Avoid beyond bounds copy while caching ACL
[zen-stable.git] / drivers / usb / gadget / f_sourcesink.c
blob7aa7ac82c02c187cfd6af99eea6c4a937ad2e993
1 /*
2 * f_sourcesink.c - USB peripheral source/sink configuration driver
4 * Copyright (C) 2003-2008 David Brownell
5 * Copyright (C) 2008 by Nokia Corporation
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
13 /* #define VERBOSE_DEBUG */
15 #include <linux/slab.h>
16 #include <linux/kernel.h>
17 #include <linux/device.h>
18 #include <linux/module.h>
20 #include "g_zero.h"
21 #include "gadget_chips.h"
25 * SOURCE/SINK FUNCTION ... a primary testing vehicle for USB peripheral
26 * controller drivers.
28 * This just sinks bulk packets OUT to the peripheral and sources them IN
29 * to the host, optionally with specific data patterns for integrity tests.
30 * As such it supports basic functionality and load tests.
32 * In terms of control messaging, this supports all the standard requests
33 * plus two that support control-OUT tests. If the optional "autoresume"
34 * mode is enabled, it provides good functional coverage for the "USBCV"
35 * test harness from USB-IF.
37 * Note that because this doesn't queue more than one request at a time,
38 * some other function must be used to test queueing logic. The network
39 * link (g_ether) is the best overall option for that, since its TX and RX
40 * queues are relatively independent, will receive a range of packet sizes,
41 * and can often be made to run out completely. Those issues are important
42 * when stress testing peripheral controller drivers.
45 * This is currently packaged as a configuration driver, which can't be
46 * combined with other functions to make composite devices. However, it
47 * can be combined with other independent configurations.
49 struct f_sourcesink {
50 struct usb_function function;
52 struct usb_ep *in_ep;
53 struct usb_ep *out_ep;
56 static inline struct f_sourcesink *func_to_ss(struct usb_function *f)
58 return container_of(f, struct f_sourcesink, function);
61 static unsigned pattern;
62 module_param(pattern, uint, 0);
63 MODULE_PARM_DESC(pattern, "0 = all zeroes, 1 = mod63 ");
65 /*-------------------------------------------------------------------------*/
67 static struct usb_interface_descriptor source_sink_intf = {
68 .bLength = sizeof source_sink_intf,
69 .bDescriptorType = USB_DT_INTERFACE,
71 .bNumEndpoints = 2,
72 .bInterfaceClass = USB_CLASS_VENDOR_SPEC,
73 /* .iInterface = DYNAMIC */
76 /* full speed support: */
78 static struct usb_endpoint_descriptor fs_source_desc = {
79 .bLength = USB_DT_ENDPOINT_SIZE,
80 .bDescriptorType = USB_DT_ENDPOINT,
82 .bEndpointAddress = USB_DIR_IN,
83 .bmAttributes = USB_ENDPOINT_XFER_BULK,
86 static struct usb_endpoint_descriptor fs_sink_desc = {
87 .bLength = USB_DT_ENDPOINT_SIZE,
88 .bDescriptorType = USB_DT_ENDPOINT,
90 .bEndpointAddress = USB_DIR_OUT,
91 .bmAttributes = USB_ENDPOINT_XFER_BULK,
94 static struct usb_descriptor_header *fs_source_sink_descs[] = {
95 (struct usb_descriptor_header *) &source_sink_intf,
96 (struct usb_descriptor_header *) &fs_sink_desc,
97 (struct usb_descriptor_header *) &fs_source_desc,
98 NULL,
101 /* high speed support: */
