xref: /openbmc/qemu/hw/usb/redirect.c (revision d8f8a860f2403533fc73f541122c65a34b21e42f)
1 /*
2  * USB redirector usb-guest
3  *
4  * Copyright (c) 2011-2012 Red Hat, Inc.
5  *
6  * Red Hat Authors:
7  * Hans de Goede <hdegoede@redhat.com>
8  *
9  * Permission is hereby granted, free of charge, to any person obtaining a copy
10  * of this software and associated documentation files (the "Software"), to deal
11  * in the Software without restriction, including without limitation the rights
12  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
13  * copies of the Software, and to permit persons to whom the Software is
14  * furnished to do so, subject to the following conditions:
15  *
16  * The above copyright notice and this permission notice shall be included in
17  * all copies or substantial portions of the Software.
18  *
19  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
20  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
21  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
22  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
23  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
24  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25  * THE SOFTWARE.
26  */
27 
28 #include "qemu-common.h"
29 #include "qemu-timer.h"
30 #include "monitor.h"
31 #include "sysemu.h"
32 
33 #include <dirent.h>
34 #include <sys/ioctl.h>
35 #include <signal.h>
36 #include <usbredirparser.h>
37 #include <usbredirfilter.h>
38 
39 #include "hw/usb.h"
40 
41 #define MAX_ENDPOINTS 32
42 #define NO_INTERFACE_INFO 255 /* Valid interface_count always <= 32 */
43 #define EP2I(ep_address) (((ep_address & 0x80) >> 3) | (ep_address & 0x0f))
44 #define I2EP(i) (((i & 0x10) << 3) | (i & 0x0f))
45 
46 typedef struct USBRedirDevice USBRedirDevice;
47 
48 /* Struct to hold buffered packets (iso or int input packets) */
49 struct buf_packet {
50     uint8_t *data;
51     int len;
52     int status;
53     QTAILQ_ENTRY(buf_packet)next;
54 };
55 
56 struct endp_data {
57     uint8_t type;
58     uint8_t interval;
59     uint8_t interface; /* bInterfaceNumber this ep belongs to */
60     uint16_t max_packet_size; /* In bytes, not wMaxPacketSize format !! */
61     uint8_t iso_started;
62     uint8_t iso_error; /* For reporting iso errors to the HC */
63     uint8_t interrupt_started;
64     uint8_t interrupt_error;
65     uint8_t bufpq_prefilled;
66     uint8_t bufpq_dropping_packets;
67     QTAILQ_HEAD(, buf_packet) bufpq;
68     int32_t bufpq_size;
69     int32_t bufpq_target_size;
70 };
71 
72 struct PacketIdQueueEntry {
73     uint64_t id;
74     QTAILQ_ENTRY(PacketIdQueueEntry)next;
75 };
76 
77 struct PacketIdQueue {
78     USBRedirDevice *dev;
79     const char *name;
80     QTAILQ_HEAD(, PacketIdQueueEntry) head;
81     int size;
82 };
83 
84 struct USBRedirDevice {
85     USBDevice dev;
86     /* Properties */
87     CharDriverState *cs;
88     uint8_t debug;
89     char *filter_str;
90     int32_t bootindex;
91     /* Data passed from chardev the fd_read cb to the usbredirparser read cb */
92     const uint8_t *read_buf;
93     int read_buf_size;
94     /* For async handling of close */
95     QEMUBH *chardev_close_bh;
96     /* To delay the usb attach in case of quick chardev close + open */
97     QEMUTimer *attach_timer;
98     int64_t next_attach_time;
99     struct usbredirparser *parser;
100     struct endp_data endpoint[MAX_ENDPOINTS];
101     struct PacketIdQueue cancelled;
102     struct PacketIdQueue already_in_flight;
103     /* Data for device filtering */
104     struct usb_redir_device_connect_header device_info;
105     struct usb_redir_interface_info_header interface_info;
106     struct usbredirfilter_rule *filter_rules;
107     int filter_rules_count;
108 };
109 
110 static void usbredir_hello(void *priv, struct usb_redir_hello_header *h);
111 static void usbredir_device_connect(void *priv,
112     struct usb_redir_device_connect_header *device_connect);
113 static void usbredir_device_disconnect(void *priv);
114 static void usbredir_interface_info(void *priv,
115     struct usb_redir_interface_info_header *interface_info);
116 static void usbredir_ep_info(void *priv,
117     struct usb_redir_ep_info_header *ep_info);
118 static void usbredir_configuration_status(void *priv, uint64_t id,
119     struct usb_redir_configuration_status_header *configuration_status);
120 static void usbredir_alt_setting_status(void *priv, uint64_t id,
121     struct usb_redir_alt_setting_status_header *alt_setting_status);
122 static void usbredir_iso_stream_status(void *priv, uint64_t id,
123     struct usb_redir_iso_stream_status_header *iso_stream_status);
124 static void usbredir_interrupt_receiving_status(void *priv, uint64_t id,
125     struct usb_redir_interrupt_receiving_status_header
126     *interrupt_receiving_status);
127 static void usbredir_bulk_streams_status(void *priv, uint64_t id,
128     struct usb_redir_bulk_streams_status_header *bulk_streams_status);
129 static void usbredir_control_packet(void *priv, uint64_t id,
130     struct usb_redir_control_packet_header *control_packet,
131     uint8_t *data, int data_len);
132 static void usbredir_bulk_packet(void *priv, uint64_t id,
133     struct usb_redir_bulk_packet_header *bulk_packet,
134     uint8_t *data, int data_len);
135 static void usbredir_iso_packet(void *priv, uint64_t id,
136     struct usb_redir_iso_packet_header *iso_packet,
137     uint8_t *data, int data_len);
138 static void usbredir_interrupt_packet(void *priv, uint64_t id,
139     struct usb_redir_interrupt_packet_header *interrupt_header,
140     uint8_t *data, int data_len);
141 
142 static int usbredir_handle_status(USBRedirDevice *dev,
143                                        int status, int actual_len);
144 
145 #define VERSION "qemu usb-redir guest " QEMU_VERSION
146 
147 /*
148  * Logging stuff
149  */
150 
151 #define ERROR(...) \
152     do { \
153         if (dev->debug >= usbredirparser_error) { \
154             error_report("usb-redir error: " __VA_ARGS__); \
155         } \
156     } while (0)
157 #define WARNING(...) \
158     do { \
159         if (dev->debug >= usbredirparser_warning) { \
160             error_report("usb-redir warning: " __VA_ARGS__); \
161         } \
162     } while (0)
163 #define INFO(...) \
164     do { \
165         if (dev->debug >= usbredirparser_info) { \
166             error_report("usb-redir: " __VA_ARGS__); \
167         } \
168     } while (0)
169 #define DPRINTF(...) \
170     do { \
171         if (dev->debug >= usbredirparser_debug) { \
172             error_report("usb-redir: " __VA_ARGS__); \
173         } \
174     } while (0)
175 #define DPRINTF2(...) \
176     do { \
177         if (dev->debug >= usbredirparser_debug_data) { \
178             error_report("usb-redir: " __VA_ARGS__); \
179         } \
180     } while (0)
181 
182 static void usbredir_log(void *priv, int level, const char *msg)
183 {
184     USBRedirDevice *dev = priv;
185 
186     if (dev->debug < level) {
187         return;
188     }
189 
190     error_report("%s", msg);
191 }
192 
193 static void usbredir_log_data(USBRedirDevice *dev, const char *desc,
194     const uint8_t *data, int len)
195 {
196     int i, j, n;
197 
198     if (dev->debug < usbredirparser_debug_data) {
199         return;
200     }
201 
202     for (i = 0; i < len; i += j) {
203         char buf[128];
204 
205         n = sprintf(buf, "%s", desc);
206         for (j = 0; j < 8 && i + j < len; j++) {
207             n += sprintf(buf + n, " %02X", data[i + j]);
208         }
209         error_report("%s", buf);
210     }
211 }
212 
213 /*
214  * usbredirparser io functions
215  */
216 
217 static int usbredir_read(void *priv, uint8_t *data, int count)
218 {
219     USBRedirDevice *dev = priv;
220 
221     if (dev->read_buf_size < count) {
222         count = dev->read_buf_size;
223     }
224 
225     memcpy(data, dev->read_buf, count);
226 
227     dev->read_buf_size -= count;
228     if (dev->read_buf_size) {
229         dev->read_buf += count;
230     } else {
231         dev->read_buf = NULL;
232     }
233 
234     return count;
235 }
236 
237 static int usbredir_write(void *priv, uint8_t *data, int count)
238 {
239     USBRedirDevice *dev = priv;
240 
241     if (!dev->cs->opened) {
242         return 0;
243     }
244 
245     /* Don't send new data to the chardev until our state is fully synced */
246     if (!runstate_check(RUN_STATE_RUNNING)) {
247         return 0;
248     }
249 
250     return qemu_chr_fe_write(dev->cs, data, count);
251 }
252 
253 /*
254  * Cancelled and buffered packets helpers
255  */
256 
257 static void packet_id_queue_init(struct PacketIdQueue *q,
258     USBRedirDevice *dev, const char *name)
259 {
260     q->dev = dev;
261     q->name = name;
262     QTAILQ_INIT(&q->head);
263     q->size = 0;
264 }
265 
266 static void packet_id_queue_add(struct PacketIdQueue *q, uint64_t id)
267 {
268     USBRedirDevice *dev = q->dev;
269     struct PacketIdQueueEntry *e;
270 
271     DPRINTF("adding packet id %"PRIu64" to %s queue\n", id, q->name);
272 
273     e = g_malloc0(sizeof(struct PacketIdQueueEntry));
274     e->id = id;
275     QTAILQ_INSERT_TAIL(&q->head, e, next);
276     q->size++;
277 }
278 
279 static int packet_id_queue_remove(struct PacketIdQueue *q, uint64_t id)
