH
	default:
		return retval;
	}
}

static int set_altsetting (struct usbtest_dev *dev, int alternate)
{
	struct usb_interface		*iface = dev->intf;
	struct usb_device		*udev;

	if (alternate < 0 || alternate >= 256)
		return -EINVAL;

	udev = interface_to_usbdev (iface);
	return usb_set_interface (udev,
			iface->altsetting [0].desc.bInterfaceNumber,
			alternate);
}

491
static int is_good_config(struct usbtest_dev *tdev, int len)
Linus Torvalds's avatar
Linus Torvalds committed
492
493
{
	struct usb_config_descriptor	*config;
494

Linus Torvalds's avatar
Linus Torvalds committed
495
496
	if (len < sizeof *config)
		return 0;
497
	config = (struct usb_config_descriptor *) tdev->buf;
Linus Torvalds's avatar
Linus Torvalds committed
498
499
500
501
502

	switch (config->bDescriptorType) {
	case USB_DT_CONFIG:
	case USB_DT_OTHER_SPEED_CONFIG:
		if (config->bLength != 9) {
503
			ERROR(tdev, "bogus config descriptor length\n");
Linus Torvalds's avatar
Linus Torvalds committed
504
505
506
507
			return 0;
		}
		/* this bit 'must be 1' but often isn't */
		if (!realworld && !(config->bmAttributes & 0x80)) {
508
			ERROR(tdev, "high bit of config attributes not set\n");
Linus Torvalds's avatar
Linus Torvalds committed
509
510
511
			return 0;
		}
		if (config->bmAttributes & 0x1f) {	/* reserved == 0 */
512
			ERROR(tdev, "reserved config bits set\n");
Linus Torvalds's avatar
Linus Torvalds committed
513
514
515
516
517
518
519
520
521
522
523
			return 0;
		}
		break;
	default:
		return 0;
	}

	if (le16_to_cpu(config->wTotalLength) == len)		/* read it all */
		return 1;
	if (le16_to_cpu(config->wTotalLength) >= TBUF_SIZE)		/* max partial read */
		return 1;
524
	ERROR(tdev, "bogus config descriptor read size\n");
Linus Torvalds's avatar
Linus Torvalds committed
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
	return 0;
}

/* sanity test for standard requests working with usb_control_mesg() and some
 * of the utility functions which use it.
 *
 * this doesn't test how endpoint halts behave or data toggles get set, since
 * we won't do I/O to bulk/interrupt endpoints here (which is how to change
 * halt or toggle).  toggle testing is impractical without support from hcds.
 *
 * this avoids failing devices linux would normally work with, by not testing
 * config/altsetting operations for devices that only support their defaults.
 * such devices rarely support those needless operations.
 *
 * NOTE that since this is a sanity test, it's not examining boundary cases
 * to see if usbcore, hcd, and device all behave right.  such testing would
 * involve varied read sizes and other operation sequences.
 */
static int ch9_postconfig (struct usbtest_dev *dev)
{
	struct usb_interface	*iface = dev->intf;
	struct usb_device	*udev = interface_to_usbdev (iface);
	int			i, alt, retval;

	/* [9.2.3] if there's more than one altsetting, we need to be able to
	 * set and get each one.  mostly trusts the descriptors from usbcore.
	 */
	for (i = 0; i < iface->num_altsetting; i++) {

		/* 9.2.3 constrains the range here */
		alt = iface->altsetting [i].desc.bAlternateSetting;
		if (alt < 0 || alt >= iface->num_altsetting) {
557
			dev_err(&iface->dev,
Linus Torvalds's avatar
Linus Torvalds committed
558
559
560
561
562
563
564
565
566
567
568
					"invalid alt [%d].bAltSetting = %d\n",
					i, alt);
		}

		/* [real world] get/set unimplemented if there's only one */
		if (realworld && iface->num_altsetting == 1)
			continue;

		/* [9.4.10] set_interface */
		retval = set_altsetting (dev, alt);
		if (retval) {
569
			dev_err(&iface->dev, "can't set_interface = %d, %d\n",
Linus Torvalds's avatar
Linus Torvalds committed
570
571
572
573
574
575
576
					alt, retval);
			return retval;
		}

		/* [9.4.4] get_interface always works */
		retval = get_altsetting (dev);
		if (retval != alt) {
577
			dev_err(&iface->dev, "get alt should be %d, was %d\n",
Linus Torvalds's avatar
Linus Torvalds committed
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
					alt, retval);
			return (retval < 0) ? retval : -EDOM;
		}

	}

	/* [real world] get_config unimplemented if there's only one */
	if (!realworld || udev->descriptor.bNumConfigurations != 1) {
		int	expected = udev->actconfig->desc.bConfigurationValue;

		/* [9.4.2] get_configuration always works
		 * ... although some cheap devices (like one TI Hub I've got)
		 * won't return config descriptors except before set_config.
		 */
		retval = usb_control_msg (udev, usb_rcvctrlpipe (udev, 0),
				USB_REQ_GET_CONFIGURATION,
				USB_DIR_IN | USB_RECIP_DEVICE,
				0, 0, dev->buf, 1, USB_CTRL_GET_TIMEOUT);
		if (retval != 1 || dev->buf [0] != expected) {
597
			dev_err(&iface->dev, "get config --> %d %d (1 %d)\n",
David Brownell's avatar
David Brownell committed
598
				retval, dev->buf[0], expected);
Linus Torvalds's avatar
Linus Torvalds committed
599
600
601
602
603
604
605
606
			return (retval < 0) ? retval : -EDOM;
		}
	}

	/* there's always [9.4.3] a device descriptor [9.6.1] */
	retval = usb_get_descriptor (udev, USB_DT_DEVICE, 0,
			dev->buf, sizeof udev->descriptor);
	if (retval != sizeof udev->descriptor) {
607
		dev_err(&iface->dev, "dev descriptor --> %d\n", retval);
Linus Torvalds's avatar
Linus Torvalds committed
608
609
610
611
612
613
614
		return (retval < 0) ? retval : -EDOM;
	}

	/* there's always [9.4.3] at least one config descriptor [9.6.3] */
	for (i = 0; i < udev->descriptor.bNumConfigurations; i++) {
		retval = usb_get_descriptor (udev, USB_DT_CONFIG, i,
				dev->buf, TBUF_SIZE);
615
616
		if (!is_good_config(dev, retval)) {
			dev_err(&iface->dev,
Linus Torvalds's avatar
Linus Torvalds committed
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
					"config [%d] descriptor --> %d\n",
					i, retval);
			return (retval < 0) ? retval : -EDOM;
		}

		// FIXME cross-checking udev->config[i] to make sure usbcore
		// parsed it right (etc) would be good testing paranoia
	}

