xref: /qemu/hw/usb/redirect.c (revision 1b3e6f88dc151578acb6158e22570cf3ee7cbb69)
1 /*
2  * USB redirector usb-guest
3  *
4  * Copyright (c) 2011-2012 Red Hat, Inc.
5  *
6  * Red Hat Authors:
7  * Hans de Goede <hdegoede@redhat.com>
8  *
9  * Permission is hereby granted, free of charge, to any person obtaining a copy
10  * of this software and associated documentation files (the "Software"), to deal
11  * in the Software without restriction, including without limitation the rights
12  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
13  * copies of the Software, and to permit persons to whom the Software is
14  * furnished to do so, subject to the following conditions:
15  *
16  * The above copyright notice and this permission notice shall be included in
17  * all copies or substantial portions of the Software.
18  *
19  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
20  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
21  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
22  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
23  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
24  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25  * THE SOFTWARE.
26  */
27 
28 #include "qemu-common.h"
29 #include "qemu-timer.h"
30 #include "monitor.h"
31 #include "sysemu.h"
32 
33 #include <dirent.h>
34 #include <sys/ioctl.h>
35 #include <signal.h>
36 #include <usbredirparser.h>
37 #include <usbredirfilter.h>
38 
39 #include "hw/usb.h"
40 
41 #define MAX_ENDPOINTS 32
42 #define NO_INTERFACE_INFO 255 /* Valid interface_count always <= 32 */
43 #define EP2I(ep_address) (((ep_address & 0x80) >> 3) | (ep_address & 0x0f))
44 #define I2EP(i) (((i & 0x10) << 3) | (i & 0x0f))
45 
46 typedef struct USBRedirDevice USBRedirDevice;
47 
48 /* Struct to hold buffered packets (iso or int input packets) */
49 struct buf_packet {
50     uint8_t *data;
51     int len;
52     int status;
53     QTAILQ_ENTRY(buf_packet)next;
54 };
55 
56 struct endp_data {
57     uint8_t type;
58     uint8_t interval;
59     uint8_t interface; /* bInterfaceNumber this ep belongs to */
60     uint16_t max_packet_size; /* In bytes, not wMaxPacketSize format !! */
61     uint8_t iso_started;
62     uint8_t iso_error; /* For reporting iso errors to the HC */
63     uint8_t interrupt_started;
64     uint8_t interrupt_error;
65     uint8_t bufpq_prefilled;
66     uint8_t bufpq_dropping_packets;
67     QTAILQ_HEAD(, buf_packet) bufpq;
68     int32_t bufpq_size;
69     int32_t bufpq_target_size;
70 };
71 
72 struct PacketIdQueueEntry {
73     uint64_t id;
74     QTAILQ_ENTRY(PacketIdQueueEntry)next;
75 };
76 
77 struct PacketIdQueue {
78     USBRedirDevice *dev;
79     const char *name;
80     QTAILQ_HEAD(, PacketIdQueueEntry) head;
81     int size;
82 };
83 
84 struct USBRedirDevice {
85     USBDevice dev;
86     /* Properties */
87     CharDriverState *cs;
88     uint8_t debug;
89     char *filter_str;
90     int32_t bootindex;
91     /* Data passed from chardev the fd_read cb to the usbredirparser read cb */
92     const uint8_t *read_buf;
93     int read_buf_size;
94     /* For async handling of close */
95     QEMUBH *chardev_close_bh;
96     /* To delay the usb attach in case of quick chardev close + open */
97     QEMUTimer *attach_timer;
98     int64_t next_attach_time;
99     struct usbredirparser *parser;
100     struct endp_data endpoint[MAX_ENDPOINTS];
101     struct PacketIdQueue cancelled;
102     struct PacketIdQueue already_in_flight;
103     /* Data for device filtering */
104     struct usb_redir_device_connect_header device_info;
105     struct usb_redir_interface_info_header interface_info;
106     struct usbredirfilter_rule *filter_rules;
107     int filter_rules_count;
108 };
109 
110 static void usbredir_hello(void *priv, struct usb_redir_hello_header *h);
111 static void usbredir_device_connect(void *priv,
112     struct usb_redir_device_connect_header *device_connect);
113 static void usbredir_device_disconnect(void *priv);
114 static void usbredir_interface_info(void *priv,
115     struct usb_redir_interface_info_header *interface_info);
116 static void usbredir_ep_info(void *priv,
117     struct usb_redir_ep_info_header *ep_info);
118 static void usbredir_configuration_status(void *priv, uint64_t id,
119     struct usb_redir_configuration_status_header *configuration_status);
120 static void usbredir_alt_setting_status(void *priv, uint64_t id,
121     struct usb_redir_alt_setting_status_header *alt_setting_status);
122 static void usbredir_iso_stream_status(void *priv, uint64_t id,
123     struct usb_redir_iso_stream_status_header *iso_stream_status);
124 static void usbredir_interrupt_receiving_status(void *priv, uint64_t id,
125     struct usb_redir_interrupt_receiving_status_header
126     *interrupt_receiving_status);
127 static void usbredir_bulk_streams_status(void *priv, uint64_t id,
128     struct usb_redir_bulk_streams_status_header *bulk_streams_status);
129 static void usbredir_control_packet(void *priv, uint64_t id,
130     struct usb_redir_control_packet_header *control_packet,
131     uint8_t *data, int data_len);
132 static void usbredir_bulk_packet(void *priv, uint64_t id,
133     struct usb_redir_bulk_packet_header *bulk_packet,
134     uint8_t *data, int data_len);
135 static void usbredir_iso_packet(void *priv, uint64_t id,
136     struct usb_redir_iso_packet_header *iso_packet,
137     uint8_t *data, int data_len);
138 static void usbredir_interrupt_packet(void *priv, uint64_t id,
139     struct usb_redir_interrupt_packet_header *interrupt_header,
140     uint8_t *data, int data_len);
141 
142 static int usbredir_handle_status(USBRedirDevice *dev,
143                                        int status, int actual_len);
144 
145 #define VERSION "qemu usb-redir guest " QEMU_VERSION
146 
147 /*
148  * Logging stuff
149  */
150 
151 #define ERROR(...) \
152     do { \
153         if (dev->debug >= usbredirparser_error) { \
154             error_report("usb-redir error: " __VA_ARGS__); \
155         } \
156     } while (0)
157 #define WARNING(...) \
158     do { \
159         if (dev->debug >= usbredirparser_warning) { \
160             error_report("usb-redir warning: " __VA_ARGS__); \
161         } \
162     } while (0)
163 #define INFO(...) \
164     do { \
165         if (dev->debug >= usbredirparser_info) { \
166             error_report("usb-redir: " __VA_ARGS__); \
167         } \
168     } while (0)
169 #define DPRINTF(...) \
170     do { \
171         if (dev->debug >= usbredirparser_debug) { \
172             error_report("usb-redir: " __VA_ARGS__); \
173         } \
174     } while (0)
175 #define DPRINTF2(...) \
176     do { \
177         if (dev->debug >= usbredirparser_debug_data) { \
178             error_report("usb-redir: " __VA_ARGS__); \
179         } \
180     } while (0)
181 
182 static void usbredir_log(void *priv, int level, const char *msg)
183 {
184     USBRedirDevice *dev = priv;
185 
186     if (dev->debug < level) {
187         return;
188     }
189 
190     error_report("%s", msg);
191 }
192 
193 static void usbredir_log_data(USBRedirDevice *dev, const char *desc,
194     const uint8_t *data, int len)
195 {
196     int i, j, n;
197 
198     if (dev->debug < usbredirparser_debug_data) {
199         return;
200     }
201 
202     for (i = 0; i < len; i += j) {
203         char buf[128];
204 
205         n = sprintf(buf, "%s", desc);
206         for (j = 0; j < 8 && i + j < len; j++) {
207             n += sprintf(buf + n, " %02X", data[i + j]);
208         }
209         error_report("%s", buf);
210     }
211 }
212 
213 /*
214  * usbredirparser io functions
215  */
216 
217 static int usbredir_read(void *priv, uint8_t *data, int count)
218 {
219     USBRedirDevice *dev = priv;
220 
221     if (dev->read_buf_size < count) {
222         count = dev->read_buf_size;
223     }
224 
225     memcpy(data, dev->read_buf, count);
226 
227     dev->read_buf_size -= count;
228     if (dev->read_buf_size) {
229         dev->read_buf += count;
230     } else {
231         dev->read_buf = NULL;
232     }
233 
234     return count;
235 }
236 
237 static int usbredir_write(void *priv, uint8_t *data, int count)
238 {
239     USBRedirDevice *dev = priv;
240 
241     if (!dev->cs->opened) {
242         return 0;
243     }
244 
245     /* Don't send new data to the chardev until our state is fully synced */
246     if (!runstate_check(RUN_STATE_RUNNING)) {
247         return 0;
248     }
249 
250     return qemu_chr_fe_write(dev->cs, data, count);
251 }
252 
253 /*
254  * Cancelled and buffered packets helpers
255  */
256 
257 static void packet_id_queue_init(struct PacketIdQueue *q,
258     USBRedirDevice *dev, const char *name)
259 {
260     q->dev = dev;
261     q->name = name;
262     QTAILQ_INIT(&q->head);
263     q->size = 0;
264 }
265 
266 static void packet_id_queue_add(struct PacketIdQueue *q, uint64_t id)
267 {
268     USBRedirDevice *dev = q->dev;
269     struct PacketIdQueueEntry *e;
270 
271     DPRINTF("adding packet id %"PRIu64" to %s queue\n", id, q->name);
272 
273     e = g_malloc0(sizeof(struct PacketIdQueueEntry));
274     e->id = id;
275     QTAILQ_INSERT_TAIL(&q->head, e, next);
276     q->size++;
277 }
278 
279 static int packet_id_queue_remove(struct PacketIdQueue *q, uint64_t id)