280 {
281     USBRedirDevice *dev = q->dev;
282     struct PacketIdQueueEntry *e;
283 
284     QTAILQ_FOREACH(e, &q->head, next) {
285         if (e->id == id) {
286             DPRINTF("removing packet id %"PRIu64" from %s queue\n",
287                     id, q->name);
288             QTAILQ_REMOVE(&q->head, e, next);
289             q->size--;
290             g_free(e);
291             return 1;
292         }
293     }
294     return 0;
295 }
296 
297 static void packet_id_queue_empty(struct PacketIdQueue *q)
298 {
299     USBRedirDevice *dev = q->dev;
300     struct PacketIdQueueEntry *e, *next_e;
301 
302     DPRINTF("removing %d packet-ids from %s queue\n", q->size, q->name);
303 
304     QTAILQ_FOREACH_SAFE(e, &q->head, next, next_e) {
305         QTAILQ_REMOVE(&q->head, e, next);
306         g_free(e);
307     }
308     q->size = 0;
309 }
310 
311 static void usbredir_cancel_packet(USBDevice *udev, USBPacket *p)
312 {
313     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
314 
315     packet_id_queue_add(&dev->cancelled, p->id);
316     usbredirparser_send_cancel_data_packet(dev->parser, p->id);
317     usbredirparser_do_write(dev->parser);
318 }
319 
320 static int usbredir_is_cancelled(USBRedirDevice *dev, uint64_t id)
321 {
322     if (!dev->dev.attached) {
323         return 1; /* Treat everything as cancelled after a disconnect */
324     }
325     return packet_id_queue_remove(&dev->cancelled, id);
326 }
327 
328 static void usbredir_fill_already_in_flight_from_ep(USBRedirDevice *dev,
329     struct USBEndpoint *ep)
330 {
331     static USBPacket *p;
332 
333     QTAILQ_FOREACH(p, &ep->queue, queue) {
334         packet_id_queue_add(&dev->already_in_flight, p->id);
335     }
336 }
337 
338 static void usbredir_fill_already_in_flight(USBRedirDevice *dev)
339 {
340     int ep;
341     struct USBDevice *udev = &dev->dev;
342 
343     usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_ctl);
344 
345     for (ep = 0; ep < USB_MAX_ENDPOINTS; ep++) {
346         usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_in[ep]);
347         usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_out[ep]);
348     }
349 }
350 
351 static int usbredir_already_in_flight(USBRedirDevice *dev, uint64_t id)
352 {
353     return packet_id_queue_remove(&dev->already_in_flight, id);
354 }
355 
356 static USBPacket *usbredir_find_packet_by_id(USBRedirDevice *dev,
357     uint8_t ep, uint64_t id)
358 {
359     USBPacket *p;
360 
361     if (usbredir_is_cancelled(dev, id)) {
362         return NULL;
363     }
364 
365     p = usb_ep_find_packet_by_id(&dev->dev,
366                             (ep & USB_DIR_IN) ? USB_TOKEN_IN : USB_TOKEN_OUT,
367                             ep & 0x0f, id);
368     if (p == NULL) {
369         ERROR("could not find packet with id %"PRIu64"\n", id);
370     }
371     return p;
372 }
373 
374 static void bufp_alloc(USBRedirDevice *dev,
375     uint8_t *data, int len, int status, uint8_t ep)
376 {
377     struct buf_packet *bufp;
378 
379     if (!dev->endpoint[EP2I(ep)].bufpq_dropping_packets &&
380         dev->endpoint[EP2I(ep)].bufpq_size >
381             2 * dev->endpoint[EP2I(ep)].bufpq_target_size) {
382         DPRINTF("bufpq overflow, dropping packets ep %02X\n", ep);
383         dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 1;
384     }
385     /* Since we're interupting the stream anyways, drop enough packets to get
386        back to our target buffer size */
387     if (dev->endpoint[EP2I(ep)].bufpq_dropping_packets) {
388         if (dev->endpoint[EP2I(ep)].bufpq_size >
389                 dev->endpoint[EP2I(ep)].bufpq_target_size) {
390             free(data);
391             return;
392         }
393         dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
394     }
395 
396     bufp = g_malloc(sizeof(struct buf_packet));
397     bufp->data   = data;
398     bufp->len    = len;
399     bufp->status = status;
400     QTAILQ_INSERT_TAIL(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);
401     dev->endpoint[EP2I(ep)].bufpq_size++;
402 }
403 
404 static void bufp_free(USBRedirDevice *dev, struct buf_packet *bufp,
405     uint8_t ep)
406 {
407     QTAILQ_REMOVE(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);
408     dev->endpoint[EP2I(ep)].bufpq_size--;
409     free(bufp->data);
410     g_free(bufp);
411 }
412 
413 static void usbredir_free_bufpq(USBRedirDevice *dev, uint8_t ep)
414 {
415     struct buf_packet *buf, *buf_next;
416 
417     QTAILQ_FOREACH_SAFE(buf, &dev->endpoint[EP2I(ep)].bufpq, next, buf_next) {
418         bufp_free(dev, buf, ep);
419     }
420 }
421 
422 /*
423  * USBDevice callbacks
424  */
425 
426 static void usbredir_handle_reset(USBDevice *udev)
427 {
428     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
429 
430     DPRINTF("reset device\n");
431     usbredirparser_send_reset(dev->parser);
432     usbredirparser_do_write(dev->parser);
433 }
434 
435 static int usbredir_handle_iso_data(USBRedirDevice *dev, USBPacket *p,
436                                      uint8_t ep)
437 {
438     int status, len;
439     if (!dev->endpoint[EP2I(ep)].iso_started &&
440             !dev->endpoint[EP2I(ep)].iso_error) {
441         struct usb_redir_start_iso_stream_header start_iso = {
442             .endpoint = ep,
443         };
444         int pkts_per_sec;
445 
446         if (dev->dev.speed == USB_SPEED_HIGH) {
447             pkts_per_sec = 8000 / dev->endpoint[EP2I(ep)].interval;
448         } else {
449             pkts_per_sec = 1000 / dev->endpoint[EP2I(ep)].interval;
450         }
451         /* Testing has shown that we need circa 60 ms buffer */
452         dev->endpoint[EP2I(ep)].bufpq_target_size = (pkts_per_sec * 60) / 1000;
453 
454         /* Aim for approx 100 interrupts / second on the client to
455            balance latency and interrupt load */
456         start_iso.pkts_per_urb = pkts_per_sec / 100;
457         if (start_iso.pkts_per_urb < 1) {
458             start_iso.pkts_per_urb = 1;
459         } else if (start_iso.pkts_per_urb > 32) {
460             start_iso.pkts_per_urb = 32;
461         }
462 
463         start_iso.no_urbs = (dev->endpoint[EP2I(ep)].bufpq_target_size +
464                              start_iso.pkts_per_urb - 1) /
465                             start_iso.pkts_per_urb;
466         /* Output endpoints pre-fill only 1/2 of the packets, keeping the rest
467            as overflow buffer. Also see the usbredir protocol documentation */
468         if (!(ep & USB_DIR_IN)) {
469             start_iso.no_urbs *= 2;
470         }
471         if (start_iso.no_urbs > 16) {
472             start_iso.no_urbs = 16;
473         }
474 
475         /* No id, we look at the ep when receiving a status back */
476         usbredirparser_send_start_iso_stream(dev->parser, 0, &start_iso);
477         usbredirparser_do_write(dev->parser);
478         DPRINTF("iso stream started pkts/sec %d pkts/urb %d urbs %d ep %02X\n",
479                 pkts_per_sec, start_iso.pkts_per_urb, start_iso.no_urbs, ep);
480         dev->endpoint[EP2I(ep)].iso_started = 1;
481         dev->endpoint[EP2I(ep)].bufpq_prefilled = 0;
482         dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
483     }
484 
485     if (ep & USB_DIR_IN) {
486         struct buf_packet *isop;
487 
488         if (dev->endpoint[EP2I(ep)].iso_started &&
489                 !dev->endpoint[EP2I(ep)].bufpq_prefilled) {
490             if (dev->endpoint[EP2I(ep)].bufpq_size <
491                     dev->endpoint[EP2I(ep)].bufpq_target_size) {
492                 return usbredir_handle_status(dev, 0, 0);
493             }
494             dev->endpoint[EP2I(ep)].bufpq_prefilled = 1;
495         }
496 
497         isop = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq);
498         if (isop == NULL) {
499             DPRINTF("iso-token-in ep %02X, no isop, iso_error: %d\n",
500                     ep, dev->endpoint[EP2I(ep)].iso_error);
501             /* Re-fill the buffer */
502             dev->endpoint[EP2I(ep)].bufpq_prefilled = 0;
503             /* Check iso_error for stream errors, otherwise its an underrun */
504             status = dev->endpoint[EP2I(ep)].iso_error;
505             dev->endpoint[EP2I(ep)].iso_error = 0;
506             return status ? USB_RET_IOERROR : 0;
507         }
508         DPRINTF2("iso-token-in ep %02X status %d len %d queue-size: %d\n", ep,
509                  isop->status, isop->len, dev->endpoint[EP2I(ep)].bufpq_size);
510 
511         status = isop->status;
512         if (status != usb_redir_success) {
513             bufp_free(dev, isop, ep);
514             return USB_RET_IOERROR;
515         }
516 
517         len = isop->len;
518         if (len > p->iov.size) {
519             ERROR("received iso data is larger then packet ep %02X (%d > %d)\n",
520                   ep, len, (int)p->iov.size);
521             bufp_free(dev, isop, ep);
522             return USB_RET_BABBLE;
523         }
524         usb_packet_copy(p, isop->data, len);
525         bufp_free(dev, isop, ep);
526         return len;
527     } else {
528         /* If the stream was not started because of a pending error don't
529            send the packet to the usb-host */