	/* and sometimes [9.2.6.6] speed dependent descriptors */
	if (le16_to_cpu(udev->descriptor.bcdUSB) == 0x0200) {
		struct usb_qualifier_descriptor		*d = NULL;

		/* device qualifier [9.6.2] */
		retval = usb_get_descriptor (udev,
				USB_DT_DEVICE_QUALIFIER, 0, dev->buf,
				sizeof (struct usb_qualifier_descriptor));
		if (retval == -EPIPE) {
			if (udev->speed == USB_SPEED_HIGH) {
636
				dev_err(&iface->dev,
Linus Torvalds's avatar
Linus Torvalds committed
637
638
639
640
641
642
						"hs dev qualifier --> %d\n",
						retval);
				return (retval < 0) ? retval : -EDOM;
			}
			/* usb2.0 but not high-speed capable; fine */
		} else if (retval != sizeof (struct usb_qualifier_descriptor)) {
643
			dev_err(&iface->dev, "dev qualifier --> %d\n", retval);
Linus Torvalds's avatar
Linus Torvalds committed
644
645
646
647
648
649
650
651
652
653
654
			return (retval < 0) ? retval : -EDOM;
		} else
			d = (struct usb_qualifier_descriptor *) dev->buf;

		/* might not have [9.6.2] any other-speed configs [9.6.4] */
		if (d) {
			unsigned max = d->bNumConfigurations;
			for (i = 0; i < max; i++) {
				retval = usb_get_descriptor (udev,
					USB_DT_OTHER_SPEED_CONFIG, i,
					dev->buf, TBUF_SIZE);
655
656
				if (!is_good_config(dev, retval)) {
					dev_err(&iface->dev,
Linus Torvalds's avatar
Linus Torvalds committed
657
658
659
660
661
662
663
664
665
666
667
668
						"other speed config --> %d\n",
						retval);
					return (retval < 0) ? retval : -EDOM;
				}
			}
		}
	}
	// FIXME fetch strings from at least the device descriptor

	/* [9.4.5] get_status always works */
	retval = usb_get_status (udev, USB_RECIP_DEVICE, 0, dev->buf);
	if (retval != 2) {
669
		dev_err(&iface->dev, "get dev status --> %d\n", retval);
Linus Torvalds's avatar
Linus Torvalds committed
670
671
672
673
674
675
676
677
678
		return (retval < 0) ? retval : -EDOM;
	}

	// FIXME configuration.bmAttributes says if we could try to set/clear
	// the device's remote wakeup feature ... if we can, test that here

	retval = usb_get_status (udev, USB_RECIP_INTERFACE,
			iface->altsetting [0].desc.bInterfaceNumber, dev->buf);
	if (retval != 2) {
679
		dev_err(&iface->dev, "get interface status --> %d\n", retval);
Linus Torvalds's avatar
Linus Torvalds committed
680
681
682
		return (retval < 0) ? retval : -EDOM;
	}
	// FIXME get status for each endpoint in the interface
683

Linus Torvalds's avatar
Linus Torvalds committed
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
	return 0;
}

/*-------------------------------------------------------------------------*/

/* use ch9 requests to test whether:
 *   (a) queues work for control, keeping N subtests queued and
 *       active (auto-resubmit) for M loops through the queue.
 *   (b) protocol stalls (control-only) will autorecover.
 *       it's not like bulk/intr; no halt clearing.
 *   (c) short control reads are reported and handled.
 *   (d) queues are always processed in-order
 */

struct ctrl_ctx {
	spinlock_t		lock;
	struct usbtest_dev	*dev;
	struct completion	complete;
	unsigned		count;
	unsigned		pending;
	int			status;
	struct urb		**urb;
	struct usbtest_param	*param;
	int			last;
};

#define NUM_SUBCASES	15		/* how many test subcases here? */

struct subcase {
	struct usb_ctrlrequest	setup;
	int			number;
	int			expected;
};

718
static void ctrl_complete (struct urb *urb)
Linus Torvalds's avatar
Linus Torvalds committed
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
{
	struct ctrl_ctx		*ctx = urb->context;
	struct usb_ctrlrequest	*reqp;
	struct subcase		*subcase;
	int			status = urb->status;

	reqp = (struct usb_ctrlrequest *)urb->setup_packet;
	subcase = container_of (reqp, struct subcase, setup);

	spin_lock (&ctx->lock);
	ctx->count--;
	ctx->pending--;

	/* queue must transfer and complete in fifo order, unless
	 * usb_unlink_urb() is used to unlink something not at the
	 * physical queue head (not tested).
	 */
	if (subcase->number > 0) {
		if ((subcase->number - ctx->last) != 1) {
738
739
740
			ERROR(ctx->dev,
				"subcase %d completed out of order, last %d\n",
				subcase->number, ctx->last);
Linus Torvalds's avatar
Linus Torvalds committed
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
			status = -EDOM;
			ctx->last = subcase->number;
			goto error;
		}
	}
	ctx->last = subcase->number;

	/* succeed or fault in only one way? */
	if (status == subcase->expected)
		status = 0;

	/* async unlink for cleanup? */
	else if (status != -ECONNRESET) {

		/* some faults are allowed, not required */
		if (subcase->expected > 0 && (
757
758
			  ((status == -subcase->expected	/* happened */
			   || status == 0))))			/* didn't */
Linus Torvalds's avatar
Linus Torvalds committed
759
760
761
762
763
			status = 0;
		/* sometimes more than one fault is allowed */
		else if (subcase->number == 12 && status == -EPIPE)
			status = 0;
		else
764
			ERROR(ctx->dev, "subtest %d error, status %d\n",
Linus Torvalds's avatar
Linus Torvalds committed
765
766
767
768
769
770
771
772
773
774
					subcase->number, status);
	}

	/* unexpected status codes mean errors; ideally, in hardware */
	if (status) {
error:
		if (ctx->status == 0) {
			int		i;

			ctx->status = status;
775
776
			ERROR(ctx->dev, "control queue %02x.%02x, err %d, "
					"%d left, subcase %d, len %d/%d\n",
Linus Torvalds's avatar
Linus Torvalds committed
777
					reqp->bRequestType, reqp->bRequest,
778
779
780
					status, ctx->count, subcase->number,
					urb->actual_length,
					urb->transfer_buffer_length);
Linus Torvalds's avatar
Linus Torvalds committed
781
782
783
784
785
786
787
788

			/* FIXME this "unlink everything" exit route should
			 * be a separate test case.
			 */