280 {
281     USBRedirDevice *dev = q->dev;
282     struct PacketIdQueueEntry *e;
283 
284     QTAILQ_FOREACH(e, &q->head, next) {
285         if (e->id == id) {
286             DPRINTF("removing packet id %"PRIu64" from %s queue\n",
287                     id, q->name);
288             QTAILQ_REMOVE(&q->head, e, next);
289             q->size--;
290             g_free(e);
291             return 1;
292         }
293     }
294     return 0;
295 }
296 
297 static void packet_id_queue_empty(struct PacketIdQueue *q)
298 {
299     USBRedirDevice *dev = q->dev;
300     struct PacketIdQueueEntry *e, *next_e;
301 
302     DPRINTF("removing %d packet-ids from %s queue\n", q->size, q->name);
303 
304     QTAILQ_FOREACH_SAFE(e, &q->head, next, next_e) {
305         QTAILQ_REMOVE(&q->head, e, next);
306         g_free(e);
307     }
308     q->size = 0;
309 }
310 
311 static void usbredir_cancel_packet(USBDevice *udev, USBPacket *p)
312 {
313     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
314 
315     packet_id_queue_add(&dev->cancelled, p->id);
316     usbredirparser_send_cancel_data_packet(dev->parser, p->id);
317     usbredirparser_do_write(dev->parser);
318 }
319 
320 static int usbredir_is_cancelled(USBRedirDevice *dev, uint64_t id)
321 {
322     if (!dev->dev.attached) {
323         return 1; /* Treat everything as cancelled after a disconnect */
324     }
325     return packet_id_queue_remove(&dev->cancelled, id);
326 }
327 
328 static void usbredir_fill_already_in_flight_from_ep(USBRedirDevice *dev,
329     struct USBEndpoint *ep)
330 {
331     static USBPacket *p;
332 
333     QTAILQ_FOREACH(p, &ep->queue, queue) {
334         packet_id_queue_add(&dev->already_in_flight, p->id);
335     }
336 }
337 
338 static void usbredir_fill_already_in_flight(USBRedirDevice *dev)
339 {
340     int ep;
341     struct USBDevice *udev = &dev->dev;
342 
343     usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_ctl);
344 
345     for (ep = 0; ep < USB_MAX_ENDPOINTS; ep++) {
346         usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_in[ep]);
347         usbredir_fill_already_in_flight_from_ep(dev, &udev->ep_out[ep]);
348     }
349 }
350 
351 static int usbredir_already_in_flight(USBRedirDevice *dev, uint64_t id)
352 {
353     return packet_id_queue_remove(&dev->already_in_flight, id);
354 }
355 
356 static USBPacket *usbredir_find_packet_by_id(USBRedirDevice *dev,
357     uint8_t ep, uint64_t id)
358 {
359     USBPacket *p;
360 
361     if (usbredir_is_cancelled(dev, id)) {
362         return NULL;
363     }
364 
365     p = usb_ep_find_packet_by_id(&dev->dev,
366                             (ep & USB_DIR_IN) ? USB_TOKEN_IN : USB_TOKEN_OUT,
367                             ep & 0x0f, id);
368     if (p == NULL) {
369         ERROR("could not find packet with id %"PRIu64"\n", id);
370     }
371     return p;
372 }
373 
374 static void bufp_alloc(USBRedirDevice *dev,
375     uint8_t *data, int len, int status, uint8_t ep)
376 {
377     struct buf_packet *bufp;
378 
379     if (!dev->endpoint[EP2I(ep)].bufpq_dropping_packets &&
380         dev->endpoint[EP2I(ep)].bufpq_size >
381             2 * dev->endpoint[EP2I(ep)].bufpq_target_size) {
382         DPRINTF("bufpq overflow, dropping packets ep %02X\n", ep);
383         dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 1;
384     }
385     /* Since we're interupting the stream anyways, drop enough packets to get
386        back to our target buffer size */
387     if (dev->endpoint[EP2I(ep)].bufpq_dropping_packets) {
388         if (dev->endpoint[EP2I(ep)].bufpq_size >
389                 dev->endpoint[EP2I(ep)].bufpq_target_size) {
390             free(data);
391             return;
392         }
393         dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
394     }
395 
396     bufp = g_malloc(sizeof(struct buf_packet));
397     bufp->data   = data;
398     bufp->len    = len;
399     bufp->status = status;
400     QTAILQ_INSERT_TAIL(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);
401     dev->endpoint[EP2I(ep)].bufpq_size++;
402 }
403 
404 static void bufp_free(USBRedirDevice *dev, struct buf_packet *bufp,
405     uint8_t ep)
406 {
407     QTAILQ_REMOVE(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);
408     dev->endpoint[EP2I(ep)].bufpq_size--;
409     free(bufp->data);
410     g_free(bufp);
411 }
412 
413 static void usbredir_free_bufpq(USBRedirDevice *dev, uint8_t ep)
414 {
415     struct buf_packet *buf, *buf_next;
416 
417     QTAILQ_FOREACH_SAFE(buf, &dev->endpoint[EP2I(ep)].bufpq, next, buf_next) {
418         bufp_free(dev, buf, ep);
419     }
420 }
421 
422 /*
423  * USBDevice callbacks
424  */
425 
426 static void usbredir_handle_reset(USBDevice *udev)
427 {
428     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
429 
430     DPRINTF("reset device\n");
431     usbredirparser_send_reset(dev->parser);
432     usbredirparser_do_write(dev->parser);
433 }
434 
435 static int usbredir_handle_iso_data(USBRedirDevice *dev, USBPacket *p,
436                                      uint8_t ep)
437 {
438     int status, len;
439     if (!dev->endpoint[EP2I(ep)].iso_started &&
440             !dev->endpoint[EP2I(ep)].iso_error) {
441         struct usb_redir_start_iso_stream_header start_iso = {
442             .endpoint = ep,
443         };
444         int pkts_per_sec;
445 
446         if (dev->dev.speed == USB_SPEED_HIGH) {
447             pkts_per_sec = 8000 / dev->endpoint[EP2I(ep)].interval;
448         } else {
449             pkts_per_sec = 1000 / dev->endpoint[EP2I(ep)].interval;
450         }
451         /* Testing has shown that we need circa 60 ms buffer */
452         dev->endpoint[EP2I(ep)].bufpq_target_size = (pkts_per_sec * 60) / 1000;
453 
454         /* Aim for approx 100 interrupts / second on the client to
455            balance latency and interrupt load */
456         start_iso.pkts_per_urb = pkts_per_sec / 100;
457         if (start_iso.pkts_per_urb < 1) {
458             start_iso.pkts_per_urb = 1;
459         } else if (start_iso.pkts_per_urb > 32) {
460             start_iso.pkts_per_urb = 32;
461         }
462 
463         start_iso.no_urbs = (dev->endpoint[EP2I(ep)].bufpq_target_size +
464                              start_iso.pkts_per_urb - 1) /
465                             start_iso.pkts_per_urb;
466         /* Output endpoints pre-fill only 1/2 of the packets, keeping the rest
467            as overflow buffer. Also see the usbredir protocol documentation */
468         if (!(ep & USB_DIR_IN)) {
469             start_iso.no_urbs *= 2;
470         }
471         if (start_iso.no_urbs > 16) {
472             start_iso.no_urbs = 16;
473         }
474 
475         /* No id, we look at the ep when receiving a status back */
476         usbredirparser_send_start_iso_stream(dev->parser, 0, &start_iso);
477         usbredirparser_do_write(dev->parser);
478         DPRINTF("iso stream started pkts/sec %d pkts/urb %d urbs %d ep %02X\n",
479                 pkts_per_sec, start_iso.pkts_per_urb, start_iso.no_urbs, ep);
480         dev->endpoint[EP2I(ep)].iso_started = 1;
481         dev->endpoint[EP2I(ep)].bufpq_prefilled = 0;
482         dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
483     }
484 
485     if (ep & USB_DIR_IN) {
486         struct buf_packet *isop;
487 
488         if (dev->endpoint[EP2I(ep)].iso_started &&
489                 !dev->endpoint[EP2I(ep)].bufpq_prefilled) {
490             if (dev->endpoint[EP2I(ep)].bufpq_size <
491                     dev->endpoint[EP2I(ep)].bufpq_target_size) {
492                 return usbredir_handle_status(dev, 0, 0);
493             }
494             dev->endpoint[EP2I(ep)].bufpq_prefilled = 1;
495         }
496 
497         isop = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq);
498         if (isop == NULL) {
499             DPRINTF("iso-token-in ep %02X, no isop, iso_error: %d\n",
500                     ep, dev->endpoint[EP2I(ep)].iso_error);
501             /* Re-fill the buffer */
502             dev->endpoint[EP2I(ep)].bufpq_prefilled = 0;
503             /* Check iso_error for stream errors, otherwise its an underrun */
504             status = dev->endpoint[EP2I(ep)].iso_error;
505             dev->endpoint[EP2I(ep)].iso_error = 0;
506             return status ? USB_RET_IOERROR : 0;
507         }
508         DPRINTF2("iso-token-in ep %02X status %d len %d queue-size: %d\n", ep,
509                  isop->status, isop->len, dev->endpoint[EP2I(ep)].bufpq_size);
510 
511         status = isop->status;
512         if (status != usb_redir_success) {
513             bufp_free(dev, isop, ep);
514             return USB_RET_IOERROR;
515         }
516 
517         len = isop->len;
518         if (len > p->iov.size) {
519             ERROR("received iso data is larger then packet ep %02X (%d > %d)\n",
520                   ep, len, (int)p->iov.size);
521             bufp_free(dev, isop, ep);
522             return USB_RET_BABBLE;
523         }
524         usb_packet_copy(p, isop->data, len);
525         bufp_free(dev, isop, ep);
526         return len;
527     } else {
528         /* If the stream was not started because of a pending error don't
529            send the packet to the usb-host */
530         if (dev->endpoint[EP2I(ep)].iso_started) {