530         if (dev->endpoint[EP2I(ep)].iso_started) {
531             struct usb_redir_iso_packet_header iso_packet = {
532                 .endpoint = ep,
533                 .length = p->iov.size
534             };
535             uint8_t buf[p->iov.size];
536             /* No id, we look at the ep when receiving a status back */
537             usb_packet_copy(p, buf, p->iov.size);
538             usbredirparser_send_iso_packet(dev->parser, 0, &iso_packet,
539                                            buf, p->iov.size);
540             usbredirparser_do_write(dev->parser);
541         }
542         status = dev->endpoint[EP2I(ep)].iso_error;
543         dev->endpoint[EP2I(ep)].iso_error = 0;
544         DPRINTF2("iso-token-out ep %02X status %d len %zd\n", ep, status,
545                  p->iov.size);
546         return usbredir_handle_status(dev, status, p->iov.size);
547     }
548 }
549 
550 static void usbredir_stop_iso_stream(USBRedirDevice *dev, uint8_t ep)
551 {
552     struct usb_redir_stop_iso_stream_header stop_iso_stream = {
553         .endpoint = ep
554     };
555     if (dev->endpoint[EP2I(ep)].iso_started) {
556         usbredirparser_send_stop_iso_stream(dev->parser, 0, &stop_iso_stream);
557         DPRINTF("iso stream stopped ep %02X\n", ep);
558         dev->endpoint[EP2I(ep)].iso_started = 0;
559     }
560     dev->endpoint[EP2I(ep)].iso_error = 0;
561     usbredir_free_bufpq(dev, ep);
562 }
563 
564 static int usbredir_handle_bulk_data(USBRedirDevice *dev, USBPacket *p,
565                                       uint8_t ep)
566 {
567     struct usb_redir_bulk_packet_header bulk_packet;
568 
569     DPRINTF("bulk-out ep %02X len %zd id %"PRIu64"\n", ep, p->iov.size, p->id);
570 
571     if (usbredir_already_in_flight(dev, p->id)) {
572         return USB_RET_ASYNC;
573     }
574 
575     bulk_packet.endpoint  = ep;
576     bulk_packet.length    = p->iov.size;
577     bulk_packet.stream_id = 0;
578 
579     if (ep & USB_DIR_IN) {
580         usbredirparser_send_bulk_packet(dev->parser, p->id,
581                                         &bulk_packet, NULL, 0);
582     } else {
583         uint8_t buf[p->iov.size];
584         usb_packet_copy(p, buf, p->iov.size);
585         usbredir_log_data(dev, "bulk data out:", buf, p->iov.size);
586         usbredirparser_send_bulk_packet(dev->parser, p->id,
587                                         &bulk_packet, buf, p->iov.size);
588     }
589     usbredirparser_do_write(dev->parser);
590     return USB_RET_ASYNC;
591 }
592 
593 static int usbredir_handle_interrupt_data(USBRedirDevice *dev,
594                                            USBPacket *p, uint8_t ep)
595 {
596     if (ep & USB_DIR_IN) {
597         /* Input interrupt endpoint, buffered packet input */
598         struct buf_packet *intp;
599         int status, len;
600 
601         if (!dev->endpoint[EP2I(ep)].interrupt_started &&
602                 !dev->endpoint[EP2I(ep)].interrupt_error) {
603             struct usb_redir_start_interrupt_receiving_header start_int = {
604                 .endpoint = ep,
605             };
606             /* No id, we look at the ep when receiving a status back */
607             usbredirparser_send_start_interrupt_receiving(dev->parser, 0,
608                                                           &start_int);
609             usbredirparser_do_write(dev->parser);
610             DPRINTF("interrupt recv started ep %02X\n", ep);
611             dev->endpoint[EP2I(ep)].interrupt_started = 1;
612             /* We don't really want to drop interrupt packets ever, but
613                having some upper limit to how much we buffer is good. */
614             dev->endpoint[EP2I(ep)].bufpq_target_size = 1000;
615             dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
616         }
617 
618         intp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq);
619         if (intp == NULL) {
620             DPRINTF2("interrupt-token-in ep %02X, no intp\n", ep);
621             /* Check interrupt_error for stream errors */
622             status = dev->endpoint[EP2I(ep)].interrupt_error;
623             dev->endpoint[EP2I(ep)].interrupt_error = 0;
624             if (status) {
625                 return usbredir_handle_status(dev, status, 0);
626             }
627             return USB_RET_NAK;
628         }
629         DPRINTF("interrupt-token-in ep %02X status %d len %d\n", ep,
630                 intp->status, intp->len);
631 
632         status = intp->status;
633         if (status != usb_redir_success) {
634             bufp_free(dev, intp, ep);
635             return usbredir_handle_status(dev, status, 0);
636         }
637 
638         len = intp->len;
639         if (len > p->iov.size) {
640             ERROR("received int data is larger then packet ep %02X\n", ep);
641             bufp_free(dev, intp, ep);
642             return USB_RET_BABBLE;
643         }
644         usb_packet_copy(p, intp->data, len);
645         bufp_free(dev, intp, ep);
646         return len;
647     } else {
648         /* Output interrupt endpoint, normal async operation */
649         struct usb_redir_interrupt_packet_header interrupt_packet;
650         uint8_t buf[p->iov.size];
651 
652         DPRINTF("interrupt-out ep %02X len %zd id %"PRIu64"\n", ep,
653                 p->iov.size, p->id);
654 
655         if (usbredir_already_in_flight(dev, p->id)) {
656             return USB_RET_ASYNC;
657         }
658 
659         interrupt_packet.endpoint  = ep;
660         interrupt_packet.length    = p->iov.size;
661 
662         usb_packet_copy(p, buf, p->iov.size);
663         usbredir_log_data(dev, "interrupt data out:", buf, p->iov.size);
664         usbredirparser_send_interrupt_packet(dev->parser, p->id,
665                                         &interrupt_packet, buf, p->iov.size);
666         usbredirparser_do_write(dev->parser);
667         return USB_RET_ASYNC;
668     }
669 }
670 
671 static void usbredir_stop_interrupt_receiving(USBRedirDevice *dev,
672     uint8_t ep)
673 {
674     struct usb_redir_stop_interrupt_receiving_header stop_interrupt_recv = {
675         .endpoint = ep
676     };
677     if (dev->endpoint[EP2I(ep)].interrupt_started) {
678         usbredirparser_send_stop_interrupt_receiving(dev->parser, 0,
679                                                      &stop_interrupt_recv);
680         DPRINTF("interrupt recv stopped ep %02X\n", ep);
681         dev->endpoint[EP2I(ep)].interrupt_started = 0;
682     }
683     dev->endpoint[EP2I(ep)].interrupt_error = 0;
684     usbredir_free_bufpq(dev, ep);
685 }
686 
687 static int usbredir_handle_data(USBDevice *udev, USBPacket *p)
688 {
689     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
690     uint8_t ep;
691 
692     ep = p->ep->nr;
693     if (p->pid == USB_TOKEN_IN) {
694         ep |= USB_DIR_IN;
695     }
696 
697     switch (dev->endpoint[EP2I(ep)].type) {
698     case USB_ENDPOINT_XFER_CONTROL:
699         ERROR("handle_data called for control transfer on ep %02X\n", ep);
700         return USB_RET_NAK;
701     case USB_ENDPOINT_XFER_ISOC:
702         return usbredir_handle_iso_data(dev, p, ep);
703     case USB_ENDPOINT_XFER_BULK:
704         return usbredir_handle_bulk_data(dev, p, ep);
705     case USB_ENDPOINT_XFER_INT:
706         return usbredir_handle_interrupt_data(dev, p, ep);
707     default:
708         ERROR("handle_data ep %02X has unknown type %d\n", ep,
709               dev->endpoint[EP2I(ep)].type);
710         return USB_RET_NAK;
711     }
712 }
713 
714 static int usbredir_set_config(USBRedirDevice *dev, USBPacket *p,
715                                 int config)
716 {
717     struct usb_redir_set_configuration_header set_config;
718     int i;
719 
720     DPRINTF("set config %d id %"PRIu64"\n", config, p->id);
721 
722     for (i = 0; i < MAX_ENDPOINTS; i++) {
723         switch (dev->endpoint[i].type) {
724         case USB_ENDPOINT_XFER_ISOC:
725             usbredir_stop_iso_stream(dev, I2EP(i));
726             break;
727         case USB_ENDPOINT_XFER_INT:
728             if (i & 0x10) {
729                 usbredir_stop_interrupt_receiving(dev, I2EP(i));
730             }
731             break;
732         }
733         usbredir_free_bufpq(dev, I2EP(i));
734     }
735 
736     set_config.configuration = config;
737     usbredirparser_send_set_configuration(dev->parser, p->id, &set_config);
738     usbredirparser_do_write(dev->parser);
739     return USB_RET_ASYNC;
740 }
741 
742 static int usbredir_get_config(USBRedirDevice *dev, USBPacket *p)
743 {
744     DPRINTF("get config id %"PRIu64"\n", p->id);
745 
746     usbredirparser_send_get_configuration(dev->parser, p->id);
747     usbredirparser_do_write(dev->parser);
748     return USB_RET_ASYNC;
749 }
750 
751 static int usbredir_set_interface(USBRedirDevice *dev, USBPacket *p,
752                                    int interface, int alt)
753 {
754     struct usb_redir_set_alt_setting_header set_alt;
755     int i;
756 
757     DPRINTF("set interface %d alt %d id %"PRIu64"\n", interface, alt, p->id);
758 
759     for (i = 0; i < MAX_ENDPOINTS; i++) {
760         if (dev->endpoint[i].interface == interface) {
761             switch (dev->endpoint[i].type) {
762             case USB_ENDPOINT_XFER_ISOC:
763                 usbredir_stop_iso_stream(dev, I2EP(i));
764                 break;
765             case USB_ENDPOINT_XFER_INT:
766                 if (i & 0x10) {
767                     usbredir_stop_interrupt_receiving(dev, I2EP(i));
768                 }
769                 break;
770             }
771             usbredir_free_bufpq(dev, I2EP(i));
772         }
773     }
774 
775     set_alt.interface = interface;
776     set_alt.alt = alt;
777     usbredirparser_send_set_alt_setting(dev->parser, p->id, &set_alt);
778     usbredirparser_do_write(dev->parser);
779     return USB_RET_ASYNC;
780 }
781 
782 static int usbredir_get_interface(USBRedirDevice *dev, USBPacket *p,
783                                    int interface)
784 {
785     struct usb_redir_get_alt_setting_header get_alt;
786 
787     DPRINTF("get interface %d id %"PRIu64"\n", interface, p->id);
788 
789     get_alt.interface = interface;
790     usbredirparser_send_get_alt_setting(dev->parser, p->id, &get_alt);
791     usbredirparser_do_write(dev->parser);
792     return USB_RET_ASYNC;
793 }
794 
795 static int usbredir_handle_control(USBDevice *udev, USBPacket *p,
796         int request, int value, int index, int length, uint8_t *data)
797 {
798     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
799     struct usb_redir_control_packet_header control_packet;
800 
801     if (usbredir_already_in_flight(dev, p->id)) {
802         return USB_RET_ASYNC;
803     }
804 
805     /* Special cases for certain standard device requests */
806     switch (request) {
807     case DeviceOutRequest | USB_REQ_SET_ADDRESS:
808         DPRINTF("set address %d\n", value);
809         dev->dev.addr = value;
810         return 0;
811     case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
812         return usbredir_set_config(dev, p, value & 0xff);
813     case DeviceRequest | USB_REQ_GET_CONFIGURATION:
814         return usbredir_get_config(dev, p);
815     case InterfaceOutRequest | USB_REQ_SET_INTERFACE:
816         return usbredir_set_interface(dev, p, index, value);
817     case InterfaceRequest | USB_REQ_GET_INTERFACE:
818         return usbredir_get_interface(dev, p, index);
819     }
820 
821     /* Normal ctrl requests, note request is (bRequestType << 8) | bRequest */
822     DPRINTF(
823         "ctrl-out type 0x%x req 0x%x val 0x%x index %d len %d id %"PRIu64"\n",
824         request >> 8, request & 0xff, value, index, length, p->id);
825 
826     control_packet.request     = request & 0xFF;
827     control_packet.requesttype = request >> 8;
828     control_packet.endpoint    = control_packet.requesttype & USB_DIR_IN;
829     control_packet.value       = value;
830     control_packet.index       = index;
831     control_packet.length      = length;
832 
833     if (control_packet.requesttype & USB_DIR_IN) {
834         usbredirparser_send_control_packet(dev->parser, p->id,
835                                            &control_packet, NULL, 0);
836     } else {
837         usbredir_log_data(dev, "ctrl data out:", data, length);
838         usbredirparser_send_control_packet(dev->parser, p->id,
839                                            &control_packet, data, length);
840     }
841     usbredirparser_do_write(dev->parser);
842     return USB_RET_ASYNC;
843 }
844 
845 /*
846  * Close events can be triggered by usbredirparser_do_write which gets called
847  * from within the USBDevice data / control packet callbacks and doing a
848  * usb_detach from within these callbacks is not a good idea.
849  *
850  * So we use a bh handler to take care of close events.
851  */
852 static void usbredir_chardev_close_bh(void *opaque)
853 {
854     USBRedirDevice *dev = opaque;
855 
856     usbredir_device_disconnect(dev);
857 
858     if (dev->parser) {
859         DPRINTF("destroying usbredirparser\n");
860         usbredirparser_destroy(dev->parser);
861         dev->parser = NULL;
862     }
863 }
864 
865 static void usbredir_chardev_open(USBRedirDevice *dev)
866 {
867     uint32_t caps[USB_REDIR_CAPS_SIZE] = { 0, };
868     int flags = 0;
869 
870     /* Make sure any pending closes are handled (no-op if none pending) */
871     usbredir_chardev_close_bh(dev);
872     qemu_bh_cancel(dev->chardev_close_bh);
873 
874     DPRINTF("creating usbredirparser\n");
875 
876     dev->parser = qemu_oom_check(usbredirparser_create());
877     dev->parser->priv = dev;
878     dev->parser->log_func = usbredir_log;
879     dev->parser->read_func = usbredir_read;
880     dev->parser->write_func = usbredir_write;
881     dev->parser->hello_func = usbredir_hello;
882     dev->parser->device_connect_func = usbredir_device_connect;
883     dev->parser->device_disconnect_func = usbredir_device_disconnect;
884     dev->parser->interface_info_func = usbredir_interface_info;
885     dev->parser->ep_info_func = usbredir_ep_info;
886     dev->parser->configuration_status_func = usbredir_configuration_status;
887     dev->parser->alt_setting_status_func = usbredir_alt_setting_status;
888     dev->parser->iso_stream_status_func = usbredir_iso_stream_status;
889     dev->parser->interrupt_receiving_status_func =
890         usbredir_interrupt_receiving_status;
891     dev->parser->bulk_streams_status_func = usbredir_bulk_streams_status;
892     dev->parser->control_packet_func = usbredir_control_packet;
893     dev->parser->bulk_packet_func = usbredir_bulk_packet;
894     dev->parser->iso_packet_func = usbredir_iso_packet;
895     dev->parser->interrupt_packet_func = usbredir_interrupt_packet;
896     dev->read_buf = NULL;
897     dev->read_buf_size = 0;
898 
899     usbredirparser_caps_set_cap(caps, usb_redir_cap_connect_device_version);
900     usbredirparser_caps_set_cap(caps, usb_redir_cap_filter);
901     usbredirparser_caps_set_cap(caps, usb_redir_cap_ep_info_max_packet_size);
902     usbredirparser_caps_set_cap(caps, usb_redir_cap_64bits_ids);
903 
904     if (runstate_check(RUN_STATE_INMIGRATE)) {
905         flags |= usbredirparser_fl_no_hello;
906     }
907     usbredirparser_init(dev->parser, VERSION, caps, USB_REDIR_CAPS_SIZE,
908                         flags);
909     usbredirparser_do_write(dev->parser);
910 }
911 
912 static void usbredir_reject_device(USBRedirDevice *dev)
913 {
914     usbredir_device_disconnect(dev);
915     if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter)) {
916         usbredirparser_send_filter_reject(dev->parser);
917         usbredirparser_do_write(dev->parser);
918     }
919 }
920 
921 static void usbredir_do_attach(void *opaque)
922 {
923     USBRedirDevice *dev = opaque;
924 
925     /* In order to work properly with XHCI controllers we need these caps */
926     if ((dev->dev.port->speedmask & USB_SPEED_MASK_SUPER) && !(
927         usbredirparser_peer_has_cap(dev->parser,
928                                     usb_redir_cap_ep_info_max_packet_size) &&
929         usbredirparser_peer_has_cap(dev->parser,
930                                     usb_redir_cap_64bits_ids))) {
931         ERROR("usb-redir-host lacks capabilities needed for use with XHCI\n");
932         usbredir_reject_device(dev);
933         return;
934     }
935 
936     if (usb_device_attach(&dev->dev) != 0) {
937         usbredir_reject_device(dev);
938     }
939 }
940 
941 /*
942  * chardev callbacks
943  */
944 
945 static int usbredir_chardev_can_read(void *opaque)
946 {
947     USBRedirDevice *dev = opaque;
948 
949     if (!dev->parser) {
950         WARNING("chardev_can_read called on non open chardev!\n");
951         return 0;
952     }
953 
954     /* Don't read new data from the chardev until our state is fully synced */
955     if (!runstate_check(RUN_STATE_RUNNING)) {
956         return 0;
957     }
958 
959     /* usbredir_parser_do_read will consume *all* data we give it */
960     return 1024 * 1024;
961 }
962 
963 static void usbredir_chardev_read(void *opaque, const uint8_t *buf, int size)
964 {
965     USBRedirDevice *dev = opaque;
966 
967     /* No recursion allowed! */
968     assert(dev->read_buf == NULL);
969 
970     dev->read_buf = buf;
971     dev->read_buf_size = size;
972 
973     usbredirparser_do_read(dev->parser);
974     /* Send any acks, etc. which may be queued now */
975     usbredirparser_do_write(dev->parser);
976 }
977 
978 static void usbredir_chardev_event(void *opaque, int event)
979 {
980     USBRedirDevice *dev = opaque;
981 
982     switch (event) {
983     case CHR_EVENT_OPENED:
984         DPRINTF("chardev open\n");
985         usbredir_chardev_open(dev);
986         break;
987     case CHR_EVENT_CLOSED:
988         DPRINTF("chardev close\n");
989         qemu_bh_schedule(dev->chardev_close_bh);
990         break;
991     }
992 }
993 
994 /*
995  * init + destroy
996  */
997 
998 static void usbredir_vm_state_change(void *priv, int running, RunState state)
999 {
1000     USBRedirDevice *dev = priv;
1001 
1002     if (state == RUN_STATE_RUNNING && dev->parser != NULL) {
1003         usbredirparser_do_write(dev->parser); /* Flush any pending writes */
1004     }
1005 }
1006 
1007 static int usbredir_initfn(USBDevice *udev)
1008 {
1009     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
1010     int i;
1011 
1012     if (dev->cs == NULL) {
1013         qerror_report(QERR_MISSING_PARAMETER, "chardev");