103 static struct usb_endpoint_descriptor hs_source_desc = {
104 .bLength = USB_DT_ENDPOINT_SIZE,
105 .bDescriptorType = USB_DT_ENDPOINT,
107 .bmAttributes = USB_ENDPOINT_XFER_BULK,
108 .wMaxPacketSize = cpu_to_le16(512),
111 static struct usb_endpoint_descriptor hs_sink_desc = {
112 .bLength = USB_DT_ENDPOINT_SIZE,
113 .bDescriptorType = USB_DT_ENDPOINT,
115 .bmAttributes = USB_ENDPOINT_XFER_BULK,
116 .wMaxPacketSize = cpu_to_le16(512),
119 static struct usb_descriptor_header *hs_source_sink_descs[] = {
120 (struct usb_descriptor_header *) &source_sink_intf,
121 (struct usb_descriptor_header *) &hs_source_desc,
122 (struct usb_descriptor_header *) &hs_sink_desc,
123 NULL,
126 /* super speed support: */
128 static struct usb_endpoint_descriptor ss_source_desc = {
129 .bLength = USB_DT_ENDPOINT_SIZE,
130 .bDescriptorType = USB_DT_ENDPOINT,
132 .bmAttributes = USB_ENDPOINT_XFER_BULK,
133 .wMaxPacketSize = cpu_to_le16(1024),
136 struct usb_ss_ep_comp_descriptor ss_source_comp_desc = {
137 .bLength = USB_DT_SS_EP_COMP_SIZE,
138 .bDescriptorType = USB_DT_SS_ENDPOINT_COMP,
139 .bMaxBurst = 0,
140 .bmAttributes = 0,
141 .wBytesPerInterval = 0,
144 static struct usb_endpoint_descriptor ss_sink_desc = {
145 .bLength = USB_DT_ENDPOINT_SIZE,
146 .bDescriptorType = USB_DT_ENDPOINT,
148 .bmAttributes = USB_ENDPOINT_XFER_BULK,
149 .wMaxPacketSize = cpu_to_le16(1024),
152 struct usb_ss_ep_comp_descriptor ss_sink_comp_desc = {
153 .bLength = USB_DT_SS_EP_COMP_SIZE,
154 .bDescriptorType = USB_DT_SS_ENDPOINT_COMP,
155 .bMaxBurst = 0,
156 .bmAttributes = 0,
157 .wBytesPerInterval = 0,
160 static struct usb_descriptor_header *ss_source_sink_descs[] = {
161 (struct usb_descriptor_header *) &source_sink_intf,
162 (struct usb_descriptor_header *) &ss_source_desc,
163 (struct usb_descriptor_header *) &ss_source_comp_desc,
164 (struct usb_descriptor_header *) &ss_sink_desc,
165 (struct usb_descriptor_header *) &ss_sink_comp_desc,
166 NULL,
169 /* function-specific strings: */
171 static struct usb_string strings_sourcesink[] = {
172 [0].s = "source and sink data",
173 { } /* end of list */
176 static struct usb_gadget_strings stringtab_sourcesink = {
177 .language = 0x0409, /* en-us */
178 .strings = strings_sourcesink,
181 static struct usb_gadget_strings *sourcesink_strings[] = {
182 &stringtab_sourcesink,
183 NULL,
186 /*-------------------------------------------------------------------------*/
188 static int __init
189 sourcesink_bind(struct usb_configuration *c, struct usb_function *f)
191 struct usb_composite_dev *cdev = c->cdev;
192 struct f_sourcesink *ss = func_to_ss(f);
193 int id;
195 /* allocate interface ID(s) */
196 id = usb_interface_id(c, f);
197 if (id < 0)
198 return id;
199 source_sink_intf.bInterfaceNumber = id;
201 /* allocate endpoints */
202 ss->in_ep = usb_ep_autoconfig(cdev->gadget, &fs_source_desc);
203 if (!ss->in_ep) {
204 autoconf_fail:
205 ERROR(cdev, "%s: can't autoconfigure on %s\n",
206 f->name, cdev->gadget->name);
207 return -ENODEV;
209 ss->in_ep->driver_data = cdev; /* claim */
211 ss->out_ep = usb_ep_autoconfig(cdev->gadget, &fs_sink_desc);
212 if (!ss->out_ep)
213 goto autoconf_fail;