531             struct usb_redir_iso_packet_header iso_packet = {
532                 .endpoint = ep,
533                 .length = p->iov.size
534             };
535             uint8_t buf[p->iov.size];
536             /* No id, we look at the ep when receiving a status back */
537             usb_packet_copy(p, buf, p->iov.size);
538             usbredirparser_send_iso_packet(dev->parser, 0, &iso_packet,
539                                            buf, p->iov.size);
540             usbredirparser_do_write(dev->parser);
541         }
542         status = dev->endpoint[EP2I(ep)].iso_error;
543         dev->endpoint[EP2I(ep)].iso_error = 0;
544         DPRINTF2("iso-token-out ep %02X status %d len %zd\n", ep, status,
545                  p->iov.size);
546         return usbredir_handle_status(dev, status, p->iov.size);
547     }
548 }
549 
550 static void usbredir_stop_iso_stream(USBRedirDevice *dev, uint8_t ep)
551 {
552     struct usb_redir_stop_iso_stream_header stop_iso_stream = {
553         .endpoint = ep
554     };
555     if (dev->endpoint[EP2I(ep)].iso_started) {
556         usbredirparser_send_stop_iso_stream(dev->parser, 0, &stop_iso_stream);
557         DPRINTF("iso stream stopped ep %02X\n", ep);
558         dev->endpoint[EP2I(ep)].iso_started = 0;
559     }
560     dev->endpoint[EP2I(ep)].iso_error = 0;
561     usbredir_free_bufpq(dev, ep);
562 }
563 
564 static int usbredir_handle_bulk_data(USBRedirDevice *dev, USBPacket *p,
565                                       uint8_t ep)
566 {
567     struct usb_redir_bulk_packet_header bulk_packet;
568 
569     DPRINTF("bulk-out ep %02X len %zd id %"PRIu64"\n", ep, p->iov.size, p->id);
570 
571     if (usbredir_already_in_flight(dev, p->id)) {
572         return USB_RET_ASYNC;
573     }
574 
575     bulk_packet.endpoint  = ep;
576     bulk_packet.length    = p->iov.size;
577     bulk_packet.stream_id = 0;
578 
579     if (ep & USB_DIR_IN) {
580         usbredirparser_send_bulk_packet(dev->parser, p->id,
581                                         &bulk_packet, NULL, 0);
582     } else {
583         uint8_t buf[p->iov.size];
584         usb_packet_copy(p, buf, p->iov.size);
585         usbredir_log_data(dev, "bulk data out:", buf, p->iov.size);
586         usbredirparser_send_bulk_packet(dev->parser, p->id,
587                                         &bulk_packet, buf, p->iov.size);
588     }
589     usbredirparser_do_write(dev->parser);
590     return USB_RET_ASYNC;
591 }
592 
593 static int usbredir_handle_interrupt_data(USBRedirDevice *dev,
594                                            USBPacket *p, uint8_t ep)
595 {
596     if (ep & USB_DIR_IN) {
597         /* Input interrupt endpoint, buffered packet input */
598         struct buf_packet *intp;
599         int status, len;
600 
601         if (!dev->endpoint[EP2I(ep)].interrupt_started &&
602                 !dev->endpoint[EP2I(ep)].interrupt_error) {
603             struct usb_redir_start_interrupt_receiving_header start_int = {
604                 .endpoint = ep,
605             };
606             /* No id, we look at the ep when receiving a status back */
607             usbredirparser_send_start_interrupt_receiving(dev->parser, 0,
608                                                           &start_int);
609             usbredirparser_do_write(dev->parser);
610             DPRINTF("interrupt recv started ep %02X\n", ep);
611             dev->endpoint[EP2I(ep)].interrupt_started = 1;
612             /* We don't really want to drop interrupt packets ever, but
613                having some upper limit to how much we buffer is good. */
614             dev->endpoint[EP2I(ep)].bufpq_target_size = 1000;
615             dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
616         }
617 
618         intp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq);
619         if (intp == NULL) {
620             DPRINTF2("interrupt-token-in ep %02X, no intp\n", ep);
621             /* Check interrupt_error for stream errors */
622             status = dev->endpoint[EP2I(ep)].interrupt_error;
623             dev->endpoint[EP2I(ep)].interrupt_error = 0;
624             if (status) {
625                 return usbredir_handle_status(dev, status, 0);
626             }
627             return USB_RET_NAK;
628         }
629         DPRINTF("interrupt-token-in ep %02X status %d len %d\n", ep,
630                 intp->status, intp->len);
631 
632         status = intp->status;
633         if (status != usb_redir_success) {
634             bufp_free(dev, intp, ep);
635             return usbredir_handle_status(dev, status, 0);
636         }
637 
638         len = intp->len;
639         if (len > p->iov.size) {
640             ERROR("received int data is larger then packet ep %02X\n", ep);
641             bufp_free(dev, intp, ep);
642             return USB_RET_BABBLE;
643         }
644         usb_packet_copy(p, intp->data, len);
645         bufp_free(dev, intp, ep);
646         return len;
647     } else {
648         /* Output interrupt endpoint, normal async operation */
649         struct usb_redir_interrupt_packet_header interrupt_packet;
650         uint8_t buf[p->iov.size];
651 
652         DPRINTF("interrupt-out ep %02X len %zd id %"PRIu64"\n", ep,
653                 p->iov.size, p->id);
654 
655         if (usbredir_already_in_flight(dev, p->id)) {
656             return USB_RET_ASYNC;
657         }
658 
659         interrupt_packet.endpoint  = ep;
660         interrupt_packet.length    = p->iov.size;
661 
662         usb_packet_copy(p, buf, p->iov.size);
663         usbredir_log_data(dev, "interrupt data out:", buf, p->iov.size);
664         usbredirparser_send_interrupt_packet(dev->parser, p->id,
665                                         &interrupt_packet, buf, p->iov.size);
666         usbredirparser_do_write(dev->parser);
667         return USB_RET_ASYNC;
668     }
669 }
670 
671 static void usbredir_stop_interrupt_receiving(USBRedirDevice *dev,
672     uint8_t ep)
673 {
674     struct usb_redir_stop_interrupt_receiving_header stop_interrupt_recv = {
675         .endpoint = ep
676     };
677     if (dev->endpoint[EP2I(ep)].interrupt_started) {
678         usbredirparser_send_stop_interrupt_receiving(dev->parser, 0,
679                                                      &stop_interrupt_recv);
680         DPRINTF("interrupt recv stopped ep %02X\n", ep);
681         dev->endpoint[EP2I(ep)].interrupt_started = 0;
682     }
683     dev->endpoint[EP2I(ep)].interrupt_error = 0;
684     usbredir_free_bufpq(dev, ep);
685 }
686 
687 static int usbredir_handle_data(USBDevice *udev, USBPacket *p)
688 {
689     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
690     uint8_t ep;
691 
692     ep = p->ep->nr;
693     if (p->pid == USB_TOKEN_IN) {
694         ep |= USB_DIR_IN;
695     }
696 
697     switch (dev->endpoint[EP2I(ep)].type) {
698     case USB_ENDPOINT_XFER_CONTROL:
699         ERROR("handle_data called for control transfer on ep %02X\n", ep);
700         return USB_RET_NAK;
701     case USB_ENDPOINT_XFER_ISOC:
702         return usbredir_handle_iso_data(dev, p, ep);
703     case USB_ENDPOINT_XFER_BULK:
704         return usbredir_handle_bulk_data(dev, p, ep);
705     case USB_ENDPOINT_XFER_INT:
706         return usbredir_handle_interrupt_data(dev, p, ep);
707     default:
708         ERROR("handle_data ep %02X has unknown type %d\n", ep,
709               dev->endpoint[EP2I(ep)].type);
710         return USB_RET_NAK;
711     }
712 }
713 
714 static int usbredir_set_config(USBRedirDevice *dev, USBPacket *p,
715                                 int config)
716 {
717     struct usb_redir_set_configuration_header set_config;
718     int i;
719 
720     DPRINTF("set config %d id %"PRIu64"\n", config, p->id);
721 
722     for (i = 0; i < MAX_ENDPOINTS; i++) {
723         switch (dev->endpoint[i].type) {
724         case USB_ENDPOINT_XFER_ISOC:
725             usbredir_stop_iso_stream(dev, I2EP(i));
726             break;
727         case USB_ENDPOINT_XFER_INT:
728             if (i & 0x10) {
729                 usbredir_stop_interrupt_receiving(dev, I2EP(i));
730             }
731             break;
732         }
733         usbredir_free_bufpq(dev, I2EP(i));
734     }
735 
736     set_config.configuration = config;
737     usbredirparser_send_set_configuration(dev->parser, p->id, &set_config);
738     usbredirparser_do_write(dev->parser);
739     return USB_RET_ASYNC;
740 }
741 
742 static int usbredir_get_config(USBRedirDevice *dev, USBPacket *p)
743 {
744     DPRINTF("get config id %"PRIu64"\n", p->id);
745 
746     usbredirparser_send_get_configuration(dev->parser, p->id);
747     usbredirparser_do_write(dev->parser);
748     return USB_RET_ASYNC;
749 }
750 
751 static int usbredir_set_interface(USBRedirDevice *dev, USBPacket *p,
752                                    int interface, int alt)
753 {
754     struct usb_redir_set_alt_setting_header set_alt;
755     int i;
756 
757     DPRINTF("set interface %d alt %d id %"PRIu64"\n", interface, alt, p->id);
758 
759     for (i = 0; i < MAX_ENDPOINTS; i++) {
760         if (dev->endpoint[i].interface == interface) {
761             switch (dev->endpoint[i].type) {
762             case USB_ENDPOINT_XFER_ISOC:
763                 usbredir_stop_iso_stream(dev, I2EP(i));
764                 break;
765             case USB_ENDPOINT_XFER_INT:
766                 if (i & 0x10) {
767                     usbredir_stop_interrupt_receiving(dev, I2EP(i));
768                 }
769                 break;
770             }
771             usbredir_free_bufpq(dev, I2EP(i));
772         }
773     }
774 
775     set_alt.interface = interface;
776     set_alt.alt = alt;
777     usbredirparser_send_set_alt_setting(dev->parser, p->id, &set_alt);
778     usbredirparser_do_write(dev->parser);
779     return USB_RET_ASYNC;
780 }
781 
782 static int usbredir_get_interface(USBRedirDevice *dev, USBPacket *p,
783                                    int interface)
784 {
785     struct usb_redir_get_alt_setting_header get_alt;
786 
787     DPRINTF("get interface %d id %"PRIu64"\n", interface, p->id);
788 
789     get_alt.interface = interface;
790     usbredirparser_send_get_alt_setting(dev->parser, p->id, &get_alt);
791     usbredirparser_do_write(dev->parser);
792     return USB_RET_ASYNC;
793 }
794 
795 static int usbredir_handle_control(USBDevice *udev, USBPacket *p,
796         int request, int value, int index, int length, uint8_t *data)
797 {
798     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
799     struct usb_redir_control_packet_header control_packet;
800 
801     if (usbredir_already_in_flight(dev, p->id)) {
802         return USB_RET_ASYNC;
803     }
804 
805     /* Special cases for certain standard device requests */
806     switch (request) {
807     case DeviceOutRequest | USB_REQ_SET_ADDRESS:
808         DPRINTF("set address %d\n", value);
809         dev->dev.addr = value;
810         return 0;
811     case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
812         return usbredir_set_config(dev, p, value & 0xff);
813     case DeviceRequest | USB_REQ_GET_CONFIGURATION:
814         return usbredir_get_config(dev, p);
815     case InterfaceOutRequest | USB_REQ_SET_INTERFACE:
816         return usbredir_set_interface(dev, p, index, value);
817     case InterfaceRequest | USB_REQ_GET_INTERFACE:
818         return usbredir_get_interface(dev, p, index);
819     }
820 
821     /* Normal ctrl requests, note request is (bRequestType << 8) | bRequest */
822     DPRINTF(
823         "ctrl-out type 0x%x req 0x%x val 0x%x index %d len %d id %"PRIu64"\n",
824         request >> 8, request & 0xff, value, index, length, p->id);
825 
826     control_packet.request     = request & 0xFF;
827     control_packet.requesttype = request >> 8;
828     control_packet.endpoint    = control_packet.requesttype & USB_DIR_IN;
829     control_packet.value       = value;
830     control_packet.index       = index;
831     control_packet.length      = length;
832 
833     if (control_packet.requesttype & USB_DIR_IN) {
834         usbredirparser_send_control_packet(dev->parser, p->id,
835                                            &control_packet, NULL, 0);
836     } else {
837         usbredir_log_data(dev, "ctrl data out:", data, length);
838         usbredirparser_send_control_packet(dev->parser, p->id,
839                                            &control_packet, data, length);
840     }
841     usbredirparser_do_write(dev->parser);
842     return USB_RET_ASYNC;
843 }
844 
845 /*
846  * Close events can be triggered by usbredirparser_do_write which gets called
847  * from within the USBDevice data / control packet callbacks and doing a
848  * usb_detach from within these callbacks is not a good idea.
849  *
850  * So we use a bh handler to take care of close events.
851  */
852 static void usbredir_chardev_close_bh(void *opaque)
853 {
854     USBRedirDevice *dev = opaque;
855 
856     usbredir_device_disconnect(dev);
857 
858     if (dev->parser) {
859         DPRINTF("destroying usbredirparser\n");
860         usbredirparser_destroy(dev->parser);
861         dev->parser = NULL;
862     }
863 }
864 
865 static void usbredir_create_parser(USBRedirDevice *dev)
866 {
867     uint32_t caps[USB_REDIR_CAPS_SIZE] = { 0, };
868     int flags = 0;
869 
870     DPRINTF("creating usbredirparser\n");
871 
872     dev->parser = qemu_oom_check(usbredirparser_create());
873     dev->parser->priv = dev;
874     dev->parser->log_func = usbredir_log;
875     dev->parser->read_func = usbredir_read;
876     dev->parser->write_func = usbredir_write;
877     dev->parser->hello_func = usbredir_hello;
878     dev->parser->device_connect_func = usbredir_device_connect;
879     dev->parser->device_disconnect_func = usbredir_device_disconnect;
880     dev->parser->interface_info_func = usbredir_interface_info;
881     dev->parser->ep_info_func = usbredir_ep_info;
882     dev->parser->configuration_status_func = usbredir_configuration_status;
883     dev->parser->alt_setting_status_func = usbredir_alt_setting_status;
884     dev->parser->iso_stream_status_func = usbredir_iso_stream_status;
885     dev->parser->interrupt_receiving_status_func =
886         usbredir_interrupt_receiving_status;
887     dev->parser->bulk_streams_status_func = usbredir_bulk_streams_status;
888     dev->parser->control_packet_func = usbredir_control_packet;
889     dev->parser->bulk_packet_func = usbredir_bulk_packet;
890     dev->parser->iso_packet_func = usbredir_iso_packet;
891     dev->parser->interrupt_packet_func = usbredir_interrupt_packet;
892     dev->read_buf = NULL;
893     dev->read_buf_size = 0;
894 
895     usbredirparser_caps_set_cap(caps, usb_redir_cap_connect_device_version);
896     usbredirparser_caps_set_cap(caps, usb_redir_cap_filter);
897     usbredirparser_caps_set_cap(caps, usb_redir_cap_ep_info_max_packet_size);
898     usbredirparser_caps_set_cap(caps, usb_redir_cap_64bits_ids);
899 
900     if (runstate_check(RUN_STATE_INMIGRATE)) {
901         flags |= usbredirparser_fl_no_hello;
902     }
903     usbredirparser_init(dev->parser, VERSION, caps, USB_REDIR_CAPS_SIZE,
904                         flags);
905     usbredirparser_do_write(dev->parser);
906 }
907 
908 static void usbredir_reject_device(USBRedirDevice *dev)
909 {
910     usbredir_device_disconnect(dev);
911     if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter)) {
912         usbredirparser_send_filter_reject(dev->parser);
913         usbredirparser_do_write(dev->parser);
914     }
915 }
916 
917 static void usbredir_do_attach(void *opaque)
918 {
919     USBRedirDevice *dev = opaque;
920 
921     /* In order to work properly with XHCI controllers we need these caps */
922     if ((dev->dev.port->speedmask & USB_SPEED_MASK_SUPER) && !(
923         usbredirparser_peer_has_cap(dev->parser,
924                                     usb_redir_cap_ep_info_max_packet_size) &&
925         usbredirparser_peer_has_cap(dev->parser,
926                                     usb_redir_cap_64bits_ids))) {
927         ERROR("usb-redir-host lacks capabilities needed for use with XHCI\n");
928         usbredir_reject_device(dev);
929         return;
930     }
931 
932     if (usb_device_attach(&dev->dev) != 0) {
933         usbredir_reject_device(dev);
934     }
935 }
936 
937 /*
938  * chardev callbacks
939  */
940 
941 static int usbredir_chardev_can_read(void *opaque)
942 {
943     USBRedirDevice *dev = opaque;
944 
945     if (!dev->parser) {
946         WARNING("chardev_can_read called on non open chardev!\n");
947         return 0;
948     }
949 
950     /* Don't read new data from the chardev until our state is fully synced */
951     if (!runstate_check(RUN_STATE_RUNNING)) {
952         return 0;
953     }
954 
955     /* usbredir_parser_do_read will consume *all* data we give it */
956     return 1024 * 1024;
957 }
958 
959 static void usbredir_chardev_read(void *opaque, const uint8_t *buf, int size)
960 {
961     USBRedirDevice *dev = opaque;
962 
963     /* No recursion allowed! */
964     assert(dev->read_buf == NULL);
965 
966     dev->read_buf = buf;
967     dev->read_buf_size = size;
968 
969     usbredirparser_do_read(dev->parser);
970     /* Send any acks, etc. which may be queued now */
971     usbredirparser_do_write(dev->parser);
972 }
973 
974 static void usbredir_chardev_event(void *opaque, int event)
975 {
976     USBRedirDevice *dev = opaque;
977 
978     switch (event) {
979     case CHR_EVENT_OPENED:
980         DPRINTF("chardev open\n");
981         /* Make sure any pending closes are handled (no-op if none pending) */
982         usbredir_chardev_close_bh(dev);
983         qemu_bh_cancel(dev->chardev_close_bh);
984         usbredir_create_parser(dev);
985         break;
986     case CHR_EVENT_CLOSED:
987         DPRINTF("chardev close\n");
988         qemu_bh_schedule(dev->chardev_close_bh);
989         break;
990     }
991 }
992 
993 /*
994  * init + destroy
995  */
996 
997 static void usbredir_vm_state_change(void *priv, int running, RunState state)
998 {
999     USBRedirDevice *dev = priv;
1000 
1001     if (state == RUN_STATE_RUNNING && dev->parser != NULL) {
1002         usbredirparser_do_write(dev->parser); /* Flush any pending writes */
1003     }
1004 }
1005 
1006 static int usbredir_initfn(USBDevice *udev)
1007 {
1008     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
1009     int i;
1010 
1011     if (dev->cs == NULL) {
1012         qerror_report(QERR_MISSING_PARAMETER, "chardev");