			/* unlink whatever's still pending */
			for (i = 1; i < ctx->param->sglen; i++) {
				struct urb	*u = ctx->urb [
789
790
						(i + subcase->number)
						% ctx->param->sglen];
Linus Torvalds's avatar
Linus Torvalds committed
791
792
793

				if (u == urb || !u->dev)
					continue;
794
				spin_unlock(&ctx->lock);
Linus Torvalds's avatar
Linus Torvalds committed
795
				status = usb_unlink_urb (u);
796
				spin_lock(&ctx->lock);
Linus Torvalds's avatar
Linus Torvalds committed
797
798
799
800
801
802
				switch (status) {
				case -EINPROGRESS:
				case -EBUSY:
				case -EIDRM:
					continue;
				default:
803
804
					ERROR(ctx->dev, "urb unlink --> %d\n",
							status);
Linus Torvalds's avatar
Linus Torvalds committed
805
806
807
808
809
810
811
812
				}
			}
			status = ctx->status;
		}
	}

	/* resubmit if we need to, else mark this as done */
	if ((status == 0) && (ctx->pending < ctx->count)) {
813
		if ((status = usb_submit_urb (urb, GFP_ATOMIC)) != 0) {
814
815
			ERROR(ctx->dev,
				"can't resubmit ctrl %02x.%02x, err %d\n",
Linus Torvalds's avatar
Linus Torvalds committed
816
817
818
819
820
821
				reqp->bRequestType, reqp->bRequest, status);
			urb->dev = NULL;
		} else
			ctx->pending++;
	} else
		urb->dev = NULL;
822

Linus Torvalds's avatar
Linus Torvalds committed
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
	/* signal completion when nothing's queued */
	if (ctx->pending == 0)
		complete (&ctx->complete);
	spin_unlock (&ctx->lock);
}

static int
test_ctrl_queue (struct usbtest_dev *dev, struct usbtest_param *param)
{
	struct usb_device	*udev = testdev_to_usbdev (dev);
	struct urb		**urb;
	struct ctrl_ctx		context;
	int			i;

	spin_lock_init (&context.lock);
	context.dev = dev;
	init_completion (&context.complete);
	context.count = param->sglen * param->iterations;
	context.pending = 0;
	context.status = -ENOMEM;
	context.param = param;
	context.last = -1;

	/* allocate and init the urbs we'll queue.
	 * as with bulk/intr sglists, sglen is the queue depth; it also
	 * controls which subtests run (more tests than sglen) or rerun.
	 */
850
	urb = kcalloc(param->sglen, sizeof(struct urb *), GFP_KERNEL);
Linus Torvalds's avatar
Linus Torvalds committed
851
852
853
854
855
856
857
858
	if (!urb)
		return -ENOMEM;
	for (i = 0; i < param->sglen; i++) {
		int			pipe = usb_rcvctrlpipe (udev, 0);
		unsigned		len;
		struct urb		*u;
		struct usb_ctrlrequest	req;
		struct subcase		*reqp;
859
860
861
862
863

		/* sign of this variable means:
		 *  -: tested code must return this (negative) error code
		 *  +: tested code may return this (negative too) error code
		 */
Linus Torvalds's avatar
Linus Torvalds committed
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
		int			expected = 0;

		/* requests here are mostly expected to succeed on any
		 * device, but some are chosen to trigger protocol stalls
		 * or short reads.
		 */
		memset (&req, 0, sizeof req);
		req.bRequest = USB_REQ_GET_DESCRIPTOR;
		req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;

		switch (i % NUM_SUBCASES) {
		case 0:		// get device descriptor
			req.wValue = cpu_to_le16 (USB_DT_DEVICE << 8);
			len = sizeof (struct usb_device_descriptor);
			break;
		case 1:		// get first config descriptor (only)
			req.wValue = cpu_to_le16 ((USB_DT_CONFIG << 8) | 0);
			len = sizeof (struct usb_config_descriptor);
			break;
		case 2:		// get altsetting (OFTEN STALLS)
			req.bRequest = USB_REQ_GET_INTERFACE;
			req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
			// index = 0 means first interface
			len = 1;
			expected = EPIPE;
			break;
		case 3:		// get interface status
			req.bRequest = USB_REQ_GET_STATUS;
			req.bRequestType = USB_DIR_IN|USB_RECIP_INTERFACE;
			// interface 0
			len = 2;
			break;
		case 4:		// get device status
			req.bRequest = USB_REQ_GET_STATUS;
			req.bRequestType = USB_DIR_IN|USB_RECIP_DEVICE;
			len = 2;
			break;
		case 5:		// get device qualifier (MAY STALL)
			req.wValue = cpu_to_le16 (USB_DT_DEVICE_QUALIFIER << 8);
			len = sizeof (struct usb_qualifier_descriptor);
			if (udev->speed != USB_SPEED_HIGH)
				expected = EPIPE;
			break;
		case 6:		// get first config descriptor, plus interface
			req.wValue = cpu_to_le16 ((USB_DT_CONFIG << 8) | 0);
			len = sizeof (struct usb_config_descriptor);
			len += sizeof (struct usb_interface_descriptor);
			break;
		case 7:		// get interface descriptor (ALWAYS STALLS)
			req.wValue = cpu_to_le16 (USB_DT_INTERFACE << 8);
			// interface == 0
			len = sizeof (struct usb_interface_descriptor);
916
			expected = -EPIPE;
Linus Torvalds's avatar
Linus Torvalds committed
917
918
919
			break;
		// NOTE: two consecutive stalls in the queue here.
		// that tests fault recovery a bit more aggressively.
920
		case 8:		// clear endpoint halt (MAY STALL)
Linus Torvalds's avatar
Linus Torvalds committed
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
			req.bRequest = USB_REQ_CLEAR_FEATURE;
			req.bRequestType = USB_RECIP_ENDPOINT;
			// wValue 0 == ep halt
			// wIndex 0 == ep0 (shouldn't halt!)
			len = 0;
			pipe = usb_sndctrlpipe (udev, 0);
			expected = EPIPE;
			break;
		case 9:		// get endpoint status
			req.bRequest = USB_REQ_GET_STATUS;
			req.bRequestType = USB_DIR_IN|USB_RECIP_ENDPOINT;
			// endpoint 0
			len = 2;
			break;
		case 10:	// trigger short read (EREMOTEIO)
			req.wValue = cpu_to_le16 ((USB_DT_CONFIG << 8) | 0);
			len = 1024;
			expected = -EREMOTEIO;
			break;
		// NOTE: two consecutive _different_ faults in the queue.
		case 11:	// get endpoint descriptor (ALWAYS STALLS)
			req.wValue = cpu_to_le16 (USB_DT_ENDPOINT << 8);
			// endpoint == 0
			len = sizeof (struct usb_interface_descriptor);
			expected = EPIPE;
			break;
		// NOTE: sometimes even a third fault in the queue!
		case 12:	// get string 0 descriptor (MAY STALL)
			req.wValue = cpu_to_le16 (USB_DT_STRING << 8);
			// string == 0, for language IDs
			len = sizeof (struct usb_interface_descriptor);
			// may succeed when > 4 languages
			expected = EREMOTEIO;	// or EPIPE, if no strings
			break;
		case 13:	// short read, resembling case 10
			req.wValue = cpu_to_le16 ((USB_DT_CONFIG << 8) | 0);
			// last data packet "should" be DATA1, not DATA0
			len = 1024 - udev->descriptor.bMaxPacketSize0;
			expected = -EREMOTEIO;
			break;
		case 14:	// short read; try to fill the last packet
			req.wValue = cpu_to_le16 ((USB_DT_DEVICE << 8) | 0);
963
			/* device descriptor size == 18 bytes */
Linus Torvalds's avatar
Linus Torvalds committed
964
965
966
967
968
969
970
971
			len = udev->descriptor.bMaxPacketSize0;
			switch (len) {
			case 8:		len = 24; break;
			case 16:	len = 32; break;
			}
			expected = -EREMOTEIO;
			break;
		default:
972
			ERROR(dev, "bogus number of ctrl queue testcases!\n");
Linus Torvalds's avatar
Linus Torvalds committed
973
974
975
976
977
978
979
980
			context.status = -EINVAL;
			goto cleanup;
		}
		req.wLength = cpu_to_le16 (len);
		urb [i] = u = simple_alloc_urb (udev, pipe, len);
		if (!u)
			goto cleanup;