214 ss->out_ep->driver_data = cdev; /* claim */
216 /* support high speed hardware */
217 if (gadget_is_dualspeed(c->cdev->gadget)) {
218 hs_source_desc.bEndpointAddress =
219 fs_source_desc.bEndpointAddress;
220 hs_sink_desc.bEndpointAddress =
221 fs_sink_desc.bEndpointAddress;
222 f->hs_descriptors = hs_source_sink_descs;
225 /* support super speed hardware */
226 if (gadget_is_superspeed(c->cdev->gadget)) {
227 ss_source_desc.bEndpointAddress =
228 fs_source_desc.bEndpointAddress;
229 ss_sink_desc.bEndpointAddress =
230 fs_sink_desc.bEndpointAddress;
231 f->ss_descriptors = ss_source_sink_descs;
234 DBG(cdev, "%s speed %s: IN/%s, OUT/%s\n",
235 (gadget_is_superspeed(c->cdev->gadget) ? "super" :
236 (gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full")),
237 f->name, ss->in_ep->name, ss->out_ep->name);
238 return 0;
241 static void
242 sourcesink_unbind(struct usb_configuration *c, struct usb_function *f)
244 kfree(func_to_ss(f));
247 /* optionally require specific source/sink data patterns */
248 static int check_read_data(struct f_sourcesink *ss, struct usb_request *req)
250 unsigned i;
251 u8 *buf = req->buf;
252 struct usb_composite_dev *cdev = ss->function.config->cdev;
254 for (i = 0; i < req->actual; i++, buf++) {
255 switch (pattern) {
257 /* all-zeroes has no synchronization issues */
258 case 0:
259 if (*buf == 0)
260 continue;
261 break;
263 /* "mod63" stays in sync with short-terminated transfers,
264 * OR otherwise when host and gadget agree on how large
265 * each usb transfer request should be. Resync is done
266 * with set_interface or set_config. (We *WANT* it to
267 * get quickly out of sync if controllers or their drivers
268 * stutter for any reason, including buffer duplcation...)
270 case 1:
271 if (*buf == (u8)(i % 63))
272 continue;
273 break;
275 ERROR(cdev, "bad OUT byte, buf[%d] = %d\n", i, *buf);
276 usb_ep_set_halt(ss->out_ep);
277 return -EINVAL;
279 return 0;
282 static void reinit_write_data(struct usb_ep *ep, struct usb_request *req)
284 unsigned i;
285 u8 *buf = req->buf;
287 switch (pattern) {
288 case 0:
289 memset(req->buf, 0, req->length);
290 break;
291 case 1:
292 for (i = 0; i < req->length; i++)
293 *buf++ = (u8) (i % 63);
294 break;
298 static void source_sink_complete(struct usb_ep *ep, struct usb_request *req)
300 struct f_sourcesink *ss = ep->driver_data;
301 struct usb_composite_dev *cdev = ss->function.config->cdev;
302 int status = req->status;
304 switch (status) {
306 case 0: /* normal completion? */
307 if (ep == ss->out_ep) {
308 check_read_data(ss, req);
309 memset(req->buf, 0x55, req->length);
310 } else
311 reinit_write_data(ep, req);
312 break;
314 /* this endpoint is normally active while we're configured */
315 case -ECONNABORTED: /* hardware forced ep reset */
316 case -ECONNRESET: /* request dequeued */
317 case -ESHUTDOWN: /* disconnect from host */
318 VDBG(cdev, "%s gone (%d), %d/%d\n", ep->name, status,
319 req->actual, req->length);
320 if (ep == ss->out_ep)
321 check_read_data(ss, req);
322 free_ep_req(ep, req);
323 return;
325 case -EOVERFLOW: /* buffer overrun on read means that
326 * we didn't provide a big enough
327 * buffer.