1013         return -1;
1014     }
1015 
1016     if (dev->filter_str) {
1017         i = usbredirfilter_string_to_rules(dev->filter_str, ":", "|",
1018                                            &dev->filter_rules,
1019                                            &dev->filter_rules_count);
1020         if (i) {
1021             qerror_report(QERR_INVALID_PARAMETER_VALUE, "filter",
1022                           "a usb device filter string");
1023             return -1;
1024         }
1025     }
1026 
1027     dev->chardev_close_bh = qemu_bh_new(usbredir_chardev_close_bh, dev);
1028     dev->attach_timer = qemu_new_timer_ms(vm_clock, usbredir_do_attach, dev);
1029 
1030     packet_id_queue_init(&dev->cancelled, dev, "cancelled");
1031     packet_id_queue_init(&dev->already_in_flight, dev, "already-in-flight");
1032     for (i = 0; i < MAX_ENDPOINTS; i++) {
1033         QTAILQ_INIT(&dev->endpoint[i].bufpq);
1034     }
1035 
1036     /* We'll do the attach once we receive the speed from the usb-host */
1037     udev->auto_attach = 0;
1038 
1039     /* Let the backend know we are ready */
1040     qemu_chr_fe_open(dev->cs);
1041     qemu_chr_add_handlers(dev->cs, usbredir_chardev_can_read,
1042                           usbredir_chardev_read, usbredir_chardev_event, dev);
1043 
1044     qemu_add_vm_change_state_handler(usbredir_vm_state_change, dev);
1045     add_boot_device_path(dev->bootindex, &udev->qdev, NULL);
1046     return 0;
1047 }
1048 
1049 static void usbredir_cleanup_device_queues(USBRedirDevice *dev)
1050 {
1051     int i;
1052 
1053     packet_id_queue_empty(&dev->cancelled);
1054     packet_id_queue_empty(&dev->already_in_flight);
1055     for (i = 0; i < MAX_ENDPOINTS; i++) {
1056         usbredir_free_bufpq(dev, I2EP(i));
1057     }
1058 }
1059 
1060 static void usbredir_handle_destroy(USBDevice *udev)
1061 {
1062     USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
1063 
1064     qemu_chr_fe_close(dev->cs);
1065     qemu_chr_delete(dev->cs);
1066     /* Note must be done after qemu_chr_close, as that causes a close event */
1067     qemu_bh_delete(dev->chardev_close_bh);
1068 
1069     qemu_del_timer(dev->attach_timer);
1070     qemu_free_timer(dev->attach_timer);
1071 
1072     usbredir_cleanup_device_queues(dev);
1073 
1074     if (dev->parser) {
1075         usbredirparser_destroy(dev->parser);
1076     }
1077 
1078     free(dev->filter_rules);
1079 }
1080 
1081 static int usbredir_check_filter(USBRedirDevice *dev)
1082 {
1083     if (dev->interface_info.interface_count == NO_INTERFACE_INFO) {
1084         ERROR("No interface info for device\n");
1085         goto error;
1086     }
1087 
1088     if (dev->filter_rules) {
1089         if (!usbredirparser_peer_has_cap(dev->parser,
1090                                     usb_redir_cap_connect_device_version)) {
1091             ERROR("Device filter specified and peer does not have the "
1092                   "connect_device_version capability\n");
1093             goto error;
1094         }
1095 
1096         if (usbredirfilter_check(
1097                 dev->filter_rules,
1098                 dev->filter_rules_count,
1099                 dev->device_info.device_class,
1100                 dev->device_info.device_subclass,
1101                 dev->device_info.device_protocol,
1102                 dev->interface_info.interface_class,
1103                 dev->interface_info.interface_subclass,
1104                 dev->interface_info.interface_protocol,
1105                 dev->interface_info.interface_count,
1106                 dev->device_info.vendor_id,
1107                 dev->device_info.product_id,
1108                 dev->device_info.device_version_bcd,
1109                 0) != 0) {
1110             goto error;
1111         }
1112     }
1113 
1114     return 0;
1115 
1116 error:
1117     usbredir_reject_device(dev);
1118     return -1;
1119 }
1120 
1121 /*
1122  * usbredirparser packet complete callbacks
1123  */
1124 
1125 static int usbredir_handle_status(USBRedirDevice *dev,
1126                                        int status, int actual_len)
1127 {
1128     switch (status) {
1129     case usb_redir_success:
1130         return actual_len;
1131     case usb_redir_stall:
1132         return USB_RET_STALL;
1133     case usb_redir_cancelled:
1134         /*
1135          * When the usbredir-host unredirects a device, it will report a status
1136          * of cancelled for all pending packets, followed by a disconnect msg.
1137          */
1138         return USB_RET_IOERROR;
1139     case usb_redir_inval:
1140         WARNING("got invalid param error from usb-host?\n");
1141         return USB_RET_IOERROR;
1142     case usb_redir_babble:
1143         return USB_RET_BABBLE;
1144     case usb_redir_ioerror:
1145     case usb_redir_timeout:
1146     default:
1147         return USB_RET_IOERROR;
1148     }
1149 }
1150 
1151 static void usbredir_hello(void *priv, struct usb_redir_hello_header *h)
1152 {
1153     USBRedirDevice *dev = priv;
1154 
1155     /* Try to send the filter info now that we've the usb-host's caps */
1156     if (usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_filter) &&
1157             dev->filter_rules) {
1158         usbredirparser_send_filter_filter(dev->parser, dev->filter_rules,
1159                                           dev->filter_rules_count);
1160         usbredirparser_do_write(dev->parser);
1161     }
1162 }
1163 
1164 static void usbredir_device_connect(void *priv,
1165     struct usb_redir_device_connect_header *device_connect)
1166 {
1167     USBRedirDevice *dev = priv;
1168     const char *speed;
1169 
1170     if (qemu_timer_pending(dev->attach_timer) || dev->dev.attached) {
1171         ERROR("Received device connect while already connected\n");
1172         return;
1173     }
1174 
1175     switch (device_connect->speed) {
1176     case usb_redir_speed_low:
1177         speed = "low speed";
1178         dev->dev.speed = USB_SPEED_LOW;
1179         break;
1180     case usb_redir_speed_full:
1181         speed = "full speed";
1182         dev->dev.speed = USB_SPEED_FULL;
1183         break;
1184     case usb_redir_speed_high:
1185         speed = "high speed";
1186         dev->dev.speed = USB_SPEED_HIGH;
1187         break;
1188     case usb_redir_speed_super:
1189         speed = "super speed";
1190         dev->dev.speed = USB_SPEED_SUPER;
1191         break;
1192     default:
1193         speed = "unknown speed";
1194         dev->dev.speed = USB_SPEED_FULL;
1195     }
1196 
1197     if (usbredirparser_peer_has_cap(dev->parser,
1198                                     usb_redir_cap_connect_device_version)) {
1199         INFO("attaching %s device %04x:%04x version %d.%d class %02x\n",
1200              speed, device_connect->vendor_id, device_connect->product_id,
1201              ((device_connect->device_version_bcd & 0xf000) >> 12) * 10 +
1202              ((device_connect->device_version_bcd & 0x0f00) >>  8),
1203              ((device_connect->device_version_bcd & 0x00f0) >>  4) * 10 +
1204              ((device_connect->device_version_bcd & 0x000f) >>  0),
1205              device_connect->device_class);
1206     } else {
1207         INFO("attaching %s device %04x:%04x class %02x\n", speed,
1208              device_connect->vendor_id, device_connect->product_id,
1209              device_connect->device_class);
1210     }
1211 
1212     dev->dev.speedmask = (1 << dev->dev.speed);
1213     dev->device_info = *device_connect;
1214 
1215     if (usbredir_check_filter(dev)) {
1216         WARNING("Device %04x:%04x rejected by device filter, not attaching\n",
1217                 device_connect->vendor_id, device_connect->product_id);
1218         return;
1219     }
1220 
1221     qemu_mod_timer(dev->attach_timer, dev->next_attach_time);
1222 }
1223 
1224 static void usbredir_device_disconnect(void *priv)
1225 {
1226     USBRedirDevice *dev = priv;
1227     int i;
1228 
1229     /* Stop any pending attaches */
1230     qemu_del_timer(dev->attach_timer);
1231 
1232     if (dev->dev.attached) {
1233         DPRINTF("detaching device\n");
1234         usb_device_detach(&dev->dev);
1235         /*
1236          * Delay next usb device attach to give the guest a chance to see
1237          * see the detach / attach in case of quick close / open succession
1238          */
1239         dev->next_attach_time = qemu_get_clock_ms(vm_clock) + 200;
1240     }
1241 
1242     /* Reset state so that the next dev connected starts with a clean slate */
1243     usbredir_cleanup_device_queues(dev);
1244     memset(dev->endpoint, 0, sizeof(dev->endpoint));
1245     for (i = 0; i < MAX_ENDPOINTS; i++) {
1246         QTAILQ_INIT(&dev->endpoint[i].bufpq);
1247     }
1248     usb_ep_init(&dev->dev);
1249     dev->interface_info.interface_count = NO_INTERFACE_INFO;
1250     dev->dev.addr = 0;
1251     dev->dev.speed = 0;
1252 }
1253 
1254 static void usbredir_interface_info(void *priv,
1255     struct usb_redir_interface_info_header *interface_info)
1256 {
1257     USBRedirDevice *dev = priv;
1258 
1259     dev->interface_info = *interface_info;
1260 
1261     /*
1262      * If we receive interface info after the device has already been
1263      * connected (ie on a set_config), re-check the filter.
