From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([140.186.70.92]:41140)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <peter.maydell@linaro.org>) id 1QW5U6-0007cE-4o
	for qemu-devel@nongnu.org; Mon, 13 Jun 2011 07:39:11 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <peter.maydell@linaro.org>) id 1QW5U5-0004WY-6o
	for qemu-devel@nongnu.org; Mon, 13 Jun 2011 07:39:10 -0400
Received: from mail-pv0-f173.google.com ([74.125.83.173]:56764)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <peter.maydell@linaro.org>) id 1QW5U4-0004WO-ST
	for qemu-devel@nongnu.org; Mon, 13 Jun 2011 07:39:09 -0400
Received: by pvg3 with SMTP id 3so2157659pvg.4
	for <qemu-devel@nongnu.org>; Mon, 13 Jun 2011 04:39:07 -0700 (PDT)
MIME-Version: 1.0
Date: Mon, 13 Jun 2011 12:39:06 +0100
Message-ID: <BANLkTi=-U4GwwPMX=NyS-isRae-66zKDaw@mail.gmail.com>
From: Peter Maydell <peter.maydell@linaro.org>
Content-Type: text/plain; charset=UTF-8
Subject: [Qemu-devel] usb-musb: calls usb_packet_complete() on packets with
	no owner
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: QEMU Developers <qemu-devel@nongnu.org>, Gerd Hoffmann <kraxel@redhat.com>

The function usb_packet_complete() in hw/usb.c says:
/* Notify the controller that an async packet is complete.  This should only
   be called for packets previously deferred by returning USB_RET_ASYNC from
   handle_packet. */

and this is checked by means of an assert(p->owner != NULL). However,
hw/usb-musb.c's musb_packet() function does this:

    if (s->port.dev)
        ret = usb_handle_packet(s->port.dev, &ep->packey[dir].p);
    else
        ret = USB_RET_NODEV;

    if (ret == USB_RET_ASYNC) {
        ep->status[dir] = len;
        return;
    }

    ep->status[dir] = ret;
    usb_packet_complete(s->port.dev, &ep->packey[dir].p);

which will call usb_packet_complete() on packets which did not
return USB_RET_ASYNC from usb_handle_packet, and so trips this
assert.

Any suggestions about what the right way to fix this is?
(I'm a bit confused about the comment that usb_packet_complete
is to 'notify the controller' -- usb-musb is the controller...)

(I do have a repro case but it's in qemu-linaro because it
uses the omap3 port; I can't seem to persuade my n800 image
to actually use the usb-otg.)

thanks
-- PMM