981
		reqp = usb_buffer_alloc (udev, sizeof *reqp, GFP_KERNEL,
Linus Torvalds's avatar
Linus Torvalds committed
982
983
984
985
986
987
988
				&u->setup_dma);
		if (!reqp)
			goto cleanup;
		reqp->setup = req;
		reqp->number = i % NUM_SUBCASES;
		reqp->expected = expected;
		u->setup_packet = (char *) &reqp->setup;
989
		u->transfer_flags |= URB_NO_SETUP_DMA_MAP;
Linus Torvalds's avatar
Linus Torvalds committed
990
991
992
993
994
995
996
997
998

		u->context = &context;
		u->complete = ctrl_complete;
	}

	/* queue the urbs */
	context.urb = urb;
	spin_lock_irq (&context.lock);
	for (i = 0; i < param->sglen; i++) {
999
		context.status = usb_submit_urb (urb [i], GFP_ATOMIC);
Linus Torvalds's avatar
Linus Torvalds committed
1000
		if (context.status != 0) {
1001
			ERROR(dev, "can't submit urb[%d], status %d\n",
Linus Torvalds's avatar
Linus Torvalds committed
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
					i, context.status);
			context.count = context.pending;
			break;
		}
		context.pending++;
	}
	spin_unlock_irq (&context.lock);

	/* FIXME  set timer and time out; provide a disconnect hook */

	/* wait for the last one to complete */
	if (context.pending > 0)
		wait_for_completion (&context.complete);

cleanup:
	for (i = 0; i < param->sglen; i++) {
		if (!urb [i])
			continue;
		urb [i]->dev = udev;
		if (urb [i]->setup_packet)
			usb_buffer_free (udev, sizeof (struct usb_ctrlrequest),
					urb [i]->setup_packet,
					urb [i]->setup_dma);
		simple_free_urb (urb [i]);
	}
	kfree (urb);
	return context.status;
}
#undef NUM_SUBCASES


/*-------------------------------------------------------------------------*/

1035
static void unlink1_callback (struct urb *urb)
Linus Torvalds's avatar
Linus Torvalds committed
1036
1037
1038
1039
1040
{
	int	status = urb->status;

	// we "know" -EPIPE (stall) never happens
	if (!status)
1041
		status = usb_submit_urb (urb, GFP_ATOMIC);
Linus Torvalds's avatar
Linus Torvalds committed
1042
1043
	if (status) {
		urb->status = status;
1044
		complete(urb->context);
Linus Torvalds's avatar
Linus Torvalds committed
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
	}
}

static int unlink1 (struct usbtest_dev *dev, int pipe, int size, int async)
{
	struct urb		*urb;
	struct completion	completion;
	int			retval = 0;

	init_completion (&completion);
	urb = simple_alloc_urb (testdev_to_usbdev (dev), pipe, size);
	if (!urb)
		return -ENOMEM;
	urb->context = &completion;
	urb->complete = unlink1_callback;

	/* keep the endpoint busy.  there are lots of hc/hcd-internal
	 * states, and testing should get to all of them over time.
	 *
	 * FIXME want additional tests for when endpoint is STALLing
	 * due to errors, or is just NAKing requests.
	 */
1067
	if ((retval = usb_submit_urb (urb, GFP_KERNEL)) != 0) {
1068
		dev_err(&dev->intf->dev, "submit fail %d\n", retval);
Linus Torvalds's avatar
Linus Torvalds committed
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
		return retval;
	}

	/* unlinking that should always work.  variable delay tests more
	 * hcd states and code paths, even with little other system load.
	 */
	msleep (jiffies % (2 * INTERRUPT_RATE));
	if (async) {
retry:
		retval = usb_unlink_urb (urb);
		if (retval == -EBUSY || retval == -EIDRM) {
			/* we can't unlink urbs while they're completing.
			 * or if they've completed, and we haven't resubmitted.
			 * "normal" drivers would prevent resubmission, but
			 * since we're testing unlink paths, we can't.
			 */
1085
			ERROR(dev,  "unlink retry\n");
Linus Torvalds's avatar
Linus Torvalds committed
1086
1087
1088
1089
1090
			goto retry;
		}
	} else
		usb_kill_urb (urb);
	if (!(retval == 0 || retval == -EINPROGRESS)) {
1091
		dev_err(&dev->intf->dev, "unlink fail %d\n", retval);
Linus Torvalds's avatar
Linus Torvalds committed
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
		return retval;
	}

	wait_for_completion (&completion);
	retval = urb->status;
	simple_free_urb (urb);

	if (async)
		return (retval == -ECONNRESET) ? 0 : retval - 1000;
	else
		return (retval == -ENOENT || retval == -EPERM) ?
				0 : retval - 2000;
}

static int unlink_simple (struct usbtest_dev *dev, int pipe, int len)
{
	int			retval = 0;

	/* test sync and async paths */
	retval = unlink1 (dev, pipe, len, 1);
	if (!retval)
		retval = unlink1 (dev, pipe, len, 0);
	return retval;
}

/*-------------------------------------------------------------------------*/

1119
static int verify_not_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
Linus Torvalds's avatar
Linus Torvalds committed
1120
1121
1122
1123
1124
1125
1126
{
	int	retval;
	u16	status;