1264      */
1265     if (qemu_timer_pending(dev->attach_timer) || dev->dev.attached) {
1266         if (usbredir_check_filter(dev)) {
1267             ERROR("Device no longer matches filter after interface info "
1268                   "change, disconnecting!\n");
1269         }
1270     }
1271 }
1272 
1273 static void usbredir_set_pipeline(USBRedirDevice *dev, struct USBEndpoint *uep)
1274 {
1275     if (uep->type != USB_ENDPOINT_XFER_BULK) {
1276         return;
1277     }
1278     if (uep->pid == USB_TOKEN_OUT) {
1279         uep->pipeline = true;
1280     }
1281 }
1282 
1283 static void usbredir_ep_info(void *priv,
1284     struct usb_redir_ep_info_header *ep_info)
1285 {
1286     USBRedirDevice *dev = priv;
1287     struct USBEndpoint *usb_ep;
1288     int i;
1289 
1290     for (i = 0; i < MAX_ENDPOINTS; i++) {
1291         dev->endpoint[i].type = ep_info->type[i];
1292         dev->endpoint[i].interval = ep_info->interval[i];
1293         dev->endpoint[i].interface = ep_info->interface[i];
1294         switch (dev->endpoint[i].type) {
1295         case usb_redir_type_invalid:
1296             break;
1297         case usb_redir_type_iso:
1298         case usb_redir_type_interrupt:
1299             if (dev->endpoint[i].interval == 0) {
1300                 ERROR("Received 0 interval for isoc or irq endpoint\n");
1301                 usbredir_device_disconnect(dev);
1302             }
1303             /* Fall through */
1304         case usb_redir_type_control:
1305         case usb_redir_type_bulk:
1306             DPRINTF("ep: %02X type: %d interface: %d\n", I2EP(i),
1307                     dev->endpoint[i].type, dev->endpoint[i].interface);
1308             break;
1309         default:
1310             ERROR("Received invalid endpoint type\n");
1311             usbredir_device_disconnect(dev);
1312             return;
1313         }
1314         usb_ep = usb_ep_get(&dev->dev,
1315                             (i & 0x10) ? USB_TOKEN_IN : USB_TOKEN_OUT,
1316                             i & 0x0f);
1317         usb_ep->type = dev->endpoint[i].type;
1318         usb_ep->ifnum = dev->endpoint[i].interface;
1319         if (usbredirparser_peer_has_cap(dev->parser,
1320                                      usb_redir_cap_ep_info_max_packet_size)) {
1321             dev->endpoint[i].max_packet_size =
1322                 usb_ep->max_packet_size = ep_info->max_packet_size[i];
1323         }
1324         usbredir_set_pipeline(dev, usb_ep);
1325     }
1326 }
1327 
1328 static void usbredir_configuration_status(void *priv, uint64_t id,
1329     struct usb_redir_configuration_status_header *config_status)
1330 {
1331     USBRedirDevice *dev = priv;
1332     USBPacket *p;
1333     int len = 0;
1334 
1335     DPRINTF("set config status %d config %d id %"PRIu64"\n",
1336             config_status->status, config_status->configuration, id);
1337 
1338     p = usbredir_find_packet_by_id(dev, 0, id);
1339     if (p) {
1340         if (dev->dev.setup_buf[0] & USB_DIR_IN) {
1341             dev->dev.data_buf[0] = config_status->configuration;
1342             len = 1;
1343         }
1344         p->result = usbredir_handle_status(dev, config_status->status, len);
1345         usb_generic_async_ctrl_complete(&dev->dev, p);
1346     }
1347 }
1348 
1349 static void usbredir_alt_setting_status(void *priv, uint64_t id,
1350     struct usb_redir_alt_setting_status_header *alt_setting_status)
1351 {
1352     USBRedirDevice *dev = priv;
1353     USBPacket *p;
1354     int len = 0;
1355 
1356     DPRINTF("alt status %d intf %d alt %d id: %"PRIu64"\n",
1357             alt_setting_status->status, alt_setting_status->interface,
1358             alt_setting_status->alt, id);
1359 
1360     p = usbredir_find_packet_by_id(dev, 0, id);
1361     if (p) {
1362         if (dev->dev.setup_buf[0] & USB_DIR_IN) {
1363             dev->dev.data_buf[0] = alt_setting_status->alt;
1364             len = 1;
1365         }
1366         p->result =
1367             usbredir_handle_status(dev, alt_setting_status->status, len);
1368         usb_generic_async_ctrl_complete(&dev->dev, p);
1369     }
1370 }
1371 
1372 static void usbredir_iso_stream_status(void *priv, uint64_t id,
1373     struct usb_redir_iso_stream_status_header *iso_stream_status)
1374 {
1375     USBRedirDevice *dev = priv;
1376     uint8_t ep = iso_stream_status->endpoint;
1377 
1378     DPRINTF("iso status %d ep %02X id %"PRIu64"\n", iso_stream_status->status,
1379             ep, id);
1380 
1381     if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].iso_started) {
1382         return;
1383     }
1384 
1385     dev->endpoint[EP2I(ep)].iso_error = iso_stream_status->status;
1386     if (iso_stream_status->status == usb_redir_stall) {
1387         DPRINTF("iso stream stopped by peer ep %02X\n", ep);
1388         dev->endpoint[EP2I(ep)].iso_started = 0;
1389     }
1390 }
1391 
1392 static void usbredir_interrupt_receiving_status(void *priv, uint64_t id,
1393     struct usb_redir_interrupt_receiving_status_header
1394     *interrupt_receiving_status)
1395 {
1396     USBRedirDevice *dev = priv;
1397     uint8_t ep = interrupt_receiving_status->endpoint;
1398 
1399     DPRINTF("interrupt recv status %d ep %02X id %"PRIu64"\n",
1400             interrupt_receiving_status->status, ep, id);
1401 
1402     if (!dev->dev.attached || !dev->endpoint[EP2I(ep)].interrupt_started) {
1403         return;
1404     }
1405 
1406     dev->endpoint[EP2I(ep)].interrupt_error =
1407         interrupt_receiving_status->status;
1408     if (interrupt_receiving_status->status == usb_redir_stall) {
1409         DPRINTF("interrupt receiving stopped by peer ep %02X\n", ep);
1410         dev->endpoint[EP2I(ep)].interrupt_started = 0;
1411     }
1412 }
1413 
1414 static void usbredir_bulk_streams_status(void *priv, uint64_t id,
1415     struct usb_redir_bulk_streams_status_header *bulk_streams_status)
1416 {
1417 }
1418 
1419 static void usbredir_control_packet(void *priv, uint64_t id,
1420     struct usb_redir_control_packet_header *control_packet,
1421     uint8_t *data, int data_len)
1422 {
1423     USBRedirDevice *dev = priv;
1424     USBPacket *p;
1425     int len = control_packet->length;
1426 
1427     DPRINTF("ctrl-in status %d len %d id %"PRIu64"\n", control_packet->status,
1428             len, id);
1429 
1430     p = usbredir_find_packet_by_id(dev, 0, id);
1431     if (p) {
1432         len = usbredir_handle_status(dev, control_packet->status, len);
1433         if (len > 0) {
1434             usbredir_log_data(dev, "ctrl data in:", data, data_len);