1014         return -1;
1015     }
1016 
1017     if (dev->filter_str) {
1018         i = usbredirfilter_string_to_rules(dev->filter_str, ":", "|",
1019                                            &dev->filter_rules,
1020                                            &dev->filter_rules_count);
1021         if (i) {
1022             qerror_report(QERR_INVALID_PARAMETER_VALUE, "filter",
1023                           "a usb device filter string");
1024             return -1;
1025         }
1026     }
1027 
1028     dev->chardev_close_bh = qemu_bh_new(usbredir_chardev_close_bh, dev);
1029     dev->attach_timer = qemu_new_timer_ms(vm_clock, usbredir_do_attach, dev);
1030 
1031     packet_id_queue_init(&dev->cancelled, dev, "cancelled");
1032     packet_id_queue_init(&dev->already_in_flight, dev, "already-in-flight");
1033     for (i = 0; i < MAX_ENDPOINTS; i++) {
1034         QTAILQ_INIT(&dev->endpoint[i].bufpq);
1035     }
1036 
1037     /* We'll do the attach once we receive the speed from the usb-host */
1038     udev->auto_attach = 0;
1039 
1040     /* Let the backend know we are ready */
1041     qemu_chr_fe_open(dev->cs);
1042     qemu_chr_add_handlers(dev->cs, usbredir_chardev_can_read,
1043                           usbredir_chardev_read, usbredir_chardev_event, dev);
1044 
1045     qemu_add_vm_change_state_handler(usbredir_vm_state_change, dev);
1046     add_boot_device_path(dev->bootindex, &udev->qdev, NULL);
1047     return 0;
1048 }
1049 
1050 static void usbredir_cleanup_device_queues(USBRedirDevice *dev)
1051 {
1052     int i;
1053 
1054     packet_id_queue_empty(&dev->cancelled);
1055     packet_id_queue_empty(&dev->already_in_flight);
1056     for (i = 0; i < MAX_ENDPOINTS; i++) {
1057         usbredir_free_bufpq(dev, I2EP(i));
1058     }
1059 }
1060 
1061 static void usbredir_handle_destroy(USBDevice *udev)
1062 {
1063     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
1064 
1065     qemu_chr_fe_close(dev->cs);
1066     qemu_chr_delete(dev->cs);
1067     /* Note must be done after qemu_chr_close, as that causes a close event */
1068     qemu_bh_delete(dev->chardev_close_bh);
1069 
1070     qemu_del_timer(dev->attach_timer);
1071     qemu_free_timer(dev->attach_timer);
1072 
1073     usbredir_cleanup_device_queues(dev);
1074 
1075     if (dev->parser) {
1076         usbredirparser_destroy(dev->parser);
1077     }
1078 
1079     free(dev->filter_rules);
1080 }
1081 
1082 static int usbredir_check_filter(USBRedirDevice *dev)
1083 {
1084     if (dev->interface_info.interface_count == NO_INTERFACE_INFO) {
1085         ERROR("No interface info for device\n");
1086         goto error;
1087     }
1088 
1089     if (dev->filter_rules) {
1090         if (!usbredirparser_peer_has_cap(dev->parser,
1091                                     usb_redir_cap_connect_device_version)) {
1092             ERROR("Device filter specified and peer does not have the "
1093                   "connect_device_version capability\n");
1094             goto error;
1095         }
1096 
1097         if (usbredirfilter_check(
1098                 dev->filter_rules,
1099                 dev->filter_rules_count,
1100                 dev->device_info.device_class,
1101                 dev->device_info.device_subclass,
1102                 dev->device_info.device_protocol,
1103                 dev->interface_info.interface_class,
1104                 dev->interface_info.interface_subclass,
1105                 dev->interface_info.interface_protocol,
1106                 dev->interface_info.interface_count,
1107                 dev->device_info.vendor_id,
1108                 dev->device_info.product_id,
1109                 dev->device_info.device_version_bcd,
1110                 0) != 0) {
1111             goto error;
1112         }
1113     }
1114 
1115     return 0;
1116 
1117 error:
1118     usbredir_reject_device(dev);
1119     return -1;
1120 }
1121 
1122 /*
1123  * usbredirparser packet complete callbacks
1124  */
1125 
1126 static int usbredir_handle_status(USBRedirDevice *dev,
1127                                        int status, int actual_len)
1128 {
1129     switch (status) {
1130     case usb_redir_success:
1131         return actual_len;
1132     case usb_redir_stall:
1133         return USB_RET_STALL;
1134     case usb_redir_cancelled:
1135         /*
1136          * When the usbredir-host unredirects a device, it will report a status
1137          * of cancelled for all pending packets, followed by a disconnect msg.
1138          */
1139         return USB_RET_IOERROR;
1140     case usb_redir_inval:
1141         WARNING("got invalid param error from usb-host?\n");
1142         return USB_RET_IOERROR;
1143     case usb_redir_babble:
1144         return USB_RET_BABBLE;
1145     case usb_redir_ioerror:
1146     case usb_redir_timeout:
1147     default:
1148         return USB_RET_IOERROR;
1149     }
1150 }
1151 
1152 static void usbredir_hello(void *priv, struct usb_redir_hello_header *h)
1153 {
1154     USBRedirDevice *dev = priv;
1155 
1156     /* Try to send the filter info now that we've the usb-host's caps */
1157     if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter) &&
1158             dev->filter_rules) {
1159         usbredirparser_send_filter_filter(dev->parser, dev->filter_rules,
1160                                           dev->filter_rules_count);
1161         usbredirparser_do_write(dev->parser);
1162     }
1163 }
1164 
1165 static void usbredir_device_connect(void *priv,
1166     struct usb_redir_device_connect_header *device_connect)
1167 {
1168     USBRedirDevice *dev = priv;
1169     const char *speed;
1170 
1171     if (qemu_timer_pending(dev->attach_timer) || dev->dev.attached) {
1172         ERROR("Received device connect while already connected\n");
1173         return;
1174     }
1175 
1176     switch (device_connect->speed) {
1177     case usb_redir_speed_low:
1178         speed = "low speed";
1179         dev->dev.speed = USB_SPEED_LOW;
1180         break;
1181     case usb_redir_speed_full:
1182         speed = "full speed";
1183         dev->dev.speed = USB_SPEED_FULL;
1184         break;
1185     case usb_redir_speed_high:
1186         speed = "high speed";
1187         dev->dev.speed = USB_SPEED_HIGH;
1188         break;
1189     case usb_redir_speed_super:
1190         speed = "super speed";
1191         dev->dev.speed = USB_SPEED_SUPER;
1192         break;
1193     default:
1194         speed = "unknown speed";
1195         dev->dev.speed = USB_SPEED_FULL;
1196     }
1197 
1198     if (usbredirparser_peer_has_cap(dev->parser,
1199                                     usb_redir_cap_connect_device_version)) {
1200         INFO("attaching %s device %04x:%04x version %d.%d class %02x\n",
1201              speed, device_connect->vendor_id, device_connect->product_id,
1202              ((device_connect->device_version_bcd & 0xf000) >> 12) * 10 +
1203              ((device_connect->device_version_bcd & 0x0f00) >>  8),
1204              ((device_connect->device_version_bcd & 0x00f0) >>  4) * 10 +
1205              ((device_connect->device_version_bcd & 0x000f) >>  0),
1206              device_connect->device_class);
1207     } else {
1208         INFO("attaching %s device %04x:%04x class %02x\n", speed,
1209              device_connect->vendor_id, device_connect->product_id,
1210              device_connect->device_class);
1211     }
1212 
1213     dev->dev.speedmask = (1 << dev->dev.speed);
1214     dev->device_info = *device_connect;
1215 
1216     if (usbredir_check_filter(dev)) {
1217         WARNING("Device %04x:%04x rejected by device filter, not attaching\n",
1218                 device_connect->vendor_id, device_connect->product_id);
1219         return;
1220     }
1221 
1222     qemu_mod_timer(dev->attach_timer, dev->next_attach_time);
1223 }
1224 
1225 static void usbredir_device_disconnect(void *priv)
1226 {
1227     USBRedirDevice *dev = priv;
1228     int i;
1229 
1230     /* Stop any pending attaches */
1231     qemu_del_timer(dev->attach_timer);
1232 
1233     if (dev->dev.attached) {
1234         DPRINTF("detaching device\n");
1235         usb_device_detach(&dev->dev);
1236         /*
1237          * Delay next usb device attach to give the guest a chance to see
1238          * see the detach / attach in case of quick close / open succession
1239          */
1240         dev->next_attach_time = qemu_get_clock_ms(vm_clock) + 200;
1241     }
1242 
1243     /* Reset state so that the next dev connected starts with a clean slate */
1244     usbredir_cleanup_device_queues(dev);
1245     memset(dev->endpoint, 0, sizeof(dev->endpoint));
1246     for (i = 0; i < MAX_ENDPOINTS; i++) {
1247         QTAILQ_INIT(&dev->endpoint[i].bufpq);
1248     }
1249     usb_ep_init(&dev->dev);
1250     dev->interface_info.interface_count = NO_INTERFACE_INFO;
1251     dev->dev.addr = 0;
1252     dev->dev.speed = 0;
1253 }
1254 
1255 static void usbredir_interface_info(void *priv,
1256     struct usb_redir_interface_info_header *interface_info)
1257 {
1258     USBRedirDevice *dev = priv;
1259 
1260     dev->interface_info = *interface_info;
1261 
1262     /*
1263      * If we receive interface info after the device has already been
1264      * connected (ie on a set_config), re-check the filter.