	/* shouldn't look or act halted */
	retval = usb_get_status (urb->dev, USB_RECIP_ENDPOINT, ep, &status);
	if (retval < 0) {
1127
1128
		ERROR(tdev, "ep %02x couldn't get no-halt status, %d\n",
				ep, retval);
Linus Torvalds's avatar
Linus Torvalds committed
1129
1130
1131
		return retval;
	}
	if (status != 0) {
1132
		ERROR(tdev, "ep %02x bogus status: %04x != 0\n", ep, status);
Linus Torvalds's avatar
Linus Torvalds committed
1133
1134
		return -EINVAL;
	}
1135
	retval = simple_io(tdev, urb, 1, 0, 0, __func__);
Linus Torvalds's avatar
Linus Torvalds committed
1136
1137
1138
1139
1140
	if (retval != 0)
		return -EINVAL;
	return 0;
}

1141
static int verify_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
Linus Torvalds's avatar
Linus Torvalds committed
1142
1143
1144
1145
1146
1147
1148
{
	int	retval;
	u16	status;

	/* should look and act halted */
	retval = usb_get_status (urb->dev, USB_RECIP_ENDPOINT, ep, &status);
	if (retval < 0) {
1149
1150
		ERROR(tdev, "ep %02x couldn't get halt status, %d\n",
				ep, retval);
Linus Torvalds's avatar
Linus Torvalds committed
1151
1152
		return retval;
	}
1153
	le16_to_cpus(&status);
Linus Torvalds's avatar
Linus Torvalds committed
1154
	if (status != 1) {
1155
		ERROR(tdev, "ep %02x bogus status: %04x != 1\n", ep, status);
Linus Torvalds's avatar
Linus Torvalds committed
1156
1157
		return -EINVAL;
	}
1158
	retval = simple_io(tdev, urb, 1, 0, -EPIPE, __func__);
Linus Torvalds's avatar
Linus Torvalds committed
1159
1160
	if (retval != -EPIPE)
		return -EINVAL;
1161
	retval = simple_io(tdev, urb, 1, 0, -EPIPE, "verify_still_halted");
Linus Torvalds's avatar
Linus Torvalds committed
1162
1163
1164
1165
1166
	if (retval != -EPIPE)
		return -EINVAL;
	return 0;
}

1167
static int test_halt(struct usbtest_dev *tdev, int ep, struct urb *urb)
Linus Torvalds's avatar
Linus Torvalds committed
1168
1169
1170
1171
{
	int	retval;

	/* shouldn't look or act halted now */
1172
	retval = verify_not_halted(tdev, ep, urb);
Linus Torvalds's avatar
Linus Torvalds committed
1173
1174
1175
1176
1177
1178
1179
1180
1181
	if (retval < 0)
		return retval;

	/* set halt (protocol test only), verify it worked */
	retval = usb_control_msg (urb->dev, usb_sndctrlpipe (urb->dev, 0),
			USB_REQ_SET_FEATURE, USB_RECIP_ENDPOINT,
			USB_ENDPOINT_HALT, ep,
			NULL, 0, USB_CTRL_SET_TIMEOUT);
	if (retval < 0) {
1182
		ERROR(tdev, "ep %02x couldn't set halt, %d\n", ep, retval);
Linus Torvalds's avatar
Linus Torvalds committed
1183
1184
		return retval;
	}
1185
	retval = verify_halted(tdev, ep, urb);
Linus Torvalds's avatar
Linus Torvalds committed
1186
1187
1188
1189
1190
1191
	if (retval < 0)
		return retval;

	/* clear halt (tests API + protocol), verify it worked */
	retval = usb_clear_halt (urb->dev, urb->pipe);
	if (retval < 0) {
1192
		ERROR(tdev, "ep %02x couldn't clear halt, %d\n", ep, retval);
Linus Torvalds's avatar
Linus Torvalds committed
1193
1194
		return retval;
	}
1195
	retval = verify_not_halted(tdev, ep, urb);
Linus Torvalds's avatar
Linus Torvalds committed
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
	if (retval < 0)
		return retval;

	/* NOTE:  could also verify SET_INTERFACE clear halts ... */

	return 0;
}

static int halt_simple (struct usbtest_dev *dev)
{
	int		ep;
	int		retval = 0;
	struct urb	*urb;

	urb = simple_alloc_urb (testdev_to_usbdev (dev), 0, 512);
	if (urb == NULL)
		return -ENOMEM;

	if (dev->in_pipe) {
		ep = usb_pipeendpoint (dev->in_pipe) | USB_DIR_IN;
		urb->pipe = dev->in_pipe;
1217
		retval = test_halt(dev, ep, urb);
Linus Torvalds's avatar
Linus Torvalds committed
1218
1219
1220
1221
1222
1223
1224
		if (retval < 0)
			goto done;
	}

	if (dev->out_pipe) {
		ep = usb_pipeendpoint (dev->out_pipe);
		urb->pipe = dev->out_pipe;
1225
		retval = test_halt(dev, ep, urb);
Linus Torvalds's avatar
Linus Torvalds committed
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
	}
done:
	simple_free_urb (urb);
	return retval;
}

/*-------------------------------------------------------------------------*/

/* Control OUT tests use the vendor control requests from Intel's
 * USB 2.0 compliance test device:  write a buffer, read it back.
 *
 * Intel's spec only _requires_ that it work for one packet, which
 * is pretty weak.   Some HCDs place limits here; most devices will
 * need to be able to handle more than one OUT data packet.  We'll
 * try whatever we're told to try.
 */
static int ctrl_out (struct usbtest_dev *dev,
		unsigned count, unsigned length, unsigned vary)
{
1245
1246
	unsigned		i, j, len;
	int			retval;
Linus Torvalds's avatar
Linus Torvalds committed
1247
1248
1249
	u8			*buf;
	char			*what = "?";
	struct usb_device	*udev;
1250

David Brownell's avatar
David Brownell committed
1251
	if (length < 1 || length > 0xffff || vary >= length)
Linus Torvalds's avatar
Linus Torvalds committed
1252
1253
		return -EINVAL;

1254
	buf = kmalloc(length, GFP_KERNEL);
Linus Torvalds's avatar
Linus Torvalds committed
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
	if (!buf)
		return -ENOMEM;

	udev = testdev_to_usbdev (dev);
	len = length;
	retval = 0;

	/* NOTE:  hardware might well act differently if we pushed it
	 * with lots back-to-back queued requests.
	 */
	for (i = 0; i < count; i++) {
		/* write patterned data */
		for (j = 0; j < len; j++)
			buf [j] = i + j;
		retval = usb_control_msg (udev, usb_sndctrlpipe (udev,0),
				0x5b, USB_DIR_OUT|USB_TYPE_VENDOR,
				0, 0, buf, len, USB_CTRL_SET_TIMEOUT);
		if (retval != len) {
			what = "write";
David Brownell's avatar
David Brownell committed
1274
			if (retval >= 0) {
1275
				ERROR(dev, "ctrl_out, wlen %d (expected %d)\n",
David Brownell's avatar
David Brownell committed
1276
1277
1278
						retval, len);
				retval = -EBADMSG;
			}
Linus Torvalds's avatar
Linus Torvalds committed
1279
1280
1281
1282
1283
1284
1285
1286
1287
			break;
		}