1435             if (data_len <= sizeof(dev->dev.data_buf)) {
1436                 memcpy(dev->dev.data_buf, data, data_len);
1437             } else {
1438                 ERROR("ctrl buffer too small (%d > %zu)\n",
1439                       data_len, sizeof(dev->dev.data_buf));
1440                 len = USB_RET_STALL;
1441             }
1442         }
1443         p->result = len;
1444         usb_generic_async_ctrl_complete(&dev->dev, p);
1445     }
1446     free(data);
1447 }
1448 
1449 static void usbredir_bulk_packet(void *priv, uint64_t id,
1450     struct usb_redir_bulk_packet_header *bulk_packet,
1451     uint8_t *data, int data_len)
1452 {
1453     USBRedirDevice *dev = priv;
1454     uint8_t ep = bulk_packet->endpoint;
1455     int len = bulk_packet->length;
1456     USBPacket *p;
1457 
1458     DPRINTF("bulk-in status %d ep %02X len %d id %"PRIu64"\n",
1459             bulk_packet->status, ep, len, id);
1460 
1461     p = usbredir_find_packet_by_id(dev, ep, id);
1462     if (p) {
1463         len = usbredir_handle_status(dev, bulk_packet->status, len);
1464         if (len > 0) {
1465             usbredir_log_data(dev, "bulk data in:", data, data_len);
1466             if (data_len <= p->iov.size) {
1467                 usb_packet_copy(p, data, data_len);
1468             } else {
1469                 ERROR("bulk got more data then requested (%d > %zd)\n",
1470                       data_len, p->iov.size);
1471                 len = USB_RET_BABBLE;
1472             }
1473         }
1474         p->result = len;
1475         usb_packet_complete(&dev->dev, p);
1476     }
1477     free(data);
1478 }
1479 
1480 static void usbredir_iso_packet(void *priv, uint64_t id,
1481     struct usb_redir_iso_packet_header *iso_packet,
1482     uint8_t *data, int data_len)
1483 {
1484     USBRedirDevice *dev = priv;
1485     uint8_t ep = iso_packet->endpoint;
1486 
1487     DPRINTF2("iso-in status %d ep %02X len %d id %"PRIu64"\n",
1488              iso_packet->status, ep, data_len, id);
1489 
1490     if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_ISOC) {
1491         ERROR("received iso packet for non iso endpoint %02X\n", ep);
1492         free(data);
1493         return;
1494     }
1495 
1496     if (dev->endpoint[EP2I(ep)].iso_started == 0) {
1497         DPRINTF("received iso packet for non started stream ep %02X\n", ep);
1498         free(data);
1499         return;
1500     }
1501 
1502     /* bufp_alloc also adds the packet to the ep queue */
1503     bufp_alloc(dev, data, data_len, iso_packet->status, ep);
1504 }
1505 
1506 static void usbredir_interrupt_packet(void *priv, uint64_t id,
1507     struct usb_redir_interrupt_packet_header *interrupt_packet,
1508     uint8_t *data, int data_len)
1509 {
1510     USBRedirDevice *dev = priv;
1511     uint8_t ep = interrupt_packet->endpoint;
1512 
1513     DPRINTF("interrupt-in status %d ep %02X len %d id %"PRIu64"\n",
1514             interrupt_packet->status, ep, data_len, id);
1515 
1516     if (dev->endpoint[EP2I(ep)].type != USB_ENDPOINT_XFER_INT) {
1517         ERROR("received int packet for non interrupt endpoint %02X\n", ep);
1518         free(data);
1519         return;
1520     }
1521 
1522     if (ep & USB_DIR_IN) {
1523         if (dev->endpoint[EP2I(ep)].interrupt_started == 0) {
1524             DPRINTF("received int packet while not started ep %02X\n", ep);
1525             free(data);
1526             return;
1527         }
1528 
1529         /* bufp_alloc also adds the packet to the ep queue */
1530         bufp_alloc(dev, data, data_len, interrupt_packet->status, ep);
1531     } else {
1532         int len = interrupt_packet->length;
1533 
1534         USBPacket *p = usbredir_find_packet_by_id(dev, ep, id);
1535         if (p) {
1536             p->result = usbredir_handle_status(dev,
1537                                                interrupt_packet->status, len);
1538             usb_packet_complete(&dev->dev, p);
1539         }
1540     }
1541 }
1542 
1543 /*
1544  * Migration code
1545  */
1546 
1547 static void usbredir_pre_save(void *priv)
1548 {
1549     USBRedirDevice *dev = priv;
1550 
1551     usbredir_fill_already_in_flight(dev);
1552 }
1553 
1554 static int usbredir_post_load(void *priv, int version_id)
1555 {
1556     USBRedirDevice *dev = priv;
1557     struct USBEndpoint *usb_ep;
1558     int i;
1559 
1560     switch (dev->device_info.speed) {
1561     case usb_redir_speed_low:
1562         dev->dev.speed = USB_SPEED_LOW;
1563         break;
1564     case usb_redir_speed_full:
1565         dev->dev.speed = USB_SPEED_FULL;
1566         break;
1567     case usb_redir_speed_high:
1568         dev->dev.speed = USB_SPEED_HIGH;
1569         break;
1570     case usb_redir_speed_super:
1571         dev->dev.speed = USB_SPEED_SUPER;
1572         break;
1573     default:
1574         dev->dev.speed = USB_SPEED_FULL;
1575     }
1576     dev->dev.speedmask = (1 << dev->dev.speed);
1577 
1578     for (i = 0; i < MAX_ENDPOINTS; i++) {
1579         usb_ep = usb_ep_get(&dev->dev,
1580                             (i & 0x10) ? USB_TOKEN_IN : USB_TOKEN_OUT,
1581                             i & 0x0f);
1582         usb_ep->type = dev->endpoint[i].type;
1583         usb_ep->ifnum = dev->endpoint[i].interface;
1584         usb_ep->max_packet_size = dev->endpoint[i].max_packet_size;
1585         usbredir_set_pipeline(dev, usb_ep);
1586     }
1587     return 0;
1588 }
1589 
1590 /* For usbredirparser migration */
1591 static void usbredir_put_parser(QEMUFile *f, void *priv, size_t unused)
1592 {
1593     USBRedirDevice *dev = priv;
1594     uint8_t *data;
1595     int len;
1596 
1597     if (dev->parser == NULL) {
1598         qemu_put_be32(f, 0);
1599         return;
1600     }
1601 
1602     usbredirparser_serialize(dev->parser, &data, &len);
1603     qemu_oom_check(data);
1604 
1605     qemu_put_be32(f, len);
1606     qemu_put_buffer(f, data, len);
1607 
1608     free(data);
1609 }
1610 
1611 static int usbredir_get_parser(QEMUFile *f, void *priv, size_t unused)
1612 {
1613     USBRedirDevice *dev = priv;
1614     uint8_t *data;
1615     int len, ret;
1616 
1617     len = qemu_get_be32(f);
1618     if (len == 0) {
1619         return 0;
1620     }
1621 
1622     /*
1623      * If our chardev is not open already at this point the usbredir connection
1624      * has been broken (non seamless migration, or restore from disk).
1625      *
1626      * In this case create a temporary parser to receive the migration data,
1627      * and schedule the close_bh to report the device as disconnected to the
1628      * guest and to destroy the parser again.