329 default:
330 #if 1
331 DBG(cdev, "%s complete --> %d, %d/%d\n", ep->name,
332 status, req->actual, req->length);
333 #endif
334 case -EREMOTEIO: /* short read */
335 break;
338 status = usb_ep_queue(ep, req, GFP_ATOMIC);
339 if (status) {
340 ERROR(cdev, "kill %s: resubmit %d bytes --> %d\n",
341 ep->name, req->length, status);
342 usb_ep_set_halt(ep);
343 /* FIXME recover later ... somehow */
347 static int source_sink_start_ep(struct f_sourcesink *ss, bool is_in)
349 struct usb_ep *ep;
350 struct usb_request *req;
351 int status;
353 ep = is_in ? ss->in_ep : ss->out_ep;
354 req = alloc_ep_req(ep);
355 if (!req)
356 return -ENOMEM;
358 req->complete = source_sink_complete;
359 if (is_in)
360 reinit_write_data(ep, req);
361 else
362 memset(req->buf, 0x55, req->length);
364 status = usb_ep_queue(ep, req, GFP_ATOMIC);
365 if (status) {
366 struct usb_composite_dev *cdev;
368 cdev = ss->function.config->cdev;
369 ERROR(cdev, "start %s %s --> %d\n",
370 is_in ? "IN" : "OUT",
371 ep->name, status);
372 free_ep_req(ep, req);
375 return status;
378 static void disable_source_sink(struct f_sourcesink *ss)
380 struct usb_composite_dev *cdev;
382 cdev = ss->function.config->cdev;
383 disable_endpoints(cdev, ss->in_ep, ss->out_ep);
384 VDBG(cdev, "%s disabled\n", ss->function.name);
387 static int
388 enable_source_sink(struct usb_composite_dev *cdev, struct f_sourcesink *ss)
390 int result = 0;
391 struct usb_ep *ep;
393 /* one endpoint writes (sources) zeroes IN (to the host) */
394 ep = ss->in_ep;
395 result = config_ep_by_speed(cdev->gadget, &(ss->function), ep);
396 if (result)
397 return result;
398 result = usb_ep_enable(ep);
399 if (result < 0)
400 return result;
401 ep->driver_data = ss;
403 result = source_sink_start_ep(ss, true);
404 if (result < 0) {
405 fail:
406 ep = ss->in_ep;
407 usb_ep_disable(ep);
408 ep->driver_data = NULL;
409 return result;
412 /* one endpoint reads (sinks) anything OUT (from the host) */
413 ep = ss->out_ep;
414 result = config_ep_by_speed(cdev->gadget, &(ss->function), ep);
415 if (result)
416 goto fail;
417 result = usb_ep_enable(ep);
418 if (result < 0)
419 goto fail;
420 ep->driver_data = ss;
422 result = source_sink_start_ep(ss, false);
423 if (result < 0) {
424 usb_ep_disable(ep);
425 ep->driver_data = NULL;
426 goto fail;
429 DBG(cdev, "%s enabled\n", ss->function.name);
430 return result;
433 static int sourcesink_set_alt(struct usb_function *f,
434 unsigned intf, unsigned alt)
436 struct f_sourcesink *ss = func_to_ss(f);
437 struct usb_composite_dev *cdev = f->config->cdev;
439 /* we know alt is zero */
440 if (ss->in_ep->driver_data)
441 disable_source_sink(ss);
442 return enable_source_sink(cdev, ss);
445 static void sourcesink_disable(struct usb_function *f)
447 struct f_sourcesink *ss = func_to_ss(f);
449 disable_source_sink(ss);
452 /*-------------------------------------------------------------------------*/
454 static int __init sourcesink_bind_config(struct usb_configuration *c)
456 struct f_sourcesink *ss;
457 int status;
459 ss = kzalloc(sizeof *ss, GFP_KERNEL);
460 if (!ss)
461 return -ENOMEM;
463 ss->function.name = "source/sink";
464 ss->function.descriptors = fs_source_sink_descs;
465 ss->function.bind = sourcesink_bind;
466 ss->function.unbind = sourcesink_unbind;
467 ss->function.set_alt = sourcesink_set_alt;
468 ss->function.disable = sourcesink_disable;
470 status = usb_add_function(c, &ss->function);
471 if (status)
472 kfree(ss);
473 return status;
476 static int sourcesink_setup(struct usb_configuration *c,
477 const struct usb_ctrlrequest *ctrl)
479 struct usb_request *req = c->cdev->req;
480 int value = -EOPNOTSUPP;
481 u16 w_index = le16_to_cpu(ctrl->wIndex);
482 u16 w_value = le16_to_cpu(ctrl->wValue);
483 u16 w_length = le16_to_cpu(ctrl->wLength);
485 req->length = USB_BUFSIZ;
487 /* composite driver infrastructure handles everything except
488 * the two control test requests.