		/* read it back -- assuming nothing intervened!!  */
		retval = usb_control_msg (udev, usb_rcvctrlpipe (udev,0),
				0x5c, USB_DIR_IN|USB_TYPE_VENDOR,
				0, 0, buf, len, USB_CTRL_GET_TIMEOUT);
		if (retval != len) {
			what = "read";
David Brownell's avatar
David Brownell committed
1288
			if (retval >= 0) {
1289
				ERROR(dev, "ctrl_out, rlen %d (expected %d)\n",
David Brownell's avatar
David Brownell committed
1290
1291
1292
						retval, len);
				retval = -EBADMSG;
			}
Linus Torvalds's avatar
Linus Torvalds committed
1293
1294
1295
1296
1297
1298
			break;
		}

		/* fail if we can't verify */
		for (j = 0; j < len; j++) {
			if (buf [j] != (u8) (i + j)) {
1299
				ERROR(dev, "ctrl_out, byte %d is %d not %d\n",
Linus Torvalds's avatar
Linus Torvalds committed
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
					j, buf [j], (u8) i + j);
				retval = -EBADMSG;
				break;
			}
		}
		if (retval < 0) {
			what = "verify";
			break;
		}

		len += vary;
David Brownell's avatar
David Brownell committed
1311
1312

		/* [real world] the "zero bytes IN" case isn't really used.
Joe Perches's avatar
Joe Perches committed
1313
		 * hardware can easily trip up in this weird case, since its
David Brownell's avatar
David Brownell committed
1314
1315
		 * status stage is IN, not OUT like other ep0in transfers.
		 */
Linus Torvalds's avatar
Linus Torvalds committed
1316
		if (len > length)
David Brownell's avatar
David Brownell committed
1317
			len = realworld ? 1 : 0;
Linus Torvalds's avatar
Linus Torvalds committed
1318
1319
1320
	}

	if (retval < 0)
1321
		ERROR (dev, "ctrl_out %s failed, code %d, count %d\n",
Linus Torvalds's avatar
Linus Torvalds committed
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
			what, retval, i);

	kfree (buf);
	return retval;
}

/*-------------------------------------------------------------------------*/

/* ISO tests ... mimics common usage
 *  - buffer length is split into N packets (mostly maxpacket sized)
 *  - multi-buffers according to sglen
 */

struct iso_context {
	unsigned		count;
	unsigned		pending;
	spinlock_t		lock;
	struct completion	done;
1340
	int			submit_error;
Linus Torvalds's avatar
Linus Torvalds committed
1341
	unsigned long		errors;
1342
	unsigned long		packet_count;
Linus Torvalds's avatar
Linus Torvalds committed
1343
1344
1345
	struct usbtest_dev	*dev;
};

1346
static void iso_callback (struct urb *urb)
Linus Torvalds's avatar
Linus Torvalds committed
1347
1348
1349
1350
1351
1352
{
	struct iso_context	*ctx = urb->context;

	spin_lock(&ctx->lock);
	ctx->count--;

1353
	ctx->packet_count += urb->number_of_packets;
Linus Torvalds's avatar
Linus Torvalds committed
1354
1355
	if (urb->error_count > 0)
		ctx->errors += urb->error_count;
1356
1357
	else if (urb->status != 0)
		ctx->errors += urb->number_of_packets;
Linus Torvalds's avatar
Linus Torvalds committed
1358

1359
1360
	if (urb->status == 0 && ctx->count > (ctx->pending - 1)
			&& !ctx->submit_error) {
Linus Torvalds's avatar
Linus Torvalds committed
1361
1362
1363
1364
1365
		int status = usb_submit_urb (urb, GFP_ATOMIC);
		switch (status) {
		case 0:
			goto done;
		default:
1366
			dev_err(&ctx->dev->intf->dev,
Linus Torvalds's avatar
Linus Torvalds committed
1367
1368
1369
1370
					"iso resubmit err %d\n",
					status);
			/* FALLTHROUGH */
		case -ENODEV:			/* disconnected */
1371
1372
		case -ESHUTDOWN:		/* endpoint disabled */
			ctx->submit_error = 1;
Linus Torvalds's avatar
Linus Torvalds committed
1373
1374
1375
1376
1377
1378
1379
1380
			break;
		}
	}
	simple_free_urb (urb);

	ctx->pending--;
	if (ctx->pending == 0) {
		if (ctx->errors)
1381
			dev_err(&ctx->dev->intf->dev,
1382
1383
				"iso test, %lu errors out of %lu\n",
				ctx->errors, ctx->packet_count);
Linus Torvalds's avatar
Linus Torvalds committed
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
		complete (&ctx->done);
	}
done:
	spin_unlock(&ctx->lock);
}

static struct urb *iso_alloc_urb (
	struct usb_device	*udev,
	int			pipe,
	struct usb_endpoint_descriptor	*desc,
	long			bytes
)
{
	struct urb		*urb;
	unsigned		i, maxp, packets;

	if (bytes < 0 || !desc)
		return NULL;
	maxp = 0x7ff & le16_to_cpu(desc->wMaxPacketSize);
	maxp *= 1 + (0x3 & (le16_to_cpu(desc->wMaxPacketSize) >> 11));
Julia Lawall's avatar
Julia Lawall committed
1404
	packets = DIV_ROUND_UP(bytes, maxp);
Linus Torvalds's avatar
Linus Torvalds committed
1405

1406
	urb = usb_alloc_urb (packets, GFP_KERNEL);
Linus Torvalds's avatar
Linus Torvalds committed
1407
1408
1409
1410
1411
1412
1413
	if (!urb)
		return urb;
	urb->dev = udev;
	urb->pipe = pipe;

	urb->number_of_packets = packets;
	urb->transfer_buffer_length = bytes;
1414
	urb->transfer_buffer = usb_buffer_alloc (udev, bytes, GFP_KERNEL,
Linus Torvalds's avatar
Linus Torvalds committed
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
			&urb->transfer_dma);
	if (!urb->transfer_buffer) {
		usb_free_urb (urb);
		return NULL;
	}
	memset (urb->transfer_buffer, 0, bytes);
	for (i = 0; i < packets; i++) {
		/* here, only the last packet will be short */
		urb->iso_frame_desc[i].length = min ((unsigned) bytes, maxp);
		bytes -= urb->iso_frame_desc[i].length;

		urb->iso_frame_desc[i].offset = maxp * i;
	}

	urb->complete = iso_callback;
	// urb->context = SET BY CALLER
	urb->interval = 1 << (desc->bInterval - 1);
	urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
	return urb;
}

static int
test_iso_queue (struct usbtest_dev *dev, struct usbtest_param *param,
		int pipe, struct usb_endpoint_descriptor *desc)
{
	struct iso_context	context;
	struct usb_device	*udev;
	unsigned		i;
	unsigned long		packets = 0;
1444
	int			status = 0;
Linus Torvalds's avatar
Linus Torvalds committed
1445
1446
1447
1448
1449
	struct urb		*urbs[10];	/* FIXME no limit */

	if (param->sglen > 10)
		return -EDOM;