1265      */
1266     if (qemu_timer_pending(dev->attach_timer) || dev->dev.attached) {
1267         if (usbredir_check_filter(dev)) {
1268             ERROR("Device no longer matches filter after interface info "
1269                   "change, disconnecting!\n");
1270         }
1271     }
1272 }
1273 
1274 static void usbredir_ep_info(void *priv,
1275     struct usb_redir_ep_info_header *ep_info)
1276 {
1277     USBRedirDevice *dev = priv;
1278     struct USBEndpoint *usb_ep;
1279     int i;
1280 
1281     for (i = 0; i < MAX_ENDPOINTS; i++) {
1282         dev->endpoint[i].type = ep_info->type[i];
1283         dev->endpoint[i].interval = ep_info->interval[i];
1284         dev->endpoint[i].interface = ep_info->interface[i];
1285         switch (dev->endpoint[i].type) {
1286         case usb_redir_type_invalid:
1287             break;
1288         case usb_redir_type_iso:
1289         case usb_redir_type_interrupt:
1290             if (dev->endpoint[i].interval == 0) {
1291                 ERROR("Received 0 interval for isoc or irq endpoint\n");
1292                 usbredir_device_disconnect(dev);
1293             }
1294             /* Fall through */
1295         case usb_redir_type_control:
1296         case usb_redir_type_bulk:
1297             DPRINTF("ep: %02X type: %d interface: %d\n", I2EP(i),
1298                     dev->endpoint[i].type, dev->endpoint[i].interface);
1299             break;
1300         default:
1301             ERROR("Received invalid endpoint type\n");
1302             usbredir_device_disconnect(dev);
1303             return;
1304         }
1305         usb_ep = usb_ep_get(&dev->dev,
1306                             (i & 0x10) ? USB_TOKEN_IN : USB_TOKEN_OUT,
1307                             i & 0x0f);
1308         usb_ep->type = dev->endpoint[i].type;
1309         usb_ep->ifnum = dev->endpoint[i].interface;
1310         if (usbredirparser_peer_has_cap(dev->parser,
1311                                      usb_redir_cap_ep_info_max_packet_size)) {
1312             dev->endpoint[i].max_packet_size =
1313                 usb_ep->max_packet_size = ep_info->max_packet_size[i];
1314         }
1315         if (ep_info->type[i] == usb_redir_type_bulk) {
1316             usb_ep->pipeline = true;
1317         }
1318     }
1319 }
1320 
1321 static void usbredir_configuration_status(void *priv, uint64_t id,
1322     struct usb_redir_configuration_status_header *config_status)
1323 {
1324     USBRedirDevice *dev = priv;
1325     USBPacket *p;
1326     int len = 0;
1327 
1328     DPRINTF("set config status %d config %d id %"PRIu64"\n",
1329             config_status->status, config_status->configuration, id);
1330 
1331     p = usbredir_find_packet_by_id(dev, 0, id);
1332     if (p) {
1333         if (dev->dev.setup_buf[0] & USB_DIR_IN) {
1334             dev->dev.data_buf[0] = config_status->configuration;
1335             len = 1;
1336         }
1337         p->result = usbredir_handle_status(dev, config_status->status, len);
1338         usb_generic_async_ctrl_complete(&dev->dev, p);
1339     }
1340 }
1341 
1342 static void usbredir_alt_setting_status(void *priv, uint64_t id,
1343     struct usb_redir_alt_setting_status_header *alt_setting_status)
1344 {
1345     USBRedirDevice *dev = priv;
1346     USBPacket *p;
1347     int len = 0;
1348 
1349     DPRINTF("alt status %d intf %d alt %d id: %"PRIu64"\n",
1350             alt_setting_status->status, alt_setting_status->interface,
1351             alt_setting_status->alt, id);
1352 
1353     p = usbredir_find_packet_by_id(dev, 0, id);
1354     if (p) {
1355         if (dev->dev.setup_buf[0] & USB_DIR_IN) {
1356             dev->dev.data_buf[0] = alt_setting_status->alt;
1357             len = 1;
1358         }
1359         p->result =
1360             usbredir_handle_status(dev, alt_setting_status->status, len);
1361         usb_generic_async_ctrl_complete(&dev->dev, p);
1362     }
1363 }
1364 
1365 static void usbredir_iso_stream_status(void *priv, uint64_t id,
1366     struct usb_redir_iso_stream_status_header *iso_stream_status)
1367 {
1368     USBRedirDevice *dev = priv;
1369     uint8_t ep = iso_stream_status->endpoint;
1370 
1371     DPRINTF("iso status %d ep %02X id %"PRIu64"\n", iso_stream_status->status,
1372             ep, id);
1373 
1374     if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].iso_started) {
1375         return;
1376     }
1377 
1378     dev->endpoint[EP2I(ep)].iso_error = iso_stream_status->status;
1379     if (iso_stream_status->status == usb_redir_stall) {
1380         DPRINTF("iso stream stopped by peer ep %02X\n", ep);
1381         dev->endpoint[EP2I(ep)].iso_started = 0;
1382     }
1383 }
1384 
1385 static void usbredir_interrupt_receiving_status(void *priv, uint64_t id,
1386     struct usb_redir_interrupt_receiving_status_header
1387     *interrupt_receiving_status)
1388 {
1389     USBRedirDevice *dev = priv;
1390     uint8_t ep = interrupt_receiving_status->endpoint;
1391 
1392     DPRINTF("interrupt recv status %d ep %02X id %"PRIu64"\n",
1393             interrupt_receiving_status->status, ep, id);
1394 
1395     if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].interrupt_started) {
1396         return;
1397     }
1398 
1399     dev->endpoint[EP2I(ep)].interrupt_error =
1400         interrupt_receiving_status->status;
1401     if (interrupt_receiving_status->status == usb_redir_stall) {
1402         DPRINTF("interrupt receiving stopped by peer ep %02X\n", ep);
1403         dev->endpoint[EP2I(ep)].interrupt_started = 0;
1404     }
1405 }
1406 
1407 static void usbredir_bulk_streams_status(void *priv, uint64_t id,
1408     struct usb_redir_bulk_streams_status_header *bulk_streams_status)
1409 {
1410 }
1411 
1412 static void usbredir_control_packet(void *priv, uint64_t id,
1413     struct usb_redir_control_packet_header *control_packet,
1414     uint8_t *data, int data_len)
1415 {
1416     USBRedirDevice *dev = priv;
1417     USBPacket *p;
1418     int len = control_packet->length;
1419 
1420     DPRINTF("ctrl-in status %d len %d id %"PRIu64"\n", control_packet->status,
1421             len, id);
1422 
1423     p = usbredir_find_packet_by_id(dev, 0, id);
1424     if (p) {
1425         len = usbredir_handle_status(dev, control_packet->status, len);
1426         if (len > 0) {
1427             usbredir_log_data(dev, "ctrl data in:", data, data_len);
1428             if (data_len <= sizeof(dev->dev.data_buf)) {
1429                 memcpy(dev->dev.data_buf, data, data_len);
1430             } else {
1431                 ERROR("ctrl buffer too small (%d > %zu)\n",
1432                       data_len, sizeof(dev->dev.data_buf));
1433                 len = USB_RET_STALL;
1434             }
1435         }
1436         p->result = len;
1437         usb_generic_async_ctrl_complete(&dev->dev, p);
1438     }
1439     free(data);
1440 }
1441 
1442 static void usbredir_bulk_packet(void *priv, uint64_t id,
1443     struct usb_redir_bulk_packet_header *bulk_packet,
1444     uint8_t *data, int data_len)
1445 {
1446     USBRedirDevice *dev = priv;
1447     uint8_t ep = bulk_packet->endpoint;
1448     int len = bulk_packet->length;
1449     USBPacket *p;
1450 
1451     DPRINTF("bulk-in status %d ep %02X len %d id %"PRIu64"\n",
1452             bulk_packet->status, ep, len, id);
1453 
1454     p = usbredir_find_packet_by_id(dev, ep, id);
1455     if (p) {
1456         len = usbredir_handle_status(dev, bulk_packet->status, len);
1457         if (len > 0) {
1458             usbredir_log_data(dev, "bulk data in:", data, data_len);
1459             if (data_len <= p->iov.size) {
1460                 usb_packet_copy(p, data, data_len);
1461             } else {