1629      */
1630     if (dev->parser == NULL) {
1631         WARNING("usb-redir connection broken during migration\n");
1632         usbredir_create_parser(dev);
1633         qemu_bh_schedule(dev->chardev_close_bh);
1634     }
1635 
1636     data = g_malloc(len);
1637     qemu_get_buffer(f, data, len);
1638 
1639     ret = usbredirparser_unserialize(dev->parser, data, len);
1640 
1641     g_free(data);
1642 
1643     return ret;
1644 }
1645 
1646 static const VMStateInfo usbredir_parser_vmstate_info = {
1647     .name = "usb-redir-parser",
1648     .put  = usbredir_put_parser,
1649     .get  = usbredir_get_parser,
1650 };
1651 
1652 
1653 /* For buffered packets (iso/irq) queue migration */
1654 static void usbredir_put_bufpq(QEMUFile *f, void *priv, size_t unused)
1655 {
1656     struct endp_data *endp = priv;
1657     struct buf_packet *bufp;
1658     int remain = endp->bufpq_size;
1659 
1660     qemu_put_be32(f, endp->bufpq_size);
1661     QTAILQ_FOREACH(bufp, &endp->bufpq, next) {
1662         qemu_put_be32(f, bufp->len);
1663         qemu_put_be32(f, bufp->status);
1664         qemu_put_buffer(f, bufp->data, bufp->len);
1665         remain--;
1666     }
1667     assert(remain == 0);
1668 }
1669 
1670 static int usbredir_get_bufpq(QEMUFile *f, void *priv, size_t unused)
1671 {
1672     struct endp_data *endp = priv;
1673     struct buf_packet *bufp;
1674     int i;
1675 
1676     endp->bufpq_size = qemu_get_be32(f);
1677     for (i = 0; i < endp->bufpq_size; i++) {
1678         bufp = g_malloc(sizeof(struct buf_packet));
1679         bufp->len = qemu_get_be32(f);
1680         bufp->status = qemu_get_be32(f);
1681         bufp->data = qemu_oom_check(malloc(bufp->len)); /* regular malloc! */
1682         qemu_get_buffer(f, bufp->data, bufp->len);
1683         QTAILQ_INSERT_TAIL(&endp->bufpq, bufp, next);
1684     }
1685     return 0;
1686 }
1687 
1688 static const VMStateInfo usbredir_ep_bufpq_vmstate_info = {
1689     .name = "usb-redir-bufpq",
1690     .put  = usbredir_put_bufpq,
1691     .get  = usbredir_get_bufpq,
1692 };
1693 
1694 
1695 /* For endp_data migration */
1696 static const VMStateDescription usbredir_ep_vmstate = {
1697     .name = "usb-redir-ep",
1698     .version_id = 1,
1699     .minimum_version_id = 1,
1700     .fields = (VMStateField[]) {
1701         VMSTATE_UINT8(type, struct endp_data),
1702         VMSTATE_UINT8(interval, struct endp_data),
1703         VMSTATE_UINT8(interface, struct endp_data),
1704         VMSTATE_UINT16(max_packet_size, struct endp_data),
1705         VMSTATE_UINT8(iso_started, struct endp_data),
1706         VMSTATE_UINT8(iso_error, struct endp_data),
1707         VMSTATE_UINT8(interrupt_started, struct endp_data),
1708         VMSTATE_UINT8(interrupt_error, struct endp_data),
1709         VMSTATE_UINT8(bufpq_prefilled, struct endp_data),
1710         VMSTATE_UINT8(bufpq_dropping_packets, struct endp_data),
1711         {
1712             .name         = "bufpq",
1713             .version_id   = 0,
1714             .field_exists = NULL,
1715             .size         = 0,
1716             .info         = &usbredir_ep_bufpq_vmstate_info,
1717             .flags        = VMS_SINGLE,
1718             .offset       = 0,
1719         },
1720         VMSTATE_INT32(bufpq_target_size, struct endp_data),
1721         VMSTATE_END_OF_LIST()
1722     }
1723 };
1724 
1725 
1726 /* For PacketIdQueue migration */
1727 static void usbredir_put_packet_id_q(QEMUFile *f, void *priv, size_t unused)
1728 {
1729     struct PacketIdQueue *q = priv;
1730     USBRedirDevice *dev = q->dev;
1731     struct PacketIdQueueEntry *e;
1732     int remain = q->size;
1733 
1734     DPRINTF("put_packet_id_q %s size %d\n", q->name, q->size);
1735     qemu_put_be32(f, q->size);
1736     QTAILQ_FOREACH(e, &q->head, next) {
1737         qemu_put_be64(f, e->id);
1738         remain--;
1739     }
1740     assert(remain == 0);
1741 }
1742 
1743 static int usbredir_get_packet_id_q(QEMUFile *f, void *priv, size_t unused)
1744 {
1745     struct PacketIdQueue *q = priv;
1746     USBRedirDevice *dev = q->dev;
1747     int i, size;
1748     uint64_t id;
1749 
1750     size = qemu_get_be32(f);
1751     DPRINTF("get_packet_id_q %s size %d\n", q->name, size);
1752     for (i = 0; i < size; i++) {
1753         id = qemu_get_be64(f);
1754         packet_id_queue_add(q, id);
1755     }
1756     assert(q->size == size);
1757     return 0;
1758 }
1759 
1760 static const VMStateInfo usbredir_ep_packet_id_q_vmstate_info = {
1761     .name = "usb-redir-packet-id-q",
1762     .put  = usbredir_put_packet_id_q,
1763     .get  = usbredir_get_packet_id_q,
1764 };
1765 
1766 static const VMStateDescription usbredir_ep_packet_id_queue_vmstate = {
1767     .name = "usb-redir-packet-id-queue",
1768     .version_id = 1,
1769     .minimum_version_id = 1,
1770     .fields = (VMStateField[]) {
1771         {
1772             .name         = "queue",
1773             .version_id   = 0,
1774             .field_exists = NULL,
1775             .size         = 0,
1776             .info         = &usbredir_ep_packet_id_q_vmstate_info,
1777             .flags        = VMS_SINGLE,
1778             .offset       = 0,
1779         },
1780         VMSTATE_END_OF_LIST()
1781     }
1782 };
1783 
1784 
1785 /* For usb_redir_device_connect_header migration */
1786 static const VMStateDescription usbredir_device_info_vmstate = {
1787     .name = "usb-redir-device-info",
1788     .version_id = 1,
1789     .minimum_version_id = 1,
1790     .fields = (VMStateField[]) {
1791         VMSTATE_UINT8(speed, struct usb_redir_device_connect_header),
1792         VMSTATE_UINT8(device_class, struct usb_redir_device_connect_header),
1793         VMSTATE_UINT8(device_subclass, struct usb_redir_device_connect_header),
1794         VMSTATE_UINT8(device_protocol, struct usb_redir_device_connect_header),
1795         VMSTATE_UINT16(vendor_id, struct usb_redir_device_connect_header),
1796         VMSTATE_UINT16(product_id, struct usb_redir_device_connect_header),
1797         VMSTATE_UINT16(device_version_bcd,
1798                        struct usb_redir_device_connect_header),
1799         VMSTATE_END_OF_LIST()
1800     }
1801 };
1802 
1803 
1804 /* For usb_redir_interface_info_header migration */
1805 static const VMStateDescription usbredir_interface_info_vmstate = {
1806     .name = "usb-redir-interface-info",
1807     .version_id = 1,
1808     .minimum_version_id = 1,
1809     .fields = (VMStateField[]) {
1810         VMSTATE_UINT32(interface_count,
1811                        struct usb_redir_interface_info_header),
1812         VMSTATE_UINT8_ARRAY(interface,
1813                             struct usb_redir_interface_info_header, 32),
1814         VMSTATE_UINT8_ARRAY(interface_class,
1815                             struct usb_redir_interface_info_header, 32),
1816         VMSTATE_UINT8_ARRAY(interface_subclass,
1817                             struct usb_redir_interface_info_header, 32),
1818         VMSTATE_UINT8_ARRAY(interface_protocol,
1819                             struct usb_redir_interface_info_header, 32),
1820         VMSTATE_END_OF_LIST()
1821     }
1822 };
1823 
1824 
1825 /* And finally the USBRedirDevice vmstate itself */
1826 static const VMStateDescription usbredir_vmstate = {
1827     .name = "usb-redir",
1828     .version_id = 1,
1829     .minimum_version_id = 1,
1830     .pre_save = usbredir_pre_save,
1831     .post_load = usbredir_post_load,
1832     .fields = (VMStateField[]) {
1833         VMSTATE_USB_DEVICE(dev, USBRedirDevice),
1834         VMSTATE_TIMER(attach_timer, USBRedirDevice),
1835         {
1836             .name         = "parser",
1837             .version_id   = 0,
1838             .field_exists = NULL,
1839             .size         = 0,
1840             .info         = &usbredir_parser_vmstate_info,
1841             .flags        = VMS_SINGLE,
1842             .offset       = 0,
1843         },
1844         VMSTATE_STRUCT_ARRAY(endpoint, USBRedirDevice, MAX_ENDPOINTS, 1,
1845                              usbredir_ep_vmstate, struct endp_data),
1846         VMSTATE_STRUCT(cancelled, USBRedirDevice, 1,
1847                        usbredir_ep_packet_id_queue_vmstate,
1848                        struct PacketIdQueue),
1849         VMSTATE_STRUCT(already_in_flight, USBRedirDevice, 1,
1850                        usbredir_ep_packet_id_queue_vmstate,
1851                        struct PacketIdQueue),
1852         VMSTATE_STRUCT(device_info, USBRedirDevice, 1,
1853                        usbredir_device_info_vmstate,
1854                        struct usb_redir_device_connect_header),
1855         VMSTATE_STRUCT(interface_info, USBRedirDevice, 1,
1856                        usbredir_interface_info_vmstate,
1857                        struct usb_redir_interface_info_header),
1858         VMSTATE_END_OF_LIST()
1859     }
1860 };
1861 
1862 static Property usbredir_properties[] = {
1863     DEFINE_PROP_CHR("chardev", USBRedirDevice, cs),
1864     DEFINE_PROP_UINT8("debug", USBRedirDevice, debug, 0),
1865     DEFINE_PROP_STRING("filter", USBRedirDevice, filter_str),
1866     DEFINE_PROP_INT32("bootindex", USBRedirDevice, bootindex, -1),
1867     DEFINE_PROP_END_OF_LIST(),
1868 };
1869 
1870 static void usbredir_class_initfn(ObjectClass *klass, void *data)
1871 {
1872     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
1873     DeviceClass *dc = DEVICE_CLASS(klass);
1874 
1875     uc->init           = usbredir_initfn;
1876     uc->product_desc   = "USB Redirection Device";
1877     uc->handle_destroy = usbredir_handle_destroy;
1878     uc->cancel_packet  = usbredir_cancel_packet;
1879     uc->handle_reset   = usbredir_handle_reset;
1880     uc->handle_data    = usbredir_handle_data;
1881     uc->handle_control = usbredir_handle_control;
1882     dc->vmsd           = &usbredir_vmstate;
1883     dc->props          = usbredir_properties;
1884 }
1885 
1886 static TypeInfo usbredir_dev_info = {
1887     .name          = "usb-redir",
1888     .parent        = TYPE_USB_DEVICE,
1889     .instance_size = sizeof(USBRedirDevice),
1890     .class_init    = usbredir_class_initfn,
1891 };
1892 
1893 static void usbredir_register_types(void)
1894 {
1895     type_register_static(&usbredir_dev_info);
1896 }
1897 
1898 type_init(usbredir_register_types)
1899