From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:50375)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <kraxel@redhat.com>) id 1aVg4v-00057X-TH
	for qemu-devel@nongnu.org; Tue, 16 Feb 2016 08:54:10 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <kraxel@redhat.com>) id 1aVg4s-0004ov-4F
	for qemu-devel@nongnu.org; Tue, 16 Feb 2016 08:54:09 -0500
Received: from mx1.redhat.com ([209.132.183.28]:50994)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <kraxel@redhat.com>) id 1aVg4r-0004om-Vb
	for qemu-devel@nongnu.org; Tue, 16 Feb 2016 08:54:06 -0500
Message-ID: <1455630843.7504.100.camel@redhat.com>
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Tue, 16 Feb 2016 14:54:03 +0100
In-Reply-To: <1455541449-5008-1-git-send-email-arei.gonglei@huawei.com>
References: <1455541449-5008-1-git-send-email-arei.gonglei@huawei.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0
Subject: Re: [Qemu-devel] [PATCH v2] usb: drop active assert when pid is
	invalid
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Gonglei <arei.gonglei@huawei.com>
Cc: qemu-devel@nongnu.org, peter.huangpeng@huawei.com

  Hi,

> diff --git a/hw/usb/core.c b/hw/usb/core.c
> index bea5e1e..6fbcf00 100644
> --- a/hw/usb/core.c
> +++ b/hw/usb/core.c
> @@ -716,7 +716,6 @@ struct USBEndpoint *usb_ep_get(USBDevice *dev, int pi=
d, int ep)
>      if (ep =3D=3D 0) {
>          return &dev->ep_ctl;
>      }
> -    assert(pid =3D=3D USB_TOKEN_IN || pid =3D=3D USB_TOKEN_OUT);

Please keep this.

>      assert(ep > 0 && ep <=3D USB_MAX_ENDPOINTS);
>      return eps + ep - 1;
>  }
> diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
> index 5ccfb83..ff66397 100644
> --- a/hw/usb/hcd-uhci.c
> +++ b/hw/usb/hcd-uhci.c
> @@ -883,6 +883,7 @@ static int uhci_handle_td(UHCIState *s, UHCIQueue *q,=
 uint32_t qh_addr,
>          /* invalid pid : frame interrupted */
>          uhci_async_free(async);
>          s->status |=3D UHCI_STS_HCPERR;
> +        s->cmd &=3D ~UHCI_CMD_RS;

When clearing RS in cmd we should also set HALTED in status I think.

How do we reach the assert above?  Maybe it is enough to move this pid
check to the start of the uhci_handle_td function to avoid triggering
the assert?

cheers,
  Gerd