1462                 ERROR("bulk got more data then requested (%d > %zd)\n",
1463                       data_len, p->iov.size);
1464                 len = USB_RET_BABBLE;
1465             }
1466         }
1467         p->result = len;
1468         usb_packet_complete(&dev->dev, p);
1469     }
1470     free(data);
1471 }
1472 
1473 static void usbredir_iso_packet(void *priv, uint64_t id,
1474     struct usb_redir_iso_packet_header *iso_packet,
1475     uint8_t *data, int data_len)
1476 {
1477     USBRedirDevice *dev = priv;
1478     uint8_t ep = iso_packet->endpoint;
1479 
1480     DPRINTF2("iso-in status %d ep %02X len %d id %"PRIu64"\n",
1481              iso_packet->status, ep, data_len, id);
1482 
1483     if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_ISOC) {
1484         ERROR("received iso packet for non iso endpoint %02X\n", ep);
1485         free(data);
1486         return;
1487     }
1488 
1489     if (dev->endpoint[EP2I(ep)].iso_started == 0) {
1490         DPRINTF("received iso packet for non started stream ep %02X\n", ep);
1491         free(data);
1492         return;
1493     }
1494 
1495     /* bufp_alloc also adds the packet to the ep queue */
1496     bufp_alloc(dev, data, data_len, iso_packet->status, ep);
1497 }
1498 
1499 static void usbredir_interrupt_packet(void *priv, uint64_t id,
1500     struct usb_redir_interrupt_packet_header *interrupt_packet,
1501     uint8_t *data, int data_len)
1502 {
1503     USBRedirDevice *dev = priv;
1504     uint8_t ep = interrupt_packet->endpoint;
1505 
1506     DPRINTF("interrupt-in status %d ep %02X len %d id %"PRIu64"\n",
1507             interrupt_packet->status, ep, data_len, id);
1508 
1509     if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_INT) {
1510         ERROR("received int packet for non interrupt endpoint %02X\n", ep);
1511         free(data);
1512         return;
1513     }
1514 
1515     if (ep & USB_DIR_IN) {
1516         if (dev->endpoint[EP2I(ep)].interrupt_started == 0) {
1517             DPRINTF("received int packet while not started ep %02X\n", ep);
1518             free(data);
1519             return;
1520         }
1521 
1522         /* bufp_alloc also adds the packet to the ep queue */
1523         bufp_alloc(dev, data, data_len, interrupt_packet->status, ep);
1524     } else {
1525         int len = interrupt_packet->length;
1526 
1527         USBPacket *p = usbredir_find_packet_by_id(dev, ep, id);
1528         if (p) {
1529             p->result = usbredir_handle_status(dev,
1530                                                interrupt_packet->status, len);
1531             usb_packet_complete(&dev->dev, p);
1532         }
1533     }
1534 }
1535 
1536 /*
1537  * Migration code
1538  */
1539 
1540 static void usbredir_pre_save(void *priv)
1541 {
1542     USBRedirDevice *dev = priv;
1543 
1544     usbredir_fill_already_in_flight(dev);
1545 }
1546 
1547 static int usbredir_post_load(void *priv, int version_id)
1548 {
1549     USBRedirDevice *dev = priv;
1550     struct USBEndpoint *usb_ep;
1551     int i;
1552 
1553     switch (dev->device_info.speed) {
1554     case usb_redir_speed_low:
1555         dev->dev.speed = USB_SPEED_LOW;
1556         break;
1557     case usb_redir_speed_full:
1558         dev->dev.speed = USB_SPEED_FULL;
1559         break;
1560     case usb_redir_speed_high:
1561         dev->dev.speed = USB_SPEED_HIGH;
1562         break;
1563     case usb_redir_speed_super:
1564         dev->dev.speed = USB_SPEED_SUPER;
1565         break;
1566     default:
1567         dev->dev.speed = USB_SPEED_FULL;
1568     }
1569     dev->dev.speedmask = (1 << dev->dev.speed);
1570 
1571     for (i = 0; i < MAX_ENDPOINTS; i++) {
1572         usb_ep = usb_ep_get(&dev->dev,
1573                             (i & 0x10) ? USB_TOKEN_IN : USB_TOKEN_OUT,
1574                             i & 0x0f);
1575         usb_ep->type = dev->endpoint[i].type;
1576         usb_ep->ifnum = dev->endpoint[i].interface;
1577         usb_ep->max_packet_size = dev->endpoint[i].max_packet_size;
1578         if (dev->endpoint[i].type == usb_redir_type_bulk) {
1579             usb_ep->pipeline = true;
1580         }
1581     }
1582     return 0;
1583 }
1584 
1585 /* For usbredirparser migration */
1586 static void usbredir_put_parser(QEMUFile *f, void *priv, size_t unused)
1587 {
1588     USBRedirDevice *dev = priv;
1589     uint8_t *data;
1590     int len;
1591 
1592     if (dev->parser == NULL) {
1593         qemu_put_be32(f, 0);
1594         return;
1595     }
1596 
1597     usbredirparser_serialize(dev->parser, &data, &len);
1598     qemu_oom_check(data);
1599 
1600     qemu_put_be32(f, len);
1601     qemu_put_buffer(f, data, len);
1602 
1603     free(data);
1604 }
1605 
1606 static int usbredir_get_parser(QEMUFile *f, void *priv, size_t unused)
1607 {
1608     USBRedirDevice *dev = priv;
1609     uint8_t *data;
1610     int len, ret;
1611 
1612     len = qemu_get_be32(f);
1613     if (len == 0) {
1614         return 0;
1615     }
1616 
1617     /*
1618      * Our chardev should be open already at this point, otherwise
1619      * the usbredir channel will be broken (ie spice without seamless)
1620      */
1621     if (dev->parser == NULL) {
1622         ERROR("get_parser called with closed chardev, failing migration\n");
1623         return -1;
1624     }
1625 
1626     data = g_malloc(len);
1627     qemu_get_buffer(f, data, len);
1628 
1629     ret = usbredirparser_unserialize(dev->parser, data, len);
1630 
1631     g_free(data);
1632 
1633     return ret;
1634 }
1635 
1636 static const VMStateInfo usbredir_parser_vmstate_info = {
1637     .name = "usb-redir-parser",
1638     .put  = usbredir_put_parser,
1639     .get  = usbredir_get_parser,
1640 };
1641 
1642 
1643 /* For buffered packets (iso/irq) queue migration */
1644 static void usbredir_put_bufpq(QEMUFile *f, void *priv, size_t unused)
1645 {
1646     struct endp_data *endp = priv;
1647     struct buf_packet *bufp;
1648     int remain = endp->bufpq_size;
1649 
1650     qemu_put_be32(f, endp->bufpq_size);
1651     QTAILQ_FOREACH(bufp, &endp->bufpq, next) {
1652         qemu_put_be32(f, bufp->len);
1653         qemu_put_be32(f, bufp->status);
1654         qemu_put_buffer(f, bufp->data, bufp->len);
1655         remain--;
1656     }
1657     assert(remain == 0);
1658 }
1659 
1660 static int usbredir_get_bufpq(QEMUFile *f, void *priv, size_t unused)
1661 {
1662     struct endp_data *endp = priv;
1663     struct buf_packet *bufp;
1664     int i;
1665 
1666     endp->bufpq_size = qemu_get_be32(f);
1667     for (i = 0; i < endp->bufpq_size; i++) {
1668         bufp = g_malloc(sizeof(struct buf_packet));
1669         bufp->len = qemu_get_be32(f);
1670         bufp->status = qemu_get_be32(f);
1671         bufp->data = qemu_oom_check(malloc(bufp->len)); /* regular malloc! */
1672         qemu_get_buffer(f, bufp->data, bufp->len);
1673         QTAILQ_INSERT_TAIL(&endp->bufpq, bufp, next);
1674     }
1675     return 0;
1676 }
1677 
1678 static const VMStateInfo usbredir_ep_bufpq_vmstate_info = {
1679     .name = "usb-redir-bufpq",
1680     .put  = usbredir_put_bufpq,
1681     .get  = usbredir_get_bufpq,
1682 };
1683 
1684 
1685 /* For endp_data migration */
1686 static const VMStateDescription usbredir_ep_vmstate = {
1687     .name = "usb-redir-ep",
1688     .version_id = 1,
1689     .minimum_version_id = 1,
1690     .fields = (VMStateField[]) {
1691         VMSTATE_UINT8(type, struct endp_data),
1692         VMSTATE_UINT8(interval, struct endp_data),
1693         VMSTATE_UINT8(interface, struct endp_data),
1694         VMSTATE_UINT16(max_packet_size, struct endp_data),
1695         VMSTATE_UINT8(iso_started, struct endp_data),