490 switch (ctrl->bRequest) {
493 * These are the same vendor-specific requests supported by
494 * Intel's USB 2.0 compliance test devices. We exceed that
495 * device spec by allowing multiple-packet requests.
497 * NOTE: the Control-OUT data stays in req->buf ... better
498 * would be copying it into a scratch buffer, so that other
499 * requests may safely intervene.
501 case 0x5b: /* control WRITE test -- fill the buffer */
502 if (ctrl->bRequestType != (USB_DIR_OUT|USB_TYPE_VENDOR))
503 goto unknown;
504 if (w_value || w_index)
505 break;
506 /* just read that many bytes into the buffer */
507 if (w_length > req->length)
508 break;
509 value = w_length;
510 break;
511 case 0x5c: /* control READ test -- return the buffer */
512 if (ctrl->bRequestType != (USB_DIR_IN|USB_TYPE_VENDOR))
513 goto unknown;
514 if (w_value || w_index)
515 break;
516 /* expect those bytes are still in the buffer; send back */
517 if (w_length > req->length)
518 break;
519 value = w_length;
520 break;
522 default:
523 unknown:
524 VDBG(c->cdev,
525 "unknown control req%02x.%02x v%04x i%04x l%d\n",
526 ctrl->bRequestType, ctrl->bRequest,
527 w_value, w_index, w_length);
530 /* respond with data transfer or status phase? */
531 if (value >= 0) {
532 VDBG(c->cdev, "source/sink req%02x.%02x v%04x i%04x l%d\n",
533 ctrl->bRequestType, ctrl->bRequest,
534 w_value, w_index, w_length);
535 req->zero = 0;
536 req->length = value;
537 value = usb_ep_queue(c->cdev->gadget->ep0, req, GFP_ATOMIC);
538 if (value < 0)
539 ERROR(c->cdev, "source/sinkc response, err %d\n",
540 value);
543 /* device either stalls (value < 0) or reports success */
544 return value;
547 static struct usb_configuration sourcesink_driver = {
548 .label = "source/sink",
549 .strings = sourcesink_strings,
550 .setup = sourcesink_setup,
551 .bConfigurationValue = 3,
552 .bmAttributes = USB_CONFIG_ATT_SELFPOWER,
553 /* .iConfiguration = DYNAMIC */
557 * sourcesink_add - add a source/sink testing configuration to a device
558 * @cdev: the device to support the configuration
560 int __init sourcesink_add(struct usb_composite_dev *cdev, bool autoresume)
562 int id;
564 /* allocate string ID(s) */
565 id = usb_string_id(cdev);
566 if (id < 0)
567 return id;
568 strings_sourcesink[0].id = id;
570 source_sink_intf.iInterface = id;
571 sourcesink_driver.iConfiguration = id;
573 /* support autoresume for remote wakeup testing */
574 if (autoresume)
575 sourcesink_driver.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
577 /* support OTG systems */
578 if (gadget_is_otg(cdev->gadget)) {
579 sourcesink_driver.descriptors = otg_desc;
580 sourcesink_driver.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
583 return usb_add_config(cdev, &sourcesink_driver, sourcesink_bind_config);