[Qemu-devel] usb-musb: calls usb_packet_complete() on packets with no owner

[Peter Maydell <peter.maydell@linaro.org>]

The function usb_packet_complete() in hw/usb.c says:
/* Notify the controller that an async packet is complete.  This should only
   be called for packets previously deferred by returning USB_RET_ASYNC from
   handle_packet. */

and this is checked by means of an assert(p->owner != NULL). However,
hw/usb-musb.c's musb_packet() function does this:

    if (s->port.dev)
        ret = usb_handle_packet(s->port.dev, &ep->packey[dir].p);
    else
        ret = USB_RET_NODEV;

    if (ret == USB_RET_ASYNC) {
        ep->status[dir] = len;
        return;
    }

    ep->status[dir] = ret;
    usb_packet_complete(s->port.dev, &ep->packey[dir].p);

which will call usb_packet_complete() on packets which did not
return USB_RET_ASYNC from usb_handle_packet, and so trips this
assert.

Any suggestions about what the right way to fix this is?
(I'm a bit confused about the comment that usb_packet_complete
is to 'notify the controller' -- usb-musb is the controller...)

(I do have a repro case but it's in qemu-linaro because it
uses the omap3 port; I can't seem to persuade my n800 image
to actually use the usb-otg.)

thanks
-- PMM