1696         VMSTATE_UINT8(iso_error, struct endp_data),
1697         VMSTATE_UINT8(interrupt_started, struct endp_data),
1698         VMSTATE_UINT8(interrupt_error, struct endp_data),
1699         VMSTATE_UINT8(bufpq_prefilled, struct endp_data),
1700         VMSTATE_UINT8(bufpq_dropping_packets, struct endp_data),
1701         {
1702             .name         = "bufpq",
1703             .version_id   = 0,
1704             .field_exists = NULL,
1705             .size         = 0,
1706             .info         = &usbredir_ep_bufpq_vmstate_info,
1707             .flags        = VMS_SINGLE,
1708             .offset       = 0,
1709         },
1710         VMSTATE_INT32(bufpq_target_size, struct endp_data),
1711         VMSTATE_END_OF_LIST()
1712     }
1713 };
1714 
1715 
1716 /* For PacketIdQueue migration */
1717 static void usbredir_put_packet_id_q(QEMUFile *f, void *priv, size_t unused)
1718 {
1719     struct PacketIdQueue *q = priv;
1720     USBRedirDevice *dev = q->dev;
1721     struct PacketIdQueueEntry *e;
1722     int remain = q->size;
1723 
1724     DPRINTF("put_packet_id_q %s size %d\n", q->name, q->size);
1725     qemu_put_be32(f, q->size);
1726     QTAILQ_FOREACH(e, &q->head, next) {
1727         qemu_put_be64(f, e->id);
1728         remain--;
1729     }
1730     assert(remain == 0);
1731 }
1732 
1733 static int usbredir_get_packet_id_q(QEMUFile *f, void *priv, size_t unused)
1734 {
1735     struct PacketIdQueue *q = priv;
1736     USBRedirDevice *dev = q->dev;
1737     int i, size;
1738     uint64_t id;
1739 
1740     size = qemu_get_be32(f);
1741     DPRINTF("get_packet_id_q %s size %d\n", q->name, size);
1742     for (i = 0; i < size; i++) {
1743         id = qemu_get_be64(f);
1744         packet_id_queue_add(q, id);
1745     }
1746     assert(q->size == size);
1747     return 0;
1748 }
1749 
1750 static const VMStateInfo usbredir_ep_packet_id_q_vmstate_info = {
1751     .name = "usb-redir-packet-id-q",
1752     .put  = usbredir_put_packet_id_q,
1753     .get  = usbredir_get_packet_id_q,
1754 };
1755 
1756 static const VMStateDescription usbredir_ep_packet_id_queue_vmstate = {
1757     .name = "usb-redir-packet-id-queue",
1758     .version_id = 1,
1759     .minimum_version_id = 1,
1760     .fields = (VMStateField[]) {
1761         {
1762             .name         = "queue",
1763             .version_id   = 0,
1764             .field_exists = NULL,
1765             .size         = 0,
1766             .info         = &usbredir_ep_packet_id_q_vmstate_info,
1767             .flags        = VMS_SINGLE,
1768             .offset       = 0,
1769         },
1770         VMSTATE_END_OF_LIST()
1771     }
1772 };
1773 
1774 
1775 /* For usb_redir_device_connect_header migration */
1776 static const VMStateDescription usbredir_device_info_vmstate = {
1777     .name = "usb-redir-device-info",
1778     .version_id = 1,
1779     .minimum_version_id = 1,
1780     .fields = (VMStateField[]) {
1781         VMSTATE_UINT8(speed, struct usb_redir_device_connect_header),
1782         VMSTATE_UINT8(device_class, struct usb_redir_device_connect_header),
1783         VMSTATE_UINT8(device_subclass, struct usb_redir_device_connect_header),
1784         VMSTATE_UINT8(device_protocol, struct usb_redir_device_connect_header),
1785         VMSTATE_UINT16(vendor_id, struct usb_redir_device_connect_header),
1786         VMSTATE_UINT16(product_id, struct usb_redir_device_connect_header),
1787         VMSTATE_UINT16(device_version_bcd,
1788                        struct usb_redir_device_connect_header),
1789         VMSTATE_END_OF_LIST()
1790     }
1791 };
1792 
1793 
1794 /* For usb_redir_interface_info_header migration */
1795 static const VMStateDescription usbredir_interface_info_vmstate = {
1796     .name = "usb-redir-interface-info",
1797     .version_id = 1,
1798     .minimum_version_id = 1,
1799     .fields = (VMStateField[]) {
1800         VMSTATE_UINT32(interface_count,
1801                        struct usb_redir_interface_info_header),
1802         VMSTATE_UINT8_ARRAY(interface,
1803                             struct usb_redir_interface_info_header, 32),
1804         VMSTATE_UINT8_ARRAY(interface_class,
1805                             struct usb_redir_interface_info_header, 32),
1806         VMSTATE_UINT8_ARRAY(interface_subclass,
1807                             struct usb_redir_interface_info_header, 32),
1808         VMSTATE_UINT8_ARRAY(interface_protocol,
1809                             struct usb_redir_interface_info_header, 32),
1810         VMSTATE_END_OF_LIST()
1811     }
1812 };
1813 
1814 
1815 /* And finally the USBRedirDevice vmstate itself */
1816 static const VMStateDescription usbredir_vmstate = {
1817     .name = "usb-redir",
1818     .version_id = 1,
1819     .minimum_version_id = 1,
1820     .pre_save = usbredir_pre_save,
1821     .post_load = usbredir_post_load,
1822     .fields = (VMStateField[]) {
1823         VMSTATE_USB_DEVICE(dev, USBRedirDevice),
1824         VMSTATE_TIMER(attach_timer, USBRedirDevice),
1825         {
1826             .name         = "parser",
1827             .version_id   = 0,
1828             .field_exists = NULL,
1829             .size         = 0,
1830             .info         = &usbredir_parser_vmstate_info,
1831             .flags        = VMS_SINGLE,
1832             .offset       = 0,
1833         },
1834         VMSTATE_STRUCT_ARRAY(endpoint, USBRedirDevice, MAX_ENDPOINTS, 1,
1835                              usbredir_ep_vmstate, struct endp_data),
1836         VMSTATE_STRUCT(cancelled, USBRedirDevice, 1,
1837                        usbredir_ep_packet_id_queue_vmstate,
1838                        struct PacketIdQueue),
1839         VMSTATE_STRUCT(already_in_flight, USBRedirDevice, 1,
1840                        usbredir_ep_packet_id_queue_vmstate,
1841                        struct PacketIdQueue),
1842         VMSTATE_STRUCT(device_info, USBRedirDevice, 1,
1843                        usbredir_device_info_vmstate,
1844                        struct usb_redir_device_connect_header),
1845         VMSTATE_STRUCT(interface_info, USBRedirDevice, 1,
1846                        usbredir_interface_info_vmstate,
1847                        struct usb_redir_interface_info_header),
1848         VMSTATE_END_OF_LIST()
1849     }
1850 };
1851 
1852 static Property usbredir_properties[] = {
1853     DEFINE_PROP_CHR("chardev", USBRedirDevice, cs),
1854     DEFINE_PROP_UINT8("debug", USBRedirDevice, debug, 0),
1855     DEFINE_PROP_STRING("filter", USBRedirDevice, filter_str),
1856     DEFINE_PROP_INT32("bootindex", USBRedirDevice, bootindex, -1),
1857     DEFINE_PROP_END_OF_LIST(),
1858 };
1859 
1860 static void usbredir_class_initfn(ObjectClass *klass, void *data)
1861 {
1862     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
1863     DeviceClass *dc = DEVICE_CLASS(klass);
1864 
1865     uc->init           = usbredir_initfn;
1866     uc->product_desc   = "USB Redirection Device";
1867     uc->handle_destroy = usbredir_handle_destroy;
1868     uc->cancel_packet  = usbredir_cancel_packet;
1869     uc->handle_reset   = usbredir_handle_reset;
1870     uc->handle_data    = usbredir_handle_data;
1871     uc->handle_control = usbredir_handle_control;
1872     dc->vmsd           = &usbredir_vmstate;
1873     dc->props          = usbredir_properties;
1874 }
1875 
1876 static TypeInfo usbredir_dev_info = {
1877     .name          = "usb-redir",
1878     .parent        = TYPE_USB_DEVICE,
1879     .instance_size = sizeof(USBRedirDevice),
1880     .class_init    = usbredir_class_initfn,
1881 };
1882 
1883 static void usbredir_register_types(void)
1884 {
1885     type_register_static(&usbredir_dev_info);
1886 }
1887 
1888 type_init(usbredir_register_types)
1889