1450
	memset(&context, 0, sizeof context);
Linus Torvalds's avatar
Linus Torvalds committed
1451
1452
1453
1454
1455
1456
1457
	context.count = param->iterations * param->sglen;
	context.dev = dev;
	init_completion (&context.done);
	spin_lock_init (&context.lock);

	memset (urbs, 0, sizeof urbs);
	udev = testdev_to_usbdev (dev);
1458
	dev_info(&dev->intf->dev,
Linus Torvalds's avatar
Linus Torvalds committed
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
		"... iso period %d %sframes, wMaxPacket %04x\n",
		1 << (desc->bInterval - 1),
		(udev->speed == USB_SPEED_HIGH) ? "micro" : "",
		le16_to_cpu(desc->wMaxPacketSize));

	for (i = 0; i < param->sglen; i++) {
		urbs [i] = iso_alloc_urb (udev, pipe, desc,
				param->length);
		if (!urbs [i]) {
			status = -ENOMEM;
			goto fail;
		}
		packets += urbs[i]->number_of_packets;
		urbs [i]->context = &context;
	}
	packets *= param->iterations;
1475
	dev_info(&dev->intf->dev,
Linus Torvalds's avatar
Linus Torvalds committed
1476
1477
1478
1479
1480
1481
1482
		"... total %lu msec (%lu packets)\n",
		(packets * (1 << (desc->bInterval - 1)))
			/ ((udev->speed == USB_SPEED_HIGH) ? 8 : 1),
		packets);

	spin_lock_irq (&context.lock);
	for (i = 0; i < param->sglen; i++) {
1483
		++context.pending;
1484
		status = usb_submit_urb (urbs [i], GFP_ATOMIC);
Linus Torvalds's avatar
Linus Torvalds committed
1485
1486
1487
1488
1489
1490
1491
1492
1493
		if (status < 0) {
			ERROR (dev, "submit iso[%d], error %d\n", i, status);
			if (i == 0) {
				spin_unlock_irq (&context.lock);
				goto fail;
			}

			simple_free_urb (urbs [i]);
			context.pending--;
1494
1495
			context.submit_error = 1;
			break;
Linus Torvalds's avatar
Linus Torvalds committed
1496
1497
1498
1499
1500
		}
	}
	spin_unlock_irq (&context.lock);

	wait_for_completion (&context.done);
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513

	/*
	 * Isochronous transfers are expected to fail sometimes.  As an
	 * arbitrary limit, we will report an error if any submissions
	 * fail or if the transfer failure rate is > 10%.
	 */
	if (status != 0)
		;
	else if (context.submit_error)
		status = -EACCES;
	else if (context.errors > context.packet_count / 10)
		status = -EIO;
	return status;
Linus Torvalds's avatar
Linus Torvalds committed
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536

fail:
	for (i = 0; i < param->sglen; i++) {
		if (urbs [i])
			simple_free_urb (urbs [i]);
	}
	return status;
}

/*-------------------------------------------------------------------------*/

/* We only have this one interface to user space, through usbfs.
 * User mode code can scan usbfs to find N different devices (maybe on
 * different busses) to use when testing, and allocate one thread per
 * test.  So discovery is simplified, and we have no device naming issues.
 *
 * Don't use these only as stress/load tests.  Use them along with with
 * other USB bus activity:  plugging, unplugging, mousing, mp3 playback,
 * video capture, and so on.  Run different tests at different times, in
 * different sequences.  Nothing here should interact with other devices,
 * except indirectly by consuming USB bandwidth and CPU resources for test
 * threads and request completion.  But the only way to know that for sure
 * is to test when HC queues are in use by many devices.
1537
1538
1539
1540
1541
1542
1543
 *
 * WARNING:  Because usbfs grabs udev->dev.sem before calling this ioctl(),
 * it locks out usbcore in certain code paths.  Notably, if you disconnect
 * the device-under-test, khubd will wait block forever waiting for the
 * ioctl to complete ... so that usb_disconnect() can abort the pending
 * urbs and then call usbtest_disconnect().  To abort a test, you're best
 * off just killing the userspace task and waiting for it to exit.
Linus Torvalds's avatar
Linus Torvalds committed
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
 */

static int
usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
{
	struct usbtest_dev	*dev = usb_get_intfdata (intf);
	struct usb_device	*udev = testdev_to_usbdev (dev);
	struct usbtest_param	*param = buf;
	int			retval = -EOPNOTSUPP;
	struct urb		*urb;
	struct scatterlist	*sg;
	struct usb_sg_request	req;
	struct timeval		start;
	unsigned		i;

	// FIXME USBDEVFS_CONNECTINFO doesn't say how fast the device is.

	if (code != USBTEST_REQUEST)
		return -EOPNOTSUPP;

	if (param->iterations <= 0 || param->length < 0
			|| param->sglen < 0 || param->vary < 0)
		return -EINVAL;

1568
	if (mutex_lock_interruptible(&dev->lock))
Linus Torvalds's avatar
Linus Torvalds committed
1569
1570
		return -ERESTARTSYS;

1571
1572
	/* FIXME: What if a system sleep starts while a test is running? */
	if (!intf->is_active) {
1573
		mutex_unlock(&dev->lock);
David Brownell's avatar
David Brownell committed
1574
1575
1576
		return -EHOSTUNREACH;
	}

Linus Torvalds's avatar
Linus Torvalds committed
1577
1578
1579
1580
1581
	/* some devices, like ez-usb default devices, need a non-default
	 * altsetting to have any active endpoints.  some tests change
	 * altsettings; force a default so most tests don't need to check.
	 */
	if (dev->info->alt >= 0) {
1582
		int	res;
Linus Torvalds's avatar
Linus Torvalds committed
1583
1584

		if (intf->altsetting->desc.bInterfaceNumber) {
1585
			mutex_unlock(&dev->lock);
Linus Torvalds's avatar
Linus Torvalds committed
1586
1587
1588
1589
1590
1591
1592
			return -ENODEV;
		}
		res = set_altsetting (dev, dev->info->alt);
		if (res) {
			dev_err (&intf->dev,
					"set altsetting to %d failed, %d\n",
					dev->info->alt, res);
1593
			mutex_unlock(&dev->lock);
Linus Torvalds's avatar
Linus Torvalds committed
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
			return res;
		}
	}

