This patch fixes bugs in usbdcore*.c related to the use of devices with multiple configurations.

The original code made mistakes about the meaning of configuration value and configuration index, and the resulting off-by-one errors resulted in:

* SET_CONFIGURATION always selected the first configuration, no matter what wValue is being passed. * GET_DESCRIPTOR/CONFIGURATION always returned the descriptor for the first configuration (index 0).

Signed-off-by: Harald Welte laforge@openmoko.org

diff --git a/drivers/usb/usbdcore.c b/drivers/usb/usbdcore.c index 65a5724..a2e6711 100644 --- a/drivers/usb/usbdcore.c +++ b/drivers/usb/usbdcore.c @@ -147,12 +147,9 @@ struct usb_string_descriptor *usbd_get_string (__u8 index) static struct usb_configuration_instance *usbd_device_configuration_instance (struct usb_device_instance *device, unsigned int port, unsigned int configuration) { - /* XXX */ - configuration = configuration ? configuration - 1 : 0; - - if (configuration >= device->configurations) { + if (configuration >= device->configurations) return NULL; - } + return device->configuration_instance_array + configuration; }

diff --git a/drivers/usb/usbdcore_ep0.c b/drivers/usb/usbdcore_ep0.c index 2c89304..d9808f9 100644 --- a/drivers/usb/usbdcore_ep0.c +++ b/drivers/usb/usbdcore_ep0.c @@ -237,8 +237,8 @@ static int ep0_get_descriptor (struct usb_device_instance *device, return -1; } /*dbg_ep0(2, "%d %d", index, device_descriptor->bNumConfigurations); */ - if (index > device_descriptor->bNumConfigurations) { - dbg_ep0 (0, "index too large: %d > %d", index, + if (index >= device_descriptor->bNumConfigurations) { + dbg_ep0 (0, "index too large: %d >= %d", index, device_descriptor-> bNumConfigurations); return -1; @@ -612,14 +612,8 @@ int ep0_recv_setup (struct urb *urb)

case USB_REQ_SET_CONFIGURATION: /* c.f. 9.4.7 - the top half of wValue is reserved */ - /* */ - if ((device->configuration = - le16_to_cpu (request->wValue) & 0xFF80) != 0) { - /* c.f. 9.4.7 - zero is the default or addressed state, in our case this */ - /* is the same is configuration zero */ - serial_printf("error setting dev->config to zero!\n"); - device->configuration = 0; /* TBR - ?????? */ - } + device->configuration = le16_to_cpu(request->wValue) & 0xff; + /* reset interface and alternate settings */ device->interface = device->alternate = 0;