	/*
	 * Just a bunch of test cases that every HCD is expected to handle.
	 *
	 * Some may need specific firmware, though it'd be good to have
	 * one firmware image to handle all the test cases.
	 *
	 * FIXME add more tests!  cancel requests, verify the data, control
	 * queueing, concurrent read+write threads, and so on.
	 */
	do_gettimeofday (&start);
	switch (param->test_num) {

	case 0:
1611
		dev_info(&intf->dev, "TEST 0:  NOP\n");
Linus Torvalds's avatar
Linus Torvalds committed
1612
1613
1614
1615
1616
1617
1618
		retval = 0;
		break;

	/* Simple non-queued bulk I/O tests */
	case 1:
		if (dev->out_pipe == 0)
			break;
1619
		dev_info(&intf->dev,
Linus Torvalds's avatar
Linus Torvalds committed
1620
1621
1622
1623
1624
1625
1626
1627
				"TEST 1:  write %d bytes %u times\n",
				param->length, param->iterations);
		urb = simple_alloc_urb (udev, dev->out_pipe, param->length);
		if (!urb) {
			retval = -ENOMEM;
			break;
		}
		// FIRMWARE:  bulk sink (maybe accepts short writes)
1628
		retval = simple_io(dev, urb, param->iterations, 0, 0, "test1");
Linus Torvalds's avatar
Linus Torvalds committed
1629
1630
1631
1632
1633
		simple_free_urb (urb);
		break;
	case 2:
		if (dev->in_pipe == 0)
			break;
1634
		dev_info(&intf->dev,
Linus Torvalds's avatar
Linus Torvalds committed
1635
1636
1637
1638
1639
1640
1641
1642
				"TEST 2:  read %d bytes %u times\n",
				param->length, param->iterations);
		urb = simple_alloc_urb (udev, dev->in_pipe, param->length);
		if (!urb) {
			retval = -ENOMEM;
			break;
		}
		// FIRMWARE:  bulk source (maybe generates short writes)
1643
		retval = simple_io(dev, urb, param->iterations, 0, 0, "test2");
Linus Torvalds's avatar
Linus Torvalds committed
1644
1645
1646
1647
1648
		simple_free_urb (urb);
		break;
	case 3:
		if (dev->out_pipe == 0 || param->vary == 0)
			break;
1649
		dev_info(&intf->dev,
Linus Torvalds's avatar
Linus Torvalds committed
1650
1651
1652
1653
1654
1655
1656
1657
				"TEST 3:  write/%d 0..%d bytes %u times\n",
				param->vary, param->length, param->iterations);
		urb = simple_alloc_urb (udev, dev->out_pipe, param->length);
		if (!urb) {
			retval = -ENOMEM;
			break;
		}
		// FIRMWARE:  bulk sink (maybe accepts short writes)
1658
		retval = simple_io(dev, urb, param->iterations, param->vary,
Linus Torvalds's avatar
Linus Torvalds committed
1659
1660
1661
1662
1663
1664
					0, "test3");
		simple_free_urb (urb);
		break;
	case 4:
		if (dev->in_pipe == 0 || param->vary == 0)
			break;
1665
		dev_info(&intf->dev,
Linus Torvalds's avatar
Linus Torvalds committed
1666
1667
1668
1669
1670
1671
1672
1673
				"TEST 4:  read/%d 0..%d bytes %u times\n",
				param->vary, param->length, param->iterations);
		urb = simple_alloc_urb (udev, dev->in_pipe, param->length);
		if (!urb) {
			retval = -ENOMEM;
			break;
		}
		// FIRMWARE:  bulk source (maybe generates short writes)
1674
		retval = simple_io(dev, urb, param->iterations, param->vary,
Linus Torvalds's avatar
Linus Torvalds committed
1675
1676
1677
1678
1679
1680
1681
1682
					0, "test4");
		simple_free_urb (urb);
		break;

	/* Queued bulk I/O tests */
	case 5:
		if (dev->out_pipe == 0 || param->sglen == 0)
			break;
1683
		dev_info(&intf->dev,
Linus Torvalds's avatar
Linus Torvalds committed
1684
1685
1686
1687
1688
1689
1690
1691
1692
			"TEST 5:  write %d sglists %d entries of %d bytes\n",
				param->iterations,
				param->sglen, param->length);
		sg = alloc_sglist (param->sglen, param->length, 0);
		if (!sg) {
			retval = -ENOMEM;
			break;
		}
		// FIRMWARE:  bulk sink (maybe accepts short writes)
1693
		retval = perform_sglist(dev, param->iterations, dev->out_pipe,
Linus Torvalds's avatar
Linus Torvalds committed
1694
1695
1696
1697
1698
1699
1700
				&req, sg, param->sglen);
		free_sglist (sg, param->sglen);
		break;

	case 6:
		if (dev->in_pipe == 0 || param->sglen == 0)
			break;
1701
		dev_info(&intf->dev,
Linus Torvalds's avatar
Linus Torvalds committed
1702
1703
1704
1705
1706
1707
1708
1709
1710
			"TEST 6:  read %d sglists %d entries of %d bytes\n",
				param->iterations,
				param->sglen, param->length);
		sg = alloc_sglist (param->sglen, param->length, 0);
		if (!sg) {
			retval = -ENOMEM;
			break;
		}
		// FIRMWARE:  bulk source (maybe generates short writes)
1711
		retval = perform_sglist(dev, param->iterations, dev->in_pipe,
Linus Torvalds's avatar
Linus Torvalds committed
1712
1713
1714
1715
1716
1717
				&req, sg, param->sglen);
		free_sglist (sg, param->sglen);
		break;
	case 7:
		if (dev->out_pipe == 0 || param->sglen == 0 || param->vary == 0)
			break;
1718
		dev_info(&intf->dev,
Linus Torvalds's avatar
Linus Torvalds committed
1719
1720
1721
1722
1723
1724
1725
1726
1727
			"TEST 7:  write/%d %d sglists %d entries 0..%d bytes\n",
				param->vary, param->iterations,
				param->sglen, param->length);
		sg = alloc_sglist (param->sglen, param->length, param->vary);
		if (!sg) {
			retval = -ENOMEM;
			break;
		}
		// FIRMWARE:  bulk sink (maybe accepts short writes)
1728
		retval = perform_sglist(dev, param->iterations, dev->out_pipe,
Linus Torvalds's avatar
Linus Torvalds committed
1729
1730
1731
1732
1733
1734
				&req, sg, param->sglen);
		free_sglist (sg, param->sglen);
		break;
	case 8:
		if (dev